@karlorz/codexhost-cli-win32-x64 0.13.2-3 → 0.13.3-0

package/app/plugins/codebuddy/plugin.mjs

@@ -16797,6 +16797,27 @@ function nativeError(error51, profile = CODEBUDDY_RUNTIME_PROFILE) {
 function failure(code, message, profile = CODEBUDDY_RUNTIME_PROFILE) {
   return { ok: false, error: nativeError(new CodeBuddyError(code, message), profile) };
 }
+function nativeTurnError(stopReason, meta3, profile) {
+  const fallback = `Native Turn stopped: ${text(stopReason) || "unknown"} (${text(meta3["codebuddy.ai/outcome"]) || "no native outcome"})`;
+  const raw = text(meta3["codebuddy.ai/errorMessage"]).trim();
+  let diagnostic = "";
+  let category;
+  if (raw) {
+    try {
+      const error51 = record2(JSON.parse(raw));
+      const data = record2(error51.data);
+      diagnostic = text(data.details).trim() || text(error51.message).trim();
+      category = data.category;
+    } catch {
+      diagnostic = raw;
+    }
+  }
+  return nativeError(new CodeBuddyError(
+    // -32000 is shared by native refusals; the category identifies authentication failures.
+    category === "auth" ? "authenticationRequired" : "nativeFailure",
+    diagnostic ? `${fallback}: ${diagnostic}` : fallback
+  ), profile);
+}
 async function bounded(operation, milliseconds, label, onTimeout) {
   let timer;
   try {
@@ -24828,7 +24849,7 @@ var CodeBuddySession = class {
       // Those remain visible on individual Items; they do not fail the completed Turn.
       (!meta3["codebuddy.ai/outcome"] || meta3["codebuddy.ai/outcome"] === "SUCCESS" || meta3["codebuddy.ai/outcome"] === "PARTIAL_SUCCESS") ? { status: "succeeded" } : {
         status: "failed",
-        error: nativeError(new CodeBuddyError("nativeFailure", `Native Turn stopped: ${text(stop) || "unknown"} (${text(meta3["codebuddy.ai/outcome"]) || "no native outcome"})`), this.profile)
+        error: nativeTurnError(stop, meta3, this.profile)
       };
       const snapshot = await this.#snapshot();
       const added = snapshot.turns.filter((turn) => !active.before.has(turn.nativeTurnRef.nativeTurnKey));

package/app/plugins/deepseek-harness/manifest.json

@@ -31,8 +31,8 @@
     }
   },
   "notice": {
-    "en": "Requires DSH 0.1.7-rc.1 or later and the V4 protocol. Verified with 0.1.7-rc.1, 0.1.7-rc.2, 0.2.0-rc.1 and 0.2.0-rc.2; other versions require native protocol validation.",
-    "zh-CN": "需要 DSH 0.1.7-rc.1 或更高版本及 V4 协议。已验证 0.1.7-rc.1、0.1.7-rc.2、0.2.0-rc.1 和 0.2.0-rc.2；其他版本仍需通过原生协议校验。"
+    "en": "Requires DSH 0.1.7-rc.1 or later and the V4 protocol. Verified with 0.1.7-rc.1, 0.1.7-rc.2, 0.2.0-rc.1, 0.2.0-rc.2, 0.2.1-rc.1 and 0.2.1-rc.2; other versions require native protocol validation.",
+    "zh-CN": "需要 DSH 0.1.7-rc.1 或更高版本及 V4 协议。已验证 0.1.7-rc.1、0.1.7-rc.2、0.2.0-rc.1、0.2.0-rc.2、0.2.1-rc.1 和 0.2.1-rc.2；其他版本仍需通过原生协议校验。"
   },
   "links": {
     "website": "https://github.com/deepseek-ai/deepseek-harness",

package/app/plugins/deepseek-harness/plugin.mjs

@@ -21923,7 +21923,7 @@ function validateV4Event(event) {
       break;
     case "subagent/catalog":
       requiredOptionalKeys(data, ["version", "childId", "childCreatedAt", "mode"], ["label"]);
-      if (data.version !== 0 || data.mode !== "one-shot" && data.mode !== "continuable")
+      if (!(data.version === 0 && (data.mode === "one-shot" || data.mode === "continuable") || data.version === 2 && data.mode === "external"))
         throw invalid("subagent catalog");
       identifier(data.childId, "subagent catalog childId");
       nonNegativeInteger2(data.childCreatedAt, "subagent catalog childCreatedAt");
@@ -22457,14 +22457,16 @@ var MAX_TIMER_MILLISECONDS = 2147483647;
 var NUMERIC_IDENTIFIER = String.raw`(?:0|[1-9]\d*)`;
 var PRERELEASE_IDENTIFIER = String.raw`(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)`;
 var SEMVER_PATTERN = new RegExp(String.raw`^${NUMERIC_IDENTIFIER}\.${NUMERIC_IDENTIFIER}\.${NUMERIC_IDENTIFIER}` + String.raw`(?:-${PRERELEASE_IDENTIFIER}(?:\.${PRERELEASE_IDENTIFIER})*)?` + String.raw`(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$`, "u");
-var DEEPSEEK_NEWEST_VERIFIED_VERSION = "0.2.0-rc.2";
+var DEEPSEEK_NEWEST_VERIFIED_VERSION = "0.2.1-rc.2";
 var DEEPSEEK_VERIFIED_VERSIONS = [
   "0.1.7-rc.1",
   "0.1.7-rc.2",
   "0.2.0-rc.1",
+  "0.2.0-rc.2",
+  "0.2.1-rc.1",
   DEEPSEEK_NEWEST_VERIFIED_VERSION
 ];
-var DEEPSEEK_UPGRADE_COMMAND = `npm install -g @deepseek-ai/dsh@${DEEPSEEK_NEWEST_VERIFIED_VERSION}`;
+var DEEPSEEK_UPGRADE_COMMAND = "npm install -g @deepseek-ai/dsh@latest";
 var DEFAULT_DEEPSEEK_ENDPOINT = "http://127.0.0.1:3080/";
 var MODERN_AUTHENTICATION_FINGERPRINT = Buffer.from("dsh web authentication required; reopen the URL printed by dsh web.\n");
 var MODERN_AUTHENTICATION_PROBE_TIMEOUT_MS = 1e3;
@@ -27056,6 +27058,8 @@ var KNOWN_EVENT_TYPES = /* @__PURE__ */ new Set([
   "hook/invoked",
   "hook/result",
   "image/offload",
+  "job/registered",
+  "job/settled",
   "llm/retry",
   "llm/retry-started",
   "model/selection",
@@ -27092,6 +27096,7 @@ var KNOWN_EVENT_TYPES = /* @__PURE__ */ new Set([
   "turn/start",
   "user/message",
   "web/deepseek-search-llm-request",
+  "working-directory/change",
   "workspace/changes"
 ]);
 var SURFACE_EVENT_TYPES = /* @__PURE__ */ new Set([
@@ -27265,6 +27270,14 @@ var ModernEventValidator = class {
         return;
       case "workspace/changes":
         return;
+      case "working-directory/change":
+        exactKeys(data, ["cwd"]);
+        requiredString(data.cwd, "working-directory/change cwd");
+        return;
+      case "job/registered":
+      case "job/settled":
+        validateJobLifecycle(event.type, data);
+        return;
       case "agent-preset/selected":
         exactKeys(data, ["agentPreset"]);
         requiredString(data.agentPreset, "agent-preset/selected agentPreset");
@@ -28248,7 +28261,7 @@ function validateSessionTitle(data) {
   }
 }
 function validateSessionTitleRequest(data) {
-  exactKeys(data, ["titleProvider", "messageSeqs", "route", "system", "messages", "maxTokens"]);
+  requiredOptionalKeys(data, ["titleProvider", "messageSeqs", "route", "system", "messages", "maxTokens"], ["reasoningEffort"]);
   requiredString(data.titleProvider, "session/title request provider");
   validateSeqArray(data.messageSeqs, "session/title request messageSeqs");
   validateModelRoute(data.route, "session/title request route");
@@ -28262,6 +28275,9 @@ function validateSessionTitleRequest(data) {
     }
   }
   positiveInteger(data.maxTokens, "session/title request maxTokens");
+  if (data.reasoningEffort !== void 0 && !nonBlankString(data.reasoningEffort)) {
+    fail("Modern history session/title request reasoningEffort is invalid");
+  }
 }
 function validateTodoWrite(data) {
   exactKeys(data, ["todos"]);
@@ -28305,12 +28321,47 @@ function validateWorkflow(type, data) {
   requiredString(data.runId, "workflow runId");
   enumValue(data.stopReason, ["completed", "cancelled", "error"], "workflow stopReason");
 }
+function validateJobLifecycle(type, data) {
+  const settled = type === "job/settled";
+  requiredOptionalKeys(data, [
+    "jobId",
+    "owner",
+    "kind",
+    "label",
+    "startedAt",
+    ...settled ? ["finishedAt", "status", "cause", "producerReported"] : []
+  ], settled ? ["toolCall", "detail"] : ["toolCall"]);
+  requiredString(data.jobId, `${type} jobId`);
+  requiredString(data.owner, `${type} owner`);
+  requiredString(data.kind, `${type} kind`);
+  if (typeof data.label !== "string")
+    fail(`Modern history ${type} label is invalid`);
+  nonNegativeInteger(data.startedAt, `${type} startedAt`);
+  if (data.toolCall !== void 0) {
+    if (!isRecord4(data.toolCall))
+      fail(`Modern history ${type} toolCall is malformed`);
+    exactKeys(data.toolCall, ["callId", "rootCallId"]);
+    requiredString(data.toolCall.callId, `${type} toolCall callId`);
+    requiredString(data.toolCall.rootCallId, `${type} toolCall rootCallId`);
+  }
+  if (!settled)
+    return;
+  nonNegativeInteger(data.finishedAt, "job/settled finishedAt");
+  enumValue(data.status, ["completed", "killed", "failed"], "job/settled status");
+  enumValue(data.cause, ["producer", "kill", "teardown"], "job/settled cause");
+  if (typeof data.producerReported !== "boolean") {
+    fail("Modern history job/settled producerReported is invalid");
+  }
+  if (data.detail !== void 0 && typeof data.detail !== "string") {
+    fail("Modern history job/settled detail is invalid");
+  }
+}
 function validatePtcDispatch(type, data, profile) {
   const settle = type === "tool/ptc-dispatch";
   const required2 = ["rootCallId", "parentCallId", "subCallId", "name", "arguments"];
   if (settle)
     required2.push("isError", "content");
-  requiredOptionalKeys(data, required2, settle ? ["error"] : []);
+  requiredOptionalKeys(data, required2, settle ? ["error", "meta"] : []);
   for (const key of ["rootCallId", "parentCallId", "subCallId", "name"]) {
     requiredString(data[key], `tool/ptc-dispatch ${key}`);
   }
@@ -28459,12 +28510,20 @@ function validateSearchRequest(data) {
   requiredString(data.apiVersion, "search request apiVersion");
   if (!isRecord4(data.body))
     fail("Modern history search request body is malformed");
-  requiredOptionalKeys(data.body, ["model", "max_tokens", "messages", "tools"], []);
+  requiredOptionalKeys(data.body, ["model", "max_tokens", "messages", "tools"], ["thinking"]);
   requiredString(data.body.model, "search request model");
   positiveInteger(data.body.max_tokens, "search request max_tokens");
   if (!Array.isArray(data.body.messages) || !Array.isArray(data.body.tools)) {
     fail("Modern history search request arrays are malformed");
   }
+  if (data.body.thinking !== void 0) {
+    const { thinking } = data.body;
+    if (!isRecord4(thinking))
+      fail("Modern history search request thinking is malformed");
+    exactKeys(thinking, ["type"]);
+    if (thinking.type !== "disabled")
+      fail("Modern history search request thinking is invalid");
+  }
 }
 function validateModelRoute(value, label) {
   if (!isRecord4(value))
@@ -31100,7 +31159,8 @@ function titleFromProjections(value) {
   return typeof title === "string" && title.trim().length > 0 && title.length <= DEEPSEEK_MODERN_SESSION_TITLE_MAX_LENGTH && !title.includes("\0") ? title : null;
 }
 function parseSummary(value) {
-  if (!isPlainRecord7(value) || !exactKeys5(value, ["sessionId", "updatedAt", "agentAvailable", "running", "blank"], ["parentSessionId", "origin", "cwd", "projections"]) || typeof value.running !== "boolean" || typeof value.blank !== "boolean" || typeof value.agentAvailable !== "boolean" || !validUpdatedAt(value.updatedAt)) {
+  if (!isPlainRecord7(value) || !exactKeys5(value, ["sessionId", "updatedAt", "agentAvailable", "running", "blank"], ["parentSessionId", "origin", "cwd", "projections", "formatStatus"]) || // DSH 0.2.1 marks rows whose stored log still awaits migration on open.
+  value.formatStatus !== void 0 && value.formatStatus !== "current" && value.formatStatus !== "migration-required" || typeof value.running !== "boolean" || typeof value.blank !== "boolean" || typeof value.agentAvailable !== "boolean" || !validUpdatedAt(value.updatedAt)) {
     throw sessionListError("protocolError", "DeepSeek Harness returned an invalid Session row");
   }
   const sessionId = boundedId(value.sessionId, "Session id");

package/app/plugins/opencode/plugin.mjs

@@ -24218,7 +24218,7 @@ var OpenCodeHarnessSession = class {
   }
   #projectPart(active, part) {
     if (part.type === "text" || part.type === "reasoning") {
-      if (part.type === "text" && part.ignored || !part.text)
+      if (part.type === "text" && part.ignored)
         return;
       const existing = active.items.get(part.id);
       if (!existing) {
@@ -25092,11 +25092,15 @@ function v2State(session, catalog, policy) {
     ...entry ? {
       resolvedModelLabel: entry.resolvedModelLabel ?? entry.label,
       availableThinkingOptions: catalog.thinkingOptions.filter((v) => entry.supportedThinkingOptionIds?.includes(v.id)),
-      effectiveThinkingOptionId: encodeOpenCodeVariant(session.model?.variant)
+      effectiveThinkingOptionId: effectiveVariant(session.model?.variant, entry)
     } : {},
     effectivePermissionModeId: decodeMode(mode?.effect)
   };
 }
+function effectiveVariant(variant, entry) {
+  const id = encodeOpenCodeVariant(variant);
+  return variant === "default" && !entry.supportedThinkingOptionIds?.includes(id) ? encodeOpenCodeVariant(void 0) : id;
+}
 function decodeMode(effect) {
   return effect === "allow" || effect === "ask" ? harnessPermissionModeIdSchema.parse(effect) : harnessPermissionModeIdSchema.parse("default");
 }

package/app/plugins/workbuddy/plugin.mjs

@@ -17523,6 +17523,27 @@ function nativeError(error51, profile = CODEBUDDY_RUNTIME_PROFILE) {
 function failure(code, message, profile = CODEBUDDY_RUNTIME_PROFILE) {
   return { ok: false, error: nativeError(new CodeBuddyError(code, message), profile) };
 }
+function nativeTurnError(stopReason, meta3, profile) {
+  const fallback = `Native Turn stopped: ${text(stopReason) || "unknown"} (${text(meta3["codebuddy.ai/outcome"]) || "no native outcome"})`;
+  const raw = text(meta3["codebuddy.ai/errorMessage"]).trim();
+  let diagnostic = "";
+  let category;
+  if (raw) {
+    try {
+      const error51 = record2(JSON.parse(raw));
+      const data = record2(error51.data);
+      diagnostic = text(data.details).trim() || text(error51.message).trim();
+      category = data.category;
+    } catch {
+      diagnostic = raw;
+    }
+  }
+  return nativeError(new CodeBuddyError(
+    // -32000 is shared by native refusals; the category identifies authentication failures.
+    category === "auth" ? "authenticationRequired" : "nativeFailure",
+    diagnostic ? `${fallback}: ${diagnostic}` : fallback
+  ), profile);
+}
 async function bounded(operation, milliseconds, label, onTimeout) {
   let timer;
   try {
@@ -25682,7 +25703,7 @@ var CodeBuddySession = class {
       // Those remain visible on individual Items; they do not fail the completed Turn.
       (!meta3["codebuddy.ai/outcome"] || meta3["codebuddy.ai/outcome"] === "SUCCESS" || meta3["codebuddy.ai/outcome"] === "PARTIAL_SUCCESS") ? { status: "succeeded" } : {
         status: "failed",
-        error: nativeError(new CodeBuddyError("nativeFailure", `Native Turn stopped: ${text(stop) || "unknown"} (${text(meta3["codebuddy.ai/outcome"]) || "no native outcome"})`), this.profile)
+        error: nativeTurnError(stop, meta3, this.profile)
       };
       const snapshot = await this.#snapshot();
       const added = snapshot.turns.filter((turn) => !active.before.has(turn.nativeTurnRef.nativeTurnKey));
@@ -25989,6 +26010,121 @@ function workBuddyDelegationArguments(environment, ephemeral) {
   return ["--append-system-prompt", WORKBUDDY_DELEGATION_INSTRUCTIONS];
 }
 
+// dist/credential-bootstrap.js
+var WORKBUDDY_CREDENTIAL_PRELOAD = String.raw`
+(() => {
+  const env = process.env;
+  const bootstrapEnvironment = [
+    "CODEBUDDY_SIDECAR_CREDENTIAL_BOOTSTRAP_SOCKET",
+    "CODEBUDDY_SIDECAR_READY_SOCKET",
+    "CODEBUDDY_SIDECAR_READY_TOKEN",
+    "CODEBUDDY_SIDECAR_READY_SESSION_ID",
+  ];
+  if (bootstrapEnvironment.some(name => env[name] !== undefined)) {
+    if (!["WORKBUDDY_AT_REST_ENCRYPTION", ...bootstrapEnvironment].every(name => env[name]?.trim())) {
+      throw Error("WorkBuddy credential bootstrap environment is incomplete");
+    }
+    return;
+  }
+  const policy = env.WORKBUDDY_AT_REST_ENCRYPTION?.trim();
+  // Other explicit policies remain owned by the native CLI.
+  if (policy && policy !== "fields") return;
+
+  let provider;
+  try {
+    provider = process._linkedBinding("electron_browser_workbuddy_storage");
+  } catch {
+    // Older app runtimes predate encrypted credential fields.
+    return;
+  }
+  const crypto = require("node:crypto");
+  const net = require("node:net");
+  const fs = require("node:fs");
+  const path = require("node:path");
+  let payload;
+  try { payload = JSON.parse(provider.loggerGet()); }
+  catch { throw Error("WorkBuddy credential key provider is unavailable"); }
+  let secret = payload && payload.atRestSecretKey;
+  const decoded = typeof secret === "string" ? Buffer.from(secret, "base64") : Buffer.alloc(0);
+  const valid = payload && payload.version === 1 && decoded.length === 32 &&
+    decoded.toString("base64") === secret && !decoded.every(byte => byte === 0);
+  decoded.fill(0);
+  if (!valid) throw Error("WorkBuddy credential key payload is unsupported");
+  // Match the native normalizeAtRestKeyPayload; the base64 text is hashed, not its decoded bytes.
+  const key = crypto.createHash("sha256").update(secret, "utf8").digest();
+  secret = undefined;
+  payload = undefined;
+  const token = crypto.randomBytes(24).toString("hex");
+  const sessionId = crypto.randomUUID();
+  let directory;
+  let socketPath;
+  if (process.platform === "win32") {
+    socketPath = "\\\\.\\pipe\\codexhost-wb-" + process.pid + "-" + token;
+  } else {
+    let root = require("node:os").tmpdir();
+    if (Buffer.byteLength(root) > 65) root = "/tmp";
+    directory = fs.mkdtempSync(path.join(root, "ch-wb-"));
+    fs.chmodSync(directory, 0o700);
+    socketPath = path.join(directory, "c");
+  }
+  const cleanup = () => {
+    if (directory) try { fs.rmSync(directory, {recursive:true,force:true}); } catch {}
+  };
+  process.once("exit", cleanup);
+  Object.assign(env, {
+    WORKBUDDY_AT_REST_ENCRYPTION: "fields",
+    CODEBUDDY_SIDECAR_CREDENTIAL_BOOTSTRAP_SOCKET: socketPath,
+    CODEBUDDY_SIDECAR_READY_SOCKET: socketPath + "-ready",
+    CODEBUDDY_SIDECAR_READY_TOKEN: token,
+    CODEBUDDY_SIDECAR_READY_SESSION_ID: sessionId,
+  });
+  let message = JSON.stringify({version:1,sessionId,token,pid:process.pid,bootstrap:{
+    version:1,policy:"fields",
+    symmetricKey:{keyId:crypto.createHash("sha256").update(key).digest("hex").slice(0,16),keyBase64:key.toString("base64")},
+    asymmetricUnavailable:"missing-key",
+  }}) + "\n";
+  key.fill(0);
+  let done = false;
+  let socket;
+  const finish = success => {
+    if (done) return;
+    done = true;
+    clearTimeout(timer);
+    socket && socket.destroy();
+    message = "";
+    cleanup();
+    process.removeListener("exit", cleanup);
+    if (!success) {
+      process.stderr.write("WorkBuddy credential bootstrap failed\n");
+      process.exit(1);
+    }
+  };
+  const timer = setTimeout(() => finish(false), 4500);
+  const connect = () => {
+    if (done) return;
+    socket = net.createConnection(socketPath);
+    let reply = "";
+    socket.once("connect", () => socket.end(message, () => { message = ""; }));
+    socket.on("data", chunk => {
+      reply += chunk;
+      if (reply.length > 1024) return finish(false);
+      if (!reply.includes("\n")) return;
+      try {
+        const result = JSON.parse(reply.slice(0, reply.indexOf("\n")));
+        finish(result.ok === true && result.policy === "fields");
+      } catch { finish(false); }
+    });
+    socket.once("end", () => { if (!done) finish(false); });
+    socket.once("error", error => {
+      socket.destroy();
+      if (error.code === "ENOENT" || error.code === "ECONNREFUSED") setTimeout(connect, 20);
+      else finish(false);
+    });
+  };
+  setImmediate(connect);
+})();
+`;
+
 // dist/discovery.js
 var WORKBUDDY_MACOS_ELECTRON = "/Applications/WorkBuddy AI.app/Contents/MacOS/Electron";
 var windowsRoots = [
@@ -26133,7 +26269,8 @@ function workBuddyInvocation(environment, ephemeral, dependenciesOrArguments = {
   } : configuredEnvironment;
   return {
     ...commandInvocation(executable, [
-      ...bundle ? [bundle.cli] : [],
+      ...bundle ? ["--eval", `${WORKBUDDY_CREDENTIAL_PRELOAD}
+require(process.argv[1]);`, bundle.cli] : [],
       ...nativeArguments ?? [
         "--acp",
         ...ephemeral ? ["--no-session-persistence"] : [],