@trops/dash-core 0.1.382 → 0.1.384

package/dist/electron/index.js

@@ -18,7 +18,8 @@ var require$$8$1 = require('https');
 var require$$0$6 = require('@modelcontextprotocol/sdk/client/index.js');
 var require$$1$4 = require('@modelcontextprotocol/sdk/client/stdio.js');
 var require$$0$5 = require('pkce-challenge');
-var require$$6$1 = require('child_process');
+var require$$5$1 = require('os');
+var require$$7 = require('child_process');
 var require$$2$2 = require('algoliasearch');
 var require$$3$3 = require('node:path');
 var require$$0$7 = require('openai');
@@ -28,7 +29,6 @@ var require$$1$5 = require('crypto');
 var require$$0$8 = require('http');
 var require$$1$6 = require('http2');
 var require$$2$3 = require('node-forge');
-var require$$2$5 = require('os');
 var require$$3$4 = require('adm-zip');
 var require$$4$1 = require('url');
 var require$$2$4 = require('vm');
@@ -25629,6 +25629,7 @@ const {
 } = streamableHttp$1;
 const path$c = require$$1$2;
 const fs$8 = require$$0$2;
+const os = require$$5$1;
 const responseCache$2 = responseCache_1;
 
 /**
@@ -25676,6 +25677,8 @@ function isReadOnlyTool(toolName) {
  */
 const DEFAULT_TOOL_CACHE_TTL = 5000;
 
+const IS_WINDOWS$1 = process.platform === "win32";
+
 /**
  * Cached shell PATH result (resolved once, reused for all spawns).
  */
@@ -25712,11 +25715,21 @@ function isNodeEsmError(errorText) {
 function getShellPath$1() {
   if (_shellPath$1 !== null) return _shellPath$1;
 
-  const { execSync } = require$$6$1;
+  // Windows: skip the POSIX shell-path discovery entirely. The nvm /
+  // homebrew / volta fallback dirs below are *nix-specific, and
+  // Windows Electron apps typically inherit a working PATH from the
+  // launcher. Users managing Node via nvm-windows or fnm should
+  // already have their shims on PATH.
+  if (IS_WINDOWS$1) {
+    _shellPath$1 = process.env.PATH || "";
+    return _shellPath$1;
+  }
+
+  const { execSync } = require$$7;
   const fallbackDirs = ["/usr/local/bin", "/opt/homebrew/bin"];
 
   // Scan nvm versions, tracking both latest and best compatible version
-  const home = process.env.HOME || "";
+  const home = os.homedir();
   let compatibleNvmBin = null;
   if (home) {
     fallbackDirs.push(`${home}/.volta/bin`);
@@ -25855,7 +25868,7 @@ function interpolate$1(template, credentials) {
  * @param {object} tokenRefresh { credentialsPath, oauthKeysPath }
  */
 async function refreshGoogleOAuthToken(tokenRefresh) {
-  const home = process.env.HOME || "";
+  const home = os.homedir();
   const credPath = tokenRefresh.credentialsPath.replace(/^~/, home);
   const keysPath = tokenRefresh.oauthKeysPath.replace(/^~/, home);
 
@@ -26051,7 +26064,7 @@ const mcpController$2 = {
           // Merge static env vars from mcpConfig (with ~ expansion)
           if (mcpConfig.staticEnv) {
             Object.entries(mcpConfig.staticEnv).forEach(([envVar, value]) => {
-              env[envVar] = value.replace(/^~/, process.env.HOME || "");
+              env[envVar] = value.replace(/^~/, os.homedir());
             });
           }
 
@@ -26542,7 +26555,7 @@ const mcpController$2 = {
    * @returns {{ success } | { error, message }}
    */
   runAuth: async (win, mcpConfig, credentials, authCommand) => {
-    const { spawn } = require$$6$1;
+    const { spawn } = require$$7;
 
     const env = cleanEnvForChildProcess();
 
@@ -26551,7 +26564,7 @@ const mcpController$2 = {
       const { from, to } = authCommand.setup.copyCredential;
       const sourcePath = credentials?.[from];
       if (sourcePath) {
-        const destPath = to.replace(/^~/, process.env.HOME || "");
+        const destPath = to.replace(/^~/, os.homedir());
         const destDir = require$$1$2.dirname(destPath);
         try {
           fs$8.mkdirSync(destDir, { recursive: true });
@@ -26586,7 +26599,7 @@ const mcpController$2 = {
     // Merge static env vars from authCommand with ~ expansion
     if (authCommand.staticEnv) {
       Object.entries(authCommand.staticEnv).forEach(([key, value]) => {
-        env[key] = value.replace(/^~/, process.env.HOME || "");
+        env[key] = value.replace(/^~/, os.homedir());
       });
     }
 
@@ -26602,6 +26615,8 @@ const mcpController$2 = {
       const proc = spawn(authCommand.command, resolvedArgs, {
         env,
         stdio: ["ignore", "pipe", "pipe"],
+        // Needed so Windows can launch .cmd/.bat wrappers (npx.cmd, etc).
+        shell: IS_WINDOWS$1,
       });
 
       let stdout = "";
@@ -28149,7 +28164,7 @@ var pluginController_1 = pluginController$1;
  * can use the Chat widget without a separate API key.
  */
 
-const { spawn, execSync } = require$$6$1;
+const { spawn, execSync } = require$$7;
 const {
   LLM_STREAM_DELTA: LLM_STREAM_DELTA$2,
   LLM_STREAM_TOOL_CALL: LLM_STREAM_TOOL_CALL$2,
@@ -28158,6 +28173,8 @@ const {
   LLM_STREAM_ERROR: LLM_STREAM_ERROR$2,
 } = llmEvents$1;
 
+const IS_WINDOWS = process.platform === "win32";
+
 /**
  * Cached shell PATH result (resolved once, reused for all spawns).
  * Same pattern as mcpController.js.
@@ -28167,6 +28184,13 @@ let _shellPath = null;
 function getShellPath() {
   if (_shellPath !== null) return _shellPath;
 
+  // Windows: no POSIX login-shell trick — just use the inherited PATH,
+  // which is typically correct for GUI-launched Electron apps.
+  if (IS_WINDOWS) {
+    _shellPath = process.env.PATH || "";
+    return _shellPath;
+  }
+
   try {
     const shell = process.env.SHELL || "/bin/bash";
     _shellPath = execSync(`${shell} -ilc 'echo -n "$PATH"'`, {
@@ -28181,7 +28205,7 @@ function getShellPath() {
 }
 
 /**
- * Cached CLI binary path (resolved once via `which claude`).
+ * Cached CLI binary path (resolved once via `which` / `where`).
  */
 let _cliBinaryPath = undefined; // undefined = not yet checked
 
@@ -28190,11 +28214,21 @@ function resolveCliBinary() {
 
   try {
     const fullPath = getShellPath();
-    _cliBinaryPath = execSync("which claude", {
+    // `where` on Windows, `which` everywhere else. `where` may list
+    // multiple matches on separate lines (e.g. claude.cmd + claude.ps1)
+    // — take the first hit.
+    const lookup = IS_WINDOWS ? "where claude" : "which claude";
+    const result = execSync(lookup, {
       encoding: "utf8",
       timeout: 5000,
       env: { ...process.env, PATH: fullPath },
-    }).trim();
+    });
+    _cliBinaryPath = IS_WINDOWS
+      ? result
+          .split(/\r?\n/)
+          .find((l) => l.trim())
+          ?.trim() || null
+      : result.trim();
   } catch {
     _cliBinaryPath = null;
   }
@@ -28208,6 +28242,33 @@ function resolveCliBinary() {
  */
 const activeProcesses = new Map();
 
+/**
+ * Kill a child process and its descendants. On Windows, spawning with
+ * shell:true (needed for .cmd targets) means child.kill() only
+ * terminates the cmd.exe — the real CLI keeps running. Use taskkill
+ * with /T (tree) /F (force) to clean up.
+ */
+function killChildTree(child) {
+  if (!child || child.killed || typeof child.pid !== "number") return;
+  if (IS_WINDOWS) {
+    try {
+      execSync(`taskkill /pid ${child.pid} /T /F`, {
+        stdio: "ignore",
+        timeout: 5000,
+      });
+    } catch {
+      // Fall back to plain kill — best-effort
+      try {
+        child.kill();
+      } catch {
+        /* ignore */
+      }
+    }
+  } else {
+    child.kill("SIGTERM");
+  }
+}
+
 /**
  * Session IDs for conversation continuity.
  * Map<widgetUuid, sessionId>
@@ -28269,11 +28330,21 @@ const cliController$2 = {
     // to — causing long reasoning loops or silent hangs. We pass only the
     // caller's `systemPrompt` as context.
     //
+    // --permission-mode bypassPermissions: in an embedded in-app assistant,
+    // the user has already opted into the configured MCP servers (they
+    // ran `claude mcp add` themselves). Prompting for tool-use approval
+    // on every call produces "I need permission to..." replies instead of
+    // actual actions. Bypassing matches the user's intent — if they
+    // didn't want the assistant to use a tool, they wouldn't have
+    // configured it.
+    //
     // (We intentionally avoid `--bare` — it also disables keychain reads,
     // which breaks OAuth login for users authenticated via `claude login`.)
     const args = [
       "-p",
       "--disable-slash-commands",
+      "--permission-mode",
+      "bypassPermissions",
       "--output-format",
       "stream-json",
       "--verbose",
@@ -28319,6 +28390,10 @@ const cliController$2 = {
       const spawnOpts = {
         env: { ...process.env, PATH: fullPath },
         stdio: ["pipe", "pipe", "pipe"],
+        // On Windows, the Claude CLI is typically installed as claude.cmd
+        // (a batch wrapper). Node's child_process.spawn can't launch .cmd
+        // files directly without a shell — ENOENT otherwise.
+        shell: IS_WINDOWS,
       };
       if (cwd) {
         const fs = require("fs");
@@ -28523,7 +28598,7 @@ const cliController$2 = {
   abortRequest: (requestId) => {
     const child = activeProcesses.get(requestId);
     if (child) {
-      child.kill("SIGTERM");
+      killChildTree(child);
       activeProcesses.delete(requestId);
       return { success: true };
     }
@@ -28580,7 +28655,7 @@ const cliController$2 = {
     // Kill any active processes for this widget
     for (const [reqId, child] of activeProcesses) {
       if (reqId.startsWith(widgetUuid)) {
-        child.kill("SIGTERM");
+        killChildTree(child);
         activeProcesses.delete(reqId);
       }
     }
@@ -28631,7 +28706,7 @@ const dashboardTools$1 = [
   {
     name: "create_dashboard",
     description:
-      "Create a new dashboard with the given name. Optionally provide a layout to create a grid dashboard. Returns the dashboard ID. After creating, use search_widgets or list_widgets to find widgets, then add_widget to populate the dashboard.",
+      "Create a new dashboard with the given name. Defaults to a 1×1 grid layout if `layout` is omitted — the resulting dashboard has a single cell ready for a widget. Pass an explicit `layout` object to use different dimensions. Pass `layout: null` only if the caller specifically wants a layout-less container dashboard (rare — widgets cannot be added without further editing). Returns the dashboard ID.",
     inputSchema: {
       type: "object",
       properties: {
@@ -49252,6 +49327,7 @@ var jsonSchemaToZod_1 = { jsonSchemaToZod: jsonSchemaToZod$1, jsonSchemaProperty
 
 const https$2 = require$$8$1;
 const { randomUUID } = require$$1$5;
+const { BrowserWindow } = require$$0$1;
 const { McpServer } = mcp;
 const {
   StreamableHTTPServerTransport,
@@ -49260,6 +49336,52 @@ const {
 const settingsController$3 = settingsController_1;
 const { getOrCreateCert } = tlsCert;
 
+// Tool-name prefixes that indicate a mutation. After a successful call
+// to any of these, the renderer is notified via "dash-mcp:state-changed"
+// so it can refresh the relevant UI slice (themes, dashboards, widgets,
+// providers, etc.) without requiring a manual reload.
+const MUTATING_PREFIXES = [
+  "create_",
+  "add_",
+  "remove_",
+  "delete_",
+  "update_",
+  "apply_",
+  "install_",
+  "move_",
+  "set_",
+  "configure_",
+];
+
+function isMutatingTool(name) {
+  return MUTATING_PREFIXES.some((p) => name.startsWith(p));
+}
+
+function broadcastStateChanged(toolName, result) {
+  // Best-effort parse of the tool's first text content block. MCP tool
+  // results are of shape { content: [{ type: "text", text: "<json>" }] }.
+  // Expose the parsed JSON as `result` so renderers can act on specifics
+  // (e.g. the new dashboard ID from create_dashboard) without a round
+  // trip back to fetch state.
+  let parsed = null;
+  try {
+    const firstText = result?.content?.find?.((c) => c.type === "text")?.text;
+    if (firstText) parsed = JSON.parse(firstText);
+  } catch {
+    /* leave null */
+  }
+  const payload = { toolName, result: parsed };
+  for (const win of BrowserWindow.getAllWindows()) {
+    if (!win.isDestroyed()) {
+      try {
+        win.webContents.send("dash-mcp:state-changed", payload);
+      } catch {
+        /* ignore */
+      }
+    }
+  }
+}
+
 // --- State ---
 let mcpServer = null;
 let httpsServer = null;
@@ -49343,14 +49465,22 @@ const { jsonSchemaToZod } = jsonSchemaToZod_1;
 function applyRegistrations(server) {
   for (const tool of registeredTools) {
     const zodSchema = jsonSchemaToZod(tool.inputSchema);
+    // Wrap mutating tool handlers so a successful invocation broadcasts
+    // "dash-mcp:state-changed" to all renderer windows. Read-only tools
+    // (list_, get_, search_) are passed through unwrapped.
+    const mutating = isMutatingTool(tool.name);
+    const handler = mutating
+      ? async (...args) => {
+          const result = await tool.handler(...args);
+          if (result && !result.isError) {
+            broadcastStateChanged(tool.name, result);
+          }
+          return result;
+        }
+      : tool.handler;
     // server.tool() expects a raw Zod shape (e.g. { name: z.string() }),
     // NOT a z.object() wrapper. Extract .shape from the Zod object.
-    server.tool(
-      tool.name,
-      tool.description,
-      zodSchema.shape || {},
-      tool.handler,
-    );
+    server.tool(tool.name, tool.description, zodSchema.shape || {}, handler);
   }
   for (const resource of registeredResources) {
     server.resource(
@@ -50645,7 +50775,7 @@ var schedulerController_1 = schedulerController$2;
 (function (module) {
 	const fs = require$$0$2;
 	const path = require$$1$2;
-	const os = require$$2$5;
+	const os = require$$5$1;
 	const AdmZip = require$$3$4;
 	const { fileURLToPath } = require$$4$1;
 	const { app, ipcMain, BrowserWindow } = require$$0$1;
@@ -58871,6 +59001,17 @@ async function handleCreateDashboard$1({ name, layout }) {
     };
   }
 
+  // Default to a 1×1 grid when the caller omits `layout`. A bare
+  // container dashboard has no grid cells, so widgets can't be added
+  // without further editing — even a single-cell grid avoids that
+  // dead-end while staying unopinionated about layout. Callers that
+  // want a specific size pass an explicit `layout` object. Callers
+  // that genuinely want a layout-less container must pass
+  // `layout: null` explicitly.
+  if (layout === undefined) {
+    layout = { rows: 1, cols: 1 };
+  }
+
   // Validate optional layout parameter
   if (layout !== undefined && layout !== null) {
     if (typeof layout !== "object" || Array.isArray(layout)) {
@@ -74759,6 +74900,23 @@ const mcpDashServerApi$2 = {
    * @returns {Promise<string>}
    */
   getToken: () => ipcRenderer$3.invoke(MCP_DASH_SERVER_GET_TOKEN, {}),
+
+  /**
+   * Subscribe to state-change notifications fired after any mutating
+   * MCP tool call (create_*, add_*, apply_*, remove_*, update_*,
+   * move_*, configure_*, set_*, delete_*, install_*). The callback
+   * receives { toolName }. Use this to refresh renderer state (theme,
+   * dashboards, widgets, providers) so MCP-driven changes are
+   * reflected in the UI without requiring a manual reload.
+   *
+   * @param {(payload: { toolName: string }) => void} callback
+   * @returns {() => void} unsubscribe function
+   */
+  onStateChanged: (callback) => {
+    const handler = (_event, payload) => callback(payload);
+    ipcRenderer$3.on("dash-mcp:state-changed", handler);
+    return () => ipcRenderer$3.removeListener("dash-mcp:state-changed", handler);
+  },
 };
 
 var mcpDashServerApi_1 = mcpDashServerApi$2;