@davait/aipictury 1.9.2 → 1.10.3

package/ext/agent.js

@@ -1046,7 +1046,10 @@ async function runHelper(args, { server, session, signal, report, hooks, model }
   const allowedTools = role?.tools.length ? new Set(role.tools.flatMap((t) => AGENT_TOOLS[t] || [t])) : null
   const writes = !allowedTools || [...allowedTools].some((t) => WRITES.has(t) || t === 'run_command')
   const type = role ? (writes ? 'general' : 'explore') : args.subagent_type === 'general' ? 'general' : 'explore'
-  const sub = { allowAll: session.allowAll, allowCommands: session.allowCommands, allowSites: session.allowSites, seen: new Map(), cwd: session.cwd, worktree: session.worktree }
+  // The run's own rules hold for its helpers too: a tool denied for the run (--disallowedTools)
+  // was still offered to a helper, which ran the command the run could not.
+  const sub = { allowAll: session.allowAll, allowCommands: session.allowCommands, allowSites: session.allowSites, seen: new Map(), cwd: session.cwd, worktree: session.worktree,
+    ...(session.commandAllow ? { commandAllow: session.commandAllow } : {}), ...(session.commandDeny ? { commandDeny: session.commandDeny } : {}) }
   // isolation: "worktree" — the helper works in a checkout of its own.
   let ownTree = null
   if (args.isolation === 'worktree') {
@@ -1055,7 +1058,9 @@ async function runHelper(args, { server, session, signal, report, hooks, model }
     sub.cwd = ownTree.path
   }
   const readOnly = type === 'explore' || modeNow() === 'plan'
+  const denied = new Set((session.commandDeny || []).flatMap((rule) => permissions.toolsNamed(rule)))
   const tools = toolSchema({ readOnly, helper: true, extra: [...mcp.schema({ readOnly, loaded: (session.loadedMcp ||= new Set()) }), ...mcp.resourceSchema()] })
+    .filter((t) => !denied.has(t.function?.name))
     .filter((t) => !allowedTools || allowedTools.has(t.function.name) || (t.function.name.startsWith('mcp__') && allowedTools.has(t.function.name)))
   const id = `agent_${helpersOf(session).size + 1}`
   const h = {

package/ext/extension.js

@@ -2295,6 +2295,9 @@ function moveConversationsToDisk(context) {
 }
 
 function activate(context) {
+  // This window names itself on every call to its GPU server (gpuRun.js).
+  gpuRun.setApp({ client: 'vscode', server: serverUrl })
+  gpuRun.nameCalls()
   try { moveConversationsToDisk(context) } catch { /* tried again next start */ }
   syncCommandEnv().catch(() => { /* again before each run */ })
   undoOldThinkingSwitch(context).catch(() => { /* the setting stays as it was */ })

package/ext/gpuRun.js

@@ -10,11 +10,20 @@ const { AsyncLocalStorage } = require('async_hooks')
 const store = new AsyncLocalStorage()
 const BEAT = 30_000
 
-/** The headers of the run this code is part of (none outside a run). */
+// This app (this VS Code window, this CLI): on every call to its server, so the server lets its
+// quick calls (a title, a rule saved) and its own runs share the GPU — never another app's.
+const app = { id: `app-${crypto.randomUUID()}`, client: 'vscode', server: () => '' }
+/** Who this app is ('vscode' | 'cli') and where its GPU server is (a function: it can change). */
+function setApp({ client, server } = {}) { if (client) app.client = client; if (server) app.server = server }
+
+/** The headers of every call this code makes to its server: the app's, and the run's in a run. */
 function headers() {
+  const own = { 'X-AIPictury-App': app.id, 'X-AIPictury-Client': app.client }
   const r = store.getStore()
-  if (!r) return {}
-  return { 'X-AIPictury-Client': r.client, 'X-AIPictury-Run': r.run, 'X-AIPictury-Label': encodeURIComponent(r.label || '') }
+  // Work a run left going after it ended (a rule saved, a title written) is no longer that run:
+  // named so, it took the GPU back for a run that was over, and other apps waited 90 s.
+  if (!r || r.ended) return own
+  return { ...own, 'X-AIPictury-Client': r.client, 'X-AIPictury-Run': r.run, 'X-AIPictury-Label': encodeURIComponent(r.label || '') }
 }
 
 class GpuBusyError extends Error {
@@ -30,8 +39,29 @@ class GpuBusyError extends Error {
  * fn() as a run holding the GPU of `server`. `client`: 'vscode' | 'cli'. A GPU held by another
  * run: GpuBusyError before anything is done. A server without holds (older): fn() as before.
  */
+// Every call a run makes to its own server carries the run, whoever made the call: not only
+// through the account's fetch (account.js serverFetch), which a window without an account (the
+// extension's tests) does not have — there the run's own model calls were refused as another's.
+function nameCalls() {
+  if (globalThis.fetch.namesRuns) return
+  const base = globalThis.fetch
+  const named = (input, init = {}) => {
+    const r = store.getStore()
+    const url = typeof input === 'string' ? input : input?.url || String(input)
+    const server = (r && !r.ended && r.server) || String(app.server() || '').replace(/\/+$/, '')
+    if (!server || !url.startsWith(server)) return base(input, init)
+    const h = new Headers(init.headers || (typeof input === 'object' && input?.headers) || undefined)
+    for (const [k, v] of Object.entries(headers())) if (!h.has(k)) h.set(k, v)
+    return base(input, { ...init, headers: h })
+  }
+  named.namesRuns = true
+  globalThis.fetch = named
+}
+
 async function holding({ server, client, label = '' }, fn) {
-  const run = { client, run: `${client}-${crypto.randomUUID()}`, label: String(label).replace(/\s+/g, ' ').slice(0, 100) }
+  nameCalls()
+  const run = { client, server: String(server || '').replace(/\/+$/, ''), run: `${client}-${crypto.randomUUID()}`,
+    label: String(label).replace(/\s+/g, ' ').slice(0, 100) }
   return store.run(run, async () => {
     const h = headers()
     let held = false
@@ -53,6 +83,7 @@ async function holding({ server, client, label = '' }, fn) {
     try {
       return await fn()
     } finally {
+      run.ended = true
       if (beat) clearInterval(beat)
       if (held) await fetch(`${server}/api/gpu/hold`, { method: 'DELETE', headers: h, signal: AbortSignal.timeout(10_000) }).catch(() => {})
     }
@@ -70,8 +101,9 @@ async function state(server) {
 /** The hold of another run on every GPU (all busy), or null (one is free, or it is this run's). */
 function busyFor(gpu, mine = null) {
   const lanes = gpu?.lanes || []
-  if (!lanes.length || lanes.some((l) => !l.hold || l.hold.run === mine)) return null
+  // A quick call (no run: a title, a rule saved) is done in a moment; the server lets its owner in.
+  if (!lanes.length || lanes.some((l) => !l.hold || l.hold.run === mine || l.hold.side)) return null
   return lanes[0].hold
 }
 
-module.exports = { holding, headers, state, busyFor, GpuBusyError, store }
+module.exports = { holding, headers, setApp, nameCalls, state, busyFor, GpuBusyError, store }

package/ext/package.json

@@ -2,7 +2,7 @@
   "name": "aipictury",
   "displayName": "AIPictury",
   "description": "A coding agent and a generation studio running on your own GPU, with uncensored local models.",
-  "version": "1.9.2",
+  "version": "1.10.3",
   "publisher": "aipictury",
   "license": "SEE LICENSE IN LICENSE.md",
   "engines": {
@@ -1203,7 +1203,7 @@
     "@eslint/js": "^10.0.1",
     "@types/vscode": "^1.95.0",
     "@vscode/test-electron": "^3.1.0",
-    "@vscode/vsce": "^3.2.0",
+    "@vscode/vsce": "^4.0.0",
     "dompurify": "^3.4.16",
     "esbuild": "^0.28.2",
     "eslint": "^10.11.0",

package/ext/storage.js

@@ -26,11 +26,12 @@ class Storage {
   }
 
   /** Stores bytes at `path` ("users/u/media/a.png"). Resolves to the object's metadata. A multipart
-   *  upload, as the SDK's: the type goes in the object's metadata, where the rules read it. */
+   *  upload, as the SDK's: the type goes in the object's metadata, where the rules read it; and
+   *  no-store, so no browser that shows it keeps a copy past signing out. */
   async upload(path, bytes, contentType) {
     const boundary = `aipictury-${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`
     const body = Buffer.concat([
-      Buffer.from(`--${boundary}\r\nContent-Type: application/json; charset=utf-8\r\n\r\n${JSON.stringify({ name: path, contentType })}\r\n`
+      Buffer.from(`--${boundary}\r\nContent-Type: application/json; charset=utf-8\r\n\r\n${JSON.stringify({ name: path, contentType, cacheControl: 'private, no-store' })}\r\n`
         + `--${boundary}\r\nContent-Type: ${contentType}\r\n\r\n`),
       Buffer.from(bytes),
       Buffer.from(`\r\n--${boundary}--`),

package/main.js

@@ -711,6 +711,8 @@ async function main() {
   if (!require(path.join(EXT, 'gpuServer.js')).explicit()) {
     try { await require(path.join(EXT, 'gpuServer.js')).adopt((await sync.cloud.getPreferences())?.values?.gpuServer) } catch { /* said below if none */ }
   }
+  // This CLI names itself on every call to its GPU server (gpuRun.js).
+  require(path.join(EXT, 'gpuRun.js')).setApp({ client: 'cli', server })
   // Every call to the GPU server carries the account's token (the server may require it), and only those.
   const { serverFetch } = require(path.join(EXT, 'account.js'))
   globalThis.fetch = serverFetch({ fetch: globalThis.fetch, account, server })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davait/aipictury",
-  "version": "1.9.2",
+  "version": "1.10.3",
   "description": "The AIPictury agent in a terminal: the VS Code extension's agent, on your own GPU server, signed in to your AIPictury account.",
   "bin": {
     "aipictury": "main.js"