tide-commander 1.177.2 → 1.178.0

package/dist/src/packages/server/codex/app-server/app-server-process.js

@@ -20,6 +20,12 @@
  *
  * One process multiplexes every Codex agent: each agent owns a `threadId`, and
  * notifications carry that id so the runner can fan them back out.
+ *
+ * The daemon reads ~/.codex/auth.json ONCE at startup and never re-reads it, so
+ * a daemon that outlives an account switch keeps running every agent on the
+ * PREVIOUS account. Both entry points guard against that: boot() refuses to
+ * rejoin a daemon whose account no longer matches the auth file, and
+ * `killDetachedAppServerDaemon()` is called by the account switcher.
  */
 import { spawn } from 'child_process';
 import * as http from 'http';
@@ -27,11 +33,14 @@ import * as net from 'net';
 import * as fs from 'fs';
 import { WebSocket } from 'ws';
 import { createLogger } from '../../utils/logger.js';
+import { listProviderCredentialProfiles } from '../../services/provider-credentials-service.js';
 import { loadDaemonInfo, saveDaemonInfo, clearDaemonInfo, APP_SERVER_LOG_FILE, } from './app-server-recovery-store.js';
 const log = createLogger('CodexAppServer');
 const INITIALIZE_TIMEOUT_MS = 15000;
 const READYZ_TIMEOUT_MS = 20000;
 const READYZ_POLL_MS = 250;
+const ACCOUNT_PROBE_TIMEOUT_MS = 5000;
+const DAEMON_KILL_GRACE_MS = 2000;
 export class CodexAppServerProcess {
     opts;
     ws = null;
@@ -60,14 +69,21 @@ export class CodexAppServerProcess {
     }
     async boot() {
         this.stopped = false;
-        // 1. Rejoin an already-running daemon if one is healthy.
+        // 1. Rejoin an already-running daemon if one is healthy AND still logged in
+        //    as the account ~/.codex/auth.json currently holds. A daemon that
+        //    survived an account switch (ours or a plain `codex login`) would keep
+        //    every agent on the old, usually rate-limited, account.
         const existing = loadDaemonInfo();
         if (existing && (await this.isDaemonHealthy(existing))) {
-            log.log(`🔗 Rejoining existing app-server daemon pid=${existing.pid} port=${existing.port}`);
-            this.port = existing.port;
-            this.reconnectedToExisting = true;
-            await this.connectAndInitialize(existing.port);
-            return;
+            if (await daemonAccountIsCurrent(existing.port)) {
+                log.log(`🔗 Rejoining existing app-server daemon pid=${existing.pid} port=${existing.port}`);
+                this.port = existing.port;
+                this.reconnectedToExisting = true;
+                await this.connectAndInitialize(existing.port);
+                return;
+            }
+            log.warn(`Existing app-server daemon pid=${existing.pid} is signed in as a different Codex account than ~/.codex/auth.json — killing it so the active account takes effect`);
+            killDetachedAppServerDaemon();
         }
         // 2. Spawn a fresh detached daemon.
         this.reconnectedToExisting = false;
@@ -253,15 +269,140 @@ export class CodexAppServerProcess {
     /** Disconnect AND kill the daemon (used on explicit full shutdown). */
     killDaemon() {
         this.disconnect();
-        const info = loadDaemonInfo();
-        if (info && isPidAlive(info.pid)) {
+        killDetachedAppServerDaemon();
+    }
+}
+/**
+ * Kill the detached daemon recorded on disk, if any, and forget it.
+ *
+ * Called when the live Codex account changes: the daemon caches
+ * ~/.codex/auth.json in memory at startup, so switching accounts is a silent
+ * no-op for every agent until the daemon is replaced. The next launch spawns a
+ * fresh one with the new credentials; in-flight turns die with the old daemon
+ * (they were running on the account the user just abandoned), and the runner's
+ * socket-close handler finalizes those agents so none stays stuck 'working'.
+ */
+export function killDetachedAppServerDaemon() {
+    const info = loadDaemonInfo();
+    if (!info)
+        return { stopped: false, pid: null };
+    const alive = isPidAlive(info.pid);
+    if (alive) {
+        // The recorded pid is the `codex` node wrapper, which spawns the real Rust
+        // binary as a child — signal the whole process GROUP (spawn used
+        // detached:true, so the wrapper leads one) or the binary outlives the
+        // wrapper and keeps holding the old account. SIGKILL the stragglers after a
+        // grace period; the timer is unref'd so it can't hold the process open.
+        signalDaemon(info.pid, 'SIGTERM');
+        log.log(`🔪 Killed app-server daemon pid=${info.pid} (Codex credentials changed)`);
+        setTimeout(() => {
+            if (isPidAlive(info.pid))
+                signalDaemon(info.pid, 'SIGKILL');
+        }, DAEMON_KILL_GRACE_MS).unref();
+    }
+    clearDaemonInfo();
+    return { stopped: alive, pid: alive ? info.pid : null };
+}
+function signalDaemon(pid, signal) {
+    try {
+        process.kill(-pid, signal);
+        return;
+    }
+    catch { /* not a group leader — fall back to the pid itself */ }
+    try {
+        process.kill(pid, signal);
+    }
+    catch (err) {
+        log.warn(`Failed to ${signal} app-server daemon pid=${pid}: ${err.message}`);
+    }
+}
+/**
+ * Compare the account a daemon is signed in as against the one in the auth
+ * file. Anything unknown (API-key auth, unreachable daemon, probe error) counts
+ * as current — a probe glitch must never cost the user a running daemon.
+ */
+export function isDaemonAccountCurrent(daemonEmail, activeEmail) {
+    if (!daemonEmail || !activeEmail)
+        return true;
+    return daemonEmail.trim().toLowerCase() === activeEmail.trim().toLowerCase();
+}
+async function daemonAccountIsCurrent(port) {
+    let activeEmail = null;
+    try {
+        activeEmail = listProviderCredentialProfiles('codex').active?.email ?? null;
+    }
+    catch {
+        return true;
+    }
+    if (!activeEmail)
+        return true;
+    return isDaemonAccountCurrent(await probeDaemonAccountEmail(port), activeEmail);
+}
+/**
+ * Ask a running daemon which ChatGPT account it holds, over a throwaway
+ * WebSocket so the runner's own connection/lifecycle is untouched. Returns null
+ * when the answer isn't a ChatGPT login (API key) or the probe fails.
+ */
+function probeDaemonAccountEmail(port) {
+    return new Promise((resolve) => {
+        let ws;
+        try {
+            ws = new WebSocket(`ws://127.0.0.1:${port}`);
+        }
+        catch {
+            resolve(null);
+            return;
+        }
+        let settled = false;
+        const finish = (email) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
             try {
-                process.kill(info.pid, 'SIGTERM');
+                ws.close();
             }
             catch { /* ignore */ }
-        }
-        clearDaemonInfo();
-    }
+            resolve(email);
+        };
+        const timer = setTimeout(() => finish(null), ACCOUNT_PROBE_TIMEOUT_MS);
+        ws.on('open', () => {
+            ws.send(JSON.stringify({
+                id: 1,
+                method: 'initialize',
+                params: {
+                    clientInfo: { name: 'tide-commander', title: 'Tide Commander', version: '1.0.0' },
+                    capabilities: { experimentalApi: true },
+                },
+            }));
+        });
+        ws.on('message', (data) => {
+            let msg;
+            try {
+                msg = JSON.parse(data.toString());
+            }
+            catch {
+                return;
+            }
+            if (msg.id === undefined || msg.method !== undefined)
+                return;
+            if (Number(msg.id) === 1) {
+                if (msg.error) {
+                    finish(null);
+                    return;
+                }
+                ws.send(JSON.stringify({ method: 'initialized', params: {} }));
+                ws.send(JSON.stringify({ id: 2, method: 'account/read', params: {} }));
+                return;
+            }
+            if (Number(msg.id) === 2) {
+                const account = msg.result?.account;
+                finish(typeof account?.email === 'string' ? account.email : null);
+            }
+        });
+        ws.on('error', () => finish(null));
+        ws.on('close', () => finish(null));
+    });
 }
 function isPidAlive(pid) {
     if (!pid || pid < 1)

package/dist/src/packages/server/routes/files.js

@@ -5,7 +5,7 @@
 import { Router } from 'express';
 import * as fs from 'fs';
 import * as path from 'path';
-import { execFile, execSync, spawn } from 'child_process';
+import { execFile, execFileSync, execSync, spawn } from 'child_process';
 import * as os from 'os';
 import { pathToFileURL } from 'url';
 import { logger } from '../utils/logger.js';
@@ -21,6 +21,23 @@ if (!fs.existsSync(TEMP_DIR)) {
 }
 log.log(` Temp upload directory: ${TEMP_DIR}`);
 const router = Router();
+function looksLikeBinaryBuffer(buffer) {
+    if (buffer.length === 0)
+        return false;
+    const sample = buffer.subarray(0, Math.min(buffer.length, 8192));
+    // NUL catches the common case; replacement characters catch compressed or
+    // media formats that contain no NUL in their first block but are not UTF-8.
+    return sample.includes(0) || buffer.toString('utf-8').includes('\uFFFD');
+}
+function binaryContentTypeForExtension(extension) {
+    const mimeTypes = {
+        '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+        '.gif': 'image/gif', '.webp': 'image/webp', '.bmp': 'image/bmp',
+        '.ico': 'image/x-icon', '.pdf': 'application/pdf', '.stl': 'model/stl',
+        '.fcstd': 'application/vnd.freecad', '.gcode': 'text/x-gcode', '.gco': 'text/x-gcode',
+    };
+    return mimeTypes[extension] || 'application/octet-stream';
+}
 // Windows absolute paths — drive-letter (`C:\…` or `C:/…`) and UNC (`\\server\share`)
 // — are NOT recognized by path.isAbsolute() when the server runs on POSIX. Without
 // this, a configured Windows path is misclassified as relative and resolved into
@@ -546,7 +563,7 @@ router.get('/read', async (req, res) => {
             res.status(400).json({ error: 'File too large (max 1MB)' });
             return;
         }
-        const content = fs.readFileSync(filePath, 'utf-8');
+        const fileBuffer = fs.readFileSync(filePath);
         const extension = path.extname(filePath).toLowerCase();
         const filename = path.basename(filePath);
         const base = {
@@ -559,6 +576,11 @@ router.get('/read', async (req, res) => {
             areaId: resolution.areaId,
             areaName: resolution.areaName,
         };
+        if (looksLikeBinaryBuffer(fileBuffer)) {
+            res.status(415).json({ ...base, binary: true, error: 'Binary file cannot be read as text' });
+            return;
+        }
+        const content = fileBuffer.toString('utf-8');
         // Preview mode (Ctrl+hover tooltip in the terminal): return only the
         // requested line window. Reading the file is cheap; shipping a 1MB body
         // over the wire on every hover is not.
@@ -762,6 +784,10 @@ router.get('/binary', async (req, res) => {
             '.ico': 'image/x-icon',
             '.svg': 'image/svg+xml',
             '.pdf': 'application/pdf',
+            '.stl': 'model/stl',
+            '.fcstd': 'application/vnd.freecad',
+            '.gcode': 'text/x-gcode',
+            '.gco': 'text/x-gcode',
             '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
             '.xls': 'application/vnd.ms-excel',
             '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
@@ -1817,11 +1843,10 @@ router.get('/git-original', async (req, res) => {
         // Get relative path from git root
         const relativePath = path.relative(gitRoot, filePath);
         // Get original content from HEAD
-        let originalContent;
+        let originalBuffer;
         try {
-            originalContent = execSync(`git show HEAD:"${relativePath}"`, {
+            originalBuffer = execFileSync('git', ['show', `HEAD:${relativePath}`], {
                 cwd: gitRoot,
-                encoding: 'utf-8',
                 maxBuffer: 10 * 1024 * 1024, // 10MB
             });
         }
@@ -1839,11 +1864,22 @@ router.get('/git-original', async (req, res) => {
             }
             throw err;
         }
+        if (looksLikeBinaryBuffer(originalBuffer)) {
+            res.status(415).json({
+                path: filePath,
+                filename: path.basename(filePath),
+                extension: path.extname(filePath).toLowerCase(),
+                binary: true,
+                isNew: false,
+                error: 'Binary file cannot be read as text',
+            });
+            return;
+        }
         res.json({
             path: filePath,
             filename: path.basename(filePath),
             extension: path.extname(filePath).toLowerCase(),
-            content: originalContent,
+            content: originalBuffer.toString('utf-8'),
             isNew: false,
         });
     }
@@ -1852,6 +1888,40 @@ router.get('/git-original', async (req, res) => {
         res.status(500).json({ error: err.message });
     }
 });
+// GET /api/files/git-original-binary - Stream the HEAD version of a binary
+// file. This keeps deleted image/PDF/STL/FCStd previews useful in the Git modal.
+router.get('/git-original-binary', async (req, res) => {
+    try {
+        const resolution = resolveAndValidateFilePath(req.query.path, req.query.baseDir);
+        if (!resolution.ok) {
+            res.status(resolution.status).json({ error: resolution.error });
+            return;
+        }
+        const filePath = resolution.path;
+        const gitRoot = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+            cwd: path.dirname(filePath),
+            encoding: 'utf-8',
+        }).trim();
+        const relativePath = path.relative(gitRoot, filePath);
+        if (!relativePath || relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+            res.status(400).json({ error: 'Path is outside the git repository' });
+            return;
+        }
+        const buffer = execFileSync('git', ['show', `HEAD:${relativePath}`], {
+            cwd: gitRoot,
+            maxBuffer: 50 * 1024 * 1024,
+        });
+        const extension = path.extname(filePath).toLowerCase();
+        res.setHeader('Content-Type', binaryContentTypeForExtension(extension));
+        res.setHeader('Content-Length', buffer.length);
+        res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate');
+        res.send(buffer);
+    }
+    catch (err) {
+        log.error(' Failed to get original binary from git:', err);
+        res.status(404).json({ error: 'Original binary file not found' });
+    }
+});
 // GET /api/files/git-diff - Get unified diff for a file
 router.get('/git-diff', async (req, res) => {
     try {
@@ -3093,6 +3163,10 @@ router.post('/by-path', async (req, res) => {
             '.mp3': 'audio/mpeg',
             '.mp4': 'video/mp4',
             '.wav': 'audio/wav',
+            '.stl': 'model/stl',
+            '.fcstd': 'application/vnd.freecad',
+            '.gcode': 'text/x-gcode',
+            '.gco': 'text/x-gcode',
         };
         const contentType = mimeTypes[extension] || 'application/octet-stream';
         res.setHeader('Content-Type', contentType);

package/dist/src/packages/server/routes/system.js

@@ -15,6 +15,7 @@ import { isDevInstall, maybeTriggerWebBundleRebuild } from '../services/web-bund
 import { deleteClaudeCredentialProfile, getClaudeCredentialProfilesUsage, listClaudeCredentialProfiles, renameClaudeCredentialProfile, saveActiveClaudeCredentialProfile, switchClaudeCredentialProfile, } from '../services/claude-credentials-service.js';
 import { deleteProviderCredentialProfile, listProviderCredentialProfiles, renameProviderCredentialProfile, saveActiveProviderCredentialProfile, switchProviderCredentialProfile, } from '../services/provider-credentials-service.js';
 import { getCodexCredentialProfilesUsage } from '../services/codex-usage-service.js';
+import { killDetachedAppServerDaemon } from '../codex/app-server/app-server-process.js';
 const log = createLogger('SystemRoutes');
 const router = Router();
 const PACKAGE_NAME = 'tide-commander';
@@ -609,9 +610,15 @@ function mountProviderCredentialRoutes(provider, basePath) {
                 res.status(400).json({ error: 'stashActiveAs must be a string when provided' });
                 return;
             }
-            res.json(switchProviderCredentialProfile(provider, name.trim(), {
+            const result = switchProviderCredentialProfile(provider, name.trim(), {
                 stashActiveAs: typeof stashActiveAs === 'string' ? stashActiveAs.trim() : undefined,
-            }));
+            });
+            // The detached `codex app-server` daemon caches ~/.codex/auth.json in
+            // memory at startup, so without this every Codex agent would keep running
+            // on the account the user just switched away from. Killing it makes the
+            // next launch spawn a fresh daemon with the new credentials.
+            const appServerStopped = provider === 'codex' ? killDetachedAppServerDaemon().stopped : false;
+            res.json({ ...result, codexAppServerStopped: appServerStopped });
         }
         catch (err) {
             const message = err.message;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tide-commander",
-  "version": "1.177.2",
+  "version": "1.178.0",
   "description": "Visual multi-agent orchestrator and manager for Claude Code with 3D/2D interface",
   "repository": {
     "type": "git",
@@ -91,6 +91,7 @@
     "mssql": "^12.4.0",
     "multer": "^2.1.1",
     "mysql2": "^3.16.2",
+    "occt-import-js": "^0.0.23",
     "oracledb": "^6.10.0",
     "pdfjs-dist": "^5.6.205",
     "pg": "^8.17.2",