@cjhyy/code-shell-core 0.8.8 → 0.8.10

package/dist/model-catalog/save-entry.js

@@ -6,10 +6,91 @@
  * here (those go through the user's own Edit, by design).
  * See docs/superpowers/specs/2026-06-15-unified-model-catalog-design.md §7.
  */
-import { readFileSync, writeFileSync, existsSync, copyFileSync, mkdirSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname } from "node:path";
 import { catalogEntrySchema, userCatalogFileSchema } from "./types.js";
 import { upsertCatalogEntry } from "./upsert.js";
+import { acquireFileLock } from "../utils/file-mutex.js";
+const MAX_USER_CATALOG_BYTES = 4 * 1024 * 1024;
+const BACKUP_STAMP_RE = /^[A-Za-z0-9._-]{1,128}$/;
+function pathEntry(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function readExistingCatalog(path) {
+    const metadata = pathEntry(path);
+    if (!metadata)
+        return undefined;
+    if (metadata.isSymbolicLink() ||
+        !metadata.isFile() ||
+        metadata.size > MAX_USER_CATALOG_BYTES) {
+        throw new Error("catalog must be a bounded regular file");
+    }
+    const descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = fstatSync(descriptor);
+        if (!opened.isFile() || opened.size > MAX_USER_CATALOG_BYTES) {
+            throw new Error("catalog must be a bounded regular file");
+        }
+        const raw = readFileSync(descriptor, "utf8");
+        try {
+            const parsed = userCatalogFileSchema.safeParse(JSON.parse(raw));
+            return { raw, entries: parsed.success ? parsed.data : [] };
+        }
+        catch {
+            return { raw, entries: [] };
+        }
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function writeBackup(path, raw) {
+    try {
+        writeFileSync(path, raw, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function writeCatalogAtomic(path, entries) {
+    const serialized = `${JSON.stringify(userCatalogFileSchema.parse(entries), null, 2)}\n`;
+    if (Buffer.byteLength(serialized, "utf8") > MAX_USER_CATALOG_BYTES) {
+        throw new Error("catalog exceeds its size limit");
+    }
+    const parent = dirname(path);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const parentInfo = lstatSync(parent);
+    if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory()) {
+        throw new Error("catalog parent must be a real directory");
+    }
+    const target = pathEntry(path);
+    if (target && (target.isSymbolicLink() || !target.isFile())) {
+        throw new Error("catalog target must be a regular file");
+    }
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, serialized, {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: "wx",
+        });
+        renameSync(temporary, path);
+        if (process.platform !== "win32")
+            chmodSync(path, 0o600);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
 /**
  * @param stamp caller-supplied unique suffix for the backup filename. Pass a
  *   timestamp/counter from the caller — core forbids Date.now() in some paths
@@ -22,47 +103,27 @@ export function saveCatalogEntry(entry, opts) {
         return { ok: false, error: `invalid catalog entry: ${parsed.error.issues.map((i) => i.message).join("; ")}` };
     }
     const valid = parsed.data;
-    // Read + back up any existing file (even if corrupt — never silently lose it).
-    let current = [];
-    let backup;
-    if (existsSync(opts.path)) {
-        backup = `${opts.path}.bak-${opts.stamp}`;
-        try {
-            copyFileSync(opts.path, backup);
-        }
-        catch {
-            backup = undefined; // best-effort; don't abort the write on backup failure
-        }
-        try {
-            const raw = JSON.parse(readFileSync(opts.path, "utf-8"));
-            const safe = userCatalogFileSchema.safeParse(raw);
-            current = safe.success ? safe.data : [];
-        }
-        catch {
-            current = []; // corrupt → start fresh (original preserved in backup)
-        }
-    }
-    const action = current.some((e) => e.id === valid.id) ? "updated" : "added";
-    const next = upsertCatalogEntry(current, valid);
-    // Ensure the parent dir exists — a first-ever catalog write on a machine
-    // whose ~/.code-shell hasn't been created yet would otherwise throw ENOENT
-    // (the agent-facing tool wants a clean {ok:false} or a real write, not a crash).
+    if (!BACKUP_STAMP_RE.test(opts.stamp))
+        return { ok: false, error: "invalid backup stamp" };
+    let release;
     try {
-        mkdirSync(dirname(opts.path), { recursive: true });
+        release = acquireFileLock(opts.path);
+        const existing = readExistingCatalog(opts.path);
+        let backup = existing ? `${opts.path}.bak-${opts.stamp}` : undefined;
+        if (existing && !writeBackup(backup, existing.raw))
+            backup = undefined;
+        const action = existing?.entries.some((e) => e.id === valid.id)
+            ? "updated"
+            : "added";
+        writeCatalogAtomic(opts.path, upsertCatalogEntry(existing?.entries ?? [], valid));
+        return { ok: true, action, backup };
     }
     catch (e) {
-        return { ok: false, error: `could not create catalog directory: ${e instanceof Error ? e.message : String(e)}`, backup };
+        return { ok: false, error: `could not write catalog: ${e instanceof Error ? e.message : String(e)}` };
     }
-    try {
-        writeFileSync(opts.path, JSON.stringify(next, null, 2));
-    }
-    catch (e) {
-        // IO error (perms / disk full / bad path): return a clean {ok:false} with the
-        // backup filename preserved, never let the throw escape past the tool's
-        // expected result shape (the original file is intact — we only upsert-wrote).
-        return { ok: false, error: `could not write catalog: ${e instanceof Error ? e.message : String(e)}`, backup };
+    finally {
+        release?.();
     }
-    return { ok: true, action, backup };
 }
 /**
  * Remove the entry with `id` from the user catalog file. Mirrors saveCatalogEntry's
@@ -72,33 +133,33 @@ export function saveCatalogEntry(entry, opts) {
  * built-in version ("reset" semantics).
  */
 export function deleteUserCatalogEntry(id, opts) {
-    if (!existsSync(opts.path))
-        return { ok: true, removed: false };
-    let backup = `${opts.path}.bak-${opts.stamp}`;
-    try {
-        copyFileSync(opts.path, backup);
-    }
-    catch {
-        backup = undefined;
+    if (!BACKUP_STAMP_RE.test(opts.stamp)) {
+        return { ok: false, removed: false, error: "invalid backup stamp" };
     }
-    let current = [];
+    let release;
     try {
-        const raw = JSON.parse(readFileSync(opts.path, "utf-8"));
-        const safe = userCatalogFileSchema.safeParse(raw);
-        current = safe.success ? safe.data : [];
-    }
-    catch {
-        current = [];
-    }
-    const next = current.filter((e) => e.id !== id);
-    const removed = next.length !== current.length;
-    if (!removed)
-        return { ok: true, removed: false, backup };
-    try {
-        writeFileSync(opts.path, JSON.stringify(next, null, 2));
+        release = acquireFileLock(opts.path);
+        const existing = readExistingCatalog(opts.path);
+        if (!existing)
+            return { ok: true, removed: false };
+        let backup = `${opts.path}.bak-${opts.stamp}`;
+        if (!writeBackup(backup, existing.raw))
+            backup = undefined;
+        const next = existing.entries.filter((e) => e.id !== id);
+        const removed = next.length !== existing.entries.length;
+        if (!removed)
+            return { ok: true, removed: false, backup };
+        writeCatalogAtomic(opts.path, next);
+        return { ok: true, removed: true, backup };
     }
     catch (e) {
-        return { ok: false, removed: false, error: `could not write catalog: ${e instanceof Error ? e.message : String(e)}`, backup };
+        return {
+            ok: false,
+            removed: false,
+            error: `could not write catalog: ${e instanceof Error ? e.message : String(e)}`,
+        };
+    }
+    finally {
+        release?.();
     }
-    return { ok: true, removed: true, backup };
 }

package/dist/model-catalog/types.js

@@ -12,6 +12,10 @@
  * ("openai"/"google"/"fal"). `shape` is documentation/future only.
  */
 import { z } from "zod";
+const id = z.string().min(1).max(128);
+const shortText = z.string().max(256);
+const longText = z.string().max(32_768);
+const boundedNumber = z.number().finite().min(0).max(1_000_000_000);
 /**
  * How the param maps onto the outgoing request body. `field` is the request
  * field this param lands on — same param name can land differently per
@@ -20,7 +24,7 @@ import { z } from "zod";
  * in `if (kind === ...)` branches in the engine. Minimal v1: field only.
  */
 export const wireSpecSchema = z.object({
-    field: z.string(),
+    field: id,
 });
 /**
  * One **generic** declarative param — no special-casing per param. reasoning
@@ -32,18 +36,18 @@ export const wireSpecSchema = z.object({
  */
 export const paramSpecSchema = z.object({
     /** Logical name, e.g. "reasoning" / "size" / "quality" / "temperature". */
-    name: z.string(),
+    name: id,
     /** UI control label (falls back to `name`). */
-    label: z.string().optional(),
+    label: shortText.optional(),
     control: z.enum(["enum", "number", "toggle", "text"]),
     /** control=enum allowed values, e.g. ["low","medium","high","xhigh"]. */
-    options: z.array(z.string()).optional(),
+    options: z.array(shortText).max(64).optional(),
     /** control=number bounds. */
-    min: z.number().optional(),
-    max: z.number().optional(),
-    default: z.union([z.string(), z.number(), z.boolean()]).optional(),
+    min: boundedNumber.optional(),
+    max: boundedNumber.optional(),
+    default: z.union([shortText, boundedNumber, z.boolean()]).optional(),
     /** Natural-language usage note → injected into the tool description. */
-    doc: z.string().optional(),
+    doc: z.string().max(4_096).optional(),
     /** How this param lands on the request body. */
     wire: wireSpecSchema.optional(),
 });
@@ -53,17 +57,17 @@ export const paramSpecSchema = z.object({
  * can expose different params, since gateways normalize differently).
  */
 export const modelPresetSchema = z.object({
-    value: z.string(),
-    label: z.string().optional(),
-    maxContextTokens: z.number().optional(),
-    maxOutputTokens: z.number().optional(),
+    value: id,
+    label: shortText.optional(),
+    maxContextTokens: boundedNumber.optional(),
+    maxOutputTokens: boundedNumber.optional(),
     supportsVision: z.boolean().optional(),
     /** Params this model supports; absent → no adjustable knobs. */
-    params: z.array(paramSpecSchema).optional(),
+    params: z.array(paramSpecSchema).max(64).optional(),
 });
 export const catalogEntrySchema = z.object({
     /** Template id, e.g. "openai" / "openai-images" / "fal-video". */
-    id: z.string(),
+    id,
     /** Which 连接 page group this lands in. (audio = speech-to-text / voice input.) */
     tag: z.enum(["text", "image", "video", "audio"]),
     /**
@@ -71,15 +75,15 @@ export const catalogEntrySchema = z.object({
      * runtime adapter for image/video. OpenRouter is `openrouter` even though its
      * text protocol is `openai-compat`.
      */
-    adapterKind: z.string(),
+    adapterKind: id,
     /** LLM client protocol (text entries). */
     protocol: z.enum(["openai-compat", "anthropic-style"]).optional(),
     /** HTTP shape — documentation/future only; runtime dispatches on adapterKind. */
     shape: z.enum(["generic-sync", "fal-queue"]).optional(),
-    displayName: z.string(),
-    description: z.string(),
-    defaultBaseUrl: z.string(),
-    defaultModel: z.string().optional(),
+    displayName: z.string().min(1).max(256),
+    description: z.string().max(4_096),
+    defaultBaseUrl: z.string().max(4_096),
+    defaultModel: shortText.optional(),
     /** Whether this provider needs an API key (ollama/local = false). */
     needsKey: z.boolean().optional(),
     /**
@@ -89,8 +93,8 @@ export const catalogEntrySchema = z.object({
      * `value`, so future built-in models remain visible.
      */
     modelPresetsMode: z.enum(["replace", "merge"]).optional(),
-    modelPresets: z.array(modelPresetSchema).optional(),
-    signupUrl: z.string().optional(),
+    modelPresets: z.array(modelPresetSchema).max(512).optional(),
+    signupUrl: z.string().max(4_096).optional(),
     /** Whether the 连接 card offers a "测试" button (image=true, video=false). */
     test: z.boolean().optional(),
     /**
@@ -98,7 +102,7 @@ export const catalogEntrySchema = z.object({
      * the agent via the dynamic GenerateImage/GenerateVideo tool description so it
      * knows what a configured model accepts (different models differ).
      */
-    paramsDoc: z.string().optional(),
+    paramsDoc: longText.optional(),
 });
 /** A user-catalog file is just an array of entries (zod-validated on load). */
-export const userCatalogFileSchema = z.array(catalogEntrySchema);
+export const userCatalogFileSchema = z.array(catalogEntrySchema).max(256);

package/dist/panel-apps/installer.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
-import { existsSync } from "node:fs";
-import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { constants, existsSync } from "node:fs";
+import { cp, lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { basename, extname, join, posix, relative, resolve, sep } from "node:path";
 import { extractZip, extractZipSubdirectory } from "../plugins/installer/unzip.js";
@@ -279,22 +279,34 @@ async function walkBoundedTree(root, directory, depth, budget, files, directorie
     }
 }
 async function readManifest(sourceRoot) {
-    const file = join(sourceRoot, PANEL_APP_MANIFEST_FILE);
-    let info;
     try {
-        info = await stat(file);
+        const raw = await readBoundedPackageFile(sourceRoot, PANEL_APP_MANIFEST_FILE, MAX_MANIFEST_BYTES);
+        return PanelAppManifest.parse(JSON.parse(raw.toString("utf8")));
     }
-    catch {
-        throw new PanelAppInstallError(`missing ${PANEL_APP_MANIFEST_FILE}`);
+    catch (error) {
+        throw new PanelAppInstallError(`invalid Panel App manifest: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+async function readBoundedPackageFile(root, relativePath, maxBytes) {
+    const candidate = join(root, ...relativePath.split("/"));
+    const metadata = await lstat(candidate);
+    if (metadata.isSymbolicLink() || !metadata.isFile() || metadata.size > maxBytes) {
+        throw new PanelAppInstallError(`Panel App file is not a bounded regular file: ${relativePath}`);
     }
-    if (!info.isFile() || info.size > MAX_MANIFEST_BYTES) {
-        throw new PanelAppInstallError(`${PANEL_APP_MANIFEST_FILE} must be a regular file no larger than 1 MiB`);
+    const physical = await realpath(candidate);
+    if (physical !== root && !physical.startsWith(`${root}${sep}`)) {
+        throw new PanelAppInstallError(`Panel App file escapes its package: ${relativePath}`);
     }
+    const handle = await open(candidate, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
     try {
-        return PanelAppManifest.parse(JSON.parse(await readFile(file, "utf-8")));
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.size > maxBytes) {
+            throw new PanelAppInstallError(`Panel App file is not a bounded regular file: ${relativePath}`);
+        }
+        return await handle.readFile();
     }
-    catch (error) {
-        throw new PanelAppInstallError(`invalid Panel App manifest: ${error instanceof Error ? error.message : String(error)}`);
+    finally {
+        await handle.close();
     }
 }
 async function inspectPanelAppSource(sourceRoot) {
@@ -323,10 +335,11 @@ async function inspectPanelAppSource(sourceRoot) {
         if (!files.includes(skillEntry)) {
             throw new PanelAppInstallError(`declared Panel App skill is missing: ${skillEntry}`);
         }
-        const skillInfo = await stat(join(root, ...skillEntry.split("/")));
+        const skillInfo = await lstat(join(root, ...skillEntry.split("/")));
         if (!skillInfo.isFile() || skillInfo.size > MAX_AGENT_SKILL_BYTES) {
             throw new PanelAppInstallError(`declared Panel App skill must be a file no larger than 256 KiB: ${skillEntry}`);
         }
+        await readBoundedPackageFile(root, skillEntry, MAX_AGENT_SKILL_BYTES);
     }
     for (const file of files) {
         if (file === PANEL_APP_MANIFEST_FILE || file === PANEL_APP_META_FILE)
@@ -352,7 +365,7 @@ async function inspectPanelAppSource(sourceRoot) {
         hash
             .update(file)
             .update("\0")
-            .update(await readFile(join(root, ...file.split("/"))));
+            .update(await readBoundedPackageFile(root, file, file === PANEL_APP_MANIFEST_FILE ? MAX_MANIFEST_BYTES : MAX_FILE_BYTES));
     }
     return { manifest, files, digest: hash.digest("hex") };
 }

package/dist/panel-apps/manifest.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 export declare const PANEL_APP_MANIFEST_FILE = ".codeshell-panel/panel.json";
-export declare const PANEL_APP_PERMISSIONS: readonly ["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage"];
+export declare const PANEL_APP_PERMISSIONS: readonly ["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "agent.task", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage", "process"];
 export declare const PANEL_APP_ICONS: readonly ["panel", "activity", "bar-chart-3", "chart", "file-text", "globe", "image", "layout-dashboard", "line-chart", "palette", "pie-chart", "table", "terminal"];
 export declare const PanelAppAgentTool: z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
@@ -116,12 +116,12 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     icon: z.ZodDefault<z.ZodEnum<["panel", "activity", "bar-chart-3", "chart", "file-text", "globe", "image", "layout-dashboard", "line-chart", "palette", "pie-chart", "table", "terminal"]>>;
     placement: z.ZodDefault<z.ZodLiteral<"right-dock">>;
     singleton: z.ZodDefault<z.ZodBoolean>;
-    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage"]>, "many">>;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "agent.task", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage", "process"]>, "many">>;
     schemaVersion: z.ZodLiteral<1>;
 }, "strict", z.ZodTypeAny, {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -144,7 +144,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     };
     schemaVersion: 1;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;
@@ -230,12 +230,12 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     icon: z.ZodDefault<z.ZodEnum<["panel", "activity", "bar-chart-3", "chart", "file-text", "globe", "image", "layout-dashboard", "line-chart", "palette", "pie-chart", "table", "terminal"]>>;
     placement: z.ZodDefault<z.ZodLiteral<"right-dock">>;
     singleton: z.ZodDefault<z.ZodBoolean>;
-    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage"]>, "many">>;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["context.session", "context.workspace", "storage", "external.open", "agent.submitPrompt", "agent.task", "workspace.info", "workspace.read", "workspace.write", "notifications.send", "audio.transcribe", "credentials.cookies", "automations.manage", "process"]>, "many">>;
     schemaVersion: z.ZodLiteral<2>;
 }, "strict", z.ZodTypeAny, {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -276,14 +276,14 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
         }[] | undefined;
     } | undefined;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;
 }>]>, {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -298,7 +298,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
 } | {
     id: string;
     version: string;
-    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[];
+    permissions: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[];
     entry: string;
     title: {
         default: string;
@@ -330,7 +330,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
     };
     schemaVersion: 1;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;
@@ -354,7 +354,7 @@ export declare const PanelAppManifest: z.ZodEffects<z.ZodDiscriminatedUnion<"sch
         }[] | undefined;
     } | undefined;
     description?: string | undefined;
-    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage")[] | undefined;
+    permissions?: ("context.session" | "context.workspace" | "storage" | "external.open" | "agent.submitPrompt" | "agent.task" | "workspace.info" | "workspace.read" | "workspace.write" | "notifications.send" | "audio.transcribe" | "credentials.cookies" | "automations.manage" | "process")[] | undefined;
     icon?: "terminal" | "image" | "panel" | "activity" | "bar-chart-3" | "chart" | "file-text" | "globe" | "layout-dashboard" | "line-chart" | "palette" | "pie-chart" | "table" | undefined;
     placement?: "right-dock" | undefined;
     singleton?: boolean | undefined;

package/dist/panel-apps/manifest.js

@@ -7,6 +7,7 @@ export const PANEL_APP_PERMISSIONS = [
     "storage",
     "external.open",
     "agent.submitPrompt",
+    "agent.task",
     "workspace.info",
     "workspace.read",
     "workspace.write",
@@ -14,6 +15,7 @@ export const PANEL_APP_PERMISSIONS = [
     "audio.transcribe",
     "credentials.cookies",
     "automations.manage",
+    "process",
 ];
 export const PANEL_APP_ICONS = [
     "panel",
@@ -139,7 +141,7 @@ const PanelAppManifestFields = {
     icon: z.enum(PANEL_APP_ICONS).default("panel"),
     placement: z.literal("right-dock").default("right-dock"),
     singleton: z.boolean().default(true),
-    permissions: z.array(z.enum(PANEL_APP_PERMISSIONS)).max(12).default([]),
+    permissions: z.array(z.enum(PANEL_APP_PERMISSIONS)).max(16).default([]),
 };
 /**
  * Schema v2 keeps one installable Panel App identity while allowing it to

package/dist/panel-apps/registry.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { z } from "zod";
 import { panelAppsRegistryPath } from "./paths.js";
@@ -28,47 +28,95 @@ const Registry = z
     apps: z.array(RegistryEntry).max(1_024),
 })
     .strict();
-async function readRegistryUnlocked() {
+const MAX_PANEL_APP_REGISTRY_BYTES = 4 * 1024 * 1024;
+async function registryEntry(path) {
+    try {
+        return await lstat(path);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function checkedRegistryDirectory() {
+    const directory = dirname(panelAppsRegistryPath());
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const metadata = await lstat(directory);
+    if (metadata.isSymbolicLink() || !metadata.isDirectory()) {
+        throw new Error("Panel App registry directory must be a real directory");
+    }
+    return directory;
+}
+async function readRegistryUnlocked(strict = false) {
     const path = panelAppsRegistryPath();
-    if (!existsSync(path))
-        return [];
+    let handle;
     try {
-        return Registry.parse(JSON.parse(await readFile(path, "utf-8"))).apps;
+        const metadata = await registryEntry(path);
+        if (!metadata)
+            return [];
+        if (metadata.isSymbolicLink() ||
+            !metadata.isFile() ||
+            metadata.size > MAX_PANEL_APP_REGISTRY_BYTES) {
+            throw new Error("Panel App registry must be a bounded regular file");
+        }
+        handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        const opened = await handle.stat();
+        if (!opened.isFile() || opened.size > MAX_PANEL_APP_REGISTRY_BYTES) {
+            throw new Error("Panel App registry must be a bounded regular file");
+        }
+        return Registry.parse(JSON.parse(await handle.readFile("utf8"))).apps;
     }
-    catch {
+    catch (error) {
+        if (strict) {
+            const detail = error instanceof Error ? `: ${error.message}` : "";
+            throw new Error(`Panel App registry is corrupt${detail}`, { cause: error });
+        }
         return [];
     }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
 }
 async function writeRegistryUnlocked(apps) {
     const path = panelAppsRegistryPath();
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await checkedRegistryDirectory();
+    const target = await registryEntry(path);
+    if (target && (target.isSymbolicLink() || !target.isFile())) {
+        throw new Error("Panel App registry target must be a regular file");
+    }
     const tmp = `${path}.${process.pid}.${randomUUID()}.tmp`;
     try {
         const registry = Registry.parse({
             version: 1,
             apps: [...apps].sort((left, right) => left.id.localeCompare(right.id)),
         });
-        await writeFile(tmp, `${JSON.stringify(registry, null, 2)}\n`, {
+        const serialized = `${JSON.stringify(registry, null, 2)}\n`;
+        if (Buffer.byteLength(serialized, "utf8") > MAX_PANEL_APP_REGISTRY_BYTES) {
+            throw new Error("Panel App registry is too large");
+        }
+        await writeFile(tmp, serialized, {
             encoding: "utf-8",
             flag: "wx",
             mode: 0o600,
         });
         await rename(tmp, path);
+        if (process.platform !== "win32")
+            await chmod(path, 0o600);
     }
     finally {
         await rm(tmp, { force: true });
     }
 }
 async function mutateRegistry(mutation) {
-    const directory = dirname(panelAppsRegistryPath());
-    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const directory = await checkedRegistryDirectory();
     const release = await lock(directory, {
         realpath: true,
         stale: 10_000,
         retries: { retries: 8, minTimeout: 10, maxTimeout: 120, factor: 1.5 },
     });
     try {
-        const next = mutation(await readRegistryUnlocked());
+        const next = mutation(await readRegistryUnlocked(true));
         await writeRegistryUnlocked(next.apps);
         return next.result;
     }

package/dist/plugins/installedPlugins.d.ts

@@ -7,6 +7,10 @@ import type { InstalledPluginsV2, PluginInstallEntry } from "./types.js";
 export declare function installedPluginsPath(): string;
 export declare function readInstalledPlugins(): InstalledPluginsV2;
 export declare function writeInstalledPlugins(data: InstalledPluginsV2): void;
+export declare function mutateInstalledPlugins<R>(mutation: (current: InstalledPluginsV2) => {
+    value?: InstalledPluginsV2;
+    result?: R;
+}): R | undefined;
 /**
  * Append an install entry for `<plugin>@<marketplace>`. Multiple entries
  * for the same key are allowed (different scopes); MVP only writes scope:"user".