@taewooopark/agent-blackbox 0.46.1 → 0.46.3

package/dist/agent-blackbox.plugin.mjs

@@ -1064,7 +1064,10 @@ function createOpenCodeEventFactory(options) {
     const current = typeof output.output === "string" ? output.output : "";
     if (!current)
       return;
-    const key = `${readString2(input, "sessionID") ?? "s"}::${path}`;
+    const args = input.args && typeof input.args === "object" ? input.args : {};
+    const offset = typeof args.offset === "number" ? args.offset : "";
+    const limit = typeof args.limit === "number" ? args.limit : "";
+    const key = `${readString2(input, "sessionID") ?? "s"}::${path}::${offset}:${limit}`;
     const hash = hashContent(current);
     const decision = decideReadServe(readCache.get(key), { hash, content: current }, compactionGen, path);
     readCache.set(key, { hash, content: current, gen: compactionGen });

package/dist/cli.js

@@ -1858,6 +1858,13 @@ async function handleRequest(request, response, eventsFile, clients, suggestConf
       sendEmpty(response, 204);
       return;
     }
+    if (request.method === "POST" || url.pathname === "/suggest") {
+      const origin = request.headers.origin;
+      if (typeof origin === "string" && !isLoopbackOrigin(origin)) {
+        sendJson(response, 403, { ok: false, error: { message: "cross-site request blocked" } });
+        return;
+      }
+    }
     const replay = parseReplayQuery(url);
     if (request.method === "GET" && url.pathname === "/health") {
       sendJson(response, 200, { ok: true, data: { status: "ok", eventsFile } });
@@ -2351,7 +2358,10 @@ function openInBrowser(url) {
   const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args2 = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    spawn2(command, args2, { stdio: "ignore", detached: true }).unref();
+    const child = spawn2(command, args2, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
   } catch {
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taewooopark/agent-blackbox",
-  "version": "0.46.1",
+  "version": "0.46.3",
   "description": "Local-first flight recorder + context-efficiency profiler for coding agents (OpenCode). Run with npx.",
   "type": "module",
   "license": "MIT",