@kenkaiiii/ggcoder 5.74.3 → 5.75.1

package/README.md

@@ -69,7 +69,7 @@ Switch mid-conversation with `/model`. Not locked to anyone.
 
 | Provider          | Models                                                             | Auth             |
 | ----------------- | ------------------------------------------------------------------ | ---------------- |
-| **Anthropic**     | Claude Fable 5.1, Opus 5.5, Sonnet 5.5, Haiku 4.5                    | OAuth            |
+| **Anthropic**     | Claude Fable 5.1, Opus 5.5, Sonnet 5.5, Haiku 5.5                    | OAuth            |
 | **OpenAI**        | GPT-6 Astra, GPT-6.1 Sol, GPT-6 Luna                               | OAuth            |
 | **Moonshot**      | Kimi K3, K2.8 Preview (Kimi sign-in), K2.7 Code                    | OAuth or API key |
 | **Z.AI (GLM)**    | GLM-5.3, GLM-5.3-Flash (image)                                     | API key          |

package/assets/skills/bulletproof/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: bulletproof
-description: Use when writing or reviewing code an attacker can reach — auth, sessions, tokens, crypto; untrusted input (requests, files, archives, repo content, model/tool output); secrets; per-user or multi-tenant data access (incl. Supabase/Firebase RLS); dependencies, install scripts, CI/CD, publishing, signing, updates; shelling out, deserialization, dynamic loading; LLM/agent/MCP tools; and pre-ship "can this be hacked" reviews, hardening, or suspected compromise. Fires mid-build on adding a login, upload, webhook, dependency, or tool. Do NOT use for local CLIs/libraries/scripts with no auth, network, secrets or multi-user data, styling/copy/docs, or legal/privacy questions (compliance-guard).
+description: "Use for attacker-reachable code: auth, tokens, crypto, untrusted input, secrets, tenant data, CI, agent tools. Do NOT use for local scripts without auth or network."
 license: Apache-2.0. Content is defensive engineering guidance, not a security certification or a penetration test. See references/provenance.md.
 compatibility: Works offline from the bundled references, which are a snapshot dated 3 October 2026. Version numbers, CVEs, and incident details decay fast; re-verify date-sensitive claims with web access before stating them as current. Never certifies that software is secure.
 ---

package/assets/skills/clarify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: clarify
-description: Use when requirements or a design are genuinely unsettled — the user asks to interrogate, sharpen, or stress-test a plan or spec before building, a new app or feature request leaves costly-to-reverse product decisions open, or mid-build discovery hits a decision that materially changes the result (scope, data model, UX, tradeoff). Settled terms and hard-to-reverse calls hand off to shared-language. Do NOT use for routine changes, clear bug reports (root-cause), reviewing finished work (code-review), or work whose requirements are already settled — bias to action there.
+description: Use when requirements are genuinely unsettled. Do NOT use for routine work.
 ---
 
 # Clarify

package/assets/skills/code-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: code-review
-description: Use when the user asks to review written work — a diff, PR, branch, commit range, or agent-generated change — or says "review before merge", "is this really done?", "check what the agent did". Checks spec compliance and build quality separately, verifies PR/"done" claims against the diff, and reports file:line findings by severity. Do NOT use while still mid-build (finish and run checks instead), for a plain diff summary, or for security review (bulletproof), performance (lean), migrations/data loss (durable), or UI review (evidence-led-ui).
+description: Use when asked to review a diff, PR or finished work. Do NOT use mid-build.
 ---
 
 # Code Review

package/assets/skills/compliance-guard/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: compliance-guard
-description: Use when shipping something real users reach and the work carries legal exposure — pre-launch or "is this safe to ship" reviews; mid-build features adding personal data, pixels/cookies, payments or auto-renewal, uploads/UGC, email/SMS/push, AI chatbots, minors, biometrics, scraping; drafting privacy policies, terms, disclosures. Also when a feature may need a licence or be illegal: health, finance, money movement, crypto, gambling, adult content, background checks, automated hiring/lending/housing decisions. Do NOT use for local-only scripts, prototypes with no real users or data, or changes touching no data, money, users or public surface; security hardening is bulletproof's lane.
+description: Use when shipping to real users risks legal exposure (personal data, payments, minors). Do NOT use for local work.
 license: Apache-2.0. Content is engineering guidance, not legal advice. See references/provenance.md.
 compatibility: Static review works offline from the bundled references. Legal status changes constantly; date-sensitive claims must be re-verified with web access before being stated as current. Never certifies compliance.
 ---

package/assets/skills/durable/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: durable
-description: Use when user data must not be lost or corrupted — creating the first table/schema, writing or running migrations, backfills/imports, any destructive op (delete, drop, truncate, reset, overwrite), before the agent itself runs a command against a database that may hold real data, setting up backups/recovery, or moving data between systems; plus "is my data safe / back up my app" checks. Any store — SQL, document, serverless, files, queues. Do NOT use for query speed or pool sizing (that is lean), access control over data (that is bulletproof), or privacy/legal deletion regimes (that is compliance-guard).
+description: "Use when data could be lost: migrations, destructive ops, real databases. Do NOT use for query speed."
 license: Data-durability engineering guidance, not a DBA certification. Sources and snapshot date are recorded at the foot of each reference file.
 compatibility: Snapshot dated 3 October 2026. Version behaviours, provider retention defaults and tool flags decay — re-verify with web access before asserting them as current.
 ---

package/assets/skills/evidence-led-ui/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: evidence-led-ui
-description: Use when building or changing web/mobile UI: net-new screens or pages, redesigns, design systems, visual polish, UI review, and mid-build edits touching colour, type, spacing, icons, focus/hover/selected states, borders, dropdown icons, motion, or UI copy layout. Also use when output looks generic or AI-made. Small styling fixes take the small-edit path. Do NOT use for behavior-only wiring with no visual state, copy-only text changes, database/API schemas, CLI output, or standalone image generation; speed/bundle work is lean, legal/privacy review of public pages is compliance-guard.
+description: Use when building or reviewing UI visuals. Do NOT use for behaviour-only changes.
 license: See LICENSES.md
 compatibility: Full review requires filesystem inspection and rendered screenshots (deferred `screenshot` tool); web research and device tooling are optional and unavailable checks must be reported as unverified.
 ---

package/assets/skills/lean/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: lean
-description: Use when speed or resource use matters — while writing features that load, render lists, fetch, poll, spawn processes or cache (inline gate); on "slow / laggy / eating RAM / fans spinning", leaks, zombie or orphan processes, bundle bloat, dead code, Core Web Vitals; for a performance pass or pre-ship "will this run smoothly" check. Any stack — web, backend/API/CLI, desktop (Electron, Tauri), mobile, native, game, ML. Do NOT use for correctness bugs where speed is not the complaint, copy/docs-only changes, design or visual polish (evidence-led-ui), data-loss or migration safety (durable), or when the user explicitly deprioritizes performance.
+description: Use when speed or resource use matters. Do NOT use for correctness bugs.
 license: Performance engineering guidance, not a benchmark certification. Sources and snapshot date are recorded at the foot of each reference file.
 compatibility: Snapshot dated 3 October 2026. Thresholds, tool names, and defaults decay — re-verify with web access before asserting them as current. Claims sourced to that date carry a SNAPSHOT marker.
 ---

package/assets/skills/refactoring/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: refactoring
-description: Use for behavior-preserving restructuring: extract, move, split, deduplicate, plan a refactor, or migrate an implementation behind an unchanged contract. Baseline tests, small steps, revert-on-red. Do NOT use for requested behavior or API-contract changes (including new return/error semantics), even when called a "refactor"; use the normal implementation workflow with regression tests and update affected callers together. Also exclude bug fixes (root-cause when stubborn), performance work (lean), data migrations (durable), styling/copy, TDD's refactor step (tdd), and rewrites.
+description: Use for behaviour-preserving restructuring behind an unchanged contract. Do NOT use for renames, bug fixes or behaviour changes.
 license: Behavior-preservation methodology synthesized from public sources (Fowler's Refactoring catalog, Tidy First?, and community agent skills by bienhoang, wondelai, mattpocock, jeffallan, vasilyu1983), audited 2026-09-12.
 ---
 

package/assets/skills/root-cause/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: root-cause
-description: Use when a bug resists the obvious fix, behaviour makes no sense, a symptom keeps coming back, a test is flaky, something "worked last week", or the user asks why something happens and the answer is not on the surface — including mid-build when a second fix attempt fails. Do NOT use for bugs with a clear repro and an obvious cause (reproduce, fix, re-run directly), security incident triage (bulletproof), or reviewing a diff (code-review).
+description: Use when a bug resists the obvious fix or is flaky. Do NOT use when the cause is obvious.
 ---
 
 # Root-Cause

package/assets/skills/shared-language/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: shared-language
-description: Use when a project's domain vocabulary is fuzzy or drifting (two names for one thing, one name for two), naming decisions keep recurring, or a hard-to-reverse architectural decision needs recording so it is not re-litigated or re-suggested — including mid-build when a term settles or a change contradicts an ADR. Do NOT use for throwaway scripts, projects too small to have recurring vocabulary, interviewing for requirements (clarify), or renames with no vocabulary decision (refactoring).
+description: Use when domain terms drift or a decision needs an ADR. Do NOT use for renames.
 ---
 
 # Shared Language

package/assets/skills/tdd/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: tdd
-description: Use when the user asks for test-driven development, red-green-refactor, "write the test first", or wants a feature or bug fix built test-first — including mid-build when they ask to switch to test-first. Do NOT use when tests are a verification step after the build, the project has no suite and the user has not asked for one, the change is throwaway probe code, or the goal is restructuring without behaviour change (refactoring) or finding an unknown cause (root-cause).
+description: Use when asked for test-first development. Do NOT use for post-build tests.
 ---
 
 # TDD

package/dist/app-sidecar/app-settings.d.ts

@@ -0,0 +1,65 @@
+import type { Provider, ThinkingLevel } from "@kenkaiiii/gg-ai";
+import type { KenModelPref } from "../core/ken-model.js";
+export declare const ALL_PROVIDERS: Provider[];
+/** Per-project model + thinking preferences. Persisted so each window (one
+ *  project cwd) restores its OWN model across app restarts — instead of every
+ *  window reading the same single global slot that the last writer clobbered. */
+export interface ProjectModelPrefs {
+    provider: Provider;
+    model: string;
+    thinkingEnabled?: boolean;
+    thinkingLevel?: ThinkingLevel;
+}
+export interface AppSettings {
+    /** Folder new projects are created inside. Defaults to ~/gg-projects. */
+    projectsRoot: string;
+    /** Model + thinking prefs keyed by normalized project cwd. A window restores
+     *  its own entry on boot; absent → global settings.json → provider default. */
+    projectModels?: Record<string, ProjectModelPrefs>;
+    /** Autopilot (auto-review) on/off keyed by normalized project cwd. Per-window
+     *  (one window = one cwd); absent/false → off. Restored on boot. */
+    autopilot?: Record<string, boolean>;
+    /** Ken's model override keyed by normalized project cwd. Absent → Ken follows
+     *  GG Coder's model (the historical behavior). Set → Ken (chat + autopilot)
+     *  uses this model regardless of GG Coder's. */
+    kenModels?: Record<string, KenModelPref>;
+    /** Extra folders scanned for projects alongside `projectsRoot`. */
+    projectRoots?: string[];
+    /** Project paths dismissed from the picker, as normalized cwds. */
+    hiddenProjects?: string[];
+}
+export declare function stringArray(value: unknown): string[] | undefined;
+export declare function appSettingsFile(): string;
+export declare function defaultProjectsRoot(): string;
+/** Normalize a project cwd to a stable settings key so trailing slashes /
+ *  relative segments collapse — the same project always maps to one entry. */
+export declare function projectModelKey(cwd: string): string;
+export declare function loadAppSettings(): Promise<AppSettings>;
+export declare function saveAppSettings(settings: AppSettings): Promise<void>;
+/** Read this project's persisted model/thinking prefs, if any. */
+export declare function loadProjectModelPrefs(cwd: string): Promise<ProjectModelPrefs | undefined>;
+/** Persist this project's model/thinking prefs via read-modify-write so the rest
+ *  of the settings file (projectsRoot, other projects' entries) is preserved. */
+export declare function saveProjectModelPrefs(cwd: string, prefs: ProjectModelPrefs): Promise<void>;
+/** Read this project's persisted Ken model override, if any. */
+export declare function loadKenModelPref(cwd: string): Promise<KenModelPref | undefined>;
+/** Persist (or with null, clear) this project's Ken model override via
+ *  read-modify-write so the rest of the settings file is preserved. */
+export declare function saveKenModelPref(cwd: string, pref: KenModelPref | null): Promise<void>;
+/** Read this project's persisted autopilot flag (default off). */
+export declare function loadAutopilot(cwd: string): Promise<boolean>;
+/** Persist this project's autopilot flag via read-modify-write so the rest of
+ *  the settings file (projectsRoot, model map, other projects) is preserved. */
+export declare function saveAutopilot(cwd: string, enabled: boolean): Promise<void>;
+/**
+ * Persist the active model selection to ~/.gg/settings.json so it survives app
+ * restarts. Mirrors the CLI's handleModelSelect persistence (App.tsx).
+ */
+export declare function persistModelSelection(settingsFile: string, provider: Provider, model: string): Promise<void>;
+/**
+ * Persist the thinking level to ~/.gg/settings.json so it survives app restarts.
+ * Mirrors the CLI's handleToggleThinking persistence (App.tsx).
+ */
+export declare function persistThinkingLevel(settingsFile: string, level: ThinkingLevel | undefined): Promise<void>;
+/** Validate a project folder name: lowercase letters, digits, dashes only. */
+export declare function isValidProjectName(name: string): boolean;

package/dist/app-sidecar/app-settings.js

@@ -0,0 +1,147 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { SettingsManager } from "../core/settings-manager.js";
+import { log } from "../core/logger.js";
+export const ALL_PROVIDERS = [
+    // US
+    "anthropic",
+    "openai",
+    "gemini",
+    "xai",
+    // China
+    "moonshot",
+    "glm",
+    "minimax",
+    "xiaomi",
+    "deepseek",
+    // Open-community gateway, before the provider-agnostic one
+    "huggingface",
+    // Japan, then provider-agnostic gateway last
+    "sakana",
+    "openrouter",
+];
+export function stringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const out = value.filter((v) => typeof v === "string" && v.trim().length > 0);
+    return out.length > 0 ? out : undefined;
+}
+export function appSettingsFile() {
+    return path.join(os.homedir(), ".gg", "gg-app.json");
+}
+export function defaultProjectsRoot() {
+    return path.join(os.homedir(), "gg-projects");
+}
+/** Normalize a project cwd to a stable settings key so trailing slashes /
+ *  relative segments collapse — the same project always maps to one entry. */
+export function projectModelKey(cwd) {
+    return path.resolve(cwd);
+}
+export async function loadAppSettings() {
+    try {
+        const raw = JSON.parse(await fs.readFile(appSettingsFile(), "utf-8"));
+        return {
+            projectsRoot: typeof raw.projectsRoot === "string" && raw.projectsRoot.trim()
+                ? raw.projectsRoot
+                : defaultProjectsRoot(),
+            // Preserve the per-project map verbatim (validated + written by the
+            // model/thinking handlers below).
+            projectModels: raw.projectModels && typeof raw.projectModels === "object" ? raw.projectModels : undefined,
+            autopilot: raw.autopilot && typeof raw.autopilot === "object" ? raw.autopilot : undefined,
+            kenModels: raw.kenModels && typeof raw.kenModels === "object" ? raw.kenModels : undefined,
+            projectRoots: stringArray(raw.projectRoots),
+            hiddenProjects: stringArray(raw.hiddenProjects),
+        };
+    }
+    catch {
+        return { projectsRoot: defaultProjectsRoot() };
+    }
+}
+export async function saveAppSettings(settings) {
+    await fs.mkdir(path.dirname(appSettingsFile()), { recursive: true });
+    await fs.writeFile(appSettingsFile(), JSON.stringify(settings, null, 2), "utf-8");
+}
+/** Read this project's persisted model/thinking prefs, if any. */
+export async function loadProjectModelPrefs(cwd) {
+    const s = await loadAppSettings();
+    return s.projectModels?.[projectModelKey(cwd)];
+}
+/** Persist this project's model/thinking prefs via read-modify-write so the rest
+ *  of the settings file (projectsRoot, other projects' entries) is preserved. */
+export async function saveProjectModelPrefs(cwd, prefs) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    s.projectModels = { ...(s.projectModels ?? {}), [key]: prefs };
+    await saveAppSettings(s);
+}
+/** Read this project's persisted Ken model override, if any. */
+export async function loadKenModelPref(cwd) {
+    const s = await loadAppSettings();
+    return s.kenModels?.[projectModelKey(cwd)];
+}
+/** Persist (or with null, clear) this project's Ken model override via
+ *  read-modify-write so the rest of the settings file is preserved. */
+export async function saveKenModelPref(cwd, pref) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    const next = { ...(s.kenModels ?? {}) };
+    if (pref)
+        next[key] = pref;
+    else
+        delete next[key];
+    s.kenModels = next;
+    await saveAppSettings(s);
+}
+/** Read this project's persisted autopilot flag (default off). */
+export async function loadAutopilot(cwd) {
+    const s = await loadAppSettings();
+    return s.autopilot?.[projectModelKey(cwd)] ?? false;
+}
+/** Persist this project's autopilot flag via read-modify-write so the rest of
+ *  the settings file (projectsRoot, model map, other projects) is preserved. */
+export async function saveAutopilot(cwd, enabled) {
+    const s = await loadAppSettings();
+    const key = projectModelKey(cwd);
+    s.autopilot = { ...(s.autopilot ?? {}), [key]: enabled };
+    await saveAppSettings(s);
+}
+/**
+ * Persist the active model selection to ~/.gg/settings.json so it survives app
+ * restarts. Mirrors the CLI's handleModelSelect persistence (App.tsx).
+ */
+export async function persistModelSelection(settingsFile, provider, model) {
+    try {
+        const sm = new SettingsManager(settingsFile);
+        await sm.load();
+        await sm.set("defaultProvider", provider);
+        await sm.set("defaultModel", model);
+    }
+    catch (err) {
+        log("WARN", "app-sidecar", "failed to persist model selection", { err: String(err) });
+    }
+}
+/**
+ * Persist the thinking level to ~/.gg/settings.json so it survives app restarts.
+ * Mirrors the CLI's handleToggleThinking persistence (App.tsx).
+ */
+export async function persistThinkingLevel(settingsFile, level) {
+    try {
+        const sm = new SettingsManager(settingsFile);
+        await sm.load();
+        await sm.set("thinkingEnabled", !!level);
+        if (level)
+            await sm.set("thinkingLevel", level);
+    }
+    catch (err) {
+        log("WARN", "app-sidecar", "failed to persist thinking level", { err: String(err) });
+    }
+}
+/** Validate a project folder name: lowercase letters, digits, dashes only. */
+export function isValidProjectName(name) {
+    return /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name);
+}
+// ── History reconstruction types ──────────────────────────
+// Mirrors HistoryEntry in gg-app/src/agent.ts — the wire shape the webview
+// receives from GET /history. Fields beyond role/text carry the transcript
+//# sourceMappingURL=app-settings.js.map

package/dist/app-sidecar/app-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-settings.js","sourceRoot":"","sources":["../../src/app-sidecar/app-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAiB,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC,KAAK;IACL,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,UAAU;IACV,KAAK;IACL,SAAS;IACT,QAAQ;IACR,UAAU;IACV,2DAA2D;IAC3D,aAAa;IACb,6CAA6C;IAC7C,QAAQ;IACR,YAAY;CACb,CAAC;AAmCF,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,OAAO,CAAC,CAAyB,CAAC;QAC9F,OAAO;YACL,YAAY,EACV,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;gBAC7D,CAAC,CAAC,GAAG,CAAC,YAAY;gBAClB,CAAC,CAAC,mBAAmB,EAAE;YAC3B,oEAAoE;YACpE,kCAAkC;YAClC,aAAa,EACX,GAAG,CAAC,aAAa,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC5F,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACzF,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;YAC3C,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;SAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAqB;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;IAClC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,KAAwB;IAC/E,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;IAC/D,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;IAClC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;uEACuE;AACvE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAyB;IAC3E,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;IACxC,IAAI,IAAI;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;IACnB,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;IAClC,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;AACtD,CAAC;AAED;gFACgF;AAChF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,OAAgB;IAC/D,MAAM,CAAC,GAAG,MAAM,eAAe,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;IACzD,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,QAAkB,EAClB,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAuC,CAAC,CAAC;QACzE,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,mCAAmC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,KAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK;YAAE,MAAM,EAAE,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,6DAA6D;AAC7D,2EAA2E;AAC3E,2EAA2E"}

package/dist/app-sidecar/attachments.d.ts

@@ -0,0 +1,11 @@
+export interface AppAttachment {
+    kind: "image" | "video" | "file";
+    name: string;
+    mediaType: string;
+    /** base64 (no data: prefix). */
+    data: string;
+}
+export interface PreparedAttachment extends AppAttachment {
+    path?: string;
+}
+export declare function prepareAttachments(cwd: string, attachments: AppAttachment[]): Promise<PreparedAttachment[]>;

package/dist/app-sidecar/attachments.js

@@ -0,0 +1,47 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { shrinkToFit, validateVisionImage } from "../utils/image.js";
+export async function prepareAttachments(cwd, attachments) {
+    const dir = path.join(cwd, ".gg", "uploads");
+    await fs.mkdir(dir, { recursive: true }).catch(() => { });
+    const out = [];
+    for (const a of attachments) {
+        // Sanitize the filename and prefix with a short timestamp to avoid clobber.
+        const safe = a.name.replace(/[^\w.-]+/g, "_").slice(-80) || "file";
+        const fileName = `${Date.now().toString(36)}-${safe}`;
+        const filePath = path.join(dir, fileName);
+        const buf = Buffer.from(a.data, "base64");
+        // Validate and cap image attachments before they become native image content
+        // blocks. Anthropic applies a 2000 px per-dimension cap once conversation
+        // history contains more than 20 images, so every attachment must be safe for
+        // later turns too. Keep the original on disk, but send the resized bytes.
+        // Corrupt or unsupported images become plain files so they cannot reject the
+        // entire provider request.
+        let prepared = { ...a };
+        if (a.kind === "image") {
+            try {
+                const resized = await shrinkToFit(buf, a.mediaType);
+                const validatedType = await validateVisionImage(resized.buffer);
+                prepared = validatedType
+                    ? {
+                        ...a,
+                        mediaType: validatedType,
+                        data: resized.buffer.toString("base64"),
+                    }
+                    : { ...a, kind: "file" };
+            }
+            catch {
+                prepared = { ...a, kind: "file" };
+            }
+        }
+        try {
+            await fs.writeFile(filePath, buf);
+            out.push({ ...prepared, path: filePath });
+        }
+        catch {
+            out.push({ ...prepared });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=attachments.js.map

package/dist/app-sidecar/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../../src/app-sidecar/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAiBrE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,WAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC;QACnE,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,2BAA2B;QAC3B,IAAI,QAAQ,GAAuB,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpD,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAChE,QAAQ,GAAG,aAAa;oBACtB,CAAC,CAAC;wBACE,GAAG,CAAC;wBACJ,SAAS,EAAE,aAAa;wBACxB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;qBACxC;oBACH,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/app-sidecar/auth-routes.d.ts

@@ -0,0 +1,3 @@
+import type http from "node:http";
+import type { SessionRouteContext } from "./route-context.js";
+export declare function handleAuthRoutes(ctx: SessionRouteContext, req: http.IncomingMessage, res: http.ServerResponse, url: string, method: string): boolean;