onbuzz 3.4.0 → 3.6.1

package/src/interfaces/__tests__/imageServing.test.js

@@ -0,0 +1,228 @@
+/**
+ * Unit tests for the /api/images/:sessionId/:filename endpoint.
+ *
+ * Covers:
+ *  - Path traversal rejection
+ *  - Serving images from project dir (with and without active session)
+ *  - Serving images from OS temp dir
+ *  - Serving images from agent working directories
+ *  - 404 when image doesn't exist anywhere
+ *  - Content-type correctness for different extensions
+ */
+
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from '@jest/globals';
+import express from 'express';
+import { createServer } from 'http';
+import path from 'path';
+import fs from 'fs/promises';
+import os from 'os';
+
+// ── Minimal WebServer stand-in ──────────────────────────────────
+// We only mount the single route under test so the full webServer
+// dependency tree isn't required.
+
+const HTTP_STATUS = { BAD_REQUEST: 400, NOT_FOUND: 404, INTERNAL_SERVER_ERROR: 500, FORBIDDEN: 403 };
+
+function buildApp({ sessions, orchestrator, projectDir, logger }) {
+  const app = express();
+
+  // Replicate the exact route from webServer.js
+  app.get('/api/images/:sessionId/:filename', async (req, res) => {
+    try {
+      const { sessionId, filename } = req.params;
+
+      const normalizedFilename = path.basename(filename);
+      if (normalizedFilename !== filename || filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
+        return res.status(HTTP_STATUS.BAD_REQUEST).json({ success: false, error: 'Invalid filename' });
+      }
+
+      const session = sessions.get(sessionId);
+      const effectiveProjectDir = session?.projectDir || projectDir || process.cwd();
+
+      let imagePath = null;
+      const searchPaths = [
+        path.join(effectiveProjectDir, 'images', normalizedFilename),
+        path.join('/tmp/loxia-images', sessionId, normalizedFilename),
+        path.join('/tmp/loxia-images', normalizedFilename),
+        path.join(process.env.TEMP || process.env.TMP || '/tmp', 'loxia-images', sessionId, normalizedFilename),
+        path.join(process.env.TEMP || process.env.TMP || '/tmp', 'loxia-images', normalizedFilename)
+      ];
+
+      if (orchestrator?.agentPool) {
+        try {
+          const agents = await orchestrator.agentPool.getAllAgents();
+          for (const agent of agents) {
+            if (agent.directoryAccess?.workingDirectory) {
+              searchPaths.push(path.join(agent.directoryAccess.workingDirectory, 'images', normalizedFilename));
+            }
+          }
+        } catch (_) { /* ignore */ }
+      }
+
+      for (const sp of searchPaths) {
+        try {
+          const stats = await fs.stat(sp);
+          if (stats.isFile()) { imagePath = sp; break; }
+        } catch (_) { continue; }
+      }
+
+      if (!imagePath) {
+        return res.status(HTTP_STATUS.NOT_FOUND).json({ success: false, error: 'Image not found' });
+      }
+
+      res.sendFile(imagePath, (err) => {
+        if (err && !res.headersSent) {
+          res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: 'Failed to serve image' });
+        }
+      });
+    } catch (error) {
+      if (!res.headersSent) {
+        res.status(HTTP_STATUS.INTERNAL_SERVER_ERROR).json({ success: false, error: error.message });
+      }
+    }
+  });
+
+  return app;
+}
+
+// ── Helpers ─────────────────────────────────────────────────────
+
+async function fetch(url) {
+  const resp = await globalThis.fetch(url);
+  const body = resp.headers.get('content-type')?.includes('json')
+    ? await resp.json()
+    : await resp.text();
+  return { status: resp.status, body, headers: resp.headers };
+}
+
+// ── Test suite ──────────────────────────────────────────────────
+
+describe('/api/images/:sessionId/:filename', () => {
+  let server, baseUrl;
+  let tmpProjectDir;
+  let tmpAgentDir;
+  const sessions = new Map();
+  const sessionId = 'test-session-abc123';
+
+  beforeAll(async () => {
+    // Create temp directories that simulate project and agent dirs
+    tmpProjectDir = path.join(os.tmpdir(), `loxia-img-test-proj-${Date.now()}`);
+    tmpAgentDir = path.join(os.tmpdir(), `loxia-img-test-agent-${Date.now()}`);
+    await fs.mkdir(path.join(tmpProjectDir, 'images'), { recursive: true });
+    await fs.mkdir(path.join(tmpAgentDir, 'images'), { recursive: true });
+
+    // Also create the OS temp search path
+    const osTempPath = path.join(process.env.TEMP || process.env.TMP || '/tmp', 'loxia-images', sessionId);
+    await fs.mkdir(osTempPath, { recursive: true });
+
+    // Write test images
+    const pngHeader = Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]); // PNG magic bytes
+    await fs.writeFile(path.join(tmpProjectDir, 'images', 'project-image.png'), pngHeader);
+    await fs.writeFile(path.join(tmpAgentDir, 'images', 'agent-image.png'), pngHeader);
+    await fs.writeFile(path.join(osTempPath, 'temp-image.png'), pngHeader);
+
+    // Register session
+    sessions.set(sessionId, { projectDir: tmpProjectDir });
+
+    const orchestrator = {
+      agentPool: {
+        getAllAgents: async () => [
+          { directoryAccess: { workingDirectory: tmpAgentDir } }
+        ]
+      }
+    };
+
+    const app = buildApp({
+      sessions,
+      orchestrator,
+      projectDir: tmpProjectDir,
+      logger: { info() {}, warn() {}, error() {}, debug() {} }
+    });
+
+    server = createServer(app);
+    await new Promise(resolve => server.listen(0, resolve));
+    const port = server.address().port;
+    baseUrl = `http://localhost:${port}`;
+  });
+
+  afterAll(async () => {
+    server?.close();
+    await fs.rm(tmpProjectDir, { recursive: true, force: true }).catch(() => {});
+    await fs.rm(tmpAgentDir, { recursive: true, force: true }).catch(() => {});
+    const osTempPath = path.join(process.env.TEMP || process.env.TMP || '/tmp', 'loxia-images', sessionId);
+    await fs.rm(osTempPath, { recursive: true, force: true }).catch(() => {});
+  });
+
+  // ── Security ──────────────────────────────────────────────
+
+  it('rejects path traversal with ..', async () => {
+    const { status, body } = await fetch(`${baseUrl}/api/images/${sessionId}/..%2F..%2Fetc%2Fpasswd`);
+    expect(status).toBe(400);
+    expect(body.error).toBe('Invalid filename');
+  });
+
+  it('rejects filenames with slashes', async () => {
+    const { status, body } = await fetch(`${baseUrl}/api/images/${sessionId}/sub%2Ffile.png`);
+    expect(status).toBe(400);
+    expect(body.error).toBe('Invalid filename');
+  });
+
+  it('rejects filenames with backslashes', async () => {
+    const { status, body } = await fetch(`${baseUrl}/api/images/${sessionId}/sub%5Cfile.png`);
+    expect(status).toBe(400);
+    expect(body.error).toBe('Invalid filename');
+  });
+
+  // ── Serving from project directory (session active) ───────
+
+  it('serves image from project/images/ when session is active', async () => {
+    const { status, headers } = await fetch(`${baseUrl}/api/images/${sessionId}/project-image.png`);
+    expect(status).toBe(200);
+    expect(headers.get('content-type')).toMatch(/image|octet/);
+  });
+
+  // ── Serving without active session (session expired) ──────
+
+  it('still serves image when session has expired (falls back to cwd)', async () => {
+    // Use a sessionId that doesn't exist in the map
+    // Image is in the OS temp dir under the expired sessionId
+    const expiredSessionId = sessionId; // temp image was created under this id
+    // Remove session temporarily
+    sessions.delete(sessionId);
+
+    // The image is in OS temp: $TEMP/loxia-images/test-session-abc123/temp-image.png
+    const { status } = await fetch(`${baseUrl}/api/images/${expiredSessionId}/temp-image.png`);
+    expect(status).toBe(200);
+
+    // Restore session for other tests
+    sessions.set(sessionId, { projectDir: tmpProjectDir });
+  });
+
+  // ── Serving from agent working directory ──────────────────
+
+  it('finds image in agent working directory', async () => {
+    const { status } = await fetch(`${baseUrl}/api/images/${sessionId}/agent-image.png`);
+    expect(status).toBe(200);
+  });
+
+  // ── Serving from OS temp directory ────────────────────────
+
+  it('finds image in OS temp loxia-images directory', async () => {
+    const { status } = await fetch(`${baseUrl}/api/images/${sessionId}/temp-image.png`);
+    expect(status).toBe(200);
+  });
+
+  // ── 404 for missing images ────────────────────────────────
+
+  it('returns 404 for non-existent image', async () => {
+    const { status, body } = await fetch(`${baseUrl}/api/images/${sessionId}/does-not-exist.png`);
+    expect(status).toBe(404);
+    expect(body.error).toBe('Image not found');
+  });
+
+  it('returns 404 for unknown session + missing file', async () => {
+    const { status, body } = await fetch(`${baseUrl}/api/images/unknown-session-xyz/nope.png`);
+    expect(status).toBe(404);
+    expect(body.error).toBe('Image not found');
+  });
+});

package/src/interfaces/webServer.js

@@ -1946,15 +1946,6 @@ class WebServer {
       try {
         const { sessionId, filename } = req.params;
 
-        // Security validation: Check if sessionId exists
-        const session = this.sessions.get(sessionId);
-        if (!session) {
-          return res.status(HTTP_STATUS.FORBIDDEN).json({
-            success: false,
-            error: 'Invalid session'
-          });
-        }
-
         // Security validation: Check filename for path traversal attempts
         const normalizedFilename = path.basename(filename);
         if (normalizedFilename !== filename || filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
@@ -1964,19 +1955,32 @@ class WebServer {
           });
         }
 
+        // Session may or may not still exist (server restarts lose session map)
+        const session = this.sessions.get(sessionId);
+        const projectDir = session?.projectDir || process.cwd();
+
         // Try to locate the image in multiple possible locations
         let imagePath = null;
         const searchPaths = [
           // 1. Session's project directory images folder
-          path.join(session.projectDir || process.cwd(), 'images', normalizedFilename),
+          path.join(projectDir, 'images', normalizedFilename),
           // 2. Temp directory for this session
           path.join('/tmp/loxia-images', sessionId, normalizedFilename),
           // 3. General temp images directory
-          path.join('/tmp/loxia-images', normalizedFilename)
+          path.join('/tmp/loxia-images', normalizedFilename),
+          // 4. OS temp dir (Windows: %TEMP%, Linux: /tmp)
+          path.join(process.env.TEMP || process.env.TMP || '/tmp', 'loxia-images', sessionId, normalizedFilename),
+          path.join(process.env.TEMP || process.env.TMP || '/tmp', 'loxia-images', normalizedFilename)
         ];
 
-        // 4. Search in agent working directories for this session
-        // Get all agents and check their workingDirectory
+        // 5. Search ALL known project dirs from active sessions (not just current)
+        for (const [, sess] of this.sessions) {
+          if (sess?.projectDir && sess.projectDir !== projectDir) {
+            searchPaths.push(path.join(sess.projectDir, 'images', normalizedFilename));
+          }
+        }
+
+        // 6. Search in agent working directories AND agent projectDirs
         if (this.orchestrator?.agentPool) {
           try {
             const agents = await this.orchestrator.agentPool.getAllAgents();
@@ -1986,6 +1990,10 @@ class WebServer {
                   path.join(agent.directoryAccess.workingDirectory, 'images', normalizedFilename)
                 );
               }
+              // Also check the agent's own projectDir (may differ from session projectDir)
+              if (agent.projectDir) {
+                searchPaths.push(path.join(agent.projectDir, 'images', normalizedFilename));
+              }
             }
           } catch (error) {
             this.logger.warn('Failed to get agent working directories for image search', {
@@ -1994,6 +2002,12 @@ class WebServer {
           }
         }
 
+        // 7. Common user project directory (fallback for when session is gone)
+        const homeDir = process.env.USERPROFILE || process.env.HOME || '';
+        if (homeDir) {
+          searchPaths.push(path.join(homeDir, 'Loxia', 'images', normalizedFilename));
+        }
+
         // Find the first existing file
         for (const searchPath of searchPaths) {
           try {
@@ -2576,6 +2590,76 @@ class WebServer {
       }
     });
 
+    // ============================================
+    // Artifacts API Endpoint
+    // ============================================
+
+    // DEBUG: Inject a test artifact into an agent (remove after testing)
+    this.app.post('/api/agents/:agentId/artifacts/test', async (req, res) => {
+      try {
+        const { agentId } = req.params;
+        const agent = await this.orchestrator.agentPool.getAgent(agentId);
+        if (!agent) return res.status(404).json({ success: false, error: 'Agent not found' });
+
+        if (!agent.artifacts) agent.artifacts = {};
+        const testPath = (agent.directoryAccess?.workingDirectory || '/test') + '/test-artifact.js';
+        const displayPath = 'test-artifact.js';
+
+        agent.artifacts[testPath] = {
+          displayPath,
+          versions: [{
+            id: `v-${Date.now()}`,
+            content: '// Test artifact\nconsole.log("Hello from artifacts!");',
+            timestamp: new Date().toISOString(),
+            action: 'write',
+            size: 50,
+            fullPath: testPath
+          }]
+        };
+
+        // Broadcast via WebSocket
+        const sessionIds = this.orchestrator.webSocketManager?.getSessionsForAgent?.(agentId) || [];
+        for (const sid of sessionIds) {
+          this.orchestrator.webSocketManager.broadcastToSession(sid, {
+            type: 'artifacts_updated',
+            data: { agentId, artifacts: agent.artifacts, workingDirectory: agent.directoryAccess?.workingDirectory || '' }
+          });
+        }
+
+        res.json({ success: true, artifactCount: Object.keys(agent.artifacts).length });
+      } catch (error) {
+        res.status(500).json({ success: false, error: error.message });
+      }
+    });
+
+    // Get artifacts (files written by the agent) with version history
+    this.app.get('/api/agents/:agentId/artifacts', async (req, res) => {
+      try {
+        const { agentId } = req.params;
+        const agent = await this.orchestrator.agentPool.getAgent(agentId);
+
+        if (!agent) {
+          return res.status(404).json({ success: false, error: 'Agent not found' });
+        }
+
+        // Return the artifacts map (or empty if none yet)
+        // { [filePath]: { displayPath, versions: [{ id, content, timestamp, action, size }] } }
+        res.json({
+          success: true,
+          agentId,
+          artifacts: agent.artifacts || {},
+          workingDirectory: agent.directoryAccess?.workingDirectory || ''
+        });
+
+      } catch (error) {
+        this.logger.error('Failed to get agent artifacts', {
+          agentId: req.params.agentId,
+          error: error.message
+        });
+        res.status(500).json({ success: false, error: error.message });
+      }
+    });
+
     // ============================================
     // Terminal Tasks API Endpoints
     // ============================================

package/src/services/conversationCompactionService.js

@@ -825,12 +825,12 @@ class ConversationCompactionService {
     const filteredMessages = allMessages.filter(m => {
       if (m === mainSystemMsg) return true;
       if (m.role === 'system') return false;
-      if (m.type === 'tool_result' || m.role === 'tool') return false;
+      if (m.type === 'tool_result' || m.type === 'tool-result' || m.role === 'tool') return false;
       return true;
     });
 
     const removedSystemCount = allMessages.filter(m => m.role === 'system' && m !== mainSystemMsg).length;
-    const removedToolCount = allMessages.filter(m => m.type === 'tool_result' || m.role === 'tool').length;
+    const removedToolCount = allMessages.filter(m => m.type === 'tool_result' || m.type === 'tool-result' || m.role === 'tool').length;
 
     // 3. Apply sandwich using segment identification
     const segments = this._identifySegments(filteredMessages);

package/src/services/visualEditorServer.js

@@ -155,10 +155,10 @@ class VisualEditorServer {
       return { success: true, port: this.port, message: 'Already running' };
     }
 
-    // Find a free port starting from the preferred port
+    // Find a free port by checking on 0.0.0.0 (matching the actual bind address)
     const preferredPort = this.port;
     try {
-      const actualPort = await findFreePort(preferredPort);
+      const actualPort = await findFreePort(preferredPort, 100, '0.0.0.0');
 
       if (actualPort !== preferredPort) {
         this.logger.info?.(`[VisualEditorServer] Port ${preferredPort} taken, using ${actualPort}`) ||
@@ -170,6 +170,15 @@ class VisualEditorServer {
       throw err;
     }
 
+    return this._tryListen(this.port, 10);
+  }
+
+  /**
+   * Try to listen on a port, retrying on EADDRINUSE up to maxRetries times.
+   * Handles the TOCTOU race between findFreePort and actual listen().
+   */
+  async _tryListen(port, maxRetries) {
+    this.port = port;
     this.app = express();
     this._setupMiddleware();
     this._setupRoutes();
@@ -197,9 +206,19 @@ class VisualEditorServer {
       });
 
       this.server.on('error', (err) => {
-        // This shouldn't happen since we checked with findFreePort, but handle anyway
-        this.logger.error?.(`[VisualEditorServer] Server error: ${err.message}`);
-        reject(err);
+        if (err.code === 'EADDRINUSE' && maxRetries > 0) {
+          const nextPort = this.port + 1;
+          this.logger.info?.(`[VisualEditorServer] Port ${this.port} in use, trying ${nextPort}...`) ||
+            console.log(`[VisualEditorServer] Port ${this.port} in use, trying ${nextPort}...`);
+          // Clean up and retry on next port
+          try { this.server.close(); } catch {}
+          this.app = null;
+          this.server = null;
+          resolve(this._tryListen(nextPort, maxRetries - 1));
+        } else {
+          this.logger.error?.(`[VisualEditorServer] Server error: ${err.message}`);
+          reject(err);
+        }
       });
     });
   }
@@ -1158,8 +1177,8 @@ class VisualEditorServer {
 
     // Listen for commands from parent (Loxia Web-UI) or WebSocket
     window.addEventListener('message', (e) => {
-      if (e.data && (e.data.type === 'highlight' || e.data.type === 'scroll-to')) {
-        // Forward to app iframe
+      if (e.data && (e.data.type === 'highlight' || e.data.type === 'scroll-to' || e.data.type === 'toggle')) {
+        // Forward to app iframe (including toggle for Select/Preview mode switching)
         iframe.contentWindow.postMessage(e.data, '*');
       }
     });

package/src/tools/imageTool.js

@@ -479,13 +479,33 @@ export class ImageTool extends BaseTool {
           let imageUrl;
           let isTemporary = false;
 
+          this.logger?.info('Image generation result', {
+            jobId: job.jobId,
+            savedToDisk: result.savedToDisk,
+            resolvedOutputPath: result.resolvedOutputPath,
+            temporaryUrl: result.temporaryUrl?.substring(0, 80),
+            downloadError: result.downloadError,
+            isBase64Response: result.isBase64Response
+          });
+
           if (result.savedToDisk && result.resolvedOutputPath) {
             // Image was saved successfully - use our server endpoint
             imageUrl = this._convertToWebUrl(result.resolvedOutputPath, job.sessionId);
+            this.logger?.info('Using local server URL for image', { imageUrl });
           } else if (result.temporaryUrl) {
             // Download failed - use temporary AI-generated URL (expires in ~1 hour)
             imageUrl = result.temporaryUrl;
             isTemporary = true;
+            this.logger?.warn('Using temporary AI URL for image (local save failed)', {
+              imageUrl: imageUrl.substring(0, 80),
+              downloadError: result.downloadError
+            });
+          } else {
+            this.logger?.error('No image URL available - neither local save nor temporary URL', {
+              jobId: job.jobId,
+              savedToDisk: result.savedToDisk,
+              hasTemporaryUrl: !!result.temporaryUrl
+            });
           }
 
           global.loxiaWebServer.broadcastToSession(job.sessionId, {
@@ -788,11 +808,19 @@ export class ImageTool extends BaseTool {
 
     try {
       if (b64Json) {
-        // Flux response: Save base64 directly to disk
-        this.logger?.info('Saving base64 image directly to disk (Flux response)');
+        // Flux/GPT-Image response: Save base64 directly to disk
+        this.logger?.info(`Saving base64 image to disk: ${resolvedOutputPath}`);
         const imageBuffer = Buffer.from(b64Json, 'base64');
         await fs.writeFile(resolvedOutputPath, imageBuffer);
-        savedToDisk = true;
+
+        // Verify the file was actually written
+        const stat = await fs.stat(resolvedOutputPath);
+        if (stat.size > 0) {
+          savedToDisk = true;
+          this.logger?.info(`Image saved successfully: ${resolvedOutputPath} (${stat.size} bytes)`);
+        } else {
+          this.logger?.warn(`Image file is empty after write: ${resolvedOutputPath}`);
+        }
 
         // For web display, we'll use our local server endpoint (set below)
         displayUrl = null; // Will be converted to web URL later
@@ -800,7 +828,15 @@ export class ImageTool extends BaseTool {
         // URL response: Download from URL
         this.logger?.info(`Downloading image from URL: ${imageUrl.substring(0, 50)}...`);
         await this._downloadImage(imageUrl, resolvedOutputPath);
-        savedToDisk = true;
+
+        // Verify the file was actually written
+        const stat = await fs.stat(resolvedOutputPath);
+        if (stat.size > 0) {
+          savedToDisk = true;
+          this.logger?.info(`Image downloaded successfully: ${resolvedOutputPath} (${stat.size} bytes)`);
+        } else {
+          this.logger?.warn(`Downloaded image file is empty: ${resolvedOutputPath}`);
+        }
         displayUrl = imageUrl;
       }
 
@@ -811,7 +847,7 @@ export class ImageTool extends BaseTool {
     } catch (error) {
       // Save failed, but we might still have a temporary URL
       downloadError = error.message;
-      this.logger?.warn(`Failed to save image to disk: ${error.message}`);
+      this.logger?.error(`Failed to save image to disk at ${resolvedOutputPath}: ${error.message}`);
 
       if (!imageUrl) {
         // No URL fallback for Flux - this is a real failure