@todoforai/edge 0.13.9 → 0.13.11

package/dist/index.js

@@ -656,6 +656,8 @@ var require_receiver = __commonJS((exports, module) => {
       this._binaryType = options.binaryType || BINARY_TYPES[0];
       this._extensions = options.extensions || {};
       this._isServer = !!options.isServer;
+      this._maxBufferedChunks = options.maxBufferedChunks | 0;
+      this._maxFragments = options.maxFragments | 0;
       this._maxPayload = options.maxPayload | 0;
       this._skipUTF8Validation = !!options.skipUTF8Validation;
       this[kWebSocket] = undefined;
@@ -678,6 +680,10 @@ var require_receiver = __commonJS((exports, module) => {
     _write(chunk, encoding, cb) {
       if (this._opcode === 8 && this._state == GET_INFO)
         return cb();
+      if (this._maxBufferedChunks > 0 && this._buffers.length >= this._maxBufferedChunks) {
+        cb(this.createError(RangeError, "Too many buffered chunks", false, 1008, "WS_ERR_TOO_MANY_BUFFERED_PARTS"));
+        return;
+      }
       this._bufferedBytes += chunk.length;
       this._buffers.push(chunk);
       this.startLoop(cb);
@@ -881,6 +887,11 @@ var require_receiver = __commonJS((exports, module) => {
         return;
       }
       if (data.length) {
+        if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
+          const error = this.createError(RangeError, "Too many message fragments", false, 1008, "WS_ERR_TOO_MANY_BUFFERED_PARTS");
+          cb(error);
+          return;
+        }
         this._messageLength = this._totalPayloadLength;
         this._fragments.push(data);
       }
@@ -898,6 +909,11 @@ var require_receiver = __commonJS((exports, module) => {
             cb(error);
             return;
           }
+          if (this._maxFragments > 0 && this._fragments.length >= this._maxFragments) {
+            const error = this.createError(RangeError, "Too many message fragments", false, 1008, "WS_ERR_TOO_MANY_BUFFERED_PARTS");
+            cb(error);
+            return;
+          }
           this._fragments.push(buf);
         }
         this.dataMessage(cb);
@@ -1805,6 +1821,8 @@ var require_websocket = __commonJS((exports, module) => {
         binaryType: this.binaryType,
         extensions: this._extensions,
         isServer: this._isServer,
+        maxBufferedChunks: options.maxBufferedChunks,
+        maxFragments: options.maxFragments,
         maxPayload: options.maxPayload,
         skipUTF8Validation: options.skipUTF8Validation
       });
@@ -2047,6 +2065,8 @@ var require_websocket = __commonJS((exports, module) => {
       autoPong: true,
       closeTimeout: CLOSE_TIMEOUT,
       protocolVersion: protocolVersions[1],
+      maxBufferedChunks: 1024 * 1024,
+      maxFragments: 128 * 1024,
       maxPayload: 100 * 1024 * 1024,
       skipUTF8Validation: false,
       perMessageDeflate: true,
@@ -2285,6 +2305,8 @@ var require_websocket = __commonJS((exports, module) => {
       websocket.setSocket(socket, head, {
         allowSynchronousEvents: opts.allowSynchronousEvents,
         generateMask: opts.generateMask,
+        maxBufferedChunks: opts.maxBufferedChunks,
+        maxFragments: opts.maxFragments,
         maxPayload: opts.maxPayload,
         skipUTF8Validation: opts.skipUTF8Validation
       });
@@ -2620,6 +2642,8 @@ var require_websocket_server = __commonJS((exports, module) => {
       options = {
         allowSynchronousEvents: true,
         autoPong: true,
+        maxBufferedChunks: 1024 * 1024,
+        maxFragments: 128 * 1024,
         maxPayload: 100 * 1024 * 1024,
         skipUTF8Validation: false,
         perMessageDeflate: false,
@@ -2846,6 +2870,8 @@ var require_websocket_server = __commonJS((exports, module) => {
       socket.removeListener("error", socketOnError);
       ws.setSocket(socket, head, {
         allowSynchronousEvents: this.options.allowSynchronousEvents,
+        maxBufferedChunks: this.options.maxBufferedChunks,
+        maxFragments: this.options.maxFragments,
         maxPayload: this.options.maxPayload,
         skipUTF8Validation: this.options.skipUTF8Validation
       });
@@ -47843,6 +47869,7 @@ Options:
   --api-key <key>      API key (env: TODOFORAI_API_KEY)
   --api-url <url>      API URL (env: TODOFORAI_API_URL, default: https://api.todofor.ai)
   --add-path <path>    Add workspace path to this edge
+  --max-timeout <sec>  Floor for shell execution timeout
   --kill               Replace any existing edge instance for this user+server
   --debug              Verbose logging (env: TODOFORAI_DEBUG=1)
   -v, --version        Print version and exit
@@ -47861,6 +47888,7 @@ function loadConfig() {
       debug: { type: "boolean", default: false },
       kill: { type: "boolean", default: false },
       "add-path": { type: "string" },
+      "max-timeout": { type: "string" },
       version: { type: "boolean", short: "v", default: false },
       help: { type: "boolean", short: "h", default: false }
     },
@@ -47884,17 +47912,33 @@ function loadConfig() {
     const p = values["add-path"];
     addWorkspacePath = path.resolve(p.replace(/^~/, process.env.HOME || "~"));
   }
-  return { apiUrl, apiKey, debug, kill, addWorkspacePath, subcommand };
+  const maxTimeout = values["max-timeout"] ? Math.max(0, parseInt(values["max-timeout"], 10) || 0) : undefined;
+  return { apiUrl, apiKey, debug, kill, addWorkspacePath, maxTimeout, subcommand };
 }
-var CREDENTIALS_PATH = path.join(os.homedir(), ".todoforai", "credentials.json");
-function readCredentials() {
+function credentialsPath() {
+  const sys = os.platform();
+  if (sys === "win32") {
+    return path.join(os.homedir(), "AppData", "Roaming", "todoforai", "credentials.json");
+  }
+  if (sys === "darwin") {
+    return path.join(os.homedir(), "Library", "Application Support", "todoforai", "credentials.json");
+  }
+  const xdg = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+  return path.join(xdg, "todoforai", "credentials.json");
+}
+var CREDENTIALS_PATH = credentialsPath();
+var LEGACY_CREDENTIALS_PATH = path.join(os.homedir(), ".todoforai", "credentials.json");
+function readFileMap(p) {
   try {
-    return JSON.parse(fs.readFileSync(CREDENTIALS_PATH, "utf-8"));
+    return JSON.parse(fs.readFileSync(p, "utf-8"));
   } catch {
     return {};
   }
 }
-function writeCredentials(creds) {
+function readCredentials() {
+  return { ...readFileMap(LEGACY_CREDENTIALS_PATH), ...readFileMap(CREDENTIALS_PATH) };
+}
+function writeNewFile(creds) {
   const dir = path.dirname(CREDENTIALS_PATH);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
   fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 384 });
@@ -47906,14 +47950,23 @@ function loadSavedApiKey(apiUrl) {
   return readCredentials()[apiUrl] || null;
 }
 function saveApiKey(apiUrl, apiKey) {
-  const creds = readCredentials();
+  const creds = readFileMap(CREDENTIALS_PATH);
   creds[apiUrl] = apiKey;
-  writeCredentials(creds);
+  writeNewFile(creds);
 }
 function clearApiKey(apiUrl) {
-  const creds = readCredentials();
-  delete creds[apiUrl];
-  writeCredentials(creds);
+  const creds = readFileMap(CREDENTIALS_PATH);
+  if (apiUrl in creds) {
+    delete creds[apiUrl];
+    writeNewFile(creds);
+  }
+  const legacy = readFileMap(LEGACY_CREDENTIALS_PATH);
+  if (apiUrl in legacy) {
+    delete legacy[apiUrl];
+    try {
+      fs.writeFileSync(LEGACY_CREDENTIALS_PATH, JSON.stringify(legacy, null, 2), { mode: 384 });
+    } catch {}
+  }
 }
 
 // node_modules/ws/wrapper.mjs
@@ -47938,7 +47991,7 @@ function getConnectionEnv() {
   const { apiUrl, apiKey } = getter();
   if (!apiUrl || !apiKey)
     return {};
-  return { TODOFORAI_API_URL: apiUrl, TODOFORAI_API_KEY: apiKey };
+  return { TODOFORAI_API_URL: apiUrl, TODOFORAI_API_TOKEN: apiKey };
 }
 
 // src/constants.ts
@@ -48710,6 +48763,7 @@ var tool_catalog_default = {
       "~/.zele/sqlite.db"
     ],
     capabilities: "Read inbox, search/send/reply email, email addresses — multi-account Gmail, OAuth browser login for setup.",
+    description: "Use for anything Gmail: reading the user's inbox, searching mail, sending or replying to email. Multi-account, OAuth login via `zele login`.",
     versionCmd: "zele --version 2>/dev/null | head -1"
   },
   xurl: {
@@ -48723,6 +48777,7 @@ var tool_catalog_default = {
       "~/.xurl"
     ],
     capabilities: "Post tweets, reply & quote, read timelines, search tweets, like & repost, follow/unfollow, DMs, media uploads",
+    description: "Use to interact with X/Twitter: post/reply/quote tweets, search, read timelines, like/repost, follow, DMs, media upload. Authenticated raw API access via `xurl <method> <path>`.",
     versionCmd: "xurl --version 2>/dev/null | head -1"
   },
   "tiktok-uploader": {
@@ -48736,7 +48791,7 @@ var tool_catalog_default = {
       "~/.tiktok/cookies.txt"
     ],
     capabilities: "Upload videos, batch uploads, schedule posts, custom covers, hashtags & mentions",
-    description: "Cookie-based auth: Run 'npx @todoforai/tiktok-cookie-helper' to set up. Login to tiktok.com → Install 'Get cookies.txt LOCALLY' extension → Export cookies → Helper saves to ~/.tiktok/cookies.txt",
+    description: "Use to upload videos to TikTok (single or batch), schedule posts, set covers/hashtags/mentions. Cookie-based auth: run `npx @todoforai/tiktok-cookie-helper` → log in to tiktok.com → export cookies via 'Get cookies.txt LOCALLY' extension → saved to ~/.tiktok/cookies.txt.",
     versionCmd: "pip show tiktok-uploader 2>/dev/null | grep -oP 'Version: \\K.*'"
   },
   instagrapi: {
@@ -48745,6 +48800,7 @@ var tool_catalog_default = {
     installer: "pip",
     label: "Instagram",
     capabilities: "Upload photos & reels, post stories, send DMs, like & comment, manage followers",
+    description: 'Use for Instagram automation: upload photos/reels, post stories, DMs, like/comment, follower management. Python library; call via `python3 -c "from instagrapi import Client; ..."`.',
     statusCmd: 'python3 -c "import instagrapi" 2>/dev/null',
     versionCmd: "pip show instagrapi 2>/dev/null | grep -oP 'Version: \\K.*'"
   },
@@ -48759,6 +48815,7 @@ var tool_catalog_default = {
       "~/.local/share/mudslide"
     ],
     capabilities: "Send messages, send images & files, send locations & polls, group management, QR code login",
+    description: "Use to send WhatsApp messages/files/media/locations/polls from CLI. QR-code login via `mudslide login`.",
     versionCmd: "mudslide --version 2>/dev/null | head -1"
   },
   "telegram-send": {
@@ -48772,6 +48829,7 @@ var tool_catalog_default = {
       "~/.config/telegram-send/telegram-send.conf"
     ],
     capabilities: "Send messages, send files & images, send video & audio, Markdown/HTML formatting, channel & group support",
+    description: "Use to send Telegram messages/files from CLI (one-way bot output). Configure once with `telegram-send --configure`. For full Telegram automation use a different tool.",
     versionCmd: "telegram-send --version 2>/dev/null | head -1"
   },
   "apollo-api": {
@@ -48780,6 +48838,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "Apollo",
     capabilities: "Lead search & enrichment, email sequences, CRM sync",
+    description: "Use for B2B prospecting: search Apollo's people/company DB, enrich leads with emails/titles/companies, manage sequences and CRM data. Needs APOLLO_API_KEY.",
     versionCmd: "apollo-api --version 2>/dev/null | head -1"
   },
   "meta-ads": {
@@ -48798,6 +48857,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "ElevenLabs",
     capabilities: "Text-to-speech, voice cloning, multiple languages",
+    description: "Use to generate speech audio from text, clone voices, or list voices. Needs ELEVENLABS_API_KEY.",
     versionCmd: "elevenlabs-api --version 2>/dev/null | head -1"
   },
   "suno-api": {
@@ -48806,12 +48866,37 @@ var tool_catalog_default = {
     installer: "npm",
     label: "Suno",
     capabilities: "AI music generation, custom lyrics, multiple genres",
+    description: "Use to generate music/songs from a prompt or custom lyrics. Needs SUNO_API_KEY.",
     versionCmd: "suno-api --version 2>/dev/null | head -1"
   },
+  ntn: {
+    category: "utility",
+    pkg: "ntn",
+    installer: "npm",
+    label: "Notion",
+    statusCmd: "ntn doctor 2>&1 | grep -E 'Default workspace\\s+✔' >/dev/null",
+    loginCmd: "ntn login",
+    credentialPaths: [
+      "~/.config/notion"
+    ],
+    capabilities: "Official Notion CLI: workspace-wide OAuth login, raw API calls (`ntn api <path>`), page/datasource management, file uploads, Workers deploy.",
+    description: "Two auth tracks: (1) `ntn login` for Workers/internal commands (`ntn doctor`, `ntn workers`) — workspace OAuth stored in keychain. (2) Public REST API (`ntn api`, `ntn pages`, `ntn datasources`, `ntn files`) requires NOTION_API_TOKEN env var (integration token from https://www.notion.so/my-integrations) — and the target pages must be Connected to that integration via the Notion UI: page `...` → Connections. Examples: `ntn api /v1/users/me`, `ntn api /v1/search -X POST -d '{\"query\":\"...\"}'`, `ntn pages get <id>` (Markdown export), `ntn pages create --parent page:<id> --content '# Title'`, `ntn pages update <id> --content '...'`, `ntn pages trash <id> --yes`. Use `ntn datasources resolve <database-id>` then `ntn datasources query <data-source-id>`.",
+    versionCmd: "ntn --version 2>/dev/null | head -1"
+  },
+  "perplexity-api": {
+    category: "utility",
+    pkg: "@todoforai/perplexity-api",
+    installer: "npm",
+    label: "Perplexity",
+    capabilities: "AI-powered web search, chat completions, async chat, embeddings and agent runs",
+    description: "Use when you need current web-grounded answers with citations (news, prices, docs released after training cutoff). Prefer over plain LLM when freshness/sources matter. Needs PERPLEXITY_API_KEY.",
+    versionCmd: "perplexity-api --version 2>/dev/null | head -1"
+  },
   gh: {
     category: "development",
     pkg: "gh",
     installer: "binary",
+    preinstallCloud: true,
     label: "GitHub",
     statusCmd: "gh auth status",
     loginCmd: "gh auth login",
@@ -48819,6 +48904,7 @@ var tool_catalog_default = {
       "~/.config/gh/hosts.yml"
     ],
     capabilities: "Repos, PRs & issues, actions & releases, gists & SSH keys",
+    description: "Use for any GitHub operation: create/list/merge PRs, file issues, manage releases, trigger/inspect Actions, clone/fork repos, gists. Prefer `gh` over raw GitHub API calls.",
     versionCmd: "gh --version 2>/dev/null | head -1"
   },
   glab: {
@@ -48832,6 +48918,7 @@ var tool_catalog_default = {
       "~/.config/glab-cli/config.yml"
     ],
     capabilities: "Repos, MRs & issues, CI/CD pipelines, releases",
+    description: "Use for any GitLab operation: MRs, issues, pipelines, releases, repo management. GitLab equivalent of `gh`.",
     versionCmd: "glab --version 2>/dev/null | head -1"
   },
   vercel: {
@@ -48845,6 +48932,7 @@ var tool_catalog_default = {
       "~/.local/share/com.vercel.cli/auth.json"
     ],
     capabilities: "Deploy & preview, environment variables, domain management",
+    description: "Use to deploy a project to Vercel (`vercel deploy`), manage env vars, domains, and preview URLs.",
     versionCmd: "vercel --version 2>/dev/null | head -1"
   },
   netlify: {
@@ -48858,6 +48946,7 @@ var tool_catalog_default = {
       "~/.netlify/config.json"
     ],
     capabilities: "Deploy & preview, serverless functions, forms & identity",
+    description: "Use to deploy sites/functions to Netlify, manage env vars, forms, identity. `netlify deploy --prod` for production.",
     versionCmd: "netlify --version 2>/dev/null | head -1"
   },
   firebase: {
@@ -48871,6 +48960,7 @@ var tool_catalog_default = {
       "~/.config/configstore/firebase-tools.json"
     ],
     capabilities: "Hosting & deploy, Firestore & Realtime DB, auth & functions",
+    description: "Use for Firebase: deploy hosting/functions, manage Firestore/Realtime DB rules and data, auth users, emulators.",
     versionCmd: "firebase --version 2>/dev/null | head -1"
   },
   wrangler: {
@@ -48884,6 +48974,7 @@ var tool_catalog_default = {
       "~/.config/.wrangler/config/default.toml"
     ],
     capabilities: "Workers & Pages deploy, KV & D1 storage, R2 & Queues",
+    description: "Use for Cloudflare developer platform: deploy Workers/Pages, manage KV/D1/R2/Queues, tail logs. Use `cloudflared` for tunnels.",
     versionCmd: "wrangler --version 2>/dev/null | head -1"
   },
   stripe: {
@@ -48897,6 +48988,7 @@ var tool_catalog_default = {
       "~/.config/stripe/config.toml"
     ],
     capabilities: "Payments & subscriptions, webhook testing, invoice management",
+    description: "Use for Stripe: inspect/create customers, charges, subscriptions, invoices, webhooks. `stripe listen` to forward webhooks locally; `stripe get/post /v1/...` for raw API.",
     versionCmd: "stripe --version 2>/dev/null | head -1"
   },
   flyctl: {
@@ -48910,6 +49002,7 @@ var tool_catalog_default = {
       "~/.fly/config.yml"
     ],
     capabilities: "Deploy containers globally, Postgres & volumes, auto-scaling",
+    description: "Use to deploy apps/containers to Fly.io edge, manage Postgres/volumes/machines/secrets. `flyctl deploy` from app dir.",
     versionCmd: "flyctl version 2>/dev/null | head -1"
   },
   supabase: {
@@ -48923,6 +49016,7 @@ var tool_catalog_default = {
       "~/.config/supabase/access-token"
     ],
     capabilities: "Postgres database, auth & storage, edge functions",
+    description: "Use for Supabase projects: run/migrate local Postgres, deploy edge functions, manage auth/storage, link to cloud project.",
     versionCmd: "supabase --version 2>/dev/null | head -1"
   },
   railway: {
@@ -48936,6 +49030,7 @@ var tool_catalog_default = {
       "~/.railway/config.json"
     ],
     capabilities: "Deploy apps & databases, environment management, auto-scaling",
+    description: "Use to deploy apps/services to Railway, provision databases, manage env vars and environments. `railway up` to deploy current dir.",
     versionCmd: "railway --version 2>/dev/null | head -1"
   },
   shopify: {
@@ -48949,6 +49044,7 @@ var tool_catalog_default = {
       "~/.config/shopify/config.json"
     ],
     capabilities: "Theme development, app scaffolding, store management",
+    description: "Use for Shopify dev: scaffold/develop themes and apps, push/pull themes, run dev server against a store.",
     versionCmd: "shopify version 2>/dev/null | head -1"
   },
   "datadog-ci": {
@@ -48957,6 +49053,7 @@ var tool_catalog_default = {
     installer: "npm",
     label: "Datadog",
     capabilities: "CI test visibility, sourcemap uploads, deployment tracking",
+    description: "Use in CI to upload test results/sourcemaps/coverage to Datadog and mark deployments. Needs DATADOG_API_KEY.",
     versionCmd: "datadog-ci version 2>/dev/null | head -1"
   },
   "sentry-cli": {
@@ -48970,18 +49067,20 @@ var tool_catalog_default = {
       "~/.sentryclirc"
     ],
     capabilities: "Release management, sourcemap uploads, error monitoring",
+    description: "Use to create Sentry releases, upload sourcemaps/debug-symbols, associate commits, send events. `sentry-cli releases new <version>`.",
     versionCmd: "sentry-cli --version 2>/dev/null | head -1"
   },
   todoai: {
     category: "utility",
     pkg: "@todoforai/cli",
     installer: "bun",
-    label: "TODO CLI",
+    label: "TODOforAI",
     capabilities: "Create & manage TODOs, run workflows, API access",
+    description: "Use to programmatically create/list/update TODOs in TODOforAI, kick off workflows, call the platform API.",
     statusCmd: "todoai --help >/dev/null 2>&1",
     installCmd: "bun add -g @todoforai/cli",
     versionCmd: "todoai --version 2>/dev/null | head -1",
-    preinstall: true
+    internal: true
   },
   newman: {
     category: "testing",
@@ -48990,17 +49089,21 @@ var tool_catalog_default = {
     label: "Postman",
     statusCmd: "newman --version",
     capabilities: "Run API test collections, CI/CD integration, HTML reports",
+    description: "Use to run Postman collections from CLI (API smoke tests, CI checks). `newman run <collection.json> -e <env.json>`.",
     versionCmd: "newman --version 2>/dev/null | head -1"
   },
   curl: {
     category: "networking",
     pkg: "curl",
     installer: "system",
-    label: "curl",
+    label: "Web Request",
+    binName: "curl",
     statusCmd: "curl --version >/dev/null 2>&1",
     capabilities: "HTTP/HTTPS/FTP client: GET/POST/PUT/DELETE, headers, auth, file upload/download, follow redirects, cookies, TLS.",
+    description: "Default tool for any HTTP request: hitting REST APIs, downloading files, testing endpoints. Common flags: `-s` silent, `-L` follow redirects, `-H 'Header: ...'`, `-X POST -d '...'`, `-o file`, `-f` fail on HTTP errors. Pipe into `jq` for JSON.",
     versionCmd: "curl --version 2>/dev/null | head -1",
-    preinstall: true
+    preinstallCloud: true,
+    internal: true
   },
   cloudflared: {
     category: "networking",
@@ -49009,25 +49112,29 @@ var tool_catalog_default = {
     label: "Tunnel",
     statusCmd: "cloudflared --version",
     capabilities: "Tunnel to localhost, expose local services, zero-trust access",
+    description: "Use to expose a local port to the public internet via a Cloudflare tunnel. Quick: `cloudflared tunnel --url http://localhost:<port>` prints a public https URL.",
     versionCmd: "cloudflared --version 2>/dev/null | head -1"
   },
   vault: {
     category: "security",
     pkg: "vault",
     installer: "binary",
-    label: "Vault",
+    preinstallCloud: true,
+    label: "HashiCorp Vault",
     statusCmd: "test -f ~/.vault-token && echo 'authenticated'",
     loginCmd: "vault login",
     credentialPaths: [
       "~/.vault-token"
     ],
     capabilities: "Secrets management, dynamic credentials",
+    description: "HashiCorp Vault CLI for Terraform/vals/ecosystem integrations. For day-to-day secret read/write in TODOforAI, prefer `tfa-vault` (zero-config). Needs VAULT_ADDR + VAULT_TOKEN.",
     versionCmd: "vault --version 2>/dev/null | head -1"
   },
   rclone: {
     category: "cloud",
     pkg: "rclone",
-    installer: "binary",
+    installer: "system",
+    preinstallCloud: true,
     label: "Cloud Sync",
     statusCmd: "rclone listremotes 2>&1 | grep -v 'NOTICE' | head -5",
     loginCmd: "rclone config",
@@ -49078,81 +49185,127 @@ var tool_catalog_default = {
     label: "PDF",
     statusCmd: "python3 -c 'import pymupdf' 2>/dev/null || /usr/bin/python3 -c 'import pymupdf' 2>/dev/null",
     capabilities: "PDF text editing, extraction, merge, split",
-    description: "Install: pip install pymupdf. Use via python3 -c with pymupdf. Replace text: doc=pymupdf.open(path); page.add_redact_annot(page.search_for('old')[0], text='new'); page.apply_redactions(); doc.save(out). Extract with positions: page.get_text('dict') returns spans with bbox/font/size.",
-    versionCmd: "python3 -c 'import pymupdf; print(pymupdf.__version__)' 2>/dev/null"
+    description: "Use to programmatically read/edit/merge/split PDFs (text + positions). Call from `python3 -c`. Extract text: `pymupdf.open(p)[i].get_text()`; with bbox/font: `.get_text('dict')`. Replace text in place: `page.add_redact_annot(page.search_for('old')[0], text='new'); page.apply_redactions(); doc.save(out)`. For PDF → markdown prefer `firecrawl parse`.",
+    versionCmd: "python3 -c 'import pymupdf; print(pymupdf.__version__)' 2>/dev/null",
+    preinstallCloud: true
   },
   "agent-browser": {
     category: "development",
     pkg: "agent-browser",
     installer: "npm",
+    preinstallCloud: true,
     label: "Browser",
     statusCmd: "agent-browser --version",
     capabilities: "Headless browser automation, web scraping, accessibility tree snapshots, screenshots, PDF generation",
-    description: "Headless Chrome automation for AI agents. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with refs), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>. Use snapshot to get semantic page structure with @refs for clicking. Supports drag/drop, file uploads, form interactions.",
+    description: "Use when a task needs a real browser: JS-rendered pages, logged-in flows, clicking/filling forms, screenshots, PDF export. Prefer `curl` for plain HTTP and `firecrawl` for bulk scrape/crawl. Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with @refs — use these for clicking), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>.",
     versionCmd: "agent-browser --version 2>/dev/null | head -1"
   },
+  firecrawl: {
+    category: "development",
+    pkg: "firecrawl-cli",
+    installer: "npm",
+    label: "Firecrawl",
+    statusCmd: "firecrawl view-config 2>&1 | grep -q 'Authenticated' && echo authenticated",
+    loginCmd: "firecrawl login",
+    credentialPaths: [
+      "~/.config/firecrawl-cli"
+    ],
+    capabilities: "Web scraping, crawling, search, map URLs, parse local HTML/PDF/DOCX to markdown, AI agent extraction",
+    description: "Use for web → markdown at scale: single pages (`firecrawl scrape <url>`), whole sites (`firecrawl crawl <url>`), URL discovery (`firecrawl map <url>`), web search (`firecrawl search <query>`), local doc conversion (`firecrawl parse <file.pdf|docx|html|xlsx>`), AI-guided extraction (`firecrawl agent <prompt>`). Prefer over `curl` when you want markdown not HTML. Auth: `firecrawl login` or FIRECRAWL_API_KEY.",
+    versionCmd: "firecrawl --version 2>/dev/null | head -1"
+  },
   "todoforai-browser": {
     category: "development",
     pkg: "@todoforai/browser",
     installer: "npm",
-    label: "TODO for AI Browser",
+    label: "Browser (Extension)",
     capabilities: "Browser automation via extension (non-headless), web scraping, accessibility tree snapshots, screenshots, PDF generation",
     description: "Browser automation via the TODO for AI browser extension (non-headless, uses your real browser). Commands: open <url>, click/type/fill <selector> <text>, snapshot (accessibility tree with refs), screenshot [path], pdf <path>, eval <js>, wait <selector|ms>. Use snapshot to get semantic page structure with @refs for clicking. Supports drag/drop, file uploads, form interactions.",
-    versionCmd: `node -p "require(require('child_process').execSync('which todoforai-browser',{encoding:'utf8'}).trim().replace(/\\/dist\\/index\\.js$/, '/package.json')).version" 2>/dev/null`
+    versionCmd: `node -p "require(require('child_process').execSync('which todoforai-browser',{encoding:'utf8'}).trim().replace(/\\/dist\\/index\\.js$/, '/package.json')).version" 2>/dev/null`,
+    internal: true
   },
   "todoforai-subagent": {
     category: "development",
     pkg: "@todoforai/subagent",
     installer: "npm",
-    label: "TODO for AI Sub-agent",
+    label: "Sub-agent",
     capabilities: "Spawn a TODO for AI sub-agent (FluidAgent) from the CLI; pipe stdin in, get an answer out",
     description: 'Run a sub-agent task from a shell block. Usage: `todoforai-subagent [-m model] [-s :preset|@file|text] [--tools read,grep,bash] "<question>"`. Pipe stdin to include input context. Presets: :review, :explore, :plan, :summarize. Auth via TODOFORAI_API_KEY (auto-injected by edge).',
     versionCmd: "todoforai-subagent --version 2>/dev/null | head -1",
     installCmd: "bun add -g @todoforai/subagent",
-    preinstall: true
-  },
-  "todoforai-review": {
-    category: "development",
-    pkg: "@todoforai/review",
-    installer: "npm",
-    label: "TODO for AI Review",
-    capabilities: "Review a git diff with a sub-agent: assess goal, find issues, suggest simpler approaches",
-    description: 'Capture `git diff` and ask a read-only sub-agent to review it. Usage: `todoforai-review [--repo <path>] [--against <ref>] "<goal>"`. Default diffs uncommitted changes vs HEAD. Wraps `todoforai-subagent --sysmsg :review --tools read,grep,bash`.',
-    versionCmd: "todoforai-review --version 2>/dev/null | head -1",
-    installCmd: "bun add -g @todoforai/review",
-    preinstall: true
-  },
-  "todoforai-explore": {
-    category: "development",
-    pkg: "@todoforai/explore",
-    installer: "npm",
-    label: "TODO for AI Explore",
-    capabilities: "Explore a codebase with a sub-agent: map structure, find patterns, surface relevant files",
-    description: 'Ask a read-only sub-agent to explore a codebase. Usage: `todoforai-explore [--repo <path>] "<question>"`. Sub-agent uses read/grep/bash to investigate and reports findings with file:line citations. Wraps `todoforai-subagent --sysmsg :explore`.',
-    versionCmd: "todoforai-explore --version 2>/dev/null | head -1",
-    installCmd: "bun add -g @todoforai/explore",
-    preinstall: true
+    internal: true
   },
   "todoforai-summary": {
     category: "development",
     pkg: "@todoforai/summary",
     installer: "npm",
-    label: "TODO for AI Summary",
+    label: "Summarize (Lite)",
     capabilities: "Summarize files or piped input via a sub-agent",
     description: 'Summarize file contents or stdin. Usage: `todoforai-summary [-f <file>]... [<files...>] [<focus>]` or `cat x | todoforai-summary "focus"`. Wraps `todoforai-subagent --sysmsg :summarize`.',
     versionCmd: "todoforai-summary --version 2>/dev/null | head -1",
     installCmd: "bun add -g @todoforai/summary",
-    preinstall: true
+    internal: true
+  },
+  "tfa-explore": {
+    category: "development",
+    pkg: "@todoforai/tfa-explore",
+    installer: "npm",
+    label: "Explore",
+    capabilities: "Explore a codebase as a real TODO: read-only agent maps structure, surfaces relevant files, streams findings to terminal",
+    description: 'Codebase exploration as a real TODO with patched permissions (read/grep/bash only) and live streaming. Usage: `tfa-explore [--repo <path>] "<question>"`. Creates a TODO visible in the UI and streams block events to stdout until DONE.',
+    versionCmd: "tfa-explore --version 2>/dev/null | head -1",
+    installCmd: "bun add -g @todoforai/tfa-explore",
+    preinstall: true,
+    preinstallCloud: true,
+    internal: true
+  },
+  "tfa-review": {
+    category: "development",
+    pkg: "@todoforai/tfa-review",
+    installer: "npm",
+    label: "Review",
+    capabilities: "Review a git diff as a real TODO: read-only agent assesses goal, finds issues, suggests simpler approaches",
+    description: 'Capture `git diff` and ask a read-only sub-agent to review it as a real TODO. Usage: `tfa-review [--repo <path>] [--against <ref>] "<goal>"`. Default diffs uncommitted changes vs HEAD. Streams block events to stdout until DONE.',
+    versionCmd: "tfa-review --version 2>/dev/null | head -1",
+    installCmd: "bun add -g @todoforai/tfa-review",
+    preinstall: true,
+    preinstallCloud: true,
+    internal: true
+  },
+  "tfa-summary": {
+    category: "development",
+    pkg: "@todoforai/tfa-summary",
+    installer: "npm",
+    label: "Summarize",
+    capabilities: "Summarize files or piped input as a real TODO with no-tools sub-agent",
+    description: 'Summarize file contents or stdin as a real TODO. Usage: `tfa-summary [-f <file>]... [<files...>] [<focus>]` or `cat x | tfa-summary "focus"`. No tools (content is inlined); streams block events to stdout until DONE.',
+    versionCmd: "tfa-summary --version 2>/dev/null | head -1",
+    installCmd: "bun add -g @todoforai/tfa-summary",
+    internal: true
+  },
+  "tfa-vault": {
+    category: "security",
+    pkg: "@todoforai/vault",
+    installer: "npm",
+    label: "Vault",
+    capabilities: "Zero-config TODOforAI vault CLI: put/get/patch/list/rm secrets in the user's KV v2 vault. Reuses bridge credentials (TODOFORAI_API_KEY / ~/.config/todoforai/credentials.json); derives vault URL from backend URL.",
+    description: 'Read & write secrets in the user\'s TODOforAI vault — no VAULT_ADDR, no VAULT_TOKEN, no `vault login` needed. Usage: `tfa-vault put <path> k=v [k=v ...]`, `tfa-vault get [-f <field>] <path>`, `tfa-vault patch <path> k=v ...`, `tfa-vault list [<prefix>]`, `tfa-vault rm <path>`. Values: inline (`k=v`), file (`k=@/path`), stdin (`k=-`). `get -f <field>` writes raw value with no trailing newline — safe in `$(...)`. Exit 2 means "not found" (distinct from network errors). Prefer this over the HashiCorp `vault` CLI for daily use; `vault` remains supported for Terraform/vals/ecosystem tools.',
+    versionCmd: "tfa-vault --version 2>/dev/null | head -1",
+    statusCmd: "tfa-vault whoami",
+    installCmd: "bun add -g @todoforai/vault",
+    preinstall: true,
+    preinstallCloud: true,
+    internal: true
   },
   ripgrep: {
     category: "development",
     pkg: "ripgrep",
     installer: "binary",
-    label: "ripgrep (rg)",
+    label: "Search",
     capabilities: "Fast recursive grep with regex, .gitignore-aware, parallel, unicode-correct",
     description: "Fast code/text search. Usage: `rg <pattern> [path]`, `-i` case-insensitive, `-l` files only, `-t <lang>` filter by language, `-g '<glob>'` filter by glob, `-C N` context. Prefer over `grep -r`.",
     versionCmd: "rg --version 2>/dev/null | head -1",
-    preinstall: true,
+    preinstallCloud: true,
     binary: {
       "linux-x86_64": { url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz", archive: "tar.gz", extract: "ripgrep-14.1.1-x86_64-unknown-linux-musl/rg" },
       "linux-aarch64": { url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-unknown-linux-gnu.tar.gz", archive: "tar.gz", extract: "ripgrep-14.1.1-aarch64-unknown-linux-gnu/rg" },
@@ -49160,17 +49313,18 @@ var tool_catalog_default = {
       "darwin-aarch64": { url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-aarch64-apple-darwin.tar.gz", archive: "tar.gz", extract: "ripgrep-14.1.1-aarch64-apple-darwin/rg" },
       "windows-x86_64": { url: "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-pc-windows-msvc.zip", archive: "zip", extract: "ripgrep-14.1.1-x86_64-pc-windows-msvc/rg.exe" }
     },
-    binName: "rg"
+    binName: "rg",
+    internal: true
   },
   fd: {
     category: "development",
     pkg: "fd-find",
     installer: "binary",
-    label: "fd",
+    label: "Find Files",
     capabilities: "Fast user-friendly find replacement: regex by default, .gitignore-aware, parallel",
     description: "Find files/dirs by name. Usage: `fd <pattern> [path]`, `-e <ext>` filter by extension, `-t f|d` type, `-H` include hidden, `-x <cmd>` exec per match.",
     versionCmd: "fd --version 2>/dev/null | head -1",
-    preinstall: true,
+    preinstallCloud: true,
     binary: {
       "linux-x86_64": { url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-unknown-linux-musl.tar.gz", archive: "tar.gz", extract: "fd-v10.2.0-x86_64-unknown-linux-musl/fd" },
       "linux-aarch64": { url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-aarch64-unknown-linux-gnu.tar.gz", archive: "tar.gz", extract: "fd-v10.2.0-aarch64-unknown-linux-gnu/fd" },
@@ -49178,17 +49332,18 @@ var tool_catalog_default = {
       "darwin-aarch64": { url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-aarch64-apple-darwin.tar.gz", archive: "tar.gz", extract: "fd-v10.2.0-aarch64-apple-darwin/fd" },
       "windows-x86_64": { url: "https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-pc-windows-msvc.zip", archive: "zip", extract: "fd-v10.2.0-x86_64-pc-windows-msvc/fd.exe" }
     },
-    binName: "fd"
+    binName: "fd",
+    internal: true
   },
   jq: {
     category: "development",
     pkg: "jq",
     installer: "binary",
-    label: "jq",
+    label: "JSON",
     capabilities: "Command-line JSON processor: query, filter, transform, format JSON streams",
     description: "JSON pipeline tool. Usage: `cat x.json | jq '.field'`, `jq -r` raw output, `jq '.[] | select(.k==\"v\")'`, `jq -s` slurp array. Pairs well with curl/rg.",
     versionCmd: "jq --version 2>/dev/null | head -1",
-    preinstall: true,
+    preinstallCloud: true,
     binary: {
       "linux-x86_64": { url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64", archive: "raw" },
       "linux-aarch64": { url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-arm64", archive: "raw" },
@@ -49196,16 +49351,44 @@ var tool_catalog_default = {
       "darwin-aarch64": { url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-macos-arm64", archive: "raw" },
       "windows-x86_64": { url: "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-windows-amd64.exe", archive: "raw" }
     },
-    binName: "jq"
+    binName: "jq",
+    internal: true
   },
   patch: {
     category: "development",
     pkg: "patch",
     installer: "system",
-    label: "GNU patch",
+    preinstallCloud: true,
+    label: "Apply Diff",
     capabilities: "Apply unified/context diff patches to files; reverse, dry-run, fuzzy matching",
     description: "Apply diffs. Usage: `patch -p1 < changes.diff` (strip 1 leading path component), `--dry-run` to preview, `-R` to reverse, `-N` skip already-applied. Reads unified (`diff -u`) or context diffs.",
-    versionCmd: "patch --version 2>/dev/null | head -1"
+    versionCmd: "patch --version 2>/dev/null | head -1",
+    binName: "patch",
+    internal: true
+  },
+  sed: {
+    category: "development",
+    pkg: "sed",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Replace Text",
+    capabilities: "Stream editor: in-place text substitution, line filtering, scripted edits",
+    description: "Non-interactive text transformation. Usage: `sed 's/old/new/g' file`, `-i` edit in place (`-i ''` on macOS), `-n '5,10p'` print line range, `-E` extended regex. Pair with `rg -l` to bulk-rewrite matched files.",
+    versionCmd: "sed --version 2>/dev/null | head -1",
+    binName: "sed",
+    internal: true
+  },
+  grep: {
+    category: "development",
+    pkg: "grep",
+    installer: "system",
+    preinstallCloud: true,
+    label: "Search Text",
+    capabilities: "Search plain text for lines matching a regex: recursive, fixed-string, context, invert, count",
+    description: "Line-based text search. Usage: `grep <pattern> file`, `-r` recursive, `-i` case-insensitive, `-n` line numbers, `-E` extended regex, `-F` fixed strings, `-v` invert, `-C N` context, `-l` files only. For large code searches prefer `rg`.",
+    versionCmd: "grep --version 2>/dev/null | head -1",
+    binName: "grep",
+    internal: true
   }
 };
 
@@ -49616,11 +49799,6 @@ function execShellAsync(cmd, env, timeout) {
 async function scanCatalogTools() {
   const result = {};
   const env = buildEnvWithTools();
-  const rawPath = process.env.PATH ?? process.env.Path ?? process.env.path ?? "";
-  const pathDirs = rawPath.split(path3.delimiter).filter(Boolean);
-  log2("scan", `platform=${os3.platform()} PATH dirs (${pathDirs.length}):`);
-  for (const d of pathDirs)
-    log2("scan", `  ${d}`);
   const entries = Object.entries(TOOL_CATALOG);
   const installed = [];
   const missing = [];
@@ -49632,8 +49810,6 @@ async function scanCatalogTools() {
       installed.push([name, entry]);
     }
   }
-  log2("scan", `installed: [${installed.map(([n]) => n).join(", ")}]`);
-  log2("scan", `missing:   [${missing.join(", ")}]`);
   await Promise.all(installed.map(async ([name, entry]) => {
     const state = { installed: true };
     if (entry.versionCmd) {
@@ -51054,7 +51230,7 @@ var mimetypes_default = {
     image: { icon: "mdi:file-image", color: "yellow", prefixRule: "image/", needsObjectUrl: true },
     audio: { icon: "mdi:file-music", color: "grey", prefixRule: "audio/", needsObjectUrl: true },
     video: { icon: "mdi:file-video", color: "yellow", prefixRule: "video/", needsObjectUrl: true },
-    pdf: { icon: "mdi:file-pdf-box", color: "red", needsObjectUrl: true },
+    pdf: { icon: "mdi:pdf-box", color: "red", needsObjectUrl: true },
     document: { icon: "mdi:file-word", color: "lightblue" },
     spreadsheet: { icon: "mdi:file-excel", color: "green" },
     text: { icon: "mdi:file", color: "white", prefixRule: "text/" },
@@ -51145,7 +51321,7 @@ var MAX_IMAGE_FILE_SIZE = 5000000;
 var OFFICE_EXTENSIONS = new Set([".docx", ".xlsx", ".pdf"]);
 var EXT_TO_MIME = new Map(Object.entries(mimetypes_default.extensions).map(([ext, e]) => [`.${ext}`, e.mime]));
 var EXT_TO_TYPE = new Map(Object.entries(mimetypes_default.extensions).map(([ext, e]) => [`.${ext}`, e.type]));
-async function readFileContent(filePath, rootPath, fallbackRootPaths) {
+async function readFileContent(filePath, rootPath, fallbackRootPaths, skipSizeLimit = false) {
   try {
     const fullPath = path4.resolve(resolveFilePath(filePath, rootPath, fallbackRootPaths));
     if (!fs7.existsSync(fullPath)) {
@@ -51167,7 +51343,7 @@ async function readFileContent(filePath, rootPath, fallbackRootPaths) {
     const isImage = fileType === "image";
     const isOffice = OFFICE_EXTENSIONS.has(ext);
     const sizeLimit = isImage ? MAX_IMAGE_FILE_SIZE : isOffice ? MAX_OFFICE_FILE_SIZE : MAX_FILE_SIZE;
-    if (stat.size > sizeLimit) {
+    if (!skipSizeLimit && stat.size > sizeLimit) {
       return {
         success: false,
         error: `File too large: ${fullPath} (${stat.size.toLocaleString()} bytes, max ${sizeLimit.toLocaleString()})`
@@ -51660,6 +51836,13 @@ async function sendInput(blockId, text) {
   }
   return true;
 }
+function detachBlock(blockId) {
+  const resolver = completionResolvers.get(blockId);
+  if (resolver) {
+    resolver();
+    completionResolvers.delete(blockId);
+  }
+}
 function interruptBlock(blockId) {
   const handle = processes.get(blockId);
   if (!handle)
@@ -52147,12 +52330,13 @@ function detectContentType(output, cmd) {
   return { result: output };
 }
 register("execute_shell_command", async (args, client) => {
-  const { cmd, timeout = 120, cwd = args.root_path ?? "", todoId = "", messageId = "", blockId = "", agentSettingsId = "", pid: resumePid = 0 } = args;
+  const { cmd, cwd = args.root_path ?? "", todoId = "", messageId = "", blockId = "", agentSettingsId = "", pid: resumePid = 0 } = args;
+  const timeout = Math.max(args.timeout ?? 120, client?.maxTimeout ?? 0);
   const canStream = !!(todoId && blockId && client);
   if (!canStream) {
     const { exec } = await import("child_process");
     const result = await new Promise((resolve) => {
-      exec(cmd, { cwd: cwd || os8.tmpdir(), encoding: "utf-8", timeout: 120000, maxBuffer: 10485760, env: { ...buildEnvWithTools(), ...getConnectionEnv(), TODOFORAI_TODO_ID: todoId, TODOFORAI_MESSAGE_ID: messageId, TODOFORAI_BLOCK_ID: blockId, TODOFORAI_AGENT_SETTINGS_ID: agentSettingsId } }, (_err, stdout, stderr) => {
+      exec(cmd, { cwd: cwd || os8.tmpdir(), encoding: "utf-8", timeout: timeout * 1000, maxBuffer: 10485760, env: { ...buildEnvWithTools(), ...getConnectionEnv(), TODOFORAI_TODO_ID: todoId, TODOFORAI_MESSAGE_ID: messageId, TODOFORAI_BLOCK_ID: blockId, TODOFORAI_AGENT_SETTINGS_ID: agentSettingsId } }, (_err, stdout, stderr) => {
         resolve((stdout || "") + (stderr || ""));
       });
     });
@@ -52209,13 +52393,37 @@ register("execute_shell_command", async (args, client) => {
   }
 });
 register("read_file", async (args) => {
-  const { path: p10, rootPath = "", fallbackRootPaths = [] } = args;
-  const result = await readFileContent(p10, rootPath, fallbackRootPaths);
+  const { path: p10, rootPath = "", fallbackRootPaths = [], skipSizeLimit = false } = args;
+  const result = await readFileContent(p10, rootPath, fallbackRootPaths, skipSizeLimit);
   if (!result.success)
     throw new Error(result.error || "Unknown read error");
   const { success, ...rest } = result;
   return rest;
 });
+var LIST_DIR_MAX_ENTRIES = 1e4;
+register("list_dir", async (args) => {
+  const { path: p10, rootPath = "", fallbackRootPaths = [] } = args;
+  const fullPath = resolveFilePath(p10, rootPath, fallbackRootPaths);
+  const st2 = fs10.statSync(fullPath);
+  if (!st2.isDirectory())
+    throw new Error(`Not a directory: ${fullPath}`);
+  const dirents = fs10.readdirSync(fullPath, { withFileTypes: true });
+  if (dirents.length > LIST_DIR_MAX_ENTRIES) {
+    throw new Error(`Directory too large: ${dirents.length} entries (max ${LIST_DIR_MAX_ENTRIES})`);
+  }
+  const entries = dirents.map((d) => {
+    let size = 0, mtime = 0, mode = 0, is_dir = d.isDirectory();
+    try {
+      const s = fs10.lstatSync(path7.join(fullPath, d.name));
+      size = Number(s.size);
+      mtime = s.mtimeMs / 1000;
+      mode = s.mode & 511;
+      is_dir = s.isDirectory();
+    } catch {}
+    return { name: d.name, is_dir, size, mtime, mode };
+  });
+  return { entries };
+});
 register("create_file", async (args) => {
   const { path: p10, content, rootPath = "", fallbackRootPaths = [] } = args;
   const fullPath = resolveFilePath(p10, rootPath, fallbackRootPaths);
@@ -52236,106 +52444,6 @@ register("read_file_base64", async (args) => {
   const data = fs10.readFileSync(fullPath);
   return { path: fullPath, base64: data.toString("base64"), bytes: data.length };
 });
-register("search_files", async (args) => {
-  const { pattern, path: p10 = ".", cwd = args.root_path ?? "", head = 100, max_count = 5, glob: globPattern = "", ignore_case = true } = args;
-  const { execSync: execWhich } = await import("child_process");
-  const whichCmd = process.platform === "win32" ? "where" : "which";
-  const which = (bin) => {
-    try {
-      return execWhich(`${whichCmd} ${bin}`, { encoding: "utf-8" }).trim().split(`
-`)[0].trim();
-    } catch {
-      return null;
-    }
-  };
-  let rgPath = which("rg");
-  if (!rgPath) {
-    await ensureTool("rg");
-    rgPath = which("rg");
-  }
-  let searchPath = p10.replace(/^~/, process.env.HOME || "~");
-  if (!path7.isAbsolute(searchPath) && cwd)
-    searchPath = path7.join(cwd, searchPath);
-  searchPath = path7.resolve(searchPath);
-  if (!fs10.existsSync(searchPath))
-    throw new Error(`Search path does not exist: ${searchPath}`);
-  let cmd;
-  if (rgPath) {
-    cmd = [rgPath, "--no-heading", "--line-number", "--color=never"];
-    if (ignore_case)
-      cmd.push("--ignore-case");
-    if (max_count > 0)
-      cmd.push(`--max-count=${max_count}`);
-    if (globPattern)
-      cmd.push("--glob", globPattern);
-    cmd.push(pattern, searchPath);
-  } else {
-    console.warn("[search_files] ripgrep (rg) not found, falling back to grep");
-    const grepPath = which("grep") || "grep";
-    cmd = [grepPath, "-rn", "--color=never"];
-    if (ignore_case)
-      cmd.push("-i");
-    if (max_count > 0)
-      cmd.push(`--max-count=${max_count}`);
-    if (globPattern) {
-      cmd.push(`--include=${globPattern}`);
-    }
-    cmd.push(pattern, searchPath);
-  }
-  const { spawn: spawnChild } = await import("child_process");
-  const { stdout, stderr, code } = await new Promise((resolve) => {
-    const child = spawnChild(cmd[0], cmd.slice(1));
-    let out = "", err2 = "";
-    child.stdout?.on("data", (d) => {
-      out += d.toString();
-    });
-    child.stderr?.on("data", (d) => {
-      err2 += d.toString();
-    });
-    child.on("close", (exitCode) => resolve({ stdout: out, stderr: err2, code: exitCode ?? 1 }));
-  });
-  if (code === 0) {
-    let output = stdout;
-    const lines = output.split(`
-`).filter((l) => l.trim());
-    if (lines.length > head) {
-      output = lines.slice(0, head).join(`
-`) + `
-... (${lines.length - head} more matches truncated)`;
-    }
-    if ((cwd || searchPath) && output) {
-      const searchBase = searchPath && fs10.existsSync(searchPath) && fs10.statSync(searchPath).isDirectory() ? searchPath : path7.dirname(searchPath);
-      const bases = Array.from(new Set([cwd, searchBase].filter(Boolean)));
-      const lines2 = output.split(`
-`).map((line) => {
-        if (line.includes(":")) {
-          const colonIdx = line.indexOf(":");
-          let filePart = line.slice(0, colonIdx);
-          const rest = line.slice(colonIdx);
-          try {
-            const candidates = [filePart, ...bases.map((b) => path7.relative(b, filePart))].filter((p11) => (p11.match(/\.\.\//g) || []).length <= 2);
-            filePart = candidates.reduce((a, b) => a.length <= b.length ? a : b, filePart);
-          } catch {}
-          let fullLine = filePart + rest;
-          if (fullLine.length > 300) {
-            fullLine = fullLine.slice(0, 300) + "...";
-          }
-          return fullLine;
-        }
-        return line;
-      });
-      output = lines2.join(`
-`);
-    }
-    if (output.length > 1e5)
-      output = output.slice(0, 1e5) + `
-... (output truncated)`;
-    return { result: output };
-  }
-  if (code === 1)
-    return { result: "No matches found." };
-  throw new Error(`search error (exit ${code}): ${stderr}`);
-});
 register("download_attachment", async (args, client) => {
   if (!client)
     throw new Error("Client instance required");
@@ -52411,18 +52519,21 @@ register("register_attachment", async (args, client) => {
 
 // src/handlers.ts
 var log3 = (level, ...args) => console.log(`[${level}]`, ...args);
-async function handleBlockExecute(payload, send, edgeId) {
+async function handleBlockExecute(payload, send, edgeId, maxTimeout = 0) {
   const { blockId, messageId = "", content = "", todoId = "", rootPath = "", manual = false } = payload;
   await send(msg.shellBlockStart(todoId, blockId, "execute", messageId));
   try {
-    const timeout = payload.timeout ?? 120;
+    const timeout = Math.max(payload.timeout ?? 120, maxTimeout);
     await executeBlock(blockId, content, send, todoId, messageId, timeout, rootPath, manual, undefined, edgeId);
   } catch (e) {
     await send(msg.blockError(blockId, todoId, e.message));
   }
 }
 async function handleBlockSignal(payload) {
-  interruptBlock(payload.blockId);
+  if (payload.detach)
+    detachBlock(payload.blockId);
+  else
+    interruptBlock(payload.blockId);
 }
 async function handleBlockKeyboard(payload) {
   await sendInput(payload.blockId, payload.content || "");
@@ -52543,8 +52654,8 @@ async function handleCd(payload, send, edgeConfig, onConfigChange) {
   }
 }
 async function handleFileChunkRequest(payload, send, responseType = EA.FILE_CHUNK_RESULT) {
-  const { path: p10 = "", rootPath = "", fallbackRootPaths = [] } = payload;
-  const result = await readFileContent(p10, rootPath, fallbackRootPaths);
+  const { path: p10 = "", rootPath = "", fallbackRootPaths = [], skipSizeLimit = false } = payload;
+  const result = await readFileContent(p10, rootPath, fallbackRootPaths, skipSizeLimit);
   if (result.success) {
     await send(msg.fileChunkResult(responseType, { ...payload, full_path: result.fullPath, content: result.content, content_type: result.contentType }));
   } else {
@@ -52622,6 +52733,7 @@ class TODOforAIEdge {
   edgeId = "";
   userId = "";
   debug;
+  maxTimeout;
   wsUrl;
   fingerprint = "";
   heartbeatTimer;
@@ -52641,6 +52753,7 @@ class TODOforAIEdge {
   constructor(config) {
     this.api = new ApiClient(normalizeApiUrl(config.apiUrl), config.apiKey);
     this.debug = config.debug;
+    this.maxTimeout = config.maxTimeout ?? 0;
     this.wsUrl = getWsUrl(this.api.apiUrl);
     this.addWorkspacePath = config.addWorkspacePath;
     this.browserExtensionBridge = new BrowserExtensionBridge(this.debug);
@@ -52699,10 +52812,16 @@ class TODOforAIEdge {
     try {
       console.log("\x1B[36mStarting device login...\x1B[0m");
       const { code, url, expiresIn } = await this.api.initDeviceLogin("edge");
+      const userCode = new URL(url).searchParams.get("user_code") || "";
+      const formattedCode = userCode.length === 8 ? `${userCode.slice(0, 4)}-${userCode.slice(4)}` : userCode;
       console.log(`
 \x1B[1m\uD83D\uDD11 Open this URL to authorize:\x1B[0m`);
       console.log(`\x1B[36m${url}\x1B[0m
 `);
+      if (formattedCode) {
+        console.log(`\x1B[1m   Your code: \x1B[33m${formattedCode}\x1B[0m
+`);
+      }
       try {
         const { exec } = __require("child_process");
         const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
@@ -52852,7 +52971,7 @@ class TODOforAIEdge {
         run(() => handleCd(payload, send, this.edgeConfig, (u) => this.updateConfig(u)));
         break;
       case FE.BLOCK_EXECUTE:
-        run(() => handleBlockExecute(payload, send, this.edgeId));
+        run(() => handleBlockExecute(payload, send, this.edgeId, this.maxTimeout));
         break;
       case FE.BLOCK_SAVE:
         run(() => handleBlockSave(payload, send));
@@ -53067,22 +53186,75 @@ class ServerError extends Error {
   }
 }
 
+// src/update-notifier.ts
+import fs12 from "node:fs";
+import path9 from "node:path";
+import os9 from "node:os";
+var TTL_MS = 24 * 60 * 60 * 1000;
+var CACHE_DIR = path9.join(os9.homedir(), ".config", "todoforai");
+function cmpVer(a, b) {
+  const pa2 = a.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
+  const pb2 = b.split("-")[0].split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i10 = 0;i10 < Math.max(pa2.length, pb2.length); i10++) {
+    const d = (pa2[i10] ?? 0) - (pb2[i10] ?? 0);
+    if (d)
+      return d;
+  }
+  return 0;
+}
+function checkForUpdates(pkg) {
+  if (!process.stderr.isTTY || process.env.CI || process.env.NO_UPDATE_NOTIFIER)
+    return;
+  const cacheFile = path9.join(CACHE_DIR, `notifier-${encodeURIComponent(pkg.name)}.json`);
+  let cache = {};
+  try {
+    cache = JSON.parse(fs12.readFileSync(cacheFile, "utf8"));
+  } catch {}
+  if (cache.latest && cmpVer(cache.latest, pkg.version) > 0) {
+    process.stderr.write(`
+\x1B[33m  Update available: \x1B[2m${pkg.version}\x1B[22m → \x1B[1m${cache.latest}\x1B[0m
+` + `\x1B[33m  Run:\x1B[0m npm i -g ${pkg.name}
+
+`);
+  }
+  if (Date.now() - (cache.ts ?? 0) > TTL_MS) {
+    try {
+      fs12.mkdirSync(CACHE_DIR, { recursive: true });
+      fs12.writeFileSync(cacheFile, JSON.stringify({ ...cache, ts: Date.now() }));
+    } catch {}
+    fetch(`https://registry.npmjs.org/${pkg.name}/latest`, { signal: AbortSignal.timeout(3000) }).then((r) => r.ok ? r.json() : null).then((j) => {
+      if (!j?.version)
+        return;
+      fs12.writeFileSync(cacheFile, JSON.stringify({ ts: Date.now(), latest: j.version }));
+    }).catch(() => {});
+  }
+}
+
 // src/index.ts
-import fs12 from "fs";
-import path9 from "path";
-import os9 from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import fs13 from "fs";
+import path10 from "path";
+import os10 from "os";
 import crypto3 from "crypto";
+function readOwnPackage() {
+  try {
+    const pkgPath = path10.resolve(fileURLToPath2(import.meta.url), "../../package.json");
+    return JSON.parse(fs13.readFileSync(pkgPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
 function lockPath(apiUrl, userId) {
-  const dir = path9.join(os9.homedir(), ".todoforai");
-  fs12.mkdirSync(dir, { recursive: true });
+  const dir = path10.join(os10.homedir(), ".todoforai");
+  fs13.mkdirSync(dir, { recursive: true });
   const hash = crypto3.createHash("sha256").update(`${apiUrl}
 ${userId}`).digest("hex").slice(0, 12);
-  return path9.join(dir, `edge-${hash}.lock`);
+  return path10.join(dir, `edge-${hash}.lock`);
 }
 function isEdgeProcess(pid) {
   try {
     process.kill(pid, 0);
-    const cmdline = fs12.readFileSync(`/proc/${pid}/cmdline`, "utf-8");
+    const cmdline = fs13.readFileSync(`/proc/${pid}/cmdline`, "utf-8");
     return cmdline.includes("index.ts") || cmdline.includes("todoforai-edge");
   } catch {
     return false;
@@ -53090,7 +53262,7 @@ function isEdgeProcess(pid) {
 }
 function killExistingEdge(lp2) {
   try {
-    const pid = parseInt(fs12.readFileSync(lp2, "utf-8").trim(), 10);
+    const pid = parseInt(fs13.readFileSync(lp2, "utf-8").trim(), 10);
     if (!isNaN(pid) && isEdgeProcess(pid)) {
       console.log(`\x1B[33mKilling existing edge process (pid ${pid})...\x1B[0m`);
       process.kill(pid, "SIGTERM");
@@ -53113,7 +53285,7 @@ function killExistingEdge(lp2) {
 }
 function acquireLock(lp2, kill = false) {
   try {
-    const pid = parseInt(fs12.readFileSync(lp2, "utf-8").trim(), 10);
+    const pid = parseInt(fs13.readFileSync(lp2, "utf-8").trim(), 10);
     if (!isNaN(pid) && isEdgeProcess(pid)) {
       if (kill) {
         killExistingEdge(lp2);
@@ -53121,16 +53293,19 @@ function acquireLock(lp2, kill = false) {
         return false;
     }
   } catch {}
-  fs12.writeFileSync(lp2, String(process.pid));
+  fs13.writeFileSync(lp2, String(process.pid));
   return true;
 }
 function releaseLock(lp2) {
   try {
-    if (fs12.readFileSync(lp2, "utf-8").trim() === String(process.pid))
-      fs12.unlinkSync(lp2);
+    if (fs13.readFileSync(lp2, "utf-8").trim() === String(process.pid))
+      fs13.unlinkSync(lp2);
   } catch {}
 }
 async function main() {
+  const ownPkg = readOwnPackage();
+  if (ownPkg)
+    checkForUpdates(ownPkg);
   const config = await loadConfig();
   if (config.debug) {
     console.log("[config]", { apiUrl: config.apiUrl, debug: config.debug, addWorkspacePath: config.addWorkspacePath });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@todoforai/edge",
-  "version": "0.13.9",
+  "version": "0.13.11",
   "type": "module",
   "bin": {
     "todoforai-edge": "dist/index.js"
@@ -22,8 +22,8 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@types/ws": "^8.5.12",
     "@types/node": "^22.0.0",
+    "@types/ws": "^8.5.12",
     "typescript": "^5.6.0"
   }
 }