@oddessentials/agent-guild 1.28.0 → 1.30.0

package/node_modules/ws/README.md

@@ -56,39 +56,27 @@ can use one of the many wrappers available on npm, like
 npm install ws
 ```
 
-### Opt-in for performance
+### Legacy opt-in for performance
 
-[bufferutil][] is an optional module that can be installed alongside the ws
-module:
+On older Node.js versions, ws can leverage optional binary modules to optimize
+performance.
 
-```
-npm install --save-optional bufferutil
-```
-
-This is a binary addon that improves the performance of certain operations such
-as masking and unmasking the data payload of the WebSocket frames. Prebuilt
-binaries are available for the most popular platforms, so you don't necessarily
-need to have a C++ compiler installed on your machine.
-
-To force ws to not use bufferutil, use the
-[`WS_NO_BUFFER_UTIL`](./doc/ws.md#ws_no_buffer_util) environment variable. This
-can be useful to enhance security in systems where a user can put a package in
-the package search path of an application of another user, due to how the
-Node.js resolver algorithm works.
-
-#### Legacy opt-in for performance
-
-If you are running on an old version of Node.js (prior to v18.14.0), ws also
-supports the [utf-8-validate][] module:
-
-```
-npm install --save-optional utf-8-validate
-```
+- `npm install --save-optional bufferutil`: Provides binary polyfills for
+  [`http.websocketMask()`][] and [`http.websocketUnmask()`][].
+- `npm install --save-optional utf-8-validate`: Provides a binary polyfill for
+  [`buffer.isUtf8()`][].
 
-This contains a binary polyfill for [`buffer.isUtf8()`][].
+On newer Node.js versions (v27.0.0-alpha.0.0.0 or later for bufferutil, and
+v18.14.0 or later for utf-8-validate) that feature built-in alternatives, these
+modules are not loaded even if installed.
 
-To force ws not to use utf-8-validate, use the
-[`WS_NO_UTF_8_VALIDATE`](./doc/ws.md#ws_no_utf_8_validate) environment variable.
+To force ws not to use [bufferutil][] or [utf-8-validate][] on the older Node.js
+versions where they would otherwise be loaded, set the
+[`WS_NO_BUFFER_UTIL`](./doc/ws.md#ws_no_buffer_util) and
+[`WS_NO_UTF_8_VALIDATE`](./doc/ws.md#ws_no_utf_8_validate) environment
+variables. This can be useful to enhance security in systems where a user can
+put a package in the package search path of an application of another user, due
+to how the Node.js resolver algorithm works.
 
 ## API docs
 
@@ -533,6 +521,10 @@ We're using the GitHub [releases][changelog] for changelog entries.
 [MIT](LICENSE)
 
 [`buffer.isutf8()`]: https://nodejs.org/api/buffer.html#bufferisutf8input
+[`http.websocketMask()`]:
+  https://nodejs.org/api/http.html#httpwebsocketmasksource-mask-output-offset-length
+[`http.websocketUnmask()`]:
+  https://nodejs.org/api/http.html#httpwebsocketunmaskbuffer-mask
 [bufferutil]: https://github.com/websockets/bufferutil
 [changelog]: https://github.com/websockets/ws/releases
 [client-report]: http://websockets.github.io/ws/autobahn/clients/

package/node_modules/ws/lib/buffer-util.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { websocketMask, websocketUnmask } = require('http');
+
 const { EMPTY_BUFFER } = require('./constants');
 
 const FastBuffer = Buffer[Symbol.species];
@@ -111,8 +113,17 @@ module.exports = {
   unmask: _unmask
 };
 
-/* istanbul ignore else  */
-if (!process.env.WS_NO_BUFFER_UTIL) {
+if (websocketMask) {
+  module.exports.mask = function (source, mask, output, offset, length) {
+    if (length < 24) _mask(source, mask, output, offset, length);
+    else websocketMask(source, mask, output, offset, length);
+  };
+
+  module.exports.unmask = function (buffer, mask) {
+    if (buffer.length < 24) _unmask(buffer, mask);
+    else websocketUnmask(buffer, mask);
+  };
+} /* istanbul ignore else  */ else if (!process.env.WS_NO_BUFFER_UTIL) {
   try {
     const bufferUtil = require('bufferutil');
 

package/node_modules/ws/lib/sender.js

@@ -153,7 +153,9 @@ class Sender {
       target.writeUIntBE(dataLength, 4, 6);
     }
 
-    if (!options.mask) return [target, data];
+    if (!options.mask) {
+      return dataLength ? [target, data] : [target];
+    }
 
     target[1] |= 0x80;
     target[offset - 4] = mask[0];
@@ -161,6 +163,7 @@ class Sender {
     target[offset - 2] = mask[2];
     target[offset - 1] = mask[3];
 
+    if (!dataLength) return [target];
     if (skipMasking) return [target, data];
 
     if (merge) {

package/node_modules/ws/lib/websocket.js

@@ -819,10 +819,15 @@ function initAsClient(websocket, address, protocols, options) {
   }
 
   if (isIpcUrl) {
-    const parts = opts.path.split(':');
+    const i = opts.path.indexOf(':');
 
-    opts.socketPath = parts[0];
-    opts.path = parts[1];
+    if (i === -1) {
+      opts.socketPath = opts.path;
+      opts.path = '';
+    } else {
+      opts.socketPath = opts.path.slice(0, i);
+      opts.path = opts.path.slice(i + 1);
+    }
   }
 
   let req;

package/node_modules/ws/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ws",
-  "version": "8.22.0",
+  "version": "8.22.1",
   "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
   "keywords": [
     "HyBi",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oddessentials/agent-guild",
-  "version": "1.28.0",
+  "version": "1.30.0",
   "description": "Launch and watch AI coding-assistant terminal sessions from one local web page. A bundled session manager owns the terminals so the page can close and reconnect.",
   "mcpName": "ai.oddessentials/agent-guild",
   "license": "AGPL-3.0-only",
@@ -50,17 +50,20 @@
     "test": "node --test --test-concurrency=1 \"tests/*.test.mjs\""
   },
   "dependencies": {
+    "@jsquash/jpeg": "1.6.0",
+    "@jsquash/png": "3.1.1",
+    "@jsquash/webp": "1.5.0",
     "@noble/hashes": "2.4.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/addon-web-links": "^0.12.0",
     "@xterm/headless": "^6.0.0",
     "@xterm/xterm": "^6.0.0",
-    "markdown-it": "^15.0.2",
+    "markdown-it": "^15.0.3",
     "node-pty": "^1.2.0-beta.15",
     "qrcode-generator": "2.0.4",
     "smol-toml": "1.9.1",
-    "ws": "^8.22.0"
+    "ws": "^8.22.1"
   },
   "bundleDependencies": true,
   "publishConfig": {
@@ -74,6 +77,6 @@
     "@gltf-transform/extensions": "4.5.1",
     "@gltf-transform/functions": "4.5.1",
     "esbuild": "0.28.2",
-    "three": "0.186.1"
+    "three": "0.187.0"
   }
 }

package/src/manager/config.mjs

@@ -56,6 +56,8 @@ export const paths = {
   get multiplexers() { return path.join(dataDir(), 'multiplexers.json'); },
   /** The Yard's art packs, one folder per content id. */
   get yardArt() { return path.join(dataDir(), 'yard-art'); },
+  get yardWorlds() { return path.join(dataDir(), 'yard-worlds'); },
+  get yardPieces() { return path.join(dataDir(), 'yard-pieces'); },
 };
 
 function writePrivate(file, contents) {

package/src/manager/folder-browser.mjs

@@ -1,8 +1,10 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { readManifest } from './yard-pieces.mjs';
 
 const failure = (status, code, message) => Object.assign(new Error(message), { status, code });
+const PIECE_SCAN = 500;
 const byName = (a, b) => a.name.localeCompare(b.name, undefined, { sensitivity: 'base', numeric: true }) || (a.name < b.name ? -1 : 1);
 
 export function folderSegments(dir, paths = path) {
@@ -30,7 +32,7 @@ export function folderNameProblem(name, platform = process.platform) {
   return null;
 }
 
-export function createFolderBrowser({ platform = process.platform, home = os.homedir(), limit = 2000, driveTimeoutMs = 500, fsp = fs.promises } = {}) {
+export function createFolderBrowser({ platform = process.platform, home = os.homedir(), limit = 2000, driveTimeoutMs = 500, fsp = fs.promises, workshop = null } = {}) {
   const paths = platform === 'win32' ? path.win32 : path.posix;
 
   async function roots() {
@@ -73,6 +75,37 @@ export function createFolderBrowser({ platform = process.platform, home = os.hom
     return folders.filter(Boolean).sort(byName);
   }
 
+  async function filesIn(dir, extension) {
+    const listed = await fsp.readdir(dir, { withFileTypes: true }).catch(() => []);
+    return listed.filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(extension))
+      .map((entry) => ({ name: entry.name, path: paths.join(dir, entry.name) })).sort(byName);
+  }
+
+  async function pieceIn(dir, kind) {
+    const file = paths.join(dir, 'piece.json');
+    try {
+      const stat = await fsp.lstat(file);
+      if (!stat.isFile() || stat.size > 16 * 1024) return null;
+      const bytes = await fsp.readFile(file), folder = paths.basename(dir);
+      try {
+        const { title } = readManifest(bytes, kind);
+        return { title: title || folder, folder, path: dir };
+      } catch (err) {
+        const meta = err.newer ? JSON.parse(bytes.toString('utf8')) : null;
+        if (meta?.kind !== kind) return null;
+        const title = typeof meta.title === 'string' && meta.title.length <= 128 && !/\p{Cc}/u.test(meta.title) ? meta.title.trim() : '';
+        return { title: title || folder, folder, path: dir, problem: err.message };
+      }
+    } catch {
+      return null;
+    }
+  }
+
+  async function piecesIn(dir, folders, kind) {
+    const found = await Promise.all([dir, ...folders.slice(0, PIECE_SCAN).map((entry) => entry.path)].map((folder) => pieceIn(folder, kind)));
+    return found.filter(Boolean).sort((a, b) => a.title.localeCompare(b.title, undefined, { sensitivity: 'base', numeric: true }) || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  }
+
   const browser = {
     async create(rawParent, rawName) {
       if (typeof rawParent !== 'string' || !rawParent.trim() || rawParent.includes('\0')) throw failure(400, 'bad_path', 'The folder must be a path.');
@@ -97,7 +130,7 @@ export function createFolderBrowser({ platform = process.platform, home = os.hom
       }
       return browser.list(dir);
     },
-    async list(raw) {
+    async list(raw, { extension = null, pieces = null } = {}) {
       if (raw !== undefined && raw !== null && (typeof raw !== 'string' || raw.includes('\0'))) {
         throw failure(400, 'bad_path', 'The folder must be a path.');
       }
@@ -105,8 +138,9 @@ export function createFolderBrowser({ platform = process.platform, home = os.hom
       if (asked === '~' || asked.startsWith('~/') || asked.startsWith('~\\')) asked = paths.join(home, asked.slice(1));
       const wanted = asked ? paths.resolve(asked) : home;
       const dir = await nearestFolder(wanted);
-      const [folders, drives] = await Promise.all([entries(dir), roots()]);
+      const [folders, drives, files] = await Promise.all([entries(dir), roots(), extension ? filesIn(dir, extension) : null]);
       const parent = paths.dirname(dir);
+      const [found, steam] = pieces ? await Promise.all([piecesIn(dir, folders, pieces), workshop ? workshop() : null]) : [null, null];
       return {
         path: dir,
         parent: parent === dir ? null : parent,
@@ -116,6 +150,8 @@ export function createFolderBrowser({ platform = process.platform, home = os.hom
         entries: folders.slice(0, limit),
         truncated: folders.length > limit,
         note: dir === wanted ? null : wanted,
+        ...(files ? { files: files.slice(0, limit) } : {}),
+        ...(found ? { pieces: found, workshop: steam } : {}),
       };
     },
   };

package/src/manager/main.mjs

@@ -17,6 +17,8 @@ import { Changelog } from './changelog.mjs';
 import { GitHub } from './github.mjs';
 import { createManagerServer } from './server.mjs';
 import { YardArt } from './yard-art.mjs';
+import { YardWorlds } from './yard-worlds.mjs';
+import { YardPieces } from './yard-pieces.mjs';
 import { loadPty } from './pty.mjs';
 import { createNotesStore } from './notes.mjs';
 import { createCardNames } from './card-names.mjs';
@@ -186,6 +188,8 @@ export async function startManager({ port = resolvePort(), host = DEFAULT_HOST,
     notes: createNotesStore(paths.notes),
     launcher: launcherPath(),
     yardArt: new YardArt({ webDir, dir: paths.yardArt }),
+    yardWorlds: new YardWorlds({ dir: paths.yardWorlds }),
+    yardPieces: new YardPieces({ dir: paths.yardPieces }),
     mcpConnect,
     onShutdownRequest: ({ restart = false } = {}) => shutdown('requested via API', { restart }).then((code) => process.exit(code)),
   });

package/src/manager/server.mjs

@@ -19,6 +19,9 @@ import { createOptionalCards } from './optional-cards.mjs';
 import { MODES as AUTOSTART_MODES } from './autostart.mjs';
 import { ptyRestartProblem } from './pty.mjs';
 import { YardArt } from './yard-art.mjs';
+import { YardWorlds } from './yard-worlds.mjs';
+import { YardPieces } from './yard-pieces.mjs';
+import { createWorkshopFinder } from './steam-workshop.mjs';
 import { spokenText } from './spoken-text.mjs';
 import { MCP_ACTIONS } from './mcp-connect.mjs';
 
@@ -69,8 +72,8 @@ const SECURITY_HEADERS = {
   'Referrer-Policy': 'no-referrer',
   'Cross-Origin-Resource-Policy': 'same-origin',
   'Content-Security-Policy':
-    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://i.ytimg.com; " +
-    "connect-src 'self' ws://127.0.0.1:* ws://localhost:*; frame-src https://www.youtube-nocookie.com; " +
+    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://i.ytimg.com; " +
+    "connect-src 'self' blob: ws://127.0.0.1:* ws://localhost:*; frame-src https://www.youtube-nocookie.com; " +
     "frame-ancestors vscode-webview: vscode-file:; base-uri 'none'; form-action 'none'",
 };
 
@@ -176,7 +179,7 @@ export function createManagerServer({
   notes = createNotesStore(),
   deviceSignIn = new DeviceSignIn({ token }),
   folderOpener = createFolderOpener({ resolveCwd: (cwd) => manager.resolveCwd(cwd) }),
-  folderBrowser = createFolderBrowser(),
+  folderBrowser = createFolderBrowser({ workshop: createWorkshopFinder() }),
   /** The double-click launcher file for this platform, or null when the package carries none. */
   launcher = null,
   /** @type {(opts: { restart: boolean }) => void} */
@@ -185,6 +188,8 @@ export function createManagerServer({
   nextManagerProblem = ptyRestartProblem,
   /** The Yard's art; without a data folder, only a checkout's. */
   yardArt = new YardArt({ webDir }),
+  yardWorlds = new YardWorlds(),
+  yardPieces = new YardPieces(),
   mcpConnect = null,
   heartbeatMs = 30000,
 }) {
@@ -292,6 +297,18 @@ export function createManagerServer({
       throw new HttpError(400, 'malformed path', 'bad_path');
     }
     if (rel.includes('\0')) throw new HttpError(404, 'not found', 'not_found');
+    if (rel.startsWith('yard/worlds/')) {
+      const [skin, name, ...rest] = rel.slice('yard/worlds/'.length).split('/');
+      const world = rest.length ? null : yardWorlds.file(skin, name);
+      if (!world) throw new HttpError(404, 'not found', 'not_found');
+      return serveFile(req, res, world);
+    }
+    if (rel.startsWith('yard/pieces/')) {
+      const [skin, slot, name, ...rest] = rel.slice('yard/pieces/'.length).split('/');
+      const piece = rest.length ? null : yardPieces.file(skin, slot, name);
+      if (!piece) throw new HttpError(404, 'not found', 'not_found');
+      return serveFile(req, res, piece);
+    }
     let root = webDir;
     if (rel.startsWith('yard/assets/')) {
       root = yardArt.assetsDir();
@@ -408,6 +425,14 @@ export function createManagerServer({
     if (route === '/yard-art' && method === 'GET') return sendJson(res, 200, { yardArt: yardArt.snapshot() });
     if (route === '/yard-art/download' && method === 'POST') return sendJson(res, 202, { yardArt: yardArt.start() });
     if (route === '/yard-art/cancel' && method === 'POST') return sendJson(res, 200, { yardArt: yardArt.cancel() });
+    if (route === '/yard-worlds' && method === 'GET') return sendJson(res, 200, { yardWorlds: yardWorlds.snapshot() });
+    const yardWorld = route.match(/^\/yard-worlds\/([a-z]+)$/);
+    if (yardWorld && method === 'PUT') return sendJson(res, 200, { yardWorlds: await yardWorlds.replace(yardWorld[1], (await readJsonBody(req)).path) });
+    if (yardWorld && method === 'DELETE') return sendJson(res, 200, { yardWorlds: await yardWorlds.restore(yardWorld[1]) });
+    if (route === '/yard-pieces' && method === 'GET') return sendJson(res, 200, { yardPieces: yardPieces.snapshot() });
+    const yardPiece = route.match(/^\/yard-pieces\/([a-z]+)\/([a-z]+)$/);
+    if (yardPiece && method === 'PUT') return sendJson(res, 200, { yardPieces: await yardPieces.replace(yardPiece[1], yardPiece[2], (await readJsonBody(req)).path) });
+    if (yardPiece && method === 'DELETE') return sendJson(res, 200, { yardPieces: await yardPieces.restore(yardPiece[1], yardPiece[2]) });
     if (route === '/yard/fireworks' && method === 'POST') {
       broadcast({ type: 'yard.fireworks' });
       return sendJson(res, 200, { ok: true, pages: [...eventClients].filter((ws) => !ws.revoked && ws.readyState === ws.OPEN).length });
@@ -435,7 +460,7 @@ export function createManagerServer({
       return sendJson(res, 200, { ok: true });
     }
     if (route === '/folders' && method === 'GET') {
-      return sendJson(res, 200, await folderBrowser.list(url.searchParams.get('path') ?? undefined));
+      return sendJson(res, 200, await folderBrowser.list(url.searchParams.get('path') ?? undefined, { extension: url.searchParams.get('files') === 'agworld' ? '.agworld' : null, pieces: ['character', 'companion'].includes(url.searchParams.get('pieces')) ? url.searchParams.get('pieces') : null }));
     }
     if (route === '/folders' && method === 'POST') {
       const { path: parent, name } = await readJsonBody(req);
@@ -771,10 +796,12 @@ export function createManagerServer({
   remoteAccess?.on('updated', () => broadcast({ type: 'remote-access.updated' }));
   deviceSignIn.on('updated', () => broadcast({ type: 'sign-in.updated' }));
   yardArt.on('updated', (status) => broadcast({ type: 'yard-art.updated', yardArt: status }));
+  yardWorlds.on('updated', (worlds) => broadcast({ type: 'yard-worlds.updated', yardWorlds: worlds }));
+  yardPieces.on('updated', (pieces) => broadcast({ type: 'yard-pieces.updated', yardPieces: pieces }));
 
   function handleEvents(ws, req) {
     eventClients.add(ws);
-    const hello = { type: 'hello', version, pid: process.pid, platform: process.platform, startedAt, launcher, folderOpener: folderOpenerFor(req), remoteAccess: remoteAccess ? { available: true } : null, upgrade: upgradeInfo(), yardArt: yardArt.snapshot(), sessions: manager.list(), heartbeat: true };
+    const hello = { type: 'hello', version, pid: process.pid, platform: process.platform, startedAt, launcher, folderOpener: folderOpenerFor(req), remoteAccess: remoteAccess ? { available: true } : null, upgrade: upgradeInfo(), yardArt: yardArt.snapshot(), yardWorlds: yardWorlds.snapshot(), yardPieces: yardPieces.snapshot(), sessions: manager.list(), heartbeat: true };
     const notesHello = notes.helloRevision();
     if (notesHello.known) hello.notesRevision = notesHello.revision;
     else hello.notesUnreadable = true;

package/src/manager/steam-workshop.mjs

@@ -0,0 +1,64 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+export const WORLD_APP = '5462970';
+
+export function parseVdf(text) {
+  const tokens = text.match(/"(?:[^"\\]|\\.)*"|[{}]/g) ?? [];
+  const root = {}, stack = [root];
+  let key = null;
+  for (const token of tokens) {
+    const top = stack[stack.length - 1];
+    if (token === '{') {
+      if (key === null) return root;
+      stack.push(top[key.toLowerCase()] = {});
+      key = null;
+    } else if (token === '}') {
+      if (stack.length > 1) stack.pop();
+      key = null;
+    } else {
+      const value = token.slice(1, -1).replace(/\\(.)/g, '$1');
+      if (key === null) key = value;
+      else { top[key.toLowerCase()] = value; key = null; }
+    }
+  }
+  return root;
+}
+
+function windowsSteam() {
+  return new Promise((resolve) => {
+    execFile('reg', ['query', 'HKCU\\Software\\Valve\\Steam', '/v', 'SteamPath'], { timeout: 5000, windowsHide: true }, (err, stdout) => {
+      resolve(err ? null : String(stdout).match(/SteamPath\s+REG_\w+\s+(.+)/)?.[1]?.trim() || null);
+    });
+  });
+}
+
+export function steamRoots({ platform = process.platform, home = os.homedir(), registry = windowsSteam } = {}) {
+  if (platform === 'win32') return registry().then((root) => (root ? [root] : []));
+  if (platform === 'darwin') return Promise.resolve([path.join(home, 'Library', 'Application Support', 'Steam')]);
+  return Promise.resolve([path.join(home, '.local', 'share', 'Steam'), path.join(home, '.steam', 'steam'), path.join(home, '.var', 'app', 'com.valvesoftware.Steam', '.local', 'share', 'Steam')]);
+}
+
+export async function worldLibrary({ roots = steamRoots(), fsp = fs.promises } = {}) {
+  for (const root of await roots) {
+    let folders;
+    try { folders = parseVdf(await fsp.readFile(path.join(root, 'steamapps', 'libraryfolders.vdf'), 'utf8')).libraryfolders; } catch { continue; }
+    for (const entry of Object.values(folders ?? {})) {
+      if (typeof entry === 'object' && typeof entry.path === 'string' && entry.apps && Object.hasOwn(entry.apps, WORLD_APP)) return path.normalize(entry.path);
+    }
+  }
+  return null;
+}
+
+export function createWorkshopFinder({ library = () => worldLibrary(), fsp = fs.promises } = {}) {
+  let found = null;
+  return async () => {
+    found ??= library().catch(() => null);
+    const root = await found;
+    if (!root) { found = null; return null; }
+    const folder = path.join(root, 'steamapps', 'workshop', 'content', WORLD_APP);
+    return (await fsp.stat(folder).then((stat) => stat.isDirectory(), () => false)) ? folder : null;
+  };
+}

package/src/manager/yard-art.mjs

@@ -283,7 +283,7 @@ export class YardArt extends EventEmitter {
 }
 
 // Windows can hold a just-written folder briefly (indexing, antivirus).
-async function renameRetrying(from, to) {
+export async function renameRetrying(from, to) {
   for (let attempt = 0; ; attempt++) {
     try { return await fsp.rename(from, to); } catch (err) {
       if (attempt >= 20 || !['EPERM', 'EBUSY', 'EACCES'].includes(err.code)) throw err;