@aexol/spectral 0.9.42 → 0.9.44

package/dist/extensions/seo/utils/url-safety.js

@@ -0,0 +1,202 @@
+/**
+ * URL validation and SSRF protection.
+ *
+ * Ported from the Python `url_safety.py` in claude-seo. Blocks requests to
+ * private/internal IP ranges to prevent server-side request forgery.
+ */
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { createHash } from "node:crypto";
+export class UrlSafetyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UrlSafetyError";
+    }
+}
+/** Private/loopback IPv4 CIDR prefixes. */
+const PRIVATE_IPV4_PREFIXES = [
+    "10.",
+    "172.16.", "172.17.", "172.18.", "172.19.", "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.", "172.28.", "172.29.", "172.30.", "172.31.",
+    "192.168.",
+    "169.254.",
+    "127.",
+    "0.",
+    "100.64.", "100.65.", "100.66.", "100.67.", "100.68.", "100.69.", "100.70.", "100.71.", "100.72.", "100.73.", "100.74.", "100.75.", "100.76.", "100.77.", "100.78.", "100.79.", "100.80.", "100.81.", "100.82.", "100.83.", "100.84.", "100.85.", "100.86.", "100.87.", "100.88.", "100.89.", "100.90.", "100.91.", "100.92.", "100.93.", "100.94.", "100.95.", "100.96.", "100.97.", "100.98.", "100.99.", "100.100.", "100.101.", "100.102.", "100.103.", "100.104.", "100.105.", "100.106.", "100.107.", "100.108.", "100.109.", "100.110.", "100.111.", "100.112.", "100.113.", "100.114.", "100.115.", "100.116.", "100.117.", "100.118.", "100.119.", "100.120.", "100.121.", "100.122.", "100.123.", "100.124.", "100.125.", "100.126.", "100.127.",
+];
+/** Blocked hostnames that resolve to metadata endpoints or local services. */
+const BLOCKED_HOSTNAMES = new Set([
+    "localhost",
+    "metadata.google.internal",
+    "metadata",
+    "169.254.169.254",
+    "fd00.local",
+    "metadata.aws.internal",
+]);
+function isPrivateIPv4(ip) {
+    for (const prefix of PRIVATE_IPV4_PREFIXES) {
+        if (ip.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+function isPrivateIPv6(ip) {
+    const lower = ip.toLowerCase();
+    return (lower === "::1" ||
+        lower.startsWith("fe80:") ||
+        lower.startsWith("fc00:") ||
+        lower.startsWith("fd00:") ||
+        lower.startsWith("fd01:") ||
+        lower.startsWith("::ffff:") && isPrivateIPv4(lower.replace("::ffff:", "")));
+}
+function isPrivateIp(ip) {
+    const family = isIP(ip);
+    if (family === 4)
+        return isPrivateIPv4(ip);
+    if (family === 6)
+        return isPrivateIPv6(ip);
+    return false;
+}
+/**
+ * Validate a URL string with optional SSRF protection.
+ *
+ * Throws UrlSafetyError if the URL is invalid, uses a non-http(s) protocol,
+ * points to a blocked hostname, or (when ssrfProtection=true) resolves to a
+ * private IP address.
+ */
+export async function validateUrl(urlStr, opts = {}) {
+    const ssrfProtection = opts.ssrfProtection ?? true;
+    const resolveDns = opts.resolveDns ?? ssrfProtection;
+    if (!urlStr || typeof urlStr !== "string") {
+        throw new UrlSafetyError("URL is required.");
+    }
+    // Reject file:// and other local protocol schemes.
+    const trimmed = urlStr.trim();
+    if (/^(file|ftp|gopher|dict|ldap|data|blob):/i.test(trimmed)) {
+        throw new UrlSafetyError(`Protocol not allowed for SEO fetch: ${trimmed}`);
+    }
+    // Auto-prepend https:// if missing a protocol.
+    let normalized = trimmed;
+    if (!/^https?:\/\//i.test(normalized)) {
+        normalized = `https://${normalized}`;
+    }
+    let parsed;
+    try {
+        parsed = new URL(normalized);
+    }
+    catch {
+        throw new UrlSafetyError(`Invalid URL: ${urlStr}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new UrlSafetyError(`Only http and https protocols are allowed, got: ${parsed.protocol}`);
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    // Check for direct IP literals.
+    const ipFamily = isIP(hostname.replace(/^\[|\]$/g, ""));
+    if (ssrfProtection) {
+        if (BLOCKED_HOSTNAMES.has(hostname)) {
+            throw new UrlSafetyError(`Blocked hostname: ${hostname}`);
+        }
+        if (ipFamily && isPrivateIp(hostname.replace(/^\[|\]$/g, ""))) {
+            throw new UrlSafetyError(`URL points to a private IP address: ${hostname}`);
+        }
+    }
+    let ips = [];
+    if (resolveDns && !ipFamily) {
+        try {
+            const records = await lookup(hostname, { all: true });
+            ips = records.map((r) => r.address);
+            if (ssrfProtection) {
+                for (const ip of ips) {
+                    if (isPrivateIp(ip)) {
+                        throw new UrlSafetyError(`Hostname ${hostname} resolves to private IP ${ip}. Blocked by SSRF protection.`);
+                    }
+                }
+            }
+        }
+        catch (err) {
+            if (err instanceof UrlSafetyError)
+                throw err;
+            // DNS resolution failure is not necessarily an error for SSRF — the fetch
+            // will fail naturally. But we surface it if the caller wanted DNS.
+            if (resolveDns && !ssrfProtection) {
+                // non-fatal: continue without IPs
+            }
+        }
+    }
+    return {
+        href: parsed.href,
+        protocol: parsed.protocol,
+        hostname: parsed.hostname,
+        port: parsed.port,
+        pathname: parsed.pathname,
+        search: parsed.search,
+        ips,
+    };
+}
+/** Quick synchronous URL validation without DNS resolution. */
+export function validateUrlBasic(urlStr) {
+    if (!urlStr || typeof urlStr !== "string") {
+        throw new UrlSafetyError("URL is required.");
+    }
+    const trimmed = urlStr.trim();
+    if (/^(file|ftp|gopher|dict|ldap|data|blob):/i.test(trimmed)) {
+        throw new UrlSafetyError(`Protocol not allowed: ${trimmed}`);
+    }
+    let normalized = trimmed;
+    if (!/^https?:\/\//i.test(normalized)) {
+        normalized = `https://${normalized}`;
+    }
+    let parsed;
+    try {
+        parsed = new URL(normalized);
+    }
+    catch {
+        throw new UrlSafetyError(`Invalid URL: ${urlStr}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new UrlSafetyError(`Only http/https allowed: ${parsed.protocol}`);
+    }
+    return {
+        href: parsed.href,
+        protocol: parsed.protocol,
+        hostname: parsed.hostname,
+        port: parsed.port,
+        pathname: parsed.pathname,
+        search: parsed.search,
+        ips: [],
+    };
+}
+/** Normalize a URL for baseline matching (strip UTM, sort params, lowercase host). */
+export function normalizeUrl(url) {
+    const UTM_PARAMS = new Set(["utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content"]);
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return url;
+    }
+    parsed.hostname = parsed.hostname.toLowerCase();
+    // Strip default ports.
+    if ((parsed.protocol === "http:" && parsed.port === "80") || (parsed.protocol === "https:" && parsed.port === "443")) {
+        parsed.port = "";
+    }
+    // Remove UTM params.
+    const params = new URLSearchParams(parsed.search);
+    for (const key of [...params.keys()]) {
+        if (UTM_PARAMS.has(key.toLowerCase())) {
+            params.delete(key);
+        }
+    }
+    params.sort();
+    parsed.search = params.toString();
+    // Strip trailing slash (except bare domain).
+    if (parsed.pathname.length > 1 && parsed.pathname.endsWith("/")) {
+        parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+    }
+    return parsed.href;
+}
+/** Hash a normalized URL for baseline deduplication. */
+export function urlHash(url) {
+    return createHash("sha256").update(normalizeUrl(url)).digest("hex").slice(0, 16);
+}

package/dist/sdk/coding-agent/core/extensions/native-extensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-extensions.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/coding-agent/core/extensions/native-extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,aAAa,CAAC;IAChD;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,uBAAuB,EAkEtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAIjF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CASD"}
+{"version":3,"file":"native-extensions.d.ts","sourceRoot":"","sources":["../../../../../src/sdk/coding-agent/core/extensions/native-extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,aAAa,CAAC;IAChD;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,uBAAuB,EA8EtD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAElF;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAIjF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzE,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CASD"}

package/dist/sdk/coding-agent/core/extensions/native-extensions.js

@@ -77,6 +77,17 @@ export const NATIVE_EXTENSIONS = [
         defaultEnabled: true,
         tags: ["vision", "images"],
     },
+    {
+        id: "seo",
+        label: "SEO Analysis",
+        description: "Native SEO audit tools: on-page parsing, technical checks, content quality, " +
+            "Schema.org detection/generation, sitemap, images, preload/bfcache, agent UX, " +
+            "parasite risk, drift monitoring, and full audit orchestration. No external API keys required.",
+        category: "automation",
+        entryPath: "src/extensions/seo/index.ts",
+        defaultEnabled: true,
+        tags: ["seo", "audit", "marketing"],
+    },
 ];
 /**
  * Look up a native extension by id. Returns undefined for unknown ids.

package/dist/server/handlers/paths-pick-directory.d.ts

@@ -1,33 +1,6 @@
-/**
- * Native OS folder picker dialog for project path selection.
- *
- * The "New Project" form in the browser has a "Browse..." button next to
- * the typed-path autocomplete. When clicked, it sends
- * `POST /api/paths/pick-directory` to this handler, which launches a
- * native OS folder picker dialog on the user's machine and returns the
- * absolute path of the selected directory (or `null` when cancelled).
- *
- * Platform strategy (tried in order):
- *   1. macOS  — osascript (built-in, zero deps, native look)
- *   2. Linux  — zenity (GTK), kdialog (KDE), then Python tkinter
- *   3. Windows — PowerShell (COM object)
- *   4. Fallback — Python tkinter (bundled with most Python installs)
- *
- * The first available tool wins; if none work, we return an error.
- * All child processes are synchronous — the browser is waiting anyway.
- */
-/** Result shape returned to the frontend. */
 export interface PickDirectoryResult {
-    /** Absolute path of the selected directory, or null if cancelled. */
     path: string | null;
-    /** Human-readable error when the picker couldn't be launched. */
     error?: string;
 }
-/**
- * Attempt to open a native folder picker dialog and return the selected path.
- *
- * Synchronous and blocking by design — the browser form is waiting for a
- * response and the user is interacting with the dialog.
- */
 export declare function handlePickDirectory(): PickDirectoryResult;
 //# sourceMappingURL=paths-pick-directory.d.ts.map

package/dist/server/handlers/paths-pick-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths-pick-directory.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/paths-pick-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAqID;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,mBAAmB,CAgCzD"}
+{"version":3,"file":"paths-pick-directory.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/paths-pick-directory.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA6JD,wBAAgB,mBAAmB,IAAI,mBAAmB,CAmBzD"}

package/dist/server/handlers/paths-pick-directory.js

@@ -1,30 +1,18 @@
-/**
- * Native OS folder picker dialog for project path selection.
- *
- * The "New Project" form in the browser has a "Browse..." button next to
- * the typed-path autocomplete. When clicked, it sends
- * `POST /api/paths/pick-directory` to this handler, which launches a
- * native OS folder picker dialog on the user's machine and returns the
- * absolute path of the selected directory (or `null` when cancelled).
- *
- * Platform strategy (tried in order):
- *   1. macOS  — osascript (built-in, zero deps, native look)
- *   2. Linux  — zenity (GTK), kdialog (KDE), then Python tkinter
- *   3. Windows — PowerShell (COM object)
- *   4. Fallback — Python tkinter (bundled with most Python installs)
- *
- * The first available tool wins; if none work, we return an error.
- * All child processes are synchronous — the browser is waiting anyway.
- */
 import { execSync } from "node:child_process";
 import { platform } from "node:os";
-// ---------------------------------------------------------------------------
-// Platform pickers
-// ---------------------------------------------------------------------------
-/**
- * macOS: Use `osascript` with AppleScript to show a native folder chooser.
- * Returns the POSIX path or empty string on cancel.
- */
+function execErrMsg(err) {
+    if (err && typeof err === "object" && "message" in err) {
+        return String(err.message);
+    }
+    return String(err);
+}
+function execErrStatus(err) {
+    if (err && typeof err === "object" && "status" in err) {
+        const s = err.status;
+        return typeof s === "number" ? s : undefined;
+    }
+    return undefined;
+}
 function pickMacOS() {
     const script = `
     set folderPath to POSIX path of (choose folder with prompt "Select project directory")
@@ -36,75 +24,95 @@ function pickMacOS() {
             timeout: 180_000, // 3 min — user might take time to browse
         });
         const trimmed = result.trim();
-        return trimmed || null;
+        if (!trimmed) {
+            return { path: null };
+        }
+        return { path: trimmed };
     }
-    catch {
-        // osascript exits non-zero on user cancel (error -128) — treat as silent cancel
-        return null;
+    catch (err) {
+        if (execErrStatus(err) === 1) {
+            return { path: null }; // user cancelled
+        }
+        return {
+            path: null,
+            error: `Could not open folder picker (macOS): ${execErrMsg(err)}`,
+        };
     }
 }
-/**
- * Run a command that shows a folder picker dialog. Returns `null` on user
- * cancellation, and falls through (re-throws) if the tool is not installed.
- */
 function tryDialog(cmd) {
     try {
         const result = execSync(cmd, { encoding: "utf-8", timeout: 180_000 });
         return result.trim() || null;
     }
     catch (err) {
-        // exit code 1 = user cancelled the dialog → stop here, return null
-        // exit code 127 = command not found → re-throw so the next picker tries
-        const status = err && typeof err === "object" && "status" in err
-            ? err.status
-            : undefined;
-        if (status === 1)
-            return null;
+        if (execErrStatus(err) === 1)
+            return null; // user cancelled
         throw err;
     }
 }
-/**
- * Linux: Try zenity (GTK), then kdialog (KDE), then Python tkinter.
- */
 function pickLinux() {
     try {
-        return tryDialog(`zenity --file-selection --directory --title="Select project directory"`);
+        const p = tryDialog(`zenity --file-selection --directory --title="Select project directory"`);
+        return p ? { path: p } : { path: null };
     }
     catch {
-        // zenity not available
     }
     try {
-        return tryDialog(`kdialog --getexistingdirectory "${process.env.HOME ?? "/"}" --title "Select project directory"`);
+        const p = tryDialog(`kdialog --getexistingdirectory "${process.env.HOME ?? "/"}" --title "Select project directory"`);
+        return p ? { path: p } : { path: null };
     }
     catch {
-        // kdialog not available
     }
-    // Try Python tkinter
-    return pickTkinter();
+    const tkResult = pickTkinter();
+    if (tkResult.path === null && !tkResult.error) {
+        return {
+            path: null,
+            error: "No folder picker available. Install zenity, kdialog, or python3-tk.",
+        };
+    }
+    return tkResult;
 }
-/**
- * Windows: Use PowerShell to invoke the COM Shell.Application folder picker.
- */
 function pickWindows() {
     const script = `
-    Add-Type -AssemblyName System.Windows.Forms
-    $f = New-Object System.Windows.Forms.FolderBrowserDialog
-    $f.Description = "Select project directory"
-    $f.ShowNewFolderButton = $true
-    if ($f.ShowDialog() -eq "OK") { $f.SelectedPath } else { "" }
+    try {
+      Add-Type -AssemblyName System.Windows.Forms -ErrorAction Stop
+      $f = New-Object System.Windows.Forms.FolderBrowserDialog
+      $f.Description = "Select project directory"
+      $f.ShowNewFolderButton = $true
+      if ($f.ShowDialog() -eq "OK") { Write-Output $f.SelectedPath } else { Write-Output "__CANCELLED__" }
+    } catch {
+      Write-Error $_.Exception.Message
+      [Environment]::Exit(99)
+    }
   `.trim();
+    // -EncodedCommand (UTF-16LE base64) avoids cmd.exe quote-escaping bugs
+    // that would corrupt -Command strings containing nested double-quotes.
+    const encoded = Buffer.from(script, "utf-16le").toString("base64");
     try {
-        const result = execSync(`powershell -NoProfile -Command "${script.replace(/"/g, '\\"')}"`, { encoding: "utf-8", timeout: 180_000 });
-        return result.trim() || null;
+        const result = execSync(`powershell -STA -NoProfile -EncodedCommand ${encoded}`, { encoding: "utf-8", timeout: 180_000 });
+        const trimmed = result.trim();
+        if (!trimmed || trimmed === "__CANCELLED__") {
+            return { path: null };
+        }
+        return { path: trimmed };
     }
-    catch {
-        return null;
+    catch (err) {
+        const status = execErrStatus(err);
+        if (status === 99) {
+            const stderr = err && typeof err === "object" && "stderr" in err
+                ? String(err.stderr).trim()
+                : "";
+            return {
+                path: null,
+                error: stderr || "Folder picker could not be displayed.",
+            };
+        }
+        return {
+            path: null,
+            error: `Could not open folder picker (Windows): ${execErrMsg(err)}`,
+        };
     }
 }
-/**
- * Python tkinter fallback — works on any OS with Python + tkinter installed.
- * tkinter is bundled with macOS Python from python.org and most Linux distros.
- */
 function pickTkinter() {
     const script = `import tkinter as tk
 from tkinter import filedialog
@@ -120,61 +128,47 @@ print(d if d else "")
             encoding: "utf-8",
             timeout: 180_000,
         });
-        return result.trim() || null;
+        const trimmed = result.trim();
+        return trimmed ? { path: trimmed } : { path: null };
     }
     catch {
-        // python3 not found — try 'python' (Windows)
         try {
             const result = execSync(`python -c "${script}"`, {
                 encoding: "utf-8",
                 timeout: 180_000,
             });
-            return result.trim() || null;
+            const trimmed = result.trim();
+            return trimmed ? { path: trimmed } : { path: null };
         }
         catch {
-            return null;
+            return {
+                path: null,
+                error: "Python/tkinter not available for folder picker. Type the path manually.",
+            };
         }
     }
 }
-// ---------------------------------------------------------------------------
-// Public handler
-// ---------------------------------------------------------------------------
-/**
- * Attempt to open a native folder picker dialog and return the selected path.
- *
- * Synchronous and blocking by design — the browser form is waiting for a
- * response and the user is interacting with the dialog.
- */
 export function handlePickDirectory() {
     const os = platform();
     try {
-        let path = null;
         if (os === "darwin") {
-            path = pickMacOS();
+            return pickMacOS();
         }
         else if (os === "linux") {
-            path = pickLinux();
+            return pickLinux();
         }
         else if (os === "win32") {
-            path = pickWindows();
+            return pickWindows();
         }
         else {
-            // Unknown platform — try Python tkinter as universal fallback
-            path = pickTkinter();
-        }
-        if (path === null) {
-            // User cancelled or no picker available. Distinguish:
-            // When no path AND no error in the platform pickers, it's a cancel.
-            return { path: null };
+            return pickTkinter();
         }
-        return { path };
     }
     catch (err) {
-        // The platform picker failed entirely (not cancelled — process error).
         const msg = err instanceof Error ? err.message : String(err);
         return {
             path: null,
-            error: `Could not open folder picker: ${msg}`,
+            error: `Could not open folder picker (${os}): ${msg}`,
         };
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexol/spectral",
-  "version": "0.9.42",
+  "version": "0.9.44",
   "description": "AI coding agent for Aexol with relay-based browser access.",
   "type": "module",
   "private": false,