@chibitek/chibi 0.1.169 → 0.1.171

package/dist-server/companion/src/routes.js

@@ -33,7 +33,7 @@ export const MESSAGE_FILE_ROUTE = {
 };
 export const CLOUD_DESKTOP_CONTROL_ROUTE = {
     method: "POST",
-    path: /^\/api\/bots\/[\w-]+\/computer\/(?:control|screenshot|viewer-close)$/,
+    path: /^\/api\/bots\/[\w-]+\/computer\/(?:control|screenshot|viewer-close|remote-frame|remote-input)$/,
 };
 export function isCloudDesktopJoin(method, path) {
     return method === CLOUD_DESKTOP_JOIN_ROUTE.method && CLOUD_DESKTOP_JOIN_ROUTE.path.test(path);
@@ -41,6 +41,28 @@ export function isCloudDesktopJoin(method, path) {
 export function isMessageFileDownload(method, path) {
     return method === MESSAGE_FILE_ROUTE.method && MESSAGE_FILE_ROUTE.path.test(path);
 }
+/** The desktop's broad bot and room edits. A phone reaches the harness as
+ * the owner, so the harness's own display-fields-only filter for clients
+ * never runs; the proxy opens these to the pin toggle alone by checking the
+ * body itself (isPinOnlyBody) and forwarding exactly the bytes it checked. */
+export const PIN_ONLY_ROUTE = {
+    method: "PATCH",
+    path: /^\/api\/(?:bots|groups)\/[\w-]+$/,
+};
+export function isPinOnlyRoute(method, path) {
+    return method === PIN_ONLY_ROUTE.method && PIN_ONLY_ROUTE.path.test(path);
+}
+/** `{"pinned": true|false}` and nothing else. */
+export function isPinOnlyBody(raw) {
+    try {
+        const body = JSON.parse(raw.toString("utf8"));
+        return Boolean(body) && typeof body === "object" && !Array.isArray(body)
+            && Object.keys(body).length === 1 && typeof body.pinned === "boolean";
+    }
+    catch {
+        return false;
+    }
+}
 export function isCloudDesktopAccess(method, path) {
     return isCloudDesktopJoin(method, path)
         || (method === CLOUD_DESKTOP_CONTROL_ROUTE.method && CLOUD_DESKTOP_CONTROL_ROUTE.path.test(path));
@@ -75,6 +97,8 @@ const ALLOWED = [
     // Pinned-row reorder: hands the viewer's own pin stamps back out in a new
     // order (server/pin-order.ts); it cannot pin, unpin or reach hidden bots.
     { method: "PUT", path: /^\/api\/pins\/order$/ },
+    // Pin or unpin one bot or room; the proxy refuses any other field.
+    PIN_ONLY_ROUTE,
     { method: "POST", path: /^\/api\/bots\/[\w-]+\/messages$/ },
     { method: "PATCH", path: /^\/api\/bots\/[\w-]+\/cards\/[\w-]+$/ },
     { method: "POST", path: /^\/api\/bots\/[\w-]+\/respond$/ },
@@ -185,6 +209,9 @@ const ALLOWED = [
     // on/off only. The full server list stays on the computer, since a local
     // server's arguments can carry anything.
     { method: "GET", path: /^\/api\/mcp\/defaults$/ },
+    // A marketplace connect card. The harness adds only Atomic's featured,
+    // vendor-run servers, threat-scans them and saves them switched off.
+    { method: "POST", path: /^\/api\/mcp\/registry\/add$/ },
 ];
 /** Route families worth naming in the refusal.
  *

package/dist-server/container-mcp.js

@@ -16594,6 +16594,7 @@ var SPAWNED_PROXIES = {
   hook: resolveProxy("hooks/omb-hook"),
   // the RTK add-on's Claude PreToolUse hook (bypassPermissions turns only)
   rtkHook: resolveProxy("hooks/rtk-hook"),
+  planHook: resolveProxy("hooks/plan-hook"),
   // Loaded by the external `pi` process via `-e`, not by this server — but
   // resolved through the same single source of truth so the packaged layout
   // check can assert it ships.

package/dist-server/hooks/plan-hook.js

@@ -0,0 +1,22 @@
+// server/hooks/plan-hook.ts
+import { readFileSync } from "node:fs";
+
+// server/plan-policy.ts
+var PLAN_READ_TOOLS = ["Read", "Glob", "Grep"];
+var PLAN_REFUSAL = "Plan mode blocked this action. Review the plan and approve it in Atomic before making changes.";
+function planToolAllowed(tool) {
+  return typeof tool === "string" && PLAN_READ_TOOLS.includes(tool);
+}
+
+// server/hooks/plan-hook.ts
+try {
+  const event = JSON.parse(readFileSync(0, "utf8"));
+  if (event.hook_event_name === "PreToolUse" && planToolAllowed(event.tool_name)) {
+  } else {
+    process.stderr.write(PLAN_REFUSAL);
+    process.exitCode = 2;
+  }
+} catch {
+  process.stderr.write(PLAN_REFUSAL);
+  process.exitCode = 2;
+}