@todoforai/edge 0.13.10 → 0.13.12

package/dist/index.js

@@ -47927,7 +47927,6 @@ function credentialsPath() {
   return path.join(xdg, "todoforai", "credentials.json");
 }
 var CREDENTIALS_PATH = credentialsPath();
-var LEGACY_CREDENTIALS_PATH = path.join(os.homedir(), ".todoforai", "credentials.json");
 function readFileMap(p) {
   try {
     return JSON.parse(fs.readFileSync(p, "utf-8"));
@@ -47935,9 +47934,6 @@ function readFileMap(p) {
     return {};
   }
 }
-function readCredentials() {
-  return { ...readFileMap(LEGACY_CREDENTIALS_PATH), ...readFileMap(CREDENTIALS_PATH) };
-}
 function writeNewFile(creds) {
   const dir = path.dirname(CREDENTIALS_PATH);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
@@ -47947,7 +47943,7 @@ function writeNewFile(creds) {
   } catch {}
 }
 function loadSavedApiKey(apiUrl) {
-  return readCredentials()[apiUrl] || null;
+  return readFileMap(CREDENTIALS_PATH)[apiUrl] || null;
 }
 function saveApiKey(apiUrl, apiKey) {
   const creds = readFileMap(CREDENTIALS_PATH);
@@ -47960,13 +47956,6 @@ function clearApiKey(apiUrl) {
     delete creds[apiUrl];
     writeNewFile(creds);
   }
-  const legacy = readFileMap(LEGACY_CREDENTIALS_PATH);
-  if (apiUrl in legacy) {
-    delete legacy[apiUrl];
-    try {
-      fs.writeFileSync(LEGACY_CREDENTIALS_PATH, JSON.stringify(legacy, null, 2), { mode: 384 });
-    } catch {}
-  }
 }
 
 // node_modules/ws/wrapper.mjs
@@ -48940,7 +48929,7 @@ var tool_catalog_default = {
     pkg: "netlify-cli",
     installer: "npm",
     label: "Netlify",
-    statusCmd: `test -f ~/.netlify/config.json && netlify api getCurrentUser 2>&1 | grep -oP '"email":\\s*"\\K[^"]+' | head -1`,
+    statusCmd: `netlify api getCurrentUser 2>&1 | grep -oP '"email":\\s*"\\K[^"]+' | head -1`,
     loginCmd: "netlify login",
     credentialPaths: [
       "~/.netlify/config.json"
@@ -48954,7 +48943,7 @@ var tool_catalog_default = {
     pkg: "firebase-tools",
     installer: "npm",
     label: "Firebase",
-    statusCmd: "test -f ~/.config/configstore/firebase-tools.json && firebase login:list 2>&1 | grep '@'",
+    statusCmd: "firebase login:list 2>&1 | grep '@'",
     loginCmd: "firebase login",
     credentialPaths: [
       "~/.config/configstore/firebase-tools.json"
@@ -48968,7 +48957,7 @@ var tool_catalog_default = {
     pkg: "wrangler",
     installer: "npm",
     label: "Cloudflare",
-    statusCmd: "test -f ~/.config/.wrangler/config/default.toml && wrangler whoami 2>&1 | grep -v 'Failed' | grep '@'",
+    statusCmd: "wrangler whoami 2>&1 | grep -v 'Failed' | grep '@'",
     loginCmd: "wrangler login",
     credentialPaths: [
       "~/.config/.wrangler/config/default.toml"
@@ -49010,7 +48999,7 @@ var tool_catalog_default = {
     pkg: "supabase",
     installer: "binary",
     label: "Supabase",
-    statusCmd: "test -f ~/.config/supabase/access-token && echo 'authenticated'",
+    statusCmd: "supabase projects list >/dev/null 2>&1 && echo authenticated",
     loginCmd: "supabase login",
     credentialPaths: [
       "~/.config/supabase/access-token"
@@ -49024,7 +49013,7 @@ var tool_catalog_default = {
     pkg: "@railway/cli",
     installer: "npm",
     label: "Railway",
-    statusCmd: "test -f ~/.railway/config.json && railway whoami 2>&1 | grep -v 'Unauthorized'",
+    statusCmd: "railway whoami 2>&1 | grep -v 'Unauthorized'",
     loginCmd: "railway login",
     credentialPaths: [
       "~/.railway/config.json"
@@ -49061,7 +49050,7 @@ var tool_catalog_default = {
     pkg: "@sentry/cli",
     installer: "npm",
     label: "Sentry",
-    statusCmd: "test -f ~/.sentryclirc && echo 'authenticated'",
+    statusCmd: "sentry-cli info 2>&1 | grep -q 'Authentication Info' && echo authenticated",
     loginCmd: "sentry-cli login",
     credentialPaths: [
       "~/.sentryclirc"
@@ -49077,7 +49066,7 @@ var tool_catalog_default = {
     label: "TODOforAI",
     capabilities: "Create & manage TODOs, run workflows, API access",
     description: "Use to programmatically create/list/update TODOs in TODOforAI, kick off workflows, call the platform API.",
-    statusCmd: "todoai --help >/dev/null 2>&1",
+    statusCmd: "todoai whoami >/dev/null 2>&1",
     installCmd: "bun add -g @todoforai/cli",
     versionCmd: "todoai --version 2>/dev/null | head -1",
     internal: true
@@ -49087,7 +49076,6 @@ var tool_catalog_default = {
     pkg: "newman",
     installer: "npm",
     label: "Postman",
-    statusCmd: "newman --version",
     capabilities: "Run API test collections, CI/CD integration, HTML reports",
     description: "Use to run Postman collections from CLI (API smoke tests, CI checks). `newman run <collection.json> -e <env.json>`.",
     versionCmd: "newman --version 2>/dev/null | head -1"
@@ -49098,7 +49086,6 @@ var tool_catalog_default = {
     installer: "system",
     label: "Web Request",
     binName: "curl",
-    statusCmd: "curl --version >/dev/null 2>&1",
     capabilities: "HTTP/HTTPS/FTP client: GET/POST/PUT/DELETE, headers, auth, file upload/download, follow redirects, cookies, TLS.",
     description: "Default tool for any HTTP request: hitting REST APIs, downloading files, testing endpoints. Common flags: `-s` silent, `-L` follow redirects, `-H 'Header: ...'`, `-X POST -d '...'`, `-o file`, `-f` fail on HTTP errors. Pipe into `jq` for JSON.",
     versionCmd: "curl --version 2>/dev/null | head -1",
@@ -49110,7 +49097,6 @@ var tool_catalog_default = {
     pkg: "cloudflared",
     installer: "binary",
     label: "Tunnel",
-    statusCmd: "cloudflared --version",
     capabilities: "Tunnel to localhost, expose local services, zero-trust access",
     description: "Use to expose a local port to the public internet via a Cloudflare tunnel. Quick: `cloudflared tunnel --url http://localhost:<port>` prints a public https URL.",
     versionCmd: "cloudflared --version 2>/dev/null | head -1"
@@ -49121,13 +49107,13 @@ var tool_catalog_default = {
     installer: "binary",
     preinstallCloud: true,
     label: "HashiCorp Vault",
-    statusCmd: "test -f ~/.vault-token && echo 'authenticated'",
+    statusCmd: "vault token lookup >/dev/null 2>&1 && echo authenticated",
     loginCmd: "vault login",
     credentialPaths: [
       "~/.vault-token"
     ],
     capabilities: "Secrets management, dynamic credentials",
-    description: "HashiCorp Vault CLI for Terraform/vals/ecosystem integrations. For day-to-day secret read/write in TODOforAI, prefer `tfa-vault` (zero-config). Needs VAULT_ADDR + VAULT_TOKEN.",
+    description: "HashiCorp Vault CLI — only for Terraform/vals/ecosystem integrations that expect it. For all credential read/write tasks use `tfa-vault` instead. Needs VAULT_ADDR + VAULT_TOKEN.",
     versionCmd: "vault --version 2>/dev/null | head -1"
   },
   rclone: {
@@ -49136,16 +49122,17 @@ var tool_catalog_default = {
     installer: "system",
     preinstallCloud: true,
     label: "Cloud Sync",
-    statusCmd: "rclone listremotes 2>&1 | grep -v 'NOTICE' | head -5",
+    statusCmd: "rclone listremotes 2>&1 | grep -v 'NOTICE' | grep -q ':' && echo authenticated",
     loginCmd: "rclone config",
     credentialPaths: [
       "~/.config/rclone/rclone.conf"
     ],
     capabilities: "Access Google Drive, OneDrive, Dropbox, S3 and 40+ cloud providers. List, copy, sync, move, mount files as virtual filesystem (FUSE). Use 'rclone config create <name> <provider>' to connect (opens browser for OAuth).",
-    description: "Connect providers: rclone config create gdrive drive (Google Drive), rclone config create onedrive onedrive (OneDrive), rclone config create dropbox dropbox (Dropbox), rclone config create s3 s3 (Amazon S3). List remotes: rclone listremotes. List files: rclone ls remote:path. Copy: rclone copy source:path dest:path. Sync: rclone sync source:path dest:path. Mount as virtual filesystem (FUSE, no files downloaded until accessed): mkdir -p ~/.todoforai/mnt/<remote> && rclone mount <remote>: ~/.todoforai/mnt/<remote> --vfs-cache-mode full --vfs-fast-fingerprint --no-modtime --attr-timeout 1h --vfs-cache-max-size 400M --daemon --log-file=/tmp/rclone-<remote>.log --log-level INFO. Unmount: fusermount -u ~/.todoforai/mnt/<remote>. Check config: rclone config show.",
+    description: "Use to access cloud storage (Drive/OneDrive/Dropbox/S3/40+). Connect: `rclone config create <name> <provider>` (OAuth via browser). Core ops: `rclone listremotes`, `rclone ls <remote>:<path>`, `rclone copy|sync <src> <dst>`. Mount as FUSE (lazy fetch): `rclone mount <remote>: ~/.todoforai/mnt/<remote> --vfs-cache-mode full --daemon`; unmount with `fusermount -u <path>`. See `subProviders` for per-provider connect commands.",
     subProviders: {
       gdrive: {
         label: "Google Drive",
+        authType: "oauth",
         connectCmd: "rclone config create {{REMOTE}} drive",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "gdrive",
@@ -49154,6 +49141,7 @@ var tool_catalog_default = {
       },
       onedrive: {
         label: "OneDrive",
+        authType: "oauth",
         connectCmd: "rclone config create {{REMOTE}} onedrive",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "onedrive",
@@ -49162,6 +49150,7 @@ var tool_catalog_default = {
       },
       dropbox: {
         label: "Dropbox",
+        authType: "oauth",
         connectCmd: "rclone config create {{REMOTE}} dropbox",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "dropbox",
@@ -49170,6 +49159,7 @@ var tool_catalog_default = {
       },
       s3: {
         label: "Amazon S3",
+        authType: "credentials",
         connectCmd: "rclone config create {{REMOTE}} s3",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "s3",
@@ -49183,7 +49173,6 @@ var tool_catalog_default = {
     pkg: "pymupdf",
     installer: "pip",
     label: "PDF",
-    statusCmd: "python3 -c 'import pymupdf' 2>/dev/null || /usr/bin/python3 -c 'import pymupdf' 2>/dev/null",
     capabilities: "PDF text editing, extraction, merge, split",
     description: "Use to programmatically read/edit/merge/split PDFs (text + positions). Call from `python3 -c`. Extract text: `pymupdf.open(p)[i].get_text()`; with bbox/font: `.get_text('dict')`. Replace text in place: `page.add_redact_annot(page.search_for('old')[0], text='new'); page.apply_redactions(); doc.save(out)`. For PDF → markdown prefer `firecrawl parse`.",
     versionCmd: "python3 -c 'import pymupdf; print(pymupdf.__version__)' 2>/dev/null",
@@ -49195,9 +49184,8 @@ var tool_catalog_default = {
     installer: "npm",
     preinstallCloud: true,
     label: "Browser",
-    statusCmd: "agent-browser --version",
     capabilities: "Headless browser automation, web scraping, accessibility tree snapshots, screenshots, PDF generation",
-    description: "Use when a task needs a real browser: JS-rendered pages, logged-in flows, clicking/filling forms, screenshots, PDF export. Prefer `curl` for plain HTTP and `firecrawl` for bulk scrape/crawl. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with @refs — use these for clicking), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>.",
+    description: "Headless browser for JS-rendered pages, automated flows, screenshots, PDF export. **Default browser choice** — use this unless the user's own session/cookies are required (then use `todoforai-browser`). Prefer `curl` for plain HTTP, `firecrawl` for bulk scrape/crawl. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with @refs — use these for clicking), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>.",
     versionCmd: "agent-browser --version 2>/dev/null | head -1"
   },
   firecrawl: {
@@ -49220,7 +49208,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "Browser (Extension)",
     capabilities: "Browser automation via extension (non-headless), web scraping, accessibility tree snapshots, screenshots, PDF generation",
-    description: "Browser automation via the TODO for AI browser extension (non-headless, uses your real browser). Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with refs), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>. Use snapshot to get semantic page structure with @refs for clicking. Supports drag/drop, file uploads, form interactions.",
+    description: "Drives the user's real browser via the TODOforAI extension (non-headless). Use when the task needs the user's actual session — logged-in accounts, saved cookies, extensions, MFA. For anything else prefer headless `agent-browser`. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with @refs for clicking), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>. Supports drag/drop, file uploads, form interactions.",
     versionCmd: `node -p "require(require('child_process').execSync('which todoforai-browser',{encoding:'utf8'}).trim().replace(/\\/dist\\/index\\.js$/, '/package.json')).version" 2>/dev/null`,
     internal: true
   },
@@ -49254,6 +49242,7 @@ var tool_catalog_default = {
     capabilities: "Explore a codebase as a real TODO: read-only agent maps structure, surfaces relevant files, streams findings to terminal",
     description: 'Codebase exploration as a real TODO with patched permissions (read/grep/bash only) and live streaming. Usage: `tfa-explore [--repo <path>] "<question>"`. Creates a TODO visible in the UI and streams block events to stdout until DONE.',
     versionCmd: "tfa-explore --version 2>/dev/null | head -1",
+    statusCmd: "tfa-explore whoami",
     installCmd: "bun add -g @todoforai/tfa-explore",
     preinstall: true,
     preinstallCloud: true,
@@ -49267,6 +49256,7 @@ var tool_catalog_default = {
     capabilities: "Review a git diff as a real TODO: read-only agent assesses goal, finds issues, suggests simpler approaches",
     description: 'Capture `git diff` and ask a read-only sub-agent to review it as a real TODO. Usage: `tfa-review [--repo <path>] [--against <ref>] "<goal>"`. Default diffs uncommitted changes vs HEAD. Streams block events to stdout until DONE.',
     versionCmd: "tfa-review --version 2>/dev/null | head -1",
+    statusCmd: "tfa-review whoami",
     installCmd: "bun add -g @todoforai/tfa-review",
     preinstall: true,
     preinstallCloud: true,
@@ -49280,6 +49270,7 @@ var tool_catalog_default = {
     capabilities: "Summarize files or piped input as a real TODO with no-tools sub-agent",
     description: 'Summarize file contents or stdin as a real TODO. Usage: `tfa-summary [-f <file>]... [<files...>] [<focus>]` or `cat x | tfa-summary "focus"`. No tools (content is inlined); streams block events to stdout until DONE.',
     versionCmd: "tfa-summary --version 2>/dev/null | head -1",
+    statusCmd: "tfa-summary whoami",
     installCmd: "bun add -g @todoforai/tfa-summary",
     internal: true
   },
@@ -49289,13 +49280,12 @@ var tool_catalog_default = {
     installer: "npm",
     label: "Vault",
     capabilities: "Zero-config TODOforAI vault CLI: put/get/patch/list/rm secrets in the user's KV v2 vault. Reuses bridge credentials (TODOFORAI_API_KEY / ~/.config/todoforai/credentials.json); derives vault URL from backend URL.",
-    description: 'Read & write secrets in the user\'s TODOforAI vault — no VAULT_ADDR, no VAULT_TOKEN, no `vault login` needed. Usage: `tfa-vault put <path> k=v [k=v ...]`, `tfa-vault get [-f <field>] <path>`, `tfa-vault patch <path> k=v ...`, `tfa-vault list [<prefix>]`, `tfa-vault rm <path>`. Values: inline (`k=v`), file (`k=@/path`), stdin (`k=-`). `get -f <field>` writes raw value with no trailing newline — safe in `$(...)`. Exit 2 means "not found" (distinct from network errors). Prefer this over the HashiCorp `vault` CLI for daily use; `vault` remains supported for Terraform/vals/ecosystem tools.',
+    description: 'Native TODOforAI secret store — free, zero-config (reuses bridge credentials; no VAULT_ADDR/VAULT_TOKEN/login). **Default credential source: for any task touching API keys, tokens, service accounts, or third-party auth, check `tfa-vault` before searching repo files, .env, or env vars — unless the user provides another source.** Discover-then-consume pattern: `tfa-vault list accounts/` to find keys, then `KEY=$(tfa-vault get -f api_key accounts/<service>)` in shell. Common paths: `accounts/<service>`, `api/<service>`, `secrets/<service>`. Usage: `tfa-vault put <path> k=v [k=v ...]`, `tfa-vault get [-f <field>] <path>`, `tfa-vault patch <path> k=v ...`, `tfa-vault list [<prefix>]`, `tfa-vault rm <path>`. Values: inline (`k=v`), file (`k=@/path`), stdin (`k=-`). `get -f <field>` writes raw value with no trailing newline — safe in `$(...)`. Exit 2 means "not found" (distinct from network errors).',
     versionCmd: "tfa-vault --version 2>/dev/null | head -1",
     statusCmd: "tfa-vault whoami",
     installCmd: "bun add -g @todoforai/vault",
     preinstall: true,
-    preinstallCloud: true,
-    internal: true
+    preinstallCloud: true
   },
   ripgrep: {
     category: "development",
@@ -49531,17 +49521,6 @@ function isToolInstalled(name) {
   }
   return whichWithTools(name) !== null;
 }
-function findReferencedTools(content) {
-  const stripped = content.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
-  return Object.keys(TOOL_CATALOG).filter((name) => {
-    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const re = new RegExp(String.raw`(?:^|[|;&\n]|&&|\|\||` + String.raw`\$\(|` + "`" + String.raw`|xargs\s+|sudo\s+|env\s+)\s*` + esc + String.raw`\b(?!-)`, "m");
-    return re.test(stripped);
-  });
-}
-function findMissingTools(content) {
-  return findReferencedTools(content).filter((name) => !isToolInstalled(name));
-}
 async function installBinary(name) {
   const urlFunc = BINARY_URL_FUNCS[name];
   if (!urlFunc) {
@@ -51592,7 +51571,6 @@ ${this.lastPart}`;
 var processes = new Map;
 var outputBuffers = new Map;
 var completionResolvers = new Map;
-var pendingToolApprovals = new Map;
 var exitedOutputByPid = new Map;
 async function executeBlock(blockId, content, send, todoId, messageId, timeout, cwd, manual = false, runMode, edgeId, agentSettingsId = "", keepAliveOnTimeout = false) {
   if (processes.has(blockId)) {
@@ -51611,38 +51589,6 @@ async function executeBlock(blockId, content, send, todoId, messageId, timeout,
     } else {
       cwd = tmpDir;
     }
-    const missing = findMissingTools(content);
-    if (missing.length && !pendingToolApprovals.has(blockId)) {
-      pendingToolApprovals.set(blockId, missing);
-      console.log(`[shell] Missing tools ${missing}, requesting approval for block ${blockId}`);
-      await send({
-        type: "BLOCK_UPDATE",
-        payload: {
-          todoId,
-          blockId,
-          messageId,
-          updates: {
-            status: "AWAITING_APPROVAL",
-            approvalContext: { source: "edge", toolInstalls: missing, workspace: cwd, edgeId }
-          }
-        }
-      });
-      return;
-    }
-    if (pendingToolApprovals.has(blockId)) {
-      const tools = pendingToolApprovals.get(blockId);
-      pendingToolApprovals.delete(blockId);
-      const installed = [];
-      for (const t of tools) {
-        if (await ensureTool(t))
-          installed.push(t);
-      }
-      if (installed.length) {
-        const notice = `[installed: ${installed.join(", ")}]
-`;
-        await send(msg.shellBlockResult(todoId, blockId, notice, messageId));
-      }
-    }
     await send({
       type: "BLOCK_UPDATE",
       payload: { todoId, blockId, messageId, updates: { status: "RUNNING" } }
@@ -51931,20 +51877,13 @@ var MAX_DIRS_PER_ROOT = 2000;
 var FRONTMATTER_BYTES = 8 * 1024;
 var MAX_NAME_LEN = 64;
 var MAX_DESC_LEN = 1024;
-function shortestPath(filePath, relTo) {
-  const rel = path6.relative(relTo, filePath);
-  const home = os7.homedir();
-  const homeRel = filePath.startsWith(home + path6.sep) ? "~" + filePath.slice(home.length) : filePath;
-  return [rel, homeRel, filePath].reduce((a, b) => b.length < a.length ? b : a);
-}
 async function discoverSkills(rootPaths, opts = {}) {
   const includeUserScope = opts.includeUserScope ?? true;
   const roots = [
-    ...rootPaths.map((p10) => ({ path: path6.join(p10, ".agents", "skills"), relTo: p10, scope: "repo" }))
+    ...rootPaths.map((p10) => ({ path: path6.join(p10, ".agents", "skills"), scope: "repo" }))
   ];
   if (includeUserScope) {
-    const home = os7.homedir();
-    roots.push({ path: path6.join(home, ".agents", "skills"), relTo: home, scope: "user" });
+    roots.push({ path: path6.join(os7.homedir(), ".agents", "skills"), scope: "user" });
   }
   const skills = [];
   const errors = [];
@@ -51962,11 +51901,11 @@ async function discoverSkills(rootPaths, opts = {}) {
     }
     if (!stat.isDirectory())
       continue;
-    walkRoot(root.path, root.relTo, root.scope, skills, errors, seenSkillPaths);
+    walkRoot(root.path, root.scope, skills, errors, seenSkillPaths);
   }
   return { skills, errors };
 }
-function walkRoot(root, relTo, scope, skills, errors, seen) {
+function walkRoot(root, scope, skills, errors, seen) {
   const queue = [{ dir: root, depth: 0 }];
   let dirsVisited = 0;
   for (let i10 = 0;i10 < queue.length; i10++) {
@@ -52002,14 +51941,14 @@ function walkRoot(root, relTo, scope, skills, errors, seen) {
         if (seen.has(full))
           continue;
         seen.add(full);
-        const skill = parseSkillFile(full, relTo, scope, errors);
+        const skill = parseSkillFile(full, scope, errors);
         if (skill)
           skills.push(skill);
       }
     }
   }
 }
-function parseSkillFile(filePath, relTo, scope, errors) {
+function parseSkillFile(filePath, scope, errors) {
   let head;
   try {
     const fd3 = fs9.openSync(filePath, "r");
@@ -52042,7 +51981,7 @@ function parseSkillFile(filePath, relTo, scope, errors) {
     name,
     description,
     shortDescription: shortDescription && shortDescription.length <= MAX_DESC_LEN ? shortDescription : undefined,
-    path: shortestPath(filePath, relTo),
+    path: filePath,
     scope
   };
 }
@@ -52372,9 +52311,6 @@ register("execute_shell_command", async (args, client) => {
   try {
     await send(msg.shellBlockStart(todoId, blockId, "execute", messageId));
     await executeBlock(blockId, execCmd, send, todoId, messageId, timeout, cwd, false, "internal", undefined, agentSettingsId, true);
-    if (pendingToolApprovals.has(blockId)) {
-      return { __awaiting_approval__: true };
-    }
     await waitForCompletion(blockId, (timeout + 5) * 1000);
     const rawOutput = getBlockRawOutput(blockId);
     let output = rawOutput ?? getBlockOutput(blockId);
@@ -52686,8 +52622,6 @@ async function handleFunctionCall(payload, send, client) {
       throw new Error(`Unknown function: ${functionName}. Available: ${available.join(", ")}`);
     }
     const result = await fn2(args, client);
-    if (result && result.__awaiting_approval__)
-      return;
     await send(makeSuccess(result));
   } catch (e) {
     log3("error", `Function call '${functionName}' failed:`, e.message);
@@ -53186,22 +53120,82 @@ class ServerError extends Error {
   }
 }
 
+// node_modules/@todoforai/update-notifier/src/index.ts
+import fs12 from "node:fs";
+import path9 from "node:path";
+import os9 from "node:os";
+function isLinkedInstall() {
+  try {
+    return !fs12.realpathSync(process.argv[1] || "").includes(`${path9.sep}node_modules${path9.sep}`);
+  } catch {
+    return false;
+  }
+}
+var TTL_MS = 24 * 60 * 60 * 1000;
+var CACHE_DIR = path9.join(os9.homedir(), ".config", "todoforai");
+function cmpVer(a, b) {
+  const pa2 = a.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
+  const pb2 = b.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i10 = 0;i10 < Math.max(pa2.length, pb2.length); i10++) {
+    const d = (pa2[i10] ?? 0) - (pb2[i10] ?? 0);
+    if (d)
+      return d;
+  }
+  return 0;
+}
+function checkForUpdates(pkg) {
+  if (!process.stderr.isTTY || process.env.CI || process.env.NO_UPDATE_NOTIFIER || isLinkedInstall())
+    return;
+  const cacheFile = path9.join(CACHE_DIR, `notifier-${encodeURIComponent(pkg.name)}.json`);
+  let cache = {};
+  try {
+    cache = JSON.parse(fs12.readFileSync(cacheFile, "utf8"));
+  } catch {}
+  if (cache.latest && cmpVer(cache.latest, pkg.version) > 0) {
+    process.stderr.write(`
+\x1B[33m  Update available: \x1B[2m${pkg.version}\x1B[22m → \x1B[1m${cache.latest}\x1B[0m
+` + `\x1B[33m  Run:\x1B[0m npm i -g ${pkg.name}
+
+`);
+  }
+  if (Date.now() - (cache.ts ?? 0) > TTL_MS) {
+    try {
+      fs12.mkdirSync(CACHE_DIR, { recursive: true });
+      fs12.writeFileSync(cacheFile, JSON.stringify({ ...cache, ts: Date.now() }));
+    } catch {}
+    fetch(`https://registry.npmjs.org/${pkg.name}/latest`, { signal: AbortSignal.timeout(3000) }).then((r) => r.ok ? r.json() : null).then((j) => {
+      if (!j?.version)
+        return;
+      fs12.writeFileSync(cacheFile, JSON.stringify({ ts: Date.now(), latest: j.version }));
+    }).catch(() => {});
+  }
+}
+
 // src/index.ts
-import fs12 from "fs";
-import path9 from "path";
-import os9 from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import fs13 from "fs";
+import path10 from "path";
+import os10 from "os";
 import crypto3 from "crypto";
+function readOwnPackage() {
+  try {
+    const pkgPath = path10.resolve(fileURLToPath2(import.meta.url), "../../package.json");
+    return JSON.parse(fs13.readFileSync(pkgPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
 function lockPath(apiUrl, userId) {
-  const dir = path9.join(os9.homedir(), ".todoforai");
-  fs12.mkdirSync(dir, { recursive: true });
+  const dir = path10.join(os10.homedir(), ".todoforai");
+  fs13.mkdirSync(dir, { recursive: true });
   const hash = crypto3.createHash("sha256").update(`${apiUrl}
 ${userId}`).digest("hex").slice(0, 12);
-  return path9.join(dir, `edge-${hash}.lock`);
+  return path10.join(dir, `edge-${hash}.lock`);
 }
 function isEdgeProcess(pid) {
   try {
     process.kill(pid, 0);
-    const cmdline = fs12.readFileSync(`/proc/${pid}/cmdline`, "utf-8");
+    const cmdline = fs13.readFileSync(`/proc/${pid}/cmdline`, "utf-8");
     return cmdline.includes("index.ts") || cmdline.includes("todoforai-edge");
   } catch {
     return false;
@@ -53209,7 +53203,7 @@ function isEdgeProcess(pid) {
 }
 function killExistingEdge(lp2) {
   try {
-    const pid = parseInt(fs12.readFileSync(lp2, "utf-8").trim(), 10);
+    const pid = parseInt(fs13.readFileSync(lp2, "utf-8").trim(), 10);
     if (!isNaN(pid) && isEdgeProcess(pid)) {
       console.log(`\x1B[33mKilling existing edge process (pid ${pid})...\x1B[0m`);
       process.kill(pid, "SIGTERM");
@@ -53232,7 +53226,7 @@ function killExistingEdge(lp2) {
 }
 function acquireLock(lp2, kill = false) {
   try {
-    const pid = parseInt(fs12.readFileSync(lp2, "utf-8").trim(), 10);
+    const pid = parseInt(fs13.readFileSync(lp2, "utf-8").trim(), 10);
     if (!isNaN(pid) && isEdgeProcess(pid)) {
       if (kill) {
         killExistingEdge(lp2);
@@ -53240,16 +53234,31 @@ function acquireLock(lp2, kill = false) {
         return false;
     }
   } catch {}
-  fs12.writeFileSync(lp2, String(process.pid));
+  fs13.writeFileSync(lp2, String(process.pid));
   return true;
 }
 function releaseLock(lp2) {
   try {
-    if (fs12.readFileSync(lp2, "utf-8").trim() === String(process.pid))
-      fs12.unlinkSync(lp2);
+    if (fs13.readFileSync(lp2, "utf-8").trim() === String(process.pid))
+      fs13.unlinkSync(lp2);
   } catch {}
 }
+var MIN_BUN_VERSION = "1.3.14";
+function cmpSemver(a, b) {
+  const pa2 = a.split(".").map(Number), pb2 = b.split(".").map(Number);
+  for (let i10 = 0;i10 < 3; i10++)
+    if ((pa2[i10] ?? 0) !== (pb2[i10] ?? 0))
+      return (pa2[i10] ?? 0) - (pb2[i10] ?? 0);
+  return 0;
+}
 async function main() {
+  if (typeof Bun !== "undefined" && cmpSemver(Bun.version, MIN_BUN_VERSION) < 0) {
+    console.error(`\x1B[31mBun ${Bun.version} is too old — WebSocket upgrade fails after fetch on the same host. Upgrade to >= ${MIN_BUN_VERSION} via \`bun upgrade\`.\x1B[0m`);
+    process.exit(1);
+  }
+  const ownPkg = readOwnPackage();
+  if (ownPkg)
+    checkForUpdates(ownPkg);
   const config = await loadConfig();
   if (config.debug) {
     console.log("[config]", { apiUrl: config.apiUrl, debug: config.debug, addWorkspacePath: config.addWorkspacePath });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@todoforai/edge",
-  "version": "0.13.10",
+  "version": "0.13.12",
   "type": "module",
   "bin": {
     "todoforai-edge": "dist/index.js"
@@ -16,14 +16,15 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
+    "@todoforai/update-notifier": "^0.1.0",
     "fflate": "^0.8.2",
     "ignore": "^7.0.5",
     "unpdf": "^1.4.0",
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@types/ws": "^8.5.12",
     "@types/node": "^22.0.0",
+    "@types/ws": "^8.5.12",
     "typescript": "^5.6.0"
   }
 }