@withbuddi/buddi 0.1.0-pre.23 → 0.1.0-pre.25

package/node_modules/@hono/node-server/dist/serve-static.d.cts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.d.mts

@@ -8,7 +8,8 @@ type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   index?: string;
-  precompressed?: boolean;
+  precompressed?: boolean; /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   rewriteRequestPath?: (path: string, c: Context<E>) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;
   onNotFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/@hono/node-server/dist/serve-static.mjs

@@ -76,6 +76,7 @@ const serveStatic = (options = { root: "" }) => {
 		let filename;
 		if (optionPath) filename = optionPath;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/@hono/node-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.mjs",
   "type": "module",
@@ -100,7 +100,7 @@
     "@types/ws": "^8.18.1",
     "@whatwg-node/fetch": "^0.9.14",
     "eslint": "^9.10.0",
-    "hono": "^4.12.8",
+    "hono": "^4.13.9",
     "np": "^11.2.1",
     "prettier": "^3.2.4",
     "publint": "^0.3.18",
@@ -119,6 +119,7 @@
     "postbuild": "publint",
     "prerelease": "pnpm run build && pnpm run test --run",
     "release": "np --no-publish",
+    "typecheck": "tsc --noEmit",
     "lint": "eslint src test",
     "lint:fix": "eslint src test --fix",
     "format": "prettier --check \"src/**/*.{js,ts}\" \"test/**/*.{js,ts}\"",

package/node_modules/hono/dist/cjs/adapter/bun/websocket.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_helper_websocket_index = require("../../helper/websocket/index.js");
 const require_adapter_bun_server = require("./server.js");
+const require_helper_websocket_index = require("../../helper/websocket/index.js");
 //#region src/adapter/bun/websocket.ts
 /**
 * @internal

package/node_modules/hono/dist/cjs/middleware/language/language.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_utils_accept = require("../../utils/accept.js");
 const require_helper_cookie_index = require("../../helper/cookie/index.js");
+const require_utils_accept = require("../../utils/accept.js");
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/hono/dist/cjs/middleware/serve-static/index.js

@@ -23,6 +23,7 @@ const serveStatic = (options) => {
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = require_utils_url.tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/hono/dist/middleware/language/language.js

@@ -1,5 +1,5 @@
-import { getCookie, setCookie } from "../../helper/cookie/index.js";
 import { parseAccept } from "../../utils/accept.js";
+import { getCookie, setCookie } from "../../helper/cookie/index.js";
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/hono/dist/middleware/serve-static/index.js

@@ -22,6 +22,7 @@ const serveStatic = (options) => {
 		let filename;
 		if (options.path) filename = options.path;
 		else try {
+			if (!options.allowPercentInPath && c.req.path.includes("%")) throw new Error();
 			filename = tryDecodeURI(c.req.path);
 			if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) throw new Error();
 		} catch {

package/node_modules/hono/dist/types/middleware/serve-static/index.d.ts

@@ -5,6 +5,8 @@ export type ServeStaticOptions<E extends Env = Env> = {
   root?: string;
   path?: string;
   precompressed?: boolean;
+  /** Allow percent signs in the routed request path. Defaults to false. */
+  allowPercentInPath?: boolean;
   mimes?: Record<string, string>;
   rewriteRequestPath?: (path: string) => string;
   onFound?: (path: string, c: Context<E>) => void | Promise<void>;

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.10",
+  "version": "4.13.11",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withbuddi/buddi",
-  "version": "0.1.0-pre.23",
+  "version": "0.1.0-pre.25",
   "type": "module",
   "description": "Your personal agents, on your computer",
   "repository": {
@@ -17,7 +17,7 @@
     "buddi": "packages/install/dist/launcher.js"
   },
   "buddi": {
-    "notes": "### Added\n\n- A plugin says who made it: the install card and the Plugins page show the author from its manifest.\n- Disable a plugin without removing it: its tools, pages and watchers stop, its data stays, its missions pause, and agents that use it carry on without those tools.\n- A Weather page in the rail: today by the hour, the week, and ten days ahead, per place, drawn from the design kit; plugin pages can show tiles, a hero and a two-series chart.\n- Plugin pages can show a calendar: week, month and list views drawn from the design kit; the Calendar page uses it.\n- Focus modes for notifications: Do not disturb or Urgent only, for an hour, until tomorrow or until you turn it off, from the owner menu or /focus on Telegram, plus schedules that replace quiet hours; when a focus ends, one message says what waited.\n- An agent's tool grant can end in `?` (`weather.*?`) to mean \"if provided\": a family no installed plugin provides is skipped instead of holding the agent back.\n- Planner's morning brief reads today's weather for your home place and today's meetings with their gaps when the Weather and Calendar plugins are installed, then ends with what to do first; without them it leaves those lines out and never mentions them. A Planner added earlier gains this by adding `weather.*?, calendar.*?` to its tools.\n- Plugins can keep a private link, such as a calendar's secret ICS address, as an owner secret they fetch without ever reading it (host API 1.9, `auth: { secret, as: 'url' }`, kind `http.url`).\n- Plugins can draw results as tiles on the canvas and add a one-line glance next to Home's greeting; Weather shows its forecast as daily tiles and the temperature at home beside the date, and Calendar your next meeting.\n- A Calendar page in the rail shows today and the week ahead from your linked calendars.\n- Settings → Appearance chooses which plugin pages sit in the rail.\n\n### Changed\n\n- Weather's Today view is one panel: the day's chart with its values written on it and the hourly strip below share one highlight when you hover or pick an hour.\n- `buddi plugins init` writes a plugin whose manifest version is read from its package.json (`src/version.ts`), so the installed card can no longer show a stale version.\n- `buddi speech install` downloads through an `http` area of its own, with the same address rules as the gateway, refusing any host the speech plugin does not declare.\n- Until 0.1.0, pre-releases are installed with plain `npm install -g @withbuddi/buddi`; the `next` tag is only meaningful after 0.1.0.\n- After buddi restarts on a new build, the dashboard knows within seconds and reloads itself when you are not in the middle of something."
+    "notes": "### Fixed\n\n- Right after a device-code sign-in, a connection could briefly read \"done\" beside \"not signed in\", because the page read the connection before the sign-in landed and its state after. The state is now taken first, and a stale read no longer overwrites a fresher cached connection.\n- A connection's idle clock started when a request began, so a slow first start or a long call could be stopped under itself. It now starts only when the last request ends.\n- Once a connection was given to agents there was no way to change who holds it. Its sheet now has Change beside \"Held by\": tick an agent to give it the tools, untick one to take them away, in one save.\n- The floating Buddi button covered the footer of sheets and dialogs. It steps aside while one is open.\n- A catalog service could be connected only once from the page. Its sheet now offers \"Add another account\" through the same sign-in, and rows with the same name show their name in buddi.\n- The approval on the canvas repeated the raw tool name three times, shouted its state, and wedged its buttons under it. It now reads like the dock: the action in words, a status pill and the expiry in a short head, the preview as its body, and the decision on the right with Approve last; the raw tool name is in the envelope's details.\n- The approval card for a connected service's tool showed its arguments as raw, cut-off JSON. It now says what the call does and where, then one short line per argument; the exact arguments stay on the envelope beside it.\n- A question that needed a link to answer (a sign-in page, an approval code) could reach the owner without the link, which sat in a tool result they never see. Agents are now told to put the link and the code in the question itself, and the question card makes https links clickable.\n- Agents on Claude Sonnet 5.5, Opus 5.5 and other current Claude models failed every run with \"provider rejected the request as invalid\", because thinking was still asked for with a token budget. buddi now sends adaptive thinking to Claude 4.6 and later, `between_tools` to turn it off on Sonnet 5.5, and nothing on models where it cannot be turned off.\n- A model account could not be removed while an agent that had since been deleted was still recorded against it. A deleted agent no longer counts as using an account, the account list stops counting it, and removing the account clears what it left behind.\n- Restoring a backup into a packaged install failed on the mail tables (a thread points at its last message, a message at its thread) because an ordinary database role cannot switch off foreign-key checks and no table order satisfies a cycle. The restore now holds those keys off during the load and adds them back before the commit, which re-checks every row.\n- The extension knocks on buddi's HTTP side before each reconnect and opens the socket only when something answers, so a buddi that is off or restarting no longer fills chrome://extensions' error list with refused connections.\n- Listing the models of an OpenAI-compatible account asked every model Ollama's capability question, which on mlxh made its manager load a worker for each one, image models and the largest included. Only a host that answers as Ollama is asked now.\n- Test connection gives an account on this computer two minutes instead of fifteen seconds, since a local model loads on its first request.\n- When a model's provider refuses a call because of the account (\"Third-party apps now draw from your extra usage…\"), the chat shows that sentence and points at Settings → Model accounts, instead of a generic line about the connection or a wrong one about the .env.\n- Giving a connection's tools to an agent failed with \"matches no registered tool\" whenever a chat or a run had happened between buddi starting and the review being kept, and worked again after a restart: the tools were being registered into that run's own copy of the registry. They now go to buddi's own registry, and every run started afterwards gets them.\n- Adding a service that was already added and never reviewed reuses that connection instead of making a second one.\n- The page a service sends you back to after a sign-in (`/connections/callback`) was blank: the dashboard's files are addressed relatively and the browser looked for them under `/connections/`. It now finishes the sign-in and closes itself as meant.\n\n### Added\n\n- Connections can be a program on this computer: **A program on this computer** in Settings → Connections (name, command, arguments, environment variables with a Secret switch) and `buddi connections add <name> [--env K=V]... [--secret K]... -- <command> <args…>`. Secret variables are kept in the vault; the review is the program's first run, shows its command line in full, and a changed command, arguments or variable name asks for another review. buddi starts it as you in its own process group with only the named variables, stops it after ten idle minutes and on shutdown, and keeps its last stderr lines on the row when it fails. The paste box and `--json` also read a `command` entry and a `claude mcp add … -- <command>` line.\n- The installed app claims links to its own address (`handle_links: preferred`) and reuses its open window (`launch_handler: navigate-existing`), so \"Open buddi\" in the extension and any buddi link land in the app once Chrome's \"Open supported links\" is on for it.\n- Each release attaches `buddi-extension-<version>.zip`, the Chrome Web Store upload of the extension (the unpacked folder in the tarball is unchanged), and the dashboard is ready to recognise the store's extension id once the listing exists.\n- mlxh, local MLX models on a Mac, as a model account: Settings → Model accounts has a **mlxh, local MLX models on this Mac** choice (address filled in, no key, the model list next), and first run's \"On this computer\" card finds mlxh beside Ollama and starts on its first language model. `GET /api/onboarding/mlxh` says whether mlxh answers here and what it serves.\n- An mlxh account's context window follows mlxh's `max_prompt_tokens` when the server reports it, else its 8,192 default, and Settings says how to raise it; image models on mlxh are flagged in the model list as belonging to the Image plugin.\n- First run's \"What should I take on for you?\": tick My days, My mail, My money, Voice, My code or Pictures, and buddi fetches their plugins from withbuddi.com and installs them in the background while you answer the next chapters. It approves on your behalf only plugins made by buddi whose download matches the hash withbuddi.com lists; anything else waits on its card in Settings → Plugins, and every install shows there with its hash as usual. `POST`/`GET /api/onboarding/take-on`.\n- GitHub connects with a code instead of a token: Settings → Connections and `buddi connections add github` show a code and open github.com/login/device, you type it and say yes, and buddi signs in with its own GitHub app (the OAuth device flow). Token and Client id stay available; `--token` still forces the token.\n- `buddi connections list|add|review|give|remove` connects an MCP service from the terminal, through the running buddi and the same four steps as Settings → Connections; a sign-in on the service's page lands in any dashboard session, once, within ten minutes.\n- A plugin that ships a settings tab has a Settings action on its row (in place of Open when it has no page of its own), in its ⋯ menu and in its detail sheet, so setting one up after an install is one click.\n- Connections sign in with a token: paste one on the sign-in screen and buddi tries it on the server before it keeps it, as one of your secrets sent only to that server's host. GitHub opens on Token, with a link to the page where you make one.\n- \"I have a config\" on Settings → Connections reads the `mcpServers` block another MCP client uses: it fills the address and name, and a header becomes the token. A local `command` and SSE-only servers are refused with a sentence.\n\n### Changed\n\n…"
   },
   "files": [
     "packages",