@oar-sh/oar 0.9.7 → 0.9.9

package/server/services/pwa-manifest-theme.mjs

@@ -0,0 +1,30 @@
+// The installed app's icon and launch screen follow the Theme setting: the
+// page links the manifest with `?theme=light` in Day mode, and the manifest
+// then names the light icon set and a white background.
+
+export const PWA_LIGHT_BACKGROUND = '#ffffff';
+
+export function normalizePwaTheme(value) {
+  return String(value || '').trim().toLowerCase() === 'light' ? 'light' : 'dark';
+}
+
+function lightIconSrc(src) {
+  return String(src || '').replace(/(^|\/)app-icon(?=[-.])/, '$1app-icon-light');
+}
+
+/**
+ * The manifest for one theme. Dark is the template as it stands; light swaps
+ * every `app-icon*` source for its `app-icon-light*` twin and whitens the
+ * launch background and the toolbar colour.
+ */
+export function applyPwaManifestTheme(manifest, theme) {
+  if (normalizePwaTheme(theme) !== 'light') return manifest;
+  return {
+    ...manifest,
+    background_color: PWA_LIGHT_BACKGROUND,
+    theme_color: PWA_LIGHT_BACKGROUND,
+    icons: Array.isArray(manifest?.icons)
+      ? manifest.icons.map((icon) => ({ ...icon, src: lightIconSrc(icon?.src) }))
+      : manifest?.icons,
+  };
+}

package/server/services/safe-served-content.mjs

@@ -3,15 +3,20 @@
 //
 // The threat: a semi-trusted producer (an AI worker writing a workspace file, or
 // an uploaded attachment) can supply content whose MIME type the browser will
-// execute as markup/script on THIS origin — `text/html`, `image/svg+xml`, XML
-// with embedded script. Served inline, that is stored XSS against the app (and,
-// via the unauthenticated /api/shared/* routes, against share viewers). We
-// neutralize such types to `text/plain` and always send `nosniff`, and we attach
-// a locked-down CSP + `sandbox` so anything that still reaches the browser as a
+// execute as markup/script on THIS origin — `text/html`, XML with embedded
+// script. Served inline, that is stored XSS against the app (and, via the
+// unauthenticated /api/shared/* routes, against share viewers). We neutralize
+// such types to `text/plain` and always send `nosniff`, and we attach a
+// locked-down CSP + `sandbox` so anything that still reaches the browser as a
 // document can neither run script nor navigate.
+//
+// SVG keeps its type: as an `<img>` it never runs script, and opened as a
+// document the `sandbox` CSP denies it script and an origin, so the viewer
+// and the file browser's thumbnails can show it.
 
 // Types the browser renders as active documents on this origin.
-const ACTIVE_MARKUP_PATTERN = /^text\/html\b|svg|xhtml|(^|\/)xml\b|\+xml\b/i;
+const ACTIVE_MARKUP_PATTERN = /^text\/html\b|xhtml|(^|\/)xml\b|\+xml\b/i;
+const SVG_TYPE = 'image/svg+xml';
 
 // Types safe to preview inline with their real Content-Type.
 const INLINE_SAFE_PREFIXES = ['image/', 'video/', 'audio/'];
@@ -25,7 +30,7 @@ const INLINE_SAFE_EXACT = new Set(['application/pdf']);
 export function safeServedContentType(mimeType) {
   const type = String(mimeType || '').trim().toLowerCase().split(';')[0].slice(0, 127)
     || 'application/octet-stream';
-  if (ACTIVE_MARKUP_PATTERN.test(type)) {
+  if (type !== SVG_TYPE && ACTIVE_MARKUP_PATTERN.test(type)) {
     // Render markup/script content as its own source text instead of executing it.
     return { contentType: 'text/plain; charset=utf-8', inlineSafe: false, neutralized: true };
   }
@@ -34,6 +39,45 @@ export function safeServedContentType(mimeType) {
   return { contentType: type, inlineSafe, neutralized: false };
 }
 
+// Printable ASCII, the only characters a quoted `filename="…"` may hold once
+// quotes and backslashes are gone. Anything else goes into `filename*`.
+const NON_ASCII_PATTERN = /[^\x20-\x7e]/g;
+// A surrogate without its partner: not a character, and encodeURIComponent
+// throws on it.
+const LONE_SURROGATE_PATTERN = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+
+/** RFC 5987 `ext-value` encoding: UTF-8 percent-encoded, attr-char kept. */
+function encodeRfc5987(value) {
+  return encodeURIComponent(value)
+    // encodeURIComponent leaves these alone, but RFC 5987 does not allow them bare.
+    .replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+
+/**
+ * The `Content-Disposition` value for `fileName`, RFC 6266 style: a quoted
+ * `filename` every client can read, built from the name's ASCII characters
+ * (never empty: `file` plus the extension when nothing is left), and, when the
+ * name has characters outside ASCII, `filename*=UTF-8''…` carrying the whole
+ * name percent-encoded. The result holds nothing a header may not: no
+ * control characters, no quotes inside the quoted string, and no character
+ * outside Latin-1, which Node's `setHeader` rejects (and which used to make a
+ * file with a Japanese or emoji name unservable).
+ */
+export function contentDispositionValue(disposition, fileName) {
+  const name = String(fileName || '')
+    .replace(LONE_SURROGATE_PATTERN, '')
+    .replace(/[\u0000-\u001f\u007f"\\]/g, '')
+    .slice(0, 255);
+  if (!name) return disposition;
+  const ascii = name.replace(NON_ASCII_PATTERN, '').trim();
+  if (ascii === name) return `${disposition}; filename="${name}"`;
+  const dot = name.lastIndexOf('.');
+  const stem = (dot > 0 ? name.slice(0, dot) : name).replace(NON_ASCII_PATTERN, '').replace(/^[\s.]+|[\s.]+$/g, '') || 'file';
+  const ext = (dot > 0 ? name.slice(dot) : '').replace(NON_ASCII_PATTERN, '').trim();
+  const fallback = `${stem}${ext.length > 1 ? ext : ''}`;
+  return `${disposition}; filename="${fallback}"; filename*=UTF-8''${encodeRfc5987(name)}`;
+}
+
 /**
  * Apply the safe Content-Type plus the hardening headers to a response that is
  * about to stream stored bytes. Returns the resolved descriptor so callers can
@@ -46,12 +90,18 @@ export function applySafeServedContentHeaders(res, mimeType, { fileName = '' } =
   // Belt-and-braces: a served file is never part of the app UI, so forbid it
   // from loading anything or being framed, and sandbox it so it cannot run
   // script or navigate even if a browser would otherwise treat it as active.
-  res.setHeader('Content-Security-Policy', "default-src 'none'; sandbox; frame-ancestors 'none'");
-  const safeName = String(fileName || '').replace(/[\r\n"\\]/g, '').slice(0, 255);
-  const disposition = resolved.inlineSafe ? 'inline' : 'attachment';
+  // A PDF is the exception: browsers refuse to show a sandboxed PDF in their
+  // built-in viewer, so it gets no `sandbox` and may be framed by this origin.
+  // PDF viewers do not run document script, so the sandbox bought nothing there.
+  res.setHeader(
+    'Content-Security-Policy',
+    resolved.contentType === 'application/pdf'
+      ? "default-src 'none'; frame-ancestors 'self'"
+      : "default-src 'none'; sandbox; frame-ancestors 'none'",
+  );
   res.setHeader(
     'Content-Disposition',
-    safeName ? `${disposition}; filename="${safeName}"` : disposition,
+    contentDispositionValue(resolved.inlineSafe ? 'inline' : 'attachment', fileName),
   );
   return resolved;
 }

package/server/services/session-history-refresh-service.mjs

@@ -144,6 +144,22 @@ export function createSessionHistoryRefreshService({
         WHERE conversation_id = ? AND hidden_from_shares = 1
       `)
     : null;
+  // Pins are carried across the replace the same way as hidden marks.
+  const messagesSupportPins = messageColumns.has('pinned_at');
+  const listPinnedMessageMarks = messagesSupportPins
+    ? db.prepare(`
+        SELECT id, role, text, timestamp, pinned_at
+        FROM messages
+        WHERE conversation_id = ? AND pinned_at IS NOT NULL
+      `)
+    : null;
+  const restoreMessagePin = messagesSupportPins
+    ? db.prepare(`
+        UPDATE messages
+        SET pinned_at = ?
+        WHERE conversation_id = ? AND id = ?
+      `)
+    : null;
   const restoreHiddenMessageVisibility = messagesSupportShareVisibility
     ? db.prepare(`
         UPDATE messages
@@ -418,6 +434,7 @@ export function createSessionHistoryRefreshService({
 
   const replaceRetrievableHistoryTx = db.transaction((conversationId, messages = []) => {
     const hiddenMessages = listHiddenMessageVisibility?.all(conversationId) || [];
+    const pinnedMessages = listPinnedMessageMarks?.all(conversationId) || [];
     const attachmentCandidates = collectAttachmentCandidates(conversationId);
     deleteConversationMessages.run(conversationId);
     deleteConversationActivity.run(conversationId);
@@ -437,6 +454,13 @@ export function createSessionHistoryRefreshService({
         resolvedId,
       );
     }
+    // Its own consumed set: a message can be both hidden and pinned.
+    const consumedPinnedIds = new Set();
+    for (const pinnedMessage of pinnedMessages) {
+      const resolvedId = resolveHiddenMessageId(pinnedMessage, rebuiltMessages, consumedPinnedIds);
+      if (!resolvedId) continue;
+      restoreMessagePin.run(pinnedMessage.pinned_at, conversationId, resolvedId);
+    }
   });
 
   function evaluateRefreshIdleState(conversationId) {

package/server/services/session-worker-registry-service.mjs

@@ -82,6 +82,19 @@ function normalizeSteeringCancellableIds(raw) {
   return ids;
 }
 
+// The Claude worker's running CLI: the compaction window it was spawned with
+// (a token count, null = Auto) and whether background work holds it, which
+// blocks the respawn that applies a changed window. Null when no CLI runs or
+// the worker does not report it.
+function normalizeSteeringAutoCompactWindow(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const active = Number(raw.active);
+  return {
+    active: Number.isFinite(active) && active > 0 ? Math.round(active) : null,
+    backgroundWork: raw.backgroundWork === true,
+  };
+}
+
 // The worker's composer-facing steering snapshot, published on its heartbeat.
 // Callers follow the registry convention of spreading the existing entry into
 // upserts, so an update without `steering` keeps the last known snapshot.
@@ -98,7 +111,7 @@ export function normalizeWorkerSteeringSnapshot(raw) {
   if (!raw || typeof raw !== 'object') return null;
   const holdReason = String(raw.holdReason || '').trim().toLowerCase();
   const messageId = String(raw.messageId || '').trim().slice(0, STEERING_MESSAGE_ID_MAX_LENGTH);
-  return {
+  const snapshot = {
     turnActive: raw.turnActive === true,
     canSteer: raw.canSteer === true,
     holdReason: STEERING_HOLD_REASONS.has(holdReason) ? holdReason : null,
@@ -106,6 +119,10 @@ export function normalizeWorkerSteeringSnapshot(raw) {
     supported: raw.supported === true,
     cancellableIds: normalizeSteeringCancellableIds(raw.cancellableIds),
   };
+  // Only a snapshot that reports a running CLI carries the key.
+  const autoCompactWindow = normalizeSteeringAutoCompactWindow(raw.autoCompactWindow);
+  if (autoCompactWindow) snapshot.autoCompactWindow = autoCompactWindow;
+  return snapshot;
 }
 
 function sanitizeState(raw = null) {

package/server/services/update-install-service.mjs

@@ -1,6 +1,7 @@
 'use strict';
 
 import { spawn as defaultSpawn } from 'child_process';
+import fs from 'fs';
 
 import {
   CLI_SPAWN_DISABLED_ERROR,
@@ -10,6 +11,7 @@ import {
   stripTerminalEscapes,
   tailOf,
 } from './cli-process-runner.mjs';
+import { NPM_ALLOW_SCRIPTS_ARG, resolveNpmInvocation } from './oar-cli-helpers.mjs';
 import { compareSemverIsh, parseSemverIsh } from '../../shared/update-semver.mjs';
 
 // Applies an OAR self-update: `npm i -g @oar-sh/oar@<version>` with the log
@@ -99,6 +101,9 @@ export function readUpdateOutcome(readSetting) {
 export function createUpdateInstallService({
   runningVersion,
   installMethod = 'npm-global',
+  packageRoot = '',
+  execPath = process.execPath,
+  existsImpl = fs.existsSync,
   spawnImpl = defaultSpawn,
   env = process.env,
   platform = process.platform,
@@ -204,12 +209,13 @@ export function createUpdateInstallService({
 
     // npm itself is a shim on Windows; spawn npm.cmd through a shell there
     // (args are fixed strings + a validated semver, so no injection surface).
-    const command = platform === 'win32' ? 'npm.cmd' : 'npm';
-    const args = ['install', '-g', `${UPDATE_PACKAGE_NAME}@${target}`];
+    const npm = resolveNpmInvocation({ execPath, packageRoot, platform, env, existsImpl });
+    const command = npm.command;
+    const args = ['install', '-g', ...npm.prefixArgs, NPM_ALLOW_SCRIPTS_ARG, `${UPDATE_PACKAGE_NAME}@${target}`];
     const result = await runToCompletion(
       () => spawnImpl(command, args, {
         stdio: ['ignore', 'pipe', 'pipe'],
-        env: { ...env },
+        env: npm.env,
         ...(platform === 'win32' ? { windowsHide: true, shell: true } : { detached: true }),
       }),
       {