@loicngr/kobo 1.1.1 → 1.3.0

package/dist/mcp-server/kobo-tasks-handlers.js

@@ -1,3 +1,7 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { nanoid } from 'nanoid';
+export const VALID_TASK_STATUSES = ['pending', 'in_progress', 'done'];
 function rowToDto(row) {
     return {
         id: row.id,
@@ -25,3 +29,146 @@ export function markTaskDoneHandler(db, workspaceId, taskId) {
         .get(taskId);
     return { success: true, task: rowToDto(row) };
 }
+export function createTaskHandler(db, workspaceId, data) {
+    if (!data.title?.trim()) {
+        throw new Error('title is required');
+    }
+    // Verify workspace exists
+    const ws = db.prepare('SELECT id FROM workspaces WHERE id = ?').get(workspaceId);
+    if (!ws) {
+        throw new Error(`Workspace '${workspaceId}' not found`);
+    }
+    const id = nanoid();
+    const now = new Date().toISOString();
+    const isAC = data.is_acceptance_criterion ? 1 : 0;
+    // Append at the end: max(sort_order) + 1
+    const maxRow = db
+        .prepare('SELECT COALESCE(MAX(sort_order), -1) AS max FROM tasks WHERE workspace_id = ?')
+        .get(workspaceId);
+    const sortOrder = maxRow.max + 1;
+    db.prepare('INSERT INTO tasks (id, workspace_id, title, status, is_acceptance_criterion, sort_order, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)').run(id, workspaceId, data.title.trim(), 'pending', isAC, sortOrder, now, now);
+    const row = db.prepare('SELECT id, title, status, is_acceptance_criterion FROM tasks WHERE id = ?').get(id);
+    return rowToDto(row);
+}
+export function updateTaskHandler(db, workspaceId, taskId, data) {
+    // Verify task belongs to workspace
+    const existing = db.prepare('SELECT id FROM tasks WHERE id = ? AND workspace_id = ?').get(taskId, workspaceId);
+    if (!existing) {
+        throw new Error(`Task '${taskId}' not found in workspace '${workspaceId}'`);
+    }
+    const sets = [];
+    const values = [];
+    if (data.title !== undefined) {
+        if (!data.title.trim())
+            throw new Error('title cannot be empty');
+        sets.push('title = ?');
+        values.push(data.title.trim());
+    }
+    if (data.status !== undefined) {
+        if (!VALID_TASK_STATUSES.includes(data.status)) {
+            throw new Error(`Invalid status '${data.status}'. Must be one of: ${VALID_TASK_STATUSES.join(', ')}`);
+        }
+        sets.push('status = ?');
+        values.push(data.status);
+    }
+    if (data.is_acceptance_criterion !== undefined) {
+        sets.push('is_acceptance_criterion = ?');
+        values.push(data.is_acceptance_criterion ? 1 : 0);
+    }
+    if (sets.length === 0) {
+        throw new Error('No fields to update (provide title, status, or is_acceptance_criterion)');
+    }
+    sets.push('updated_at = ?');
+    values.push(new Date().toISOString());
+    values.push(taskId);
+    db.prepare(`UPDATE tasks SET ${sets.join(', ')} WHERE id = ?`).run(...values);
+    const row = db
+        .prepare('SELECT id, title, status, is_acceptance_criterion FROM tasks WHERE id = ?')
+        .get(taskId);
+    return rowToDto(row);
+}
+export function deleteTaskHandler(db, workspaceId, taskId) {
+    const result = db.prepare('DELETE FROM tasks WHERE id = ? AND workspace_id = ?').run(taskId, workspaceId);
+    if (result.changes === 0) {
+        throw new Error(`Task '${taskId}' not found in workspace '${workspaceId}'`);
+    }
+    return { success: true, task_id: taskId };
+}
+export function getDevServerStatusHandler(db, workspaceId) {
+    const row = db.prepare('SELECT dev_server_status FROM workspaces WHERE id = ?').get(workspaceId);
+    if (!row) {
+        throw new Error(`Workspace '${workspaceId}' not found`);
+    }
+    return { workspaceId, status: row.dev_server_status };
+}
+export function getSettingsHandler(settingsPath, projectPath) {
+    // Shape is determined solely by whether projectPath was provided:
+    //  - with projectPath → { global, project }
+    //  - without         → { global, projects }
+    // The `error` field is added on top when settings are unavailable.
+    if (!settingsPath || !fs.existsSync(settingsPath)) {
+        const base = projectPath ? { global: null, project: null } : { global: null, projects: [] };
+        return { ...base, error: 'Settings file not available' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+    }
+    catch (err) {
+        throw new Error(`Failed to read settings: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const global = parsed.global ?? null;
+    const projects = Array.isArray(parsed.projects) ? parsed.projects : [];
+    if (projectPath) {
+        const project = projects.find((p) => p.path === projectPath) ?? null;
+        return { global, project };
+    }
+    return { global, projects };
+}
+export function getWorkspaceInfoHandler(db, workspaceId) {
+    const row = db
+        .prepare('SELECT id, name, project_path, source_branch, working_branch, status, notion_url, notion_page_id, model, dev_server_status, created_at, updated_at FROM workspaces WHERE id = ?')
+        .get(workspaceId);
+    if (!row) {
+        throw new Error(`Workspace '${workspaceId}' not found`);
+    }
+    return {
+        id: row.id,
+        name: row.name,
+        projectPath: row.project_path,
+        sourceBranch: row.source_branch,
+        workingBranch: row.working_branch,
+        worktreePath: path.join(row.project_path, '.worktrees', row.working_branch),
+        status: row.status,
+        model: row.model,
+        notionUrl: row.notion_url,
+        notionPageId: row.notion_page_id,
+        devServerStatus: row.dev_server_status,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+export function listWorkspaceImagesHandler(worktreePath) {
+    const imagesDir = path.join(worktreePath, '.ai', 'images');
+    const indexPath = path.join(imagesDir, 'index.json');
+    if (!fs.existsSync(indexPath))
+        return [];
+    let entries;
+    try {
+        entries = JSON.parse(fs.readFileSync(indexPath, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    // Read directory once — imagesDir is guaranteed to exist because indexPath does
+    const files = fs.readdirSync(imagesDir);
+    return entries.map((e) => {
+        const match = files.find((f) => f.startsWith(`${e.uid}.`));
+        return {
+            uid: e.uid,
+            originalName: e.originalName,
+            relativePath: match ? path.join('.ai', 'images', match) : '',
+            createdAt: e.createdAt,
+        };
+    });
+}

package/dist/mcp-server/kobo-tasks-server.js

@@ -3,9 +3,10 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import Database from 'better-sqlite3';
-import { listTasksHandler, markTaskDoneHandler } from './kobo-tasks-handlers.js';
+import { createTaskHandler, deleteTaskHandler, getDevServerStatusHandler, getSettingsHandler, getWorkspaceInfoHandler, listTasksHandler, listWorkspaceImagesHandler, markTaskDoneHandler, updateTaskHandler, } from './kobo-tasks-handlers.js';
 const workspaceId = process.env.KOBO_WORKSPACE_ID;
 const dbPath = process.env.KOBO_DB_PATH;
+const settingsPath = process.env.KOBO_SETTINGS_PATH;
 const backendUrl = process.env.KOBO_BACKEND_URL ?? 'http://localhost:3000';
 if (!workspaceId) {
     console.error('[kobo-tasks-server] KOBO_WORKSPACE_ID env var is required');
@@ -37,12 +38,36 @@ async function notifyBackend(taskId) {
         console.error('[kobo-tasks-server] notify-done failed:', err);
     }
 }
+async function notifyTasksUpdated() {
+    try {
+        const url = `${backendUrl}/api/workspaces/${workspaceId}/tasks/notify-updated`;
+        await fetch(url, { method: 'POST' });
+    }
+    catch (err) {
+        console.error('[kobo-tasks-server] notify-updated failed:', err);
+    }
+}
+async function backendRequest(method, pathname, body) {
+    const url = `${backendUrl}${pathname}`;
+    const init = { method };
+    if (body !== undefined) {
+        init.headers = { 'Content-Type': 'application/json' };
+        init.body = JSON.stringify(body);
+    }
+    const res = await fetch(url, init);
+    if (!res.ok) {
+        const errText = await res.text().catch(() => '');
+        throw new Error(`Backend ${method} ${pathname} returned ${res.status}: ${errText}`);
+    }
+    const text = await res.text();
+    return text ? JSON.parse(text) : null;
+}
 const server = new Server({ name: 'kobo-tasks', version: '1.0.0' }, { capabilities: { tools: {} } });
 server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: [
         {
             name: 'list_tasks',
-            description: 'List all tasks and acceptance criteria for the current workspace with their IDs and current status. Call this first to discover task IDs before calling mark_task_done.',
+            description: 'List all tasks and acceptance criteria for the current workspace with their IDs and current status. Call this first to discover task IDs before calling mark_task_done / update_task / delete_task.',
             inputSchema: {
                 type: 'object',
                 properties: {},
@@ -63,43 +88,225 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                 required: ['task_id'],
             },
         },
+        {
+            name: 'create_task',
+            description: 'Create a new task or acceptance criterion for the current workspace. Appended at the end of the list.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    title: { type: 'string', description: 'Task title' },
+                    is_acceptance_criterion: {
+                        type: 'boolean',
+                        description: 'Whether this is an acceptance criterion (default: false)',
+                    },
+                },
+                required: ['title'],
+            },
+        },
+        {
+            name: 'update_task',
+            description: 'Update an existing task — change title, status, or is_acceptance_criterion flag. At least one field is required.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    task_id: { type: 'string', description: 'The ID of the task to update' },
+                    title: { type: 'string', description: 'New title (optional)' },
+                    status: {
+                        type: 'string',
+                        enum: ['pending', 'in_progress', 'done'],
+                        description: 'New status (optional)',
+                    },
+                    is_acceptance_criterion: {
+                        type: 'boolean',
+                        description: 'Toggle acceptance criterion flag (optional)',
+                    },
+                },
+                required: ['task_id'],
+            },
+        },
+        {
+            name: 'delete_task',
+            description: 'Delete a task from the current workspace permanently.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    task_id: { type: 'string', description: 'The ID of the task to delete' },
+                },
+                required: ['task_id'],
+            },
+        },
+        {
+            name: 'get_settings',
+            description: 'Read Kōbō settings (global + projects). Optionally filter to a specific project by path to get both global and that project override.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    project_path: {
+                        type: 'string',
+                        description: 'Optional project path to resolve a specific project entry',
+                    },
+                },
+                required: [],
+            },
+        },
+        {
+            name: 'get_dev_server_status',
+            description: 'Check whether the dev server is running for the current workspace.',
+            inputSchema: {
+                type: 'object',
+                properties: {},
+                required: [],
+            },
+        },
+        {
+            name: 'get_workspace_info',
+            description: 'Get all metadata about the current workspace (name, project path, branches, model, notion URL, worktree path, status).',
+            inputSchema: { type: 'object', properties: {}, required: [] },
+        },
+        {
+            name: 'start_dev_server',
+            description: 'Start the dev server configured for the current workspace.',
+            inputSchema: { type: 'object', properties: {}, required: [] },
+        },
+        {
+            name: 'stop_dev_server',
+            description: 'Stop the dev server of the current workspace.',
+            inputSchema: { type: 'object', properties: {}, required: [] },
+        },
+        {
+            name: 'get_dev_server_logs',
+            description: 'Fetch the last N lines of the dev server logs for the current workspace.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    tail: {
+                        type: 'number',
+                        description: 'Number of lines to fetch from the end (default: 200)',
+                    },
+                },
+                required: [],
+            },
+        },
+        {
+            name: 'list_workspace_images',
+            description: 'List all images uploaded to the current workspace (from .ai/images/index.json). Returns uid, originalName, relativePath and createdAt for each image.',
+            inputSchema: { type: 'object', properties: {}, required: [] },
+        },
+        {
+            name: 'get_git_info',
+            description: 'Get git stats for the current workspace (commit count, files changed, insertions, deletions, PR URL if any).',
+            inputSchema: { type: 'object', properties: {}, required: [] },
+        },
+        {
+            name: 'set_workspace_status',
+            description: 'Update the current workspace status. Valid values: idle, completed, error. Transitions are validated by the backend.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    status: {
+                        type: 'string',
+                        description: 'New status (e.g. idle, completed)',
+                    },
+                },
+                required: ['status'],
+            },
+        },
     ],
 }));
+function ok(data) {
+    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
+}
+function fail(message) {
+    return { content: [{ type: 'text', text: `Error: ${message}` }], isError: true };
+}
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
-    if (name === 'list_tasks') {
-        const tasks = listTasksHandler(db, workspaceId);
-        return {
-            content: [{ type: 'text', text: JSON.stringify(tasks, null, 2) }],
-        };
-    }
-    if (name === 'mark_task_done') {
-        const taskId = args?.task_id;
-        if (!taskId) {
-            return {
-                content: [{ type: 'text', text: 'Error: task_id parameter is required' }],
-                isError: true,
-            };
+    const a = (args ?? {});
+    try {
+        if (name === 'list_tasks') {
+            return ok(listTasksHandler(db, workspaceId));
         }
-        try {
+        if (name === 'mark_task_done') {
+            const taskId = a.task_id;
+            if (!taskId)
+                return fail('task_id parameter is required');
             const result = markTaskDoneHandler(db, workspaceId, taskId);
             void notifyBackend(taskId);
-            return {
-                content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
-            };
+            return ok(result);
+        }
+        if (name === 'create_task') {
+            const title = a.title;
+            if (!title)
+                return fail('title parameter is required');
+            const task = createTaskHandler(db, workspaceId, {
+                title,
+                is_acceptance_criterion: a.is_acceptance_criterion,
+            });
+            void notifyTasksUpdated();
+            return ok(task);
         }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            return {
-                content: [{ type: 'text', text: `Error: ${message}` }],
-                isError: true,
-            };
+        if (name === 'update_task') {
+            const taskId = a.task_id;
+            if (!taskId)
+                return fail('task_id parameter is required');
+            const task = updateTaskHandler(db, workspaceId, taskId, {
+                title: a.title,
+                status: a.status,
+                is_acceptance_criterion: a.is_acceptance_criterion,
+            });
+            void notifyTasksUpdated();
+            return ok(task);
         }
+        if (name === 'delete_task') {
+            const taskId = a.task_id;
+            if (!taskId)
+                return fail('task_id parameter is required');
+            const result = deleteTaskHandler(db, workspaceId, taskId);
+            void notifyTasksUpdated();
+            return ok(result);
+        }
+        if (name === 'get_settings') {
+            return ok(getSettingsHandler(settingsPath, a.project_path));
+        }
+        if (name === 'get_dev_server_status') {
+            return ok(getDevServerStatusHandler(db, workspaceId));
+        }
+        if (name === 'get_workspace_info') {
+            return ok(getWorkspaceInfoHandler(db, workspaceId));
+        }
+        if (name === 'start_dev_server') {
+            const result = await backendRequest('POST', `/api/dev-server/${workspaceId}/start`);
+            return ok(result);
+        }
+        if (name === 'stop_dev_server') {
+            const result = await backendRequest('POST', `/api/dev-server/${workspaceId}/stop`);
+            return ok(result);
+        }
+        if (name === 'get_dev_server_logs') {
+            const tail = a.tail ?? 200;
+            const result = await backendRequest('GET', `/api/dev-server/${workspaceId}/logs?tail=${tail}`);
+            return ok(result);
+        }
+        if (name === 'list_workspace_images') {
+            const info = getWorkspaceInfoHandler(db, workspaceId);
+            return ok(listWorkspaceImagesHandler(info.worktreePath));
+        }
+        if (name === 'get_git_info') {
+            const result = await backendRequest('GET', `/api/workspaces/${workspaceId}/git-stats`);
+            return ok(result);
+        }
+        if (name === 'set_workspace_status') {
+            const status = a.status;
+            if (!status)
+                return fail('status parameter is required');
+            const result = await backendRequest('PATCH', `/api/workspaces/${workspaceId}`, { status });
+            return ok(result);
+        }
+        return fail(`Unknown tool: ${name}`);
+    }
+    catch (err) {
+        return fail(err instanceof Error ? err.message : String(err));
     }
-    return {
-        content: [{ type: 'text', text: `Unknown tool: ${name}` }],
-        isError: true,
-    };
 });
 const transport = new StdioServerTransport();
 server.connect(transport).catch((err) => {

package/dist/server/db/migrations.js

@@ -1,20 +1,71 @@
 import { initSchema } from './schema.js';
-export const SCHEMA_VERSION = 1;
+export const migrations = [
+    {
+        version: 2,
+        name: 'add-permission-mode',
+        migrate: (db) => {
+            db.exec("ALTER TABLE workspaces ADD COLUMN permission_mode TEXT NOT NULL DEFAULT 'auto-accept'");
+        },
+    },
+];
+/** Current schema version — always equals the highest migration version. */
+export const SCHEMA_VERSION = migrations.length > 0 ? migrations[migrations.length - 1].version : 1;
 export function runMigrations(db) {
+    // Create the history table (replaces the old single-row schema_version table).
     db.exec(`
-    CREATE TABLE IF NOT EXISTS schema_version (
-      version INTEGER NOT NULL
+    CREATE TABLE IF NOT EXISTS schema_migrations (
+      version  INTEGER PRIMARY KEY,
+      name     TEXT NOT NULL,
+      applied_at TEXT NOT NULL
     )
   `);
-    const row = db.prepare('SELECT version FROM schema_version LIMIT 1').get();
-    const currentVersion = row?.version ?? 0;
-    if (currentVersion < 1) {
+    // ── Backward compat: migrate from legacy schema_version table ──────────────
+    const hasLegacy = db.prepare("SELECT count(*) as c FROM sqlite_master WHERE type='table' AND name='schema_version'").get().c > 0;
+    if (hasLegacy) {
+        const legacyRow = db.prepare('SELECT version FROM schema_version LIMIT 1').get();
+        const legacyVersion = legacyRow?.version ?? 0;
+        // Back-fill history for all migrations that were already applied under the old system.
+        if (legacyVersion >= 1) {
+            const now = new Date().toISOString();
+            // Version 1 = initSchema (always applied if legacyVersion >= 1)
+            db.prepare('INSERT OR IGNORE INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)').run(1, 'init-schema', now);
+            for (const m of migrations) {
+                if (m.version <= legacyVersion) {
+                    db.prepare('INSERT OR IGNORE INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)').run(m.version, m.name, now);
+                }
+            }
+        }
+        db.exec('DROP TABLE schema_version');
+    }
+    // ── Determine current state ────────────────────────────────────────────────
+    const applied = new Set(db.prepare('SELECT version FROM schema_migrations').all().map((r) => r.version));
+    // Fresh install — no migrations applied yet.
+    if (!applied.has(1)) {
         initSchema(db);
-        if (currentVersion === 0) {
-            db.prepare('INSERT INTO schema_version (version) VALUES (?)').run(1);
+        const now = new Date().toISOString();
+        db.prepare('INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)').run(1, 'init-schema', now);
+        // Mark all incremental migrations as applied (initSchema creates the latest shape).
+        for (const m of migrations) {
+            db.prepare('INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)').run(m.version, m.name, now);
         }
-        else {
-            db.prepare('UPDATE schema_version SET version = ?').run(1);
+        return;
+    }
+    // Apply pending migrations sequentially.
+    for (const m of migrations) {
+        if (!applied.has(m.version)) {
+            m.migrate(db);
+            db.prepare('INSERT INTO schema_migrations (version, name, applied_at) VALUES (?, ?, ?)').run(m.version, m.name, new Date().toISOString());
         }
     }
 }
+/** Return the full migration history (for diagnostics / admin UI). */
+export function getMigrationHistory(db) {
+    try {
+        return db
+            .prepare('SELECT version, name, applied_at FROM schema_migrations ORDER BY version')
+            .all();
+    }
+    catch {
+        return [];
+    }
+}

package/dist/server/db/schema.js

@@ -10,6 +10,7 @@ export function initSchema(db) {
       notion_url TEXT,
       notion_page_id TEXT,
       model TEXT NOT NULL DEFAULT 'claude-opus-4-6',
+      permission_mode TEXT NOT NULL DEFAULT 'auto-accept',
       dev_server_status TEXT NOT NULL DEFAULT 'stopped',
       archived_at TEXT,
       created_at TEXT NOT NULL,

package/dist/server/index.js

@@ -9,10 +9,11 @@ import { getDb } from './db/index.js';
 import { runMigrations } from './db/migrations.js';
 import devServerRouter from './routes/dev-server.js';
 import gitRouter from './routes/git.js';
+import imagesRouter from './routes/images.js';
 import notionRouter from './routes/notion.js';
 import settingsRouter from './routes/settings.js';
 import workspacesRouter from './routes/workspaces.js';
-import { getAvailableSkills, sendMessage, startAgent, stopAgent } from './services/agent-manager.js';
+import { getAvailableSkills, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, } from './services/agent-manager.js';
 import { startDevServer, stopDevServer } from './services/dev-server-service.js';
 import { emit, handleConnection, setMessageHandler } from './services/websocket-service.js';
 import { getLatestSession, getWorkspace, updateWorkspaceStatus } from './services/workspace-service.js';
@@ -31,14 +32,18 @@ console.log(`[kobo] Kōbō home: ${getKoboHome()}`);
 // 1. Initialize DB + run migrations
 const db = getDb();
 runMigrations(db);
-// 2. Initialize process cleanup
+// 2. Initialize process cleanup, agent watchdog, and PR watcher
 initProcessCleanup();
+startWatchdog();
+import { startPrWatcher } from './services/pr-watcher-service.js';
+startPrWatcher();
 // 3. Create Hono app
 const app = new Hono();
 // Health check (root / is handled by the SPA catch-all below)
 app.get('/api/health', (c) => c.json({ status: 'ok', version: '0.1.0' }));
 // 4. Mount route sub-routers
 app.route('/api/workspaces', workspacesRouter);
+app.route('/api/workspaces', imagesRouter);
 app.route('/api/notion', notionRouter);
 app.route('/api/git', gitRouter);
 app.route('/api/settings', settingsRouter);
@@ -91,6 +96,7 @@ const server = serve({
     fetch: app.fetch,
     port: PORT,
 }, (info) => {
+    setBackendPort(info.port);
     console.log(`Server running at http://localhost:${info.port}`);
 });
 // 6. Create WebSocketServer attached to the HTTP server
@@ -115,7 +121,7 @@ setMessageHandler((type, payload) => {
                 const workspace = getWorkspace(p.workspaceId);
                 if (workspace) {
                     const worktreePath = `${workspace.projectPath}/.worktrees/${workspace.workingBranch}`;
-                    startAgent(p.workspaceId, worktreePath, p.content, workspace.model, true);
+                    startAgent(p.workspaceId, worktreePath, p.content, workspace.model, true, workspace.permissionMode);
                     updateWorkspaceStatus(p.workspaceId, 'executing');
                 }
             }
@@ -133,7 +139,7 @@ setMessageHandler((type, payload) => {
             }
             const worktreePath = `${workspace.projectPath}/.worktrees/${workspace.workingBranch}`;
             const prompt = p.prompt ?? 'Continue the previous task where you left off.';
-            startAgent(p.workspaceId, worktreePath, prompt, workspace.model);
+            startAgent(p.workspaceId, worktreePath, prompt, workspace.model, false, workspace.permissionMode);
         }
         catch (err) {
             console.error('[ws] Failed to start agent:', err);

package/dist/server/routes/images.js

@@ -0,0 +1,57 @@
+import { Hono } from 'hono';
+import * as imageService from '../services/image-service.js';
+import * as workspaceService from '../services/workspace-service.js';
+const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
+const ALLOWED_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
+const app = new Hono();
+// POST /:id/images — upload an image
+app.post('/:id/images', async (c) => {
+    try {
+        const { id } = c.req.param();
+        const workspace = workspaceService.getWorkspace(id);
+        if (!workspace) {
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        }
+        const body = await c.req.parseBody();
+        const file = body.image;
+        if (!file || !(file instanceof File)) {
+            return c.json({ error: 'Missing image field in multipart body' }, 400);
+        }
+        if (!ALLOWED_MIME_TYPES.has(file.type)) {
+            return c.json({ error: `Unsupported MIME type: '${file.type}'. Allowed: ${[...ALLOWED_MIME_TYPES].join(', ')}` }, 400);
+        }
+        const arrayBuffer = await file.arrayBuffer();
+        const buffer = Buffer.from(arrayBuffer);
+        if (buffer.length > MAX_FILE_SIZE) {
+            return c.json({ error: `File too large (${(buffer.length / 1024 / 1024).toFixed(1)} MB). Max: 10 MB` }, 400);
+        }
+        const worktreePath = `${workspace.projectPath}/.worktrees/${workspace.workingBranch}`;
+        const result = await imageService.saveImage(worktreePath, buffer, file.name);
+        return c.json({ uid: result.uid, path: result.relativePath }, 201);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ error: message }, 500);
+    }
+});
+// DELETE /:id/images/:uid — delete an uploaded image
+app.delete('/:id/images/:uid', async (c) => {
+    try {
+        const { id, uid } = c.req.param();
+        const workspace = workspaceService.getWorkspace(id);
+        if (!workspace) {
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        }
+        const worktreePath = `${workspace.projectPath}/.worktrees/${workspace.workingBranch}`;
+        await imageService.deleteImage(worktreePath, uid);
+        return c.body(null, 204);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes('not found')) {
+            return c.json({ error: message }, 404);
+        }
+        return c.json({ error: message }, 500);
+    }
+});
+export default app;