@loicngr/kobo 1.11.8 → 1.11.10

package/dist/server/services/search-service.js

@@ -1,6 +1,6 @@
 import { getDb } from '../db/index.js';
 /** Event types that carry user-authored or assistant-authored readable text. */
-const SEARCHABLE_TYPES = ['user:message', 'agent:output'];
+const SEARCHABLE_TYPES = ['user:message', 'agent:event', 'agent:output'];
 const SNIPPET_CONTEXT = 100; // chars on each side of the match
 /**
  * Extract the readable text content of a ws_events payload, or `null` when
@@ -29,6 +29,9 @@ function extractReadableText(type, payload) {
             return parts.length > 0 ? parts.join('\n') : null;
         }
     }
+    if (type === 'agent:event' && p.kind === 'message:text') {
+        return typeof p.text === 'string' ? p.text : null;
+    }
     return null;
 }
 function buildSnippet(text, matchIndex, query) {
@@ -56,49 +59,59 @@ export function searchEvents(query, options = {}) {
     const db = getDb();
     const typePlaceholders = SEARCHABLE_TYPES.map(() => '?').join(', ');
     const archiveFilter = includeArchived ? '' : 'AND w.archived_at IS NULL';
-    const likePattern = `%${trimmed}%`;
-    // Over-fetch a bit so post-filter rejects don't shrink us below `limit` on
-    // realistic datasets, without scanning the entire table.
-    const dbLimit = Math.max(limit * 3, 100);
-    const rows = db
-        .prepare(`SELECT e.id, e.workspace_id, e.session_id, e.type, e.created_at, e.payload,
-              w.name AS workspace_name, w.archived_at
-       FROM ws_events e
-       JOIN workspaces w ON e.workspace_id = w.id
-       WHERE e.type IN (${typePlaceholders})
-         AND e.payload LIKE ?
-         ${archiveFilter}
-       ORDER BY e.created_at DESC
-       LIMIT ?`)
-        .all(...SEARCHABLE_TYPES, likePattern, dbLimit);
+    const escapedQuery = trimmed.replace(/[\\%_]/g, '\\$&');
+    const likePattern = `%${escapedQuery}%`;
     const needle = trimmed.toLowerCase();
     const results = [];
-    for (const row of rows) {
-        let parsed;
-        try {
-            parsed = JSON.parse(row.payload);
-        }
-        catch {
-            continue;
+    const batchSize = Math.min(Math.max(limit * 3, 100), 500);
+    const statement = db.prepare(`SELECT e.id, e.workspace_id, e.session_id, e.type, e.created_at, e.payload,
+            w.name AS workspace_name, w.archived_at
+     FROM ws_events e
+     JOIN workspaces w ON e.workspace_id = w.id
+     WHERE e.type IN (${typePlaceholders})
+       AND e.payload LIKE ? ESCAPE '\\'
+       ${archiveFilter}
+       AND (? IS NULL OR e.created_at < ? OR (e.created_at = ? AND e.id < ?))
+     ORDER BY e.created_at DESC, e.id DESC
+     LIMIT ?`);
+    let cursorCreatedAt = null;
+    let cursorId = null;
+    while (results.length < limit) {
+        const rows = statement.all(...SEARCHABLE_TYPES, likePattern, cursorCreatedAt, cursorCreatedAt, cursorCreatedAt, cursorId, batchSize);
+        for (const row of rows) {
+            let parsed;
+            try {
+                parsed = JSON.parse(row.payload);
+            }
+            catch {
+                continue;
+            }
+            const text = extractReadableText(row.type, parsed);
+            if (!text)
+                continue;
+            const idx = text.toLowerCase().indexOf(needle);
+            if (idx < 0)
+                continue;
+            results.push({
+                eventId: row.id,
+                sessionId: row.session_id,
+                workspaceId: row.workspace_id,
+                workspaceName: row.workspace_name,
+                archived: row.archived_at !== null,
+                type: row.type,
+                timestamp: row.created_at,
+                snippet: buildSnippet(text, idx, trimmed),
+            });
+            if (results.length >= limit)
+                break;
         }
-        const text = extractReadableText(row.type, parsed);
-        if (!text)
-            continue;
-        const idx = text.toLowerCase().indexOf(needle);
-        if (idx < 0)
-            continue;
-        results.push({
-            eventId: row.id,
-            sessionId: row.session_id,
-            workspaceId: row.workspace_id,
-            workspaceName: row.workspace_name,
-            archived: row.archived_at !== null,
-            type: row.type,
-            timestamp: row.created_at,
-            snippet: buildSnippet(text, idx, trimmed),
-        });
-        if (results.length >= limit)
+        if (rows.length < batchSize)
+            break;
+        const last = rows.at(-1);
+        if (!last)
             break;
+        cursorCreatedAt = last.created_at;
+        cursorId = last.id;
     }
     return results;
 }

package/dist/server/services/websocket-service.js

@@ -109,16 +109,18 @@ export function handleConnection(ws) {
 export function emit(workspaceId, type, payload, sessionId) {
     const id = nanoid();
     const createdAt = new Date().toISOString();
+    let replayable = false;
     // Best-effort persist — don't let FK violation (deleted workspace) break the broadcast
     try {
         const db = getDb();
         db.prepare('INSERT INTO ws_events (id, workspace_id, type, payload, session_id, created_at) VALUES (?, ?, ?, ?, ?, ?)').run(id, workspaceId, type, JSON.stringify(payload), sessionId ?? null, createdAt);
+        replayable = true;
     }
     catch (err) {
         console.error(`[websocket-service] Failed to persist event (workspace=${workspaceId}, type=${type}):`, err);
     }
     // Build the event object to send
-    const event = { id, workspaceId, type, payload, sessionId, createdAt };
+    const event = { id, workspaceId, type, payload, sessionId, createdAt, replayable };
     const message = JSON.stringify(event);
     // Broadcast to subscribed clients. Wrap `.send` in try/catch so a dropped
     // client doesn't throw and abort delivery to the remaining subscribers.
@@ -145,7 +147,7 @@ export function emit(workspaceId, type, payload, sessionId) {
 export function emitEphemeral(workspaceId, type, payload) {
     const id = nanoid();
     const createdAt = new Date().toISOString();
-    const event = { id, workspaceId, type, payload, createdAt };
+    const event = { id, workspaceId, type, payload, createdAt, replayable: false };
     const message = JSON.stringify(event);
     let sendErrorLogged = false;
     for (const [ws, subs] of clients) {
@@ -188,12 +190,14 @@ export function handleSyncRequest(ws, lastEventId, workspaceIds) {
     // up. This keeps first-paint fast on long-lived workspaces with tens of
     // thousands of events without ever deleting anything from the DB.
     const INITIAL_WINDOW = 300;
+    let mode = 'snapshot';
     if (lastEventId) {
         // Resume path: replay every event strictly after the cursor (delta
         // since last seen). If the cursor is stale/unknown, fall back to the
         // recent window rather than streaming the entire history.
         const lastRow = db.prepare('SELECT rowid FROM ws_events WHERE id = ?').get(lastEventId);
         if (lastRow) {
+            mode = 'delta';
             rows = db
                 .prepare(`SELECT * FROM ws_events WHERE workspace_id IN (${placeholders}) AND rowid > ? ORDER BY rowid ASC`)
                 .all(...resolvedIds, lastRow.rowid);
@@ -232,9 +236,10 @@ export function handleSyncRequest(ws, lastEventId, workspaceIds) {
             payload: parsedPayload,
             sessionId: row.session_id ?? undefined,
             createdAt: row.created_at,
+            replayable: true,
         };
     });
-    ws.send(JSON.stringify({ type: 'sync:response', payload: { events } }));
+    ws.send(JSON.stringify({ type: 'sync:response', payload: { events, mode } }));
 }
 // ── Utilities ──────────────────────────────────────────────────────────────────
 /**

package/dist/server/services/workspace-service.js

@@ -165,20 +165,29 @@ export function updateWorkspaceStatus(id, status) {
     return getWorkspace(id);
 }
 const WORKSPACE_NAME_MAX_LENGTH = 200;
-/** Update a workspace's display name. */
-export function updateWorkspaceName(id, name) {
-    // Strip control characters (incl. newlines) and collapse whitespace
+function sanitizeWorkspaceName(name) {
     const noControl = Array.from(name, (c) => {
         const code = c.charCodeAt(0);
         return code < 32 || code === 127 ? ' ' : c;
     }).join('');
     const sanitized = noControl.replace(/\s+/g, ' ').trim();
-    if (!sanitized) {
+    if (!sanitized)
         throw new Error('Workspace name cannot be empty');
-    }
     if (sanitized.length > WORKSPACE_NAME_MAX_LENGTH) {
         throw new Error(`Workspace name cannot exceed ${WORKSPACE_NAME_MAX_LENGTH} characters`);
     }
+    return sanitized;
+}
+function normalizeWorkspaceDescription(description) {
+    const trimmed = description == null ? null : description.trim();
+    if (trimmed !== null && trimmed.length > 200) {
+        throw new Error(`Description must be 200 characters or fewer (got ${trimmed.length})`);
+    }
+    return trimmed && trimmed.length > 0 ? trimmed : null;
+}
+/** Update a workspace's display name. */
+export function updateWorkspaceName(id, name) {
+    const sanitized = sanitizeWorkspaceName(name);
     const db = getDb();
     const now = new Date().toISOString();
     const result = db.prepare('UPDATE workspaces SET name = ?, updated_at = ? WHERE id = ?').run(sanitized, now, id);
@@ -311,11 +320,7 @@ export function updateAgentPermissionMode(id, mode) {
  *   does not exist.
  */
 export function updateWorkspaceDescription(id, description) {
-    const trimmed = description == null ? null : description.trim();
-    if (trimmed !== null && trimmed.length > 200) {
-        throw new Error(`Description must be 200 characters or fewer (got ${trimmed.length})`);
-    }
-    const stored = trimmed && trimmed.length > 0 ? trimmed : null;
+    const stored = normalizeWorkspaceDescription(description);
     const db = getDb();
     const result = db
         .prepare('UPDATE workspaces SET description = ?, updated_at = ? WHERE id = ?')
@@ -326,6 +331,72 @@ export function updateWorkspaceDescription(id, description) {
     emitEphemeral(id, 'workspace:description-updated', { description: stored });
     return getWorkspace(id);
 }
+/** Validate and persist a multi-field API update with one atomic SQL statement. */
+export function updateWorkspaceFields(id, fields) {
+    const workspace = getWorkspace(id);
+    if (!workspace)
+        throw new Error(`Workspace '${id}' not found`);
+    const assignments = [];
+    const values = [];
+    if (fields.model !== undefined) {
+        if (typeof fields.model !== 'string' || !fields.model.trim())
+            throw new Error('model must be a non-empty string');
+        assignments.push('model = ?');
+        values.push(fields.model.trim());
+    }
+    if (fields.reasoningEffort !== undefined) {
+        if (typeof fields.reasoningEffort !== 'string' || !fields.reasoningEffort.trim()) {
+            throw new Error('reasoningEffort must be a non-empty string');
+        }
+        assignments.push('reasoning_effort = ?');
+        values.push(fields.reasoningEffort.trim());
+    }
+    if (fields.agentPermissionMode !== undefined) {
+        if (!['plan', 'bypass', 'strict', 'interactive'].includes(fields.agentPermissionMode)) {
+            throw new Error('Invalid agentPermissionMode');
+        }
+        const legacyMode = fields.agentPermissionMode === 'plan' ? 'plan' : 'auto-accept';
+        const legacyProfile = fields.agentPermissionMode === 'plan' ? 'bypass' : fields.agentPermissionMode;
+        assignments.push('agent_permission_mode = ?', 'permission_mode = ?', 'permission_profile = ?');
+        values.push(fields.agentPermissionMode, legacyMode, legacyProfile);
+    }
+    if (fields.status !== undefined) {
+        const allowed = VALID_TRANSITIONS[workspace.status];
+        if (!allowed || (fields.status !== workspace.status && !allowed.includes(fields.status))) {
+            throw new Error(`Invalid status transition from '${workspace.status}' to '${fields.status}'. Allowed: ${allowed?.join(', ') ?? ''}`);
+        }
+        assignments.push('status = ?');
+        values.push(fields.status);
+    }
+    if (fields.name !== undefined) {
+        if (typeof fields.name !== 'string')
+            throw new Error('name must be a string');
+        assignments.push('name = ?');
+        values.push(sanitizeWorkspaceName(fields.name));
+    }
+    const hasDescription = Object.hasOwn(fields, 'description');
+    let storedDescription;
+    if (hasDescription) {
+        if (fields.description !== null && typeof fields.description !== 'string') {
+            throw new Error('description must be a string or null');
+        }
+        storedDescription = normalizeWorkspaceDescription(fields.description ?? null);
+        assignments.push('description = ?');
+        values.push(storedDescription);
+    }
+    if (assignments.length === 0)
+        return workspace;
+    assignments.push('updated_at = ?');
+    values.push(new Date().toISOString(), id);
+    const result = getDb()
+        .prepare(`UPDATE workspaces SET ${assignments.join(', ')} WHERE id = ?`)
+        .run(...values);
+    if (result.changes === 0)
+        throw new Error(`Workspace '${id}' not found`);
+    if (hasDescription)
+        emitEphemeral(id, 'workspace:description-updated', { description: storedDescription ?? null });
+    return getWorkspace(id);
+}
 /**
  * Update a workspace's agent-side description (≤ 200 chars after trim).
  * Empty string (after trim) or `null` clears the column.

package/dist/server/services/worktree-purge-service.js

@@ -24,7 +24,7 @@ export async function purgeWorktree(workspaceId) {
         console.error(`[purge] stopAgent failed for '${workspace.name}':`, msg);
     }
     try {
-        devServerService.stopDevServer(workspaceId);
+        await devServerService.stopDevServer(workspaceId);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/dist/server/utils/git-ops.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
 const execFileAsync = promisify(execFileCb);
+const READ_ONLY_GIT_TIMEOUT_MS = 15_000;
 function git(repoPath, args) {
     // `trimEnd` (not `trim`): some git outputs are column-aligned and the LEADING
     // space carries information. The classic case is `git status --porcelain`,
@@ -13,6 +14,15 @@ function git(repoPath, args) {
     // always appends) still goes — that's what every caller expects.
     return execFileSync('git', args, { cwd: repoPath, encoding: 'utf-8' }).trimEnd();
 }
+async function gitAsync(repoPath, args, timeout = READ_ONLY_GIT_TIMEOUT_MS) {
+    const { stdout } = await execFileAsync('git', args, {
+        cwd: repoPath,
+        encoding: 'utf-8',
+        timeout,
+        maxBuffer: 10 * 1024 * 1024,
+    });
+    return stdout.trimEnd();
+}
 /** Return the name of the currently checked-out branch. */
 export function getCurrentBranch(repoPath) {
     return git(repoPath, ['rev-parse', '--abbrev-ref', 'HEAD']);
@@ -899,31 +909,33 @@ export function writeFileInWorktree(absPath, content) {
 /** Parse `git status --porcelain` into counts of staged, modified, and untracked files. */
 export function getWorkingTreeStatus(repoPath) {
     try {
-        const output = git(repoPath, ['status', '--porcelain']);
-        let staged = 0;
-        let modified = 0;
-        let untracked = 0;
-        for (const line of output.split('\n')) {
-            if (!line)
-                continue;
-            const x = line[0]; // index status
-            const y = line[1]; // worktree status
-            if (x === '?' && y === '?') {
-                untracked++;
-            }
-            else {
-                if (x !== ' ' && x !== '?')
-                    staged++;
-                if (y !== ' ' && y !== '?')
-                    modified++;
-            }
-        }
-        return { staged, modified, untracked };
+        return parseWorkingTreeStatus(git(repoPath, ['status', '--porcelain']));
     }
     catch {
         return { staged: 0, modified: 0, untracked: 0 };
     }
 }
+function parseWorkingTreeStatus(output) {
+    let staged = 0;
+    let modified = 0;
+    let untracked = 0;
+    for (const line of output.split('\n')) {
+        if (!line)
+            continue;
+        const x = line[0];
+        const y = line[1];
+        if (x === '?' && y === '?') {
+            untracked++;
+        }
+        else {
+            if (x !== ' ' && x !== '?')
+                staged++;
+            if (y !== ' ' && y !== '?')
+                modified++;
+        }
+    }
+    return { staged, modified, untracked };
+}
 /**
  * List uncommitted working-tree files with their status, parsed from
  * `git status --porcelain`. Same classification rule as getWorkingTreeStatus.
@@ -1052,6 +1064,57 @@ export function getWorkingTreeDiffStats(repoPath) {
 }
 // ── Async versions ───────────────────────────────────────────────────────────
 // Non-blocking alternatives for hot paths (route handlers).
+async function resolveBaseAsync(repoPath, base) {
+    try {
+        await gitAsync(repoPath, ['rev-parse', '--verify', `origin/${base}`]);
+        return `origin/${base}`;
+    }
+    catch {
+        return base;
+    }
+}
+/** Non-blocking commit count for request and polling hot paths. */
+export async function getCommitCountAsync(repoPath, base, head) {
+    try {
+        const ref = await resolveBaseAsync(repoPath, base);
+        const output = await gitAsync(repoPath, ['rev-list', '--count', `${ref}..${head}`]);
+        return parseInt(output, 10) || 0;
+    }
+    catch {
+        return 0;
+    }
+}
+/** Non-blocking behind count for request and polling hot paths. */
+export async function getCommitsBehindAsync(repoPath, base, head) {
+    try {
+        const ref = await resolveBaseAsync(repoPath, base);
+        const output = await gitAsync(repoPath, ['rev-list', '--count', `${head}..${ref}`]);
+        const count = parseInt(output, 10);
+        return Number.isFinite(count) ? count : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+/** Non-blocking diff summary for request and polling hot paths. */
+export async function getStructuredDiffStatsBetweenAsync(repoPath, base, head) {
+    try {
+        const ref = await resolveBaseAsync(repoPath, base);
+        return parseDiffShortstat(await gitAsync(repoPath, ['diff', '--shortstat', `${ref}...${head}`]));
+    }
+    catch {
+        return { filesChanged: 0, insertions: 0, deletions: 0 };
+    }
+}
+/** Non-blocking working-tree summary for request and polling hot paths. */
+export async function getWorkingTreeStatusAsync(repoPath) {
+    try {
+        return parseWorkingTreeStatus(await gitAsync(repoPath, ['status', '--porcelain']));
+    }
+    catch {
+        return { staged: 0, modified: 0, untracked: 0 };
+    }
+}
 /**
  * Async version of `getUnpushedCount`. Same `origin/<workingBranch>` semantic:
  * returns `-1` when the remote ref does not exist (never pushed), `0` when
@@ -1060,7 +1123,10 @@ export function getWorkingTreeDiffStats(repoPath) {
 export async function getUnpushedCountAsync(repoPath, workingBranch) {
     const remoteRef = `origin/${workingBranch}`;
     try {
-        await execFileAsync('git', ['rev-parse', '--verify', remoteRef], { cwd: repoPath });
+        await execFileAsync('git', ['rev-parse', '--verify', remoteRef], {
+            cwd: repoPath,
+            timeout: READ_ONLY_GIT_TIMEOUT_MS,
+        });
     }
     catch {
         return -1; // branch never pushed (no remote ref)
@@ -1069,6 +1135,7 @@ export async function getUnpushedCountAsync(repoPath, workingBranch) {
         const { stdout } = await execFileAsync('git', ['rev-list', `${remoteRef}..HEAD`, '--count'], {
             cwd: repoPath,
             encoding: 'utf-8',
+            timeout: READ_ONLY_GIT_TIMEOUT_MS,
         });
         return parseInt(stdout.trim(), 10) || 0;
     }
@@ -1086,7 +1153,7 @@ export async function getUnpushedCountAsync(repoPath, workingBranch) {
  */
 export async function fetchSourceBranchAsync(repoPath, branch, remote = 'origin') {
     try {
-        await execFileAsync('git', ['fetch', remote, branch], { cwd: repoPath });
+        await execFileAsync('git', ['fetch', remote, branch], { cwd: repoPath, timeout: 30_000 });
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/dist/server/utils/mcp-client.js

@@ -58,6 +58,10 @@ export function spawnMcpProcess(command, args, env) {
     const mcpProcess = spawn(command, args, {
         stdio: ['pipe', 'pipe', 'pipe'],
         env,
+        // Detached: `command` is frequently `npx`, which spawns its own `node`
+        // child to run the actual MCP server. Without this, `mcpProcess.kill()`
+        // only reaches the `npx` wrapper and can leave the real server running.
+        detached: true,
     });
     // Defensive default 'error' listener: a ChildProcess that emits 'error'
     // without any listener crashes the whole Node process (Unhandled 'error').

package/dist/server/utils/safe-path.js

@@ -0,0 +1,14 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export function isPathInside(rootPath, candidatePath) {
+    const relative = path.relative(rootPath, candidatePath);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+/** Resolve two existing paths and reject candidates that escape through a symlinked parent. */
+export function resolveExistingPathInside(rootPath, candidatePath) {
+    const realRoot = fs.realpathSync(rootPath);
+    const realCandidate = fs.realpathSync(candidatePath);
+    if (!isPathInside(realRoot, realCandidate))
+        throw new Error('Path escapes allowed root');
+    return realCandidate;
+}

package/dist/server/utils/script-runner.js

@@ -27,9 +27,24 @@ export function runScript(opts) {
                 PROJECT_PATH: env?.projectPath ?? '',
             },
             stdio: ['ignore', 'pipe', 'pipe'],
+            // Detached so this is the leader of its own process group: a script
+            // that backgrounds a child (`npm run dev &`) would otherwise leave
+            // that child running after a timeout kill, since SIGKILL on `proc`
+            // alone only reaches the `bash` process itself.
+            detached: true,
         });
         const timeout = setTimeout(() => {
-            proc.kill('SIGKILL');
+            // Kill the whole process group (-pid), not just `proc` — otherwise a
+            // backgrounded child of the script survives the timeout as an orphan.
+            try {
+                if (proc.pid)
+                    process.kill(-proc.pid, 'SIGKILL');
+                else
+                    proc.kill('SIGKILL');
+            }
+            catch {
+                proc.kill('SIGKILL');
+            }
             // Destroy pipes so the 'close' event fires immediately even if
             // child processes (e.g. sleep) inherited the file descriptors.
             proc.stdout?.destroy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@loicngr/kobo",
-  "version": "1.11.8",
+  "version": "1.11.10",
   "description": "Kōbō — multi-workspace agent manager for Claude Code. Orchestrates isolated git worktrees with dev servers, Notion integration, and MCP tools.",
   "type": "module",
   "license": "GPL-3.0-or-later",
@@ -45,7 +45,7 @@
     "quasar"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=24.15.0"
   },
   "scripts": {
     "dev": "KOBO_ENFORCE_LOCAL_HOME=1 KOBO_HOME=./data PORT=3300 tsx watch src/server/index.ts",
@@ -54,7 +54,7 @@
     "build:client": "cd src/client && npx quasar build -m pwa",
     "build:server": "npx tsc && chmod +x dist/server/index.js",
     "build": "npm run build:client && npm run build:server",
-    "install-all": "npm install && cd src/client && npm install",
+    "install-all": "npm install && cd src/client && npm install && cd src-pwa && npm install",
     "start": "node dist/server/index.js",
     "test": "vitest run --config vitest.config.ts --root .",
     "test:watch": "vitest --config vitest.config.ts --root .",
@@ -67,32 +67,32 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.183",
-    "@emnapi/core": "^1.11.1",
-    "@emnapi/runtime": "^1.11.1",
-    "@hono/node-server": "^2.0.11",
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@openai/codex": "^0.145.0",
-    "better-sqlite3": "^12.11.1",
-    "cron-parser": "^5.5.0",
-    "hono": "^4.12.26",
-    "nanoid": "^5.1.14",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.226",
+    "@emnapi/core": "^1.11.3",
+    "@emnapi/runtime": "^1.11.3",
+    "@hono/node-server": "^2.1.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@openai/codex": "^0.147.0",
+    "better-sqlite3": "^13.0.3",
+    "cron-parser": "^5.7.0",
+    "hono": "^4.13.1",
+    "nanoid": "^6.0.1",
     "node-pty": "^1.1.0",
-    "ws": "^8.21.0"
+    "ws": "^8.21.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.4.10",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^26.0.0",
+    "@biomejs/biome": "2.5.7",
+    "@types/better-sqlite3": "^9.6.0",
+    "@types/node": "^26.2.0",
     "@types/ws": "^8.18.1",
-    "@vitest/runner": "^4.1.9",
-    "concurrently": "^10.0.3",
-    "tsx": "^4.22.4",
+    "@vitest/runner": "^4.1.10",
+    "concurrently": "^10.0.4",
+    "tsx": "^4.23.11",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.10"
   },
   "overrides": {
-    "@hono/node-server": "^2.0.11",
+    "@hono/node-server": "^2.1.0",
     "shell-quote": "^1.10.0"
   }
 }

package/src/client/dist/pwa/assets/{ActivityFeed-D9EfbRqv.css → ActivityFeed-BrjeLlhi.css}

@@ -1 +1 @@
-.markdown-message[data-v-1b7bd8ca]{color:#e0e0e0;word-break:break-word;overflow-wrap:anywhere;min-width:0;max-width:100%;font-size:13px;line-height:1.55}.markdown-message[data-v-1b7bd8ca] *{max-width:100%}.markdown-message[data-v-1b7bd8ca] p{margin:0 0 .5em}.markdown-message[data-v-1b7bd8ca] p:last-child{margin-bottom:0}.markdown-message[data-v-1b7bd8ca] pre{background:#00000059;border-radius:4px;margin:.5em 0;padding:.5em .75em;overflow-x:auto}.markdown-message[data-v-1b7bd8ca] code{word-break:break-all;background:#0000004d;border-radius:3px;padding:.1em .3em;font-size:.9em}.markdown-message[data-v-1b7bd8ca] pre code{background:0 0;padding:0}.markdown-message[data-v-1b7bd8ca] ul,.markdown-message[data-v-1b7bd8ca] ol{margin:.25em 0 .5em;padding-left:1.5em}.markdown-message[data-v-1b7bd8ca] li{margin:.15em 0}.markdown-message[data-v-1b7bd8ca] a{color:#7986cb;text-decoration:underline}.markdown-message[data-v-1b7bd8ca] .document-link{color:#9fa8da;cursor:pointer;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}.markdown-message[data-v-1b7bd8ca] .document-link:hover{color:#c5cae9;-webkit-text-decoration:underline;text-decoration:underline}.markdown-message[data-v-1b7bd8ca] h1,.markdown-message[data-v-1b7bd8ca] h2,.markdown-message[data-v-1b7bd8ca] h3,.markdown-message[data-v-1b7bd8ca] h4,.markdown-message[data-v-1b7bd8ca] h5,.markdown-message[data-v-1b7bd8ca] h6{margin:.5em 0 .3em;font-weight:600;line-height:1.3}.markdown-message[data-v-1b7bd8ca] h1{font-size:1.25em}.markdown-message[data-v-1b7bd8ca] h2{font-size:1.15em}.markdown-message[data-v-1b7bd8ca] h3{font-size:1.08em}.markdown-message[data-v-1b7bd8ca] h4,.markdown-message[data-v-1b7bd8ca] h5,.markdown-message[data-v-1b7bd8ca] h6{font-size:1em}.markdown-message[data-v-1b7bd8ca] blockquote{color:#ffffffb3;border-left:3px solid #fff3;margin:.5em 0;padding-left:.75em}.markdown-message[data-v-1b7bd8ca] table{border-collapse:collapse;margin:.5em 0}.markdown-message[data-v-1b7bd8ca] th,.markdown-message[data-v-1b7bd8ca] td{border:1px solid #ffffff26;padding:.25em .5em}.tool-row[data-v-fc912366]{border-radius:4px;margin:0;font-size:12px}.tool-header[data-v-fc912366]{color:#bbb;cursor:default;align-items:center;gap:10px;min-width:0;padding:5px 10px;display:flex}.tool-row:not(.tool-row-generic) .tool-header[data-v-fc912366],.tool-row--toggleable .tool-header[data-v-fc912366]{cursor:pointer}.tool-row:has(.tool-diff) .tool-header[data-v-fc912366]{cursor:pointer}.tool-row:not(.tool-row-generic) .tool-header[data-v-fc912366]:hover,.tool-row--toggleable .tool-header[data-v-fc912366]:hover{background:#ffffff08}.tool-icon[data-v-fc912366]{color:#9fbce0;flex-shrink:0}.tool-name[data-v-fc912366]{color:#d0d0d0;flex-shrink:0;font-weight:600}.tool-arg[data-v-fc912366],.tool-path[data-v-fc912366]{color:#999;text-overflow:ellipsis;white-space:nowrap;min-width:0;max-width:100%;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11.5px;overflow:hidden}.tool-open-diff[data-v-fc912366]{flex-shrink:0}.tool-path[data-v-fc912366],.tool-arg[data-v-fc912366]{flex:1}.tool-stat-add[data-v-fc912366]{color:#66bb6a;flex-shrink:0;font-size:11px;font-weight:600}.tool-stat-del[data-v-fc912366]{color:#ef5350;flex-shrink:0;font-size:11px;font-weight:600}.tool-diff[data-v-fc912366]{background:#0003;border-radius:4px;max-height:400px;margin-top:4px;padding:8px 0;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11px;line-height:1.5;overflow:auto}.diff-line[data-v-fc912366]{white-space:pre;color:#bbb;padding:0 12px}.diff-sign[data-v-fc912366]{color:#555;-webkit-user-select:none;user-select:none;width:14px;display:inline-block}.diff-add[data-v-fc912366]{color:#c8e6c9;background:#66bb6a1a}.diff-add .diff-sign[data-v-fc912366]{color:#66bb6a}.diff-del[data-v-fc912366]{color:#ffcdd2;background:#ef53501a}.diff-del .diff-sign[data-v-fc912366]{color:#ef5350}.tool-output[data-v-fc912366]{color:#aaa;white-space:pre-wrap;background:#00000026;border-radius:4px;max-height:8em;margin-top:4px;padding:6px 10px;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11px;overflow:auto}.markdown-message[data-v-f34be4c5]{color:#e0e0e0;word-break:break-word;overflow-wrap:anywhere;min-width:0;max-width:100%;font-size:13px;line-height:1.55}.markdown-message[data-v-f34be4c5] *{max-width:100%}.markdown-message[data-v-f34be4c5] img{-o-object-fit:contain;object-fit:contain;cursor:zoom-in;background:#0003;border-radius:4px;max-width:180px;max-height:100px;margin:.3em 0;display:block}.markdown-message[data-v-f34be4c5] code{word-break:break-all}.markdown-message[data-v-f34be4c5] p{margin:0 0 .4em}.markdown-message[data-v-f34be4c5] p:last-child{margin-bottom:0}.markdown-message[data-v-f34be4c5] code{background:#00000040;border-radius:3px;padding:.1em .3em}.markdown-message[data-v-f34be4c5] h1,.markdown-message[data-v-f34be4c5] h2,.markdown-message[data-v-f34be4c5] h3,.markdown-message[data-v-f34be4c5] h4,.markdown-message[data-v-f34be4c5] h5,.markdown-message[data-v-f34be4c5] h6{margin:.4em 0 .25em;font-weight:600;line-height:1.3}.markdown-message[data-v-f34be4c5] h1{font-size:1.25em}.markdown-message[data-v-f34be4c5] h2{font-size:1.15em}.markdown-message[data-v-f34be4c5] h3{font-size:1.08em}.markdown-message[data-v-f34be4c5] h4,.markdown-message[data-v-f34be4c5] h5,.markdown-message[data-v-f34be4c5] h6{font-size:1em}.markdown-user-prompt[data-v-f34be4c5]{color:#aaa;font-size:12px;font-style:italic}.markdown-user-prompt[data-v-f34be4c5] p{margin:0 0 .4em}.markdown-user-prompt[data-v-f34be4c5] code{background:#ffffff14;border-radius:3px;padding:.1em .3em;font-style:normal}.image-lightbox-img{-o-object-fit:contain;object-fit:contain;cursor:zoom-out;background:#0000004d;border-radius:4px;max-width:92vw;max-height:92vh;display:block}.turn-card[data-v-6b8d8e3e]{border:1px solid #ffffff14;border-left:3px solid var(--turn-accent);background:#ffffff05;border-radius:6px;min-width:0;max-width:100%;margin:14px 0;overflow:hidden}.turn-card--highlighted[data-v-6b8d8e3e]{animation:1.8s ease-out search-highlight-6b8d8e3e}@keyframes search-highlight-6b8d8e3e{0%,45%{box-shadow:0 0 0 2px #818cf8f2,0 0 22px #818cf873}to{box-shadow:none}}.turn-header[data-v-6b8d8e3e]{color:#888;background:#ffffff08;border-bottom:1px solid #ffffff0d;align-items:center;gap:8px;padding:8px 14px;font-size:11px;display:flex}.turn-badge[data-v-6b8d8e3e]{letter-spacing:.3px;border-radius:3px;padding:2px 8px;font-size:11px;font-weight:700}.turn-badge-user[data-v-6b8d8e3e]{color:#ce93d8;background:#ce93d826}.turn-badge-agent[data-v-6b8d8e3e]{color:#7986cb;background:#7986cb26}.turn-badge-system[data-v-6b8d8e3e]{color:#bdbdbd;background:#75757533;font-style:italic}.turn-badge-session[data-v-6b8d8e3e]{color:#9e9e9e;background:#61616133}.turn-badge-script[data-v-6b8d8e3e]{color:#4db6ac;background:#4db6ac26}.turn-time[data-v-6b8d8e3e]{color:#666;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11px}.turn-time-arrow[data-v-6b8d8e3e]{opacity:.7;margin:0 -2px}.turn-time-updated[data-v-6b8d8e3e]{color:#8891a3}.turn-actions[data-v-6b8d8e3e]{color:#777;font-size:11px}.turn-body[data-v-6b8d8e3e]{flex-direction:column;gap:12px;min-width:0;padding:14px 18px;display:flex}.turn-body[data-v-6b8d8e3e]>*{min-width:0;max-width:100%}.turn-body[data-v-6b8d8e3e] .tool-row+.tool-row{margin-top:-8px}.turn-scroll-top[data-v-6b8d8e3e]{justify-content:flex-start;padding:0 8px 6px;display:flex}.turn-scroll-top-btn[data-v-6b8d8e3e]{opacity:.5;transition:opacity .15s}.turn-scroll-top-btn[data-v-6b8d8e3e]:hover{opacity:1}.activity-feed-wrap[data-v-0cdc51af]{width:100%;height:100%;position:relative}.activity-feed-scroll[data-v-0cdc51af]{width:100%;height:100%}.activity-feed-nav-cluster[data-v-0cdc51af]{z-index:2;align-items:center;gap:8px;display:flex;position:absolute;bottom:14px;right:14px}.activity-feed-compacting[data-v-0cdc51af]{z-index:3;background:var(--kobo-surface);border:1px solid var(--kobo-border);border-radius:6px;align-items:center;gap:8px;padding:6px 14px;display:flex;position:absolute;top:12px;left:50%;transform:translate(-50%);box-shadow:0 4px 16px #00000059}.fade-enter-active[data-v-0cdc51af],.fade-leave-active[data-v-0cdc51af]{transition:opacity .16s}.fade-enter-from[data-v-0cdc51af],.fade-leave-to[data-v-0cdc51af]{opacity:0}.activity-feed-nav-btn[data-v-0cdc51af]{opacity:.8;transition:opacity .12s}.activity-feed-nav-btn[data-v-0cdc51af]:hover{opacity:1}.content-origin-marker[data-v-0cdc51af]{pointer-events:none;width:0;height:0;margin:0;padding:0}.activity-feed-scroll[data-v-0cdc51af] .q-scrollarea__content{max-width:100%;overflow-x:hidden}.activity-feed-switching[data-v-0cdc51af]{justify-content:center;align-items:center;width:100%;height:100%;display:flex}
+.markdown-message[data-v-1b7bd8ca]{color:#e0e0e0;word-break:break-word;overflow-wrap:anywhere;min-width:0;max-width:100%;font-size:13px;line-height:1.55}.markdown-message[data-v-1b7bd8ca] *{max-width:100%}.markdown-message[data-v-1b7bd8ca] p{margin:0 0 .5em}.markdown-message[data-v-1b7bd8ca] p:last-child{margin-bottom:0}.markdown-message[data-v-1b7bd8ca] pre{background:#00000059;border-radius:4px;margin:.5em 0;padding:.5em .75em;overflow-x:auto}.markdown-message[data-v-1b7bd8ca] code{word-break:break-all;background:#0000004d;border-radius:3px;padding:.1em .3em;font-size:.9em}.markdown-message[data-v-1b7bd8ca] pre code{background:0 0;padding:0}.markdown-message[data-v-1b7bd8ca] ul,.markdown-message[data-v-1b7bd8ca] ol{margin:.25em 0 .5em;padding-left:1.5em}.markdown-message[data-v-1b7bd8ca] li{margin:.15em 0}.markdown-message[data-v-1b7bd8ca] a{color:#7986cb;text-decoration:underline}.markdown-message[data-v-1b7bd8ca] .document-link{color:#9fa8da;cursor:pointer;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}.markdown-message[data-v-1b7bd8ca] .document-link:hover{color:#c5cae9;-webkit-text-decoration:underline;text-decoration:underline}.markdown-message[data-v-1b7bd8ca] h1,.markdown-message[data-v-1b7bd8ca] h2,.markdown-message[data-v-1b7bd8ca] h3,.markdown-message[data-v-1b7bd8ca] h4,.markdown-message[data-v-1b7bd8ca] h5,.markdown-message[data-v-1b7bd8ca] h6{margin:.5em 0 .3em;font-weight:600;line-height:1.3}.markdown-message[data-v-1b7bd8ca] h1{font-size:1.25em}.markdown-message[data-v-1b7bd8ca] h2{font-size:1.15em}.markdown-message[data-v-1b7bd8ca] h3{font-size:1.08em}.markdown-message[data-v-1b7bd8ca] h4,.markdown-message[data-v-1b7bd8ca] h5,.markdown-message[data-v-1b7bd8ca] h6{font-size:1em}.markdown-message[data-v-1b7bd8ca] blockquote{color:#ffffffb3;border-left:3px solid #fff3;margin:.5em 0;padding-left:.75em}.markdown-message[data-v-1b7bd8ca] table{border-collapse:collapse;margin:.5em 0}.markdown-message[data-v-1b7bd8ca] th,.markdown-message[data-v-1b7bd8ca] td{border:1px solid #ffffff26;padding:.25em .5em}.tool-row[data-v-fc912366]{border-radius:4px;margin:0;font-size:12px}.tool-header[data-v-fc912366]{color:#bbb;cursor:default;align-items:center;gap:10px;min-width:0;padding:5px 10px;display:flex}.tool-row:not(.tool-row-generic) .tool-header[data-v-fc912366],.tool-row--toggleable .tool-header[data-v-fc912366]{cursor:pointer}.tool-row:has(.tool-diff) .tool-header[data-v-fc912366]{cursor:pointer}.tool-row:not(.tool-row-generic) .tool-header[data-v-fc912366]:hover,.tool-row--toggleable .tool-header[data-v-fc912366]:hover{background:#ffffff08}.tool-icon[data-v-fc912366]{color:#9fbce0;flex-shrink:0}.tool-name[data-v-fc912366]{color:#d0d0d0;flex-shrink:0;font-weight:600}.tool-arg[data-v-fc912366],.tool-path[data-v-fc912366]{color:#999;text-overflow:ellipsis;white-space:nowrap;min-width:0;max-width:100%;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11.5px;overflow:hidden}.tool-open-diff[data-v-fc912366]{flex-shrink:0}.tool-path[data-v-fc912366],.tool-arg[data-v-fc912366]{flex:1}.tool-stat-add[data-v-fc912366]{color:#66bb6a;flex-shrink:0;font-size:11px;font-weight:600}.tool-stat-del[data-v-fc912366]{color:#ef5350;flex-shrink:0;font-size:11px;font-weight:600}.tool-diff[data-v-fc912366]{background:#0003;border-radius:4px;max-height:400px;margin-top:4px;padding:8px 0;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11px;line-height:1.5;overflow:auto}.diff-line[data-v-fc912366]{white-space:pre;color:#bbb;padding:0 12px}.diff-sign[data-v-fc912366]{color:#555;-webkit-user-select:none;user-select:none;width:14px;display:inline-block}.diff-add[data-v-fc912366]{color:#c8e6c9;background:#66bb6a1a}.diff-add .diff-sign[data-v-fc912366]{color:#66bb6a}.diff-del[data-v-fc912366]{color:#ffcdd2;background:#ef53501a}.diff-del .diff-sign[data-v-fc912366]{color:#ef5350}.tool-output[data-v-fc912366]{color:#aaa;white-space:pre-wrap;background:#00000026;border-radius:4px;max-height:8em;margin-top:4px;padding:6px 10px;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11px;overflow:auto}.markdown-message[data-v-f34be4c5]{color:#e0e0e0;word-break:break-word;overflow-wrap:anywhere;min-width:0;max-width:100%;font-size:13px;line-height:1.55}.markdown-message[data-v-f34be4c5] *{max-width:100%}.markdown-message[data-v-f34be4c5] img{-o-object-fit:contain;object-fit:contain;cursor:zoom-in;background:#0003;border-radius:4px;max-width:180px;max-height:100px;margin:.3em 0;display:block}.markdown-message[data-v-f34be4c5] code{word-break:break-all}.markdown-message[data-v-f34be4c5] p{margin:0 0 .4em}.markdown-message[data-v-f34be4c5] p:last-child{margin-bottom:0}.markdown-message[data-v-f34be4c5] code{background:#00000040;border-radius:3px;padding:.1em .3em}.markdown-message[data-v-f34be4c5] h1,.markdown-message[data-v-f34be4c5] h2,.markdown-message[data-v-f34be4c5] h3,.markdown-message[data-v-f34be4c5] h4,.markdown-message[data-v-f34be4c5] h5,.markdown-message[data-v-f34be4c5] h6{margin:.4em 0 .25em;font-weight:600;line-height:1.3}.markdown-message[data-v-f34be4c5] h1{font-size:1.25em}.markdown-message[data-v-f34be4c5] h2{font-size:1.15em}.markdown-message[data-v-f34be4c5] h3{font-size:1.08em}.markdown-message[data-v-f34be4c5] h4,.markdown-message[data-v-f34be4c5] h5,.markdown-message[data-v-f34be4c5] h6{font-size:1em}.markdown-user-prompt[data-v-f34be4c5]{color:#aaa;font-size:12px;font-style:italic}.markdown-user-prompt[data-v-f34be4c5] p{margin:0 0 .4em}.markdown-user-prompt[data-v-f34be4c5] code{background:#ffffff14;border-radius:3px;padding:.1em .3em;font-style:normal}.image-lightbox-img{-o-object-fit:contain;object-fit:contain;cursor:zoom-out;background:#0000004d;border-radius:4px;max-width:92vw;max-height:92vh;display:block}.turn-card[data-v-6b8d8e3e]{border:1px solid #ffffff14;border-left:3px solid var(--turn-accent);background:#ffffff05;border-radius:6px;min-width:0;max-width:100%;margin:14px 0;overflow:hidden}.turn-card--highlighted[data-v-6b8d8e3e]{animation:1.8s ease-out search-highlight-6b8d8e3e}@keyframes search-highlight-6b8d8e3e{0%,45%{box-shadow:0 0 0 2px #818cf8f2,0 0 22px #818cf873}to{box-shadow:none}}.turn-header[data-v-6b8d8e3e]{color:#888;background:#ffffff08;border-bottom:1px solid #ffffff0d;align-items:center;gap:8px;padding:8px 14px;font-size:11px;display:flex}.turn-badge[data-v-6b8d8e3e]{letter-spacing:.3px;border-radius:3px;padding:2px 8px;font-size:11px;font-weight:700}.turn-badge-user[data-v-6b8d8e3e]{color:#ce93d8;background:#ce93d826}.turn-badge-agent[data-v-6b8d8e3e]{color:#7986cb;background:#7986cb26}.turn-badge-system[data-v-6b8d8e3e]{color:#bdbdbd;background:#75757533;font-style:italic}.turn-badge-session[data-v-6b8d8e3e]{color:#9e9e9e;background:#61616133}.turn-badge-script[data-v-6b8d8e3e]{color:#4db6ac;background:#4db6ac26}.turn-time[data-v-6b8d8e3e]{color:#666;font-family:SF Mono,Menlo,Consolas,monospace;font-size:11px}.turn-time-arrow[data-v-6b8d8e3e]{opacity:.7;margin:0 -2px}.turn-time-updated[data-v-6b8d8e3e]{color:#8891a3}.turn-actions[data-v-6b8d8e3e]{color:#777;font-size:11px}.turn-body[data-v-6b8d8e3e]{flex-direction:column;gap:12px;min-width:0;padding:14px 18px;display:flex}.turn-body[data-v-6b8d8e3e]>*{min-width:0;max-width:100%}.turn-body[data-v-6b8d8e3e] .tool-row+.tool-row{margin-top:-8px}.turn-scroll-top[data-v-6b8d8e3e]{justify-content:flex-start;padding:0 8px 6px;display:flex}.turn-scroll-top-btn[data-v-6b8d8e3e]{opacity:.5;transition:opacity .15s}.turn-scroll-top-btn[data-v-6b8d8e3e]:hover{opacity:1}.activity-feed-wrap[data-v-0fba0dc4]{width:100%;height:100%;position:relative}.activity-feed-scroll[data-v-0fba0dc4]{width:100%;height:100%}.activity-feed-nav-cluster[data-v-0fba0dc4]{z-index:2;align-items:center;gap:8px;display:flex;position:absolute;bottom:14px;right:14px}.activity-feed-compacting[data-v-0fba0dc4]{z-index:3;background:var(--kobo-surface);border:1px solid var(--kobo-border);border-radius:6px;align-items:center;gap:8px;padding:6px 14px;display:flex;position:absolute;top:12px;left:50%;transform:translate(-50%);box-shadow:0 4px 16px #00000059}.fade-enter-active[data-v-0fba0dc4],.fade-leave-active[data-v-0fba0dc4]{transition:opacity .16s}.fade-enter-from[data-v-0fba0dc4],.fade-leave-to[data-v-0fba0dc4]{opacity:0}.activity-feed-nav-btn[data-v-0fba0dc4]{opacity:.8;transition:opacity .12s}.activity-feed-nav-btn[data-v-0fba0dc4]:hover{opacity:1}.content-origin-marker[data-v-0fba0dc4]{pointer-events:none;width:0;height:0;margin:0;padding:0}.activity-feed-scroll[data-v-0fba0dc4] .q-scrollarea__content{max-width:100%;overflow-x:hidden}.activity-feed-switching[data-v-0fba0dc4]{justify-content:center;align-items:center;width:100%;height:100%;display:flex}