@hachej/boring-workspace 0.1.12 → 0.1.13

package/dist/{WorkspaceLoadingState-CPQBxYFG.js → WorkspaceLoadingState-BjZGQLS_.js}

@@ -1,10 +1,10 @@
-import { jsxs as d, jsx as o, Fragment as H } from "react/jsx-runtime";
-import { useCallback as b, useMemo as A, useEffect as S, useState as V, Suspense as X, useRef as q } from "react";
+import { jsxs as d, jsx as a, Fragment as H } from "react/jsx-runtime";
+import { useCallback as p, useMemo as D, useEffect as S, useState as V, Suspense as U, useRef as q } from "react";
 import { LoadingState as Z, ResizeHandle as G, IconButton as $, Button as J, Kbd as Q } from "@hachej/boring-ui-kit";
 import { c as g } from "./utils-B6yFEsav.js";
-import { $ as Y, a6 as ee, E as te, am as ne, ak as re, u as oe } from "./CommandPalette-Dme9em28.js";
-import { Search as ae, Plus as ie } from "lucide-react";
-function be(e, t, r = !0) {
+import { $ as Y, a6 as ee, E as te, am as ne, ak as re, u as ae } from "./CommandPalette-Dme9em28.js";
+import { Search as oe, Plus as ie } from "lucide-react";
+function pe(e, t, r = !0) {
   if (!r || typeof window > "u") return t;
   try {
     const n = window.localStorage.getItem(e);
@@ -49,8 +49,8 @@ function ve(e = {}) {
     surfaceParams: l,
     sidebar: s,
     sidebarParams: w
-  } = e, p = [];
-  return t && p.push({
+  } = e, b = [];
+  return t && b.push({
     id: "nav",
     position: "left",
     panel: t,
@@ -58,13 +58,13 @@ function ve(e = {}) {
     locked: !0,
     hideHeader: !0,
     constraints: { minWidth: 60, maxWidth: 60 }
-  }), p.push({
+  }), b.push({
     id: "center",
     position: "center",
     panel: n,
     params: i,
     hideHeader: !0
-  }), s && p.push({
+  }), s && b.push({
     id: "sidebar",
     position: "left",
     panel: s,
@@ -73,7 +73,7 @@ function ve(e = {}) {
     collapsible: !0,
     collapsedWidth: 40,
     constraints: { minWidth: 200, maxWidthViewportRatio: 0.5 }
-  }), c && p.push({
+  }), c && b.push({
     id: "surface",
     position: "right",
     panel: c,
@@ -81,45 +81,45 @@ function ve(e = {}) {
     hideHeader: !0,
     dynamic: !0,
     placeholder: "empty"
-  }), { version: "2.0", groups: p };
+  }), { version: "2.0", groups: b };
 }
 function xe(e) {
-  const t = e.nav !== null, r = e.surface !== void 0, n = !!e.surface, i = e.nav || "session-list", c = e.center ?? "chat", l = e.surface || "artifact-surface", s = ce(), [w, p] = j(
+  const t = e.nav !== null, r = e.surface !== void 0, n = !!e.surface, i = e.nav || "session-list", c = e.center ?? "chat", l = e.surface || "artifact-surface", s = ce(), [w, b] = E(
     e.storageKey ? `${e.storageKey}:drawerWidth` : void 0,
     260
-  ), [T, U] = j(
+  ), [T, X] = E(
     e.storageKey ? `${e.storageKey}:surfaceWidth` : void 0,
     680
-  ), f = Y(), W = C(w, 200, 360), M = Math.max(480, Math.floor(s * 0.72)), P = C(T, 480, M), z = N(e.centerParams, "getSurface"), I = N(e.centerParams, "isWorkbenchOpen"), O = N(e.centerParams, "openWorkbench"), u = R(e.navParams, "onClose"), h = R(e.surfaceParams, "onClose"), B = R(e.navParams, "onCreate"), v = t ? !!u : !!e.onOpenNav, x = n ? !!h : !!e.onOpenSurface, y = b(() => {
-    var a;
+  ), f = Y(), W = C(w, 200, 360), M = Math.max(480, Math.floor(s * 0.72)), P = C(T, 480, M), z = N(e.centerParams, "getSurface"), I = N(e.centerParams, "isWorkbenchOpen"), O = N(e.centerParams, "openWorkbench"), u = R(e.navParams, "onClose"), h = R(e.surfaceParams, "onClose"), B = R(e.navParams, "onCreate"), v = t ? !!u : !!e.onOpenNav, x = n ? !!h : !!e.onOpenSurface, y = p(() => {
+    var o;
     if (t) {
       u == null || u();
       return;
     }
-    (a = e.onOpenNav) == null || a.call(e);
-  }, [u, t, e.onOpenNav]), k = b(() => {
-    var a;
+    (o = e.onOpenNav) == null || o.call(e);
+  }, [u, t, e.onOpenNav]), k = p(() => {
+    var o;
     if (n) {
       h == null || h();
       return;
     }
-    (a = e.onOpenSurface) == null || a.call(e);
-  }, [h, e.onOpenSurface, n]), _ = b(() => {
-    t && (u == null || u()), n && (h == null || h()), D(), de();
+    (o = e.onOpenSurface) == null || o.call(e);
+  }, [h, e.onOpenSurface, n]), _ = p(() => {
+    t && (u == null || u()), n && (h == null || h()), A(), de();
   }, [u, h, t, n]);
   return ee({
-    shortcuts: A(() => {
-      const a = [];
-      return v && a.push({ key: "1", mod: !0, handler: y }), x && a.push({ key: "2", mod: !0, handler: k }), c === "chat" && a.push({ key: "Escape", allowInEditable: !0, handler: _ }), a;
+    shortcuts: D(() => {
+      const o = [];
+      return v && o.push({ key: "1", mod: !0, handler: y }), x && o.push({ key: "2", mod: !0, handler: k }), c === "chat" && o.push({ key: "Escape", allowInEditable: !0, handler: _ }), o;
     }, [v, x, c, _, y, k])
   }), S(() => {
-    const a = "workspace:chat-layout", m = "agent:chat-layout";
-    return f.unregisterByPluginId(a), f.unregisterByPluginId(m), f.registerCommand({
+    const o = "workspace:chat-layout", m = "agent:chat-layout";
+    return f.unregisterByPluginId(o), f.unregisterByPluginId(m), f.registerCommand({
       id: "workspace:open-session-history",
       title: t ? "Close Session History" : "Open Session History",
       keywords: ["sessions", "history", "drawer", t ? "close" : "open"],
       shortcut: "⌘1",
-      pluginId: a,
+      pluginId: o,
       when: () => v,
       run: y
     }), f.registerCommand({
@@ -127,7 +127,7 @@ function xe(e) {
       title: n ? "Close Workbench" : "Open Workbench",
       keywords: ["surface", "artifacts", "sources", "workbench", n ? "close" : "open"],
       shortcut: "⌘2",
-      pluginId: a,
+      pluginId: o,
       when: () => x,
       run: k
     }), c === "chat" && f.registerCommand({
@@ -143,7 +143,7 @@ function xe(e) {
       pluginId: m,
       run: B
     }), () => {
-      f.unregisterByPluginId(a), f.unregisterByPluginId(m);
+      f.unregisterByPluginId(o), f.unregisterByPluginId(m);
     };
   }, [
     f,
@@ -165,13 +165,13 @@ function xe(e) {
     k
   ]), S(() => {
     if (!z || !I || !O) return;
-    const a = {
+    const o = {
       surface: z,
       isWorkbenchOpen: I,
       openWorkbench: O
     };
     return te.on(ne.uiCommand, ({ command: m }) => {
-      re(m, a);
+      re(m, o);
     });
   }, [z, I, O]), /* @__PURE__ */ d(
     "div",
@@ -199,7 +199,7 @@ function xe(e) {
               willChange: "width"
             },
             children: [
-              /* @__PURE__ */ o(
+              /* @__PURE__ */ a(
                 "div",
                 {
                   className: g(
@@ -207,15 +207,15 @@ function xe(e) {
                     "transition-opacity duration-[200ms] ease-[cubic-bezier(0.22,1,0.36,1)]",
                     t ? "opacity-100" : "opacity-0"
                   ),
-                  children: /* @__PURE__ */ o(L, { id: i, params: e.navParams })
+                  children: /* @__PURE__ */ a(L, { id: i, params: e.navParams })
                 }
               ),
-              t ? /* @__PURE__ */ o(
-                E,
+              t ? /* @__PURE__ */ a(
+                K,
                 {
                   side: "drawer-right",
                   ariaLabel: "Resize sessions drawer",
-                  onResize: (a) => p((m) => C(m + a, 200, 360))
+                  onResize: (o) => b((m) => C(m + o, 200, 360))
                 }
               ) : null
             ]
@@ -228,9 +228,9 @@ function xe(e) {
             "aria-label": "Chat stage",
             className: "relative h-full min-h-0 min-w-0 flex-1 overflow-hidden bg-background",
             children: [
-              /* @__PURE__ */ o(L, { id: c, params: e.centerParams }),
-              !t && e.onOpenNav ? /* @__PURE__ */ o(
-                K,
+              /* @__PURE__ */ a(L, { id: c, params: e.centerParams }),
+              !t && e.onOpenNav ? /* @__PURE__ */ a(
+                j,
                 {
                   side: "left",
                   icon: "sessions",
@@ -239,8 +239,8 @@ function xe(e) {
                   hint: "⌘1"
                 }
               ) : null,
-              !n && e.onOpenSurface ? /* @__PURE__ */ o(
-                K,
+              !n && e.onOpenSurface ? /* @__PURE__ */ a(
+                j,
                 {
                   side: "right",
                   icon: "workbench",
@@ -271,7 +271,7 @@ function xe(e) {
               willChange: "width"
             },
             children: [
-              /* @__PURE__ */ o(
+              /* @__PURE__ */ a(
                 "div",
                 {
                   className: g(
@@ -279,15 +279,15 @@ function xe(e) {
                     "transition-opacity duration-[200ms] ease-[cubic-bezier(0.22,1,0.36,1)]",
                     n ? "opacity-100" : "opacity-0"
                   ),
-                  children: /* @__PURE__ */ o(L, { id: l, params: e.surfaceParams })
+                  children: /* @__PURE__ */ a(L, { id: l, params: e.surfaceParams })
                 }
               ),
-              n ? /* @__PURE__ */ o(
-                E,
+              n ? /* @__PURE__ */ a(
+                K,
                 {
                   side: "surface-left",
                   ariaLabel: "Resize workbench",
-                  onResize: (a) => U((m) => C(m - a, 480, M))
+                  onResize: (o) => X((m) => C(m - o, 480, M))
                 }
               ) : null
             ]
@@ -300,14 +300,14 @@ function xe(e) {
 function C(e, t, r) {
   return Math.max(t, Math.min(r, e));
 }
-function j(e, t) {
+function E(e, t) {
   const [r, n] = V(
     () => e ? F(e, t) : t
   );
   S(() => {
     n(e ? F(e, t) : t);
   }, [e, t]);
-  const i = b(
+  const i = p(
     (c) => {
       n((l) => {
         const s = typeof c == "function" ? c(l) : c;
@@ -325,17 +325,17 @@ function ce() {
     return window.addEventListener("resize", r), () => window.removeEventListener("resize", r);
   }, []), e;
 }
-function E({ side: e, ariaLabel: t, onResize: r }) {
-  const n = q(null), i = b((s) => {
+function K({ side: e, ariaLabel: t, onResize: r }) {
+  const n = q(null), i = p((s) => {
     s.preventDefault(), n.current = s.clientX, s.currentTarget.setPointerCapture(s.pointerId), document.body.style.cursor = "col-resize", document.body.style.userSelect = "none";
-  }, []), c = b((s) => {
+  }, []), c = p((s) => {
     if (n.current === null) return;
     const w = s.clientX - n.current;
     n.current = s.clientX, r(w);
-  }, [r]), l = b((s) => {
+  }, [r]), l = p((s) => {
     n.current !== null && (n.current = null, s.currentTarget.releasePointerCapture(s.pointerId), document.body.style.cursor = "", document.body.style.userSelect = "");
   }, []);
-  return /* @__PURE__ */ o(
+  return /* @__PURE__ */ a(
     G,
     {
       "aria-label": t,
@@ -361,7 +361,7 @@ function N(e, t) {
 function R(e, t) {
   return N(e, t);
 }
-function D() {
+function A() {
   if (typeof document > "u") return;
   const e = document.querySelector(
     '[data-boring-agent] textarea[name="message"], textarea[name="message"]'
@@ -370,12 +370,12 @@ function D() {
 }
 function de() {
   typeof window > "u" || window.requestAnimationFrame(() => {
-    D(), window.setTimeout(D, 320);
+    A(), window.setTimeout(A, 320);
   });
 }
 function L({ id: e, params: t }) {
-  const r = oe(), i = A(() => r.getComponents(), [r])[e], c = A(() => le(e), [e]);
-  return i ? /* @__PURE__ */ o(X, { fallback: /* @__PURE__ */ o(Z, { centered: !0 }), children: /* @__PURE__ */ o(
+  const r = ae(), i = D(() => r.getComponents(), [r])[e], c = D(() => le(e), [e]);
+  return i ? /* @__PURE__ */ a(U, { fallback: /* @__PURE__ */ a(Z, { centered: !0 }), children: /* @__PURE__ */ a(
     i,
     {
       params: t,
@@ -420,14 +420,14 @@ function le(e) {
     } })
   };
 }
-function K({
+function j({
   side: e,
   icon: t,
   onClick: r,
   label: n,
   hint: i
 }) {
-  return /* @__PURE__ */ o(
+  return /* @__PURE__ */ a(
     $,
     {
       type: "button",
@@ -444,9 +444,9 @@ function K({
         "focus-visible:ring-ring/40"
       ),
       children: t === "sessions" ? /* @__PURE__ */ d("svg", { width: "15", height: "15", viewBox: "0 0 24 24", fill: "none", "aria-hidden": "true", children: [
-        /* @__PURE__ */ o("circle", { cx: "12", cy: "12", r: "9", stroke: "currentColor", strokeWidth: "1.8" }),
-        /* @__PURE__ */ o("path", { d: "M12 7v5l3.2 2", stroke: "currentColor", strokeWidth: "1.8", strokeLinecap: "round" })
-      ] }) : /* @__PURE__ */ o("svg", { width: "15", height: "15", viewBox: "0 0 24 24", fill: "none", "aria-hidden": "true", children: /* @__PURE__ */ o("path", { d: "M3 7.5 A1.5 1.5 0 0 1 4.5 6 h4 l2 2 h9 A1.5 1.5 0 0 1 21 9.5 V17.5 A1.5 1.5 0 0 1 19.5 19 H4.5 A1.5 1.5 0 0 1 3 17.5 Z", stroke: "currentColor", strokeWidth: "1.8", strokeLinejoin: "round" }) })
+        /* @__PURE__ */ a("circle", { cx: "12", cy: "12", r: "9", stroke: "currentColor", strokeWidth: "1.8" }),
+        /* @__PURE__ */ a("path", { d: "M12 7v5l3.2 2", stroke: "currentColor", strokeWidth: "1.8", strokeLinecap: "round" })
+      ] }) : /* @__PURE__ */ a("svg", { width: "15", height: "15", viewBox: "0 0 24 24", fill: "none", "aria-hidden": "true", children: /* @__PURE__ */ a("path", { d: "M3 7.5 A1.5 1.5 0 0 1 4.5 6 h4 l2 2 h9 A1.5 1.5 0 0 1 21 9.5 V17.5 A1.5 1.5 0 0 1 19.5 19 H4.5 A1.5 1.5 0 0 1 3 17.5 Z", stroke: "currentColor", strokeWidth: "1.8", strokeLinejoin: "round" }) })
     }
   );
 }
@@ -465,26 +465,26 @@ function ye({
     {
       "data-boring-workspace-part": "topbar",
       className: g(
-        "relative flex items-center justify-between gap-3 px-4",
+        "relative flex items-center justify-between gap-2 px-3",
         "bg-background border-b border-[color:oklch(from_var(--border)_l_c_h/0.4)]",
         l
       ),
-      style: { height: 52 },
+      style: { height: 40 },
       "aria-label": "App top bar",
       children: [
-        /* @__PURE__ */ o("div", { className: "flex min-w-0 flex-1 items-center gap-2.5", children: i ?? /* @__PURE__ */ d(H, { children: [
-          /* @__PURE__ */ o(
-            "div",
+        /* @__PURE__ */ a("div", { className: "flex min-w-0 flex-1 items-center gap-2.5", children: i ?? /* @__PURE__ */ d(H, { children: [
+          /* @__PURE__ */ a(
+            "img",
             {
-              "aria-hidden": "true",
-              className: "flex h-7 w-7 shrink-0 items-center justify-center rounded-md bg-foreground text-[12px] font-semibold text-background",
-              children: e.charAt(0).toUpperCase()
+              src: "https://chatgpt.com/backend-api/estuary/content?id=file_000000006a4471f4b8411fcbfde271c6&ts=493962&p=fs&cid=1&sig=b406cfec61d387bdedd898858283b389f31ad2bd3eb7a358a6d1efa23e9afa83&v=0",
+              alt: e,
+              className: "h-6 w-6 shrink-0 rounded-md"
             }
           ),
-          /* @__PURE__ */ o("span", { className: "truncate text-[13px] font-medium tracking-tight text-foreground", children: e }),
+          /* @__PURE__ */ a("span", { className: "truncate text-[12px] font-medium tracking-tight text-foreground", children: e }),
           t && /* @__PURE__ */ d(H, { children: [
-            /* @__PURE__ */ o("span", { "aria-hidden": "true", className: "text-muted-foreground/30", children: "/" }),
-            /* @__PURE__ */ o("span", { className: "truncate text-[13px] font-normal text-muted-foreground", children: t })
+            /* @__PURE__ */ a("span", { "aria-hidden": "true", className: "text-muted-foreground/30", children: "/" }),
+            /* @__PURE__ */ a("span", { className: "truncate text-[12px] font-normal text-muted-foreground", children: t })
           ] })
         ] }) }),
         /* @__PURE__ */ d(
@@ -494,18 +494,18 @@ function ye({
             variant: "ghost",
             size: "sm",
             onClick: r,
-            className: "group h-7 gap-1.5 px-1.5 text-[12.5px] text-muted-foreground/60 hover:bg-transparent hover:text-foreground focus-visible:text-foreground",
+            className: "group h-6 gap-1 px-1.5 text-[12px] text-muted-foreground/60 hover:bg-transparent hover:text-foreground focus-visible:text-foreground",
             "aria-label": "Search catalogs and commands",
             title: "Command palette (⌘K)",
             children: [
-              /* @__PURE__ */ o(ae, { className: "h-3.5 w-3.5 shrink-0 opacity-70", strokeWidth: 1.75 }),
-              /* @__PURE__ */ o("span", { className: "font-normal tracking-tight", children: "Search" }),
-              /* @__PURE__ */ o(Q, { className: "ml-1 border-0 bg-transparent p-0 text-[10px] shadow-none group-hover:text-muted-foreground", children: "⌘K" })
+              /* @__PURE__ */ a(oe, { className: "h-3 w-3 shrink-0 opacity-70", strokeWidth: 1.75 }),
+              /* @__PURE__ */ a("span", { className: "font-normal tracking-tight", children: "Search" }),
+              /* @__PURE__ */ a(Q, { className: "ml-1 border-0 bg-transparent p-0 text-[10px] shadow-none group-hover:text-muted-foreground", children: "⌘K" })
             ]
           }
         ),
         /* @__PURE__ */ d("div", { className: "flex flex-1 shrink-0 items-center justify-end gap-1", children: [
-          n && /* @__PURE__ */ o(
+          n && /* @__PURE__ */ a(
             $,
             {
               type: "button",
@@ -514,7 +514,7 @@ function ye({
               onClick: n,
               "aria-label": "New chat",
               title: "New chat",
-              children: /* @__PURE__ */ o(ie, { className: "h-4 w-4" })
+              children: /* @__PURE__ */ a(ie, { className: "h-4 w-4" })
             }
           ),
           s
@@ -530,7 +530,7 @@ function ke({
   fullscreen: n = !0,
   className: i
 }) {
-  return /* @__PURE__ */ o(
+  return /* @__PURE__ */ a(
     "section",
     {
       role: "status",
@@ -542,7 +542,7 @@ function ke({
         i
       ),
       children: /* @__PURE__ */ d("div", { className: "flex w-full max-w-sm flex-col items-center gap-5 text-center", children: [
-        /* @__PURE__ */ o("div", { className: "flex h-11 w-11 items-center justify-center rounded-lg border border-border bg-card text-foreground", children: /* @__PURE__ */ o(
+        /* @__PURE__ */ a("div", { className: "flex h-11 w-11 items-center justify-center rounded-lg border border-border bg-card text-foreground", children: /* @__PURE__ */ a(
           "span",
           {
             "aria-hidden": "true",
@@ -550,10 +550,10 @@ function ke({
           }
         ) }),
         /* @__PURE__ */ d("div", { className: "space-y-2", children: [
-          /* @__PURE__ */ o("h2", { className: "text-base font-medium text-foreground", children: e }),
-          t ? /* @__PURE__ */ o("p", { className: "text-sm leading-6 text-muted-foreground", children: t }) : null
+          /* @__PURE__ */ a("h2", { className: "text-base font-medium text-foreground", children: e }),
+          t ? /* @__PURE__ */ a("p", { className: "text-sm leading-6 text-muted-foreground", children: t }) : null
         ] }),
-        r ? /* @__PURE__ */ o("p", { className: "text-xs font-medium text-muted-foreground/80", children: r }) : null
+        r ? /* @__PURE__ */ a("p", { className: "text-xs font-medium text-muted-foreground/80", children: r }) : null
       ] })
     }
   );
@@ -563,6 +563,6 @@ export {
   ye as T,
   ke as W,
   ve as b,
-  be as r,
+  pe as r,
   we as w
 };

package/dist/app-front.js

@@ -2,7 +2,7 @@ import { jsx as d, jsxs as Te, Fragment as x } from "react/jsx-runtime";
 import { useSyncExternalStore as ze, useMemo as v, useRef as K, useState as X, useEffect as y, useCallback as P } from "react";
 import { ChatPanel as Fe, useSessions as Ge } from "@hachej/boring-agent/front";
 import { aj as ke, q as Ye, ak as Qe, u as Xe, al as Ze } from "./CommandPalette-Dme9em28.js";
-import { T as He, C as qe, r as Ee, w as et, W as $e } from "./WorkspaceLoadingState-CPQBxYFG.js";
+import { T as He, C as qe, r as Ee, w as et, W as $e } from "./WorkspaceLoadingState-BjZGQLS_.js";
 function tt() {
   const e = `s${Date.now()}`;
   return {

package/dist/app-server.d.ts

@@ -28,9 +28,9 @@ interface CreateWorkspaceAgentServerOptions extends WorkspaceAgentCreateOptions,
     };
     /**
      * Whether exec_ui should stat-check file paths against the workspaceRoot
-     * before queueing the command. Defaults to true in direct/local mode and
-     * false in vercel-sandbox (where workspace files live inside the microVM,
-     * not on the host server running this Fastify process).
+     * before queueing the command. Defaults to true only for local host-backed
+     * modes (direct/local). Remote sandbox modes should leave this false because
+     * workspace files may not exist on the host server running Fastify.
      */
     validateUiPaths?: boolean;
 }

package/dist/app-server.js

@@ -1,7 +1,9 @@
 // src/app/server/createWorkspaceAgentServer.ts
 import {
+  autoDetectMode,
   createAgentApp,
-  provisionRuntimeWorkspace
+  provisionRuntimeWorkspace,
+  resolveMode
 } from "@hachej/boring-agent/server";
 import { join } from "path";
 
@@ -49,7 +51,7 @@ function createInMemoryBridge() {
 
 // src/server/ui-control/tools/uiTools.ts
 import { access } from "fs/promises";
-import { resolve, isAbsolute, relative } from "path";
+import { resolve, isAbsolute, relative, win32 } from "path";
 function makeError(message) {
   return {
     content: [{ type: "text", text: message }],
@@ -61,9 +63,15 @@ function getPathParam(kind, params) {
   const raw = kind === "navigateToLine" ? params.file : params.path;
   return typeof raw === "string" && raw.length > 0 ? raw : void 0;
 }
+function isPathAbsolute(filePath) {
+  return isAbsolute(filePath) || win32.isAbsolute(filePath);
+}
+function isOutsideWorkspaceRel(rel) {
+  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isPathAbsolute(rel);
+}
 function validatePathSyntax(relPath, workspaceRoot) {
   const rootHint = workspaceRoot ? ` (${workspaceRoot})` : "";
-  if (isAbsolute(relPath)) {
+  if (isPathAbsolute(relPath)) {
     return {
       ok: false,
       reason: `path "${relPath}" is absolute \u2014 pass a path relative to the workspace root${rootHint}.`
@@ -85,7 +93,7 @@ async function validatePath(workspaceRoot, relPath) {
   if (!syntax.ok) return syntax;
   const resolved = resolve(workspaceRoot, relPath);
   const rel = relative(workspaceRoot, resolved);
-  if (rel.startsWith("..") || isAbsolute(rel)) {
+  if (isOutsideWorkspaceRel(rel)) {
     return {
       ok: false,
       reason: `path "${relPath}" escapes the workspace root (${workspaceRoot}).`
@@ -188,13 +196,14 @@ function createExecUiTool(uiBridge, opts = {}) {
       "                 auto-opens if collapsed. Path must be relative to the",
       "                 workspace root (e.g. `src/foo.ts`, not `foo.ts` if it",
       "                 lives under src/).",
-      "                 Recovery on file-not-found: this tool stat-checks the",
-      "                 path server-side and returns an error if it doesn't",
-      "                 exist. On that error, immediately call find (or",
-      "                 grep) to locate the file, then call exec_ui",
-      "                 openFile AGAIN using the EXACT path returned \u2014 don't",
-      "                 give up and don't switch to the read tool. Repeat",
-      "                 until openFile succeeds or no candidate is found.",
+      "                 Recovery on file-not-found: when the server has local",
+      "                 filesystem access, this tool stat-checks the path and",
+      "                 returns an error if it doesn't exist. On that error,",
+      "                 immediately call find (or grep) to locate the file,",
+      "                 then call exec_ui openFile AGAIN using the EXACT path",
+      "                 returned \u2014 don't give up and don't switch to the read",
+      "                 tool. Repeat until openFile succeeds or no candidate",
+      "                 is found.",
       "                 Example: {kind:'openFile', params:{path:'README.md'}}",
       "",
       "  openPanel    params: { id: string, component: string,",
@@ -747,7 +756,9 @@ async function provisionWorkspaceAgentServer(opts) {
 async function createWorkspaceAgentServer(opts = {}) {
   const workspaceRoot = opts.workspaceRoot ?? process.cwd();
   const bridge = createInMemoryBridge();
-  const validateUiPaths = opts.validateUiPaths ?? opts.mode !== "vercel-sandbox";
+  const resolvedMode = opts.runtimeModeAdapter?.id ?? opts.mode ?? autoDetectMode();
+  const workspaceFsCapability = opts.runtimeModeAdapter ? opts.runtimeModeAdapter.workspaceFsCapability ?? "best-effort" : resolveMode(resolvedMode).workspaceFsCapability ?? "best-effort";
+  const validateUiPaths = opts.validateUiPaths ?? workspaceFsCapability === "strong";
   const uiTools = createWorkspaceUiTools(bridge, {
     workspaceRoot: validateUiPaths ? workspaceRoot : void 0
   });
@@ -761,6 +772,7 @@ async function createWorkspaceAgentServer(opts = {}) {
   }
   const app = await createAgentApp({
     ...opts,
+    mode: resolvedMode,
     workspaceRoot,
     extraTools: [
       ...opts.extraTools ?? [],
@@ -768,7 +780,7 @@ async function createWorkspaceAgentServer(opts = {}) {
       ...pluginCollection.agentOptions.extraTools ?? []
     ],
     systemPromptAppend: [
-      opts.mode !== "vercel-sandbox" ? buildWorkspaceContextPrompt() : void 0,
+      workspaceFsCapability === "strong" ? buildWorkspaceContextPrompt() : void 0,
       pluginCollection.agentOptions.systemPromptAppend
     ].filter(Boolean).join("\n\n") || void 0,
     resourceLoaderOptions: pluginCollection.agentOptions.resourceLoaderOptions

package/dist/server.d.ts

@@ -21,9 +21,9 @@ interface ExecUiToolOptions {
      * tool stat-checks the resolved path before queueing the UI command and
      * returns an error to the agent if the file is missing or escapes the
      * root — so the model gets immediate feedback instead of the frontend
-     * silently no-op'ing on a wrong path. When omitted, paths are passed
-     * through unvalidated (back-compat for callers without server-side
-     * filesystem access).
+     * silently no-op'ing on a wrong path. When omitted (for example, remote
+     * sandbox filesystems the host cannot stat), path syntax is still validated
+     * but existence is left to the frontend/remote filesystem.
      */
     workspaceRoot?: string;
     /**

package/dist/server.js

@@ -162,7 +162,7 @@ data: ${JSON.stringify({ v: UI_BRIDGE_PROTOCOL_VERSION })}
 
 // src/server/ui-control/tools/uiTools.ts
 import { access } from "fs/promises";
-import { resolve, isAbsolute, relative } from "path";
+import { resolve, isAbsolute, relative, win32 } from "path";
 function makeError(message) {
   return {
     content: [{ type: "text", text: message }],
@@ -174,9 +174,15 @@ function getPathParam(kind, params) {
   const raw = kind === "navigateToLine" ? params.file : params.path;
   return typeof raw === "string" && raw.length > 0 ? raw : void 0;
 }
+function isPathAbsolute(filePath) {
+  return isAbsolute(filePath) || win32.isAbsolute(filePath);
+}
+function isOutsideWorkspaceRel(rel) {
+  return rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isPathAbsolute(rel);
+}
 function validatePathSyntax(relPath, workspaceRoot) {
   const rootHint = workspaceRoot ? ` (${workspaceRoot})` : "";
-  if (isAbsolute(relPath)) {
+  if (isPathAbsolute(relPath)) {
     return {
       ok: false,
       reason: `path "${relPath}" is absolute \u2014 pass a path relative to the workspace root${rootHint}.`
@@ -198,7 +204,7 @@ async function validatePath(workspaceRoot, relPath) {
   if (!syntax.ok) return syntax;
   const resolved = resolve(workspaceRoot, relPath);
   const rel = relative(workspaceRoot, resolved);
-  if (rel.startsWith("..") || isAbsolute(rel)) {
+  if (isOutsideWorkspaceRel(rel)) {
     return {
       ok: false,
       reason: `path "${relPath}" escapes the workspace root (${workspaceRoot}).`
@@ -301,13 +307,14 @@ function createExecUiTool(uiBridge, opts = {}) {
       "                 auto-opens if collapsed. Path must be relative to the",
       "                 workspace root (e.g. `src/foo.ts`, not `foo.ts` if it",
       "                 lives under src/).",
-      "                 Recovery on file-not-found: this tool stat-checks the",
-      "                 path server-side and returns an error if it doesn't",
-      "                 exist. On that error, immediately call find (or",
-      "                 grep) to locate the file, then call exec_ui",
-      "                 openFile AGAIN using the EXACT path returned \u2014 don't",
-      "                 give up and don't switch to the read tool. Repeat",
-      "                 until openFile succeeds or no candidate is found.",
+      "                 Recovery on file-not-found: when the server has local",
+      "                 filesystem access, this tool stat-checks the path and",
+      "                 returns an error if it doesn't exist. On that error,",
+      "                 immediately call find (or grep) to locate the file,",
+      "                 then call exec_ui openFile AGAIN using the EXACT path",
+      "                 returned \u2014 don't give up and don't switch to the read",
+      "                 tool. Repeat until openFile succeeds or no candidate",
+      "                 is found.",
       "                 Example: {kind:'openFile', params:{path:'README.md'}}",
       "",
       "  openPanel    params: { id: string, component: string,",

package/dist/workspace.css

@@ -1868,9 +1868,6 @@
   .w-6 {
     width: calc(var(--spacing) * 6);
   }
-  .w-7 {
-    width: calc(var(--spacing) * 7);
-  }
   .w-9 {
     width: calc(var(--spacing) * 9);
   }

package/dist/workspace.js

@@ -10,7 +10,7 @@ import { EmptyState as Ie, Toolbar as ot, Popover as me, PopoverTrigger as ge, P
 import { Toaster as Ma, dismissToast as Da, toast as Ra } from "@hachej/boring-ui-kit";
 import { c as H } from "./utils-B6yFEsav.js";
 import { d as Re } from "./panel-DnvDNQac.js";
-import { C as Fa, T as La, W as za, b as qa } from "./WorkspaceLoadingState-CPQBxYFG.js";
+import { C as Fa, T as La, W as za, b as qa } from "./WorkspaceLoadingState-BjZGQLS_.js";
 import { C as Ba, c as Aa } from "./CodeEditor-DQqOn4xz.js";
 import { FileTree as Ka } from "./FileTree-BVfqs3rR.js";
 import { MarkdownEditor as ja } from "./MarkdownEditor-CcCDF65H.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-workspace",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "type": "module",
   "license": "MIT",
   "description": "Workspace UI, plugin, and bridge package for composing chat, files, catalogs, editors, and app-specific panes.",
@@ -125,8 +125,8 @@
     "tailwind-merge": "^2.0.0",
     "zod": "^3.23.0",
     "zustand": "^5.0.0",
-    "@hachej/boring-agent": "0.1.12",
-    "@hachej/boring-ui-kit": "0.1.12"
+    "@hachej/boring-agent": "0.1.13",
+    "@hachej/boring-ui-kit": "0.1.13"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.0.0",