@loicngr/kobo 1.11.13 → 1.11.14

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to Kōbō are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/). Each release is an `## <version>`
 section — the in-app "What's new" dialog reads this file.
 
+## 1.11.14
+
+- ⬆️ develop - refactor(deps): Bump SDKs + refactor shutdown + hardening sécurité
+
 ## 1.11.13
 
 - fix(engines): unstick agent sessions that never emit session:ended

package/dist/mcp-server/kobo-tasks-handlers.js

@@ -4,6 +4,7 @@ import { nanoid } from 'nanoid';
 import * as cronService from '../server/services/cron-service.js';
 import * as settingsService from '../server/services/settings-service.js';
 import { slugifyProjectName } from '../server/utils/project-slug.js';
+import { resolveExistingPathInside } from '../server/utils/safe-path.js';
 import { resolveWorkspaceWorktreePath } from '../server/utils/worktree-paths.js';
 /** Allowed task status values. */
 export const VALID_TASK_STATUSES = ['pending', 'in_progress', 'done'];
@@ -296,6 +297,7 @@ export function getTicketSourcesHandler(worktreePath) {
 export const DOCUMENT_DIRS = ['docs/plans', 'docs/superpowers', '.ai/thoughts'];
 /** Depth cap to keep recursion bounded even on pathological symlink loops. */
 const DOC_MAX_DEPTH = 8;
+const DOC_MAX_FILE_BYTES = 1024 * 1024;
 function walkMarkdownFiles(rootAbs, rootRel, out, depth = 0) {
     if (depth > DOC_MAX_DEPTH)
         return;
@@ -313,11 +315,13 @@ function walkMarkdownFiles(rootAbs, rootRel, out, depth = 0) {
         const relEntry = `${rootRel}/${entry}`;
         let stat;
         try {
-            stat = fs.statSync(absEntry);
+            stat = fs.lstatSync(absEntry);
         }
         catch {
             continue;
         }
+        if (stat.isSymbolicLink())
+            continue;
         if (stat.isDirectory()) {
             walkMarkdownFiles(absEntry, relEntry, out, depth + 1);
         }
@@ -336,7 +340,14 @@ export function listDocumentsHandler(worktreePath) {
         const absDir = path.join(worktreePath, dir);
         if (!fs.existsSync(absDir))
             continue;
-        walkMarkdownFiles(absDir, dir, documents);
+        try {
+            if (fs.lstatSync(absDir).isSymbolicLink())
+                continue;
+            walkMarkdownFiles(resolveExistingPathInside(worktreePath, absDir), dir, documents);
+        }
+        catch {
+            // A document directory outside the worktree is never eligible.
+        }
     }
     documents.sort((a, b) => new Date(b.modifiedAt).getTime() - new Date(a.modifiedAt).getTime());
     return documents;
@@ -361,7 +372,19 @@ export function readDocumentHandler(worktreePath, relPath) {
     if (!fs.existsSync(abs)) {
         throw new Error(`Document not found: ${normalized}`);
     }
-    return { path: normalized, content: fs.readFileSync(abs, 'utf-8') };
+    const lstat = fs.lstatSync(abs);
+    if (lstat.isSymbolicLink()) {
+        // Resolve for a consistent error if the link escapes; internal links are
+        // rejected too so list/read share the same no-symlink contract.
+        resolveExistingPathInside(worktreePath, abs);
+        throw new Error('Symbolic links are not allowed in documents');
+    }
+    const safeAbs = resolveExistingPathInside(worktreePath, abs);
+    const stat = fs.statSync(safeAbs);
+    if (stat.size > DOC_MAX_FILE_BYTES) {
+        throw new Error(`Document too large (max ${DOC_MAX_FILE_BYTES / 1024 / 1024} MB)`);
+    }
+    return { path: normalized, content: fs.readFileSync(safeAbs, 'utf-8') };
 }
 /**
  * Append a thought / decision / note to

package/dist/server/index.js

@@ -25,12 +25,12 @@ import templatesRouter from './routes/templates.js';
 import usageRoutes from './routes/usage.js';
 import voiceRouter from './routes/voice.js';
 import workspacesRouter from './routes/workspaces.js';
-import { getAvailableSkills, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopWatchdog, } from './services/agent/orchestrator.js';
+import { getAvailableSkills, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopAllAgents, stopWatchdog, } from './services/agent/orchestrator.js';
 import * as autoLoopService from './services/auto-loop-service.js';
 import { runContentMigrationIfNeeded } from './services/content-migration-service.js';
 import * as cronService from './services/cron-service.js';
 import { createDailyDbBackupIfNeeded, createPreMigrationBackup } from './services/db-backup-service.js';
-import { startDevServer, stopDevServer } from './services/dev-server-service.js';
+import { startDevServer, stopAllDevServers, stopDevServer } from './services/dev-server-service.js';
 import { authorizeWsUpgrade, generateToken, getLanUrls, resolveBindHost, resolveNetworkAccessEnvOverrides, } from './services/network-access-service.js';
 import { startPrWatcher, stopPrWatcher } from './services/pr-watcher-service.js';
 import * as quotaBackoffService from './services/quota-backoff-service.js';
@@ -42,7 +42,6 @@ import * as wakeupService from './services/wakeup-service.js';
 import { emit, emitEphemeral, handleConnection, setMessageHandler } from './services/websocket-service.js';
 import { getActiveSession, getWorkspace, updateWorkspaceStatus } from './services/workspace-service.js';
 import { getClientSpaPath, getDbPath, getKoboHome, getPackageVersion } from './utils/paths.js';
-import { initProcessCleanup, killAll as killAllTrackedProcesses } from './utils/process-tracker.js';
 console.log(`[kobo] Kōbō home: ${getKoboHome()}`);
 // Initialize DB + run migrations
 const db = getDb();
@@ -72,7 +71,6 @@ void createDailyDbBackupIfNeeded(db, getDbPath()).then((r) => {
     }
 });
 // Initialize process cleanup, agent watchdog, PR watcher, and wakeup rehydration
-initProcessCleanup();
 reconcileOrphanSessions();
 startWatchdog();
 wakeupService.rehydrate();
@@ -490,10 +488,10 @@ async function gracefulShutdown(signal) {
     catch {
         // Best-effort
     }
-    // Kill all tracked child processes (agents, dev servers)
+    // Stop managed agents and both direct/Docker dev servers before closing DB.
     try {
-        killAllTrackedProcesses();
-        console.log('[kobo] Tracked processes killed');
+        await Promise.all([stopAllAgents(), stopAllDevServers()]);
+        console.log('[kobo] Agents and dev servers stopped');
     }
     catch {
         // Best-effort

package/dist/server/routes/export.js

@@ -5,7 +5,8 @@ import * as workspaceService from '../services/workspace-service.js';
 const app = new Hono();
 /** Quote a CSV cell when it contains a delimiter, quote, or newline (RFC 4180). */
 function csvCell(value) {
-    return /[",\r\n]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
+    const safeValue = /^[\s]*[=+\-@]/.test(value) ? `'${value}` : value;
+    return /[",\r\n]/.test(safeValue) ? `"${safeValue.replace(/"/g, '""')}"` : safeValue;
 }
 function csvRow(values) {
     return values.map(csvCell).join(',');

package/dist/server/routes/workspaces.js

@@ -42,6 +42,7 @@ import * as worktreeService from '../services/worktree-service.js';
 import { resolveUniqueBranchAndPath } from '../utils/branch-resolver.js';
 import * as gitOps from '../utils/git-ops.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
+import * as safePath from '../utils/safe-path.js';
 import { resolveSiblingWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 /** Hono sub-router for workspace CRUD, tasks, agent lifecycle, git operations, and PR creation. */
 const app = new Hono();
@@ -2692,6 +2693,13 @@ app.get('/:id/diff-file', (c) => {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
         const worktreePath = workspace.worktreePath;
+        try {
+            safePath.assertPathInside(worktreePath, filePath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 400);
+        }
         if (c.req.query('mode') === 'commits') {
             const from = c.req.query('from');
             const to = c.req.query('to');
@@ -2750,6 +2758,13 @@ app.post('/:id/rollback-file', async (c) => {
         if (!filePath) {
             return c.json({ error: 'Missing or invalid `path` field' }, 400);
         }
+        try {
+            safePath.assertPathInside(workspace.worktreePath, filePath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 400);
+        }
         let target;
         try {
             target = gitOps.rollbackFile(workspace.worktreePath, workspace.workingBranch, filePath);

package/dist/server/services/agent/engines/claude-code/engine.js

@@ -97,7 +97,9 @@ export function createClaudeCodeEngine() {
         async start(options, onEvent) {
             const abortController = new AbortController();
             const mapperState = createMapperState();
-            const activeSubagentToolCallIds = new Set();
+            // UI/tool ids can differ from the SDK task id. Key by the stable UI id
+            // so a terminal notification that omits task_id still clears the task.
+            const activeSubagentTaskIds = new Map();
             // Pending canUseTool callbacks, keyed by SDK ctx.toolUseID.
             const pendingResolvers = new Map();
             const isInteractive = options.agentPermissionMode === 'interactive';
@@ -309,7 +311,7 @@ export function createClaudeCodeEngine() {
                     if (inputStream.hasUnansweredInput(completedResponses))
                         return;
                     console.warn(`[claude-engine] Subagent(s) still tracked active ${SUBAGENT_STALL_TIMEOUT_MS}ms after the last turn ended — forcing session drain.`);
-                    activeSubagentToolCallIds.clear();
+                    activeSubagentTaskIds.clear();
                     // This is a forced, unclean termination (the subagent may still be
                     // alive server-side) — never report it as a normal completion, so
                     // auto-loop doesn't treat an orphaned run as forward progress.
@@ -328,16 +330,16 @@ export function createClaudeCodeEngine() {
                             if (ev.kind !== 'subagent:progress')
                                 continue;
                             if (ev.status === 'running')
-                                activeSubagentToolCallIds.add(ev.toolCallId);
+                                activeSubagentTaskIds.set(ev.toolCallId, ev.taskId ?? ev.toolCallId);
                             else
-                                activeSubagentToolCallIds.delete(ev.toolCallId);
+                                activeSubagentTaskIds.delete(ev.toolCallId);
                         }
                         // The stall watchdog is only armed while we're waiting purely on
                         // background subagents (no further SDK turn expected unless one
                         // reports done). React the moment the last one clears instead of
                         // waiting for a 'result' message that may never come.
                         if (subagentStallTimer &&
-                            activeSubagentToolCallIds.size === 0 &&
+                            activeSubagentTaskIds.size === 0 &&
                             !inputStream.hasUnansweredInput(completedResponses)) {
                             clearSubagentStallWatchdog();
                             inputStream.close();
@@ -360,7 +362,7 @@ export function createClaudeCodeEngine() {
                             completedResponses++;
                             // A queued forced message starts the next response on this same SDK stream.
                             if (!inputStream.hasUnansweredInput(completedResponses)) {
-                                if (activeSubagentToolCallIds.size === 0) {
+                                if (activeSubagentTaskIds.size === 0) {
                                     clearSubagentStallWatchdog();
                                     inputStream.close();
                                     armResultDrainWatchdog();
@@ -454,7 +456,7 @@ export function createClaudeCodeEngine() {
                     // background subagent task keeps running unless told to stop via
                     // its own API, which would otherwise leave the Stop button
                     // appearing to do nothing for up to SUBAGENT_STALL_TIMEOUT_MS.
-                    for (const taskId of activeSubagentToolCallIds) {
+                    for (const taskId of activeSubagentTaskIds.values()) {
                         try {
                             void q.stopTask(taskId).catch(() => {
                                 /* best-effort */

package/dist/server/services/agent/engines/claude-code/event-mapper.js

@@ -192,7 +192,8 @@ export function mapSdkMessage(msg, state) {
             return events;
         }
         if (subtype === 'task_started' || subtype === 'task_progress' || subtype === 'task_notification') {
-            const toolCallId = typeof parsed.tool_use_id === 'string' ? parsed.tool_use_id : undefined;
+            const taskId = typeof parsed.task_id === 'string' ? parsed.task_id : undefined;
+            const toolCallId = typeof parsed.tool_use_id === 'string' ? parsed.tool_use_id : taskId;
             if (toolCallId) {
                 const usage = parsed.usage;
                 // Unlike task_started/task_progress (in-flight signals), task_notification
@@ -204,6 +205,7 @@ export function mapSdkMessage(msg, state) {
                 events.push({
                     kind: 'subagent:progress',
                     toolCallId,
+                    ...(taskId ? { taskId } : {}),
                     status: isDone ? 'done' : 'running',
                     description: typeof parsed.description === 'string' ? parsed.description : undefined,
                     taskType: typeof parsed.task_type === 'string' ? parsed.task_type : undefined,

package/dist/server/services/agent/orchestrator.js

@@ -987,12 +987,7 @@ export function interruptAgent(workspaceId, options = {}) {
         autoLoopService.disable(workspaceId, 'user-action');
     }
 }
-/** Gracefully stop an agent (the engine handles SIGTERM + SIGKILL). */
-export function stopAgent(workspaceId) {
-    const ctrl = controllers.get(workspaceId);
-    if (!ctrl) {
-        throw new Error(`No agent running for workspace '${workspaceId}'`);
-    }
+async function stopController(workspaceId, ctrl) {
     wakeupService.cancel(workspaceId, 'stopped');
     // If the session was waiting on a question/permission, normalize the state
     // synchronously so callers (archive, delete, manual stop) see a clean
@@ -1020,11 +1015,42 @@ export function stopAgent(workspaceId) {
     controllers.delete(workspaceId);
     // Manual stop should also drop any pending quota auto-resume.
     quotaBackoffService.cancel(workspaceId, 'user');
-    // Fire-and-forget: controller.stop is async but we don't block callers.
-    void ctrl.stop().catch((err) => {
+    await ctrl.stop();
+}
+/** Gracefully stop an agent (the engine handles SIGTERM + SIGKILL). */
+export function stopAgent(workspaceId) {
+    const ctrl = controllers.get(workspaceId);
+    if (!ctrl) {
+        throw new Error(`No agent running for workspace '${workspaceId}'`);
+    }
+    // Fire-and-forget: callers such as archive/delete must remain synchronous.
+    void stopController(workspaceId, ctrl).catch((err) => {
         console.error('[orchestrator] controller.stop failed:', err);
     });
 }
+/** Stop every live engine before process shutdown, with a bounded wait per engine. */
+export async function stopAllAgents(timeoutMs = 3_000) {
+    const stops = [...controllers.entries()].map(async ([workspaceId, ctrl]) => {
+        let timeout;
+        try {
+            await Promise.race([
+                stopController(workspaceId, ctrl),
+                new Promise((resolve) => {
+                    timeout = setTimeout(resolve, timeoutMs);
+                    timeout.unref?.();
+                }),
+            ]);
+        }
+        catch (err) {
+            console.error(`[orchestrator] Failed to stop '${workspaceId}' during shutdown:`, err);
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+        }
+    });
+    await Promise.all(stops);
+}
 /** Write a user message to the running agent. */
 export async function sendMessage(workspaceId, content, expectedSessionId) {
     const ctrl = controllers.get(workspaceId);

package/dist/server/services/cron-service.js

@@ -170,7 +170,6 @@ function fireOrSkip(id) {
         }
         let status = 'skipped-active';
         if (!orchestrator.hasController(row.workspace_id)) {
-            status = 'fired';
             try {
                 const globalSettings = settingsService.getGlobalSettings();
                 const projectSettings = settingsService.getProjectSettings(wsRow.project_path);
@@ -186,9 +185,11 @@ function fireOrSkip(id) {
                 // every fire" (clean context, no conversation continuity).
                 const resumeMode = row.agent_session_id !== null;
                 orchestrator.startAgent(row.workspace_id, worktreePath, row.prompt, wsRow.model, resumeMode, agentPermissionMode, row.agent_session_id ?? undefined, wsRow.reasoning_effort);
+                status = 'fired';
             }
             catch (err) {
                 console.error(`[cron-service] startAgent at fire time failed for cron '${id}':`, err);
+                status = 'start-failed';
             }
         }
         const now = new Date();

package/dist/server/services/dev-server-service.js

@@ -3,7 +3,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { getProjectSettings } from './settings-service.js';
 import { emitEphemeral } from './websocket-service.js';
-import { getWorkspace, updateDevServerStatus } from './workspace-service.js';
+import { getWorkspace, listWorkspaces, updateDevServerStatus } from './workspace-service.js';
 // ── Helpers ───────────────────────────────────────────────────────────────────
 /** Build a clean env for child processes, stripping Kobo-specific variables. */
 function cleanEnv() {
@@ -312,6 +312,18 @@ export async function stopDevServer(workspaceId) {
     emitEphemeral(workspaceId, 'devserver:status', status);
     return status;
 }
+/** Stop direct and Docker dev servers for every persisted workspace. */
+export async function stopAllDevServers() {
+    const workspaceIds = new Set([...listWorkspaces(true).map((workspace) => workspace.id), ...trackedProcesses.keys()]);
+    await Promise.all([...workspaceIds].map(async (workspaceId) => {
+        try {
+            await stopDevServer(workspaceId);
+        }
+        catch (err) {
+            console.error(`[dev-server] Failed to stop '${workspaceId}' during shutdown:`, err);
+        }
+    }));
+}
 // ── Logs ───────────────────────────────────────────────────────────────────────
 /**
  * Get logs from running dev-server containers for a workspace.

package/dist/server/services/wakeup-service.js

@@ -6,6 +6,7 @@ import * as settingsService from './settings-service.js';
 import { emitEphemeral } from './websocket-service.js';
 const MIN_DELAY_SECONDS = 60;
 const MAX_DELAY_SECONDS = 21600;
+const ACTIVE_SESSION_RETRY_MS = 15_000;
 const STALE_WAKEUP_GRACE_MS = 5 * 60 * 1000;
 const AUTONOMOUS_LOOP_SENTINEL = '<<autonomous-loop-dynamic>>';
 const AUTONOMOUS_LOOP_FALLBACK_PROMPT = 'Continue where you left off.';
@@ -19,6 +20,15 @@ function rowToPending(row) {
         return null;
     return { targetAt: row.target_at, reason: row.reason ?? undefined };
 }
+/** Keep a claimed wakeup durable while the session is still unavailable. */
+function defer(workspaceId, row) {
+    const targetAt = new Date(Date.now() + ACTIVE_SESSION_RETRY_MS).toISOString();
+    getDb().prepare('UPDATE pending_wakeups SET target_at = ? WHERE workspace_id = ?').run(targetAt, workspaceId);
+    const timeout = setTimeout(() => fire(workspaceId), ACTIVE_SESSION_RETRY_MS);
+    timeout.unref?.();
+    timers.set(workspaceId, timeout);
+    emitEphemeral(workspaceId, 'wakeup:scheduled', { targetAt, reason: row.reason ?? undefined });
+}
 /** Schedule a wakeup for the given workspace. Replaces any existing pending wakeup. */
 export function schedule(workspaceId, delaySeconds, prompt, reason, agentSessionId) {
     try {
@@ -118,21 +128,12 @@ export function rehydrate() {
 function fire(workspaceId) {
     try {
         const db = getDb();
-        // Atomic claim: SELECT + DELETE in a single transaction so a concurrent
-        // cancel() can't race us between the read and the act. If we come out
-        // with a row, it's ours exclusively; no other caller will ever see it.
-        const row = db.transaction(() => {
-            const r = db.prepare('SELECT * FROM pending_wakeups WHERE workspace_id = ?').get(workspaceId);
-            if (r) {
-                db.prepare('DELETE FROM pending_wakeups WHERE workspace_id = ?').run(workspaceId);
-            }
-            return r;
-        })();
+        const row = db.prepare('SELECT * FROM pending_wakeups WHERE workspace_id = ?').get(workspaceId);
         timers.delete(workspaceId);
         if (!row)
             return;
         if (orchestrator.hasController(workspaceId)) {
-            emitEphemeral(workspaceId, 'wakeup:skipped', { reason: 'session-active' });
+            defer(workspaceId, row);
             return;
         }
         const wsRow = db
@@ -155,12 +156,13 @@ function fire(workspaceId) {
         const agentPermissionMode = stored === 'plan' || stored === 'strict' || stored === 'interactive' ? stored : 'bypass';
         try {
             orchestrator.startAgent(workspaceId, worktreePath, row.prompt, wsRow.model, true, agentPermissionMode, row.agent_session_id ?? undefined, wsRow.reasoning_effort);
+            db.prepare('DELETE FROM pending_wakeups WHERE workspace_id = ?').run(workspaceId);
             emitEphemeral(workspaceId, 'wakeup:fired', {});
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             console.error(`[wakeup-service] startAgent at fire time failed for '${workspaceId}':`, message);
-            emitEphemeral(workspaceId, 'wakeup:skipped', { reason: 'fire-failed' });
+            defer(workspaceId, row);
         }
     }
     catch (err) {

package/dist/server/utils/git-ops.js

@@ -2,6 +2,7 @@ import { execFile as execFileCb, execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
+import { resolvePathInside } from './safe-path.js';
 const execFileAsync = promisify(execFileCb);
 const READ_ONLY_GIT_TIMEOUT_MS = 15_000;
 function git(repoPath, args) {
@@ -854,6 +855,7 @@ export function getChangedFilesBetween(repoPath, fromRef, toRef) {
  * feedback in the UI.
  */
 export function rollbackFile(repoPath, branchName, filePath, remote = 'origin') {
+    const absPath = resolvePathInside(repoPath, filePath);
     const remoteRef = `${remote}/${branchName}`;
     let remoteRefExists = false;
     try {
@@ -884,7 +886,6 @@ export function rollbackFile(repoPath, branchName, filePath, remote = 'origin')
         // with a previous rollback, stale UI list, manual rm), we still return
         // 'deleted' since the end state matches the user's intent. `rmSync`
         // over `git clean -f` keeps the action narrow to one file.
-        const absPath = join(repoPath, filePath);
         if (existsSync(absPath)) {
             rmSync(absPath, { force: true });
         }
@@ -896,7 +897,7 @@ export const rollbackFileToRemote = rollbackFile;
 /** Get the current content of a file in the worktree. Returns null if the file doesn't exist. */
 export function getFileContent(repoPath, filePath) {
     try {
-        return readFileSync(join(repoPath, filePath), 'utf-8');
+        return readFileSync(resolvePathInside(repoPath, filePath), 'utf-8');
     }
     catch {
         return null;

package/dist/server/utils/safe-path.js

@@ -4,6 +4,13 @@ export function isPathInside(rootPath, candidatePath) {
     const relative = path.relative(rootPath, candidatePath);
     return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
 }
+/** Reject an absolute or traversal path without requiring it to exist on disk. */
+export function assertPathInside(rootPath, relativePath) {
+    const root = path.resolve(rootPath);
+    const candidate = path.resolve(root, relativePath);
+    if (!isPathInside(root, candidate))
+        throw new Error(`Path '${relativePath}' escapes allowed root`);
+}
 /** Resolve two existing paths and reject candidates that escape through a symlinked parent. */
 export function resolveExistingPathInside(rootPath, candidatePath) {
     const realRoot = fs.realpathSync(rootPath);
@@ -12,3 +19,30 @@ export function resolveExistingPathInside(rootPath, candidatePath) {
         throw new Error('Path escapes allowed root');
     return realCandidate;
 }
+/**
+ * Resolve a worktree path, including its parent symlinks, while allowing a
+ * missing leaf (needed when removing an untracked file).
+ */
+export function resolvePathInside(rootPath, relativePath) {
+    assertPathInside(rootPath, relativePath);
+    const root = fs.realpathSync(rootPath);
+    const candidate = path.resolve(rootPath, relativePath);
+    let parent;
+    try {
+        parent = fs.realpathSync(path.dirname(candidate));
+    }
+    catch {
+        throw new Error(`Path '${relativePath}' is invalid (parent directory does not exist)`);
+    }
+    if (!isPathInside(root, parent))
+        throw new Error('Path escapes allowed root');
+    const resolved = path.join(parent, path.basename(candidate));
+    try {
+        return resolveExistingPathInside(root, resolved);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return resolved;
+        throw err;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loicngr/kobo",
-  "version": "1.11.13",
+  "version": "1.11.14",
   "description": "Kōbō — multi-workspace agent manager for Claude Code. Orchestrates isolated git worktrees with dev servers, Notion integration, and MCP tools.",
   "type": "module",
   "license": "GPL-3.0-or-later",
@@ -67,12 +67,12 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.226",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.246",
     "@emnapi/core": "^1.11.3",
     "@emnapi/runtime": "^1.11.3",
     "@hono/node-server": "^2.1.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@openai/codex": "^0.147.0",
+    "@openai/codex": "^0.149.1",
     "better-sqlite3": "^13.0.3",
     "cron-parser": "^5.7.0",
     "hono": "^4.13.1",

package/src/client/dist/pwa/assets/{ActivityFeed-Ds8cAMNc.js → ActivityFeed-DqDJDX2v.js}

@@ -1,4 +1,4 @@
-import{n as e}from"./vue-i18n-C3W5i7h6.js";import{B as t,C as n,St as r,wt as i,yt as a}from"./reactivity.esm-bundler-DtSZKRQB.js";import{$ as o,A as s,B as c,H as l,It as u,Mt as d,Rt as f,Tt as p,U as m,V as h,W as g,Wt as _,X as v,Z as y,_n as b,fn as x,t as S,w as C}from"./runtime-dom.esm-bundler-DgevF6KV.js";import{l as w,t as T}from"./QIcon--SvgE-nS.js";import{G as E,P as D,Q as O,d as k,f as A,v as j,y as M}from"./index-B_OmZ65F.js";import{t as N}from"./QSpinnerDots-B4RmFJUj.js";import{u as ee}from"./QSelect-8Ip46vhk.js";import{t as P}from"./QTooltip-Bz4g3bmr.js";import{r as F,t as te}from"./pending-diff-open-D1IYH8Pd.js";import{t as I}from"./documents-CyKQ9lT6.js";import{i as L,n as ne,t as R}from"./render-chat-markdown-DZnIueUV.js";import{t as z}from"./_plugin-vue_export-helper-BDNMzG2s.js";import{n as B}from"./WorkspacePage-CbC_t5Rx.js";function re(e,t,n=!0,r){let i=[],a=new Map,o=new Map;for(let n=0;n<e.length;n++){let s=e[n],c=t?.[n],l=r?.[n]??void 0;switch(s.kind){case`message:text`:{let e=a.get(s.messageId);if(e)e.text+=s.text,e.streaming=s.streaming,l&&e.eventIds?.push(l);else{let e={type:`text`,messageId:s.messageId,text:s.text,streaming:s.streaming,ts:c,eventIds:l?[l]:void 0};a.set(s.messageId,e),i.push(e)}break}case`message:end`:{let e=a.get(s.messageId);e&&(e.streaming=!1);break}case`message:thinking`:i.push({type:`thinking`,messageId:s.messageId,text:s.text,ts:c,eventIds:l?[l]:void 0});break;case`tool:call`:{let e={type:`tool`,toolCallId:s.toolCallId,name:s.name,input:s.input,ts:c,eventIds:l?[l]:void 0};o.set(s.toolCallId,e),i.push(e);break}case`tool:result`:{let e=o.get(s.toolCallId);e&&(e.result={output:s.output,isError:s.isError},l&&e.eventIds?.push(l));break}case`session:started`:i.push({type:`session`,kind:`started`,detail:{engineSessionId:s.engineSessionId,model:s.model},ts:c,eventIds:l?[l]:void 0});break;case`session:ended`:i.push({type:`session`,kind:`ended`,detail:{reason:s.reason,exitCode:s.exitCode},ts:c,eventIds:l?[l]:void 0});break;case`session:compacted`:i.push({type:`session`,kind:`compacted`,ts:c,eventIds:l?[l]:void 0})}}let s=null;for(let e of i)e.type===`text`&&e.streaming&&(s&&(s.streaming=!1),s=e);return s&&!n&&(s.streaming=!1),i}function ie(e,t){if(t.length===0)return e;let n=t.map(e=>({type:`user`,content:e.content,sender:e.sender,ts:e.ts,eventIds:e.eventIds})),r=[...e,...n];r.sort((e,t)=>{let n=e.ts??``,r=t.ts??``;return n===r?0:n?r?n<r?-1:1:-1:1});let i;for(let e of r)e.type===`user`&&e.sender!==`system-prompt`&&e.ts&&(!i||e.ts>i)&&(i=e.ts);if(i)for(let e of r)e.type===`text`&&e.streaming&&(!e.ts||e.ts<i)&&(e.streaming=!1);return r}var V=new Set([`setup`,`cleanup`,`archive`]);function H(e){switch(e.type){case`user`:return e.sender===`system-prompt`?`system-prompt`:V.has(e.sender)?`script`:`user`;case`session`:return`session`;default:return`agent`}}function ae(e){let t=[],n=null,r=null;for(let i of e){let e=H(i),a=e===`session`||e===`system-prompt`,o=e===`script`&&i.type===`user`?`script:${i.sender}`:e;!n||r!==o||a?(n={speaker:e,ts:i.ts,items:[i]},r=o,t.push(n),a&&(n=null)):n.items.push(i)}return t}var U={class:`text-caption text-grey-6`},oe=o({__name:`SessionEventItem`,props:{item:{}},setup(e){let t=e,n=c(()=>{switch(t.item.kind){case`started`:return`session.started`;case`ended`:return`session.ended`;case`compacted`:return`session.compacted`;default:return`session.started`}});return(e,t)=>(f(),g(`span`,U,i(e.$t(n.value)),1))}});function se(e,t){if(t.length===0||e.length===0)return e;let n=[...t].sort((e,t)=>t.length-e.length),r=new DOMParser().parseFromString(`<div>${e}</div>`,`text/html`),i=r.body.firstChild;if(!i)return e;function a(e){if(e.nodeType===Node.TEXT_NODE){ce(e,n,r);return}if(e.nodeName===`A`)return;let t=Array.from(e.childNodes);for(let e of t)a(e)}return a(i),i.innerHTML}function ce(e,t,n){let r=e.textContent??``;if(!t.some(e=>r.includes(e)))return;let i=n.createDocumentFragment(),a=0;for(;a<r.length;){let e=le(r,a,t);if(!e){i.appendChild(n.createTextNode(r.slice(a)));break}e.index>a&&i.appendChild(n.createTextNode(r.slice(a,e.index)));let o=n.createElement(`a`);o.className=`document-link`,o.setAttribute(`data-document-path`,e.path),o.setAttribute(`href`,`#`),o.textContent=e.path,i.appendChild(o),a=e.index+e.path.length}e.parentNode?.replaceChild(i,e)}function le(e,t,n){let r=null;for(let i of n){let n=e.indexOf(i,t);n<0||(!r||n<r.index||n===r.index&&i.length>r.path.length)&&(r={index:n,path:i})}return r}var W=[`innerHTML`],ue=z(o({__name:`TextMessageItem`,props:{item:{}},setup(e){let t=e,n=I(),r=k(),i=c(()=>{let e=r.selectedWorkspaceId;return e?n.documentsFor(e).map(e=>e.path):[]}),a=c(()=>{let e=se(L.parse(t.item.text,{async:!1,breaks:!0,gfm:!0}),i.value);return ne(e,{addAttr:[`data-document-path`]})});function o(e){let t=e.target?.closest(`.document-link`);if(!t)return;e.preventDefault();let i=t.getAttribute(`data-document-path`),a=r.selectedWorkspaceId;!i||!a||n.openDocumentByPath(a,i)}return(t,n)=>(f(),g(`div`,{class:`markdown-message`,onClick:o},[h(`div`,{innerHTML:a.value},null,8,W),e.item.streaming?(f(),l(w,{key:0,size:`xs`,class:`q-ml-xs`})):m(``,!0)]))}}),[[`__scopeId`,`data-v-1b7bd8ca`]]);function de(e,t){let n=e.split(`
+import{n as e}from"./vue-i18n-C3W5i7h6.js";import{B as t,C as n,St as r,wt as i,yt as a}from"./reactivity.esm-bundler-DtSZKRQB.js";import{$ as o,A as s,B as c,H as l,It as u,Mt as d,Rt as f,Tt as p,U as m,V as h,W as g,Wt as _,X as v,Z as y,_n as b,fn as x,t as S,w as C}from"./runtime-dom.esm-bundler-DgevF6KV.js";import{l as w,t as T}from"./QIcon--SvgE-nS.js";import{G as E,P as D,Q as O,d as k,f as A,v as j,y as M}from"./index-CtK8ORpZ.js";import{t as N}from"./QSpinnerDots-B4RmFJUj.js";import{u as ee}from"./QSelect-xHphd7hW.js";import{t as P}from"./QTooltip-DyS20jDT.js";import{r as F,t as te}from"./pending-diff-open-DHlXLorX.js";import{t as I}from"./documents-DJy1tgPd.js";import{i as L,n as ne,t as R}from"./render-chat-markdown-C00A6CfY.js";import{t as z}from"./_plugin-vue_export-helper-BDNMzG2s.js";import{n as B}from"./WorkspacePage-CJKSrSEC.js";function re(e,t,n=!0,r){let i=[],a=new Map,o=new Map;for(let n=0;n<e.length;n++){let s=e[n],c=t?.[n],l=r?.[n]??void 0;switch(s.kind){case`message:text`:{let e=a.get(s.messageId);if(e)e.text+=s.text,e.streaming=s.streaming,l&&e.eventIds?.push(l);else{let e={type:`text`,messageId:s.messageId,text:s.text,streaming:s.streaming,ts:c,eventIds:l?[l]:void 0};a.set(s.messageId,e),i.push(e)}break}case`message:end`:{let e=a.get(s.messageId);e&&(e.streaming=!1);break}case`message:thinking`:i.push({type:`thinking`,messageId:s.messageId,text:s.text,ts:c,eventIds:l?[l]:void 0});break;case`tool:call`:{let e={type:`tool`,toolCallId:s.toolCallId,name:s.name,input:s.input,ts:c,eventIds:l?[l]:void 0};o.set(s.toolCallId,e),i.push(e);break}case`tool:result`:{let e=o.get(s.toolCallId);e&&(e.result={output:s.output,isError:s.isError},l&&e.eventIds?.push(l));break}case`session:started`:i.push({type:`session`,kind:`started`,detail:{engineSessionId:s.engineSessionId,model:s.model},ts:c,eventIds:l?[l]:void 0});break;case`session:ended`:i.push({type:`session`,kind:`ended`,detail:{reason:s.reason,exitCode:s.exitCode},ts:c,eventIds:l?[l]:void 0});break;case`session:compacted`:i.push({type:`session`,kind:`compacted`,ts:c,eventIds:l?[l]:void 0})}}let s=null;for(let e of i)e.type===`text`&&e.streaming&&(s&&(s.streaming=!1),s=e);return s&&!n&&(s.streaming=!1),i}function ie(e,t){if(t.length===0)return e;let n=t.map(e=>({type:`user`,content:e.content,sender:e.sender,ts:e.ts,eventIds:e.eventIds})),r=[...e,...n];r.sort((e,t)=>{let n=e.ts??``,r=t.ts??``;return n===r?0:n?r?n<r?-1:1:-1:1});let i;for(let e of r)e.type===`user`&&e.sender!==`system-prompt`&&e.ts&&(!i||e.ts>i)&&(i=e.ts);if(i)for(let e of r)e.type===`text`&&e.streaming&&(!e.ts||e.ts<i)&&(e.streaming=!1);return r}var V=new Set([`setup`,`cleanup`,`archive`]);function H(e){switch(e.type){case`user`:return e.sender===`system-prompt`?`system-prompt`:V.has(e.sender)?`script`:`user`;case`session`:return`session`;default:return`agent`}}function ae(e){let t=[],n=null,r=null;for(let i of e){let e=H(i),a=e===`session`||e===`system-prompt`,o=e===`script`&&i.type===`user`?`script:${i.sender}`:e;!n||r!==o||a?(n={speaker:e,ts:i.ts,items:[i]},r=o,t.push(n),a&&(n=null)):n.items.push(i)}return t}var U={class:`text-caption text-grey-6`},oe=o({__name:`SessionEventItem`,props:{item:{}},setup(e){let t=e,n=c(()=>{switch(t.item.kind){case`started`:return`session.started`;case`ended`:return`session.ended`;case`compacted`:return`session.compacted`;default:return`session.started`}});return(e,t)=>(f(),g(`span`,U,i(e.$t(n.value)),1))}});function se(e,t){if(t.length===0||e.length===0)return e;let n=[...t].sort((e,t)=>t.length-e.length),r=new DOMParser().parseFromString(`<div>${e}</div>`,`text/html`),i=r.body.firstChild;if(!i)return e;function a(e){if(e.nodeType===Node.TEXT_NODE){ce(e,n,r);return}if(e.nodeName===`A`)return;let t=Array.from(e.childNodes);for(let e of t)a(e)}return a(i),i.innerHTML}function ce(e,t,n){let r=e.textContent??``;if(!t.some(e=>r.includes(e)))return;let i=n.createDocumentFragment(),a=0;for(;a<r.length;){let e=le(r,a,t);if(!e){i.appendChild(n.createTextNode(r.slice(a)));break}e.index>a&&i.appendChild(n.createTextNode(r.slice(a,e.index)));let o=n.createElement(`a`);o.className=`document-link`,o.setAttribute(`data-document-path`,e.path),o.setAttribute(`href`,`#`),o.textContent=e.path,i.appendChild(o),a=e.index+e.path.length}e.parentNode?.replaceChild(i,e)}function le(e,t,n){let r=null;for(let i of n){let n=e.indexOf(i,t);n<0||(!r||n<r.index||n===r.index&&i.length>r.path.length)&&(r={index:n,path:i})}return r}var W=[`innerHTML`],ue=z(o({__name:`TextMessageItem`,props:{item:{}},setup(e){let t=e,n=I(),r=k(),i=c(()=>{let e=r.selectedWorkspaceId;return e?n.documentsFor(e).map(e=>e.path):[]}),a=c(()=>{let e=se(L.parse(t.item.text,{async:!1,breaks:!0,gfm:!0}),i.value);return ne(e,{addAttr:[`data-document-path`]})});function o(e){let t=e.target?.closest(`.document-link`);if(!t)return;e.preventDefault();let i=t.getAttribute(`data-document-path`),a=r.selectedWorkspaceId;!i||!a||n.openDocumentByPath(a,i)}return(t,n)=>(f(),g(`div`,{class:`markdown-message`,onClick:o},[h(`div`,{innerHTML:a.value},null,8,W),e.item.streaming?(f(),l(w,{key:0,size:`xs`,class:`q-ml-xs`})):m(``,!0)]))}}),[[`__scopeId`,`data-v-1b7bd8ca`]]);function de(e,t){let n=e.split(`
 `),r=t.split(`
 `),i=n.length,a=r.length,o=Array.from({length:i+1},()=>Array(a+1).fill(0));for(let e=i-1;e>=0;e--)for(let t=a-1;t>=0;t--)n[e]===r[t]?o[e][t]=o[e+1][t+1]+1:o[e][t]=Math.max(o[e+1][t],o[e][t+1]);let s=[],c=0,l=0;for(;c<i&&l<a;)n[c]===r[l]?(s.push({type:`context`,content:n[c]}),c++,l++):o[c+1][l]>=o[c][l+1]?(s.push({type:`del`,content:n[c]}),c++):(s.push({type:`add`,content:r[l]}),l++);for(;c<i;)s.push({type:`del`,content:n[c++]});for(;l<a;)s.push({type:`add`,content:r[l++]});return s}function G(e){let t=e.split(`
 `),n=[];for(let e of t)e.startsWith(`@@`)||e.startsWith(`+++`)||e.startsWith(`---`)||(e.startsWith(`+`)?n.push({type:`add`,content:e.slice(1)}):e.startsWith(`-`)?n.push({type:`del`,content:e.slice(1)}):e.startsWith(` `)?n.push({type:`context`,content:e.slice(1)}):e.length>0&&n.push({type:`context`,content:e}));return n}function K(e,t){if(!t||typeof t!=`object`)return null;let n=t;if(e===`Edit`){let e=n.file_path;if(!e)return null;let t=n.old_string??``,r=n.new_string??``,i=typeof n.diff==`string`?n.diff:``;if(!t&&!r&&i.length>0){let t=G(i);return{toolName:`Edit`,filePath:e,additions:t.filter(e=>e.type===`add`).length,deletions:t.filter(e=>e.type===`del`).length,diffLines:t}}return{toolName:`Edit`,filePath:e,oldString:t,newString:r,replaceAll:n.replace_all??!1,additions:r?r.split(`

package/src/client/dist/pwa/assets/{ChangelogPage-DO6DNO4Q.js → ChangelogPage-Dw2LbIK2.js}

@@ -1 +1 @@
-import{B as e,C as t,wt as n}from"./reactivity.esm-bundler-DtSZKRQB.js";import{$ as r,A as i,H as a,Mt as o,Rt as s,U as c,V as l,W as u,Wt as d,Z as f,_n as p}from"./runtime-dom.esm-bundler-DgevF6KV.js";import{Dt as m,G as h,kt as g,s as _}from"./index-B_OmZ65F.js";import{t as v}from"./render-chat-markdown-DZnIueUV.js";import{t as y}from"./_plugin-vue_export-helper-BDNMzG2s.js";import{t as b}from"./QSpace-D9UEvM99.js";import{t as x}from"./QChip-DWGDTZnX.js";import{t as S}from"./QPage-DuIsRmYu.js";var C={class:`row items-center q-mb-md`},w={class:`text-h6 q-ml-sm`},T={key:0,class:`text-grey-6 text-center q-pa-lg`},E={key:1,class:`text-negative text-center q-pa-lg`},D={key:2,class:`text-grey-6 text-center q-pa-lg`},O={key:3,class:`column q-gutter-md`},k={key:0,class:`text-caption text-grey-6`},A={class:`row items-center q-mb-sm`},j={class:`text-subtitle1 text-indigo-3`,style:{"font-family":`var(--kobo-font-mono, monospace)`}},M=[`innerHTML`],N=y(r({__name:`ChangelogPage`,setup(r){let y=_(),N=t([]),P=t(``),F=t(!1),I=t(null);function L(e){return v(e)}async function R(){F.value=!0,I.value=null;try{let e=await fetch(`/api/changelog`);if(!e.ok)throw Error(`HTTP ${e.status}`);let t=await e.json();P.value=t.currentVersion??``,N.value=t.versions??[]}catch(e){I.value=e instanceof Error?e.message:String(e)}finally{F.value=!1}}return o(R),(t,r)=>(s(),a(S,{class:`q-pa-md`,style:{"max-width":`900px`,margin:`0 auto`}},{default:p(()=>[l(`div`,C,[f(h,{flat:``,dense:``,round:``,icon:`arrow_back`,onClick:r[0]||=t=>e(y).back()}),l(`div`,w,n(t.$t(`changelog.title`)),1),f(b),f(h,{flat:``,dense:``,icon:`refresh`,loading:F.value,label:t.$t(`common.refresh`),onClick:R},null,8,[`loading`,`label`])]),F.value&&N.value.length===0?(s(),u(`div`,T,n(t.$t(`common.loading`)),1)):I.value?(s(),u(`div`,E,n(I.value),1)):N.value.length===0?(s(),u(`div`,D,n(t.$t(`changelog.empty`)),1)):(s(),u(`div`,O,[P.value?(s(),u(`div`,k,n(t.$t(`changelog.currentVersion`,{version:P.value})),1)):c(``,!0),(s(!0),u(i,null,d(N.value,e=>(s(),a(m,{key:e.version,dark:``,flat:``,bordered:``},{default:p(()=>[f(g,null,{default:p(()=>[l(`div`,A,[l(`div`,j,` v`+n(e.version),1),e.version===P.value?(s(),a(x,{key:0,dense:``,size:`sm`,color:`indigo-7`,"text-color":`grey-2`,label:t.$t(`changelog.current`),class:`q-ml-sm`},null,8,[`label`])):c(``,!0)]),l(`div`,{class:`changelog-notes`,innerHTML:L(e.notes)},null,8,M)]),_:2},1024)]),_:2},1024))),128))]))]),_:1}))}}),[[`__scopeId`,`data-v-ed73d661`]]);export{N as default};
+import{B as e,C as t,wt as n}from"./reactivity.esm-bundler-DtSZKRQB.js";import{$ as r,A as i,H as a,Mt as o,Rt as s,U as c,V as l,W as u,Wt as d,Z as f,_n as p}from"./runtime-dom.esm-bundler-DgevF6KV.js";import{Dt as m,G as h,kt as g,s as _}from"./index-CtK8ORpZ.js";import{t as v}from"./render-chat-markdown-C00A6CfY.js";import{t as y}from"./_plugin-vue_export-helper-BDNMzG2s.js";import{t as b}from"./QSpace-D9UEvM99.js";import{t as x}from"./QChip-CY0_8v_e.js";import{t as S}from"./QPage-DuIsRmYu.js";var C={class:`row items-center q-mb-md`},w={class:`text-h6 q-ml-sm`},T={key:0,class:`text-grey-6 text-center q-pa-lg`},E={key:1,class:`text-negative text-center q-pa-lg`},D={key:2,class:`text-grey-6 text-center q-pa-lg`},O={key:3,class:`column q-gutter-md`},k={key:0,class:`text-caption text-grey-6`},A={class:`row items-center q-mb-sm`},j={class:`text-subtitle1 text-indigo-3`,style:{"font-family":`var(--kobo-font-mono, monospace)`}},M=[`innerHTML`],N=y(r({__name:`ChangelogPage`,setup(r){let y=_(),N=t([]),P=t(``),F=t(!1),I=t(null);function L(e){return v(e)}async function R(){F.value=!0,I.value=null;try{let e=await fetch(`/api/changelog`);if(!e.ok)throw Error(`HTTP ${e.status}`);let t=await e.json();P.value=t.currentVersion??``,N.value=t.versions??[]}catch(e){I.value=e instanceof Error?e.message:String(e)}finally{F.value=!1}}return o(R),(t,r)=>(s(),a(S,{class:`q-pa-md`,style:{"max-width":`900px`,margin:`0 auto`}},{default:p(()=>[l(`div`,C,[f(h,{flat:``,dense:``,round:``,icon:`arrow_back`,onClick:r[0]||=t=>e(y).back()}),l(`div`,w,n(t.$t(`changelog.title`)),1),f(b),f(h,{flat:``,dense:``,icon:`refresh`,loading:F.value,label:t.$t(`common.refresh`),onClick:R},null,8,[`loading`,`label`])]),F.value&&N.value.length===0?(s(),u(`div`,T,n(t.$t(`common.loading`)),1)):I.value?(s(),u(`div`,E,n(I.value),1)):N.value.length===0?(s(),u(`div`,D,n(t.$t(`changelog.empty`)),1)):(s(),u(`div`,O,[P.value?(s(),u(`div`,k,n(t.$t(`changelog.currentVersion`,{version:P.value})),1)):c(``,!0),(s(!0),u(i,null,d(N.value,e=>(s(),a(m,{key:e.version,dark:``,flat:``,bordered:``},{default:p(()=>[f(g,null,{default:p(()=>[l(`div`,A,[l(`div`,j,` v`+n(e.version),1),e.version===P.value?(s(),a(x,{key:0,dense:``,size:`sm`,color:`indigo-7`,"text-color":`grey-2`,label:t.$t(`changelog.current`),class:`q-ml-sm`},null,8,[`label`])):c(``,!0)]),l(`div`,{class:`changelog-notes`,innerHTML:L(e.notes)},null,8,M)]),_:2},1024)]),_:2},1024))),128))]))]),_:1}))}}),[[`__scopeId`,`data-v-ed73d661`]]);export{N as default};

package/src/client/dist/pwa/assets/{ClosePopup-DuAqn8Pb.js → ClosePopup-eKuUr7CY.js}

@@ -1 +1 @@
-import{P as e,b as t}from"./QIcon--SvgE-nS.js";import{gt as n,ht as r}from"./index-B_OmZ65F.js";var i={left:!0,right:!0,up:!0,down:!0,horizontal:!0,vertical:!0},a=Object.keys(i);i.all=!0;function o(e){let t={};for(let n of a)e[n]&&(t[n]=!0);return Object.keys(t).length===0?i:(t.horizontal?t.left=t.right=!0:t.left&&t.right&&(t.horizontal=!0),t.vertical?t.up=t.down=!0:t.up&&t.down&&(t.vertical=!0),t.horizontal&&t.vertical&&(t.all=!0),t)}var s=[`INPUT`,`TEXTAREA`];function c(e,t){return t.event===void 0&&e.target!==void 0&&!e.target.draggable&&typeof t.handler==`function`&&!s.includes(e.target.nodeName.toUpperCase())&&(e.qClonedBy===void 0||!e.qClonedBy.includes(t.uid))}function l(e){return e===!1?0:e===!0||e===void 0?1:Number.parseInt(e,10)||0}var u=e({name:`close-popup`,beforeMount(e,{value:i}){let a={depth:l(i),handler(t){a.depth!==0&&setTimeout(()=>{let i=n(e);i!==void 0&&r(i,t,a.depth)},0)},handlerKey(e){t(e,13)&&a.handler(e)}};e.__qclosepopup=a,e.addEventListener(`click`,a.handler),e.addEventListener(`keyup`,a.handlerKey)},updated(e,{value:t,oldValue:n}){t!==n&&(e.__qclosepopup.depth=l(t))},beforeUnmount(e){let t=e.__qclosepopup;e.removeEventListener(`click`,t.handler),e.removeEventListener(`keyup`,t.handlerKey),delete e.__qclosepopup}});export{o as n,c as r,u as t};
+import{P as e,b as t}from"./QIcon--SvgE-nS.js";import{gt as n,ht as r}from"./index-CtK8ORpZ.js";var i={left:!0,right:!0,up:!0,down:!0,horizontal:!0,vertical:!0},a=Object.keys(i);i.all=!0;function o(e){let t={};for(let n of a)e[n]&&(t[n]=!0);return Object.keys(t).length===0?i:(t.horizontal?t.left=t.right=!0:t.left&&t.right&&(t.horizontal=!0),t.vertical?t.up=t.down=!0:t.up&&t.down&&(t.vertical=!0),t.horizontal&&t.vertical&&(t.all=!0),t)}var s=[`INPUT`,`TEXTAREA`];function c(e,t){return t.event===void 0&&e.target!==void 0&&!e.target.draggable&&typeof t.handler==`function`&&!s.includes(e.target.nodeName.toUpperCase())&&(e.qClonedBy===void 0||!e.qClonedBy.includes(t.uid))}function l(e){return e===!1?0:e===!0||e===void 0?1:Number.parseInt(e,10)||0}var u=e({name:`close-popup`,beforeMount(e,{value:i}){let a={depth:l(i),handler(t){a.depth!==0&&setTimeout(()=>{let i=n(e);i!==void 0&&r(i,t,a.depth)},0)},handlerKey(e){t(e,13)&&a.handler(e)}};e.__qclosepopup=a,e.addEventListener(`click`,a.handler),e.addEventListener(`keyup`,a.handlerKey)},updated(e,{value:t,oldValue:n}){t!==n&&(e.__qclosepopup.depth=l(t))},beforeUnmount(e){let t=e.__qclosepopup;e.removeEventListener(`click`,t.handler),e.removeEventListener(`keyup`,t.handlerKey),delete e.__qclosepopup}});export{o as n,c as r,u as t};