@withbuddi/buddi 0.1.0-pre.22 → 0.1.0-pre.24

package/node_modules/@hono/node-server/dist/serve-static.d.cts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.d.mts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.mjs

@@ -76,6 +76,7 @@ const serveStatic = (options = { root: "" }) => {
 		let filename;
 		if (optionPath) filename = optionPath;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",
@@ -100,7 +100,7 @@
     "@types/ws": "^8.18.1",
     "@whatwg-node/fetch": "^0.9.14",
     "eslint": "^9.10.0",
-    "hono": "^4.12.8",
+    "hono": "^4.13.9",
     "np": "^11.2.1",
     "prettier": "^3.2.4",
     "publint": "^0.3.18",
@@ -119,6 +119,7 @@
     "postbuild": "publint",
     "prerelease": "pnpm run build && pnpm run test --run",
     "release": "np --no-publish",
+    "typecheck": "tsc --noEmit",
     "lint": "eslint src test",
     "lint:fix": "eslint src test --fix",
     "format": "prettier --check \"src/**/*.{js,ts}\" \"test/**/*.{js,ts}\"",

package/node_modules/hono/dist/cjs/adapter/bun/websocket.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_helper_websocket_index = require("../../helper/websocket/index.js");
 const require_adapter_bun_server = require("./server.js");
+const require_helper_websocket_index = require("../../helper/websocket/index.js");
 //#region src/adapter/bun/websocket.ts
 /**
 * @internal

package/node_modules/hono/dist/cjs/middleware/language/language.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_utils_accept = require("../../utils/accept.js");
 const require_helper_cookie_index = require("../../helper/cookie/index.js");
+const require_utils_accept = require("../../utils/accept.js");
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/hono/dist/cjs/middleware/serve-static/index.js

@@ -23,6 +23,7 @@ const serveStatic = (options) => {
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = require_utils_url.tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/hono/dist/middleware/language/language.js

@@ -1,5 +1,5 @@
-import { getCookie, setCookie } from "../../helper/cookie/index.js";
 import { parseAccept } from "../../utils/accept.js";
+import { getCookie, setCookie } from "../../helper/cookie/index.js";
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/hono/dist/middleware/serve-static/index.js

@@ -22,6 +22,7 @@ const serveStatic = (options) => {
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/hono/dist/types/middleware/serve-static/index.d.ts

@@ -5,6 +5,8 @@ export type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   precompressed?: boolean;
+  /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   mimes?: Record<string, string>;
   rewriteRequestPath?: (path: string) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.10",
+  "version": "4.13.11",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withbuddi/buddi",
-  "version": "0.1.0-pre.22",
+  "version": "0.1.0-pre.24",
   "type": "module",
   "description": "Your personal agents, on your computer",
   "repository": {
@@ -17,7 +17,7 @@
     "buddi": "packages/install/dist/launcher.js"
   },
   "buddi": {
-    "notes": "### Added\n\n- Installed as an app, buddi opens even when the gateway is out of reach and says what to check, Tailscale or the Mac, then comes back on its own when it answers.\n- A lightbulb on the greeting row opens a section of tip cards on Home: what is due, what was dismissed with a way back, and the switch.\n- Running as an installed app, the owner menu has Reload; after an upgrade it reads Reload to update in any mode.\n- A tip can be previewed on Home with `#/?tip=<id>` (the ids are in the tips rules), touching nothing, so its copy and layout can be checked before its day comes.\n- Home may show one tip a day when something in buddi has gone unused, a second agent, a group, a mission, voice; each is one sentence with one action, 'Not this again' removes it for good, and Settings → Notifications turns tips off.\n- First run has Start over at the foot of every step; what you already connected stays in Settings.\n- Install buddi as an app: browsers offer it, Home suggests it once, and the dashboard opens in its own window with the Blob as its icon.\n- buddi's Blob moves: it breathes on Home and the first-run page, thinks while an agent works in the chat and in the corner button, and on Telegram a thinking-Blob sticker replaces the hourglass until the answer arrives. Reduced-motion settings keep the still.\n- Add a teammate: the Agents page and Home offer a starter team, Scout for research, Planner for your day with a morning brief, Keeper for one domain's history, plus the plugin agents when their plugin is there, each added in one tap through Agent Father. The Groups heading now says what it needs instead of hiding.\n- Settings → Speech: with no language listed, listening and speaking take the one your profile answers in, and the page says \"From your profile: French.\" Plugins read it with `ctx.buddi.owner.language()` (host API 1.5).\n- Settings → Speech: Off as the service for listening or speaking, which keeps that side off even with Whisper or Kokoro installed on this computer.\n- A buddi button in the corner of every page opens a small chat with your front desk over what you are doing, so a quick question needs no page change; `/` opens it too.\n- Plugin pages can draw a small chart, a line or bars with a dashed target line, and a screen reader hears it as a sentence.\n- Goals page: each goal with recorded values shows a chart under its figures, a line over its window or a bar per week for a goal counted per week, with the target dashed.\n- Home: a message folded across agents says who else sent it, \"Finance Advisor · also Mail Triage\".\n- The finance plugin proposes Ledger, a cash-flow advisor with the plugin's tools, skills and its daily check and Friday recap, so installing finance comes with someone to use it; the Add-a-teammate card lights up.\n- Connections: connect a service that speaks MCP, GitHub, Notion, Linear or any remote server, sign in with its own consent page, read every tool it brings and its tier, and give those tools to your agents; each call runs under the same approval cards as everything else.\n- Plugins can add and remove tools while buddi runs (host API 1.6), and a tool may describe its input with JSON Schema; the first user is the coming Connections feature.\n- Connections: when a service changes its tools after your review, the new and changed ones wait while the rest keep working, and Review again shows what changed; a connection that needs a sign-in or a review says so on Home and with the dot on Settings; an unreachable one is retried in the background and says since when.\n- Connections: a tool that asks you first can have its approval remembered for one agent, on the Give screen or the agent's Access page; one the service says destroys something shows why it cannot.\n- Plugins can ask for one picture from a ChatGPT subscription account without seeing its sign-in (host API 1.8, `ctx.buddi.accounts.generateCodexImage`); `withCodexProfile` stays for compatibility and is deprecated. The account listing now carries an HTTP account's address.\n\n### Changed\n\n- The image plugin makes pictures with a ChatGPT subscription directly, without the codex command, and draws with Gemini's Imagen or any service that offers an OpenAI-compatible images endpoint.\n- Your front desk and Agent Father may ask any agent, new ones included, without being added to a list; other agents keep their explicit 'Can ask' list. The Access page shows it and lets you narrow it.\n- The Agents page always shows the starter team under your agents, not behind a button.\n- First run: after your assistant says hello, buddi introduces the phone step before offering Telegram, and the hello no longer ends with a question you cannot answer there.\n- Agent replies share one layout with the moment before them: the agent's mark on the left, then the name and the text; while it works, the mark moves and the text says so in place.\n- Home: what needs you is a deck of cards you read in full and move through with Done, with the list one toggle away; the conversations to continue sit as chips under the composer.\n- The install guide and the computer-control part of the browser guide now say what buddi does, how to set it up, what leaves your machine and where the limits are, instead of reading like a plan.\n- The agent's face in a reply's label is 32 px, per the design kit, so the working Blob is seen in the chat.\n- The Claude and ChatGPT sign-ins share one OAuth module with the refresh discipline written once.\n- Connections declare their service's host like a plugin's network (host API 1.7, `ctx.buddi.network`), so Settings → Plugins lists the services you connected under what leaves your machine. The GitHub card asks for a client id up front, and every card's address was checked; an agent held back for a missing connection says to reconnect it in Settings → Connections.\n\n### Fixed\n\n- A plugin packed with npm installs: buddi no longer lets npm fetch its core package or read a plugin's development links, and the plugin template packs cleanly. Installing never asks npm for a package named @buddi/core.\n- The Connections page in the docs has its title, so withbuddi.com builds again; a test now refuses a docs page without one.\n- A pasted key is tried with one small call before buddi offers the model list, so a wrong Ollama Cloud or compatible key is refused where you typed it, not on the first chat.\n- First run: the Claude sign-in step has a Back button while it waits for the code, so changing your mind is one click.\n- Notifications no longer cover the corner buddi button or its chat: they stack above it, and on a phone they drop from the top.\n- A delegation that came back after you approved something now opens on who was asked, the question, the answer, the files and how long it took, with the raw JSON folded under Details.\n- The same reminder from two agents is one line on Home: a message about the same thing as one from the last two days is folded into it, says \"also from\" the other agent, and reaches your phone once.\n- The queue test for retries past the sixth minute no longer fails now and then on CI: it waits for each failure to be recorded before pulling the retry forward.\n- The chat test for an agent holding a question no longer fails now and then: it waits for the question to be recorded, which happens after the run reports finished.\n- Finance: a statement line that is a pending charge now posting is no longer skipped as a duplicate; it settles the pending row, also when the posted line reads differently or is dated up to two days earlier. A deleted row never counts as already imported.\n- Home's update notice reads on one line.\n- The Gemini card starts a free Google AI key on the newest Flash when Google refuses Pro, and says why in plain words; a rate-limit answer from any provider now reads as a sentence about the key and the model, not about responses.\n- The moving Blob is drawn at a size where the motion shows: avatar-sized in the chat's thinking line and on first run, larger in the corner button."
+    "notes": "### Added\n\n- Settings → Plugins has a Browse tab: the plugin list from withbuddi.com, fetched only when you open it and kept a day, as one grid of cards with each listing's icon behind a search and filter chips (All, Recommended — what buddi publishes that you do not have — and each category). A card opens a sheet with its screenshot, its tools, the hosts it talks to, what it reaches in buddi, its dependencies and its licence; the icons and screenshots come through buddi, never straight from the page. Install stages the listed version onto the usual card.\n- A newer version listed on withbuddi.com shows as \"Update to <version>\" in Browse and on the installed plugin's row, once Browse has been opened.\n- \"A directory I built\" has a Browse… button: it lists the folders under your home directory on the computer buddi runs on, marks the ones with a package.json, and fills the field with the one you choose.\n- A link to `#/settings/plugins?install=<npm name>@<version>`, which withbuddi.com's \"Install in buddi\" opens, stages that version at once.\n- `buddi plugins describe <spec> [--json]` stages a plugin, reads its manifest, prints what it brings and deletes the stage; `--json` is what a market listing's claims are made of.\n- A Home tip points at Browse on an installation with none of the recommended plugins.\n\n### Changed\n\n- Settings → Plugins is redrawn from the design kit: one \"Add a plugin\" panel with the trust sentence under the field, the staged card with its facts beside what the package says about itself, installed plugins as compact rows (status, Update, Open and a ⋯ menu) that open a detail sheet, and \"Ships with buddi\" folded. Disable and Remove ask in a small dialog; Remove offers \"Disable instead\".\n- An installed plugin's row offers an Update only when withbuddi.com lists a newer version; its detail sheet has \"Check for an update\" otherwise.\n\n### Fixed\n\n- Disabling or enabling a plugin takes effect at once, no restart: its pages leave the rail, its tools leave the agents, its watchers stop."
   },
   "files": [
     "packages",