@hachej/boring-agent 0.1.92 → 0.1.93

package/dist/{chunk-IWBC6SF7.js → chunk-2TMS2RU2.js}

@@ -340,6 +340,7 @@ var SAFE_SESSION_NAMESPACE = /^[a-zA-Z0-9_-]+$/;
 var SESSION_ROOT_ENV = "BORING_AGENT_SESSION_ROOT";
 var SUMMARY_PREFIX_BYTES = 64 * 1024;
 var DEFAULT_LEGACY_WORKSPACE_ID = "default";
+var TRUSTED_LOCAL_USER_ID = "local";
 function sessionDirForNamespace(namespace, explicitRoot) {
   const safeNamespace = namespace.trim();
   if (!SAFE_SESSION_NAMESPACE.test(safeNamespace)) {
@@ -358,6 +359,7 @@ var PiSessionStore = class {
   cwd;
   sessionDir;
   allowLegacyUnscopedAccess;
+  pathDerivedLegacyAccess;
   prefixCache = /* @__PURE__ */ new Map();
   listInFlight = /* @__PURE__ */ new Map();
   writerTails = /* @__PURE__ */ new Map();
@@ -366,9 +368,11 @@ var PiSessionStore = class {
     if (typeof options === "string") {
       this.sessionDir = options;
       this.allowLegacyUnscopedAccess = true;
+      this.pathDerivedLegacyAccess = false;
       return;
     }
     this.allowLegacyUnscopedAccess = true;
+    this.pathDerivedLegacyAccess = options?.sessionDir === void 0 && options?.sessionNamespace === void 0;
     this.sessionDir = options?.sessionDir ?? (options?.sessionNamespace ? sessionDirForNamespace(options.sessionNamespace, options.sessionRoot) : defaultSessionDir(options?.storageCwd ?? cwd, options?.sessionRoot));
   }
   getSessionDir() {
@@ -713,6 +717,7 @@ var PiSessionStore = class {
       }
       throw new Error(`Session not found: ${sessionId}`);
     }
+    if (ctx) await this.assertFileBelongsToCtx(matchedPath, ctx, sessionId);
     return this.ensureWrapperForNativeSession(sessionId, matchedPath, ctx);
   }
   async assertFileBelongsToCtx(filepath, ctx, sessionId) {
@@ -975,8 +980,16 @@ var PiSessionStore = class {
     return header ? this.storedCtxBelongsToCtx(readHeaderSessionCtx(header), ctx) : isEmptySessionCtx(ctx);
   }
   storedCtxBelongsToCtx(storedCtx, ctx) {
-    if (storedCtx === null) return this.allowLegacyUnscopedAccess && isLegacyUnscopedCtx(ctx);
-    return sameSessionCtx(storedCtx, ctx);
+    const trustedLocalCtx = !ctx.userId || ctx.userId === TRUSTED_LOCAL_USER_ID;
+    if (storedCtx === null) {
+      return this.allowLegacyUnscopedAccess && (isLegacyUnscopedCtx(ctx) || this.pathDerivedLegacyAccess && trustedLocalCtx);
+    }
+    if (sameSessionCtx(storedCtx, ctx)) return true;
+    if (!this.pathDerivedLegacyAccess || !trustedLocalCtx) return false;
+    if (isEmptySessionCtx(storedCtx)) return true;
+    return Boolean(
+      storedCtx.workspaceId && storedCtx.workspaceId === ctx.workspaceId && (!storedCtx.userId || !ctx.userId && storedCtx.userId === TRUSTED_LOCAL_USER_ID)
+    );
   }
 };
 async function readJsonlPrefix(filepath, maxBytes = SUMMARY_PREFIX_BYTES) {

package/dist/{chunk-V3ZD3T3G.js → chunk-4TKUT7IL.js}

@@ -6,7 +6,7 @@ import {
   readConfiguredDefaultModel,
   registerConfiguredModelProviders,
   withPiHarnessDefaults
-} from "./chunk-IWBC6SF7.js";
+} from "./chunk-2TMS2RU2.js";
 import {
   AgentEffectAdmissionError,
   createAgentRuntimeBridge,
@@ -4801,7 +4801,7 @@ function createAgentRuntimeBridge2(config, options = {}) {
   });
 }
 async function createRuntime(config, options) {
-  const harnessFactory = config.harnessFactory ?? (await import("./createHarness-PMYRKDE4.js")).createPiCodingAgentHarness;
+  const harnessFactory = config.harnessFactory ?? (await import("./createHarness-UCD74XXK.js")).createPiCodingAgentHarness;
   const harnessInput = {
     tools: config.tools ?? [],
     cwd: config.workdir ?? DEFAULT_WORKDIR,
@@ -6957,7 +6957,7 @@ async function buildAgentComposition(input) {
       sessionNamespace: configuredNamespace,
       sessionDir: compatibility?.sessionDir ?? factoryInput.sessionDir
     }) : async (factoryInput) => {
-      const { createPiCodingAgentHarness } = await import("./createHarness-PMYRKDE4.js");
+      const { createPiCodingAgentHarness } = await import("./createHarness-UCD74XXK.js");
       return createPiCodingAgentHarness({
         ...factoryInput,
         pi,

package/dist/{createHarness-PMYRKDE4.js → createHarness-UCD74XXK.js}

@@ -4,7 +4,7 @@ import {
   deriveSourcePlugin,
   mergePiPackageSources,
   withPiHarnessDefaults
-} from "./chunk-IWBC6SF7.js";
+} from "./chunk-2TMS2RU2.js";
 import "./chunk-AQBXNPMD.js";
 import "./chunk-2GBHYJVC.js";
 export {

package/dist/front/index.d.ts

@@ -154,6 +154,7 @@ type SlashCommandHandlerResult = string | void | {
     preserveDraft?: boolean;
 };
 type SlashCommandHandler = (args: string, ctx: SlashCommandContext) => SlashCommandHandlerResult | Promise<SlashCommandHandlerResult>;
+type SlashCommandClickBehavior = 'execute' | 'insert' | 'disabled';
 interface SlashCommand {
     name: string;
     description: string;
@@ -165,6 +166,8 @@ interface SlashCommand {
      * is needed.
      */
     kind?: 'local' | 'skill';
+    /** Explicit opt-in for assistant-message command links. Unset commands remain plain text. */
+    clickBehavior?: SlashCommandClickBehavior;
     /**
      * Origin of the command, surfaced as a tag in the slash-command picker.
      * Mirrors Pi's command sources for server commands; `local` for built-in