@melaya/runner 1.1.61 → 1.1.63

package/dist/folderPicker.js

@@ -0,0 +1,139 @@
+/**
+ * Native OS folder dialog, shared by runner:pick-folder (static-context / RAG
+ * folders) and runner:vault-pick-folder (Obsidian vaults).
+ *
+ * Browsers can't reveal absolute paths for security, so the runner — which
+ * lives on the user's box — pops the dialog. Fixed argv; the prompt is a
+ * constant chosen by the caller, never user or model input.
+ *
+ *   - Windows: the Explorer folder dialog (IFileOpenDialog + FOS_PICKFOLDERS)
+ *     through PowerShell. WinForms' FolderBrowserDialog is the old tree view
+ *     on Windows PowerShell (.NET Framework), so it is only the fallback. The
+ *     dialog is owned by a small topmost window so it opens in front of the
+ *     browser instead of behind it.
+ *   - macOS: AppleScript `choose folder` run by osascript itself. Wrapping it
+ *     in `tell application "System Events"` needs the Automation permission
+ *     and fails (-1743) or hides the dialog when it is not granted.
+ *   - Linux: zenity, then kdialog.
+ */
+import { execFile } from "child_process";
+// Selected path on stdout, nothing on cancel. Paths are written as UTF-8 so
+// non-ASCII folder names survive the console code page.
+const WINDOWS_PICKER = String.raw `
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
+$src = @"
+using System;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+public static class MelFolderPicker {
+  [ComImport, Guid("DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7")] class FileOpenDialogCoClass {}
+  [ComImport, Guid("43826D1E-E718-42EE-BC55-A1E261C37BFE"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+  interface IShellItem {
+    void BindToHandler(); void GetParent();
+    void GetDisplayName(uint sigdn, [MarshalAs(UnmanagedType.LPWStr)] out string name);
+    void GetAttributes(); void Compare();
+  }
+  [ComImport, Guid("D57C7288-D4AD-4768-BE02-9D969532D960"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+  interface IFileOpenDialog {
+    [PreserveSig] int Show(IntPtr owner);
+    void SetFileTypes(); void SetFileTypeIndex(); void GetFileTypeIndex(); void Advise(); void Unadvise();
+    void SetOptions(uint fos); void GetOptions(out uint fos);
+    void SetDefaultFolder(); void SetFolder(); void GetFolder(); void GetCurrentSelection();
+    void SetFileName(); void GetFileName();
+    void SetTitle([MarshalAs(UnmanagedType.LPWStr)] string title);
+    void SetOkButtonLabel(); void SetFileNameLabel();
+    void GetResult(out IShellItem item);
+  }
+  public static string Pick(string title) {
+    var owner = new Form {
+      TopMost = true, ShowInTaskbar = false, FormBorderStyle = FormBorderStyle.None,
+      StartPosition = FormStartPosition.CenterScreen, Size = new Size(1, 1), Opacity = 0,
+    };
+    owner.Show(); owner.Activate();
+    try {
+      var dlg = (IFileOpenDialog)new FileOpenDialogCoClass();
+      uint fos; dlg.GetOptions(out fos);
+      dlg.SetOptions(fos | 0x20 | 0x40 | 0x800);  // PICKFOLDERS | FORCEFILESYSTEM | PATHMUSTEXIST
+      dlg.SetTitle(title);
+      if (dlg.Show(owner.Handle) != 0) return "";  // cancelled
+      IShellItem item; dlg.GetResult(out item);
+      string path; item.GetDisplayName(0x80058000, out path);  // SIGDN_FILESYSPATH
+      return path ?? "";
+    } finally { owner.Close(); }
+  }
+}
+"@
+Add-Type -TypeDefinition $src -ReferencedAssemblies System.Windows.Forms, System.Drawing
+try {
+  [Console]::Out.Write([MelFolderPicker]::Pick($env:MEL_PICK_TITLE))
+} catch {
+  # Very old shells without the COM dialog: the WinForms tree dialog.
+  Add-Type -AssemblyName System.Windows.Forms
+  $f = New-Object System.Windows.Forms.FolderBrowserDialog
+  $f.Description = $env:MEL_PICK_TITLE
+  $f.ShowNewFolderButton = $true
+  if ($f.ShowDialog() -eq 'OK') { [Console]::Out.Write($f.SelectedPath) }
+}
+`;
+function run(cmd, args, env, exit1IsCancel = false) {
+    return new Promise((resolve, reject) => {
+        execFile(cmd, args, { maxBuffer: 1024 * 64, encoding: "utf8", windowsHide: false, env: env ?? process.env }, (err, stdout, stderr) => {
+            const out = (stdout || "").trim();
+            if (err) {
+                const errMsg = (stderr || err.message || "").trim();
+                // osascript: "User canceled. (-128)"; zenity / kdialog: exit 1, no output.
+                if (!out && (/User cancel+ed|\(-128\)/i.test(errMsg) || (exit1IsCancel && err.code === 1)))
+                    return resolve("");
+                return reject(new Error(errMsg || "pick failed"));
+            }
+            resolve(out);
+        });
+    });
+}
+export async function pickNativeFolder(prompt) {
+    // Quotes and backslashes would break out of the AppleScript string literal.
+    const safePrompt = prompt.replace(/["'`$\\]/g, "");
+    let picked = "";
+    try {
+        if (process.platform === "darwin") {
+            // `activate` brings osascript's own dialog to the front; the result is a
+            // POSIX path ("/Users/me/Vault/").
+            picked = await run("osascript", [
+                "-e", "activate",
+                "-e", `POSIX path of (choose folder with prompt "${safePrompt}")`,
+            ]);
+            picked = picked.replace(/\/$/, "");
+        }
+        else if (process.platform === "win32") {
+            // The title goes through the environment, never into the script text.
+            const encoded = Buffer.from(WINDOWS_PICKER, "utf16le").toString("base64");
+            picked = await run("powershell.exe", ["-NoProfile", "-NonInteractive", "-STA", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], { ...process.env, MEL_PICK_TITLE: safePrompt });
+        }
+        else {
+            try {
+                picked = await run("zenity", ["--file-selection", "--directory", `--title=${safePrompt}`], undefined, true);
+            }
+            catch (e) {
+                if (!/ENOENT/i.test(String(e?.message)))
+                    throw e;
+                picked = await run("kdialog", ["--getexistingdirectory", process.env.HOME || "/", "--title", safePrompt], undefined, true);
+            }
+        }
+    }
+    catch (e) {
+        const msg = String(e?.message || "pick failed");
+        let hint = "";
+        if (process.platform === "linux" && /ENOENT|not found|spawn/i.test(msg)) {
+            hint = "Install 'zenity' (apt install zenity) or type the path manually.";
+        }
+        else if (process.platform === "darwin" && /-1743|not allowed|No user interaction/i.test(msg)) {
+            hint = "macOS blocked the dialog: run the runner from a logged-in session (Terminal), or type the path manually.";
+        }
+        throw new Error(hint ? `${msg} — ${hint}` : msg);
+    }
+    if (!picked)
+        return { cancelled: true };
+    return { path: picked };
+}

package/dist/localRelay.d.ts

@@ -9,6 +9,7 @@
  *   - Per-run nonce required in the URL path to prevent injection from
  *     other processes on the same machine
  */
+import http from "http";
 import type { Socket } from "socket.io-client";
 export interface LocalRelay {
     port: number;
@@ -16,4 +17,10 @@ export interface LocalRelay {
     close: () => void;
 }
 export declare function setActiveProject(project: string): void;
-export declare function startLocalRelay(socket: Socket, verbose: boolean, serverUrl?: string): Promise<LocalRelay>;
+export interface LocalRelayRoutes {
+    /** POST /vaults/op (Obsidian vault tools, protocol §2). Authenticated by the
+     *  vault capability in `Authorization: Vault <cap>`, not by the nonce: the
+     *  handler verifies it (local device vaults) or forwards it to the server. */
+    vaultOp?: (req: http.IncomingMessage, res: http.ServerResponse) => Promise<void> | void;
+}
+export declare function startLocalRelay(socket: Socket, verbose: boolean, serverUrl?: string, routes?: LocalRelayRoutes): Promise<LocalRelay>;

package/dist/localRelay.js

@@ -55,7 +55,7 @@ function _flushThrottle(socket, verbose) {
     _throttleQueue = [];
     _throttleTimer = null;
 }
-export function startLocalRelay(socket, verbose, serverUrl) {
+export function startLocalRelay(socket, verbose, serverUrl, routes = {}) {
     const nonce = crypto.randomUUID().replace(/-/g, "");
     return new Promise((resolve, reject) => {
         const expectedPath = `/events/relay/${nonce}`;
@@ -147,6 +147,26 @@ export function startLocalRelay(socket, verbose, serverUrl) {
                 });
                 return;
             }
+            // ── Obsidian vault ops (docs/plans/obsidian-vault-protocol.md §2) ──
+            if (req.method === "POST" && req.url && /^\/vaults\/op\/?(\?.*)?$/.test(req.url)) {
+                if (!routes.vaultOp) {
+                    res.writeHead(404);
+                    res.end("Not found");
+                    return;
+                }
+                Promise.resolve(routes.vaultOp(req, res)).catch(() => {
+                    if (res.headersSent) {
+                        try {
+                            res.end();
+                        }
+                        catch { /* closed */ }
+                        return;
+                    }
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end('{"ok":false,"error":"relay_failed"}');
+                });
+                return;
+            }
             if (req.method !== "POST" || req.url !== expectedPath) {
                 res.writeHead(404);
                 res.end("Not found");