Add ResizeHandle component for drag-to-resize side panels.
ChatListPanel (180–400px) and RightPanel (200–480px) widths
are persisted via localStorage. Also remove the border line
below the Extensions page tab selector.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace full-card tool rendering with a compact, collapsible group.
Each tool action is a single line with category icon, summary, and
status indicator. Collapsed by default for history, auto-expands
during streaming. Uses blockquote-style left border when expanded.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add automatic update detection (checks GitHub Releases every 8h with
dialog prompt and blue dot on Settings icon) and a skip-permissions
toggle in Settings that uses the SDK's native bypassPermissions mode
to auto-approve all tool actions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Previously uploaded files were only held in memory (optimistic message)
and lost when navigating away. Now:
- API route saves all uploaded files to .codepilot-uploads/ on disk
- File metadata (with filePath, not base64) is embedded in message content
- New /api/uploads endpoint serves persisted files
- FileAttachmentDisplay handles both base64 (in-memory) and filePath (DB)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Images were being saved to disk and referenced by text path in the prompt,
causing Claude to hallucinate about image contents since it never actually
saw the image data. Now images are sent as base64 content blocks via the
SDK's multimodal SDKUserMessage, enabling Claude's vision capability.
Non-image files continue to be saved to disk for Read tool access.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
User messages exceeding 300px are now collapsed by default with a
gradient fade overlay and expand/collapse button. Only applies to
user messages; assistant messages remain fully visible.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Slash command popover: add search box, group commands/skills with section
headers, assign unique icons per built-in command, remove Built-in badge,
show source labels for skills, deduplicate API skills with built-in names
- Import CLI Session dialog: fix list overflow and enable scrolling by
replacing Radix ScrollArea with native overflow-y-auto
- New chat empty state: replace BotIcon with custom CodePilotLogo SVG
component supporting light/dark theme
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When a manually configured provider is active, environment variables
are now shown with "Overridden" badge, strikethrough text, and muted
colors instead of both appearing as active simultaneously.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Race condition when quickly switching chat sessions caused the UI to get
stuck on loading. Added cancellation flags and key-based remounting.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Include base64 data in file metadata for chat display (fixes broken images)
- Use file-to-disk + Read tool approach instead of SDK multimodal
messages (fixes slow response caused by invalid prompt format)
- Move attach button before folder picker in input toolbar
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add ability to browse and import conversation history from Claude Code CLI
into CodePilot, with full resume support via SDK session ID.
Features:
- JSONL parser for Claude Code session files (~/.claude/projects/)
- REST API: GET /api/claude-sessions (list) + POST /api/claude-sessions/import
- Import dialog UI accessible from sidebar 'Import CLI Session' button
- Imported sessions bind sdk_session_id for seamless resume in CodePilot
- Duplicate import protection (409 with redirect to existing session)
- File size guard (50MB max) to prevent memory issues
Files changed:
- src/lib/claude-session-parser.ts — JSONL parser core
- src/app/api/claude-sessions/route.ts — list API
- src/app/api/claude-sessions/import/route.ts — import API with dedup
- src/components/layout/ImportSessionDialog.tsx — browse & import UI
- src/components/layout/ChatListPanel.tsx — sidebar integration
- src/__tests__/unit/claude-session-parser.test.ts — 17 unit tests
The SQLite database connection was never explicitly closed when the
process exits. In WAL mode, this can leave behind -wal and -shm files
and risk data loss if the WAL hasn't been checkpointed.
Changes:
- Add closeDb() export for explicit database closure
- Register process shutdown handlers (exit, SIGTERM, SIGINT, SIGHUP)
that call closeDb() before the process terminates
- Idempotent: multiple calls to closeDb() are safe
- After closeDb(), getDb() transparently re-opens the database
- Add 6 unit tests covering close, idempotency, reopen, data
persistence, and WAL cleanup (all passing)
Address all 3 points from @op7418's review:
1. No baseDir fallback (severe): Both /api/files and /api/files/preview
now fall back to os.homedir() when no baseDir is provided, preventing
access to arbitrary system directories/files.
2. baseDir bypass via baseDir=/ (medium): Both APIs now validate that
baseDir itself is within the user's home directory. Setting baseDir=/
will be rejected with 403.
3. Test cleanup (minor): Replaced 'it(cleanup...)' with proper after()
hook. Added 6 new tests for baseDir validation (18 total, all pass).
- Support image (JPEG/PNG/GIF/WebP, max 5MB) and document uploads
- Images sent as multimodal content blocks to Claude SDK
- Documents saved to temp dir for Claude's Read tool
- Emerald capsule badges in input for attached files
- Drag-and-drop, paste, and file picker support via PromptInput
- Chat display: image thumbnails with lightbox, file cards
- Lightbox uses Radix Dialog with prev/next navigation
- File metadata embedded in message content as HTML comments
- Compatible with existing slash command badge system
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The file tree API (/api/files) and file preview API (/api/files/preview)
had ineffective path safety checks that could allow reading arbitrary
files on the host system.
Issues fixed:
- /api/files: isPathSafe(resolvedDir, resolvedDir) always returns true
since it compares the directory against itself
- /api/files/preview: isPathSafe(dirname, filePath) always returns true
since a file is always inside its own parent directory
Changes:
- Add baseDir parameter to both APIs so the frontend can pass the
session's working directory as a trust boundary
- When baseDir is provided, validate that the requested path is within it
- For /api/files/preview without baseDir, fall back to restricting access
to the user's home directory (prevents /etc/passwd etc.)
- Add comprehensive unit tests covering path traversal, prefix attacks,
symlink escapes, and edge cases (13 tests, all passing)
Security: This is a defense-in-depth measure. CodePilot runs locally so
the attack surface is limited, but proper validation prevents accidental
exposure when the dev server is bound to non-localhost interfaces.
- Show app version (v0.4.0) in sidebar bottom
- Clear Electron web cache when version changes to prevent stale JS
- Exclude data/ directory from packaged app
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add flex flex-col min-h-0 to the skills container so overflow-y-auto
in SkillsManager can properly trigger scrolling.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Providers API now detects ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, and
ANTHROPIC_BASE_URL from environment. ProviderManager shows a banner
when env vars are detected, informing users they're used automatically
when no provider is active.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add findGitBash() to platform.ts that checks env var, common install
paths, and derives path from `where git`. Used in claude-client.ts
to set CLAUDE_CODE_GIT_BASH_PATH when not already configured.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes stale closure bug where keyboard navigation in the slash command
popover could reference an outdated filteredItems list when the filter
text changed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Slash commands:
- Fix skills not appearing (removed non-existent `enabled` filter)
- Add badge/capsule UI for prompt-type commands (/compact, /review, etc.)
- SDK-native commands sent directly; CLI-only commands expanded to prompts
- /clear now resets SDK session and clears database messages
- /cost shows actual aggregated token usage statistics
- Keyboard: Backspace/Escape to remove badge, arrow keys auto-scroll popover
- Add /memory command for editing CLAUDE.md
Multi-provider management:
- CRUD API for API providers with SQLite storage
- ProviderManager UI with quick presets (GLM, Kimi, MiniMax, etc.)
- Dynamic model labels based on active provider
- Environment variable injection with conflict resolution
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The collectStreamResponse() function only collected text events,
discarding tool_use and tool_result events. When a conversation was
resumed, all tool call context was lost — the user only saw the
text portions of Claude's responses.
Changes:
- Collect tool_use and tool_result SSE events as MessageContentBlock
entries alongside text blocks
- Flush accumulated text into a text block before each tool_use to
preserve the interleaved ordering (text → tool_use → tool_result →
text → ...)
- Store messages with tool calls as JSON arrays of MessageContentBlock,
using the existing type definitions in types/index.ts
- Text-only messages remain as plain strings for backward compatibility
with existing message rendering (parseMessageContent handles both)
- Add 10 unit tests covering parsing, serialization, round-tripping,
edge cases, and backward compatibility (all passing)
This enables future improvements like:
- Rendering tool call history in resumed conversations
- Showing which files were read/written in previous turns
- Exporting full conversation logs with tool context
The toSdkMcpConfig() function only handled stdio transport, discarding
the type, url, and headers fields. This meant SSE and HTTP MCP servers
configured through the Extensions page were silently converted to
broken stdio configs.
Changes:
- Import McpSSEServerConfig, McpHttpServerConfig, McpServerConfig types
from the Claude Agent SDK
- Rewrite toSdkMcpConfig() to dispatch on config.type (stdio/sse/http)
- SSE configs: pass type, url, and optional headers to the SDK
- HTTP configs: pass type, url, and optional headers to the SDK
- stdio configs: pass command, args, env (unchanged behavior)
- Skip servers with missing required fields (url for SSE/HTTP, command
for stdio) with a console warning instead of passing broken configs
- Do not include empty headers objects
- Add 11 unit tests covering all transport types, mixed configs,
missing fields, and edge cases (all passing)
This aligns the implementation with the README which states:
'Supports stdio, sse, and http transport types.'
Radix ScrollArea doesn't reliably get constrained height in flex
layouts, preventing mouse wheel scrolling. Replace with a simple
div using overflow-y-auto and min-h-0 which works correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix Windows Claude CLI not found when installed as .exe or without
extension in .local\bin (closes#6). Now searches all extensions
(.cmd, .exe, .bat, and bare) for every candidate directory.
- Fix Extensions/Skills list not scrollable when many items exist.
Change content container to overflow-hidden so internal ScrollArea
works correctly. Add overflow-auto to McpManager for its own scroll.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add src/lib/platform.ts: cross-platform Claude CLI discovery
(candidate paths, .cmd/.bat shell handling, where/which fallback)
- Refactor claude-status route and claude-client to use shared platform utils
- Electron main: Windows process spawning (windowsHide), PATH construction
with AppData/npm dirs, titleBarOverlay, .ico icon support
- electron-builder.yml: add win/nsis build targets
- package.json: add electron:pack:win script
- FolderPicker: drive switcher dropdown for navigating between drives
- SkillsManager: fix duplicate key warning with filePath fallback
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When navigating to a drive root on Windows (e.g. C:\), path.dirname
returns itself, disabling the "go up" button and trapping the user on
that drive. This adds a compact dropdown next to the up button that
lists all available drives (auto-detected via fs.accessSync), allowing
quick switching between drives. macOS/Linux are unaffected (empty array,
dropdown not rendered).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Previously the database path depended on app.getPath('userData') which
varies with app name changes (CodePilot vs codepilot vs Claude GUI).
Now uses a fixed ~/.codepilot/ directory for both dev and production.
Includes automatic migration: on first launch, if the DB doesn't exist
at the new path, it checks old locations (Application Support variants
and the old dev-mode data/ folder) and copies the database over.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Shows a copy icon at the bottom of each message on hover. Clicking
copies the text content to clipboard with a brief checkmark confirmation.
User messages show the button right-aligned; assistant messages show it
alongside the existing timestamp and token usage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1. Skills API: accept optional cwd query param so project-level skills
are scanned from the session's working directory, not the standalone
server's process.cwd().
2. SDK env: explicitly set HOME so Claude Code can resolve ~/.claude/
for global skills discovery in packaged builds.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1. Change StickToBottom resize mode from "smooth" to "instant" to
prevent scroll position bouncing when new streaming content
arrives faster than the smooth animation completes.
2. Use SDK's preset append mode for system prompts instead of
replacing Claude Code's default prompt. This preserves Claude
Code's built-in awareness of skills (.claude/commands/), working
directory context, and other default behaviors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add a new "API Configuration" section in settings for users who use
custom Anthropic-compatible APIs (e.g. via ai-claude-start). Users
can optionally set ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL in
CodePilot's settings UI. These are stored in SQLite and injected
into the Claude Code subprocess env only when configured.
Existing authentication methods (claude login, shell env vars) are
not affected - the API config is purely additive.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1. Explicitly pass process.env to the Claude Agent SDK's env option,
ensuring user shell env vars (ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL,
etc.) reach the claude subprocess in packaged builds.
2. Spawn the standalone server via /bin/sh with exec to prevent the
Electron binary from appearing as a separate Dock icon on macOS.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Return full error stack traces from the sessions API and display
the actual server error in the frontend, instead of a generic
"Failed to create session" message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The SDK's query() function also needs to find the claude binary.
Added findClaudePath() in claude-client.ts and pass it via
pathToClaudeCodeExecutable option, fixing "Failed to create session"
in packaged builds where PATH is limited.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The claude-status endpoint now searches common installation paths
(/usr/local/bin, /opt/homebrew/bin, ~/.npm-global/bin, ~/.local/bin,
~/.claude/bin) and uses `which` with expanded PATH as fallback,
fixing "Disconnected" status in packaged builds.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Full-featured desktop application built with Next.js + Electron:
- Streaming chat with Claude Code via Agent SDK
- Session management with SQLite persistence
- Project file tree and file preview
- MCP server and custom skills management
- Permission controls with Code/Plan/Ask modes
- Dark/light theme, token tracking
- macOS DMG packaging with electron-builder
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
