@overaihq/cli 0.13.0 → 0.13.2

package/dist/{chunk-56E4CWBE.js → chunk-5CMM7GCC.js}

@@ -378,6 +378,10 @@ var screenshotResultPayloadSchema = external_exports.object({
   width: external_exports.number().optional(),
   height: external_exports.number().optional()
 });
+var injectCodeMessageSchema = external_exports.object({
+  type: external_exports.literal("injectCode"),
+  code: external_exports.string()
+});
 
 // ../common/src/webPage.ts
 var webPageLanguage = ["react"];
@@ -393,11 +397,21 @@ var webPageConfigSchema = external_exports.object({
   /* Drops the iframe's sandbox attribute — needed for storage, cookies, forms. */
   noSandbox: configFlag,
   /* Renders the page fullscreen for guests by hiding the workspace top bar. */
-  hideTopBar: configFlag
+  hideTopBar: configFlag,
+  /*
+   * Which iframe runtime renders the page. "v1" is the sandboxed srcdoc
+   * iframe; "v2" serves the page from its own origin (separate renderer
+   * process, real localStorage). Absent or invalid reads as "v1" so a legacy
+   * config never fails to parse over the toggle.
+   */
+  runtime: external_exports.enum(["v1", "v2"]).catch("v1")
 });
 var webPageConfigWriteSchema = webPageConfigSchema.extend({
   noSandbox: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
-  hideTopBar: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish()
+  hideTopBar: external_exports.union([external_exports.boolean(), external_exports.enum(["true", "false"])]).nullish(),
+  // Without this override the read schema's .catch would silently push a typo
+  // ("V2", "2") as v1.
+  runtime: external_exports.enum(["v1", "v2"]).nullish()
 });
 var defaultWebPageTemplate = reactDefaultTemplate.replace(
   'className="page"',

package/dist/index.js

@@ -5,7 +5,7 @@ import {
 import {
   itemFilterExpressionRootSchema,
   webPageConfigSchema
-} from "./chunk-56E4CWBE.js";
+} from "./chunk-5CMM7GCC.js";
 import {
   external_exports
 } from "./chunk-XCJJTK3H.js";
@@ -20019,9 +20019,9 @@ var require_dist = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/conventions.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/conventions.js
 var require_conventions = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/conventions.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/conventions.js"(exports) {
     "use strict";
     function find2(list, predicate, ac) {
       if (ac === void 0) {
@@ -20228,9 +20228,9 @@ var require_conventions = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/errors.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/errors.js
 var require_errors = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/errors.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/errors.js"(exports) {
     "use strict";
     var conventions = require_conventions();
     function extendError(constructor, writableName) {
@@ -20373,9 +20373,10 @@ var require_errors = __commonJS({
     }
     var key;
     var i;
-    function ParseError2(message, locator) {
+    function ParseError2(message, locator, cause) {
       this.message = message;
       this.locator = locator;
+      this.cause = cause;
       if (Error.captureStackTrace) Error.captureStackTrace(this, ParseError2);
     }
     extendError(ParseError2);
@@ -20386,9 +20387,9 @@ var require_errors = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/grammar.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/grammar.js
 var require_grammar = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/grammar.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/grammar.js"(exports) {
     "use strict";
     function detectUnicodeSupport(RegExpImpl) {
       try {
@@ -20433,7 +20434,7 @@ var require_grammar = __commonJS({
           }
           return isStr ? part : part.source;
         }).join(""),
-        UNICODE_SUPPORT ? "mu" : "m"
+        UNICODE_SUPPORT ? "u" : ""
       );
     }
     function regg(args) {
@@ -20459,6 +20460,7 @@ var require_grammar = __commonJS({
     var NameStartChar_s = chars(NameStartChar);
     var NameChar = reg("[", NameStartChar_s, chars(/[-.0-9\xB7]/), chars(/[\u0300-\u036F\u203F-\u2040]/), "]");
     var Name = reg(NameStartChar, NameChar, "*");
+    var Name_exact = reg("^", Name, "$");
     var Nmtoken = reg(NameChar, "+");
     var EntityRef = reg("&", Name, ";");
     var CharRef = regg(/&#[0-9]+;|&#x[0-9a-fA-F]+;/);
@@ -20473,11 +20475,12 @@ var require_grammar = __commonJS({
     var NCNameStartChar = chars_without(NameStartChar, ":");
     var NCNameChar = chars_without(NameChar, ":");
     var NCName = reg(NCNameStartChar, NCNameChar, "*");
+    var NCName_exact = reg("^", NCName, "$");
     var QName = reg(NCName, regg(":", NCName), "?");
     var QName_exact = reg("^", QName, "$");
     var QName_group = reg("(", QName, ")");
     var SystemLiteral = regg(/"[^"]*"|'[^']*'/);
-    var PI = reg(/^<\?/, "(", Name, ")", regg(S, "(", Char, "*?)"), "?", /\?>/);
+    var PI = reg(/^<\?/, "(", Name, ")", regg(S, "(?!", _SChar, ")(", Char, "*?)"), "?", /\?>/);
     var PubidChar = /[\x20\x0D\x0Aa-zA-Z0-9-'()+,./:=?;!*#@$_%]/;
     var PubidLiteral = regg('"', PubidChar, '*"', "|", "'", chars_without(PubidChar, "'"), "*'");
     var COMMENT_START = "<!--";
@@ -20566,6 +20569,8 @@ var require_grammar = __commonJS({
     exports.ExternalID = ExternalID;
     exports.ExternalID_match = ExternalID_match;
     exports.Name = Name;
+    exports.Name_exact = Name_exact;
+    exports.NCName_exact = NCName_exact;
     exports.NotationDecl = NotationDecl;
     exports.Reference = Reference;
     exports.PEReference = PEReference;
@@ -20589,9 +20594,9 @@ var require_grammar = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/dom.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/dom.js
 var require_dom = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/dom.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/dom.js"(exports) {
     "use strict";
     var conventions = require_conventions();
     var find2 = conventions.find;
@@ -20857,6 +20862,8 @@ var require_dom = __commonJS({
     };
     _extends(LiveNodeList, NodeList);
     function NamedNodeMap() {
+      this._nsIndex = /* @__PURE__ */ Object.create(null);
+      this._noNsIndex = /* @__PURE__ */ Object.create(null);
     }
     function _findNodeIndex(list, node) {
       var i = 0;
@@ -20867,6 +20874,30 @@ var require_dom = __commonJS({
         i++;
       }
     }
+    function _nnmBucket(map2, namespaceURI, create) {
+      if (!namespaceURI) {
+        return map2._noNsIndex;
+      }
+      var bucket = map2._nsIndex[namespaceURI];
+      if (!bucket && create) {
+        bucket = map2._nsIndex[namespaceURI] = /* @__PURE__ */ Object.create(null);
+      }
+      return bucket;
+    }
+    function _nnmIndexFind(map2, namespaceURI, localName) {
+      var bucket = _nnmBucket(map2, namespaceURI, false);
+      var found = bucket && bucket[localName];
+      return found ? found : null;
+    }
+    function _nnmIndexAdd(map2, attr) {
+      _nnmBucket(map2, attr.namespaceURI, true)[attr.localName] = attr;
+    }
+    function _nnmIndexRemove(map2, attr) {
+      var bucket = _nnmBucket(map2, attr.namespaceURI, false);
+      if (bucket) {
+        delete bucket[attr.localName];
+      }
+    }
     function _addNamedNode(el, list, newAttr, oldAttr) {
       if (oldAttr) {
         list[_findNodeIndex(list, oldAttr)] = newAttr;
@@ -20874,6 +20905,7 @@ var require_dom = __commonJS({
         list[list.length] = newAttr;
         list.length++;
       }
+      _nnmIndexAdd(list, newAttr);
       if (el) {
         newAttr.ownerElement = el;
         var doc = el.ownerDocument;
@@ -20891,6 +20923,7 @@ var require_dom = __commonJS({
           list[i] = list[++i];
         }
         list.length = lastIndex;
+        _nnmIndexRemove(list, attr);
         if (el) {
           var doc = el.ownerDocument;
           if (doc) {
@@ -20946,7 +20979,7 @@ var require_dom = __commonJS({
         if (el && el !== this._ownerElement) {
           throw new DOMException(DOMException.INUSE_ATTRIBUTE_ERR);
         }
-        var oldAttr = this.getNamedItemNS(attr.namespaceURI, attr.localName);
+        var oldAttr = _nnmIndexFind(this, attr.namespaceURI, attr.localName);
         if (oldAttr === attr) {
           return attr;
         }
@@ -21608,8 +21641,29 @@ var require_dom = __commonJS({
             while (child) {
               var next = child.nextSibling;
               if (next !== null && next.nodeType === TEXT_NODE && child.nodeType === TEXT_NODE) {
-                node.removeChild(next);
-                child.appendData(next.data);
+                var tail = [];
+                var sibling = next;
+                while (sibling !== null && sibling.nodeType === TEXT_NODE) {
+                  tail.push(sibling.data);
+                  sibling = sibling.nextSibling;
+                }
+                var removed = child.nextSibling;
+                while (removed !== sibling) {
+                  var following = removed.nextSibling;
+                  removed.parentNode = null;
+                  removed.previousSibling = null;
+                  removed.nextSibling = null;
+                  removed = following;
+                }
+                child.nextSibling = sibling;
+                if (sibling !== null) {
+                  sibling.previousSibling = child;
+                } else {
+                  node.lastChild = child;
+                }
+                child.appendData(tail.join(""));
+                _onUpdateChild(node.ownerDocument, node);
+                child = sibling;
               } else {
                 child = next;
               }
@@ -22247,10 +22301,10 @@ var require_dom = __commonJS({
        * "InvalidCharacterError".
        *
        * Note: When the resulting document is serialized with `requireWellFormed: true`, the
-       * serializer throws `InvalidStateError` if `.target` contains `:` or is an ASCII
-       * case-insensitive match for `"xml"`, or if `.data` contains `?>` or characters outside the
-       * XML Char production (W3C DOM Parsing §3.2.1.7). Without that option the data is emitted
-       * verbatim.
+       * serializer throws `InvalidStateError` if `.target` is not a valid XML `NCName` (a `Name`
+       * with no colon) or is an ASCII case-insensitive match for `"xml"`, or if `.data` contains
+       * `?>` or characters outside the XML Char production (W3C DOM Parsing §3.2.1.7). Without that
+       * option the target and data are emitted verbatim.
        *
        * @param {string} target
        * @param {string} data
@@ -22305,19 +22359,29 @@ var require_dom = __commonJS({
        * The current implementation does not fill the `childNodes` with those of the corresponding
        * `Entity`
        *
+       * The `name` is validated against the XML `Name` production at creation time; an invalid name
+       * throws `InvalidCharacterError`. When the resulting node is serialized with
+       * `requireWellFormed: true`, the serializer re-validates `nodeName` against the XML `Name`
+       * production and throws `InvalidStateError` if a later `nodeName` mutation made it invalid;
+       * without that option the name is emitted verbatim.
+       *
+       * __This implementation differs from the specification:__ xmldom does not expand entities —
+       * the parser resolves entity references inline and never constructs `EntityReference` nodes,
+       * so this method is the only producer.
+       *
        * @deprecated
        * In DOM Level 4.
        * @param {string} name
        * The name of the entity to reference. No namespace well-formedness checks are performed.
        * @returns {EntityReference}
        * @throws {DOMException}
-       * With code `INVALID_CHARACTER_ERR` when `name` is not valid.
+       * With code `INVALID_CHARACTER_ERR` when `name` is not a valid XML `Name`.
        * @throws {DOMException}
        * with code `NOT_SUPPORTED_ERR` when the document is of type `html`
        * @see https://www.w3.org/TR/DOM-Level-3-Core/core.html#ID-392B75AE
        */
       createEntityReference: function(name2) {
-        if (!g.Name.test(name2)) {
+        if (!g.Name_exact.test(name2)) {
           throw new DOMException(DOMException.INVALID_CHARACTER_ERR, 'not a valid xml name "' + name2 + '"');
         }
         if (this.type === "html") {
@@ -22755,7 +22819,13 @@ var require_dom = __commonJS({
       }
       return true;
     }
-    function addSerializedAttribute(buf, qualifiedName, value) {
+    function addSerializedAttribute(buf, qualifiedName, value, requireWellFormed) {
+      if (requireWellFormed && !g.QName_exact.test(qualifiedName)) {
+        throw new DOMException(
+          'The attribute name "' + qualifiedName + '" is not a valid XML QName',
+          DOMExceptionName.InvalidStateError
+        );
+      }
       buf.push(" ", qualifiedName, '="', value.replace(/[<>&"\t\n\r]/g, _xmlEncoder), '"');
     }
     function serializeToString(node, buf, visibleNamespaces, opts) {
@@ -22819,6 +22889,12 @@ var require_dom = __commonJS({
                     }
                   }
                 }
+                if (requireWellFormed && !g.QName_exact.test(prefixedNodeName)) {
+                  throw new DOMException(
+                    'The element name "' + prefixedNodeName + '" is not a valid XML QName',
+                    DOMExceptionName.InvalidStateError
+                  );
+                }
                 buf.push("<", prefixedNodeName);
                 var childNamespaces = namespaces.slice();
                 for (var i = 0; i < len; i++) {
@@ -22837,7 +22913,7 @@ var require_dom = __commonJS({
                   if (needNamespaceDefine(attr, isHTML, childNamespaces)) {
                     var attrPrefix = attr.prefix || "";
                     var uri = attr.namespaceURI;
-                    addSerializedAttribute(buf, attrPrefix ? "xmlns:" + attrPrefix : "xmlns", uri);
+                    addSerializedAttribute(buf, attrPrefix ? "xmlns:" + attrPrefix : "xmlns", uri, requireWellFormed);
                     childNamespaces.push({ prefix: attrPrefix, namespace: uri });
                   }
                   var filteredAttr = nodeFilter ? nodeFilter(attr) : attr;
@@ -22845,14 +22921,14 @@ var require_dom = __commonJS({
                     if (typeof filteredAttr === "string") {
                       buf.push(filteredAttr);
                     } else {
-                      addSerializedAttribute(buf, filteredAttr.name, filteredAttr.value);
+                      addSerializedAttribute(buf, filteredAttr.name, filteredAttr.value, requireWellFormed);
                     }
                   }
                 }
                 if (nodeName === prefixedNodeName && needNamespaceDefine(n, isHTML, childNamespaces)) {
                   var nodePrefix = n.prefix || "";
                   var uri = n.namespaceURI;
-                  addSerializedAttribute(buf, nodePrefix ? "xmlns:" + nodePrefix : "xmlns", uri);
+                  addSerializedAttribute(buf, nodePrefix ? "xmlns:" + nodePrefix : "xmlns", uri, requireWellFormed);
                   childNamespaces.push({ prefix: nodePrefix, namespace: uri });
                 }
                 var canCloseTag = !n.firstChild;
@@ -22885,7 +22961,7 @@ var require_dom = __commonJS({
                 }
                 return { ns: namespaces };
               case ATTRIBUTE_NODE:
-                addSerializedAttribute(buf, n.name, n.value);
+                addSerializedAttribute(buf, n.name, n.value, requireWellFormed);
                 return null;
               case TEXT_NODE:
                 if (requireWellFormed && g.InvalidChar.test(n.data)) {
@@ -22927,6 +23003,12 @@ var require_dom = __commonJS({
                 var pubid = n.publicId;
                 var sysid = n.systemId;
                 if (requireWellFormed) {
+                  if (!g.Name_exact.test(n.name)) {
+                    throw new DOMException(
+                      'The doctype name "' + n.name + '" is not a valid XML Name',
+                      DOMExceptionName.InvalidStateError
+                    );
+                  }
                   if (pubid && !g.PubidLiteral_match.test(pubid)) {
                     throw new DOMException("DocumentType publicId is not a valid PubidLiteral", DOMExceptionName.InvalidStateError);
                   }
@@ -22953,8 +23035,11 @@ var require_dom = __commonJS({
                 return null;
               case PROCESSING_INSTRUCTION_NODE:
                 if (requireWellFormed) {
-                  if (n.target.indexOf(":") !== -1 || n.target.toLowerCase() === "xml") {
-                    throw new DOMException("The ProcessingInstruction target is not well-formed", DOMExceptionName.InvalidStateError);
+                  if (!g.NCName_exact.test(n.target) || n.target.toLowerCase() === "xml") {
+                    throw new DOMException(
+                      'The processing instruction target "' + n.target + '" is not a valid XML NCName or is reserved',
+                      DOMExceptionName.InvalidStateError
+                    );
                   }
                   if (g.InvalidChar.test(n.data)) {
                     throw new DOMException(
@@ -22969,6 +23054,12 @@ var require_dom = __commonJS({
                 buf.push("<?", n.target, " ", n.data, "?>");
                 return null;
               case ENTITY_REFERENCE_NODE:
+                if (requireWellFormed && !g.Name_exact.test(n.nodeName)) {
+                  throw new DOMException(
+                    'The entity reference name "' + n.nodeName + '" is not a valid XML Name',
+                    DOMExceptionName.InvalidStateError
+                  );
+                }
                 buf.push("&", n.nodeName, ";");
                 return null;
               //case ENTITY_NODE:
@@ -23106,6 +23197,25 @@ var require_dom = __commonJS({
             }
           }
         });
+        Object.defineProperty(CharacterData.prototype, "data", {
+          get: function() {
+            return this._data != null ? this._data : "";
+          },
+          set: function(v) {
+            this._data = v;
+            this.length = typeof v === "string" ? v.length : 0;
+          }
+        });
+        Object.defineProperty(CharacterData.prototype, "nodeValue", {
+          get: function() {
+            return this.data;
+          },
+          set: function(v) {
+            this.data = v;
+          },
+          enumerable: true,
+          configurable: true
+        });
         Object.defineProperty(Element.prototype, "children", {
           get: function() {
             return new LiveNodeList(this, childrenRefresh);
@@ -23151,9 +23261,9 @@ var require_dom = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/entities.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/entities.js
 var require_entities = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/entities.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/entities.js"(exports) {
     "use strict";
     var freeze = require_conventions().freeze;
     exports.XML_ENTITIES = freeze({
@@ -25294,9 +25404,9 @@ var require_entities = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/sax.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/sax.js
 var require_sax = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/sax.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/sax.js"(exports) {
     "use strict";
     var conventions = require_conventions();
     var g = require_grammar();
@@ -25419,9 +25529,26 @@ var require_sax = __commonJS({
               if (!tagNameRaw) {
                 return errorHandler.fatalError("end tag name missing");
               }
-              var tagNameMatch = end > 0 && g.reg("^", g.QName_group, g.S_OPT, "$").exec(tagNameRaw);
+              var endTagNameStrict = g.reg("^", g.QName_group, g.S_OPT, "$");
+              var tagNameMatch = end > 0 && endTagNameStrict.exec(tagNameRaw);
               if (!tagNameMatch) {
-                return errorHandler.fatalError('end tag name contains invalid characters: "' + tagNameRaw + '"');
+                var leadingTagNameMatch = end > 0 && g.reg("^", g.QName_group).exec(tagNameRaw);
+                if (isHTML && leadingTagNameMatch) {
+                  errorHandler.warning('end tag name contains invalid trailing characters: "' + tagNameRaw + '"');
+                  tagNameMatch = leadingTagNameMatch;
+                } else if (
+                  // Backward compatibility, remove this whole `else if` arm in the next breaking release
+                  // (XML then falls through to the `fatalError` below, for a clean mode split: XML fatal,
+                  // HTML warning). A valid end-tag name followed by a line break and trailing content was
+                  // silently accepted while `reg` still used the `m` flag; re-adding `m` here matches exactly
+                  // those inputs, kept recoverable and reported.
+                  leadingTagNameMatch && new RegExp(endTagNameStrict.source, endTagNameStrict.flags + "m").test(tagNameRaw)
+                ) {
+                  errorHandler.error('end tag name is followed by a line break and trailing content: "' + tagNameRaw + '"');
+                  tagNameMatch = leadingTagNameMatch;
+                } else {
+                  return errorHandler.fatalError('end tag name contains invalid characters: "' + tagNameRaw + '"');
+                }
               }
               if (!domBuilder.currentElement && !domBuilder.doc.documentElement) {
                 return;
@@ -25495,7 +25622,7 @@ var require_sax = __commonJS({
           if (e instanceof ParseError2) {
             throw e;
           } else if (e instanceof DOMException) {
-            throw new ParseError2(e.name + ": " + e.message, domBuilder.locator, e);
+            return errorHandler.fatalError("Error constructing the DOM: " + e.name + ": " + e.message, e);
           }
           errorHandler.error("element parse error: " + e);
           end = -1;
@@ -25536,6 +25663,9 @@ var require_sax = __commonJS({
       var s = S_TAG;
       while (true) {
         var c = source.charAt(p);
+        if (s === S_TAG && c === "<") {
+          throw new Error("unexpected < in tag name: " + source.slice(start, p));
+        }
         switch (c) {
           case "=":
             if (s === S_ATTR) {
@@ -25711,7 +25841,7 @@ var require_sax = __commonJS({
         if (nsPrefix !== false) {
           if (localNSMap == null) {
             localNSMap = /* @__PURE__ */ Object.create(null);
-            _copy(currentNSMap, currentNSMap = /* @__PURE__ */ Object.create(null));
+            currentNSMap = Object.create(currentNSMap);
           }
           currentNSMap[nsPrefix] = localNSMap[nsPrefix] = value;
           a.uri = NAMESPACE.XMLNS;
@@ -25758,7 +25888,13 @@ var require_sax = __commonJS({
     function parseHtmlSpecialContent(source, elStartEnd, tagName, entityReplacer, domBuilder) {
       var isEscapableRaw = isHTMLEscapableRawTextElement(tagName);
       if (isEscapableRaw || isHTMLRawTextElement(tagName)) {
-        var elEndStart = source.indexOf("</" + tagName + ">", elStartEnd);
+        var closeTag = new RegExp("</" + tagName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + ">", "ig");
+        closeTag.lastIndex = elStartEnd;
+        var match = closeTag.exec(source);
+        var elEndStart = match ? match.index : -1;
+        if (elEndStart < 0) {
+          return elStartEnd + 1;
+        }
         var text = source.substring(elStartEnd + 1, elEndStart);
         if (isEscapableRaw) {
           text = text.replace(ENTITY_REG, entityReplacer);
@@ -26050,9 +26186,9 @@ var require_sax = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/dom-parser.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/dom-parser.js
 var require_dom_parser = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/dom-parser.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/dom-parser.js"(exports) {
     "use strict";
     var conventions = require_conventions();
     var dom = require_dom();
@@ -26262,14 +26398,16 @@ var require_dom_parser = __commonJS({
        *
        * @param {string} message
        * - The message to be used for reporting and throwing the error.
+       * @param {Error} [cause]
+       * The error that caused this fatal error, preserved as the thrown `ParseError`'s `cause`.
        * @returns {never}
        * This function always throws an error and never returns a value.
        * @throws {ParseError}
        * Always throws a ParseError with the provided message.
        */
-      fatalError: function(message) {
+      fatalError: function(message, cause) {
         this.reportError("fatalError", message);
-        throw new ParseError2(message, this.locator);
+        throw new ParseError2(message, this.locator, cause);
       }
     };
     function _locator(l) {
@@ -26316,9 +26454,9 @@ var require_dom_parser = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/index.js
+// ../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/index.js
 var require_lib2 = __commonJS({
-  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.10/node_modules/@xmldom/xmldom/lib/index.js"(exports) {
+  "../../node_modules/.pnpm/@xmldom+xmldom@0.9.12/node_modules/@xmldom/xmldom/lib/index.js"(exports) {
     "use strict";
     var conventions = require_conventions();
     exports.assign = conventions.assign;
@@ -26821,7 +26959,10 @@ var gqlRequest = async (query, variables) => {
     }
   })();
   if (body?.errors != null && body.errors.length > 0) {
-    throw new Error(body.errors.map((e) => e.message).join("; "));
+    throw Object.assign(
+      new Error(body.errors.map((e) => e.message).join("; ")),
+      { errors: body.errors }
+    );
   }
   if (!res.ok) throw v2Error("graphql", res, raw2);
   if (body?.data == null) {
@@ -27083,10 +27224,48 @@ var validateAutomationElements = async (elements) => {
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-4HUHD7FS.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-5UOLQ3AW.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
+// ../common/src/function.ts
+var defaultAgentFunctionInputSchema = `{
+    "type": "object",
+    "properties": {
+      "method": {
+        "type": "string",
+        "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
+        "default": "POST",
+        "description": "HTTP method for this function call."
+      },
+      "headers": {
+        "type": "object",
+        "description": "Request headers. Use {} when none are needed.",
+        "default": {},
+        "additionalProperties": {
+          "type": "string"
+        }
+      },
+      "queryParams": {
+        "type": "object",
+        "description": "URL query params. Use {} when none are needed.",
+        "default": {},
+        "additionalProperties": {
+          "type": ["string", "number", "boolean"]
+        }
+      },
+      "body": {
+        "type": "object",
+        "description": "Request body payload. Use {} when none is needed.",
+        "default": {},
+        "additionalProperties": true
+      }
+    },
+    "required": ["method", "headers", "queryParams", "body"]
+  }`;
+var DEFAULT_FUNCTION_EXECUTION_TIMEOUT_MS = 3e4;
+var DEFAULT_FUNCTION_EXECUTION_MEMORY_MB = 512;
+
 // src/workspace/adapters.ts
 var metaJson = (value) => `${JSON.stringify(value, null, 2)}
 `;
@@ -27116,7 +27295,7 @@ var functionAdapter = {
         functions(condition: { workspaceId: $workspaceId }, includeArchived: NO) {
           nodes {
             id name
-            functionVersions(orderBy: [CREATED_AT_DESC], first: 1) {
+            functionVersions(orderBy: [VERSION_NUMBER_DESC], first: 1) {
               nodes { versionNumber code inputSchema outputSchema executionTimeout executionCpu executionMemory }
             }
             functionDeployedVersion { versionNumber }
@@ -27143,7 +27322,7 @@ var functionAdapter = {
     const data = await gqlRequest(
       `query CliFunctionHead($id: String!) {
         function(id: $id) {
-          functionVersions(orderBy: [CREATED_AT_DESC], first: 1) { nodes { versionNumber } }
+          functionVersions(orderBy: [VERSION_NUMBER_DESC], first: 1) { nodes { versionNumber } }
           functionDeployedVersion { versionNumber }
         }
       }`,
@@ -27171,11 +27350,11 @@ var functionAdapter = {
     }
     return functionFiles(id, name2, data.functionVersion);
   },
-  push: async (id, files, message) => {
+  push: async (id, files, message, expectedLatestVersion) => {
     const meta = JSON.parse(fileBySuffix(files, ".meta.json"));
     const data = await gqlRequest(
-      `mutation CliCreateFunctionVersion($functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int) {
-        createFunctionVersion(input: { functionVersion: {
+      `mutation CliCreateFunctionVersion($expectedLatestVersion: Int, $functionId: String!, $code: String!, $message: String, $inputSchema: String, $outputSchema: String, $executionTimeout: Int, $executionCpu: Int, $executionMemory: Int) {
+        createFunctionVersion(input: { expectedLatestVersion: $expectedLatestVersion, functionVersion: {
           functionId: $functionId, code: $code, message: $message,
           inputSchema: $inputSchema, outputSchema: $outputSchema,
           executionTimeout: $executionTimeout, executionCpu: $executionCpu,
@@ -27183,6 +27362,7 @@ var functionAdapter = {
         }}) { functionVersion { versionNumber } }
       }`,
       {
+        expectedLatestVersion,
         functionId: id,
         code: fileBySuffix(files, ".ts"),
         message,
@@ -27190,9 +27370,9 @@ var functionAdapter = {
         // limits, and so an explicit null doesn't hit the NOT NULL column.
         inputSchema: meta.inputSchema ?? "",
         outputSchema: meta.outputSchema ?? "",
-        executionTimeout: meta.executionTimeout ?? 1e4,
+        executionTimeout: meta.executionTimeout ?? DEFAULT_FUNCTION_EXECUTION_TIMEOUT_MS,
         executionCpu: meta.executionCpu ?? 250,
-        executionMemory: meta.executionMemory ?? 512
+        executionMemory: meta.executionMemory ?? DEFAULT_FUNCTION_EXECUTION_MEMORY_MB
       }
     );
     return data.createFunctionVersion.functionVersion.versionNumber;
@@ -27301,7 +27481,7 @@ var pageAdapter = (opts) => {
       }
       return pageFiles(opts.dir, id, name2, version.config);
     },
-    push: async (id, files, message) => {
+    push: async (id, files, message, expectedLatestVersion) => {
       const config = pageConfigFromFiles(files);
       const findings2 = await opts.validateConfig?.(config) ?? [];
       if (findings2.length > 0) {
@@ -27311,12 +27491,12 @@ ${findings2.map((f) => `  ${f}`).join("\n")}`
         );
       }
       const data = await gqlRequest(
-        `mutation CliCreatePageVersion($id: String!, $message: String, $config: JSON!) {
-          create${capitalized}Version(input: { ${gqlName}Version: { ${idArg}: $id, message: $message, config: $config } }) {
+        `mutation CliCreatePageVersion($expectedLatestVersion: Int, $id: String!, $message: String, $config: JSON!) {
+          create${capitalized}Version(input: { expectedLatestVersion: $expectedLatestVersion, ${gqlName}Version: { ${idArg}: $id, message: $message, config: $config } }) {
             ${gqlName}Version { versionNumber }
           }
         }`,
-        { id, message, config }
+        { id, message, config, expectedLatestVersion }
       );
       const versionNumber = data[`create${capitalized}Version`]?.[`${gqlName}Version`]?.versionNumber;
       if (versionNumber == null) {
@@ -27411,7 +27591,7 @@ var automationAdapter = {
       })
     };
   },
-  push: async (id, files, message) => {
+  push: async (id, files, message, expectedLatestVersion) => {
     const doc = JSON.parse(fileBySuffix(files, ".json"));
     const findings2 = await validateAutomationElements(doc.elements);
     if (findings2.length > 0) {
@@ -27421,12 +27601,13 @@ ${findings2.map((f) => `  ${f}`).join("\n")}`
       );
     }
     const data = await gqlRequest(
-      `mutation CliCreateAutomationVersion($automationId: String!, $elements: JSON!, $message: String, $maxConcurrentRuns: Int) {
-        createAutomationVersion(input: { automationVersion: {
+      `mutation CliCreateAutomationVersion($expectedLatestVersion: Int, $automationId: String!, $elements: JSON!, $message: String, $maxConcurrentRuns: Int) {
+        createAutomationVersion(input: { expectedLatestVersion: $expectedLatestVersion, automationVersion: {
           automationId: $automationId, elements: $elements, message: $message, maxConcurrentRuns: $maxConcurrentRuns
         }}) { automationVersion { num } }
       }`,
       {
+        expectedLatestVersion,
         automationId: id,
         elements: doc.elements,
         message,
@@ -27536,22 +27717,20 @@ var agentAdapter = {
       { agentId: id, versionNumber }
     );
     if (data.agentVersion == null) {
-      throw new Error(
-        `Agent ${id} has no version ${String(versionNumber)}.`
-      );
+      throw new Error(`Agent ${id} has no version ${String(versionNumber)}.`);
     }
     return agentFiles(id, name2, data.agentVersion);
   },
-  push: async (id, files, message) => {
+  push: async (id, files, message, expectedLatestVersion) => {
     const config = JSON.parse(fileBySuffix(files, ".json"));
     const data = await gqlRequest(
-      `mutation CliCreateAgentVersion(
+      `mutation CliCreateAgentVersion($expectedLatestVersion: Int,
         $agentId: String!, $message: String!, $systemPrompt: String!,
         $model: String!, $temperature: Float!, $maxTokens: Int!,
         $rateLimitRequestsPerMinute: Int!, $rateLimitTokensPerMinute: Int!,
         $functionIds: [String]
       ) {
-        createAgentVersionWithFunctions(input: {
+        createAgentVersionWithFunctions(input: { expectedLatestVersion: $expectedLatestVersion,
           agentId: $agentId, message: $message, systemPrompt: $systemPrompt,
           model: $model, temperature: $temperature, maxTokens: $maxTokens,
           rateLimitRequestsPerMinute: $rateLimitRequestsPerMinute,
@@ -27559,7 +27738,7 @@ var agentAdapter = {
           functionIds: $functionIds
         }) { result { versionNumber } }
       }`,
-      { agentId: id, message, ...config }
+      { agentId: id, message, ...config, expectedLatestVersion }
     );
     const versionNumber = data.createAgentVersionWithFunctions?.result?.versionNumber;
     if (versionNumber == null) {
@@ -27931,7 +28110,12 @@ var runPush = async (args, clone) => {
       if (content == null) throw new Error(`${relPath} is missing locally.`);
       files[relPath] = content;
     }
-    const versionNumber = await adapter.push(id, files, message);
+    const versionNumber = await adapter.push(
+      id,
+      files,
+      message,
+      force ? void 0 : resource.baseVersion
+    );
     for (const relPath of changedFiles) {
       const content = files[relPath];
       if (content == null) continue;
@@ -29036,42 +29220,6 @@ var agentToolRequestJsonSchemaSchema = external_exports.object({
   )
 }).loose();
 
-// ../common/src/function.ts
-var defaultAgentFunctionInputSchema = `{
-    "type": "object",
-    "properties": {
-      "method": {
-        "type": "string",
-        "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"],
-        "default": "POST",
-        "description": "HTTP method for this function call."
-      },
-      "headers": {
-        "type": "object",
-        "description": "Request headers. Use {} when none are needed.",
-        "default": {},
-        "additionalProperties": {
-          "type": "string"
-        }
-      },
-      "queryParams": {
-        "type": "object",
-        "description": "URL query params. Use {} when none are needed.",
-        "default": {},
-        "additionalProperties": {
-          "type": ["string", "number", "boolean"]
-        }
-      },
-      "body": {
-        "type": "object",
-        "description": "Request body payload. Use {} when none is needed.",
-        "default": {},
-        "additionalProperties": true
-      }
-    },
-    "required": ["method", "headers", "queryParams", "body"]
-  }`;
-
 // ../common/src/liquidjs/liquidjs.ts
 var import_jmespath = __toESM(require_jmespath(), 1);
 
@@ -34573,8 +34721,7 @@ var runCreate2 = async (args) => {
         ) {
           createFunctionVersion(input: { functionVersion: {
             functionId: $functionId, code: $code, message: "Initial version",
-            inputSchema: $inputSchema, outputSchema: "",
-            executionTimeout: 10000, executionCpu: 250, executionMemory: 512
+            inputSchema: $inputSchema, outputSchema: ""
           }}) { functionVersion { versionNumber } }
         }`,
         {
@@ -35597,6 +35744,8 @@ var runResource = async (args) => {
 // src/docs/bestPractices.ts
 var platform2 = `# OverAI platform primer
 
+Saves reject a stale editing base without discarding your draft. Incorporate the latest saved changes before retrying; never retry with a newer base unless those changes have been reconciled. A save conflict does not deploy anything. Normal push sends the manifest base to an atomic server check. Only explicit --force omits it; never use --force as automatic conflict recovery.
+
 Organization context: Commands in a clone select its org automatically. Outside a clone,
 use OVERAI_ORG_ID=<orgId>. Each backend/org has an independent saved session; org switch
 changes only the machine-global default. Use whoami to inspect the effective scope.
@@ -35715,7 +35864,15 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
 - Web pages follow the app's light/dark theme: the page root carries a \`dark\`
   class in dark mode (Tailwind darkMode: "class"), so style with \`dark:\`
   variants; useTheme() only for JS-driven styling like chart palettes.
-  Printable pages have no theme \u2014 neither the class nor the hook exists there.
+- Two dark-mode traps a web page written light-only hits. A \`border\` or
+  \`divide\` utility with no color class falls back to Tailwind's default light
+  gray, so a bare \`border-b\` stays a bright rule \u2014 write \`border-b
+  border-gray-200 dark:border-gray-700\`. And if the page loads daisyUI, its
+  theme sets the inherited text color, so a hardcoded \`bg-white\` whose text
+  just inherits goes light-on-white; pair every surface, not only the text.
+- Printable pages have no theme \u2014 neither the \`dark\` class nor useTheme()
+  exists there, so \`dark:\` variants never activate and neither trap above
+  applies.
 - Call Functions for server-side logic \u2014 they're awaitable; automations are
   fire-and-forget.
 - SQL from pages: env.TBSxxx.sql tagged templates only; compose dynamic SQL by
@@ -35730,6 +35887,9 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
   conversation helpers throw), and author-requiring writes like
   env.DFxxx.saveVersion 401. Reads use the workspace's own access, so treat
   anything the page can query as public.
+- meta.json \`runtime\`: "v2" serves the page from its own origin (separate
+  process, real localStorage/cookies \u2014 no noSandbox needed); absent or "v1" is
+  the sandboxed srcdoc iframe. Anything else is rejected on push.
 - Write meta.json flags (noSandbox, hideTopBar) as JSON booleans. A page cloned
   before the shape settled may hold the strings "true"/"false" \u2014 those still
   push, anything else is rejected. noSandbox drops the iframe sandbox, which

package/dist/{webPage-4HUHD7FS.js → webPage-5UOLQ3AW.js}

@@ -3,7 +3,7 @@ import {
   webPageConfigSchema,
   webPageConfigWriteSchema,
   webPageLanguage
-} from "./chunk-56E4CWBE.js";
+} from "./chunk-5CMM7GCC.js";
 import "./chunk-XCJJTK3H.js";
 import "./chunk-U67V476Y.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",