@surething/cockpit 1.0.260 → 1.0.262

package/bin/updater.mjs

@@ -0,0 +1,231 @@
+// Out-of-process updater. Started detached by POST /api/update, runs while the
+// server is down, and brings it back up afterwards.
+//
+// SELF-CONTAINED BY REQUIREMENT — do not add imports of cockpit's own modules.
+// This script is copied out to <cockpitHome>/updater/ before being run, because
+// `npm i -g` replaces the whole install directory underneath it. A script
+// running from that directory, or importing anything inside it, can vanish
+// mid-execution. Node builtins only.
+//
+// Why an external process at all: a process cannot reinstall the package it is
+// running from. On Windows that is a hard block (node-pty's pty.node/conpty.node
+// are dlopen'd, so the files are locked and the install fails outright); on
+// POSIX it "works" only until the server lazily imports a chunk that npm has
+// already deleted. So: server exits -> updater installs -> updater respawns it.
+//
+// The environment is inherited through this whole chain. That is what preserves
+// COCKPIT_TOKEN, PORT, COCKPIT_HOST and COCKPIT_HOME across the restart —
+// losing the token would silently turn a tunnel-exposed instance into an open
+// one, so it must never be re-derived from defaults.
+import { spawn, spawnSync } from 'child_process';
+import { appendFileSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+
+const PKG = '@surething/cockpit';
+const EXIT_WAIT_MS = 30_000;
+const POLL_MS = 250;
+
+function arg(name, fallback = null) {
+  const i = process.argv.indexOf(`--${name}`);
+  return i !== -1 && process.argv[i + 1] ? process.argv[i + 1] : fallback;
+}
+
+const serverPid = Number(arg('pid', '0'));
+const installRoot = arg('root');
+const cockpitHome = arg('home');
+const fromVersion = arg('from', 'unknown');
+const target = arg('to', 'latest');
+
+// --restart-only reuses everything here except the install step. A restart has
+// the same hard requirement as an update — the replacement must be launched by
+// a process that is NOT the one being replaced — and, more importantly, it is
+// how the server's environment survives: COCKPIT_TOKEN, PORT and COCKPIT_HOST
+// are inherited down this chain. A CLI-driven stop+start instead rebuilds the
+// environment from whatever shell the user happens to be in, which silently
+// drops the token and leaves the instance open.
+const restartOnly = process.argv.includes('--restart-only');
+
+if (!installRoot || !cockpitHome) {
+  console.error('updater: --root and --home are required');
+  process.exit(2);
+}
+
+const logPath = join(cockpitHome, 'logs', 'updater.log');
+const statePath = join(cockpitHome, 'update-state.json');
+
+function log(line) {
+  const stamped = `[${new Date().toISOString()}] ${line}\n`;
+  try {
+    appendFileSync(logPath, stamped);
+  } catch { /* logging must never abort an update */ }
+}
+
+function writeState(patch) {
+  try {
+    writeFileSync(
+      statePath,
+      JSON.stringify({ from: fromVersion, target, pid: process.pid, ...patch }, null, 2)
+    );
+  } catch { /* best effort */ }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function pidAlive(pid) {
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function readInstalledVersion() {
+  try {
+    return JSON.parse(readFileSync(join(installRoot, 'package.json'), 'utf8')).version;
+  } catch {
+    return null;
+  }
+}
+
+function runNpm(args) {
+  log(`npm ${args.join(' ')}`);
+  const r = spawnSync('npm', args, {
+    encoding: 'utf-8',
+    // Windows npm is npm.cmd; Node >=18.20/20.12 refuses to spawn .cmd without
+    // a shell (CVE-2024-27980).
+    shell: process.platform === 'win32',
+  });
+  if (r.error) {
+    log(`npm failed to launch: ${r.error.message}`);
+    return { ok: false, reason: `could not run npm: ${r.error.message}` };
+  }
+  if (r.stdout) log(r.stdout.trim());
+  if (r.stderr) log(r.stderr.trim());
+  if (r.status !== 0) return { ok: false, reason: `npm exited ${r.status}` };
+  return { ok: true };
+}
+
+/**
+ * Restart the server.
+ *
+ * Always detached, even when the old instance ran in the foreground: the
+ * terminal that owned it has already returned to its shell by the time we get
+ * here, so there is nothing to hand it back to. The UI states this outright
+ * before starting, rather than silently changing how the user stops cockpit.
+ */
+function startServer() {
+  try {
+    mkdirSync(join(cockpitHome, 'logs'), { recursive: true });
+    const fd = openSync(join(cockpitHome, 'logs', 'server.log'), 'a');
+    const child = spawn(process.execPath, ['server.mjs'], {
+      cwd: installRoot,
+      env: {
+        ...process.env,
+        // Inherited env carries the original PORT/token/host. Only the
+        // supervision mode and the browser-opening behaviour change: the user
+        // is already looking at the page that triggered this.
+        COCKPIT_MANAGED: 'bare',
+        COCKPIT_NO_OPEN: '1',
+        COCKPIT_OPEN_PROJECT: '',
+      },
+      detached: true,
+      windowsHide: true,
+      stdio: ['ignore', fd, fd],
+    });
+    child.unref();
+    log(`server respawned, pid ${child.pid}`);
+    return true;
+  } catch (e) {
+    log(`failed to respawn server: ${e.message}`);
+    return false;
+  }
+}
+
+async function main() {
+  mkdirSync(join(cockpitHome, 'logs'), { recursive: true });
+  const mode = restartOnly ? 'restart' : 'update';
+  log(
+    restartOnly
+      ? `--- restart start (server pid ${serverPid}) ---`
+      : `--- update start: ${fromVersion} -> ${target} (server pid ${serverPid}) ---`
+  );
+  writeState({ mode, phase: 'waiting-for-exit', startedAt: Date.now() });
+
+  // 1. Wait for the server to release the install directory.
+  const deadline = Date.now() + EXIT_WAIT_MS;
+  while (pidAlive(serverPid) && Date.now() < deadline) await sleep(POLL_MS);
+  if (pidAlive(serverPid)) {
+    log(`server ${serverPid} still alive after ${EXIT_WAIT_MS}ms — forcing`);
+    try {
+      if (process.platform === 'win32') {
+        spawnSync('taskkill', ['/PID', String(serverPid), '/T', '/F'], { stdio: 'ignore' });
+      } else {
+        process.kill(serverPid, 'SIGKILL');
+      }
+    } catch { /* already gone */ }
+    await sleep(1000);
+  }
+  // Windows needs a beat after exit for the loader to drop its handles on the
+  // native .node files; installing too early fails with EPERM/EBUSY.
+  if (process.platform === 'win32') await sleep(2000);
+
+  // 2. Bring it back. A restart stops here — no install, no rollback path.
+  if (restartOnly) {
+    writeState({ mode, phase: 'restarting' });
+    const ok = startServer();
+    writeState({ mode, phase: ok ? 'done' : 'failed', restarted: ok, finishedAt: Date.now() });
+    log(`--- restart ${ok ? 'complete' : 'FAILED'} ---`);
+    process.exit(ok ? 0 : 1);
+  }
+
+  writeState({ mode, phase: 'installing', startedAt: Date.now() });
+  const install = runNpm(['install', '-g', `${PKG}@${target}`, '--include=optional']);
+
+  if (!install.ok) {
+    // 3a. Roll back to the version we came from. npm may have already removed
+    //     the old tree, so leaving it as-is can mean no cockpit at all.
+    log(`install failed (${install.reason}) — rolling back to ${fromVersion}`);
+    writeState({ phase: 'rolling-back', error: install.reason });
+    const rollback =
+      fromVersion !== 'unknown'
+        ? runNpm(['install', '-g', `${PKG}@${fromVersion}`, '--include=optional'])
+        : { ok: false, reason: 'unknown previous version' };
+    const restarted = startServer();
+    writeState({
+      phase: 'failed',
+      error: install.reason,
+      rolledBack: rollback.ok,
+      restarted,
+      finishedAt: Date.now(),
+    });
+    log(`--- update failed; rollback ${rollback.ok ? 'ok' : 'FAILED'} ---`);
+    process.exit(1);
+  }
+
+  // 3b. Success.
+  const installed = readInstalledVersion();
+  log(`installed version now: ${installed}`);
+  writeState({ phase: 'restarting', installed });
+
+  const restarted = startServer();
+  writeState({
+    phase: restarted ? 'done' : 'failed',
+    installed,
+    restarted,
+    // Same version means npm had nothing newer to give — not an error.
+    unchanged: installed === fromVersion,
+    finishedAt: Date.now(),
+  });
+  log(`--- update ${restarted ? 'complete' : 'installed but respawn FAILED'} ---`);
+  process.exit(restarted ? 0 : 1);
+}
+
+main().catch((e) => {
+  log(`updater crashed: ${e && e.stack ? e.stack : e}`);
+  // Never leave the user without a server because the updater itself broke.
+  const restarted = startServer();
+  writeState({ phase: 'failed', error: String(e), restarted, finishedAt: Date.now() });
+  process.exit(1);
+});

package/dist/{chunk-CLPJYIFC.mjs → chunk-AI7T3EXM.mjs}

@@ -14,7 +14,7 @@ import {
   readJsonFile,
   sanitizedSpawnEnv,
   writeJsonFile
-} from "./chunk-TU3GL2HK.mjs";
+} from "./chunk-ZCMAJV2M.mjs";
 
 // packages/feature/console/src/server/plugins/browser/BrowserBridge.ts
 import { WebSocket } from "ws";
@@ -679,6 +679,7 @@ function registerCommand(cmd) {
     });
   } else {
     const child = cmd.process;
+    if (!child) return;
     child.stdout?.on("data", (data) => {
       appendCommandOutput(cmd.commandId, data.toString());
     });
@@ -988,12 +989,12 @@ function writeStdinToCommand(cmd, data) {
   }
   if (data === "") {
     try {
-      cmd.process.stdin?.end();
+      cmd.process?.stdin?.end();
     } catch {
     }
     return true;
   }
-  if (cmd.process.stdin?.writable) {
+  if (cmd.process?.stdin?.writable) {
     cmd.process.stdin.write(data);
     return true;
   }

package/dist/{chunk-B5LXMESP.mjs → chunk-LC4LAEWJ.mjs}

@@ -14,7 +14,7 @@ import {
   readJsonFile,
   withFileLock,
   writeJsonFile
-} from "./chunk-TU3GL2HK.mjs";
+} from "./chunk-ZCMAJV2M.mjs";
 
 // packages/feature/agent/src/server/state/globalState.ts
 import { createReadStream, existsSync, statSync } from "fs";

package/dist/{chunk-TU3GL2HK.mjs → chunk-ZCMAJV2M.mjs}

@@ -28626,6 +28626,20 @@ import { dirname, join as join4, resolve } from "path";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { closeSync, existsSync, mkdirSync, openSync, readSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, readdirSync, readFileSync } from "fs";
 import { execSync } from "child_process";
+
+// packages/shared/utils/src/encodePath.ts
+var CLAUDE_ENCODED_MAX_LEN = 200;
+function claudePathHash(path) {
+  let h = 0;
+  for (let i = 0; i < path.length; i++) h = (h << 5) - h + path.charCodeAt(i) | 0;
+  return Math.abs(h).toString(36);
+}
+function encodePath(path) {
+  const encoded = path.replace(/[^a-zA-Z0-9]/g, "-");
+  return encoded.length <= CLAUDE_ENCODED_MAX_LEN ? encoded : `${encoded.slice(0, CLAUDE_ENCODED_MAX_LEN)}-${claudePathHash(path)}`;
+}
+
+// packages/shared/utils/src/paths.ts
 var HOME_DIR = homedir();
 var COCKPIT_DIR = process.env.COCKPIT_HOME ? resolve(process.env.COCKPIT_HOME.replace(/^~(?=$|\/)/, HOME_DIR)) : join4(HOME_DIR, ".cockpit");
 var COCKPIT_PROJECTS_DIR = join4(COCKPIT_DIR, "projects");
@@ -28651,9 +28665,6 @@ var GLM_DIR = join4(COCKPIT_DIR, "glm");
 var GLM_CREDENTIALS_FILE = join4(GLM_DIR, "credentials.json");
 var OLLAMA_DIR = join4(COCKPIT_DIR, "ollama");
 var OLLAMA_CONFIG_FILE = join4(OLLAMA_DIR, "config.json");
-function encodePath(path) {
-  return path.replace(/[/.]/g, "-");
-}
 function getCockpitProjectDir(cwd) {
   return join4(COCKPIT_PROJECTS_DIR, encodePath(cwd));
 }
@@ -30757,6 +30768,7 @@ export {
   createNeo4jDriver,
   runCypherWithDriver,
   serializeValue,
+  encodePath,
   COCKPIT_DIR,
   GLOBAL_STATE_FILE,
   PUSH_SUBSCRIPTIONS_FILE,
@@ -30769,7 +30781,6 @@ export {
   DEEPSEEK_CREDENTIALS_FILE,
   KIMI_CREDENTIALS_FILE,
   GLM_CREDENTIALS_FILE,
-  encodePath,
   getSessionFilePath,
   getTerminalHistoryPath,
   getTerminalOutputPath,

package/dist/httpApi.mjs

@@ -22,10 +22,10 @@ import {
   unregisterBrowser,
   unregisterTerminal,
   writeStdinToCommand
-} from "./chunk-CLPJYIFC.mjs";
+} from "./chunk-AI7T3EXM.mjs";
 import {
   getTerminalHistoryPath
-} from "./chunk-TU3GL2HK.mjs";
+} from "./chunk-ZCMAJV2M.mjs";
 import "./chunk-7P6ASYW6.mjs";
 
 // src/lib/httpApi.ts

package/dist/scheduledTasks.mjs

@@ -14,7 +14,7 @@ import {
   stashCodexRollout,
   stashTranscript,
   updateGlobalState
-} from "./chunk-B5LXMESP.mjs";
+} from "./chunk-LC4LAEWJ.mjs";
 import {
   AgentError,
   AppRuntime,
@@ -45,7 +45,7 @@ import {
   settlePendingRecord,
   withFileLock,
   writeJsonFile
-} from "./chunk-TU3GL2HK.mjs";
+} from "./chunk-ZCMAJV2M.mjs";
 import {
   __export
 } from "./chunk-7P6ASYW6.mjs";
@@ -17478,6 +17478,8 @@ var CODEX_IMAGE_ONLY_TEXT = "[Image]";
 var CODEX_TOOL_NAMES = {
   bash: "Bash",
   applyPatch: "ApplyPatch",
+  /** `view_image` → claude's Read: it opens a file, and Read is in READ_ONLY_TOOLS. */
+  read: "Read",
   /** `spawn_agent` → claude's Task, so one bubble == one sub-agent. */
   task: "Task",
   /** `update_plan` / live `todo_list` → the checklist MessageBubble already renders. */
@@ -17488,6 +17490,7 @@ var CODEX_TOOL_NAMES = {
 var CODEX_MCP_NAMESPACE_PREFIX = "mcp__";
 var codexMcpToolName = (server, tool2) => `${CODEX_MCP_NAMESPACE_PREFIX}${server}__${tool2}`;
 var CODEX_SPAWN_FN_NAME = "spawn_agent";
+var CODEX_SUB_AGENT_ACTIVITY_TYPE = "sub_agent_activity";
 var CODEX_PATCH_FN_NAME = "apply_patch";
 var CODEX_EXEC_SCRIPT_FN_NAME = "exec";
 function codexTodoInput(items) {
@@ -17596,15 +17599,37 @@ function parseCodexExecScript(script) {
 }
 var CODEX_AGENT_DONE = /* @__PURE__ */ new Set(["completed", "errored", "interrupted", "not_found", "failed"]);
 function parseCodexSpawnInput(args, extra) {
-  const prompt = typeof args.message === "string" ? args.message : "";
-  const agentType = typeof args.agent_type === "string" ? args.agent_type : void 0;
+  const message = typeof args.message === "string" ? args.message : "";
+  const encrypted = isCodexEncryptedPayload(message);
+  const prompt = encrypted ? "" : message;
+  const agentType = typeof args.agent_type === "string" ? args.agent_type : typeof args.task_name === "string" ? codexAgentPathName(args.task_name) : void 0;
   return {
     ...agentType ? { subagent_type: agentType } : {},
     description: codexSpawnDescription(extra?.nickname, agentType, prompt),
-    prompt,
+    ...encrypted ? { message_encrypted: true } : { prompt },
     ...extra?.agentId ? { agent_id: extra.agentId } : {}
   };
 }
+var CODEX_FERNET_TOKEN_RE = /^gAAAAA[A-Za-z0-9_-]{32,}={0,2}$/;
+function isCodexEncryptedPayload(text) {
+  return CODEX_FERNET_TOKEN_RE.test(text.trim());
+}
+function codexAgentPathName(agentPath) {
+  const segments = agentPath.split("/").filter(Boolean);
+  return segments[segments.length - 1] || agentPath;
+}
+function parseCodexSubAgentActivity(payload) {
+  if (!payload || payload.type !== CODEX_SUB_AGENT_ACTIVITY_TYPE) return null;
+  const { event_id: callId, agent_thread_id: agentThreadId } = payload;
+  if (typeof callId !== "string" || !callId) return null;
+  if (typeof agentThreadId !== "string" || !agentThreadId) return null;
+  return {
+    callId,
+    agentThreadId,
+    ...typeof payload.agent_path === "string" ? { agentPath: payload.agent_path } : {},
+    ...typeof payload.kind === "string" ? { kind: payload.kind } : {}
+  };
+}
 function codexSpawnDescription(nickname, agentType, prompt) {
   if (nickname) return agentType ? `${nickname} (${agentType})` : nickname;
   const firstLine = prompt.split("\n", 1)[0]?.trim() || "";
@@ -17714,6 +17739,15 @@ function parseCallLines(text, exec2, patch, spawns, mcps) {
           target.nickname = parsed.nickname;
         }
       }
+    } else {
+      const activity = parseCodexSubAgentActivity(p);
+      if (activity) {
+        const target = spawns.find((s) => s.callId === activity.callId && !s.agentId);
+        if (target) {
+          target.agentId = activity.agentThreadId;
+          if (activity.agentPath) target.agentPath = activity.agentPath;
+        }
+      }
     }
   }
 }
@@ -18428,7 +18462,14 @@ var en_default2 = {
     help: "Help",
     updateAvailable: "v{{version}} available",
     copyUpgradeCommand: "Copy cockpit update",
+    updateNow: "Update now",
+    updating: "Updating\u2026",
+    updateComplete: "Update complete",
+    updateFailed: "Update failed: {{reason}}",
+    updateRestartNote: "Cockpit will restart in the background.",
     viewChangelog: "View changelog",
+    serverRestarted: "Cockpit was updated in the background.",
+    reloadNow: "Reload",
     upgradeCommandCopied: "Copied `cockpit update`",
     projectNotes: "Project Notes",
     closeProject: "Close project"
@@ -18456,6 +18497,7 @@ var en_default2 = {
     projectSessions: "Project Sessions",
     browseAllSessions: "Browse all sessions",
     sessionList: "Session List",
+    search: "Search",
     searchSessions: "Search sessions...",
     searchRecentSessions: "Search recent sessions",
     loadSessionsFailed: "Failed to load sessions",
@@ -19198,7 +19240,9 @@ var en_default2 = {
   },
   imagePreview: {
     previewImage: "Preview image",
-    deleteImage: "Delete image"
+    deleteImage: "Delete image",
+    copyImage: "Copy image",
+    copiedImage: "Image copied"
   },
   tokenStats: {
     title: "Claude Code Token Stats",
@@ -19631,7 +19675,14 @@ var zh_default = {
     help: "\u5E2E\u52A9",
     updateAvailable: "\u65B0\u7248\u672C v{{version}} \u53EF\u7528",
     copyUpgradeCommand: "\u590D\u5236 cockpit update",
+    updateNow: "\u7ACB\u5373\u66F4\u65B0",
+    updating: "\u6B63\u5728\u66F4\u65B0\u2026",
+    updateComplete: "\u66F4\u65B0\u5B8C\u6210",
+    updateFailed: "\u66F4\u65B0\u5931\u8D25\uFF1A{{reason}}",
+    updateRestartNote: "Cockpit \u5C06\u5728\u540E\u53F0\u91CD\u542F\u3002",
     viewChangelog: "\u67E5\u770B\u53D8\u66F4\u65E5\u5FD7",
+    serverRestarted: "Cockpit \u5DF2\u5728\u540E\u53F0\u66F4\u65B0\u3002",
+    reloadNow: "\u5237\u65B0",
     upgradeCommandCopied: "\u5DF2\u590D\u5236 `cockpit update`",
     projectNotes: "\u9879\u76EE\u7B14\u8BB0",
     closeProject: "\u5173\u95ED\u9879\u76EE"
@@ -19659,6 +19710,7 @@ var zh_default = {
     projectSessions: "\u9879\u76EE\u4F1A\u8BDD",
     browseAllSessions: "\u6D4F\u89C8\u6240\u6709\u4F1A\u8BDD",
     sessionList: "\u4F1A\u8BDD\u5217\u8868",
+    search: "\u641C\u7D22",
     searchSessions: "\u641C\u7D22\u4F1A\u8BDD...",
     searchRecentSessions: "\u641C\u7D22\u6700\u8FD1\u4F1A\u8BDD",
     loadSessionsFailed: "\u52A0\u8F7D\u4F1A\u8BDD\u5931\u8D25",
@@ -20401,7 +20453,9 @@ var zh_default = {
   },
   imagePreview: {
     previewImage: "\u9884\u89C8\u56FE\u7247",
-    deleteImage: "\u5220\u9664\u56FE\u7247"
+    deleteImage: "\u5220\u9664\u56FE\u7247",
+    copyImage: "\u590D\u5236\u56FE\u7247",
+    copiedImage: "\u5DF2\u590D\u5236\u56FE\u7247"
   },
   tokenStats: {
     title: "Claude Code Token \u7EDF\u8BA1",

package/dist/{server-2UJDVZ32.mjs → server-CQXVJT3F.mjs}

@@ -46,12 +46,12 @@ import {
   unregisterTerminal,
   updateBrowserWs,
   writeStdinToCommand
-} from "./chunk-CLPJYIFC.mjs";
+} from "./chunk-AI7T3EXM.mjs";
 import {
   createNeo4jDriver,
   runCypherWithDriver,
   serializeValue
-} from "./chunk-TU3GL2HK.mjs";
+} from "./chunk-ZCMAJV2M.mjs";
 import "./chunk-7P6ASYW6.mjs";
 export {
   INTERRUPTED_EXIT_CODE,