osborn 0.9.2 → 0.9.4

package/dist/index.js

@@ -300,41 +300,31 @@ function startApiServer(workingDir, port) {
         // GET /sessions/export — stream a gzipped tar of ~/.claude/projects/ to the client
         // Optional ?workDir= query param: if present, export only that project's slug folder.
         if (req.method === 'GET' && url.pathname === '/sessions/export') {
-            const projectsDir = join(homedir(), '.claude', 'projects');
-            const workDir = url.searchParams.get('workDir');
-            if (workDir) {
-                const slug = workDir.replace(/\//g, '-');
-                const slugDir = join(projectsDir, slug);
-                if (!existsSync(slugDir)) {
-                    res.writeHead(404, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Project not found', slug }));
+            if (syncToken) {
+                const authHeader = req.headers['authorization'] ?? '';
+                if (authHeader !== `Bearer ${syncToken}`) {
+                    res.writeHead(401, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Unauthorized' }));
                     return;
                 }
-                res.writeHead(200, {
-                    'Content-Type': 'application/gzip',
-                    'Content-Disposition': `attachment; filename="claude-sessions-${slug}.tar.gz"`,
-                    'Access-Control-Allow-Origin': '*',
-                });
-                // Use '--' to prevent tar from interpreting the leading-hyphen slug as flags
-                const tar = spawn('tar', ['-czf', '-', '-C', projectsDir, '--', slug]);
-                tar.stdout.pipe(res);
-                tar.stderr.on('data', (d) => console.error('[export]', d.toString()));
-                tar.on('close', (code) => { if (code !== 0)
-                    res.destroy(); });
-                return;
             }
+            const claudeDir = join(homedir(), '.claude');
+            const projectsDir = join(claudeDir, 'projects');
+            const workDir = url.searchParams.get('workDir');
             if (!existsSync(projectsDir)) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'No sessions found' }));
                 return;
             }
+            const tarArgs = ['-czf', '-', '-C', claudeDir, 'projects'];
+            void workDir; // workDir param accepted but full projects/ export is returned
             res.writeHead(200, {
                 'Content-Type': 'application/gzip',
                 'Content-Disposition': 'attachment; filename="claude-sessions.tar.gz"',
                 'Access-Control-Allow-Origin': '*',
             });
             // Stream tar output directly to response
-            const tar = spawn('tar', ['-czf', '-', '-C', join(homedir(), '.claude'), 'projects']);
+            const tar = spawn('tar', tarArgs);
             tar.stdout.pipe(res);
             tar.stderr.on('data', (d) => console.error('[export]', d.toString()));
             tar.on('close', (code) => { if (code !== 0)
@@ -370,7 +360,8 @@ function startApiServer(workingDir, port) {
                             return;
                         }
                         try {
-                            const projectsDir = join(homedir(), '.claude', 'projects');
+                            const claudeDir = join(homedir(), '.claude');
+                            const projectsDir = join(claudeDir, 'projects');
                             mkdirSync(projectsDir, { recursive: true });
                             // The archive should contain a 'projects' subdirectory
                             const extractedProjects = join(tmpDir, 'projects');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {