@todoforai/edge 0.13.11 → 0.13.13

package/dist/index.js

@@ -47927,7 +47927,6 @@ function credentialsPath() {
   return path.join(xdg, "todoforai", "credentials.json");
 }
 var CREDENTIALS_PATH = credentialsPath();
-var LEGACY_CREDENTIALS_PATH = path.join(os.homedir(), ".todoforai", "credentials.json");
 function readFileMap(p) {
   try {
     return JSON.parse(fs.readFileSync(p, "utf-8"));
@@ -47935,9 +47934,6 @@ function readFileMap(p) {
     return {};
   }
 }
-function readCredentials() {
-  return { ...readFileMap(LEGACY_CREDENTIALS_PATH), ...readFileMap(CREDENTIALS_PATH) };
-}
 function writeNewFile(creds) {
   const dir = path.dirname(CREDENTIALS_PATH);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
@@ -47947,7 +47943,7 @@ function writeNewFile(creds) {
   } catch {}
 }
 function loadSavedApiKey(apiUrl) {
-  return readCredentials()[apiUrl] || null;
+  return readFileMap(CREDENTIALS_PATH)[apiUrl] || null;
 }
 function saveApiKey(apiUrl, apiKey) {
   const creds = readFileMap(CREDENTIALS_PATH);
@@ -47960,13 +47956,6 @@ function clearApiKey(apiUrl) {
     delete creds[apiUrl];
     writeNewFile(creds);
   }
-  const legacy = readFileMap(LEGACY_CREDENTIALS_PATH);
-  if (apiUrl in legacy) {
-    delete legacy[apiUrl];
-    try {
-      fs.writeFileSync(LEGACY_CREDENTIALS_PATH, JSON.stringify(legacy, null, 2), { mode: 384 });
-    } catch {}
-  }
 }
 
 // node_modules/ws/wrapper.mjs
@@ -48488,12 +48477,14 @@ var BRIDGE_PORT = parseInt(process.env.TODOFORAI_BROWSER_BRIDGE_PORT || "43127",
 var BRIDGE_EDGE_ID = "local-browser-bridge";
 var REQUEST_TIMEOUT_MS = 30000;
 var isOpen = (ws) => !!ws && ws.readyState === import_websocket.default.OPEN;
+var describeExt = (ext) => ext ? `${ext.build ?? "?"}@${ext.version ?? "?"} (${ext.browser ?? "?"})` : "unknown extension";
 
 class BrowserExtensionBridge {
   debug;
   server;
   wss;
   extensionWs = null;
+  extIdentity = null;
   pending = new Map;
   constructor(debug = false) {
     this.debug = debug;
@@ -48574,8 +48565,18 @@ class BrowserExtensionBridge {
       console.log("[browser-bridge:recv]", data.type);
     if (data.type === "hello") {
       const isTabChannel = data.role === "extension-tab" || data.role === "extension";
-      if (data.role === "extension-control")
+      if (data.role === "extension-control") {
+        const ident = describeExt(data.ext);
+        const prev = this.extensionWs;
+        if (isOpen(prev) && prev !== ws) {
+          console.log(`[browser-bridge] control taken over by ${ident} (was ${describeExt(this.extIdentity)})`);
+          prev.send(JSON.stringify({ type: "control_superseded", payload: { by: ident } }));
+        } else if (this.debug) {
+          console.log(`[browser-bridge] control acquired by ${ident}`);
+        }
         this.extensionWs = ws;
+        this.extIdentity = data.ext ?? null;
+      }
       if (data.role === "extension-control" || isTabChannel) {
         if (isOpen(ws))
           ws.send(JSON.stringify({ type: "connected_edge", payload: { edgeId: BRIDGE_EDGE_ID } }));
@@ -48628,8 +48629,12 @@ class BrowserExtensionBridge {
     }
   }
   handleClose(ws) {
-    if (this.extensionWs === ws)
+    if (this.extensionWs === ws) {
+      if (this.debug)
+        console.log(`[browser-bridge] control released by ${describeExt(this.extIdentity)}`);
       this.extensionWs = null;
+      this.extIdentity = null;
+    }
     for (const [requestId, pending] of this.pending) {
       if (pending.ws !== ws)
         continue;
@@ -48860,6 +48865,15 @@ var tool_catalog_default = {
     description: "Use to generate speech audio from text, clone voices, or list voices. Needs ELEVENLABS_API_KEY.",
     versionCmd: "elevenlabs-api --version 2>/dev/null | head -1"
   },
+  "codex-imagegen-api": {
+    category: "media",
+    pkg: "@todoforai/codex-imagegen-api",
+    installer: "npm",
+    label: "Image Gen",
+    capabilities: "AI image generation & editing via TODOFORAI backend (gpt-image)",
+    description: 'Use to generate or edit images. Subcommands: `codex-imagegen-api generate "<prompt>" -o out.png [--size 1024x1024] [--quality low|medium|high]` and `codex-imagegen-api edit "<instruction>" -i in.png -o out.png` (repeat `-i` for multiple reference images).',
+    versionCmd: "codex-imagegen-api --version 2>/dev/null | head -1"
+  },
   "suno-api": {
     category: "media",
     pkg: "@todoforai/suno-api",
@@ -48940,7 +48954,7 @@ var tool_catalog_default = {
     pkg: "netlify-cli",
     installer: "npm",
     label: "Netlify",
-    statusCmd: `test -f ~/.netlify/config.json && netlify api getCurrentUser 2>&1 | grep -oP '"email":\\s*"\\K[^"]+' | head -1`,
+    statusCmd: `netlify api getCurrentUser 2>&1 | grep -oP '"email":\\s*"\\K[^"]+' | head -1`,
     loginCmd: "netlify login",
     credentialPaths: [
       "~/.netlify/config.json"
@@ -48954,7 +48968,7 @@ var tool_catalog_default = {
     pkg: "firebase-tools",
     installer: "npm",
     label: "Firebase",
-    statusCmd: "test -f ~/.config/configstore/firebase-tools.json && firebase login:list 2>&1 | grep '@'",
+    statusCmd: "firebase login:list 2>&1 | grep '@'",
     loginCmd: "firebase login",
     credentialPaths: [
       "~/.config/configstore/firebase-tools.json"
@@ -48968,7 +48982,7 @@ var tool_catalog_default = {
     pkg: "wrangler",
     installer: "npm",
     label: "Cloudflare",
-    statusCmd: "test -f ~/.config/.wrangler/config/default.toml && wrangler whoami 2>&1 | grep -v 'Failed' | grep '@'",
+    statusCmd: "wrangler whoami 2>&1 | grep -v 'Failed' | grep '@'",
     loginCmd: "wrangler login",
     credentialPaths: [
       "~/.config/.wrangler/config/default.toml"
@@ -49010,7 +49024,7 @@ var tool_catalog_default = {
     pkg: "supabase",
     installer: "binary",
     label: "Supabase",
-    statusCmd: "test -f ~/.config/supabase/access-token && echo 'authenticated'",
+    statusCmd: "supabase projects list >/dev/null 2>&1 && echo authenticated",
     loginCmd: "supabase login",
     credentialPaths: [
       "~/.config/supabase/access-token"
@@ -49024,7 +49038,7 @@ var tool_catalog_default = {
     pkg: "@railway/cli",
     installer: "npm",
     label: "Railway",
-    statusCmd: "test -f ~/.railway/config.json && railway whoami 2>&1 | grep -v 'Unauthorized'",
+    statusCmd: "railway whoami 2>&1 | grep -v 'Unauthorized'",
     loginCmd: "railway login",
     credentialPaths: [
       "~/.railway/config.json"
@@ -49061,7 +49075,7 @@ var tool_catalog_default = {
     pkg: "@sentry/cli",
     installer: "npm",
     label: "Sentry",
-    statusCmd: "test -f ~/.sentryclirc && echo 'authenticated'",
+    statusCmd: "sentry-cli info 2>&1 | grep -q 'Authentication Info' && echo authenticated",
     loginCmd: "sentry-cli login",
     credentialPaths: [
       "~/.sentryclirc"
@@ -49077,7 +49091,7 @@ var tool_catalog_default = {
     label: "TODOforAI",
     capabilities: "Create & manage TODOs, run workflows, API access",
     description: "Use to programmatically create/list/update TODOs in TODOforAI, kick off workflows, call the platform API.",
-    statusCmd: "todoai --help >/dev/null 2>&1",
+    statusCmd: "todoai whoami >/dev/null 2>&1",
     installCmd: "bun add -g @todoforai/cli",
     versionCmd: "todoai --version 2>/dev/null | head -1",
     internal: true
@@ -49087,7 +49101,6 @@ var tool_catalog_default = {
     pkg: "newman",
     installer: "npm",
     label: "Postman",
-    statusCmd: "newman --version",
     capabilities: "Run API test collections, CI/CD integration, HTML reports",
     description: "Use to run Postman collections from CLI (API smoke tests, CI checks). `newman run <collection.json> -e <env.json>`.",
     versionCmd: "newman --version 2>/dev/null | head -1"
@@ -49098,7 +49111,6 @@ var tool_catalog_default = {
     installer: "system",
     label: "Web Request",
     binName: "curl",
-    statusCmd: "curl --version >/dev/null 2>&1",
     capabilities: "HTTP/HTTPS/FTP client: GET/POST/PUT/DELETE, headers, auth, file upload/download, follow redirects, cookies, TLS.",
     description: "Default tool for any HTTP request: hitting REST APIs, downloading files, testing endpoints. Common flags: `-s` silent, `-L` follow redirects, `-H 'Header: ...'`, `-X POST -d '...'`, `-o file`, `-f` fail on HTTP errors. Pipe into `jq` for JSON.",
     versionCmd: "curl --version 2>/dev/null | head -1",
@@ -49110,7 +49122,6 @@ var tool_catalog_default = {
     pkg: "cloudflared",
     installer: "binary",
     label: "Tunnel",
-    statusCmd: "cloudflared --version",
     capabilities: "Tunnel to localhost, expose local services, zero-trust access",
     description: "Use to expose a local port to the public internet via a Cloudflare tunnel. Quick: `cloudflared tunnel --url http://localhost:<port>` prints a public https URL.",
     versionCmd: "cloudflared --version 2>/dev/null | head -1"
@@ -49121,13 +49132,13 @@ var tool_catalog_default = {
     installer: "binary",
     preinstallCloud: true,
     label: "HashiCorp Vault",
-    statusCmd: "test -f ~/.vault-token && echo 'authenticated'",
+    statusCmd: "vault token lookup >/dev/null 2>&1 && echo authenticated",
     loginCmd: "vault login",
     credentialPaths: [
       "~/.vault-token"
     ],
     capabilities: "Secrets management, dynamic credentials",
-    description: "HashiCorp Vault CLI for Terraform/vals/ecosystem integrations. For day-to-day secret read/write in TODOforAI, prefer `tfa-vault` (zero-config). Needs VAULT_ADDR + VAULT_TOKEN.",
+    description: "HashiCorp Vault CLI — only for Terraform/vals/ecosystem integrations that expect it. For all credential read/write tasks use `tfa-vault` instead. Needs VAULT_ADDR + VAULT_TOKEN.",
     versionCmd: "vault --version 2>/dev/null | head -1"
   },
   rclone: {
@@ -49136,16 +49147,17 @@ var tool_catalog_default = {
     installer: "system",
     preinstallCloud: true,
     label: "Cloud Sync",
-    statusCmd: "rclone listremotes 2>&1 | grep -v 'NOTICE' | head -5",
+    statusCmd: "rclone listremotes 2>&1 | grep -v 'NOTICE' | grep -q ':' && echo authenticated",
     loginCmd: "rclone config",
     credentialPaths: [
       "~/.config/rclone/rclone.conf"
     ],
     capabilities: "Access Google Drive, OneDrive, Dropbox, S3 and 40+ cloud providers. List, copy, sync, move, mount files as virtual filesystem (FUSE). Use 'rclone config create <name> <provider>' to connect (opens browser for OAuth).",
-    description: "Connect providers: rclone config create gdrive drive (Google Drive), rclone config create onedrive onedrive (OneDrive), rclone config create dropbox dropbox (Dropbox), rclone config create s3 s3 (Amazon S3). List remotes: rclone listremotes. List files: rclone ls remote:path. Copy: rclone copy source:path dest:path. Sync: rclone sync source:path dest:path. Mount as virtual filesystem (FUSE, no files downloaded until accessed): mkdir -p ~/.todoforai/mnt/<remote> && rclone mount <remote>: ~/.todoforai/mnt/<remote> --vfs-cache-mode full --vfs-fast-fingerprint --no-modtime --attr-timeout 1h --vfs-cache-max-size 400M --daemon --log-file=/tmp/rclone-<remote>.log --log-level INFO. Unmount: fusermount -u ~/.todoforai/mnt/<remote>. Check config: rclone config show.",
+    description: "Use to access cloud storage (Drive/OneDrive/Dropbox/S3/40+). Connect: `rclone config create <name> <provider>` (OAuth via browser). Core ops: `rclone listremotes`, `rclone ls <remote>:<path>`, `rclone copy|sync <src> <dst>`. Mount as FUSE (lazy fetch): `rclone mount <remote>: ~/.todoforai/mnt/<remote> --vfs-cache-mode full --daemon`; unmount with `fusermount -u <path>`. See `subProviders` for per-provider connect commands.",
     subProviders: {
       gdrive: {
         label: "Google Drive",
+        authType: "oauth",
         connectCmd: "rclone config create {{REMOTE}} drive",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "gdrive",
@@ -49154,6 +49166,7 @@ var tool_catalog_default = {
       },
       onedrive: {
         label: "OneDrive",
+        authType: "oauth",
         connectCmd: "rclone config create {{REMOTE}} onedrive",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "onedrive",
@@ -49162,6 +49175,7 @@ var tool_catalog_default = {
       },
       dropbox: {
         label: "Dropbox",
+        authType: "oauth",
         connectCmd: "rclone config create {{REMOTE}} dropbox",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "dropbox",
@@ -49170,6 +49184,7 @@ var tool_catalog_default = {
       },
       s3: {
         label: "Amazon S3",
+        authType: "credentials",
         connectCmd: "rclone config create {{REMOTE}} s3",
         statusCmd: "rclone lsd {{REMOTE}}: 2>&1 | head -1",
         remoteName: "s3",
@@ -49183,7 +49198,6 @@ var tool_catalog_default = {
     pkg: "pymupdf",
     installer: "pip",
     label: "PDF",
-    statusCmd: "python3 -c 'import pymupdf' 2>/dev/null || /usr/bin/python3 -c 'import pymupdf' 2>/dev/null",
     capabilities: "PDF text editing, extraction, merge, split",
     description: "Use to programmatically read/edit/merge/split PDFs (text + positions). Call from `python3 -c`. Extract text: `pymupdf.open(p)[i].get_text()`; with bbox/font: `.get_text('dict')`. Replace text in place: `page.add_redact_annot(page.search_for('old')[0], text='new'); page.apply_redactions(); doc.save(out)`. For PDF → markdown prefer `firecrawl parse`.",
     versionCmd: "python3 -c 'import pymupdf; print(pymupdf.__version__)' 2>/dev/null",
@@ -49195,9 +49209,8 @@ var tool_catalog_default = {
     installer: "npm",
     preinstallCloud: true,
     label: "Browser",
-    statusCmd: "agent-browser --version",
     capabilities: "Headless browser automation, web scraping, accessibility tree snapshots, screenshots, PDF generation",
-    description: "Use when a task needs a real browser: JS-rendered pages, logged-in flows, clicking/filling forms, screenshots, PDF export. Prefer `curl` for plain HTTP and `firecrawl` for bulk scrape/crawl. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with @refs — use these for clicking), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>.",
+    description: "Headless browser for JS-rendered pages, automated flows, screenshots, PDF export. **Default browser choice** — use this unless the user's own session/cookies are required (then use `todoforai-browser`). Prefer `curl` for plain HTTP, `firecrawl` for bulk scrape/crawl. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with @refs — use these for clicking), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>.",
     versionCmd: "agent-browser --version 2>/dev/null | head -1"
   },
   firecrawl: {
@@ -49220,7 +49233,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "Browser (Extension)",
     capabilities: "Browser automation via extension (non-headless), web scraping, accessibility tree snapshots, screenshots, PDF generation",
-    description: "Browser automation via the TODO for AI browser extension (non-headless, uses your real browser). Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with refs), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>. Use snapshot to get semantic page structure with @refs for clicking. Supports drag/drop, file uploads, form interactions.",
+    description: "Drives the user's real browser via the TODOforAI extension (non-headless). Use when the task needs the user's actual session — logged-in accounts, saved cookies, extensions, MFA. For anything else prefer headless `agent-browser`. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with @refs for clicking), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>. Supports drag/drop, file uploads, form interactions.",
     versionCmd: `node -p "require(require('child_process').execSync('which todoforai-browser',{encoding:'utf8'}).trim().replace(/\\/dist\\/index\\.js$/, '/package.json')).version" 2>/dev/null`,
     internal: true
   },
@@ -49254,6 +49267,7 @@ var tool_catalog_default = {
     capabilities: "Explore a codebase as a real TODO: read-only agent maps structure, surfaces relevant files, streams findings to terminal",
     description: 'Codebase exploration as a real TODO with patched permissions (read/grep/bash only) and live streaming. Usage: `tfa-explore [--repo <path>] "<question>"`. Creates a TODO visible in the UI and streams block events to stdout until DONE.',
     versionCmd: "tfa-explore --version 2>/dev/null | head -1",
+    statusCmd: "tfa-explore whoami",
     installCmd: "bun add -g @todoforai/tfa-explore",
     preinstall: true,
     preinstallCloud: true,
@@ -49267,6 +49281,7 @@ var tool_catalog_default = {
     capabilities: "Review a git diff as a real TODO: read-only agent assesses goal, finds issues, suggests simpler approaches",
     description: 'Capture `git diff` and ask a read-only sub-agent to review it as a real TODO. Usage: `tfa-review [--repo <path>] [--against <ref>] "<goal>"`. Default diffs uncommitted changes vs HEAD. Streams block events to stdout until DONE.',
     versionCmd: "tfa-review --version 2>/dev/null | head -1",
+    statusCmd: "tfa-review whoami",
     installCmd: "bun add -g @todoforai/tfa-review",
     preinstall: true,
     preinstallCloud: true,
@@ -49280,6 +49295,7 @@ var tool_catalog_default = {
     capabilities: "Summarize files or piped input as a real TODO with no-tools sub-agent",
     description: 'Summarize file contents or stdin as a real TODO. Usage: `tfa-summary [-f <file>]... [<files...>] [<focus>]` or `cat x | tfa-summary "focus"`. No tools (content is inlined); streams block events to stdout until DONE.',
     versionCmd: "tfa-summary --version 2>/dev/null | head -1",
+    statusCmd: "tfa-summary whoami",
     installCmd: "bun add -g @todoforai/tfa-summary",
     internal: true
   },
@@ -49289,13 +49305,12 @@ var tool_catalog_default = {
     installer: "npm",
     label: "Vault",
     capabilities: "Zero-config TODOforAI vault CLI: put/get/patch/list/rm secrets in the user's KV v2 vault. Reuses bridge credentials (TODOFORAI_API_KEY / ~/.config/todoforai/credentials.json); derives vault URL from backend URL.",
-    description: 'Read & write secrets in the user\'s TODOforAI vault — no VAULT_ADDR, no VAULT_TOKEN, no `vault login` needed. Usage: `tfa-vault put <path> k=v [k=v ...]`, `tfa-vault get [-f <field>] <path>`, `tfa-vault patch <path> k=v ...`, `tfa-vault list [<prefix>]`, `tfa-vault rm <path>`. Values: inline (`k=v`), file (`k=@/path`), stdin (`k=-`). `get -f <field>` writes raw value with no trailing newline — safe in `$(...)`. Exit 2 means "not found" (distinct from network errors). Prefer this over the HashiCorp `vault` CLI for daily use; `vault` remains supported for Terraform/vals/ecosystem tools.',
+    description: 'Native TODOforAI secret store — free, zero-config (reuses bridge credentials; no VAULT_ADDR/VAULT_TOKEN/login). **Default credential source: for any task touching API keys, tokens, service accounts, or third-party auth, check `tfa-vault` before searching repo files, .env, or env vars — unless the user provides another source.** Discover-then-consume pattern: `tfa-vault list accounts/` to find keys, then `KEY=$(tfa-vault get -f api_key accounts/<service>)` in shell. Common paths: `accounts/<service>`, `api/<service>`, `secrets/<service>`. Usage: `tfa-vault put <path> k=v [k=v ...]`, `tfa-vault get [-f <field>] <path>`, `tfa-vault patch <path> k=v ...`, `tfa-vault list [<prefix>]`, `tfa-vault rm <path>`. Values: inline (`k=v`), file (`k=@/path`), stdin (`k=-`). `get -f <field>` writes raw value with no trailing newline — safe in `$(...)`. Exit 2 means "not found" (distinct from network errors).',
     versionCmd: "tfa-vault --version 2>/dev/null | head -1",
     statusCmd: "tfa-vault whoami",
     installCmd: "bun add -g @todoforai/vault",
     preinstall: true,
-    preinstallCloud: true,
-    internal: true
+    preinstallCloud: true
   },
   ripgrep: {
     category: "development",
@@ -49531,17 +49546,6 @@ function isToolInstalled(name) {
   }
   return whichWithTools(name) !== null;
 }
-function findReferencedTools(content) {
-  const stripped = content.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
-  return Object.keys(TOOL_CATALOG).filter((name) => {
-    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const re = new RegExp(String.raw`(?:^|[|;&\n]|&&|\|\||` + String.raw`\$\(|` + "`" + String.raw`|xargs\s+|sudo\s+|env\s+)\s*` + esc + String.raw`\b(?!-)`, "m");
-    return re.test(stripped);
-  });
-}
-function findMissingTools(content) {
-  return findReferencedTools(content).filter((name) => !isToolInstalled(name));
-}
 async function installBinary(name) {
   const urlFunc = BINARY_URL_FUNCS[name];
   if (!urlFunc) {
@@ -51592,7 +51596,6 @@ ${this.lastPart}`;
 var processes = new Map;
 var outputBuffers = new Map;
 var completionResolvers = new Map;
-var pendingToolApprovals = new Map;
 var exitedOutputByPid = new Map;
 async function executeBlock(blockId, content, send, todoId, messageId, timeout, cwd, manual = false, runMode, edgeId, agentSettingsId = "", keepAliveOnTimeout = false) {
   if (processes.has(blockId)) {
@@ -51611,38 +51614,6 @@ async function executeBlock(blockId, content, send, todoId, messageId, timeout,
     } else {
       cwd = tmpDir;
     }
-    const missing = findMissingTools(content);
-    if (missing.length && !pendingToolApprovals.has(blockId)) {
-      pendingToolApprovals.set(blockId, missing);
-      console.log(`[shell] Missing tools ${missing}, requesting approval for block ${blockId}`);
-      await send({
-        type: "BLOCK_UPDATE",
-        payload: {
-          todoId,
-          blockId,
-          messageId,
-          updates: {
-            status: "AWAITING_APPROVAL",
-            approvalContext: { source: "edge", toolInstalls: missing, workspace: cwd, edgeId }
-          }
-        }
-      });
-      return;
-    }
-    if (pendingToolApprovals.has(blockId)) {
-      const tools = pendingToolApprovals.get(blockId);
-      pendingToolApprovals.delete(blockId);
-      const installed = [];
-      for (const t of tools) {
-        if (await ensureTool(t))
-          installed.push(t);
-      }
-      if (installed.length) {
-        const notice = `[installed: ${installed.join(", ")}]
-`;
-        await send(msg.shellBlockResult(todoId, blockId, notice, messageId));
-      }
-    }
     await send({
       type: "BLOCK_UPDATE",
       payload: { todoId, blockId, messageId, updates: { status: "RUNNING" } }
@@ -51931,20 +51902,13 @@ var MAX_DIRS_PER_ROOT = 2000;
 var FRONTMATTER_BYTES = 8 * 1024;
 var MAX_NAME_LEN = 64;
 var MAX_DESC_LEN = 1024;
-function shortestPath(filePath, relTo) {
-  const rel = path6.relative(relTo, filePath);
-  const home = os7.homedir();
-  const homeRel = filePath.startsWith(home + path6.sep) ? "~" + filePath.slice(home.length) : filePath;
-  return [rel, homeRel, filePath].reduce((a, b) => b.length < a.length ? b : a);
-}
 async function discoverSkills(rootPaths, opts = {}) {
   const includeUserScope = opts.includeUserScope ?? true;
   const roots = [
-    ...rootPaths.map((p10) => ({ path: path6.join(p10, ".agents", "skills"), relTo: p10, scope: "repo" }))
+    ...rootPaths.map((p10) => ({ path: path6.join(p10, ".agents", "skills"), scope: "repo" }))
   ];
   if (includeUserScope) {
-    const home = os7.homedir();
-    roots.push({ path: path6.join(home, ".agents", "skills"), relTo: home, scope: "user" });
+    roots.push({ path: path6.join(os7.homedir(), ".agents", "skills"), scope: "user" });
   }
   const skills = [];
   const errors = [];
@@ -51962,11 +51926,11 @@ async function discoverSkills(rootPaths, opts = {}) {
     }
     if (!stat.isDirectory())
       continue;
-    walkRoot(root.path, root.relTo, root.scope, skills, errors, seenSkillPaths);
+    walkRoot(root.path, root.scope, skills, errors, seenSkillPaths);
   }
   return { skills, errors };
 }
-function walkRoot(root, relTo, scope, skills, errors, seen) {
+function walkRoot(root, scope, skills, errors, seen) {
   const queue = [{ dir: root, depth: 0 }];
   let dirsVisited = 0;
   for (let i10 = 0;i10 < queue.length; i10++) {
@@ -52002,14 +51966,14 @@ function walkRoot(root, relTo, scope, skills, errors, seen) {
         if (seen.has(full))
           continue;
         seen.add(full);
-        const skill = parseSkillFile(full, relTo, scope, errors);
+        const skill = parseSkillFile(full, scope, errors);
         if (skill)
           skills.push(skill);
       }
     }
   }
 }
-function parseSkillFile(filePath, relTo, scope, errors) {
+function parseSkillFile(filePath, scope, errors) {
   let head;
   try {
     const fd3 = fs9.openSync(filePath, "r");
@@ -52042,7 +52006,7 @@ function parseSkillFile(filePath, relTo, scope, errors) {
     name,
     description,
     shortDescription: shortDescription && shortDescription.length <= MAX_DESC_LEN ? shortDescription : undefined,
-    path: shortestPath(filePath, relTo),
+    path: filePath,
     scope
   };
 }
@@ -52372,9 +52336,6 @@ register("execute_shell_command", async (args, client) => {
   try {
     await send(msg.shellBlockStart(todoId, blockId, "execute", messageId));
     await executeBlock(blockId, execCmd, send, todoId, messageId, timeout, cwd, false, "internal", undefined, agentSettingsId, true);
-    if (pendingToolApprovals.has(blockId)) {
-      return { __awaiting_approval__: true };
-    }
     await waitForCompletion(blockId, (timeout + 5) * 1000);
     const rawOutput = getBlockRawOutput(blockId);
     let output = rawOutput ?? getBlockOutput(blockId);
@@ -52686,8 +52647,6 @@ async function handleFunctionCall(payload, send, client) {
       throw new Error(`Unknown function: ${functionName}. Available: ${available.join(", ")}`);
     }
     const result = await fn2(args, client);
-    if (result && result.__awaiting_approval__)
-      return;
     await send(makeSuccess(result));
   } catch (e) {
     log3("error", `Function call '${functionName}' failed:`, e.message);
@@ -53186,10 +53145,17 @@ class ServerError extends Error {
   }
 }
 
-// src/update-notifier.ts
+// node_modules/@todoforai/update-notifier/src/index.ts
 import fs12 from "node:fs";
 import path9 from "node:path";
 import os9 from "node:os";
+function isLinkedInstall() {
+  try {
+    return !fs12.realpathSync(process.argv[1] || "").includes(`${path9.sep}node_modules${path9.sep}`);
+  } catch {
+    return false;
+  }
+}
 var TTL_MS = 24 * 60 * 60 * 1000;
 var CACHE_DIR = path9.join(os9.homedir(), ".config", "todoforai");
 function cmpVer(a, b) {
@@ -53203,7 +53169,7 @@ function cmpVer(a, b) {
   return 0;
 }
 function checkForUpdates(pkg) {
-  if (!process.stderr.isTTY || process.env.CI || process.env.NO_UPDATE_NOTIFIER)
+  if (!process.stderr.isTTY || process.env.CI || process.env.NO_UPDATE_NOTIFIER || isLinkedInstall())
     return;
   const cacheFile = path9.join(CACHE_DIR, `notifier-${encodeURIComponent(pkg.name)}.json`);
   let cache = {};
@@ -53302,7 +53268,19 @@ function releaseLock(lp2) {
       fs13.unlinkSync(lp2);
   } catch {}
 }
+var MIN_BUN_VERSION = "1.3.14";
+function cmpSemver(a, b) {
+  const pa2 = a.split(".").map(Number), pb2 = b.split(".").map(Number);
+  for (let i10 = 0;i10 < 3; i10++)
+    if ((pa2[i10] ?? 0) !== (pb2[i10] ?? 0))
+      return (pa2[i10] ?? 0) - (pb2[i10] ?? 0);
+  return 0;
+}
 async function main() {
+  if (typeof Bun !== "undefined" && cmpSemver(Bun.version, MIN_BUN_VERSION) < 0) {
+    console.error(`\x1B[31mBun ${Bun.version} is too old — WebSocket upgrade fails after fetch on the same host. Upgrade to >= ${MIN_BUN_VERSION} via \`bun upgrade\`.\x1B[0m`);
+    process.exit(1);
+  }
   const ownPkg = readOwnPackage();
   if (ownPkg)
     checkForUpdates(ownPkg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@todoforai/edge",
-  "version": "0.13.11",
+  "version": "0.13.13",
   "type": "module",
   "bin": {
     "todoforai-edge": "dist/index.js"
@@ -16,6 +16,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
+    "@todoforai/update-notifier": "^0.1.0",
     "fflate": "^0.8.2",
     "ignore": "^7.0.5",
     "unpdf": "^1.4.0",