@foldspace_npm/harness 0.1.22 → 0.1.24

package/src/init.mjs

@@ -353,7 +353,14 @@ function copyTemplate(templateRoot, targetRoot, values) {
       const sourcePath = path.join(templateRoot, relativePath);
       // npm excludes .gitignore files from package tarballs, so the bundled
       // template uses a publish-safe name and restores it during generation.
-      const outputPath = relativePath === "gitignore" ? ".gitignore" : relativePath;
+      // The permission allowlist lives in .claude/, kept flat here for the
+      // same reason.
+      const outputPath =
+        relativePath === "gitignore"
+          ? ".gitignore"
+          : relativePath === "claude-settings.json"
+            ? path.join(".claude", "settings.json")
+            : relativePath;
       const targetPath = path.join(targetRoot, outputPath);
       assertInside(targetRoot, targetPath);
 

package/src/observe-core.mjs

@@ -43,6 +43,63 @@ export function isSameSite(url, pageUrl, hosts = []) {
   }
 }
 
+/**
+ * One product often lives on several hosts (www., analyze., admin. ...), and a
+ * project only works on the hosts it names. Given addresses seen from a page,
+ * say which hosts look like the same product but are NOT covered, and the one
+ * pattern that would cover them. The site is an approximation (see siteOf), so
+ * this only ever SUGGESTS: widening `hosts` is the human's decision.
+ */
+export function uncoveredSiblings(urls, pageUrl, hosts = []) {
+  let pageHost;
+  try {
+    pageHost = new URL(pageUrl).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+  const site = siteOf(pageHost);
+  if (!site.includes(".") || /^[\d.]+$/.test(site)) return null;
+  const counts = new Map();
+  for (const url of urls) {
+    let host;
+    try {
+      const parsed = new URL(url);
+      if (!/^https?:$/.test(parsed.protocol)) continue;
+      host = parsed.hostname.toLowerCase();
+    } catch {
+      continue;
+    }
+    if (host === pageHost || siteOf(host) !== site || hostMatchesAny(host, hosts)) continue;
+    counts.set(host, (counts.get(host) || 0) + 1);
+  }
+  if (!counts.size) return null;
+  const found = [...counts].map(([host, seen]) => ({ host, seen })).sort((a, b) => b.seen - a.seen || a.host.localeCompare(b.host));
+  const pattern = `*.${site}`;
+  return {
+    hosts: found.slice(0, 12),
+    pattern,
+    hint:
+      `This product also lives on ${found.slice(0, 4).map((entry) => entry.host).join(", ")}` +
+      `${found.length > 4 ? ` and ${found.length - 4} more` : ""}, which this project does not cover. ` +
+      `To work there, add "${pattern}" to "hosts" in foldspace.dev.json - with the human's yes - then run inject and attach again.`,
+  };
+}
+
+/** Whether the page the window is on is one this project works on; if not, what would make it one. */
+export function pageCoverage(pageUrl, hosts = []) {
+  let host;
+  try {
+    host = new URL(pageUrl).hostname.toLowerCase();
+  } catch {
+    return { covered: false, host: null, pattern: null };
+  }
+  if (!hosts.length || hostMatchesAny(host, hosts)) return { covered: true, host, pattern: null };
+  const shared = hosts
+    .map((pattern) => String(pattern).toLowerCase().replace(/^\*\./, ""))
+    .some((bare) => siteOf(bare) === siteOf(host));
+  return { covered: false, host, pattern: shared ? `*.${siteOf(host)}` : null };
+}
+
 // ------------------------------------------------------------ navigation
 
 export const NAV_SCOPE_SELECTOR =
@@ -50,7 +107,45 @@ export const NAV_SCOPE_SELECTOR =
 export const NAV_ITEM_SELECTOR =
   "a[href], button, [role=menuitem], [role=tab], [role=link]";
 
-/** `--goto` accepts a path on the page's own origin and nothing else. */
+/**
+ * Where `--goto` may go: a path on the page's own origin, or a full https
+ * address on a host this project names. Nowhere else - the window carries the
+ * human's session. The path is screened either way.
+ */
+export function gotoDestination(input, pageUrl, hosts = []) {
+  const raw = String(input ?? "").trim();
+  if (!/^https?:\/\//i.test(raw)) return { ...sameOriginPath(raw, pageUrl), host: null };
+  let target;
+  try {
+    target = new URL(raw);
+  } catch {
+    throw new Error(`--goto: "${raw}" is not an address.`);
+  }
+  if (target.protocol !== "https:" && new URL(pageUrl).protocol === "https:") {
+    throw new Error("--goto must use https.");
+  }
+  if (target.username || target.password) throw new Error("--goto takes no credentials in the address.");
+  const page = new URL(pageUrl);
+  const sameOrigin = target.origin === page.origin;
+  if (!sameOrigin && !hostMatchesAny(target.hostname, hosts)) {
+    const coverage = pageCoverage(target.href, hosts);
+    throw new Error(
+      `--goto: ${target.hostname} is not one of this project's hosts (${hosts.join(", ") || "none named"}). ` +
+        (coverage.pattern
+          ? `If it is part of the product, add "${coverage.pattern}" to "hosts" in foldspace.dev.json - with the human's yes - then run inject and attach again.`
+          : "observe only opens screens of the product this project is for."),
+    );
+  }
+  const refused = pathRefusal(target.pathname);
+  if (refused) throw new Error(`--goto: ${refused}`);
+  return {
+    url: target.href,
+    path: target.pathname + target.search + target.hash,
+    host: sameOrigin ? null : target.hostname,
+  };
+}
+
+/** `--goto` with a path: the page's own origin and nothing else. */
 export function sameOriginPath(input, pageUrl) {
   const raw = String(input ?? "").trim();
   if (!raw.startsWith("/") || raw.startsWith("//") || raw.includes("\\")) {

package/src/runtime/render.ts

@@ -14,7 +14,14 @@ import type { ApiFailure } from "./http";
 export type ViewHost = HTMLElement | { container: HTMLElement };
 
 function containerOf(host: ViewHost): HTMLElement {
-  return host instanceof HTMLElement ? host : host.container;
+  // Not `instanceof HTMLElement`: the host Foldspace passes belongs to the
+  // agent panel's frame, and an element from another frame is not an instance
+  // of THIS frame's HTMLElement. The check was false for every real host, so
+  // `host.container` (undefined) was used and every failure card crashed
+  // instead of drawing (seen on a live build, 2026-09-24).
+  const wrapped = (host as { container?: HTMLElement }).container;
+  if (wrapped && typeof wrapped.appendChild === "function") return wrapped;
+  return host as HTMLElement;
 }
 
 function el(tag: string, className: string, text?: string): HTMLElement {

package/templates/agent-starter/claude-settings.json

@@ -0,0 +1,21 @@
+{
+  "$comment": "Written by foldspace init. The commands a build runs, allowed up front so the coding agent is not stopped one denial at a time mid-build. Named one by one on purpose: init, upgrade and deploy are not here and still ask. Everything else still asks.",
+  "permissions": {
+    "allow": [
+      "Bash(npx foldspace help:*)",
+      "Bash(npx foldspace build:*)",
+      "Bash(npx foldspace lint:*)",
+      "Bash(npx foldspace inject:*)",
+      "Bash(npx foldspace attach:*)",
+      "Bash(npx foldspace observe:*)",
+      "Bash(npx foldspace ask:*)",
+      "Bash(npx foldspace badge:*)",
+      "Bash(npm install:*)",
+      "Bash(npm run build:*)",
+      "Bash(npm run typecheck:*)",
+      "Bash(npm run lint:*)",
+      "Bash(npm run inject:*)",
+      "Bash(npm run attach:*)"
+    ]
+  }
+}

package/templates/agent-starter/docs/app-profile.md

@@ -101,6 +101,16 @@ across.
 
 Listed so the next person knows they exist **and knows they are unverified**.
 
+## Workarounds
+
+Anything built here because Foldspace - the SDK, the harness, the panel - did
+not do it, or did not seem to. One row each, and the same note as a comment in
+the code. "Assumed" means you did not find support for it; it may exist.
+
+| What it does | What it works around | Where in the code | Verified or assumed | Goes when |
+|---|---|---|---|---|
+| | | | | |
+
 ## Failures observed
 
 | Call | Result | What it means |