@shawnstack/quickforge 1.7.4 → 1.7.5

package/server/routes/storage.mjs

@@ -94,7 +94,7 @@ async function readIndexedValues(store, indexName, direction, scope, projectId,
   return values
 }
 
-export async function handleStorageApi(req, res, url) {
+export async function handleStorageApi(req, res, url, context = {}) {
   const parts = url.pathname.split('/').filter(Boolean)
 
   if (req.method === 'GET' && url.pathname === '/api/storage/quota') {
@@ -116,6 +116,29 @@ export async function handleStorageApi(req, res, url) {
   }
 
   const store = decodeSegment(parts[2])
+  const remotelySensitiveStores = new Set([
+    'provider-keys',
+    'custom-providers',
+    'mcp',
+    'plugins',
+    'scheduled-tasks',
+    'agent-profile-overrides',
+    'custom-agents',
+  ])
+  if (context.isLocalRequest === false && remotelySensitiveStores.has(store)) {
+    const error = new Error('This storage area is available only on this computer.')
+    error.statusCode = 403
+    error.errorCode = 'storage_local_only'
+    throw error
+  }
+
+  const remotelyReadOnlyStores = new Set(['sessions', 'sessions-metadata'])
+  if (context.isLocalRequest === false && remotelyReadOnlyStores.has(store) && req.method !== 'GET') {
+    const error = new Error('Remote clients must modify conversations through the Agent API.')
+    error.statusCode = 403
+    error.errorCode = 'storage_remote_read_only'
+    throw error
+  }
 
   if (req.method === 'GET' && parts[3] === 'keys') {
     const prefix = url.searchParams.get('prefix') || ''

package/server/routes/workspace.mjs

@@ -2,6 +2,7 @@ import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import { spawn } from 'node:child_process'
 import { streamSimpleWithAiHttpLogging } from '../ai-http-logger.mjs'
+import { resolveModelBinding } from '../model-catalog.mjs'
 import { DEFAULT_AI_MAX_RETRIES } from '../ai-provider-options.mjs'
 import { sendJson, readJsonBody } from '../utils/response.mjs'
 import { projectContextFromId } from '../project-config.mjs'
@@ -1080,9 +1081,10 @@ async function contextFromGitBody(req) {
   return { context: await projectContextFromId(projectId), body }
 }
 
-async function handleGitGenerateCommitMessage(req, res) {
+async function handleGitGenerateCommitMessage(req, res, requestContext = {}) {
   const { context, body } = await contextFromGitBody(req)
-  const message = await generateGitCommitMessage(context, body?.model, body?.thinkingLevel, Boolean(body?.includeUnstaged))
+  const binding = await resolveModelBinding(body, { context: requestContext, legacySnapshot: body?.model })
+  const message = await generateGitCommitMessage(context, binding.model, body?.thinkingLevel, Boolean(body?.includeUnstaged))
   sendJson(res, 200, { message })
 }
 
@@ -1178,7 +1180,7 @@ export async function handleWorkspaceApi(req, res, url, requestContext = {}) {
   throw error
 }
 
-export async function handleGitApi(req, res, url) {
+export async function handleGitApi(req, res, url, requestContext = {}) {
   if (req.method === 'GET' && url.pathname === '/api/git/status') {
     await handleGitStatus(req, res, url)
     return
@@ -1204,7 +1206,7 @@ export async function handleGitApi(req, res, url) {
     return
   }
   if (req.method === 'POST' && url.pathname === '/api/git/generate-commit-message') {
-    await handleGitGenerateCommitMessage(req, res)
+    await handleGitGenerateCommitMessage(req, res, requestContext)
     return
   }
   if (req.method === 'POST' && url.pathname === '/api/git/stage') {

package/server/share-store.mjs

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto'
+import { EventEmitter } from 'node:events'
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import { ensureStorage, storageDir } from './storage.mjs'
@@ -10,6 +11,25 @@ const SHARES_DIR = path.join(storageDir, 'shares')
 const SHARES_FILE = path.join(SHARES_DIR, 'conversation-shares.json')
 const writeQueueName = 'conversation-shares'
 const writeQueues = new Map()
+const shareLifecycleEvents = new EventEmitter()
+shareLifecycleEvents.setMaxListeners(0)
+
+export function onConversationShareInvalidated(listener) {
+  shareLifecycleEvents.on('invalidated', listener)
+  return () => shareLifecycleEvents.removeListener('invalidated', listener)
+}
+
+function emitConversationShareInvalidated(shareId, reason) {
+  shareLifecycleEvents.emit('invalidated', { shareId, reason })
+}
+
+function clearShareTokens(record) {
+  record.authVersion = (record.authVersion || 1) + 1
+  record.tokens = []
+  record.tokenHash = undefined
+  record.tokenIssuedAt = undefined
+  record.tokenExpiresAt = undefined
+}
 
 function enqueueWrite(queueName, operation) {
   const previous = writeQueues.get(queueName) || Promise.resolve()
@@ -64,6 +84,7 @@ function publicShareRecord(record) {
     accessCount: record.accessCount || 0,
     lastAccessedAt: record.lastAccessedAt,
     hasPassword: Boolean(record.passwordHash),
+    allowCloudUsage: record.allowCloudUsage === true,
   }
 }
 
@@ -195,6 +216,7 @@ export async function createConversationShare({
   permission,
   password,
   expiresAt,
+  allowCloudUsage = false,
   titleSnapshot,
   scope,
   projectId,
@@ -233,14 +255,13 @@ export async function createConversationShare({
     }
 
     for (const stale of existingRecords.filter((record) => record?.id !== existing?.id)) {
+      const newlySuperseded = !stale.supersededAt
       stale.supersededAt = stale.supersededAt || now
       stale.revokedAt = stale.revokedAt || now
       stale.updatedAt = now
-      stale.tokens = []
-      stale.tokenHash = undefined
-      stale.tokenIssuedAt = undefined
-      stale.tokenExpiresAt = undefined
+      clearShareTokens(stale)
       data[stale.id] = stale
+      if (newlySuperseded) emitConversationShareInvalidated(stale.id, 'superseded')
     }
 
     if (existing?.id) {
@@ -251,6 +272,7 @@ export async function createConversationShare({
         updatedAt: now,
         supersededAt: undefined,
         expiresAt: expiresAt || undefined,
+        allowCloudUsage: permission === 'operate' && allowCloudUsage === true,
         revokedAt: undefined,
         titleSnapshot: titleSnapshot || existing.titleSnapshot || 'New chat',
         scope: scope === 'project' ? 'project' : 'global',
@@ -264,19 +286,20 @@ export async function createConversationShare({
         tokenExpiresAt: existing.tokenExpiresAt,
       }
       if (passwordProvided) {
-        record.authVersion = (existing.authVersion || 1) + 1
-        record.tokens = []
-        record.tokenHash = undefined
-        record.tokenIssuedAt = undefined
-        record.tokenExpiresAt = undefined
+        clearShareTokens(record)
       }
       if (passwordProvided && !passwordInfo.passwordHash) {
         record.passwordHash = undefined
         record.passwordSalt = undefined
         record.passwordVersion = undefined
       }
+      const lifecycleChanged = Boolean(existing.revokedAt)
+        || String(existing.expiresAt || '') !== String(record.expiresAt || '')
+        || existing.allowCloudUsage === true !== (record.allowCloudUsage === true)
+        || (passwordProvided && existing.authVersion !== record.authVersion)
       data[record.id] = record
       await writeShareStoreFile(data)
+      if (lifecycleChanged) emitConversationShareInvalidated(record.id, 'updated')
       return publicShareRecord(record)
     }
 
@@ -292,6 +315,7 @@ export async function createConversationShare({
       updatedAt: now,
       supersededAt: undefined,
       expiresAt: expiresAt || undefined,
+      allowCloudUsage: permission === 'operate' && allowCloudUsage === true,
       revokedAt: undefined,
       titleSnapshot: titleSnapshot || 'New chat',
       scope: scope === 'project' ? 'project' : 'global',
@@ -335,18 +359,149 @@ export async function revokeConversationShare(shareId) {
       error.statusCode = 404
       throw error
     }
+    const wasActive = !record.revokedAt
     record.revokedAt = record.revokedAt || new Date().toISOString()
     record.updatedAt = record.revokedAt
-    record.tokens = []
-    record.tokenHash = undefined
-    record.tokenIssuedAt = undefined
-    record.tokenExpiresAt = undefined
+    clearShareTokens(record)
+    data[shareId] = record
+    await writeShareStoreFile(data)
+    if (wasActive) emitConversationShareInvalidated(shareId, 'revoked')
+    return publicShareRecord(record)
+  })
+}
+
+export async function restoreConversationShare(shareId, expiresAt) {
+  assertSafeShareId(shareId)
+  if (expiresAt && (Number.isNaN(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) {
+    const error = new Error('Expiration time must be in the future')
+    error.statusCode = 400
+    throw error
+  }
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    if (record.supersededAt) {
+      const error = new Error('Superseded shares cannot be restored')
+      error.statusCode = 409
+      throw error
+    }
+    record.revokedAt = undefined
+    record.expiresAt = expiresAt || undefined
+    record.updatedAt = new Date().toISOString()
+    clearShareTokens(record)
     data[shareId] = record
     await writeShareStoreFile(data)
     return publicShareRecord(record)
   })
 }
 
+export async function updateConversationShareExpiration(shareId, expiresAt) {
+  assertSafeShareId(shareId)
+  if (expiresAt && (Number.isNaN(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) {
+    const error = new Error('Expiration time must be in the future')
+    error.statusCode = 400
+    throw error
+  }
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    if (record.supersededAt) {
+      const error = new Error('Superseded shares cannot be updated')
+      error.statusCode = 409
+      throw error
+    }
+    assertShareActive(record)
+    record.expiresAt = expiresAt || undefined
+    record.updatedAt = new Date().toISOString()
+    data[shareId] = record
+    await writeShareStoreFile(data)
+    emitConversationShareInvalidated(shareId, 'updated')
+    return publicShareRecord(record)
+  })
+}
+
+export async function updateConversationShare(shareId, { permission, password, expiresAt, allowCloudUsage } = {}) {
+  assertSafeShareId(shareId)
+  const passwordProvided = typeof password === 'string'
+  const normalizedPassword = passwordProvided ? password.trim() : undefined
+  if (expiresAt && (Number.isNaN(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now())) {
+    const error = new Error('Expiration time must be in the future')
+    error.statusCode = 400
+    throw error
+  }
+  const passwordInfo = passwordProvided ? await hashSharePassword(normalizedPassword) : {}
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    if (record.supersededAt) {
+      const error = new Error('Superseded shares cannot be updated')
+      error.statusCode = 409
+      throw error
+    }
+    assertShareActive(record)
+    const nextPermission = permission === undefined ? record.permission : permission
+    assertValidPermission(nextPermission)
+    const willHavePassword = passwordProvided ? Boolean(normalizedPassword) : Boolean(record.passwordHash)
+    if (nextPermission === 'operate' && !willHavePassword) {
+      const error = new Error('Editable shares require a non-empty password')
+      error.statusCode = 400
+      throw error
+    }
+    const nextAllowCloudUsage = nextPermission === 'operate'
+      && (allowCloudUsage === undefined ? record.allowCloudUsage === true : allowCloudUsage === true)
+    const lifecycleChanged = nextPermission !== record.permission
+      || nextAllowCloudUsage !== (record.allowCloudUsage === true)
+      || (expiresAt !== undefined && String(record.expiresAt || '') !== String(expiresAt || ''))
+      || passwordProvided
+    if (passwordProvided) {
+      record.passwordHash = passwordInfo.passwordHash
+      record.passwordSalt = passwordInfo.passwordSalt
+      record.passwordVersion = passwordInfo.passwordVersion
+      clearShareTokens(record)
+    }
+    record.permission = nextPermission
+    record.allowCloudUsage = nextAllowCloudUsage
+    if (expiresAt !== undefined) record.expiresAt = expiresAt || undefined
+    record.updatedAt = new Date().toISOString()
+    data[shareId] = record
+    await writeShareStoreFile(data)
+    if (lifecycleChanged) emitConversationShareInvalidated(shareId, 'updated')
+    return publicShareRecord(record)
+  })
+}
+
+export async function deleteConversationShare(shareId) {
+  assertSafeShareId(shareId)
+  return enqueueWrite(writeQueueName, async () => {
+    const data = await readShareStoreFile()
+    const record = data[shareId]
+    if (!record) {
+      const error = new Error('Share not found')
+      error.statusCode = 404
+      throw error
+    }
+    delete data[shareId]
+    await writeShareStoreFile(data)
+    emitConversationShareInvalidated(shareId, 'deleted')
+    return publicShareRecord(record)
+  })
+}
+
 export async function issueConversationShareToken(shareId) {
   assertSafeShareId(shareId)
   return enqueueWrite(writeQueueName, async () => {

package/server/skills.mjs

@@ -1,16 +1,21 @@
 import { existsSync, promises as fs } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { dataDir } from './storage.mjs'
+import { fileURLToPath } from 'node:url'
+import { atomicProjectConfigUpdate, configDir, dataDir } from './storage.mjs'
 import { getEnabledPluginSkillSources } from './plugins/registry.mjs'
 import { logger } from './utils/logger.mjs'
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const bundledSkillsDir = path.resolve(__dirname, '..', 'skills')
 const userSkillsDir = path.join(dataDir, 'skills')
 const sharedUserSkillsDir = path.join(os.homedir(), '.agents', 'skills')
 const claudeUserSkillsDir = path.join(os.homedir(), '.claude', 'skills')
 const opencodeUserSkillsDir = path.join(os.homedir(), '.opencode', 'skills')
+const defaultSkillsMarkerFile = path.join(configDir, '.default-skills-v1')
+const defaultGlobalSkillNames = ['skill-creator']
 const defaultEntry = 'SKILL.md'
-const resourceDirs = ['scripts', 'references', 'assets']
+const resourceDirs = ['scripts', 'references', 'assets', 'agents', 'eval-viewer']
 const maxResourceFiles = 200
 
 function isValidSkillName(value) {
@@ -421,7 +426,7 @@ export function mergeSkills(...skillLists) {
 }
 
 export const skillSearchPaths = {
-  global: searchDirsForList([claudeUserSkillsDir, opencodeUserSkillsDir, sharedUserSkillsDir, userSkillsDir]),
+  global: searchDirsForList([bundledSkillsDir, claudeUserSkillsDir, opencodeUserSkillsDir, sharedUserSkillsDir, userSkillsDir]),
   project: ['<project>/.claude/skills', '<project>/.opencode/skills', '<project>/.agents/skills', '<project>/.quickforge/skills'],
 }
 
@@ -444,6 +449,7 @@ async function loadPluginSkills(workspaceRoot) {
 
 export async function loadGlobalSkills() {
   return loadSkillsFromSources([
+    { dir: bundledSkillsDir, name: 'builtin' },
     { dir: claudeUserSkillsDir, name: 'user-claude' },
     { dir: opencodeUserSkillsDir, name: 'user-opencode' },
     { dir: sharedUserSkillsDir, name: 'user-shared' },
@@ -451,6 +457,27 @@ export async function loadGlobalSkills() {
   ])
 }
 
+export async function ensureDefaultGlobalSkills() {
+  if (existsSync(defaultSkillsMarkerFile)) return false
+
+  const known = new Set((await loadGlobalSkills()).map((skill) => skill.name))
+  const defaults = defaultGlobalSkillNames.filter((name) => known.has(name))
+  if (defaults.length === 0) return false
+
+  await atomicProjectConfigUpdate((config) => {
+    config.globalSkills = normalizeSkillNames([
+      ...(Array.isArray(config.globalSkills) ? config.globalSkills : []),
+      ...defaults,
+    ])
+    return config
+  })
+  await fs.mkdir(configDir, { recursive: true })
+  await fs.writeFile(defaultSkillsMarkerFile, `${new Date().toISOString()}\n`, { flag: 'wx' }).catch((error) => {
+    if (error?.code !== 'EEXIST') throw error
+  })
+  return true
+}
+
 export async function loadProjectSkills(workspaceRoot) {
   const pluginSkills = await loadPluginSkills(workspaceRoot)
   const projectSkills = await loadSkillsFromSources([

package/server/storage.mjs

@@ -618,10 +618,16 @@ export async function atomicSessionValueUpdate(sessionId, updateFn) {
 export async function deleteSessionValue(sessionId) {
   return enqueueWrite('sessions', async () => {
     const bucket = await findSessionBucket(sessionId)
-    if (!bucket) return
+    if (!bucket) {
+      const { deleteCloudChatIdempotencySession } = await import('./cloud/chat-idempotency-store.mjs')
+      await deleteCloudChatIdempotencySession(sessionId)
+      return
+    }
     await fs.rm(sessionDataFile(sessionId, bucket), { force: true })
     const { deleteSessionAssets } = await import('./session-assets.mjs')
     await deleteSessionAssets(bucket, sessionId)
+    const { deleteCloudChatIdempotencySession } = await import('./cloud/chat-idempotency-store.mjs')
+    await deleteCloudChatIdempotencySession(sessionId)
     sessionBucketIndex.delete(sessionId)
   })
 }

package/server/subagents.mjs

@@ -32,7 +32,7 @@ export const subagentDefinitions = [
     model: { mode: 'inherit' },
     lifecycle: 'builtin',
     allowFileMutations: true,
-    maxRuntimeMs: 30 * 60 * 1000,
+    maxRuntimeMs: 60 * 60 * 1000,
     maxToolCalls: 300,
     systemPrompt: `You are General, a general-purpose subagent for bounded complex multi-step implementation tasks and broader independent work. You may inspect, edit, write files, and run commands using the built-in workspace tools when needed. You do not have MCP tools or Agent Skills. Prefer Explore for focused read-only repository discovery, source search, call-chain lookup, tests/docs discovery, and impact analysis. Make focused, minimal changes that satisfy the delegated task, and verify your changes when appropriate.`,
   },
@@ -46,7 +46,7 @@ export const subagentDefinitions = [
     model: { mode: 'inherit' },
     lifecycle: 'builtin',
     allowFileMutations: false,
-    maxRuntimeMs: 30 * 60 * 1000,
+    maxRuntimeMs: 60 * 60 * 1000,
     maxToolCalls: 300,
     systemPrompt: `You are Explore, the preferred read-only repository research subagent. Investigate the delegated question using read_file, grep_files, and safe read-only run_command calls, and report only findings grounded in repository evidence. Do not design solutions or propose implementation, architecture, refactoring, or code changes. Cite relevant file paths, symbols, and line ranges when practical. Clearly separate verified facts, reasonable inferences, and unknowns, and never present an inference as a verified fact. Unless the parent Agent explicitly requests them, do not provide an implementation plan, recommendations, or suggested next steps. You cannot modify files.`,
   },
@@ -82,7 +82,7 @@ capabilityPolicy: ${definition.capabilityPolicy || 'review-only'}
 tools: ${definition.allowedTools.join(', ')}
 model:
   mode: inherit
-max-runtime-ms: ${definition.maxRuntimeMs || 30 * 60 * 1000}
+max-runtime-ms: ${definition.maxRuntimeMs || 60 * 60 * 1000}
 max-tool-calls: ${definition.maxToolCalls || 300}
 ---
 ${body}

package/server/tools/definitions.mjs

@@ -111,7 +111,7 @@ export const workspaceTools = [
     description: 'Run a shell command in the project bound to this chat. Use this for lint, build, tests, git status, and diagnostics.',
     parameters: Type.Object({
       command: Type.String({ description: 'Command to execute in the workspace.' }),
-      timeoutMs: Type.Optional(Type.Number({ description: 'Command timeout in milliseconds. Defaults to 30 minutes and is clamped to the supported range.', default: 1800000 })),
+      timeoutMs: Type.Optional(Type.Number({ description: 'Command timeout in milliseconds. Defaults to 1 hour and is clamped to the supported range.', default: 3600000 })),
       description: Type.Optional(Type.String({ description: 'Short explanation of why this command is being run.' })),
     }),
     executionMode: 'sequential',

package/server/tools/index.mjs

@@ -709,9 +709,9 @@ export async function toolPresentFiles(params, context) {
 }
 
 // --- run_command ---
-const DEFAULT_RUN_COMMAND_TIMEOUT_MS = 30 * 60 * 1000
+const DEFAULT_RUN_COMMAND_TIMEOUT_MS = 60 * 60 * 1000
 const MIN_RUN_COMMAND_TIMEOUT_MS = 1000
-const MAX_RUN_COMMAND_TIMEOUT_MS = 30 * 60 * 1000
+const MAX_RUN_COMMAND_TIMEOUT_MS = 60 * 60 * 1000
 const COMMAND_PREVIEW_LINES = 200
 const COMMAND_PREVIEW_TOTAL_CHARS = 10000
 

package/server/utils/network.mjs

@@ -8,6 +8,15 @@ export function isPrivateIpv4(hostname) {
   return a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168)
 }
 
+export function isTailscaleAddress(address) {
+  if (!address) return false
+  const normalized = String(address).replace(/^::ffff:/i, '')
+  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/.test(normalized)) return false
+  const parts = normalized.split('.').map((part) => Number(part))
+  if (parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return false
+  return parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127
+}
+
 export function isLoopbackAddress(address) {
   if (!address) return false
   const normalized = address.replace(/^::ffff:/, '')

package/server/utils/response.mjs

@@ -15,7 +15,14 @@ export function sendError(res, error) {
     return
   }
   const status = error?.statusCode || 500
-  sendJson(res, status, { error: error?.message || 'Internal server error' })
+  const payload = { error: error?.message || 'Internal server error' }
+  const code = typeof error?.errorCode === 'string' && error.errorCode
+    ? error.errorCode
+    : typeof error?.code === 'string' && error.code
+      ? error.code
+      : undefined
+  if (code) payload.code = code
+  sendJson(res, status, payload)
 }
 
 export async function readJsonBody(req, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {