@trops/dash-core 0.1.411 → 0.1.413

package/dist/electron/index.js

@@ -51663,15 +51663,26 @@ const cliController$2 = {
 
     // Auto-wire the hosted Dash MCP server so the assistant can use Dash
     // tools (apply_theme, create_dashboard, add_widget, etc.) without
-    // the user running `claude mcp add dash ...` themselves. We pass an
-    // inline --mcp-config every spawn; merges with any user-configured
-    // MCPs so their other tools (github, slack, etc.) remain available.
+    // the user running `claude mcp add dash ...` themselves. We write
+    // the JSON to a short-lived temp file and pass its path via
+    // --mcp-config; merges with any user-configured MCPs so their
+    // other tools (github, slack, etc.) remain available.
+    //
+    // We use a file, not inline JSON, because the inline form is
+    // fragile on Windows: shell:true hands the arg to cmd.exe which
+    // tokenizes on embedded whitespace inside the JSON (notably in
+    // "Authorization: Bearer <UUID>" and the URL). Even with proper
+    // windowsQuote escaping, cmd.exe's `""` handling inside /d /s /c
+    // drops tokens — the user sees "MCP config file not found" with
+    // fragments of the JSON prepended to cwd. Writing the JSON to a
+    // file avoids every layer of that problem.
     //
     // Prereqs: the Dash MCP server is running and has issued a bearer
     // token. If either is missing (server disabled, first launch before
     // auto-start completes), we silently skip — the assistant still
     // works for non-Dash queries, and the setup banner remains visible
     // as a manual fallback.
+    let mcpConfigFilePath = null;
     try {
       const mcpDashServerController = mcpDashServerController_1;
       const status = mcpDashServerController.getStatus?.(win);
@@ -51694,7 +51705,18 @@ const cliController$2 = {
               },
             },
           });
-          args.push("--mcp-config", mcpConfig);
+          const os = require("os");
+          const path = require("path");
+          const fs = require("fs");
+          // Unique per-request filename so concurrent assistant calls
+          // don't race on the same file. The token is sensitive, so
+          // mode 0600 — owner read/write only.
+          mcpConfigFilePath = path.join(
+            os.tmpdir(),
+            `dash-mcp-config-${requestId}.json`,
+          );
+          fs.writeFileSync(mcpConfigFilePath, mcpConfig, { mode: 0o600 });
+          args.push("--mcp-config", mcpConfigFilePath);
         }
       }
     } catch (err) {
@@ -51705,6 +51727,19 @@ const cliController$2 = {
       );
     }
 
+    // Best-effort cleanup of the temp MCP config file. Called from
+    // both child exit handlers and the outer catch. Safe to call
+    // multiple times — becomes a no-op after the first unlink.
+    const cleanupMcpConfigFile = () => {
+      if (!mcpConfigFilePath) return;
+      try {
+        require("fs").unlinkSync(mcpConfigFilePath);
+      } catch {
+        // File may already be gone; ignore.
+      }
+      mcpConfigFilePath = null;
+    };
+
     if (model) {
       args.push("--model", model);
     }
@@ -51908,6 +51943,7 @@ const cliController$2 = {
       });
 
       child.on("error", (err) => {
+        cleanupMcpConfigFile();
         activeProcesses.delete(requestId);
         safeSend(win, LLM_STREAM_ERROR$2, {
           requestId,
@@ -51917,6 +51953,7 @@ const cliController$2 = {
       });
 
       child.on("close", (code) => {
+        cleanupMcpConfigFile();
         activeProcesses.delete(requestId);
 
         // Process any remaining buffer
@@ -51980,6 +52017,7 @@ const cliController$2 = {
         }
       });
     } catch (err) {
+      cleanupMcpConfigFile();
       activeProcesses.delete(requestId);
       safeSend(win, LLM_STREAM_ERROR$2, {
         requestId,
@@ -63429,6 +63467,29 @@ function extractEventWiring$1(layout) {
   return wiring;
 }
 
+/**
+ * Strip a `<scope>/` or `@<scope>/` prefix from a potentially-scoped
+ * package name. Widgets installed from the registry carry
+ * `w.name = "@scope/pkg"` alongside `w.scope = "scope"`; downstream
+ * code builds `${scope}/${packageName}` for display and for registry
+ * keys, so `packageName` must be the bare name or the scope doubles
+ * (e.g. `@trops/@ai-built/pipeline` instead of `@trops/pipeline`).
+ *
+ * @param {string} fullName Potentially scoped (e.g. "@ai-built/pipeline" or "ai-built/pipeline")
+ * @param {string} scope    Scope to strip (e.g. "ai-built" or "@ai-built")
+ * @returns {string} The bare package name
+ */
+function stripScopePrefix(fullName, scope) {
+  if (!fullName) return fullName || "";
+  if (!scope) return fullName;
+  const bareScope = scope.startsWith("@") ? scope.slice(1) : scope;
+  const variants = [`@${bareScope}/`, `${bareScope}/`];
+  for (const v of variants) {
+    if (fullName.startsWith(v)) return fullName.slice(v.length);
+  }
+  return fullName;
+}
+
 /**
  * Build the widget dependencies array from component names and
  * installed widget metadata.
@@ -63470,7 +63531,9 @@ function buildWidgetDependencies$1(
       for (const w of installedWidgets) {
         if (w.componentNames && w.componentNames.includes(name)) {
           if (!scope && w.scope) scope = w.scope;
-          if (!packageName || packageName === name) packageName = w.name || "";
+          if (!packageName || packageName === name) {
+            packageName = stripScopePrefix(w.name, w.scope || scope) || "";
+          }
           version = w.version || "*";
           author =
             typeof w.author === "string" ? w.author : w.author?.name || "";
@@ -63483,8 +63546,9 @@ function buildWidgetDependencies$1(
     if (componentConfigs && componentConfigs[name]) {
       const config = componentConfigs[name];
       if (!scope && config.scope) scope = config.scope;
-      if ((!packageName || packageName === name) && config.packageName)
-        packageName = config.packageName;
+      if ((!packageName || packageName === name) && config.packageName) {
+        packageName = stripScopePrefix(config.packageName, scope);
+      }
       if (config.id && !scope) {
         const idParts = config.id.split(".");
         if (idParts.length === 3) {
@@ -73155,7 +73219,38 @@ async function prepareWidgetForPublish$1(appId, packageId, options = {}) {
       }
     }
 
-    // 5. Build manifest using the widget's component configs. The
+    // 5. Normalize dash.json's author field. The AI Widget Builder
+    //    scaffolds new @ai-built/* widgets with `author: "AI Assistant"`
+    //    as the placeholder, which ships unchanged to the registry and
+    //    is what installers see under the package's author — regardless
+    //    of who actually published it. If dash.json exists and its
+    //    author is blank or that placeholder, rewrite with the
+    //    publisher's registry display name (or username) before we zip
+    //    the package. Any other user-set author is preserved.
+    const authorOverride =
+      (options.authorName && options.authorName.trim()) ||
+      profile?.displayName ||
+      profile?.username ||
+      "";
+    if (authorOverride && fs.existsSync(dashJsonPath)) {
+      try {
+        const dashJson = JSON.parse(fs.readFileSync(dashJsonPath, "utf8"));
+        const current = (dashJson.author || "").trim();
+        const isPlaceholder = !current || current === "AI Assistant";
+        if (isPlaceholder && dashJson.author !== authorOverride) {
+          dashJson.author = authorOverride;
+          fs.writeFileSync(
+            dashJsonPath,
+            JSON.stringify(dashJson, null, 2) + "\n",
+          );
+        }
+      } catch {
+        // Best-effort only — a malformed dash.json will surface later
+        // during manifest generation with a clearer error.
+      }
+    }
+
+    // 6. Build manifest using the widget's component configs. The
     //    registry cache may be missing widgets (orphaned / locally-
     //    registered packages), so fall back to scanning the package's
     //    .dash.js files from disk.
@@ -73179,24 +73274,27 @@ async function prepareWidgetForPublish$1(appId, packageId, options = {}) {
       tags: options.tags,
       icon: options.icon,
       category: options.category,
-      authorName: options.authorName,
+      // Prefer the caller-supplied authorName; otherwise fall back to
+      // the publisher's registry profile so the manifest author matches
+      // the (now-rewritten) dash.json we just zipped.
+      authorName: options.authorName || authorOverride || undefined,
       appOrigin: appId,
     });
 
-    // 6. Zip the widget directory to a temp file
+    // 7. Zip the widget directory to a temp file
     const zipName = `widget-${manifest.scope}-${manifest.name}-v${manifest.version}.zip`;
     const zipPath = path.join(app.getPath("temp"), zipName);
     const zip = new AdmZip();
     addDirToZip(zip, widget.path);
     zip.writeZip(zipPath);
 
-    // 7. Publish to registry
+    // 8. Publish to registry
     const registryResult = await registryApiController$1.publishToRegistry(
       zipPath,
       manifest,
     );
 
-    // 8. On failure: revert package.json (if we bumped) and surface details
+    // 9. On failure: revert package.json (if we bumped) and surface details
     if (!registryResult.success) {
       if (newVersion !== previousVersion) {
         try {