Implements bidirectional sync of permission/model modes between CLI sessions and web app. Adds Codex-specific permission modes (read-only, safe-yolo, yolo) alongside Claude's modes. Web can now control CLI session state via RPC set-session-config handler, while CLI broadcasts state changes through keep-alive payloads. UI controls are flavor-aware, showing appropriate modes for Claude vs Codex vs Gemini. Type centralization in api/types eliminates circular dependencies.
Implements full-stack slash command autocomplete with agent-specific built-in commands and user-defined command discovery. Includes React Strict Mode fix for suggestion handling.
Implement comprehensive worktree session support allowing users to spawn sessions in temporary git worktrees. Includes backend worktree management, full-stack integration, and refined UI for session type selection.
Backend:
- Add worktree creation/removal utilities with branch management
- Track worktree metadata (basePath, branch, name, path) in session metadata
- Automatic cleanup of worktrees when sessions fail or exit
- Enhanced error handling with stderr tail logging
UI improvements:
- Redesign session type toggle with improved alignment and spacing
- Move worktree description inline with label for cleaner layout
- Add branch name input field that appears when worktree mode selected
- Auto-focus on worktree input when switching modes
- Reduce gap between radio options from gap-3 to gap-1.5
- Update descriptive text and placeholders for clarity
Integration:
- Thread worktree parameters through API client, RPC handlers, and daemon
- Add worktreeEnv utility to read worktree info from environment
- Update session spawning to support both simple and worktree modes
* fix: use timing-safe comparison for CLI API token validation
Replace direct string comparison (===) with constant-time comparison
using crypto.timingSafeEqual to prevent timing attacks that could
leak information about the token character by character.
Affected locations:
- server/src/web/routes/auth.ts (accessToken validation)
- server/src/web/routes/cli.ts (bearer token middleware)
- server/src/socket/server.ts (socket.io /cli namespace auth)
* Update server/src/utils/crypto.ts
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
- Add shared isBunCompiled() function for consistent runtime detection
- Support Windows virtual filesystem paths (/~BUN/) alongside Linux/macOS (/$bunfs/)
- Use Bun.main for reliable detection instead of process.argv[1]
- Remove redundant $bunfs checks from cli/src/index.ts
- Update cli/src/utils/bunRuntime.ts to use shared detection function
- Create server/src/utils/bunCompiled.ts for server-side compilation check
Updates ModelContextProtocol SDK and multiple dependent libraries to latest versions. Refactors TypeScript schemas to avoid instantiation depth issues by widening Zod types and using explicit type parameters.
- Add CLI-side terminal management via Bun.Terminal with TerminalManager
- Implement server-side Socket.IO proxy for terminal I/O between web and CLI
- Create web terminal UI component with xterm.js and support for resize/reconnect
- Add terminal route and navigation button in session chat
- Include comprehensive terminal implementation plan and architecture docs
Adds support for hosting the web UI separately from the hapi server on static hosts (GitHub Pages, Cloudflare Pages). Users can now set a custom server origin via a dialog on the login screen, with the ability to return to same-origin behavior.
Changes include:
- New useServerUrl hook for managing server URL configuration and storage
- Updated API client to support baseUrl parameter for all requests
- Enhanced login UI with server picker dialog (top-right button)
- Auth system now keys tokens per baseUrl to support multiple servers
- SSE connection updated to use configured baseUrl
- Documentation updates for standalone hosting setup
When CLI_API_TOKEN is provided via environment variable, persist it to settings.json
if not already saved. This prevents token regeneration if the env var fails to load
on subsequent startups, ensuring token consistency across server restarts.
Bun.isCompiled does not exist and always returns undefined, causing
embeddedAssetMap to be null. This makes the server fall back to looking
for web/dist directory, which doesn't exist when running the compiled
binary from a different location.
The correct way to detect a compiled Bun binary is to check if Bun.main
starts with '/$bunfs' (the virtual filesystem path used by compiled binaries).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Configuration now loads with priority: environment variable > settings.json > default value.
When values are read from environment variables and not present in settings.json, they are automatically saved for future use. This eliminates the need to repeatedly set environment variables.
- New serverSettings.ts module handles loading/saving with persistence logic
- Async createConfiguration() factory for proper initialization ordering
- Configuration sources tracked and displayed in startup logs
- Exported Settings interface and read/write functions from cliApiToken.ts
- Updated index.ts to display configuration sources in log output
Update documentation across the project to reflect current state of codebase:
- cli/README.md: Add all commands (codex, gemini, daemon subcommands, doctor, mcp),
configuration options, storage locations, and source structure references
- server/README.md: Add complete HTTP API reference, Socket.IO events, Telegram bot
features, core logic descriptions, and source structure
- web/README.md: Add all routes, feature descriptions, authentication flow, data
fetching, real-time updates, and source structure
- README.md: Improve feature list clarity, add HTTPS exposure instructions in
quickstart, add multi-agent support section
Remove all interactive features from the Telegram bot that are now handled by the
Telegram Mini App. The bot now serves a single purpose: sending notifications for
permission requests and ready events.
Changes:
- bot.ts: Remove /help command and message handler, simplify /start to show Mini App link
- callbacks.ts: Remove all callback handlers except APPROVE and DENY for permissions
- sessionView.ts: Remove detail views and settings, keep only notification formatting
- renderer.ts: Remove session/machine list rendering, keep utility functions
This reduces the codebase by ~1000 lines (58% reduction) while preserving notification
functionality that the Mini App cannot provide.
Remove Switch and Message notifications, update Ready notification to
use agent flavor from session metadata, and remove emoji from button
text and titles to align with happy-cli notification style.
Implement secure auto-generation of CLI_API_TOKEN to eliminate mandatory
environment variable requirement. Token is generated once and persisted to
~/.hapi/settings.json for use by CLI on the same machine.
Changes:
- New cliApiToken.ts module with secure 256-bit token generation
- Configuration now accepts token from env, file, or generates on-demand
- Server displays prominently on first run, saves to settings
- CLI auth status command provides discovery hints for all scenarios
- Settings file parse errors fail fast to prevent data loss
Add cleanup-sessions.ts script that enables deletion of sessions from the database with support for multiple filtering strategies:
- Message count filtering (delete sessions with fewer than N messages)
- Path pattern matching with glob support
- Orphaned session detection (sessions whose path no longer exists)
- Optional confirmation prompt with --force flag to skip
Includes 'clean-session' npm script for convenient invocation.
Replace Card-based layout with semantic button elements for better accessibility and keyboard navigation. Add session metadata fields (flavor, activeAt, modelMode) and implement helper functions to format session information including agent flavor, model mode, and relative last-seen timestamps. Update hover styles and add focus-visible indicators.
Replace CLI version string comparison with file modification time (mtime) based detection. This provides a more reliable way to detect when the CLI binary has been updated, especially for bun-compiled executables where package.json may not be accessible.
Changes:
- Add getInstalledCliMtimeMs() utility to check CLI binary or package.json mtime
- Store startedWithCliMtimeMs in daemon state on startup
- Use mtime comparison in version check loop for daemon auto-restart
- Move version flag handling to early CLI startup before daemon initialization
- Fix machine active state merging to prefer newer activeAt timestamp
This improves daemon restart behavior when CLI is updated via package managers.
- Make TELEGRAM_BOT_TOKEN and ALLOWED_CHAT_IDS optional environment variables
- Add telegramEnabled flag to conditionally initialize the bot on startup
- Introduce persistent owner ID for unified user identity across web and Telegram auth
- Update Telegram bot to accept configuration in constructor instead of using global config
- Handle empty allowlist by showing chat ID prompt on /start command
- Use owner ID instead of Telegram user ID for API authentication
- Add conditional Telegram support checks in auth routes with clear error messages
- Update documentation to explain optional Telegram configuration and binding workflow
- Rename telegramUserId to userId in auth middleware for clarity
- Replace embeddedAssets stub with generated type definitions
- Fix Bun.isCompiled access with proper type assertion to prevent undefined errors
- Improve router search validation with explicit SessionFileSearch type
- Simplify middleware return patterns for better readability
Consolidate CLI and server runtime directories from ~/.config/hapi/ (CLI) and ~/.hapi-server/ (Server) to a single ~/.hapi/ directory. Unify environment variables from HAPI_HOME_DIR (CLI) and HAPI_BOT_DATA_DIR (Server) to a single HAPI_HOME variable across both applications. Update all documentation and configuration references accordingly. Bump bun-types to 1.3.5.
This commit rebrands the project from "Happy" to "HAPI" throughout the codebase, including documentation, comments, logs, and tool references. It also adds comprehensive README files for the server and web components, clarifies the monorepo structure in AGENTS.md and root README.md, and removes the outdated roadmap.md file.
Changes include:
- Rebrand references from Happy to HAPI in CLI, server, and web components
- MCP tool names updated from mcp__happy__ to mcp__hapi__
- Process/service names updated consistently
- New server/README.md with deployment and configuration guide
- New web/README.md with stack and development instructions
- Updated root README.md with quickstart guide
- Updated AGENTS.md with cleaner structure documentation
- Removed cli/roadmap.md (now superseded by documentation)
Implements comprehensive ACP backend enabling integration with ACP-compliant agents like Gemini. Includes stdio transport, message handling, permission flow, and registry for agent management. Adds new 'hapi gemini' command to launch ACP agent sessions.
Implement support for bundling web assets into CLI single executable binaries.
When built with --with-web-assets, the executable includes the compiled web
application and serves it directly without file system access. A stub generator
creates empty manifests for normal builds to maintain compatibility.
Key changes:
- Add --with-web-assets flag to build-executable.ts with manifest validation
- Generate embeddedAssets.ts manifest from web/dist during build
- Serve embedded assets in web server with fallback to file system
- Add hapi server subcommand to start API + web server
- Include server sources in CLI tsconfig for compilation scope
- Add workspace-level build:single-exe scripts for production builds
Slim down SessionSummary responses to reduce payload size:
- Replace full todos array with computed todoProgress summary
- Replace metadata object with only necessary fields (name, path, summary.text)
- Remove unused fields (thinking, createdAt, permissionMode, modelMode)
- Refactor sorting to work on full Session objects before mapping
This significantly reduces /api/sessions response size, especially for
sessions with many todos or tools.
Add comprehensive support for the AskUserQuestion tool including:
- New footer component for handling user responses with multi-step question flow
- Type definitions and parsing utilities for question and answer formats
- View component for displaying questions and options
- Integration with permission system to capture user answers
- Support for single and multi-select questions with optional text input
- Haptic feedback and error handling for better UX
Enable the web client to run in plain browser environments alongside Telegram Mini App support:
- Server: Add CLI_API_TOKEN authentication path as alternative to Telegram initData
- Client: Add useAuthSource hook to detect and manage Telegram vs browser auth sources
- Client: Add usePlatform hook for platform abstraction with graceful haptic feedback degradation
- Client: Add LoginPrompt component for browser access token login
- Client: Extend useTheme to fall back to system prefers-color-scheme in browser
- Client: Migrate all direct HapticFeedback calls to use usePlatform hook
Adds todo tracking infrastructure with TodoWrite tool integration to extract
and persist todos in sessions. Refactors ToolCard component to support
custom tool view rendering and displays todo progress in SessionList.
weishu