npm - @jlongo78/agent-spaces - Versions diffs - 0.9.9 → 0.9.10 - Mend

@jlongo78/agent-spaces 0.9.9 → 0.9.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (289) hide show

package/.next/standalone/.next/server/pages/404.html CHANGED Viewed

	@@ -1 +1 @@
1	- <!DOCTYPE html><!--~~bAQs2gDlFrq3e8w9ni9tr~~--><html lang="en" class="dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/><link rel="stylesheet" href="/_next/static/chunks/14216197f9dcbe5b.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/d2947a224b80c689.js"/><script src="/_next/static/chunks/7e363d6c9f74e9fb.js" async=""></script><script src="/_next/static/chunks/4fa395d360c87cc3.js" async=""></script><script src="/_next/static/chunks/645382108aacab6b.js" async=""></script><script src="/_next/static/chunks/797fcb0710da3be2.js" async=""></script><script src="/_next/static/chunks/turbopack-ac12088c22eb6593.js" async=""></script><script src="/_next/static/chunks/3698497a4057fe15.js" async=""></script><script src="/_next/static/chunks/54e9611ab9745d00.js" async=""></script><script src="/_next/static/chunks/d96012bcfc98706a.js" async=""></script><script src="/_next/static/chunks/73e3194f06db260e.js" async=""></script><meta name="robots" content="noindex"/><meta name="next-size-adjust" content=""/><title>404: This page could not be found.</title><title>Spaces</title><meta name="description" content="Agent workspace manager for Claude, Codex, Gemini, and more"/><link rel="icon" href="/icon.png"/><script src="/_next/static/chunks/a6dad97d9634a72d.js" noModule=""></script></head><body class="geistsans_d5a4f12f-module__Ur3q_a__variable geistmono_157ca88a-module__iaM1Ya__variable antialiased bg-zinc-950 text-zinc-100"><div hidden=""><!--$--><!--/$--></div><div style="font-family:system-ui,"Segoe UI",Roboto,Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";height:100vh;text-align:center;display:flex;flex-direction:column;align-items:center;justify-content:center"><div><style>body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}</style><h1 class="next-error-h1" style="display:inline-block;margin:0 20px 0 0;padding:0 23px 0 0;font-size:24px;font-weight:500;vertical-align:top;line-height:49px">404</h1><div style="display:inline-block"><h2 style="font-size:14px;font-weight:400;line-height:49px;margin:0">This page could not be found.</h2></div></div></div><!--$--><!--/$--><script src="/_next/static/chunks/d2947a224b80c689.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f\|\|[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[112524,[\"/_next/static/chunks/3698497a4057fe15.js\",\"/_next/static/chunks/54e9611ab9745d00.js\"],\"Providers\"]\n3:I[339756,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n4:I[837457,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n5:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"OutletBoundary\"]\n6:\"$Sreact.suspense\"\n8:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"ViewportBoundary\"]\na:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"MetadataBoundary\"]\nc:I[168027,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n:HL[\"/_next/static/chunks/14216197f9dcbe5b.css\",\"style\"]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"~~bAQs2gDlFrq3e8w9ni9tr~~\",\"c\":[\"\",\"_not-found\",\"\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"/_not-found\",{\"children\":[\"__PAGE__\",{}]}]},\"$undefined\",\"$undefined\",true],[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/14216197f9dcbe5b.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/3698497a4057fe15.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/54e9611ab9745d00.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"className\":\"dark\",\"suppressHydrationWarning\":true,\"children\":[\"$\",\"body\",null,{\"className\":\"geistsans_d5a4f12f-module__Ur3q_a__variable geistmono_157ca88a-module__iaM1Ya__variable antialiased bg-zinc-950 text-zinc-100\",\"suppressHydrationWarning\":true,\"children\":[\"$\",\"$L2\",null,{\"children\":[\"$\",\"$L3\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L4\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"padding\":\"0 23px 0 0\",\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\",\"lineHeight\":\"49px\"},\"children\":404}],[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"49px\",\"margin\":0},\"children\":\"This page could not be found.\"}]}]]}]}]],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]}]}]]}],{\"children\":[[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L3\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L4\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:style\",\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:1:props:style\",\"children\":404}],[\"$\",\"div\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:style\",\"children\":[\"$\",\"h2\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:children:props:style\",\"children\":\"This page could not be found.\"}]}]]}]}]],null,[\"$\",\"$L5\",null,{\"children\":[\"$\",\"$6\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@7\"}]}]]}],{},null,false,false]},null,false,false]},null,false,false],[\"$\",\"$1\",\"h\",{\"children\":[[\"$\",\"meta\",null,{\"name\":\"robots\",\"content\":\"noindex\"}],[\"$\",\"$L8\",null,{\"children\":\"$L9\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$La\",null,{\"children\":[\"$\",\"$6\",null,{\"name\":\"Next.Metadata\",\"children\":\"$Lb\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}],false]],\"m\":\"$undefined\",\"G\":[\"$c\",\"$undefined\"],\"S\":true}\n"])</script><script>self.__next_f.push([1,"9:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1, maximum-scale=1\"}]]\n"])</script><script>self.__next_f.push([1,"d:I[27201,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"IconMark\"]\n7:null\nb:[[\"$\",\"title\",\"0\",{\"children\":\"Spaces\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"Agent workspace manager for Claude, Codex, Gemini, and more\"}],[\"$\",\"link\",\"2\",{\"rel\":\"icon\",\"href\":\"/icon.png\"}],[\"$\",\"$Ld\",\"3\",{}]]\n"])</script></body></html>
1	+ <!DOCTYPE html><!--HNrWymrkgOP9Z4WIaYeOj--><html lang="en" class="dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/><link rel="stylesheet" href="/_next/static/chunks/14216197f9dcbe5b.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/d2947a224b80c689.js"/><script src="/_next/static/chunks/7e363d6c9f74e9fb.js" async=""></script><script src="/_next/static/chunks/4fa395d360c87cc3.js" async=""></script><script src="/_next/static/chunks/645382108aacab6b.js" async=""></script><script src="/_next/static/chunks/797fcb0710da3be2.js" async=""></script><script src="/_next/static/chunks/turbopack-ac12088c22eb6593.js" async=""></script><script src="/_next/static/chunks/3698497a4057fe15.js" async=""></script><script src="/_next/static/chunks/54e9611ab9745d00.js" async=""></script><script src="/_next/static/chunks/d96012bcfc98706a.js" async=""></script><script src="/_next/static/chunks/73e3194f06db260e.js" async=""></script><meta name="robots" content="noindex"/><meta name="next-size-adjust" content=""/><title>404: This page could not be found.</title><title>Spaces</title><meta name="description" content="Agent workspace manager for Claude, Codex, Gemini, and more"/><link rel="icon" href="/icon.png"/><script src="/_next/static/chunks/a6dad97d9634a72d.js" noModule=""></script></head><body class="geistsans_d5a4f12f-module__Ur3q_a__variable geistmono_157ca88a-module__iaM1Ya__variable antialiased bg-zinc-950 text-zinc-100"><div hidden=""><!--$--><!--/$--></div><div style="font-family:system-ui,"Segoe UI",Roboto,Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";height:100vh;text-align:center;display:flex;flex-direction:column;align-items:center;justify-content:center"><div><style>body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}</style><h1 class="next-error-h1" style="display:inline-block;margin:0 20px 0 0;padding:0 23px 0 0;font-size:24px;font-weight:500;vertical-align:top;line-height:49px">404</h1><div style="display:inline-block"><h2 style="font-size:14px;font-weight:400;line-height:49px;margin:0">This page could not be found.</h2></div></div></div><!--$--><!--/$--><script src="/_next/static/chunks/d2947a224b80c689.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f\|\|[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[112524,[\"/_next/static/chunks/3698497a4057fe15.js\",\"/_next/static/chunks/54e9611ab9745d00.js\"],\"Providers\"]\n3:I[339756,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n4:I[837457,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n5:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"OutletBoundary\"]\n6:\"$Sreact.suspense\"\n8:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"ViewportBoundary\"]\na:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"MetadataBoundary\"]\nc:I[168027,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n:HL[\"/_next/static/chunks/14216197f9dcbe5b.css\",\"style\"]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"HNrWymrkgOP9Z4WIaYeOj\",\"c\":[\"\",\"_not-found\",\"\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"/_not-found\",{\"children\":[\"__PAGE__\",{}]}]},\"$undefined\",\"$undefined\",true],[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/chunks/14216197f9dcbe5b.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/3698497a4057fe15.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/54e9611ab9745d00.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"className\":\"dark\",\"suppressHydrationWarning\":true,\"children\":[\"$\",\"body\",null,{\"className\":\"geistsans_d5a4f12f-module__Ur3q_a__variable geistmono_157ca88a-module__iaM1Ya__variable antialiased bg-zinc-950 text-zinc-100\",\"suppressHydrationWarning\":true,\"children\":[\"$\",\"$L2\",null,{\"children\":[\"$\",\"$L3\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L4\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"padding\":\"0 23px 0 0\",\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\",\"lineHeight\":\"49px\"},\"children\":404}],[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"49px\",\"margin\":0},\"children\":\"This page could not be found.\"}]}]]}]}]],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]}]}]]}],{\"children\":[[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L3\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L4\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:style\",\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:1:props:style\",\"children\":404}],[\"$\",\"div\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:style\",\"children\":[\"$\",\"h2\",null,{\"style\":\"$0:f:0:1:0:props:children:1:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:2:props:children:props:style\",\"children\":\"This page could not be found.\"}]}]]}]}]],null,[\"$\",\"$L5\",null,{\"children\":[\"$\",\"$6\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@7\"}]}]]}],{},null,false,false]},null,false,false]},null,false,false],[\"$\",\"$1\",\"h\",{\"children\":[[\"$\",\"meta\",null,{\"name\":\"robots\",\"content\":\"noindex\"}],[\"$\",\"$L8\",null,{\"children\":\"$L9\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$La\",null,{\"children\":[\"$\",\"$6\",null,{\"name\":\"Next.Metadata\",\"children\":\"$Lb\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}],false]],\"m\":\"$undefined\",\"G\":[\"$c\",\"$undefined\"],\"S\":true}\n"])</script><script>self.__next_f.push([1,"9:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1, maximum-scale=1\"}]]\n"])</script><script>self.__next_f.push([1,"d:I[27201,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"IconMark\"]\n7:null\nb:[[\"$\",\"title\",\"0\",{\"children\":\"Spaces\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"Agent workspace manager for Claude, Codex, Gemini, and more\"}],[\"$\",\"link\",\"2\",{\"rel\":\"icon\",\"href\":\"/icon.png\"}],[\"$\",\"$Ld\",\"3\",{}]]\n"])</script></body></html>

package/.next/standalone/.next/server/pages/500.html CHANGED Viewed

@@ -1,2 +1,2 @@
-<!DOCTYPE html><!--bAQs2gDlFrq3e8w9ni9tr--><html id="__next_error__"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/d2947a224b80c689.js"/><script src="/_next/static/chunks/7e363d6c9f74e9fb.js" async=""></script><script src="/_next/static/chunks/4fa395d360c87cc3.js" async=""></script><script src="/_next/static/chunks/645382108aacab6b.js" async=""></script><script src="/_next/static/chunks/797fcb0710da3be2.js" async=""></script><script src="/_next/static/chunks/turbopack-ac12088c22eb6593.js" async=""></script><script src="/_next/static/chunks/d96012bcfc98706a.js" async=""></script><script src="/_next/static/chunks/73e3194f06db260e.js" async=""></script><meta name="next-size-adjust" content=""/><title>500: Internal Server Error.</title><script src="/_next/static/chunks/a6dad97d9634a72d.js" noModule=""></script></head><body><div hidden=""><!--$--><!--/$--></div><div style="font-family:system-ui,&quot;Segoe UI&quot;,Roboto,Helvetica,Arial,sans-serif,&quot;Apple Color Emoji&quot;,&quot;Segoe UI Emoji&quot;;height:100vh;text-align:center;display:flex;flex-direction:column;align-items:center;justify-content:center"><div style="line-height:48px"><style>body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}
-@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}</style><h1 class="next-error-h1" style="display:inline-block;margin:0 20px 0 0;padding-right:23px;font-size:24px;font-weight:500;vertical-align:top">500</h1><div style="display:inline-block"><h2 style="font-size:14px;font-weight:400;line-height:28px">Internal Server Error.</h2></div></div></div><!--$--><!--/$--><script src="/_next/static/chunks/d2947a224b80c689.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[339756,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n3:I[837457,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n4:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"OutletBoundary\"]\n5:\"$Sreact.suspense\"\n7:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"ViewportBoundary\"]\n9:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"MetadataBoundary\"]\nb:I[168027,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"bAQs2gDlFrq3e8w9ni9tr\",\"c\":[\"\",\"_global-error\",\"\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"__PAGE__\",{}]}],[[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[[\"$\",\"$1\",\"c\",{\"children\":[[\"$\",\"html\",null,{\"id\":\"__next_error__\",\"children\":[[\"$\",\"head\",null,{\"children\":[\"$\",\"title\",null,{\"children\":\"500: Internal Server Error.\"}]}],[\"$\",\"body\",null,{\"children\":[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"style\":{\"lineHeight\":\"48px\"},\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}\\n@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"paddingRight\":23,\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\"},\"children\":\"500\"}],[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"28px\"},\"children\":\"Internal Server Error.\"}]}]]}]}]}]]}],[[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/d96012bcfc98706a.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/73e3194f06db260e.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$L4\",null,{\"children\":[\"$\",\"$5\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@6\"}]}]]}],{},null,false,false]},null,false,false],[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$L7\",null,{\"children\":\"$L8\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$L9\",null,{\"children\":[\"$\",\"$5\",null,{\"name\":\"Next.Metadata\",\"children\":\"$La\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}],false]],\"m\":\"$undefined\",\"G\":[\"$b\",\"$undefined\"],\"S\":true}\n"])</script><script>self.__next_f.push([1,"8:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n"])</script><script>self.__next_f.push([1,"6:null\na:[]\n"])</script></body></html>
+<!DOCTYPE html><!--HNrWymrkgOP9Z4WIaYeOj--><html id="__next_error__"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/d2947a224b80c689.js"/><script src="/_next/static/chunks/7e363d6c9f74e9fb.js" async=""></script><script src="/_next/static/chunks/4fa395d360c87cc3.js" async=""></script><script src="/_next/static/chunks/645382108aacab6b.js" async=""></script><script src="/_next/static/chunks/797fcb0710da3be2.js" async=""></script><script src="/_next/static/chunks/turbopack-ac12088c22eb6593.js" async=""></script><script src="/_next/static/chunks/d96012bcfc98706a.js" async=""></script><script src="/_next/static/chunks/73e3194f06db260e.js" async=""></script><meta name="next-size-adjust" content=""/><title>500: Internal Server Error.</title><script src="/_next/static/chunks/a6dad97d9634a72d.js" noModule=""></script></head><body><div hidden=""><!--$--><!--/$--></div><div style="font-family:system-ui,&quot;Segoe UI&quot;,Roboto,Helvetica,Arial,sans-serif,&quot;Apple Color Emoji&quot;,&quot;Segoe UI Emoji&quot;;height:100vh;text-align:center;display:flex;flex-direction:column;align-items:center;justify-content:center"><div style="line-height:48px"><style>body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}
+@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}</style><h1 class="next-error-h1" style="display:inline-block;margin:0 20px 0 0;padding-right:23px;font-size:24px;font-weight:500;vertical-align:top">500</h1><div style="display:inline-block"><h2 style="font-size:14px;font-weight:400;line-height:28px">Internal Server Error.</h2></div></div></div><!--$--><!--/$--><script src="/_next/static/chunks/d2947a224b80c689.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[339756,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n3:I[837457,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n4:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"OutletBoundary\"]\n5:\"$Sreact.suspense\"\n7:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"ViewportBoundary\"]\n9:I[897367,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"MetadataBoundary\"]\nb:I[168027,[\"/_next/static/chunks/d96012bcfc98706a.js\",\"/_next/static/chunks/73e3194f06db260e.js\"],\"default\"]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"HNrWymrkgOP9Z4WIaYeOj\",\"c\":[\"\",\"_global-error\",\"\"],\"q\":\"\",\"i\":false,\"f\":[[[\"\",{\"children\":[\"__PAGE__\",{}]}],[[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[[\"$\",\"$1\",\"c\",{\"children\":[[\"$\",\"html\",null,{\"id\":\"__next_error__\",\"children\":[[\"$\",\"head\",null,{\"children\":[\"$\",\"title\",null,{\"children\":\"500: Internal Server Error.\"}]}],[\"$\",\"body\",null,{\"children\":[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"style\":{\"lineHeight\":\"48px\"},\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}\\n@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"paddingRight\":23,\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\"},\"children\":\"500\"}],[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"28px\"},\"children\":\"Internal Server Error.\"}]}]]}]}]}]]}],[[\"$\",\"script\",\"script-0\",{\"src\":\"/_next/static/chunks/d96012bcfc98706a.js\",\"async\":true,\"nonce\":\"$undefined\"}],[\"$\",\"script\",\"script-1\",{\"src\":\"/_next/static/chunks/73e3194f06db260e.js\",\"async\":true,\"nonce\":\"$undefined\"}]],[\"$\",\"$L4\",null,{\"children\":[\"$\",\"$5\",null,{\"name\":\"Next.MetadataOutlet\",\"children\":\"$@6\"}]}]]}],{},null,false,false]},null,false,false],[\"$\",\"$1\",\"h\",{\"children\":[null,[\"$\",\"$L7\",null,{\"children\":\"$L8\"}],[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$L9\",null,{\"children\":[\"$\",\"$5\",null,{\"name\":\"Next.Metadata\",\"children\":\"$La\"}]}]}],[\"$\",\"meta\",null,{\"name\":\"next-size-adjust\",\"content\":\"\"}]]}],false]],\"m\":\"$undefined\",\"G\":[\"$b\",\"$undefined\"],\"S\":true}\n"])</script><script>self.__next_f.push([1,"8:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n"])</script><script>self.__next_f.push([1,"6:null\na:[]\n"])</script></body></html>

package/.next/standalone/bin/cortex-hook.js CHANGED Viewed

@@ -2,11 +2,16 @@
 'use strict';
 const http = require('http');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
-const LOG_FILE = path.join(process.cwd(), 'cortex-hook-debug.log');
+const LOG_DIR = path.join(os.homedir(), '.spaces', 'logs');
+const LOG_FILE = path.join(LOG_DIR, 'cortex-hook-debug.log');
 function log(msg) {
-  try { fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] " + msg + "\n"); } catch(e) {}
+  try {
+    fs.mkdirSync(LOG_DIR, { recursive: true });
+    fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] " + msg + "\n");
+  } catch(e) {}
 }
 function readSpacesEnv() {
@@ -49,7 +54,7 @@ async function main() {
   const query = encodeURIComponent(prompt);
   const url = "http://localhost:" + port + "/api/cortex/context/?q=" + query + "&limit=5" + (wsId ? "&workspace_id=" + wsId : "");
-  log('Querying: ' + url + ' (event: ' + eventName + ')');
+  log('Querying cortex (prompt length: ' + prompt.length + ', event: ' + eventName + ')');
   try {
     const body = await new Promise((resolve, reject) => {

package/.next/standalone/bin/cortex-learn-hook.js CHANGED Viewed

@@ -2,11 +2,16 @@
 'use strict';
 const http = require('http');
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
-const LOG_FILE = path.join(process.cwd(), 'cortex-hook-debug.log');
+const LOG_DIR = path.join(os.homedir(), '.spaces', 'logs');
+const LOG_FILE = path.join(LOG_DIR, 'cortex-hook-debug.log');
 function log(msg) {
-  try { fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] [LEARN] " + msg + "\n"); } catch(e) {}
+  try {
+    fs.mkdirSync(LOG_DIR, { recursive: true });
+    fs.appendFileSync(LOG_FILE, "[" + new Date().toISOString() + "] [LEARN] " + msg + "\n");
+  } catch(e) {}
 }
 function readSpacesEnv() {

package/.next/standalone/bin/scrub-standalone.js ADDED Viewed

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+'use strict';
+// Remove runtime-generated files from .next/standalone/ before publishing to npm.
+// Historical incident: cortex-hook-debug.log containing user prompts (and npm tokens)
+// leaked into versions 0.9.6-0.9.9 because the hook wrote to process.cwd() which
+// at runtime was .next/standalone/. Hooks now log to ~/.spaces/logs/, but this
+// belt-and-suspenders scrub runs on every publish to catch any other accidents.
+const fs = require('fs');
+const path = require('path');
+const STANDALONE = path.join(process.cwd(), '.next', 'standalone');
+const DENY_FILES = [
+  'cortex-hook-debug.log',
+];
+const DENY_DIRS = [
+  '.spaces',
+  '.claude',
+  '.codex',
+  '.gemini',
+  '.pi',
+  'logs',
+];
+const DENY_PATTERNS = [
+  /\.log$/i,
+  /^\.env(\..+)?$/i,
+  /^\.npmrc$/i,
+];
+function walk(dir, cb) {
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
+  catch { return; }
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (DENY_DIRS.includes(e.name)) {
+        fs.rmSync(full, { recursive: true, force: true });
+        console.log('[scrub] removed dir: ' + path.relative(STANDALONE, full));
+        continue;
+      }
+      walk(full, cb);
+    } else if (e.isFile()) {
+      cb(full, e.name);
+    }
+  }
+}
+if (!fs.existsSync(STANDALONE)) {
+  console.log('[scrub] no .next/standalone to scrub');
+  process.exit(0);
+}
+walk(STANDALONE, (full, name) => {
+  if (DENY_FILES.includes(name) || DENY_PATTERNS.some(p => p.test(name))) {
+    fs.rmSync(full, { force: true });
+    console.log('[scrub] removed file: ' + path.relative(STANDALONE, full));
+  }
+});
+// Final scan: refuse to publish if any obvious secrets remain in text files
+const SECRET_PATTERNS = [
+  /npm_[A-Za-z0-9]{30,}/,
+  /sk-ant-[A-Za-z0-9_-]{20,}/,
+  /ghp_[A-Za-z0-9]{30,}/,
+];
+let leaked = false;
+walk(STANDALONE, (full, name) => {
+  if (!/\.(js|json|md|txt|log|ts|tsx|mjs|cjs)$/i.test(name)) return;
+  let content;
+  try { content = fs.readFileSync(full, 'utf-8'); } catch { return; }
+  for (const p of SECRET_PATTERNS) {
+    const m = content.match(p);
+    if (m) {
+      console.error('[scrub] SECRET DETECTED in ' + path.relative(STANDALONE, full) + ': ' + m[0].slice(0, 12) + '...');
+      leaked = true;
+    }
+  }
+});
+if (leaked) {
+  console.error('[scrub] aborting publish — secrets found in build output');
+  process.exit(1);
+}
+console.log('[scrub] done — standalone clean');

package/.next/standalone/bin/terminal-server.js CHANGED Viewed

@@ -1334,8 +1334,11 @@ function handleConnection(wss, ws, req) {
   const rawAgentSession = url.searchParams.get('agentSession') || '';
   const agentSession = (rawAgentSession === 'new' || SESSION_ID_RE.test(rawAgentSession)) ? rawAgentSession : '';
   const rawCustomCommand = url.searchParams.get('customCommand') || '';
-  // Sanitize: reject shell metacharacters that enable injection (;, |, &, $, `, etc.)
-  const customCommand = /[;&|`$(){}]/.test(rawCustomCommand) ? '' : rawCustomCommand;
+  // Sanitize via allowlist. Any character outside [A-Za-z0-9 . _ - /] is rejected.
+  // Earlier blocklist (/[;&|`$(){}]/) missed newlines, redirects (<,>), and
+  // backslashes — a payload like "legit\nmalicious" would inject a second command
+  // when the PTY wrote it with a trailing \r.
+  const customCommand = /^[A-Za-z0-9._\-/ ]+$/.test(rawCustomCommand) ? rawCustomCommand : '';
   const cols = parseInt(url.searchParams.get('cols') || '120', 10);
   const rows = parseInt(url.searchParams.get('rows') || '30', 10);
@@ -1554,8 +1557,25 @@ function handleConnection(wss, ws, req) {
   // Detect bash-on-Windows so cd commands use bash syntax, not cmd.exe `cd /d`
   const isBashOnWindows = isWindows && shell && (shell.endsWith('bash.exe') || shell.endsWith('bash'));
-  const env = { ...process.env };
-  delete env.CLAUDECODE;
+  // Build a minimal env for the user-facing PTY — never inherit the server's
+  // secrets (SPACES_SESSION_SECRET, GH_PAT, NPM_TOKEN, ANTHROPIC_API_KEY, etc).
+  // Only forward identity/shell/locale/terminal basics from the server env.
+  const PTY_ENV_ALLOW = [
+    'HOME', 'USER', 'LOGNAME', 'SHELL', 'PATH', 'PWD', 'OLDPWD', 'HOSTNAME',
+    'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES', 'LC_COLLATE', 'LC_TIME',
+    'LC_NUMERIC', 'LC_MONETARY', 'TZ',
+    'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'XDG_RUNTIME_DIR',
+    'XDG_STATE_HOME',
+    'TERM', 'TERM_PROGRAM', 'TERM_PROGRAM_VERSION', 'COLORTERM', 'COLUMNS', 'LINES',
+    'NODE_ENV', 'NVM_DIR', 'NVM_BIN',
+    // Windows basics
+    'SYSTEMROOT', 'WINDIR', 'APPDATA', 'LOCALAPPDATA', 'USERPROFILE', 'COMSPEC',
+    'PATHEXT', 'PROGRAMFILES', 'PROGRAMFILES(X86)', 'PROGRAMDATA',
+  ];
+  const env = {};
+  for (const k of PTY_ENV_ALLOW) {
+    if (process.env[k] !== undefined) env[k] = process.env[k];
+  }
   // Enable prompt suggestions in spawned Claude Code sessions
   env.CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION = 'true';
   // Tell Claude Code where git-bash is so it doesn't fail the bash detection
@@ -2208,19 +2228,30 @@ async function handleProxyConnection(clientWs, nodeId, opts) {
     return;
   }
-  // Get the remote WebSocket URL via the terminal token endpoint
-  // Only skip TLS verification if explicitly opted in (e.g., self-signed certs)
+  // Get the remote WebSocket URL via the terminal token endpoint.
+  // If the user opted into skipping TLS verification (for self-signed federation
+  // certs), scope it to JUST this request via an undici Agent rather than the
+  // process-global NODE_TLS_REJECT_UNAUTHORIZED env var, which would disable
+  // cert verification for every outbound TLS connection in the process and
+  // race with concurrent requests.
   const skipTls = process.env.SPACES_SKIP_TLS_VERIFY === '1';
-  const prevTls = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-  if (skipTls) process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+  let fetchOptions = {
+    method: 'POST',
+    headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
+    signal: AbortSignal.timeout(10000),
+  };
+  if (skipTls) {
+    try {
+      const { Agent } = require('undici');
+      fetchOptions.dispatcher = new Agent({ connect: { rejectUnauthorized: false } });
+    } catch (e) {
+      console.warn('[Proxy] undici unavailable for per-request TLS opt-out; refusing to fall back to global flag');
+    }
+  }
   let remoteWsUrl;
   try {
     const tokenUrl = `${node.url}/api/network/terminal/token/`;
-    const res = await fetch(tokenUrl, {
-      method: 'POST',
-      headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
-      signal: AbortSignal.timeout(10000),
-    });
+    const res = await fetch(tokenUrl, fetchOptions);
     if (!res.ok) {
       let detail = '';
@@ -2236,9 +2267,6 @@ async function handleProxyConnection(clientWs, nodeId, opts) {
     clientWs.send(JSON.stringify({ type: 'error', data: `Cannot reach remote node: ${err.message}` }));
     clientWs.close();
     return;
-  } finally {
-    if (prevTls === undefined) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
-    else process.env.NODE_TLS_REJECT_UNAUTHORIZED = prevTls;
   }
   // Connect to remote terminal server using the API key directly.

package/.next/standalone/package-lock.json CHANGED Viewed

@@ -1,12 +1,12 @@
 {
   "name": "@jlongo78/agent-spaces",
-  "version": "0.9.9",
+  "version": "0.9.10",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@jlongo78/agent-spaces",
-      "version": "0.9.9",
+      "version": "0.9.10",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@dnd-kit/core": "^6.3.1",

package/.next/standalone/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@jlongo78/agent-spaces",
-  "version": "0.9.9",
+  "version": "0.9.10",
   "description": "Agent workspace manager for Claude, Codex, Gemini, and more",
   "bin": {
     "spaces": "./bin/spaces.js"
@@ -32,7 +32,7 @@
     "dev": "node bin/spaces-dev.js",
     "build": "cross-env STANDALONE=1 next build && node -e \"const fs=require('fs');fs.cpSync('.next/static','.next/standalone/.next/static',{recursive:true});fs.cpSync('public','.next/standalone/public',{recursive:true})\" && node bin/fix-standalone-externals.js",
     "postinstall": "node bin/spaces-postinstall.js || true",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "npm run build && node bin/scrub-standalone.js",
     "setup": "node bin/spaces-setup.js",
     "setup-admin": "node bin/setup-admin.js",
     "server:build": "next build",

package/.next/standalone/src/app/api/chat/route.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import { NextRequest } from 'next/server';
 import { spawn } from 'child_process';
-import { getAuthUser } from '@/lib/auth';
+import { getAuthUser, withUser } from '@/lib/auth';
+import { buildSpawnEnv } from '@/lib/spawn-env';
 export const dynamic = 'force-dynamic';
@@ -17,69 +18,71 @@ export async function POST(request: NextRequest) {
     });
   }
-  const workDir = cwd || require('os').homedir();
-  const encoder = new TextEncoder();
+  return withUser(user, () => {
+    const workDir = cwd || require('os').homedir();
+    const encoder = new TextEncoder();
-  const stream = new ReadableStream({
-    start(controller) {
-      const args = [
-        '-p', message,
-        '--output-format', 'stream-json',
-        '--verbose',
-      ];
+    const stream = new ReadableStream({
+      start(controller) {
+        const args = [
+          '-p', message,
+          '--output-format', 'stream-json',
+          '--verbose',
+        ];
-      const env = { ...process.env };
-      delete env.CLAUDECODE;
+        const env = buildSpawnEnv();
+        delete env.CLAUDECODE;
-      const child = spawn('claude', args, {
-        cwd: workDir,
-        env,
-      });
+        const child = spawn('claude', args, {
+          cwd: workDir,
+          env,
+        });
-      let buffer = '';
+        let buffer = '';
-      child.stdout.on('data', (chunk: Buffer) => {
-        buffer += chunk.toString();
-        const lines = buffer.split('\n');
-        buffer = lines.pop() || '';
+        child.stdout.on('data', (chunk: Buffer) => {
+          buffer += chunk.toString();
+          const lines = buffer.split('\n');
+          buffer = lines.pop() || '';
-        for (const line of lines) {
-          if (!line.trim()) continue;
-          try {
-            const event = JSON.parse(line);
-            controller.enqueue(encoder.encode(`data: ${JSON.stringify(event)}\n\n`));
-          } catch {
-            controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'text', text: line })}\n\n`));
+          for (const line of lines) {
+            if (!line.trim()) continue;
+            try {
+              const event = JSON.parse(line);
+              controller.enqueue(encoder.encode(`data: ${JSON.stringify(event)}\n\n`));
+            } catch {
+              controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'text', text: line })}\n\n`));
+            }
           }
-        }
-      });
+        });
-      child.stderr.on('data', (chunk: Buffer) => {
-        const text = chunk.toString();
-        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'error', text })}\n\n`));
-      });
+        child.stderr.on('data', (chunk: Buffer) => {
+          const text = chunk.toString();
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'error', text })}\n\n`));
+        });
-      child.on('close', (code) => {
-        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'done', exitCode: code })}\n\n`));
-        controller.close();
-      });
+        child.on('close', (code) => {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'done', exitCode: code })}\n\n`));
+          controller.close();
+        });
-      child.on('error', (err) => {
-        controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'error', text: err.message })}\n\n`));
-        controller.close();
-      });
+        child.on('error', (err) => {
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify({ type: 'error', text: err.message })}\n\n`));
+          controller.close();
+        });
-      request.signal.addEventListener('abort', () => {
-        child.kill('SIGTERM');
-      });
-    },
-  });
+        request.signal.addEventListener('abort', () => {
+          child.kill('SIGTERM');
+        });
+      },
+    });
-  return new Response(stream, {
-    headers: {
-      'Content-Type': 'text/event-stream',
-      'Cache-Control': 'no-cache',
-      'Connection': 'keep-alive',
-    },
+    return new Response(stream, {
+      headers: {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        'Connection': 'keep-alive',
+      },
+    });
   });
 }

package/.next/standalone/src/app/api/sessions/[id]/chat/route.ts CHANGED Viewed

@@ -3,6 +3,7 @@ import { spawn } from 'child_process';
 import { getAuthUser, withUser } from '@/lib/auth';
 import { ensureInitialized } from '@/lib/db/init';
 import { getSessionById } from '@/lib/db/queries';
+import { buildSpawnEnv } from '@/lib/spawn-env';
 export const dynamic = 'force-dynamic';
@@ -39,7 +40,7 @@ export async function POST(
         ];
         // Strip CLAUDECODE so claude doesn't think it's nested
-        const env = { ...process.env };
+        const env = buildSpawnEnv();
         delete env.CLAUDECODE;
         const child = spawn('claude', args, {

package/.next/standalone/src/lib/spawn-env.ts ADDED Viewed

@@ -0,0 +1,32 @@
+// Build a minimal, safe environment for child processes that execute user-controlled
+// code (PTY shells, `claude` CLI, etc). The server's own env contains secrets —
+// SPACES_SESSION_SECRET, GH_PAT, NPM_TOKEN, ANTHROPIC_API_KEY — and any of those
+// leaking into a user PTY would let the user forge sessions or impersonate the
+// server against upstream services.
+const ALLOWED_ENV_VARS = new Set([
+  // Identity / shell basics
+  'HOME', 'USER', 'LOGNAME', 'SHELL', 'PATH', 'PWD', 'OLDPWD', 'HOSTNAME',
+  // Locale / time
+  'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES', 'LC_COLLATE', 'LC_TIME',
+  'LC_NUMERIC', 'LC_MONETARY', 'TZ',
+  // XDG base dirs
+  'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'XDG_RUNTIME_DIR',
+  'XDG_STATE_HOME',
+  // Terminal / display
+  'TERM', 'TERM_PROGRAM', 'TERM_PROGRAM_VERSION', 'COLORTERM', 'COLUMNS', 'LINES',
+  // Node / package manager tooling child tools may need
+  'NODE_ENV', 'NVM_DIR', 'NVM_BIN',
+]);
+export function buildSpawnEnv(extras: Record<string, string | undefined> = {}): NodeJS.ProcessEnv {
+  const env: Record<string, string> = {};
+  for (const key of ALLOWED_ENV_VARS) {
+    const v = process.env[key];
+    if (v !== undefined) env[key] = v;
+  }
+  for (const [k, v] of Object.entries(extras)) {
+    if (v !== undefined) env[k] = v;
+  }
+  return env as unknown as NodeJS.ProcessEnv;
+}

package/.next/standalone/src/lib/terminal/server.ts CHANGED Viewed

@@ -3,6 +3,7 @@ import * as pty from 'node-pty';
 import { IncomingMessage } from 'http';
 import crypto from 'crypto';
 import { AGENT_TYPES } from '../agents';
+import { buildSpawnEnv } from '../spawn-env';
 interface TermSession {
   pty: pty.IPty;
@@ -83,9 +84,8 @@ export function startTerminalServer(port = 3458) {
     const shell = isWindows ? 'cmd.exe' : (process.env.SHELL || '/bin/bash');
     const agent = AGENT_TYPES[agentType];
-    // Strip CLAUDECODE to avoid nesting detection
-    const env = { ...process.env } as Record<string, string>;
-    delete env.CLAUDECODE;
+    // Build a minimal, non-secret-bearing env for the user-facing PTY.
+    const env = buildSpawnEnv() as Record<string, string>;
     if (customModelId) {
       const port = process.env.SPACES_PORT || '3457';

package/.next/standalone/src/middleware.ts CHANGED Viewed

@@ -1,6 +1,15 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { HAS_AUTH } from '@/lib/tier';
+function timingSafeEqualStr(a: string, b: string): boolean {
+  const aBytes = new TextEncoder().encode(a);
+  const bBytes = new TextEncoder().encode(b);
+  if (aBytes.length !== bBytes.length) return false;
+  let result = 0;
+  for (let i = 0; i < aBytes.length; i++) result |= aBytes[i] ^ bBytes[i];
+  return result === 0;
+}
 async function verifyToken(token: string, secretHex: string): Promise<{ sub: string; role: string } | null> {
   if (!token) return null;
   const parts = token.split('.');
@@ -20,7 +29,7 @@ async function verifyToken(token: string, secretHex: string): Promise<{ sub: str
   const expectedSig = btoa(String.fromCharCode(...new Uint8Array(sigBytes)))
     .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-  if (expectedSig !== sig) return null;
+  if (!timingSafeEqualStr(expectedSig, sig)) return null;
   try {
     const payloadStr = atob(payloadB64.replace(/-/g, '+').replace(/_/g, '/'));
@@ -58,9 +67,17 @@ export async function middleware(request: NextRequest) {
     return NextResponse.next();
   }
-  // Federation API routes authenticate via Bearer token
-  if (pathname.startsWith('/api/network/') && request.headers.get('authorization')?.startsWith('Bearer ')) {
-    return NextResponse.next();
+  // Federation API routes authenticate via Bearer token. Middleware can't validate
+  // the token against network.db in Edge runtime, so we only let through requests
+  // that carry a well-formed API-key bearer (shape: "spk_" + base36-ish). The route
+  // handler is still responsible for calling requireNetworkAuth() — this bypass is
+  // purely a shape check to reject arbitrary strings like "Bearer anything".
+  const authHeader = request.headers.get('authorization');
+  if (pathname.startsWith('/api/network/') && authHeader?.startsWith('Bearer ')) {
+    const bearer = authHeader.slice(7);
+    if (/^spk_[A-Za-z0-9_-]{8,}$/.test(bearer)) {
+      return NextResponse.next();
+    }
   }
   // Connection request/callback endpoints are unauthenticated (verified by token in body)
@@ -73,7 +90,8 @@ export async function middleware(request: NextRequest) {
   // Internal API requests from MCP servers / agent processes / VR client (local network)
   const internalToken = request.headers.get('x-spaces-internal') || request.nextUrl.searchParams.get('_internal');
-  if (internalToken === (process.env.SPACES_SESSION_SECRET || '').slice(0, 16) &&
+  const expectedInternalToken = (process.env.SPACES_SESSION_SECRET || '').slice(0, 16);
+  if (internalToken && expectedInternalToken && timingSafeEqualStr(internalToken, expectedInternalToken) &&
       (request.headers.get('host')?.startsWith('localhost') || request.headers.get('host')?.startsWith('127.0.0.1') || request.headers.get('host')?.startsWith('192.168.'))) {
     return NextResponse.next();
   }