tower-studio 0.1.3 → 0.1.6

package/src/app/api/internal/assistant/chat/route.ts

@@ -1,217 +0,0 @@
-import { NextRequest } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import { buildMultimodalPrompt } from "@/lib/build-multimodal-prompt";
-import { getAssistantCacheRoot } from "@/lib/file-utils";
-import { ClaudeCliAdapter } from "@/lib/ai/adapters/cli/claude-cli-adapter";
-import { db } from "@/lib/db";
-
-const claudeAdapter = new ClaudeCliAdapter();
-
-export const dynamic = "force-dynamic";
-export const runtime = "nodejs";
-
-/**
- * POST /api/internal/assistant/chat
- *
- * Accepts { message: string, sessionId?: string } and streams Claude Agent SDK
- * responses as Server-Sent Events (SSE). Each event is a JSON object with:
- *   - type: "text" | "thinking" | "tool_use" | "tool_result" | "error" | "done"
- *   - content: string (text content or tool info)
- *   - sessionId?: string (returned on first assistant message for resume support)
- *
- * The SDK spawns a Claude Code CLI subprocess per query() call.
- * For multi-turn, pass the sessionId from a previous response.
- */
-export async function POST(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  let body: { message: string; sessionId?: string; imageFilenames?: string[] };
-  try {
-    body = await request.json();
-  } catch {
-    return new Response(JSON.stringify({ error: "Invalid JSON body" }), {
-      status: 400,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
-
-  // Validate imageFilenames: must be array of strings matching sub-path format YYYY-MM/type/filename.ext
-  const IMAGE_FILENAME_RE =
-    /^\d{4}-\d{2}\/(images|files)\/[^/]+\.(jpg|jpeg|png|gif|webp)$/i;
-  const safeImageFilenames = Array.isArray(body.imageFilenames)
-    ? body.imageFilenames.filter(
-        (f): f is string => typeof f === "string" && IMAGE_FILENAME_RE.test(f)
-      )
-    : [];
-
-  if (!body.message?.trim() && safeImageFilenames.length === 0) {
-    return new Response(JSON.stringify({ error: "Message or images required" }), {
-      status: 400,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
-
-  // System prompt is defined in .tower/CLAUDE.md — CLI auto-discovers it from cwd
-  const stream = new ReadableStream({
-    async start(controller) {
-      const encoder = new TextEncoder();
-
-      function send(data: Record<string, unknown>) {
-        controller.enqueue(encoder.encode(`data: ${JSON.stringify(data)}\n\n`));
-      }
-
-      try {
-        const { query } = await import("@anthropic-ai/claude-agent-sdk");
-
-        const claudePath = claudeAdapter.resolveCommand();
-
-        // Ensure .tower/ exists (runtime guard — handles deletion while server is running)
-        const { ensureTowerDir } = await import("@/lib/init-tower");
-        const towerDir = ensureTowerDir();
-
-        const hasImages = safeImageFilenames.length > 0;
-
-        const options: Record<string, unknown> = {
-          // No built-in tools for text-only — add Read tool when images are attached (AI-02)
-          tools: hasImages ? ["Read"] : [],
-          // Auto-approve Tower MCP tools; also auto-approve Read when images attached
-          allowedTools: hasImages
-            ? ["mcp__tower__*", "Read"]
-            : ["mcp__tower__*"],
-          // Streaming — receive text_delta chunks as they arrive
-          includePartialMessages: true,
-          // .tower/ directory has its own CLAUDE.md with assistant persona
-          cwd: towerDir,
-          pathToClaudeCodeExecutable: claudePath,
-        };
-
-        // Resume previous session if sessionId provided
-        if (body.sessionId) {
-          (options as Record<string, unknown>).resume = body.sessionId;
-        }
-
-        // Prepend username identity context on first turn only (no sessionId)
-        let identityPrefix = "";
-        if (!body.sessionId) {
-          const usernameRow = await db.systemConfig.findUnique({ where: { key: "onboarding.username" } });
-          try {
-            const parsed = usernameRow ? JSON.parse(usernameRow.value) : null;
-            if (typeof parsed === "string" && parsed.length > 0) {
-              identityPrefix = `[Context: The user's name is ${parsed}.]\n\n`;
-            }
-          } catch { /* ignore parse errors */ }
-        }
-
-        // Prepend /tower to every message to load the Tower skill into context.
-        const prompt = `${identityPrefix}/tower ${body.message}`;
-
-        // Build multimodal prompt with image paths if images attached (AI-01)
-        const finalPrompt = hasImages
-          ? buildMultimodalPrompt(prompt, safeImageFilenames, getAssistantCacheRoot())
-          : prompt;
-
-        const q = query({
-          prompt: finalPrompt,
-          options: options as Parameters<typeof query>[0]["options"],
-        });
-
-        for await (const msg of q) {
-          switch (msg.type) {
-            case "assistant": {
-              // Extract text content from message blocks
-              const textBlocks = msg.message.content.filter(
-                (b: { type: string }) => b.type === "text"
-              );
-              const text = textBlocks
-                .map((b: { type: string; text?: string }) => b.text ?? "")
-                .join("");
-
-              // Extract tool_use blocks
-              const toolBlocks = msg.message.content.filter(
-                (b: { type: string }) => b.type === "tool_use"
-              );
-
-              if (text) {
-                send({
-                  type: "text",
-                  content: text,
-                  sessionId: msg.session_id,
-                });
-              }
-
-              for (const tool of toolBlocks) {
-                const t = tool as { type: string; name?: string; input?: unknown };
-                send({
-                  type: "tool_use",
-                  content: t.name ?? "unknown",
-                  toolInput: t.input,
-                  sessionId: msg.session_id,
-                });
-              }
-              break;
-            }
-
-            case "result": {
-              const resultMsg = msg as { subtype?: string; error?: string; session_id?: string };
-              if (resultMsg.subtype?.includes("error")) {
-                send({ type: "error", content: resultMsg.error ?? "Execution error" });
-              }
-              send({ type: "done", sessionId: resultMsg.session_id });
-              break;
-            }
-
-            // System messages — tool results, status, etc.
-            case "system": {
-              const sysMsg = msg as { subtype?: string; tool_name?: string; content?: string };
-              if (sysMsg.subtype === "tool_result") {
-                send({
-                  type: "tool_result",
-                  content: sysMsg.tool_name ?? "tool",
-                  toolOutput: sysMsg.content ?? "",
-                });
-              }
-              break;
-            }
-
-            case "stream_event": {
-              // SDKPartialAssistantMessage — per official docs:
-              // msg.event is a RawMessageStreamEvent from the Claude API
-              // msg.event.type === "content_block_delta" && msg.event.delta.type === "text_delta"
-              const streamEvent = (msg as { event: { type: string; delta?: { type: string; text?: string }; content_block?: { type: string; name?: string } }; session_id: string });
-              const evt = streamEvent.event;
-
-              if (evt.type === "content_block_delta" && evt.delta?.type === "text_delta" && evt.delta.text) {
-                send({ type: "text_delta", content: evt.delta.text, sessionId: streamEvent.session_id });
-              } else if (evt.type === "content_block_start" && evt.content_block?.type === "tool_use") {
-                send({ type: "tool_start", content: evt.content_block.name ?? "tool", sessionId: streamEvent.session_id });
-              }
-              break;
-            }
-
-            default:
-              // Ignore other message types (status, auth, hooks, etc.)
-              break;
-          }
-        }
-      } catch (err: unknown) {
-        if (process.env.NODE_ENV !== "production") {
-          const detail = err instanceof Error ? err.message : String(err);
-          console.error("[assistant-chat] ERROR:", detail);
-        }
-        send({ type: "error", content: "Assistant encountered an error. Please try again." });
-      } finally {
-        send({ type: "done" });
-        controller.close();
-      }
-    },
-  });
-
-  return new Response(stream, {
-    headers: {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache",
-      Connection: "keep-alive",
-    },
-  });
-}

package/src/app/api/internal/assistant/images/route.ts

@@ -1,51 +0,0 @@
-import * as path from "node:path";
-import * as fs from "node:fs";
-import { NextRequest, NextResponse } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import { detectImageMime, MIME_TO_EXT } from "@/lib/mime-magic";
-import { getAssistantCacheDir, buildCacheFilename, getAssistantCacheRoot } from "@/lib/file-utils";
-import { getConfigValue } from "@/actions/config-actions";
-
-export const dynamic = "force-dynamic";
-export const runtime = "nodejs";
-
-export async function POST(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const formData = await request.formData();
-  const file = formData.get("file") as File | null;
-  if (!file) {
-    return NextResponse.json({ error: "Missing file field" }, { status: 400 });
-  }
-
-  // Size check using existing system config
-  const maxBytes = await getConfigValue<number>("system.maxUploadBytes", 52428800);
-  if (file.size > maxBytes) {
-    return NextResponse.json({ error: "File too large" }, { status: 400 });
-  }
-
-  const buffer = Buffer.from(await file.arrayBuffer());
-
-  // Magic-byte validation — NOT file.type
-  const mimeType = detectImageMime(buffer);
-  if (!mimeType) {
-    return NextResponse.json({ error: "Unsupported file type" }, { status: 400 });
-  }
-
-  const ext = MIME_TO_EXT[mimeType];
-  const dir = getAssistantCacheDir("images");
-  const filename = buildCacheFilename(file.name, ext);
-  const dest = path.join(dir, filename);
-
-  // Belt-and-suspenders containment check
-  if (!dest.startsWith(dir + path.sep) && dest !== dir) {
-    return NextResponse.json({ error: "Invalid path" }, { status: 400 });
-  }
-
-  await fs.promises.writeFile(dest, buffer);
-
-  // Return sub-path relative to assistant cache root (e.g., "2026-04/images/设计稿-a1b2c3d4.png")
-  const cachePath = path.relative(getAssistantCacheRoot(), dest);
-  return NextResponse.json({ filename: cachePath, mimeType });
-}

package/src/app/api/internal/assistant/route.ts

@@ -1,50 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import {
-  startAssistantSession,
-  stopAssistantSession,
-  getAssistantSessionStatus,
-} from "@/actions/assistant-actions";
-import { ASSISTANT_SESSION_KEY } from "@/lib/assistant-constants";
-
-export const dynamic = "force-dynamic";
-export const runtime = "nodejs";
-
-export async function POST(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  let sessionId: string | undefined;
-  try {
-    const body = await request.json().catch(() => ({})) as { sessionId?: string };
-    if (body.sessionId && typeof body.sessionId === "string") {
-      sessionId = body.sessionId;
-    }
-  } catch {
-    // No body or invalid JSON — treat as new session
-  }
-
-  try {
-    await startAssistantSession(sessionId);
-    return NextResponse.json({ ok: true, sessionKey: ASSISTANT_SESSION_KEY, sessionId: sessionId ?? null });
-  } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : String(error);
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
-
-export async function DELETE(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  await stopAssistantSession();
-  return NextResponse.json({ ok: true });
-}
-
-export async function GET(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const status = await getAssistantSessionStatus();
-  return NextResponse.json({ status });
-}

package/src/app/api/internal/assistant/sessions/route.ts

@@ -1,44 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import { ensureTowerDir } from "@/lib/init-tower";
-import {
-  convertSessionMessages,
-  type SDKSessionMessage,
-} from "@/lib/assistant-message-converter";
-
-export const dynamic = "force-dynamic";
-export const runtime = "nodejs";
-
-/**
- * GET /api/internal/assistant/sessions?sessionId=xxx
- *
- * Returns messages for a specific session from the SDK.
- * Session list is managed client-side via localStorage registry
- * to avoid cross-project session leakage from SDK's listSessions.
- */
-export async function GET(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const sessionId = request.nextUrl.searchParams.get("sessionId");
-  if (!sessionId) {
-    return NextResponse.json({ error: "sessionId required" }, { status: 400 });
-  }
-
-  const towerDir = ensureTowerDir();
-
-  try {
-    const { getSessionMessages } = await import(
-      "@anthropic-ai/claude-agent-sdk"
-    );
-    const sdkMessages = (await getSessionMessages(sessionId, {
-      dir: towerDir,
-    })) as SDKSessionMessage[];
-    const chatMessages = convertSessionMessages(sdkMessages);
-    return NextResponse.json({ messages: chatMessages });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error("[assistant-sessions] Error:", message);
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}

package/src/app/api/internal/cache/[...segments]/route.ts

@@ -1,59 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { NextRequest, NextResponse } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import { MIME_MAP } from "@/lib/file-serve";
-import { getAssistantCacheRoot } from "@/lib/file-utils";
-
-export const dynamic = "force-dynamic";
-export const runtime = "nodejs";
-
-// Sub-path format: YYYY-MM/(images|files)/filename.ext
-// Uses [^/]+ for the filename segment to allow Unicode/Chinese characters
-const SUBPATH_RE =
-  /^\d{4}-\d{2}\/(images|files)\/[^/]+\.(jpg|jpeg|png|gif|webp)$/i;
-
-export async function GET(
-  request: NextRequest,
-  { params }: { params: Promise<{ segments: string[] }> }
-) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const { segments } = await params;
-  // Next.js auto-decodes URL-encoded segments — do NOT call decodeURIComponent
-  const subPath = segments.join("/");
-
-  if (!SUBPATH_RE.test(subPath)) {
-    return NextResponse.json({ error: "Invalid path" }, { status: 400 });
-  }
-
-  const cacheRoot = getAssistantCacheRoot();
-  const resolved = path.resolve(cacheRoot, subPath);
-
-  // Containment check — resolved path must be inside cache root
-  if (!resolved.startsWith(cacheRoot + path.sep)) {
-    return NextResponse.json({ error: "Invalid path" }, { status: 400 });
-  }
-
-  let bytes: Buffer;
-  try {
-    bytes = await fs.promises.readFile(resolved);
-  } catch (err: unknown) {
-    if ((err as NodeJS.ErrnoException).code === "ENOENT") {
-      return NextResponse.json({ error: "Not found" }, { status: 404 });
-    }
-    return NextResponse.json({ error: "Read error" }, { status: 500 });
-  }
-
-  const ext = path.extname(subPath).toLowerCase();
-  const contentType = MIME_MAP[ext] ?? "application/octet-stream";
-
-  return new Response(new Uint8Array(bytes), {
-    status: 200,
-    headers: {
-      "Content-Type": contentType,
-      "Cache-Control": "private, max-age=3600",
-    },
-  });
-}

package/src/app/api/internal/hooks/install/route.ts

@@ -1,41 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import * as path from "node:path";
-import { ClaudeCliAdapter } from "@/lib/ai/adapters/cli/claude-cli-adapter";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-const claudeAdapter = new ClaudeCliAdapter();
-
-export async function GET(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const installed = await claudeAdapter.isHooksInstalled();
-  const hookPath = path.join(process.cwd(), "scripts", "post-tool-hook.js");
-
-  return NextResponse.json({
-    installed,
-    hookPath,
-  });
-}
-
-export async function POST(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  const apiUrl = process.env.NEXTAUTH_URL ?? `http://localhost:${process.env.PORT ?? 3000}`;
-  await claudeAdapter.installHooks(apiUrl);
-
-  return NextResponse.json({ success: true });
-}
-
-export async function DELETE(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  await claudeAdapter.uninstallHooks();
-
-  return NextResponse.json({ success: true });
-}

package/src/app/api/internal/hooks/session/route.ts

@@ -1,60 +0,0 @@
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-import { NextRequest, NextResponse } from "next/server";
-import { db } from "@/lib/db";
-import { requireLocalhost, validateTaskId } from "@/lib/internal-api-guard";
-
-/**
- * POST /api/internal/hooks/session
- *
- * Accepts { taskId, sessionId } from the PostToolUse hook.
- * Stores sessionId on the RUNNING execution for this task.
- * Idempotent — skips if sessionId already set.
- */
-export async function POST(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  let body: { taskId?: string; sessionId?: string };
-  try {
-    body = await request.json();
-  } catch {
-    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
-  }
-
-  const { taskId, sessionId } = body;
-
-  if (!taskId || typeof taskId !== "string") {
-    return NextResponse.json({ error: "Missing taskId" }, { status: 400 });
-  }
-  const taskIdError = validateTaskId(taskId);
-  if (taskIdError) return taskIdError;
-
-  if (!sessionId || typeof sessionId !== "string") {
-    return NextResponse.json({ error: "Missing sessionId" }, { status: 400 });
-  }
-
-  // Find the RUNNING execution for this task
-  const execution = await db.taskExecution.findFirst({
-    where: { taskId, status: "RUNNING" },
-    orderBy: { createdAt: "desc" },
-    select: { id: true, sessionId: true },
-  });
-
-  if (!execution) {
-    return NextResponse.json({ error: "No running execution" }, { status: 404 });
-  }
-
-  // Skip if already set (idempotent)
-  if (execution.sessionId) {
-    return NextResponse.json({ ok: true, skipped: true });
-  }
-
-  await db.taskExecution.update({
-    where: { id: execution.id },
-    data: { sessionId },
-  });
-
-  return NextResponse.json({ ok: true, sessionId });
-}

package/src/app/api/internal/hooks/stop/route.ts

@@ -1,61 +0,0 @@
-import { NextRequest, NextResponse } from "next/server";
-import { requireLocalhost } from "@/lib/internal-api-guard";
-import { db } from "@/lib/db";
-import { broadcastNotification } from "@/lib/pty/ws-server";
-
-export const runtime = "nodejs";
-export const dynamic = "force-dynamic";
-
-export interface StopEvent {
-  taskId: string;
-  taskTitle: string;
-  sessionId: string;
-  workspaceId: string;
-  type: "stop";
-  timestamp: string;
-}
-
-export async function POST(request: NextRequest) {
-  const blocked = requireLocalhost(request);
-  if (blocked) return blocked;
-
-  let body: { taskId?: string; sessionId?: string };
-  try {
-    body = await request.json();
-  } catch {
-    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
-  }
-
-  const { taskId, sessionId } = body;
-  if (!taskId || typeof taskId !== "string") {
-    return NextResponse.json({ error: "taskId required" }, { status: 400 });
-  }
-
-  // Look up task to get title and workspaceId
-  const task = await db.task.findUnique({
-    where: { id: taskId },
-    select: {
-      id: true,
-      title: true,
-      project: { select: { workspaceId: true } },
-    },
-  });
-
-  if (!task) {
-    return NextResponse.json({ error: "Task not found" }, { status: 404 });
-  }
-
-  const event: StopEvent = {
-    taskId: task.id,
-    taskTitle: task.title,
-    sessionId: sessionId ?? "",
-    workspaceId: task.project.workspaceId,
-    type: "stop",
-    timestamp: new Date().toISOString(),
-  };
-
-  // Push to all connected notification WS clients
-  broadcastNotification(event);
-
-  return NextResponse.json({ ok: true });
-}