heyiam 0.2.29 → 0.3.1

package/dist/routes/settings.js

@@ -1,6 +1,11 @@
 import { Router } from 'express';
-import { saveAnthropicApiKey, clearAnthropicApiKey, getAnthropicApiKey } from '../settings.js';
+import { existsSync } from 'node:fs';
+import { saveAnthropicApiKey, clearAnthropicApiKey, getAnthropicApiKey, getSettings, setDefaultTemplate, getPortfolioProfile, savePortfolioProfile, isTranscriptIncluded, setTranscriptIncluded } from '../settings.js';
+import { invalidatePortfolioPreviewCache } from './preview.js';
 import { hasApiKey } from '../llm/index.js';
+import { isValidTemplate, DEFAULT_TEMPLATE, BUILT_IN_TEMPLATES } from '../render/templates.js';
+import { getDbPath } from '../db.js';
+import { getDaemonBinaryPath } from '../daemon-install.js';
 export function createSettingsRouter(_ctx) {
     const router = Router();
     // Save or clear the Anthropic API key
@@ -25,5 +30,193 @@ export function createSettingsRouter(_ctx) {
             maskedKey: key ? `...${key.slice(-4)}` : null,
         });
     });
+    // List available templates
+    router.get('/api/templates', (_req, res) => {
+        const templates = BUILT_IN_TEMPLATES.map((t) => ({
+            name: t.name,
+            label: t.label,
+            description: t.description,
+            accent: t.accent,
+            mode: t.mode,
+            tags: t.tags,
+            builtIn: true,
+        }));
+        res.json({ templates });
+    });
+    // Get current portfolio theme
+    router.get('/api/settings/theme', (_req, res) => {
+        const settings = getSettings();
+        res.json({ template: settings.defaultTemplate ?? DEFAULT_TEMPLATE });
+    });
+    // Set portfolio theme
+    router.post('/api/settings/theme', (req, res) => {
+        const { template } = req.body;
+        if (!template || !isValidTemplate(template)) {
+            res.status(400).json({ error: 'Invalid template name' });
+            return;
+        }
+        setDefaultTemplate(template);
+        invalidatePortfolioPreviewCache();
+        console.log(`[settings] Portfolio theme set to: ${template}`);
+        res.json({ ok: true, template });
+    });
+    // ── Per-session transcript toggle (publish-time, CLI-only) ───
+    //
+    // GET /api/sessions/:sessionId/transcript-setting — returns whether the
+    // session transcript will be included in the next publish. Defaults to
+    // true.
+    //
+    // PUT /api/sessions/:sessionId/transcript-setting { included: boolean }
+    // — flips the flag. When `false`, publish.ts skips all S3 transcript
+    // uploads and strips transcript-derived fields from the uploaded
+    // session JSON.
+    router.get('/api/sessions/:sessionId/transcript-setting', (req, res) => {
+        const sessionId = typeof req.params.sessionId === 'string' ? req.params.sessionId.trim() : '';
+        if (!sessionId || sessionId.length > 200) {
+            res.status(400).json({ error: { code: 'INVALID_PARAM', message: 'sessionId is required' } });
+            return;
+        }
+        res.json({ sessionId, included: isTranscriptIncluded(sessionId) });
+    });
+    router.put('/api/sessions/:sessionId/transcript-setting', (req, res) => {
+        const sessionId = typeof req.params.sessionId === 'string' ? req.params.sessionId.trim() : '';
+        if (!sessionId || sessionId.length > 200) {
+            res.status(400).json({ error: { code: 'INVALID_PARAM', message: 'sessionId is required' } });
+            return;
+        }
+        const body = req.body;
+        if (typeof body?.included !== 'boolean') {
+            res.status(400).json({ error: { code: 'INVALID_BODY', message: 'included must be a boolean' } });
+            return;
+        }
+        setTranscriptIncluded(sessionId, body.included);
+        res.json({ ok: true, sessionId, included: body.included });
+    });
+    // Get portfolio profile data
+    router.get('/api/portfolio', (_req, res) => {
+        res.json(getPortfolioProfile());
+    });
+    // Save portfolio profile data
+    router.post('/api/portfolio', (req, res) => {
+        const body = req.body;
+        if (!body || typeof body !== 'object' || Array.isArray(body)) {
+            res.status(400).json({ error: { code: 'INVALID_BODY', message: 'Request body must be a JSON object' } });
+            return;
+        }
+        const ALLOWED_FIELDS = [
+            'displayName', 'bio', 'photoBase64', 'location', 'email', 'phone',
+            'linkedinUrl', 'githubUrl', 'twitterHandle', 'websiteUrl',
+            'resumeBase64', 'resumeFilename', 'accent',
+        ];
+        const errors = [];
+        // Structural validation: only allow known string fields
+        const cleaned = {};
+        for (const key of ALLOWED_FIELDS) {
+            const val = body[key];
+            if (val === undefined || val === null || val === '')
+                continue;
+            if (typeof val !== 'string') {
+                errors.push({ field: key, message: `${key} must be a string` });
+                continue;
+            }
+            cleaned[key] = val;
+        }
+        // Length limits
+        if (cleaned.displayName && cleaned.displayName.length > 200) {
+            errors.push({ field: 'displayName', message: 'Display name must be under 200 characters' });
+        }
+        if (cleaned.bio && cleaned.bio.length > 2000) {
+            errors.push({ field: 'bio', message: 'Bio must be under 2000 characters' });
+        }
+        if (cleaned.email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(cleaned.email)) {
+            errors.push({ field: 'email', message: 'Invalid email format' });
+        }
+        if (cleaned.linkedinUrl && !cleaned.linkedinUrl.startsWith('http')) {
+            errors.push({ field: 'linkedinUrl', message: 'LinkedIn URL must start with http' });
+        }
+        if (cleaned.githubUrl && !cleaned.githubUrl.startsWith('http')) {
+            errors.push({ field: 'githubUrl', message: 'GitHub URL must start with http' });
+        }
+        if (cleaned.websiteUrl && !cleaned.websiteUrl.startsWith('http')) {
+            errors.push({ field: 'websiteUrl', message: 'Website URL must start with http' });
+        }
+        if (cleaned.accent && !/^#[0-9a-fA-F]{6}$/.test(cleaned.accent)) {
+            errors.push({ field: 'accent', message: 'Accent must be a 6-digit hex color (e.g. #084471)' });
+        }
+        // File size limits (base64 ~1.37x raw; cap photo at ~5MB, resume at ~10MB)
+        if (cleaned.photoBase64 && cleaned.photoBase64.length > 7_000_000) {
+            errors.push({ field: 'photoBase64', message: 'Photo must be under 5MB' });
+        }
+        if (cleaned.resumeBase64 && cleaned.resumeBase64.length > 14_000_000) {
+            errors.push({ field: 'resumeBase64', message: 'Resume must be under 10MB' });
+        }
+        // projectsOnPortfolio: array of {projectId, included, order}. Validated
+        // structurally; unknown entries are dropped silently. Empty array allowed
+        // (means "default ordering, include everything" at render time).
+        if (body.projectsOnPortfolio !== undefined) {
+            if (!Array.isArray(body.projectsOnPortfolio)) {
+                errors.push({ field: 'projectsOnPortfolio', message: 'projectsOnPortfolio must be an array' });
+            }
+            else {
+                const cleanedProjects = [];
+                for (let i = 0; i < body.projectsOnPortfolio.length; i++) {
+                    const raw = body.projectsOnPortfolio[i];
+                    if (!raw || typeof raw !== 'object') {
+                        errors.push({ field: `projectsOnPortfolio[${i}]`, message: 'must be an object' });
+                        continue;
+                    }
+                    if (typeof raw.projectId !== 'string' || raw.projectId.length === 0) {
+                        errors.push({ field: `projectsOnPortfolio[${i}].projectId`, message: 'must be a non-empty string' });
+                        continue;
+                    }
+                    if (typeof raw.included !== 'boolean') {
+                        errors.push({ field: `projectsOnPortfolio[${i}].included`, message: 'must be a boolean' });
+                        continue;
+                    }
+                    if (typeof raw.order !== 'number' || !Number.isFinite(raw.order)) {
+                        errors.push({ field: `projectsOnPortfolio[${i}].order`, message: 'must be a finite number' });
+                        continue;
+                    }
+                    cleanedProjects.push({
+                        projectId: raw.projectId,
+                        included: raw.included,
+                        order: raw.order,
+                    });
+                }
+                cleaned.projectsOnPortfolio = cleanedProjects;
+            }
+        }
+        if (errors.length > 0) {
+            res.status(400).json({ error: { code: 'VALIDATION_ERROR', message: 'Validation failed', fields: errors } });
+            return;
+        }
+        savePortfolioProfile(cleaned);
+        invalidatePortfolioPreviewCache();
+        console.log('[settings] Portfolio profile saved');
+        res.json({ ok: true });
+    });
+    // Local data summary: read-only diagnostic info displayed in Settings
+    // (DB path, daemon install state). Archive count + last sync are served
+    // by /api/archive/stats so the frontend composes both responses.
+    router.get('/api/local-data', (_req, res) => {
+        try {
+            const dbPath = getDbPath();
+            const daemonBinaryPath = getDaemonBinaryPath();
+            const daemonInstalled = existsSync(daemonBinaryPath);
+            res.json({
+                dbPath,
+                daemon: {
+                    installed: daemonInstalled,
+                    binaryPath: daemonBinaryPath,
+                },
+            });
+        }
+        catch (err) {
+            console.error('[local-data]', err.message);
+            res.status(500).json({
+                error: { code: 'LOCAL_DATA_FAILED', message: 'Failed to read local data summary' },
+            });
+        }
+    });
     return router;
 }

package/dist/routes/sse.js

@@ -0,0 +1,9 @@
+/** Set up an SSE response and return a typed send helper. */
+export function startSSE(res) {
+    res.writeHead(200, {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        Connection: 'keep-alive',
+    });
+    return (data) => res.write(`data: ${JSON.stringify(data)}\n\n`);
+}

package/dist/search.js

@@ -7,6 +7,12 @@ import { escapeLikeWildcards } from './format-utils.js';
  * e.g. "-Users-test-Dev-myapp" → "Users/test/Dev/myapp"
  */
 export function decodeProjectName(projectDir) {
+    // Windows: "C-Users-ben-Dev-myapp" → "C:/Users/ben/Dev/myapp"
+    const winMatch = projectDir.match(/^([A-Z])-(.+)$/);
+    if (winMatch) {
+        return `${winMatch[1]}:/${winMatch[2].replace(/-/g, "/")}`;
+    }
+    // Unix: "-Users-ben-Dev-myapp" → "Users/ben/Dev/myapp"
     return projectDir.replace(/^-/, '').replace(/-/g, '/');
 }
 function rowToResult(row, snippet, score) {

package/dist/server.js

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
 import { getDatabase, closeDatabase } from './db.js';
 import { syncWithTracking, startFileWatcher, startCursorPolling, markSyncPending } from './sync.js';
-import { createRouteContext, createProjectsRouter, createEnhanceRouter, createPublishRouter, createSearchRouter, createSessionsRouter, createArchiveRouter, createAuthRouter, createSettingsRouter, createExportRouter, createPreviewRouter, createDashboardRouter, } from './routes/index.js';
+import { createRouteContext, createProjectsRouter, createEnhanceRouter, createPublishRouter, createDeleteRouter, createSearchRouter, createSessionsRouter, createArchiveRouter, createAuthRouter, createSettingsRouter, createExportRouter, createPreviewRouter, createDashboardRouter, createGithubRouter, } from './routes/index.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 function getPackageVersion() {
     try {
@@ -81,9 +81,15 @@ export function createApp(sessionsBasePath, dbPath) {
     if (process.env.NODE_ENV !== 'production')
         corsOrigins.push('http://localhost:5173');
     app.use(cors({ origin: corsOrigins }));
-    app.use((_req, res, next) => {
+    app.use((req, res, next) => {
         res.setHeader('X-Content-Type-Options', 'nosniff');
-        res.setHeader('X-Frame-Options', 'DENY');
+        // Allow same-origin framing for preview pages (used by template browser iframes)
+        if (req.path.startsWith('/preview/')) {
+            res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+        }
+        else {
+            res.setHeader('X-Frame-Options', 'DENY');
+        }
         next();
     });
     app.use(express.json({ limit: '10mb' }));
@@ -91,6 +97,7 @@ export function createApp(sessionsBasePath, dbPath) {
     app.use(createProjectsRouter(ctx));
     app.use(createEnhanceRouter(ctx));
     app.use(createPublishRouter(ctx));
+    app.use(createDeleteRouter(ctx));
     app.use(createSearchRouter(ctx));
     app.use(createSessionsRouter(ctx));
     app.use(createArchiveRouter(ctx));
@@ -99,6 +106,7 @@ export function createApp(sessionsBasePath, dbPath) {
     app.use(createExportRouter(ctx));
     app.use(createPreviewRouter(ctx));
     app.use(createDashboardRouter(ctx));
+    app.use(createGithubRouter(ctx));
     // ── Version endpoint (used by `heyiam open` to detect stale instances) ──
     app.get('/api/version', (_req, res) => {
         res.json({ server: 'heyiam', version: SERVER_VERSION });

package/dist/settings.js

@@ -34,6 +34,14 @@ export function clearAnthropicApiKey(configDir) {
     delete settings.anthropicApiKey;
     writeConfig(SETTINGS_FILE, settings, configDir);
 }
+export function getDefaultTemplate(configDir) {
+    return getSettings(configDir).defaultTemplate;
+}
+export function setDefaultTemplate(templateName, configDir) {
+    const settings = getSettings(configDir);
+    settings.defaultTemplate = templateName;
+    writeConfig(SETTINGS_FILE, settings, configDir);
+}
 export function isOnboardingComplete(configDir) {
     return !!getSettings(configDir).onboardingCompletedAt;
 }
@@ -47,6 +55,43 @@ export function resetOnboarding(configDir) {
     delete settings.onboardingCompletedAt;
     writeConfig(SETTINGS_FILE, settings, configDir);
 }
+// ── Per-session transcript visibility ────────────────────────
+/**
+ * Return whether the session transcript should be included at publish time.
+ * Default is `true` — users must opt out explicitly.
+ */
+export function isTranscriptIncluded(sessionId, configDir) {
+    const map = getSettings(configDir).transcriptIncluded ?? {};
+    const flag = map[sessionId];
+    return flag !== false;
+}
+/**
+ * Set the include-transcript flag for a single session. Persisted to the
+ * settings file alongside other user preferences.
+ */
+export function setTranscriptIncluded(sessionId, included, configDir) {
+    const settings = getSettings(configDir);
+    const map = { ...(settings.transcriptIncluded ?? {}) };
+    if (included) {
+        // Default is `true`, so a `true` value is the same as absent — keep
+        // the map clean by deleting rather than writing redundant entries.
+        delete map[sessionId];
+    }
+    else {
+        map[sessionId] = false;
+    }
+    settings.transcriptIncluded = map;
+    writeConfig(SETTINGS_FILE, settings, configDir);
+}
+// ── Portfolio profile ────────────────────────────────────────
+export function getPortfolioProfile(configDir) {
+    return getSettings(configDir).portfolio ?? {};
+}
+export function savePortfolioProfile(data, configDir) {
+    const settings = getSettings(configDir);
+    settings.portfolio = data;
+    writeConfig(SETTINGS_FILE, settings, configDir);
+}
 /**
  * Returns the Anthropic API key from settings file or env var.
  * Env var takes precedence.
@@ -81,15 +126,6 @@ export function loadEnhancedData(sessionId, configDir) {
         return null;
     }
 }
-export function markAsUploaded(sessionId, configDir) {
-    const data = loadEnhancedData(sessionId, configDir);
-    if (!data)
-        return;
-    data.uploaded = true;
-    const dir = enhancedDir(configDir);
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(enhancedPath(sessionId, configDir), JSON.stringify(data, null, 2), { mode: 0o600 });
-}
 export function deleteEnhancedData(sessionId, configDir) {
     const path = enhancedPath(sessionId, configDir);
     if (existsSync(path))
@@ -188,3 +224,70 @@ export function getUploadedState(projectDirName, configDir) {
         return null;
     }
 }
+/**
+ * Remove the local uploaded-state record for a project. Used when the
+ * remote copy is deleted from heyi.am — clears the "Uploaded" badge and
+ * per-session `uploaded: true` flags so the UI reflects reality without
+ * requiring a new publish round-trip.
+ */
+export function clearUploadedState(projectDirName, configDir) {
+    const path = uploadedPath(projectDirName, configDir);
+    if (existsSync(path))
+        unlinkSync(path);
+}
+const PORTFOLIO_PUBLISH_FILE = 'portfolio-publish.json';
+const DEFAULT_PORTFOLIO_TARGET = 'heyi.am';
+function portfolioPublishPath(configDir = getDataDir()) {
+    return join(configDir, PORTFOLIO_PUBLISH_FILE);
+}
+/**
+ * Compute a stable hash of a portfolio profile snapshot. Keys are sorted
+ * recursively so logically-equal profiles always produce the same hash.
+ * Used for draft detection — no cryptographic guarantees required.
+ */
+export function hashPortfolioProfile(profile) {
+    const canonical = canonicalStringify(profile);
+    return createHash('sha256').update(canonical).digest('hex').slice(0, 16);
+}
+function canonicalStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalStringify).join(',')}]`;
+    const obj = value;
+    const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalStringify(obj[k])}`).join(',')}}`;
+}
+export function getPortfolioPublishState(configDir) {
+    const path = portfolioPublishPath(configDir);
+    if (!existsSync(path))
+        return { targets: {} };
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        return parsed && typeof parsed === 'object' && parsed.targets ? parsed : { targets: {} };
+    }
+    catch {
+        return { targets: {} };
+    }
+}
+export function savePortfolioPublishState(state, configDir) {
+    const dir = configDir ?? getDataDir();
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(portfolioPublishPath(configDir), JSON.stringify(state, null, 2), { mode: 0o600 });
+}
+/** Update (or create) a single target entry in the publish state. */
+export function updatePortfolioPublishTarget(target, patch, configDir) {
+    const state = getPortfolioPublishState(configDir);
+    const existing = state.targets[target];
+    const base = existing ?? {
+        lastPublishedAt: '',
+        lastPublishedProfileHash: '',
+        lastPublishedProfile: {},
+        config: {},
+        visibility: target === DEFAULT_PORTFOLIO_TARGET ? 'public' : undefined,
+    };
+    state.targets[target] = { ...base, ...patch };
+    savePortfolioPublishState(state, configDir);
+    return state;
+}
+export { DEFAULT_PORTFOLIO_TARGET };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "heyiam",
-  "version": "0.2.29",
+  "version": "0.3.1",
   "description": "Turn AI coding sessions into portfolio case studies",
   "type": "module",
   "license": "MIT",
@@ -31,17 +31,16 @@
     "dev:api": "tsx watch src/index.ts open --no-open",
     "dev:app": "cd app && npm run dev",
     "test": "vitest run && cd app && npx vitest run",
-    "test:backend": "vitest run",
+    "test:backend": "vitest run --exclude src/build-integrity.test.ts",
     "test:frontend": "cd app && npx vitest run"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.79.0",
-    "@secretlint/node": "^11.4.0",
-    "@secretlint/secretlint-rule-preset-recommend": "^11.4.0",
     "better-sqlite3": "^12.8.0",
     "commander": "^13.1.0",
     "cors": "^2.8.6",
     "express": "^5.2.1",
+    "keytar": "^7.9.0",
     "liquidjs": "^10.25.2",
     "open": "^10.1.0"
   },