upfynai-code 2.4.1 → 2.5.0

package/server/projects.js

@@ -387,8 +387,8 @@ async function extractProjectDirectory(projectName) {
 }
 
 async function getProjects(progressCallback = null) {
-  // Wrap with a 10s timeout to prevent hanging on slow filesystems
-  const timeoutMs = 10000;
+  // Wrap with a timeout to prevent hanging on slow filesystems
+  const timeoutMs = 15000;
   const result = await Promise.race([
     _getProjectsImpl(progressCallback),
     new Promise((_, reject) => setTimeout(() => reject(new Error('Projects scan timed out')), timeoutMs))
@@ -403,220 +403,103 @@ async function _getProjectsImpl(progressCallback = null) {
   const claudeDir = path.join(os.homedir(), '.claude', 'projects');
   const config = await loadProjectConfig();
   const projects = [];
-  const existingProjects = new Set();
   const codexSessionsIndexRef = { sessionsByProject: null };
-  let totalProjects = 0;
+
+  // Only load projects that were explicitly added by the user (manuallyAdded).
+  // No auto-scanning of ~/.claude/projects/ — the user adds projects via the UI.
+  const manualEntries = Object.entries(config).filter(([, cfg]) => cfg.manuallyAdded);
+  const totalProjects = manualEntries.length;
   let processedProjects = 0;
-  let directories = [];
 
-  try {
-    // Check if the .claude/projects directory exists
-    await fs.access(claudeDir);
-
-    // First, get existing Claude projects from the file system
-    const entries = await fs.readdir(claudeDir, { withFileTypes: true });
-    directories = entries.filter(e => e.isDirectory());
-
-    // Build set of existing project names for later
-    directories.forEach(e => existingProjects.add(e.name));
-
-    // Count manual projects not already in directories
-    const manualProjectsCount = Object.entries(config)
-      .filter(([name, cfg]) => cfg.manuallyAdded && !existingProjects.has(name))
-      .length;
-
-    totalProjects = directories.length + manualProjectsCount;
-
-    for (const entry of directories) {
-        processedProjects++;
-
-        // Emit progress
-        if (progressCallback) {
-          progressCallback({
-            phase: 'loading',
-            current: processedProjects,
-            total: totalProjects,
-            currentProject: entry.name
-          });
-        }
+  for (const [projectName, projectConfig] of manualEntries) {
+    processedProjects++;
 
-        // Extract actual project directory from JSONL sessions
-        const actualProjectDir = await extractProjectDirectory(entry.name);
-        
-        // Get display name from config or generate one
-        const customName = config[entry.name]?.displayName;
-        const autoDisplayName = await generateDisplayName(entry.name, actualProjectDir);
-        const fullPath = actualProjectDir;
-        
-        const project = {
-          name: entry.name,
-          path: actualProjectDir,
-          displayName: customName || autoDisplayName,
-          fullPath: fullPath,
-          isCustomName: !!customName,
-          sessions: [],
-          sessionMeta: {
-            hasMore: false,
-            total: 0
-          }
-        };
-        
-        // Try to get sessions for this project (just first 5 for performance)
-        try {
-          const sessionResult = await getSessions(entry.name, 5, 0);
-          project.sessions = sessionResult.sessions || [];
-          project.sessionMeta = {
-            hasMore: sessionResult.hasMore,
-            total: sessionResult.total
-          };
-        } catch (e) {
-          console.warn(`Could not load sessions for project ${entry.name}:`, e.message);
-          project.sessionMeta = {
-            hasMore: false,
-            total: 0
-          };
-        }
-        
-        // Also fetch Cursor sessions for this project
-        try {
-          project.cursorSessions = await getCursorSessions(actualProjectDir);
-        } catch (e) {
-          console.warn(`Could not load Cursor sessions for project ${entry.name}:`, e.message);
-          project.cursorSessions = [];
-        }
-
-        // Also fetch Codex sessions for this project
-        try {
-          project.codexSessions = await getCodexSessions(actualProjectDir, {
-            indexRef: codexSessionsIndexRef,
-          });
-        } catch (e) {
-          console.warn(`Could not load Codex sessions for project ${entry.name}:`, e.message);
-          project.codexSessions = [];
-        }
+    if (progressCallback) {
+      progressCallback({
+        phase: 'loading',
+        current: processedProjects,
+        total: totalProjects,
+        currentProject: projectName
+      });
+    }
 
-        // Add TaskMaster detection
-        try {
-          const taskMasterResult = await detectTaskMasterFolder(actualProjectDir);
-          project.taskmaster = {
-            hasTaskmaster: taskMasterResult.hasTaskmaster,
-            hasEssentialFiles: taskMasterResult.hasEssentialFiles,
-            metadata: taskMasterResult.metadata,
-            status: taskMasterResult.hasTaskmaster && taskMasterResult.hasEssentialFiles ? 'configured' : 'not-configured'
-          };
-        } catch (e) {
-          console.warn(`Could not detect TaskMaster for project ${entry.name}:`, e.message);
-          project.taskmaster = {
-            hasTaskmaster: false,
-            hasEssentialFiles: false,
-            metadata: null,
-            status: 'error'
-          };
-        }
+    // Use the original path if available, otherwise extract from potential sessions
+    let actualProjectDir = projectConfig.originalPath;
 
-      projects.push(project);
-    }
-  } catch (error) {
-    // If the directory doesn't exist (ENOENT), that's okay - just continue with empty projects
-    if (error.code !== 'ENOENT') {
-      console.error('Error reading projects directory:', error);
-    }
-    // Calculate total for manual projects only (no directories exist)
-    totalProjects = Object.entries(config)
-      .filter(([name, cfg]) => cfg.manuallyAdded)
-      .length;
-  }
-  
-  // Add manually configured projects that don't exist as folders yet
-  for (const [projectName, projectConfig] of Object.entries(config)) {
-    if (!existingProjects.has(projectName) && projectConfig.manuallyAdded) {
-      processedProjects++;
-
-      // Emit progress for manual projects
-      if (progressCallback) {
-        progressCallback({
-          phase: 'loading',
-          current: processedProjects,
-          total: totalProjects,
-          currentProject: projectName
-        });
+    if (!actualProjectDir) {
+      try {
+        actualProjectDir = await extractProjectDirectory(projectName);
+      } catch (error) {
+        // Fall back to decoded project name
+        actualProjectDir = projectName.replace(/-/g, '/');
       }
+    }
 
-      // Use the original path if available, otherwise extract from potential sessions
-      let actualProjectDir = projectConfig.originalPath;
-      
-      if (!actualProjectDir) {
-        try {
-          actualProjectDir = await extractProjectDirectory(projectName);
-        } catch (error) {
-          // Fall back to decoded project name
-          actualProjectDir = projectName.replace(/-/g, '/');
-        }
-      }
-      
-      const project = {
-          name: projectName,
-          path: actualProjectDir,
-          displayName: projectConfig.displayName || await generateDisplayName(projectName, actualProjectDir),
-          fullPath: actualProjectDir,
-          isCustomName: !!projectConfig.displayName,
-          isManuallyAdded: true,
-          sessions: [],
-          sessionMeta: {
-            hasMore: false,
-            total: 0
-          },
-          cursorSessions: [],
-          codexSessions: []
+    const project = {
+      name: projectName,
+      path: actualProjectDir,
+      displayName: projectConfig.displayName || await generateDisplayName(projectName, actualProjectDir),
+      fullPath: actualProjectDir,
+      isCustomName: !!projectConfig.displayName,
+      isManuallyAdded: true,
+      sessions: [],
+      sessionMeta: { hasMore: false, total: 0 },
+      cursorSessions: [],
+      codexSessions: []
+    };
+
+    // Check if a Claude project folder exists for this project (for session history)
+    const projectDir = path.join(claudeDir, projectName);
+    try {
+      await fs.access(projectDir);
+      const sessionResult = await getSessions(projectName, 5, 0);
+      project.sessions = sessionResult.sessions || [];
+      project.sessionMeta = {
+        hasMore: sessionResult.hasMore,
+        total: sessionResult.total
       };
+    } catch (e) {
+      // No Claude sessions — that's fine
+    }
 
-      // Try to fetch Cursor sessions for manual projects too
-      try {
-        project.cursorSessions = await getCursorSessions(actualProjectDir);
-      } catch (e) {
-        console.warn(`Could not load Cursor sessions for manual project ${projectName}:`, e.message);
-      }
+    // Fetch Cursor sessions
+    try {
+      project.cursorSessions = await getCursorSessions(actualProjectDir);
+    } catch (e) {
+      // No Cursor sessions
+    }
 
-      // Try to fetch Codex sessions for manual projects too
-      try {
-        project.codexSessions = await getCodexSessions(actualProjectDir, {
-          indexRef: codexSessionsIndexRef,
-        });
-      } catch (e) {
-        console.warn(`Could not load Codex sessions for manual project ${projectName}:`, e.message);
-      }
+    // Fetch Codex sessions
+    try {
+      project.codexSessions = await getCodexSessions(actualProjectDir, {
+        indexRef: codexSessionsIndexRef,
+      });
+    } catch (e) {
+      // No Codex sessions
+    }
 
-      // Add TaskMaster detection for manual projects
-      try {
-        const taskMasterResult = await detectTaskMasterFolder(actualProjectDir);
-        
-        // Determine TaskMaster status
-        let taskMasterStatus = 'not-configured';
-        if (taskMasterResult.hasTaskmaster && taskMasterResult.hasEssentialFiles) {
-          taskMasterStatus = 'taskmaster-only'; // We don't check MCP for manual projects in bulk
-        }
-        
-        project.taskmaster = {
-          status: taskMasterStatus,
-          hasTaskmaster: taskMasterResult.hasTaskmaster,
-          hasEssentialFiles: taskMasterResult.hasEssentialFiles,
-          metadata: taskMasterResult.metadata
-        };
-      } catch (error) {
-        console.warn(`TaskMaster detection failed for manual project ${projectName}:`, error.message);
-        project.taskmaster = {
-          status: 'error',
-          hasTaskmaster: false,
-          hasEssentialFiles: false,
-          error: error.message
-        };
-      }
-      
-      projects.push(project);
+    // TaskMaster detection
+    try {
+      const taskMasterResult = await detectTaskMasterFolder(actualProjectDir);
+      project.taskmaster = {
+        status: taskMasterResult.hasTaskmaster && taskMasterResult.hasEssentialFiles
+          ? 'configured' : 'not-configured',
+        hasTaskmaster: taskMasterResult.hasTaskmaster,
+        hasEssentialFiles: taskMasterResult.hasEssentialFiles,
+        metadata: taskMasterResult.metadata
+      };
+    } catch (error) {
+      project.taskmaster = {
+        status: 'error',
+        hasTaskmaster: false,
+        hasEssentialFiles: false,
+        error: error.message
+      };
     }
+
+    projects.push(project);
   }
 
-  // Emit completion after all projects (including manual) are processed
   if (progressCallback) {
     progressCallback({
       phase: 'complete',
@@ -1225,7 +1108,17 @@ async function addProjectManually(projectPath, displayName = null) {
   const projectDir = path.join(os.homedir(), '.claude', 'projects', projectName);
 
   if (config[projectName]) {
-    throw new Error(`Project already configured for path: ${absolutePath}`);
+    // Project already exists — return it instead of erroring
+    return {
+      name: projectName,
+      path: absolutePath,
+      fullPath: absolutePath,
+      displayName: config[projectName].displayName || await generateDisplayName(projectName, absolutePath),
+      isManuallyAdded: true,
+      alreadyExists: true,
+      sessions: [],
+      cursorSessions: []
+    };
   }
 
   // Allow adding projects even if the directory exists - this enables tracking

package/server/relay-client.js

@@ -413,11 +413,15 @@ export async function connectToServer(options = {}) {
   let reconnectAttempts = 0;
   const MAX_RECONNECT = 10;
 
+  let lastPongTime = Date.now();
+
   function connect() {
     const ws = createRelayConnection(wsUrl, config);
+    lastPongTime = Date.now();
 
     ws.on('open', () => {
       reconnectAttempts = 0;
+      lastPongTime = Date.now();
       // Don't stop spinner yet — wait for relay-connected message
     });
 
@@ -468,7 +472,14 @@ export async function connectToServer(options = {}) {
           return;
         }
 
-        if (data.type === 'pong') return;
+        if (data.type === 'pong' || data.type === 'server-ping') {
+          lastPongTime = Date.now();
+          // Reply to server-ping so server knows we're alive
+          if (data.type === 'server-ping') {
+            ws.send(JSON.stringify({ type: 'ping' }));
+          }
+          return;
+        }
 
         if (data.type === 'error') {
           spinner.fail(`Server error: ${data.error}`);
@@ -503,14 +514,24 @@ export async function connectToServer(options = {}) {
       // close handler will trigger reconnect
     });
 
-    // Heartbeat every 30 seconds
+    // Heartbeat every 30 seconds with pong timeout detection
     const heartbeat = setInterval(() => {
-      if (ws.readyState === 1) {
-        ws.send(JSON.stringify({ type: 'ping' }));
-      } else {
+      if (ws.readyState !== 1) {
+        clearInterval(heartbeat);
+        return;
+      }
+      // If no pong received in 75s, consider connection dead
+      if (Date.now() - lastPongTime > 75000) {
         clearInterval(heartbeat);
+        logRelayEvent('!', 'No heartbeat response — connection stale, reconnecting...', 'yellow');
+        ws.terminate();
+        return;
       }
+      ws.send(JSON.stringify({ type: 'ping' }));
     }, 30000);
+
+    ws.on('close', () => clearInterval(heartbeat));
+    ws.on('error', () => clearInterval(heartbeat));
   }
 
   connect();
@@ -538,13 +559,22 @@ export function connectToServerBackground(options = {}) {
 
   let reconnectAttempts = 0;
   const MAX_RECONNECT = 5;
+  let lastPongTime = Date.now();
 
   function connect() {
     const ws = createRelayConnection(wsUrl, config);
+    lastPongTime = Date.now();
 
     ws.on('message', (rawMessage) => {
       try {
         const data = JSON.parse(rawMessage);
+        if (data.type === 'pong' || data.type === 'server-ping') {
+          lastPongTime = Date.now();
+          if (data.type === 'server-ping') {
+            ws.send(JSON.stringify({ type: 'ping' }));
+          }
+          return;
+        }
         if (data.type === 'relay-command') {
           handleRelayCommand(data, ws);
         }
@@ -553,9 +583,11 @@ export function connectToServerBackground(options = {}) {
 
     ws.on('open', () => {
       reconnectAttempts = 0;
+      lastPongTime = Date.now();
     });
 
     ws.on('close', (code) => {
+      clearInterval(heartbeat);
       if (code === 1000) return;
       reconnectAttempts++;
       if (reconnectAttempts <= MAX_RECONNECT) {
@@ -565,16 +597,21 @@ export function connectToServerBackground(options = {}) {
     });
 
     ws.on('error', () => {
-      // silent — close handler will reconnect
+      clearInterval(heartbeat);
     });
 
-    // Heartbeat
+    // Heartbeat with pong timeout
     const heartbeat = setInterval(() => {
-      if (ws.readyState === 1) {
-        ws.send(JSON.stringify({ type: 'ping' }));
-      } else {
+      if (ws.readyState !== 1) {
+        clearInterval(heartbeat);
+        return;
+      }
+      if (Date.now() - lastPongTime > 75000) {
         clearInterval(heartbeat);
+        ws.terminate();
+        return;
       }
+      ws.send(JSON.stringify({ type: 'ping' }));
     }, 30000);
   }
 

package/server/routes/auth.js

@@ -220,6 +220,12 @@ router.get('/user', authenticateToken, async (req, res) => {
   }
 });
 
+// Get a fresh JWT for the current session (used by frontend to pass to iframe)
+router.get('/token', authenticateToken, (req, res) => {
+  const token = generateToken(req.user);
+  res.json({ token });
+});
+
 // Get user's tokens — relay token (for Connect + MCP) and API key
 router.get('/connect-token', authenticateToken, async (req, res) => {
   try {

package/server/routes/dashboard.js

@@ -0,0 +1,52 @@
+import { Router } from 'express';
+import { getProjects, getSessions } from '../projects.js';
+
+const router = Router();
+
+/**
+ * GET /api/dashboard/stats — Dashboard usage analytics
+ * Returns session counts, provider breakdown, and today's activity.
+ */
+router.get('/stats', async (req, res) => {
+  try {
+    const projects = await getProjects();
+    let totalSessions = 0;
+    let todaySessions = 0;
+    const providers = {};
+    const today = new Date().toISOString().slice(0, 10);
+
+    for (const project of projects) {
+      // Count sessions per provider
+      for (const provider of ['claude', 'cursor', 'codex']) {
+        try {
+          const sessions = await getSessions(project.name, provider);
+          if (sessions && sessions.length) {
+            totalSessions += sessions.length;
+            providers[provider] = (providers[provider] || 0) + sessions.length;
+
+            // Count today's sessions
+            for (const s of sessions) {
+              const created = s.created_at || s.createdAt || '';
+              if (created.startsWith(today)) {
+                todaySessions++;
+              }
+            }
+          }
+        } catch (e) {
+          // Provider not available for this project
+        }
+      }
+    }
+
+    res.json({
+      total: totalSessions,
+      today: todaySessions,
+      providers,
+      projectCount: projects.length,
+    });
+  } catch (error) {
+    res.status(500).json({ error: 'Failed to fetch dashboard stats' });
+  }
+});
+
+export default router;

package/server/routes/projects.js

@@ -12,8 +12,11 @@ function sanitizeGitError(message, token) {
   return message.replace(new RegExp(token.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'), '***');
 }
 
-// Configure allowed workspace root (defaults to user's home directory)
-export const WORKSPACES_ROOT = process.env.WORKSPACES_ROOT || os.homedir();
+// Configure allowed workspace root.
+// In local/platform mode, allow any path (no root restriction) unless explicitly set.
+// In hosted mode, default to user's home directory for security.
+const IS_LOCAL = !process.env.RAILWAY_ENVIRONMENT && !process.env.VERCEL && !process.env.RENDER;
+export const WORKSPACES_ROOT = process.env.WORKSPACES_ROOT || (IS_LOCAL ? null : os.homedir());
 
 // System-critical paths that should never be used as workspace directories
 export const FORBIDDEN_PATHS = [
@@ -110,42 +113,41 @@ export async function validateWorkspacePath(requestedPath) {
       }
     }
 
-    // Resolve the workspace root to its real path
-    const resolvedWorkspaceRoot = await fs.realpath(WORKSPACES_ROOT);
+    // If a workspace root is configured, enforce containment
+    if (WORKSPACES_ROOT) {
+      const resolvedWorkspaceRoot = await fs.realpath(WORKSPACES_ROOT);
 
-    // Ensure the resolved path is contained within the allowed workspace root
-    if (!realPath.startsWith(resolvedWorkspaceRoot + path.sep) &&
-        realPath !== resolvedWorkspaceRoot) {
-      return {
-        valid: false,
-        error: `Workspace path must be within the allowed workspace root: ${WORKSPACES_ROOT}`
-      };
-    }
+      if (!realPath.startsWith(resolvedWorkspaceRoot + path.sep) &&
+          realPath !== resolvedWorkspaceRoot) {
+        return {
+          valid: false,
+          error: `Workspace path must be within the allowed workspace root: ${WORKSPACES_ROOT}`
+        };
+      }
 
-    // Additional symlink check for existing paths
-    try {
-      await fs.access(absolutePath);
-      const stats = await fs.lstat(absolutePath);
-
-      if (stats.isSymbolicLink()) {
-        // Verify symlink target is also within allowed root
-        const linkTarget = await fs.readlink(absolutePath);
-        const resolvedTarget = path.resolve(path.dirname(absolutePath), linkTarget);
-        const realTarget = await fs.realpath(resolvedTarget);
-
-        if (!realTarget.startsWith(resolvedWorkspaceRoot + path.sep) &&
-            realTarget !== resolvedWorkspaceRoot) {
-          return {
-            valid: false,
-            error: 'Symlink target is outside the allowed workspace root'
-          };
+      // Additional symlink check for existing paths
+      try {
+        await fs.access(absolutePath);
+        const stats = await fs.lstat(absolutePath);
+
+        if (stats.isSymbolicLink()) {
+          const linkTarget = await fs.readlink(absolutePath);
+          const resolvedTarget = path.resolve(path.dirname(absolutePath), linkTarget);
+          const realTarget = await fs.realpath(resolvedTarget);
+
+          if (!realTarget.startsWith(resolvedWorkspaceRoot + path.sep) &&
+              realTarget !== resolvedWorkspaceRoot) {
+            return {
+              valid: false,
+              error: 'Symlink target is outside the allowed workspace root'
+            };
+          }
+        }
+      } catch (error) {
+        if (error.code !== 'ENOENT') {
+          throw error;
         }
       }
-    } catch (error) {
-      if (error.code !== 'ENOENT') {
-        throw error;
-      }
-      // Path doesn't exist - that's fine for new workspace creation
     }
 
     return {
@@ -301,7 +303,8 @@ router.post('/create-workspace', async (req, res) => {
   } catch (error) {
     // workspace creation error
     res.status(500).json({
-      error: 'Failed to create workspace'
+      error: 'Failed to create workspace',
+      details: error.message
     });
   }
 });