osborn 0.9.1 → 0.9.3

package/dist/fast-brain.js

@@ -866,7 +866,7 @@ export async function askHaiku(workingDir, sessionId, question, researchContext,
     initProvider();
     // workspace uses workingDir for spec.md (under ~/.claude/projects/{slug}/osb/)
     // workingDir is for JSONL access (matches Claude SDK cwd)
-    const wsDir = sessionBaseDir || workingDir;
+    const wsDir = workingDir;
     const workspace = getSessionWorkspace(wsDir, sessionId);
     // Primary: Gemini Flash (~1-2s) with pre-loaded JSONL context
     // Fallback: Anthropic direct API or Agent SDK (slower but functional)
@@ -888,7 +888,7 @@ let researchTaskCounter = 0;
  */
 export async function askFastBrain(workingDir, sessionId, question, opts) {
     const { chatHistory, researchContext, callbacks } = opts;
-    const wsDir = opts.sessionBaseDir || workingDir;
+    const wsDir = workingDir;
     // Detect document generation requests
     const docMatch = detectDocumentRequest(question);
     if (docMatch) {
@@ -1058,7 +1058,7 @@ export async function processResearchChunk(workingDir, sessionId, task, contentC
         return null;
     }
     specUpdateInProgress = true;
-    const wsDir = sessionBaseDir || workingDir;
+    const wsDir = workingDir;
     try {
         const workspace = getSessionWorkspace(wsDir, sessionId);
         const specPath = `${workspace}/spec.md`;
@@ -1492,7 +1492,7 @@ export async function contextualizeResearchUpdate(workingDir, sessionId, task, b
     initProvider();
     if (provider === 'none')
         return null;
-    const wsDir = sessionBaseDir || workingDir;
+    const wsDir = workingDir;
     try {
         const specContent = readSessionSpec(wsDir, sessionId);
         const specTruncated = specContent ? specContent.substring(0, 1500) : '';
@@ -1558,7 +1558,7 @@ export async function generateProactivePrompt(workingDir, sessionId, task, resea
     initProvider();
     if (provider === 'none')
         return null;
-    const wsDir = sessionBaseDir || workingDir;
+    const wsDir = workingDir;
     try {
         const specContent = readSessionSpec(wsDir, sessionId);
         const specTruncated = specContent ? specContent.substring(0, 2000) : '';
@@ -1636,7 +1636,7 @@ export async function generateVisualDocument(workingDir, sessionId, request, doc
     initProvider();
     if (provider === 'none')
         return null;
-    const wsDir = sessionBaseDir || workingDir;
+    const wsDir = workingDir;
     try {
         const workspace = getSessionWorkspace(wsDir, sessionId);
         const specContent = readSessionSpec(wsDir, sessionId) || '';
@@ -1726,7 +1726,7 @@ export async function processResearchCompletion(workingDir, sessionId, task, age
     initProvider();
     if (provider === 'none')
         return agentResult.substring(0, 500);
-    const wsDir = sessionBaseDir || workingDir;
+    const wsDir = workingDir;
     try {
         // Read spec for context
         const specContent = readSessionSpec(wsDir, sessionId) || '';

package/dist/index.js

@@ -300,6 +300,14 @@ function startApiServer(workingDir, port) {
         // GET /sessions/export — stream a gzipped tar of ~/.claude/projects/ to the client
         // Optional ?workDir= query param: if present, export only that project's slug folder.
         if (req.method === 'GET' && url.pathname === '/sessions/export') {
+            if (syncToken) {
+                const authHeader = req.headers['authorization'] ?? '';
+                if (authHeader !== `Bearer ${syncToken}`) {
+                    res.writeHead(401, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Unauthorized' }));
+                    return;
+                }
+            }
             const projectsDir = join(homedir(), '.claude', 'projects');
             const workDir = url.searchParams.get('workDir');
             if (workDir) {
@@ -1837,7 +1845,6 @@ async function main() {
                         chatHistory,
                         researchContext,
                         callbacks,
-                        sessionBaseDir,
                     });
                     haikuInFlight = null;
                     // Voice queue items may have been held while fast brain was in flight — retry now
@@ -2013,24 +2020,19 @@ async function main() {
             }
             // Read working directory override from frontend.
             //
-            // Must validate with existsSync before accepting: a broken reverse-slug in
-            // the frontend's session list (see `slugToPath` in config.ts — the encoding
-            // is lossy), a deleted project, or a bad legacy client can all produce a
-            // non-existent path here. Passing a non-existent cwd to
-            // `child_process.spawn` in the Claude SDK errors with ENOENT, which the
-            // SDK then reports as the misleading "Claude Code executable not found at
-            // .../cli.js" error (see MEMORY bug fix #11). Fall back to defaultWorkingDir
-            // (which is itself existsSync-verified at startup).
+            // If the path doesn't exist yet (new project on first use, or freshly
+            // imported sessions on a new sprite), create it with mkdirSync so the
+            // agent can accept it. This is safe: recursive mkdirSync is a no-op when
+            // the directory already exists, and project paths always live under the
+            // workspace root. The Claude SDK child_process.spawn requires the cwd to
+            // exist — mkdirSync satisfies that requirement without silently falling back.
             if (metadata.workingDirectory && typeof metadata.workingDirectory === 'string' && metadata.workingDirectory.length > 0) {
-                if (existsSync(metadata.workingDirectory)) {
-                    workingDir = metadata.workingDirectory;
-                    console.log(`📂 Working directory from frontend: ${workingDir}`);
-                }
-                else {
-                    console.log(`⚠️  Frontend sent workingDirectory that does not exist: ${metadata.workingDirectory}`);
-                    console.log(`   Falling back to default: ${defaultWorkingDir}`);
-                    workingDir = defaultWorkingDir;
+                if (!existsSync(metadata.workingDirectory)) {
+                    mkdirSync(metadata.workingDirectory, { recursive: true });
+                    console.log(`📁 Created project directory: ${metadata.workingDirectory}`);
                 }
+                workingDir = metadata.workingDirectory;
+                console.log(`📂 Working directory from frontend: ${workingDir}`);
             }
             else {
                 // Reset to default for new connections (in case previous session changed it)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {