Files
claudecodeui/server/routes/commands.js
Haile 4cee5e7286 Fix/resolve different bugs (#964)
* fix: don't overlap thinking banner over conversation

* feat: support message queue and add attention indicator

* fix(shell): use c to copy for claude

* fix: strip timestamp tags from cursor

* fix: select project when loading session from direct URL

* feat: support attached images for all providers

* feat(opencode): support permission options

* fix: resolve source control and chat UX bugs

- make staging real in the git panel: new /stage and /unstage endpoints,
  /status now reports the actual index via porcelain -z (handles renames,
  conflicts, and paths with spaces), and Stage/Unstage All run real git
  commands instead of toggling client-side state
- add branch search to the header dropdown and Branches tab
- persist the chosen permission mode per provider so a brand-new chat
  keeps it once the session id arrives, instead of reverting to default
- replace cmdk's fuzzy model search with strict token matching so
  "chatgpt" no longer surfaces unrelated models
- unit tests for the git status parser

* feat(git): commit graph in history view and cross-spawn everywhere

- render a VSCode-style commit graph in the source control history:
  lane-assignment algorithm, SVG strip with colored rails, merge and
  branch curves, commit dots, and branch/tag badges per commit
- /commits returns parents and ref decorations across all branches
  (--branches --remotes --tags --topo-order) using unit-separator
  fields so pipes in commit subjects can't break parsing
- collect stats via a single --shortstat pass instead of one
  `git show --stat` call per commit; raise the history limit to 50
- replace child_process spawn with cross-spawn in all runtimes,
  routes, and services: it resolves .cmd shims and PATHEXT on
  Windows (fixing taskmaster's npx invocations) and delegates to
  native spawn elsewhere, removing the per-file win32 ternaries
- unit tests for the log parser and lane assignment

* fix: remove gemini support since google discontinued it

* fix: address code review findings

- validate chat image attachments server-side: only files inside the
  ~/.cloudcli/assets upload store may reach provider file reads
- harden asset serving with nosniff and attachment disposition for
  SVGs to prevent stored XSS
- show the timestamp on image-only user messages
- serialize git stage/unstage calls and defer the status re-sync so
  rapid toggles can't interleave or flicker
- use a literal hex fallback for commit ref badges (alpha suffix on a
  var() string produced invalid CSS)
- stop binding a URL session to a guening
  project instead
- add the missing attentionRequiredIndicator key to all sidebar locales
- clean up dangling conjunctions left the
  de/ru/tr/ja/zh-CN/zh-TW READMEs

* fix: address code scanning findings

- enforce a second image trust boundary in the provider builders:
  buildClaudeUserContent/buildCodexInputItems only accept files inside
  the upload store or the run's working directory (CodeQL path
  injection)
- drop an always-true selectedProject check in handleSubmit
- remove the unused resume option from spawnCursor

* fix: use CodeQL-recognized containment check for image reads

Replace the path.relative guard in isPathInsideDirectory with the
resolve + startsWith(root + sep) idiom so the path-injection barrier
is visible to code scanning; behavior is unchanged.

* fix(security): canonicalize Claude image attachment reads

Resolve image attachment paths with realpath before reading so symlinks
inside allowed roots cannot escape to arbitrary files. Preserve support for
symlinked project/upload roots and add focused coverage for both cases.

* fix: show agent subtask

* fix(sessions): title app-created sessions from the first user message

App-created sessions (started by sending a message from cloudcli) were
titled with placeholder names — "Untitled Codex Session" from the disk
indexer and, briefly, "New session" from the empty canonical upsert —
before a later sync finally settled on the right text, causing the
sidebar title to flicker.

- Codex/OpenCode synchronizers now title app-created sessions (distinct
  app id mapped to a provider id) from the first user message, while
  sessions found purely by indexing keep their existing setup. Claude
  keeps its AI-generated titles; Cursor already used the first message.
- Decode OpenCode's JSON-string-literal prompts so titles no longer
  surface wrapped in quotes; hoist unwrapJsonStringLiteral into
  shared/utils since it's now used by both the reader and synchronizer.
- Guard the sidebar upsert merge so an empty summary can never blank out
  a title that is already set.
- Add codex/opencode synchronizer tests for the app-created vs indexed
  naming paths.

* fix(chat): make message queuing reliable across sessions and turn boundaries

Queued messages had four related defects:

- A queued message flashed and then vanished at flush time: concurrent
  transcript refreshes (the `complete` handler racing the watcher-triggered
  update) could resolve out of order, letting a stale response overwrite
  newer server messages after the optimistic row was pruned. Session slots
  now carry a monotonic fetch ticket and discard stale fetch/refresh/
  fetchMore responses.

- Switching sessions flushed the previous session's queued draft into the
  newly viewed one (sending it with the wrong provider's settings, e.g. a
  Claude model into a Codex session). The composer flush is now scoped to
  its session, and a draft restored into an idle session sends after a
  short grace period so a live-run ack can cancel it.

- The thinking banner never appeared for a queued turn: the chat handler's
  session-keyed completeRun safety net could fire after a queued message
  had already started the session's next run, emitting a spurious
  `complete` that killed it. The safety net is now scoped to its own run
  via completeRunIfCurrent (with a regression test).

- Queued messages only sent while their session was being viewed. Drafts
  now persist their send options (model, effort, permissions) at queue
  time, and a new app-level useQueuedMessageAutoSend hook dispatches a
  non-viewed session's queued message as soon as its run completes, using
  the storage key as the claim ticket to prevent double sends.
2026-07-08 10:32:32 +02:00

597 lines
16 KiB
JavaScript

import { promises as fs } from "fs";
import os from "os";
import path from "path";
import express from "express";
import { providerModelsService } from "../modules/providers/services/provider-models.service.js";
import { parseFrontMatter } from "../shared/frontmatter.js";
import { findAppRoot, getModuleDir } from "../utils/runtime-paths.js";
const __dirname = getModuleDir(import.meta.url);
// This route reads the top-level package.json for the status command, so it needs the real
// app root even after compilation moves the route file under dist-server/server/routes.
const APP_ROOT = findAppRoot(__dirname);
const router = express.Router();
const MODEL_PROVIDERS = ["claude", "cursor", "codex", "opencode"];
const MODEL_PROVIDER_LABELS = {
claude: "Claude",
cursor: "Cursor",
codex: "Codex",
opencode: "OpenCode",
};
const readModelProvider = (value) => {
if (typeof value !== "string") {
return "claude";
}
const normalized = value.trim().toLowerCase();
return MODEL_PROVIDERS.includes(normalized) ? normalized : "claude";
};
const hasConcreteSessionId = (value) =>
typeof value === "string" && value.trim().length > 0;
const resolveCommandModel = async (provider, catalog, sessionId) => {
if (!hasConcreteSessionId(sessionId)) {
return catalog.DEFAULT;
}
const currentActiveModel = await providerModelsService.getCurrentActiveModel(
provider,
sessionId,
);
return currentActiveModel?.model || catalog.DEFAULT;
};
export const executeModelsCommand = async (args, context) => {
const currentProvider = readModelProvider(context?.provider);
const result = await providerModelsService.getProviderModels(currentProvider);
const catalog = result.models;
const currentModel = await resolveCommandModel(
currentProvider,
catalog,
context?.sessionId,
);
const availableModels = catalog.OPTIONS.map((option) => option.value);
const availableOptions = catalog.OPTIONS.map((option) => ({
value: option.value,
label: option.label,
description: option.description,
}));
return {
type: "builtin",
action: "models",
data: {
current: {
provider: currentProvider,
providerLabel: MODEL_PROVIDER_LABELS[currentProvider],
model: currentModel,
},
available: {
[currentProvider]: availableModels,
},
availableModels,
availableOptions,
defaultModel: catalog.DEFAULT,
cache: result.cache,
message: `Current model: ${currentModel}`,
},
};
};
/**
* Recursively scan directory for command files (.md)
* @param {string} dir - Directory to scan
* @param {string} baseDir - Base directory for relative paths
* @param {string} namespace - Namespace for commands (e.g., 'project', 'user')
* @returns {Promise<Array>} Array of command objects
*/
async function scanCommandsDirectory(dir, baseDir, namespace) {
const commands = [];
try {
// Check if directory exists
await fs.access(dir);
const entries = await fs.readdir(dir, { withFileTypes: true });
for (const entry of entries) {
const fullPath = path.join(dir, entry.name);
if (entry.isDirectory()) {
// Recursively scan subdirectories
const subCommands = await scanCommandsDirectory(
fullPath,
baseDir,
namespace,
);
commands.push(...subCommands);
} else if (entry.isFile() && entry.name.endsWith(".md")) {
// Parse markdown file for metadata
try {
const content = await fs.readFile(fullPath, "utf8");
const { data: frontmatter, content: commandContent } =
parseFrontMatter(content);
// Calculate relative path from baseDir for command name
const relativePath = path.relative(baseDir, fullPath);
// Remove .md extension and convert to command name
const commandName =
"/" + relativePath.replace(/\.md$/, "").replace(/\\/g, "/");
// Extract description from frontmatter or first line of content
let description = frontmatter.description || "";
if (!description) {
const firstLine = commandContent.trim().split("\n")[0];
description = firstLine.replace(/^#+\s*/, "").trim();
}
commands.push({
name: commandName,
path: fullPath,
relativePath,
description,
namespace,
metadata: frontmatter,
});
} catch (err) {
console.error(`Error parsing command file ${fullPath}:`, err.message);
}
}
}
} catch (err) {
// Directory doesn't exist or can't be accessed - this is okay
if (err.code !== "ENOENT" && err.code !== "EACCES") {
console.error(`Error scanning directory ${dir}:`, err.message);
}
}
return commands;
}
/**
* Built-in commands that are always available
*/
const builtInCommands = [
{
name: "/help",
description: "Show help documentation for Claude Code",
namespace: "builtin",
metadata: { type: "builtin" },
},
{
name: "/models",
description: "View available models for the current provider",
namespace: "builtin",
metadata: { type: "builtin" },
},
{
name: "/cost",
description: "Display token usage information",
namespace: "builtin",
metadata: { type: "builtin" },
},
{
name: "/memory",
description: "Open CLAUDE.md memory file for editing",
namespace: "builtin",
metadata: { type: "builtin" },
},
{
name: "/config",
description: "Open settings and configuration",
namespace: "builtin",
metadata: { type: "builtin" },
},
{
name: "/status",
description: "Show system status and version information",
namespace: "builtin",
metadata: { type: "builtin" },
},
];
/**
* Built-in command handlers
* Each handler returns { type: 'builtin', action: string, data: any }
*/
const builtInHandlers = {
"/help": async (args, context) => {
const helpText = `# Claude Code Commands
## Built-in Commands
${builtInCommands
.map(
(cmd) => `### ${cmd.name}
${cmd.description}
`,
)
.join("\n")}
## Custom Commands
Custom commands can be created in:
- Project: \`.claude/commands/\` (project-specific)
- User: \`~/.claude/commands/\` (available in all projects)
### Command Syntax
- **Arguments**: Use \`$ARGUMENTS\` for all args or \`$1\`, \`$2\`, etc. for positional
- **File Includes**: Use \`@filename\` to include file contents
- **Bash Commands**: Use \`!command\` to execute bash commands
### Examples
\`\`\`markdown
/mycommand arg1 arg2
\`\`\`
`;
return {
type: "builtin",
action: "help",
data: {
content: helpText,
format: "markdown",
commands: builtInCommands.map((command) => ({
name: command.name,
description: command.description,
namespace: command.namespace,
})),
},
};
},
"/models": executeModelsCommand,
"/cost": async (args, context) => {
const tokenUsage = context?.tokenUsage || {};
const provider = readModelProvider(context?.provider);
const catalog = (await providerModelsService.getProviderModels(provider)).models;
const model = await resolveCommandModel(provider, catalog, context?.sessionId);
const reportedUsed =
Number(
tokenUsage.used ?? tokenUsage.totalUsed ?? tokenUsage.total_tokens ?? 0,
) || 0;
const total =
Number(
tokenUsage.total ??
tokenUsage.contextWindow ??
0,
) || 0;
const normalizedInputValue =
tokenUsage.inputTokens ??
tokenUsage.input ??
tokenUsage.cumulativeInputTokens ??
tokenUsage.breakdown?.input ??
tokenUsage.promptTokens;
const directInputTokens =
Number(
normalizedInputValue ??
tokenUsage.input_tokens ??
0
) || 0;
const cacheReadTokens =
Number(
tokenUsage.cacheReadTokens ??
tokenUsage.cache_read_input_tokens ??
tokenUsage.cacheReadInputTokens ??
0,
) || 0;
const cacheCreationTokens =
Number(
tokenUsage.cacheCreationTokens ??
tokenUsage.cache_creation_input_tokens ??
tokenUsage.cacheCreationInputTokens ??
0,
) || 0;
const inputTokens = normalizedInputValue == null
? directInputTokens + cacheReadTokens + cacheCreationTokens
: directInputTokens;
const outputTokens =
Number(
tokenUsage.outputTokens ??
tokenUsage.output ??
tokenUsage.output_tokens ??
tokenUsage.cumulativeOutputTokens ??
tokenUsage.breakdown?.output ??
tokenUsage.completionTokens ??
0,
) || 0;
const computedUsed = inputTokens + outputTokens;
const hasTokenBreakdown = computedUsed > 0;
const used = Math.max(reportedUsed, computedUsed);
return {
type: "builtin",
action: "cost",
data: {
tokenUsage: {
used,
total,
},
...(hasTokenBreakdown
? {
tokenBreakdown: {
input: inputTokens,
output: outputTokens,
},
}
: {}),
provider,
model,
},
};
},
"/status": async (args, context) => {
// Read version from package.json
const packageJsonPath = path.join(APP_ROOT, "package.json");
let version = "unknown";
let packageName = "claude-code-ui";
try {
const packageJson = JSON.parse(
await fs.readFile(packageJsonPath, "utf8"),
);
version = packageJson.version;
packageName = packageJson.name;
} catch (err) {
console.error("Error reading package.json:", err);
}
const uptime = process.uptime();
const uptimeMinutes = Math.floor(uptime / 60);
const uptimeHours = Math.floor(uptimeMinutes / 60);
const uptimeFormatted =
uptimeHours > 0
? `${uptimeHours}h ${uptimeMinutes % 60}m`
: `${uptimeMinutes}m`;
const statusProvider = readModelProvider(context?.provider);
const statusCatalog = (await providerModelsService.getProviderModels(statusProvider)).models;
const model = await resolveCommandModel(statusProvider, statusCatalog, context?.sessionId);
const memoryUsage = process.memoryUsage();
return {
type: "builtin",
action: "status",
data: {
version,
packageName,
uptime: uptimeFormatted,
uptimeSeconds: Math.floor(uptime),
model,
provider: statusProvider,
nodeVersion: process.version,
platform: process.platform,
pid: process.pid,
memoryUsage: {
rssMb: Math.round(memoryUsage.rss / 1024 / 1024),
heapUsedMb: Math.round(memoryUsage.heapUsed / 1024 / 1024),
heapTotalMb: Math.round(memoryUsage.heapTotal / 1024 / 1024),
},
},
};
},
"/memory": async (args, context) => {
const projectPath = context?.projectPath;
if (!projectPath) {
return {
type: "builtin",
action: "memory",
data: {
error: "No project selected",
message: "Please select a project to access its CLAUDE.md file",
},
};
}
const claudeMdPath = path.join(projectPath, "CLAUDE.md");
// Check if CLAUDE.md exists
let exists = false;
try {
await fs.access(claudeMdPath);
exists = true;
} catch (err) {
// File doesn't exist
}
return {
type: "builtin",
action: "memory",
data: {
path: claudeMdPath,
exists,
message: exists
? `Opening CLAUDE.md at ${claudeMdPath}`
: `CLAUDE.md not found at ${claudeMdPath}. Create it to store project-specific instructions.`,
},
};
},
"/config": async (args, context) => {
return {
type: "builtin",
action: "config",
data: {
message: "Opening settings...",
},
};
},
};
/**
* POST /api/commands/list
* List all available commands from project and user directories
*/
router.post("/list", async (req, res) => {
try {
const { projectPath } = req.body;
const allCommands = [...builtInCommands];
// Scan project-level commands (.claude/commands/)
if (projectPath) {
const projectCommandsDir = path.join(projectPath, ".claude", "commands");
const projectCommands = await scanCommandsDirectory(
projectCommandsDir,
projectCommandsDir,
"project",
);
allCommands.push(...projectCommands);
}
// Scan user-level commands (~/.claude/commands/)
const homeDir = os.homedir();
const userCommandsDir = path.join(homeDir, ".claude", "commands");
const userCommands = await scanCommandsDirectory(
userCommandsDir,
userCommandsDir,
"user",
);
allCommands.push(...userCommands);
// Separate built-in and custom commands
const customCommands = allCommands.filter(
(cmd) => cmd.namespace !== "builtin",
);
// Sort commands alphabetically by name
customCommands.sort((a, b) => a.name.localeCompare(b.name));
res.json({
builtIn: builtInCommands,
custom: customCommands,
count: allCommands.length,
});
} catch (error) {
console.error("Error listing commands:", error);
res.status(500).json({
error: "Failed to list commands",
message: error.message,
});
}
});
/**
* POST /api/commands/execute
* Execute a command with argument replacement
* This endpoint prepares the command content but doesn't execute bash commands yet
* (that will be handled in the command parser utility)
*/
router.post("/execute", async (req, res) => {
try {
const { commandName, commandPath, args = [], context = {} } = req.body;
if (!commandName) {
return res.status(400).json({
error: "Command name is required",
});
}
// Handle built-in commands
const handler = builtInHandlers[commandName];
if (handler) {
try {
const result = await handler(args, context);
return res.json({
...result,
command: commandName,
});
} catch (error) {
console.error(
`Error executing built-in command ${commandName}:`,
error,
);
return res.status(500).json({
error: "Command execution failed",
message: error.message,
command: commandName,
});
}
}
// Handle custom commands
if (!commandPath) {
return res.status(400).json({
error: "Command path is required for custom commands",
});
}
// Load command content
// Security: validate commandPath is within allowed directories
{
const resolvedPath = path.resolve(commandPath);
const userBase = path.resolve(
path.join(os.homedir(), ".claude", "commands"),
);
const projectBase = context?.projectPath
? path.resolve(path.join(context.projectPath, ".claude", "commands"))
: null;
const isUnder = (base) => {
const rel = path.relative(base, resolvedPath);
return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
};
if (!(isUnder(userBase) || (projectBase && isUnder(projectBase)))) {
return res.status(403).json({
error: "Access denied",
message: "Command must be in .claude/commands directory",
});
}
}
const content = await fs.readFile(commandPath, "utf8");
const { data: metadata, content: commandContent } =
parseFrontMatter(content);
// Basic argument replacement (will be enhanced in command parser utility)
let processedContent = commandContent;
// Replace $ARGUMENTS with all arguments joined
const argsString = args.join(" ");
processedContent = processedContent.replace(/\$ARGUMENTS/g, argsString);
// Replace $1, $2, etc. with positional arguments
args.forEach((arg, index) => {
const placeholder = `$${index + 1}`;
processedContent = processedContent.replace(
new RegExp(`\\${placeholder}\\b`, "g"),
arg,
);
});
res.json({
type: "custom",
command: commandName,
content: processedContent,
metadata,
hasFileIncludes: processedContent.includes("@"),
hasBashCommands: processedContent.includes("!"),
});
} catch (error) {
if (error.code === "ENOENT") {
return res.status(404).json({
error: "Command not found",
message: `Command file not found: ${req.body.commandPath}`,
});
}
console.error("Error executing command:", error);
res.status(500).json({
error: "Failed to execute command",
message: error.message,
});
}
});
export default router;