@surething/cockpit 1.0.244 → 1.0.246

package/dist/scheduledTasks.mjs

@@ -10,7 +10,7 @@ import {
   setRunAbort,
   startRun,
   updateGlobalState
-} from "./chunk-3X4GQZL4.mjs";
+} from "./chunk-RUNUGDPP.mjs";
 import {
   AgentError,
   AppRuntime,
@@ -37,7 +37,7 @@ import {
   settlePendingRecord,
   withFileLock,
   writeJsonFile
-} from "./chunk-BFESJMNO.mjs";
+} from "./chunk-BRW4ZEIC.mjs";
 import {
   __export
 } from "./chunk-7P6ASYW6.mjs";
@@ -1152,6 +1152,298 @@ Finally emit [Overall recap: end-to-end interaction verification + total deliver
 - **Recap over interruption**: one final review > mid-flow breaks
 `;
 
+// packages/feature/agent/src/server/lib/htmlPrompt.ts
+var HTML_PROMPT_ZH = `---
+name: html
+description: "\u751F\u6210\u53EF\u4EA4\u4E92\u7684\u5C0F\u5E94\u7528\uFF1A\u5185\u7F6E cockpit bash SDK\uFF0C\u6267\u884C\u547D\u4EE4\u53D6/\u6539\u6570\u636E"
+argument-hint: "\u63CF\u8FF0\u4F60\u60F3\u8981\u7684\u5C0F\u5E94\u7528"
+---
+
+# \u751F\u6210 Cockpit \u5C0F\u5E94\u7528
+
+\u4E00\u4E2A\u80FD\u53D6/\u6539\u6570\u636E\u7684\u5C0F\u5E94\u7528\uFF1A\u9884\u89C8\u65F6\u6CE8\u5165\u4E86\u5168\u5C40 \`window.cockpit\` SDK \u2014\u2014 \u672C\u8D28\u5C31\u662F Bash
+\u5DE5\u5177\u66B4\u9732\u7ED9\u9875\u9762\uFF0C\u9875\u9762\u6309\u94AE\u80FD \`curl\`\u3001\u8BFB\u5199\u6587\u4EF6\u3001\u8DD1\u811A\u672C\u3002\u7528 \`Write\` \u751F\u6210\u6587\u4EF6\u3002
+
+**\u9ED8\u8BA4\u7528 React \u5199**\uFF08\u4E0B\u9762\u7684\u672C\u5730\u96F6\u6784\u5EFA\u6808\uFF0Cproductized\u3001AI \u6700\u719F\uFF0C\u9002\u5408\u6709\u72B6\u6001 / \u591A\u89C6\u56FE /
+\u8868\u5355\uFF09\uFF1B\u53EA\u6709**\u6781\u7B80\u5355\u7684\u5355\u89C6\u56FE\u3001\u6216\u7EAF\u9759\u6001\u4E00\u6B21\u6027\u9875**\u624D\u9000\u56DE\u5355\u6587\u4EF6\u5185\u8054 HTML\u3002\u4E24\u79CD\u6A21\u5F0F\u5171\u7528\u4E0B\u9762
+\u8FD9\u5957\u5951\u7EA6\u3002
+
+## \u5951\u7EA6\uFF1Awindow.cockpit\uFF08\u4E24\u6A21\u5F0F\u5171\u7528\uFF0C\u53EA\u6B64\u4E00\u5904\uFF09
+
+\u9875\u9762\u52A0\u8F7D\u65F6 SDK \u5DF2\u5C31\u7EEA\uFF0C\u65E0\u9700\u5F15\u5165\u4EFB\u4F55\u5E93\uFF1A
+
+- \`cockpit.cwd: string\` \u2014\u2014 \u5F53\u524D\u6587\u4EF6\u6240\u5728\u76EE\u5F55\uFF0C\u76F8\u5BF9\u8DEF\u5F84\u547D\u4EE4\u9ED8\u8BA4\u5728\u6B64\u6267\u884C\u3002
+- \`cockpit.bash(command, opts?)\` \u2014\u2014 \u6267\u884C\u4E00\u6761 bash \u547D\u4EE4\uFF08\`command\` \u662F\u6574\u6761 shell \u4E32\uFF09\uFF1A
+  - **\u524D\u53F0**\uFF08\u9ED8\u8BA4\uFF0C\u77ED/\u79BB\u6563\u547D\u4EE4\uFF09\u2192 \`Promise<{ stdout, stderr, exitCode }>\`\uFF0C\`await\` \u540E\u4E00\u6B21\u6027\u62FF\u5168\u90E8\u8F93\u51FA\u3002
+  - **\u540E\u53F0**\uFF08\`opts.background: true\`\uFF0C\u957F/\u5B9E\u65F6\u547D\u4EE4\uFF09\u2192 \`{ kill() }\`\uFF0C\u7ECF\u56DE\u8C03\u6D41\u5F0F\u8F93\u51FA\uFF1A
+    \`opts = { background:true, cwd?, onOutput?, onStderr?, onExit?, onError? }\`\u3002\u5927/\u6301\u7EED\u8F93\u51FA\u5FC5\u987B\u7528\u540E\u53F0\uFF08\u524D\u53F0\u5168\u7F13\u5B58\u5728\u5185\u5B58\uFF09\u3002
+
+\u5199\u8FD9\u7C7B\u9875\u9762\u5FC5\u987B\u5B88\u7684\u51E0\u6761\uFF1A
+
+1. **\u6570\u636E\u53EA\u8D70 \`cockpit.bash\`**\uFF08\`curl\` \u53D6\u3001\`curl -X POST\` \u6539\u3001\u6216\u8BFB\u5199\u6587\u4EF6\uFF09\uFF0C**\u7EDD\u4E0D\u7528
+   \`fetch(\u5916\u90E8URL)\`** \u2014\u2014 \u540C\u6E90\u6C99\u7BB1\u4F1A CORS \u62E6\u622A\u3002
+2. **\u4E24\u7C7B\u5931\u8D25\u90FD\u8981\u5904\u7406**\uFF08\u524D\u53F0\uFF09\uFF1A\`try/catch\` \u6293\u5230\u7684**\u629B\u5F02\u5E38 = spawn/\u57FA\u5EFA\u5931\u8D25**\uFF08\u574F\u8DEF\u5F84\u3001
+   \u8FDE\u63A5\u65AD\uFF09\uFF1B\u6CA1\u629B\u4F46 **\`exitCode !== 0\` = \u547D\u4EE4\u8DD1\u4E86\u4F46\u5931\u8D25**\uFF0C\u5C55\u793A \`stderr\` \u6216 stdout \u91CC\u7684\u9519\u8BEF
+   \u4F53\uFF0C\u522B\u53EA\u5199"\u5931\u8D25"\u3002\u540E\u53F0\u5BF9\u5E94 \`onError\`\uFF08\u57FA\u5EFA\uFF09+ \`onExit\` \u975E\u96F6 \`code\`\uFF08\u547D\u4EE4\uFF09\u3002
+3. **\`command\` \u662F shell \u4E32**\uFF1A\u52A8\u6001\u503C/\u7528\u6237\u8F93\u5165\u62FC\u8FDB\u53BB\u524D\u5FC5\u987B\u6821\u9A8C\u6216\u8F6C\u4E49\uFF08shell \u5143\u5B57\u7B26\u4F1A\u6CE8\u5165\uFF09\uFF1B
+   \u80FD\u7528\u56FA\u5B9A\u547D\u4EE4\u5C31\u522B\u88F8\u62FC\u3002
+4. **\u8D44\u6E90\u5F15\u7528**\uFF1A\u540C\u7EA7\u76F8\u5BF9\uFF08\`./app.jsx\`\u3001\`./style.css\`\u3001\u56FE\u7247\uFF09\u548C CDN \u7EDD\u5BF9 URL \u90FD\u80FD\u52A0\u8F7D\uFF1B\u6839
+   \u76F8\u5BF9\uFF08\`/assets/x.css\`\uFF09\u4F1A 404\u3002
+
+meta \u5934\uFF08\u52A1\u5FC5\u5199\u4E0A\uFF0C\u4F9B HTML \u9762\u677F\u505A\u5361\u7247\u3001console \`/name\` \u6253\u5F00\uFF09\uFF1A
+
+\`\`\`html
+<title>\u9875\u9762\u6807\u9898</title>
+<meta name="cockpit-name" content="short-name">   <!-- /name \u77ED\u540D\uFF0C\u552F\u4E00\u3001\u53EA\u7528\u5B57\u6BCD\u6570\u5B57-_ -->
+<meta name="description" content="\u4E00\u53E5\u8BDD\u8BF4\u660E">
+<meta name="cockpit-icon" content="\u{1F50D}">           <!-- emoji \u6216\u56FE\u6807 url\uFF0C\u53EF\u9009 -->
+<meta name="cockpit-theme" content="auto">        <!-- \u542F\u7528\u53EF\u62D6\u52A8\u7684\u4EAE/\u6697\u5207\u6362\u6309\u94AE\uFF1Bauto=\u9996\u6B21\u8DDF\u968F\u7CFB\u7EDF\uFF0C\u53EF\u586B light/dark -->
+\`\`\`
+
+## \u9ED8\u8BA4\uFF1AReact\uFF08\u672C\u5730\u96F6\u6784\u5EFA\u6808\uFF09
+
+\u5916\u58F3\u56FA\u5B9A\u8FD9\u6837\u5199\uFF0C\u903B\u8F91\u62C6\u5230\u540C\u7EA7 \`./app.jsx\`\uFF1A
+
+\`\`\`html
+<div id="root"></div>
+<script src="/html-lib/react.production.min.js"></script>
+<script src="/html-lib/react-dom.production.min.js"></script>
+<script src="/html-lib/babel.min.js"></script>
+<script>
+  (async () => {
+    const src = await (await fetch('./app.jsx')).text();
+    // \u5FC5\u987B classic runtime\uFF1A\u9ED8\u8BA4 automatic \u4F1A\u6CE8\u5165 import react/jsx-runtime\uFF0C
+    // \u4F5C\u4E3A\u666E\u901A\u811A\u672C\u6CE8\u5165\u4F1A\u62A5 "Cannot use import statement outside a module"
+    const { code } = Babel.transform(src, { presets: [['react', { runtime: 'classic' }]] });
+    const s = document.createElement('script'); s.textContent = code; document.body.appendChild(s);
+  })();
+</script>
+\`\`\`
+
+- \`/html-lib\` \u662F Cockpit \u672C\u5730\u6258\u7BA1\uFF08\u540C\u6E90\u3001\u79BB\u7EBF\u53EF\u7528\uFF0C\u65E0\u9700 CDN\uFF09\u3002
+- \`app.jsx\` \u7528\u5168\u5C40 \`React\`\uFF08\`const { useState } = React;\`\uFF09\uFF0C\u672B\u5C3E
+  \`ReactDOM.createRoot(document.getElementById('root')).render(<App/>)\`\u3002
+- \u6837\u5F0F\u9ED8\u8BA4\u5957 **Cockpit \u4E3B\u9898**\uFF1A\`<link rel="stylesheet" href="/html-lib/theme.css">\`\uFF0C\u76F4\u63A5\u7528
+  \u8BED\u4E49\u53D8\u91CF\uFF08\`var(--background)\` / \`--foreground\` / \`--card\` / \`--brand\` / \`--muted-foreground\` /
+  \`--border\` / \`--destructive\`\uFF1B\u534A\u900F\u660E\u7528 \`hsl(var(--green-9) / .12)\`\uFF09\u3002\u4E0A\u9762 meta \u5934\u91CC\u7684
+  \`cockpit-theme\` \u8BA9\u9884\u89C8\u5E26\u4E0A\u4E00\u4E2A\u6D6E\u52A8\u4EAE/\u6697\u5207\u6362\u6309\u94AE\uFF08\u9ED8\u8BA4\u53F3\u4E0A\u89D2\uFF0C\u7528\u6237\u53EF\u62D6\u52A8\u5438\u9644\u5230\u4EFB\u610F\u4E00\u89D2\uFF0C
+  \u6240\u4EE5\u4E0D\u5FC5\u4E3A\u5B83\u5728\u53F3\u4E0A\u89D2\u7559\u7A7A\u4F4D\uFF09\uFF1B**\u9ED8\u8BA4\u8DDF\u968F Cockpit \u5BBF\u4E3B\u4E3B\u9898**\uFF08Cockpit \u5916\u6253\u5F00\u65F6\u6309
+  meta \u7684 auto/light/dark\uFF09\uFF0C\u624B\u52A8\u5207\u6362\u540E**\u6309 app \u8BB0\u4F4F\u9009\u62E9\uFF08\u8DE8\u5237\u65B0\uFF0C\u4F18\u5148\u4E8E\u8DDF\u968F\uFF09**\uFF0C\u4E5F\u53EF\u8C03
+  \`cockpit.toggleTheme()\`\u3002**\u522B\u81EA\u62CD\u8C03\u8272\u677F\u3001\u522B\u4E0A Tailwind**\uFF1Bapp \u7279\u6709\u7EC6\u8282\u518D\u8865\u4E00\u5C0F\u6BB5 \`<style>\`\u3002
+
+React \u91CC\u53D6\u6570\u540C\u6837\u8D70 \`cockpit.bash\`\uFF1A
+
+\`\`\`jsx
+function App() {
+  const [stars, setStars] = React.useState(null);
+  const load = async () => {
+    const { stdout, exitCode } = await cockpit.bash("curl -s https://api.github.com/repos/Surething-io/cockpit");
+    setStars(exitCode === 0 ? JSON.parse(stdout).stargazers_count : '\u51FA\u9519');
+  };
+  return <button onClick={load}>\u2B50 {stars ?? '\u52A0\u8F7D'}</button>;
+}
+\`\`\`
+
+## \u540E\u7AEF\uFF1A\u590D\u6742\u903B\u8F91\u5199\u6210\u811A\u672C\uFF08CGI \u98CE\u683C\uFF0C\u4E24\u6A21\u5F0F\u901A\u7528\uFF09
+
+\u547D\u4EE4\u5F88\u77ED\u5C31\u5185\u8054\u5728 \`cockpit.bash("...")\`\uFF1B\u903B\u8F91\u590D\u6742\uFF08\u591A\u6B65\u3001\u89E3\u6790\u3001\u5FAA\u73AF\u3001\u8981\u5E93\u3001\u5199\u5E93\uFF09\u65F6\uFF0C\u628A\u540E\u7AEF
+\u5199\u6210\u540C\u76EE\u5F55**\u811A\u672C\u6587\u4EF6**\uFF0C\`cockpit.bash\` \u8C03\u5B83\u2014\u2014HTML/JSX \u7BA1\u5C55\u793A\uFF0C\u811A\u672C\u5F53\u540E\u7AEF\u5904\u7406\u5668\u3002
+
+- **\u663E\u5F0F\u89E3\u91CA\u5668**\uFF1A\`cockpit.bash("node ./api.mjs")\` / \`python3 ./api.py\` / \`bash ./api.sh\`
+  \uFF08\u514D \`chmod +x\`\uFF09\uFF1B\`node\`/\`python3\` \u62FF\u4E0D\u51C6\u5C31\u5148 \`command -v\` \u63A2\u6D4B\uFF0C\u9000\u56DE shell\u3002
+- **\u4F20\u53C2\u9632\u6CE8\u5165**\uFF1A\u7ED3\u6784\u5316\u5165\u53C2\u7528 **base64** \u4F20\uFF08\u524D\u7AEF \`btoa(...)\`\u3001\u811A\u672C
+  \`Buffer.from(arg,'base64')\`\uFF09\uFF0C\u522B\u62FC\u5B57\u7B26\u4E32\uFF1B\u5199\u5E93\u7528**\u53C2\u6570\u5316**\u8BED\u53E5\u3002
+- \u811A\u672C\u7528 stdout \u8FD4\u56DE JSON\uFF0C\u524D\u7AEF \`JSON.parse\`\u3002\u5148 \`Write\` \u51FA\u811A\u672C\uFF0C\u518D\u5728\u9875\u9762\u8C03\u5B83\u3002
+
+## \u9000\u56DE\uFF1A\u5355\u6587\u4EF6 HTML\uFF08\u6781\u7B80 / \u7EAF\u9759\u6001\u4E00\u6B21\u6027\u9875\uFF09
+
+\u4E0D\u9700\u8981\u72B6\u6001\u5C31\u522B\u4E0A React\uFF0C\u76F4\u63A5\u5185\u8054\uFF1B\u53D6\u6570\u4E0E\u9519\u8BEF\u5904\u7406\u540C\u4E0A\u3002
+
+\u524D\u53F0\uFF08\u70B9\u6309\u94AE\u62C9\u6570\u636E\uFF09\uFF1A
+
+\`\`\`html
+<button id="load">\u52A0\u8F7D</button>
+<pre id="out"></pre>
+<script>
+  document.getElementById('load').onclick = async () => {
+    try {
+      const { stdout, stderr, exitCode } = await cockpit.bash("curl -s https://api.github.com/repos/Surething-io/cockpit");
+      if (exitCode !== 0) { out.textContent = '\u547D\u4EE4\u5931\u8D25: ' + stderr; return; }
+      out.textContent = '\u2B50 ' + JSON.parse(stdout).stargazers_count;
+    } catch (e) {
+      out.textContent = '\u6267\u884C\u51FA\u9519: ' + e.message;  // spawn / \u57FA\u5EFA\u5931\u8D25
+    }
+  };
+</script>
+\`\`\`
+
+\u540E\u53F0\uFF08\u5B9E\u65F6\u65E5\u5FD7\uFF09\uFF1A
+
+\`\`\`html
+<pre id="log"></pre>
+<script>
+  const box = document.getElementById('log');
+  const h = cockpit.bash("tail -f ./build.log", {
+    background: true,
+    onOutput: c => { box.textContent += c; },
+    onExit:   code => { box.textContent += '\\n[\u9000\u51FA ' + code + ']'; },
+    onError:  msg  => { box.textContent += '\\n[\u9519\u8BEF ' + msg + ']'; },
+  });
+  // \u9700\u8981\u65F6 h.kill()
+</script>
+\`\`\`
+
+\u751F\u6210\u540E\u7528 \`Write\` \u5199\u6210 \`.html\`\uFF0C\u7528\u6237\u70B9\u51FB\u5373\u53EF\u9884\u89C8\u5E76\u4EA4\u4E92\u3002`;
+var HTML_PROMPT_EN = `---
+name: html
+description: "Generate an interactive small app with the built-in cockpit bash SDK to fetch/update data"
+argument-hint: "describe the small app you want"
+---
+
+# Build a Cockpit small app
+
+A small app that can fetch/update data: the preview injects a global
+\`window.cockpit\` SDK \u2014 essentially the Bash tool exposed to the page, so buttons can
+\`curl\`, read/write files, and run scripts. Use \`Write\` to create the file.
+
+**Default to React** (the local zero-build stack below \u2014 productized, most AI-familiar,
+ideal for stateful / multi-view / form apps); fall back to single-file inline HTML only
+for a **trivial single view or a purely static one-off**. Both modes share the one
+contract below.
+
+## Contract: window.cockpit (shared by both modes, stated once)
+
+The SDK is ready on load \u2014 no library to import:
+
+- \`cockpit.cwd: string\` \u2014 directory of the current file; relative-path commands run here.
+- \`cockpit.bash(command, opts?)\` \u2014 run one bash command (\`command\` is a raw shell string):
+  - **Foreground** (default, short/discrete) \u2192 \`Promise<{ stdout, stderr, exitCode }>\`; \`await\` for the full output at once.
+  - **Background** (\`opts.background: true\`, long/live) \u2192 \`{ kill() }\`, streaming via callbacks:
+    \`opts = { background:true, cwd?, onOutput?, onStderr?, onExit?, onError? }\`. Use background for large/continuous output (foreground buffers it all in memory).
+
+Rules every such page must follow:
+
+1. **Data only through \`cockpit.bash\`** (\`curl\` to read, \`curl -X POST\` to write, or
+   read/write files) \u2014 **never \`fetch(externalURL)\`**: the same-origin sandbox blocks it via CORS.
+2. **Handle both failure modes** (foreground): a **throw** caught by \`try/catch\` = spawn/infra
+   failure (bad path, dropped connection); no throw but **\`exitCode !== 0\` = the command ran
+   and failed** \u2014 show \`stderr\` or the error body in stdout, don't just say "failed". Background:
+   \`onError\` (infra) + a non-zero \`code\` in \`onExit\` (command).
+3. **\`command\` is a shell string**: validate or escape any dynamic/user input before
+   interpolating it (shell metacharacters inject); prefer a fixed command.
+4. **Resource refs**: relative siblings (\`./app.jsx\`, \`./style.css\`, images) and absolute
+   CDN URLs load; root-relative (\`/assets/x.css\`) 404s.
+
+Meta head (always include \u2014 the HTML panel renders cards from it, the console opens it via \`/name\`):
+
+\`\`\`html
+<title>Page title</title>
+<meta name="cockpit-name" content="short-name">   <!-- unique short name for /name; letters/digits/-_ only -->
+<meta name="description" content="one line about the page">
+<meta name="cockpit-icon" content="\u{1F50D}">           <!-- emoji or icon url, optional -->
+<meta name="cockpit-theme" content="auto">        <!-- enable the draggable light/dark toggle; auto = first load follows the OS, or light/dark -->
+\`\`\`
+
+## Default: React (local zero-build stack)
+
+Use this fixed shell, with the logic in a sibling \`./app.jsx\`:
+
+\`\`\`html
+<div id="root"></div>
+<script src="/html-lib/react.production.min.js"></script>
+<script src="/html-lib/react-dom.production.min.js"></script>
+<script src="/html-lib/babel.min.js"></script>
+<script>
+  (async () => {
+    const src = await (await fetch('./app.jsx')).text();
+    // MUST use classic runtime: the default automatic runtime injects an import of
+    // react/jsx-runtime, which \u2014 appended as a plain script \u2014 throws
+    // "Cannot use import statement outside a module".
+    const { code } = Babel.transform(src, { presets: [['react', { runtime: 'classic' }]] });
+    const s = document.createElement('script'); s.textContent = code; document.body.appendChild(s);
+  })();
+</script>
+\`\`\`
+
+- \`/html-lib\` is hosted locally by Cockpit (same-origin, offline, no CDN).
+- \`app.jsx\` uses the global \`React\` (\`const { useState } = React;\`) and ends with
+  \`ReactDOM.createRoot(document.getElementById('root')).render(<App/>)\`.
+- Style with the **Cockpit theme** by default: \`<link rel="stylesheet" href="/html-lib/theme.css">\`,
+  then use the semantic vars (\`var(--background)\` / \`--foreground\` / \`--card\` / \`--brand\` /
+  \`--muted-foreground\` / \`--border\` / \`--destructive\`; translucency via \`hsl(var(--green-9) / .12)\`).
+  The \`cockpit-theme\` meta above gives the preview a floating light/dark toggle (top-right by
+  default, draggable to any corner \u2014 so don't reserve top-right space for it); it **follows the
+  Cockpit host theme by default** (outside Cockpit, the meta's auto/light/dark decides), and a manual
+  toggle is **remembered per app across reloads and overrides the host**, or call \`cockpit.toggleTheme()\`
+  from your own UI. Don't invent a palette or add Tailwind; add a small \`<style>\` for app-specific bits.
+
+Fetch data from React the same way, via \`cockpit.bash\`:
+
+\`\`\`jsx
+function App() {
+  const [stars, setStars] = React.useState(null);
+  const load = async () => {
+    const { stdout, exitCode } = await cockpit.bash("curl -s https://api.github.com/repos/Surething-io/cockpit");
+    setStars(exitCode === 0 ? JSON.parse(stdout).stargazers_count : 'error');
+  };
+  return <button onClick={load}>\u2B50 {stars ?? 'load'}</button>;
+}
+\`\`\`
+
+## Backend: write complex logic as a script (CGI-style, both modes)
+
+Inline short commands in \`cockpit.bash("...")\`. For complex logic (multi-step, parsing,
+loops, a library, DB writes), write the backend as a **script file** next to the page and
+call it \u2014 the HTML/JSX is the frontend, the script is the backend handler.
+
+- **Explicit interpreter**: \`cockpit.bash("node ./api.mjs")\` / \`python3 ./api.py\` /
+  \`bash ./api.sh\` (avoids \`chmod +x\`); probe \`node\`/\`python3\` with \`command -v\` if unsure,
+  and fall back to shell.
+- **Pass args safely**: send structured input as **base64** (\`btoa(...)\` on the page,
+  \`Buffer.from(arg,'base64')\` in the script) rather than string-building; use **parameterized**
+  statements for DB writes.
+- The script returns JSON on stdout; the frontend does \`JSON.parse\`. \`Write\` the script first, then call it.
+
+## Fallback: single-file HTML (trivial / static one-off)
+
+No state? Skip React and inline it. Same data/error handling as above.
+
+Foreground (button fetches data):
+
+\`\`\`html
+<button id="load">Load</button>
+<pre id="out"></pre>
+<script>
+  document.getElementById('load').onclick = async () => {
+    try {
+      const { stdout, stderr, exitCode } = await cockpit.bash("curl -s https://api.github.com/repos/Surething-io/cockpit");
+      if (exitCode !== 0) { out.textContent = 'command failed: ' + stderr; return; }
+      out.textContent = '\u2B50 ' + JSON.parse(stdout).stargazers_count;
+    } catch (e) {
+      out.textContent = 'exec error: ' + e.message;  // spawn / infra failure
+    }
+  };
+</script>
+\`\`\`
+
+Background (live log):
+
+\`\`\`html
+<pre id="log"></pre>
+<script>
+  const box = document.getElementById('log');
+  const h = cockpit.bash("tail -f ./build.log", {
+    background: true,
+    onOutput: c => { box.textContent += c; },
+    onExit:   code => { box.textContent += '\\n[exit ' + code + ']'; },
+    onError:  msg  => { box.textContent += '\\n[error ' + msg + ']'; },
+  });
+  // h.kill() when done
+</script>
+\`\`\`
+
+Write the result to a \`.html\` file with \`Write\`; the user clicks it to preview and interact.`;
+
 // packages/feature/agent/src/server/lib/newBranchPrompt.ts
 var NEW_BRANCH_LABEL_ZH = "\u9700\u6C42\uFF1A";
 var NEW_BRANCH_LABEL_EN = "Intent: ";
@@ -1689,6 +1981,7 @@ var COMMAND_CONTENT = {
   fx: { zh: FX_PROMPT_ZH, en: FX_PROMPT_EN },
   ex: { zh: EX_PROMPT_ZH, en: EX_PROMPT_EN },
   go: { zh: GO_PROMPT_ZH, en: GO_PROMPT_EN },
+  html: { zh: HTML_PROMPT_ZH, en: HTML_PROMPT_EN },
   cg: { zh: CG_PROMPT_ZH, en: CG_PROMPT_EN, labelZh: CG_LABEL_ZH, labelEn: CG_LABEL_EN },
   cc: { zh: CC_PROMPT_ZH, en: CC_PROMPT_EN, labelZh: CC_LABEL_ZH, labelEn: CC_LABEL_EN },
   cr: { zh: CR_PROMPT_ZH, en: CR_PROMPT_EN },

package/dist/{server-HKW65PHP.mjs → server-MCN5AIEU.mjs}

@@ -26,6 +26,7 @@ import {
   killCommand,
   listBrowsers,
   listTerminals,
+  normalizeCustomCommands,
   notifyExitListeners,
   notifyOutputListeners,
   readAround,
@@ -45,12 +46,12 @@ import {
   unregisterTerminal,
   updateBrowserWs,
   writeStdinToCommand
-} from "./chunk-FMJUH423.mjs";
+} from "./chunk-7WPYQYA6.mjs";
 import {
   createNeo4jDriver,
   runCypherWithDriver,
   serializeValue
-} from "./chunk-BFESJMNO.mjs";
+} from "./chunk-BRW4ZEIC.mjs";
 import "./chunk-7P6ASYW6.mjs";
 export {
   INTERRUPTED_EXIT_CODE,
@@ -81,6 +82,7 @@ export {
   killCommand,
   listBrowsers,
   listTerminals,
+  normalizeCustomCommands,
   notifyExitListeners,
   notifyOutputListeners,
   readAround,

package/dist/wsServer.mjs

@@ -2,7 +2,7 @@ import {
   addRunListener,
   getGlobalSessionsSnapshot,
   getRunSnapshot
-} from "./chunk-3X4GQZL4.mjs";
+} from "./chunk-RUNUGDPP.mjs";
 import {
   addExitListener,
   addOutputListener,
@@ -18,7 +18,7 @@ import {
   resolvePendingRequest,
   unregisterBrowser,
   writeStdinToCommand
-} from "./chunk-FMJUH423.mjs";
+} from "./chunk-7WPYQYA6.mjs";
 import {
   AppError,
   Effect_exports,
@@ -33,7 +33,7 @@ import {
   Stream_exports,
   ValidationError,
   WSError
-} from "./chunk-BFESJMNO.mjs";
+} from "./chunk-BRW4ZEIC.mjs";
 import "./chunk-7P6ASYW6.mjs";
 
 // src/lib/wsServer.ts
@@ -665,7 +665,7 @@ var handleJupyter = (conn, bubbleId, cwd) => Effect_exports.gen(function* () {
     Effect_exports.annotateLogs("cwd", cwd)
   );
   const { kernelManager } = yield* Effect_exports.tryPromise({
-    try: () => import("./server-HKW65PHP.mjs"),
+    try: () => import("./server-MCN5AIEU.mjs"),
     catch: (cause) => new AppError({
       message: "failed to import kernel manager",
       cause
@@ -1162,8 +1162,182 @@ var runTerminalHandler = (ws, projectCwd) => {
   });
 };
 
-// src/lib/effect/sessionStreamHandler.ts
+// src/lib/effect/bashStreamHandler.ts
+import { spawn as spawn4 } from "child_process";
+
+// src/lib/shell.ts
+import { existsSync as existsSync3 } from "fs";
+import { execSync as execSync2, spawn as spawn3 } from "child_process";
+var bashCache;
+function resolveBashShell() {
+  if (!isWindows) return getDefaultShell();
+  if (bashCache !== void 0) return bashCache;
+  const envShell = process.env.SHELL;
+  const candidates = [
+    ...envShell && /bash(\.exe)?$/i.test(envShell) ? [envShell] : [],
+    "C:\\Program Files\\Git\\bin\\bash.exe",
+    "C:\\Program Files (x86)\\Git\\bin\\bash.exe",
+    ...process.env.ProgramFiles ? [`${process.env.ProgramFiles}\\Git\\bin\\bash.exe`] : []
+  ];
+  for (const c of candidates) {
+    if (existsSync3(c)) return bashCache = c;
+  }
+  try {
+    const found = execSync2("where bash", { encoding: "utf-8", timeout: 3e3 }).trim().split(/\r?\n/)[0];
+    if (found && existsSync3(found)) return bashCache = found;
+  } catch {
+  }
+  return null;
+}
+function killProcessTree(child) {
+  const pid = child.pid;
+  if (!pid) return;
+  if (isWindows) {
+    try {
+      spawn3("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
+    } catch {
+    }
+    return;
+  }
+  const signal = (sig) => {
+    try {
+      process.kill(-pid, sig);
+    } catch {
+      try {
+        process.kill(pid, sig);
+      } catch {
+      }
+    }
+  };
+  signal("SIGTERM");
+  const timer = setTimeout(() => {
+    if (child.exitCode === null && child.signalCode === null) signal("SIGKILL");
+  }, 1e3);
+  if (typeof timer.unref === "function") timer.unref();
+  child.once("exit", () => clearTimeout(timer));
+}
+
+// src/lib/effect/bashStreamHandler.ts
 var HEARTBEAT6 = Schedule_exports.spaced("30 seconds");
+function killChild(child) {
+  killProcessTree(child);
+}
+var handleBash = (conn, defaultCwd) => Effect_exports.gen(function* () {
+  yield* Effect_exports.logInfo("ws/bash start").pipe(
+    Effect_exports.annotateLogs("cwd", defaultCwd ?? "")
+  );
+  const children = /* @__PURE__ */ new Map();
+  yield* Effect_exports.addFinalizer(
+    () => Effect_exports.sync(() => {
+      for (const child of children.values()) killChild(child);
+      children.clear();
+    })
+  );
+  const shell = resolveBashShell();
+  const startExec = (msg) => {
+    const id = msg.id;
+    const command = msg.command;
+    const cwd = msg.cwd || defaultCwd || process.cwd();
+    if (!id || typeof id !== "string") return;
+    if (!shell) {
+      Effect_exports.runFork(
+        conn.send({
+          type: "error",
+          id: id || "",
+          message: "bash not found \u2014 install Git Bash or WSL on Windows"
+        })
+      );
+      return;
+    }
+    if (!command || typeof command !== "string") {
+      Effect_exports.runFork(
+        conn.send({ type: "error", id: id || "", message: "missing command" })
+      );
+      return;
+    }
+    if (children.has(id)) {
+      Effect_exports.runFork(
+        conn.send({ type: "error", id, message: "duplicate command id" })
+      );
+      return;
+    }
+    let child;
+    try {
+      child = spawn4(shell, ["--login", "-c", command], {
+        cwd,
+        env: { ...process.env, FORCE_COLOR: "0" },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: true
+      });
+    } catch (e) {
+      Effect_exports.runFork(
+        conn.send({ type: "error", id, message: e.message })
+      );
+      return;
+    }
+    children.set(id, child);
+    child.stdout?.on("data", (d) => {
+      Effect_exports.runFork(conn.send({ type: "stdout", id, data: d.toString() }));
+    });
+    child.stderr?.on("data", (d) => {
+      Effect_exports.runFork(conn.send({ type: "stderr", id, data: d.toString() }));
+    });
+    child.on("close", (code) => {
+      if (children.get(id) === child) children.delete(id);
+      Effect_exports.runFork(conn.send({ type: "exit", id, code: code ?? 0 }));
+    });
+    child.on("error", (err) => {
+      if (children.get(id) === child) children.delete(id);
+      Effect_exports.runFork(conn.send({ type: "error", id, message: err.message }));
+    });
+  };
+  const dispatch = (raw) => Effect_exports.sync(() => {
+    const msg = raw;
+    const type = msg.type;
+    if (type === "exec") {
+      startExec(msg);
+    } else if (type === "kill") {
+      const id = msg.id;
+      const child = children.get(id);
+      if (child) {
+        children.delete(id);
+        killChild(child);
+      }
+    }
+  });
+  yield* Effect_exports.forkScoped(
+    Effect_exports.repeat(conn.send({ type: "ping" }), HEARTBEAT6)
+  );
+  yield* conn.messages.pipe(
+    Stream_exports.mapEffect(dispatch),
+    Stream_exports.runDrain
+  );
+}).pipe(Effect_exports.withSpan("ws.handleBash", { attributes: { cwd: defaultCwd ?? "" } }));
+var runBashHandler = (ws, cwd) => {
+  const program = Effect_exports.scoped(
+    Effect_exports.gen(function* () {
+      const conn = yield* fromWebSocket(ws, "bash");
+      yield* handleBash(conn, cwd);
+    })
+  ).pipe(
+    Effect_exports.catchTag(
+      "ValidationError",
+      (e) => Effect_exports.sync(() => ws.close(4400, e.reason))
+    ),
+    Effect_exports.catchAll(
+      (e) => Effect_exports.logError("[ws/bash]").pipe(
+        Effect_exports.annotateLogs("error", JSON.stringify(e))
+      )
+    )
+  );
+  const fiber = Effect_exports.runFork(program);
+  ws.on("close", () => {
+    Effect_exports.runFork(fiber.interruptAsFork(fiber.id()));
+  });
+};
+
+// src/lib/effect/sessionStreamHandler.ts
+var HEARTBEAT7 = Schedule_exports.spaced("30 seconds");
 var handleSessionStream = (conn, sessionId) => Effect_exports.gen(function* () {
   if (!sessionId) {
     return yield* Effect_exports.fail(
@@ -1195,7 +1369,7 @@ var handleSessionStream = (conn, sessionId) => Effect_exports.gen(function* () {
     yield* conn.send({ type: "run-idle" });
   }
   yield* Effect_exports.forkScoped(
-    Effect_exports.repeat(conn.send({ type: "ping" }), HEARTBEAT6)
+    Effect_exports.repeat(conn.send({ type: "ping" }), HEARTBEAT7)
   );
   yield* Stream_exports.fromQueue(queue).pipe(
     Stream_exports.filter((ev) => ev.seq > snapshotSeq),
@@ -3971,6 +4145,16 @@ function broadcastToGlobalState(msg) {
 
 // src/lib/wsServer.ts
 wireCodeIndexToFileWatcher();
+function isSameOriginWs(req) {
+  const origin = req.headers.origin;
+  const host = req.headers.host;
+  if (!origin || !host) return false;
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
 var g_ws = globalThis;
 var wss = g_ws.__cockpitWss ?? (() => {
   const server = new WebSocketServer({ noServer: true });
@@ -3985,6 +4169,15 @@ var wss = g_ws.__cockpitWss ?? (() => {
       runGlobalStateHandler(ws);
     } else if (pathname === "/ws/terminal") {
       runTerminalHandler(ws, query.projectCwd);
+    } else if (pathname === "/ws/bash") {
+      if (!isSameOriginWs(req)) {
+        try {
+          ws.close(4403, "forbidden origin");
+        } catch {
+        }
+      } else {
+        runBashHandler(ws, query.cwd);
+      }
     } else if (pathname === "/ws/browser") {
       runBrowserHandler(
         ws,
@@ -4004,7 +4197,7 @@ var wss = g_ws.__cockpitWss ?? (() => {
 })();
 function handleUpgrade(req, socket, head) {
   const { pathname } = parse(req.url || "", true);
-  if (pathname === "/ws/watch" || pathname === "/ws/global-state" || pathname === "/ws/terminal" || pathname === "/ws/browser" || pathname === "/ws/terminal-follow" || pathname === "/ws/jupyter" || pathname === "/ws/session-stream") {
+  if (pathname === "/ws/watch" || pathname === "/ws/global-state" || pathname === "/ws/terminal" || pathname === "/ws/bash" || pathname === "/ws/browser" || pathname === "/ws/terminal-follow" || pathname === "/ws/jupyter" || pathname === "/ws/session-stream") {
     wss.handleUpgrade(req, socket, head, (ws) => {
       wss.emit("connection", ws, req);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surething/cockpit",
-  "version": "1.0.244",
+  "version": "1.0.246",
   "description": "The open-source Claude Code GUI — an IDE-like workbench for parallel AI coding. Drive Claude (default), Codex, DeepSeek, Kimi, or local Ollama in tabs. Terminal, browser & DB bubbles, code review. Self-host on a shared dev box — a seat for every teammate. Local-first, MIT.",
   "author": "Robert",
   "license": "MIT",
@@ -67,6 +67,9 @@
   "files": [
     "bin",
     "chrome-extension",
+    "apps",
+    "!**/*.test.*",
+    "!**/*.spec.*",
     "public",
     "server.mjs",
     "dist",
@@ -80,10 +83,10 @@
     "README.md"
   ],
   "scripts": {
-    "predev": "node scripts/copy-tree-sitter-wasms.mjs && node scripts/copy-pdfjs-worker.mjs",
+    "predev": "node scripts/copy-tree-sitter-wasms.mjs && node scripts/copy-pdfjs-worker.mjs && node scripts/build-html-lib.mjs",
     "dev": "COCKPIT_ENV=dev node --import tsx server.mjs",
     "prepublishOnly": "npm run build && npm run build:server && rm -rf .next-prod/cache",
-    "prebuild": "node scripts/copy-tree-sitter-wasms.mjs && node scripts/copy-pdfjs-worker.mjs",
+    "prebuild": "node scripts/copy-tree-sitter-wasms.mjs && node scripts/copy-pdfjs-worker.mjs && node scripts/build-html-lib.mjs",
     "build": "next build --webpack",
     "build:server": "tsup --config tsup.server.ts",
     "setup": "npm run build && npm run build:server && npm link",