agentgui 1.0.985 → 1.0.987

package/lib/http-handler.js

@@ -21,16 +21,18 @@ export function maskToken(url) {
   return url.replace(/([?&]token=)[^&]*/gi, '$1***');
 }
 
+// Module-level platform constant — never changes at runtime.
+const IS_WINDOWS = os.platform() === 'win32';
+
 export function confineToRoots(inputPath, allowRoots) {
-  const isWindows = os.platform() === 'win32';
   const norms = allowRoots.map(r => path.normalize(r));
   const expanded = inputPath && inputPath.startsWith('~') ? inputPath.replace('~', os.homedir()) : inputPath;
   const normalizedPath = path.normalize(expanded || '');
-  const isAbsolute = isWindows ? /^[A-Za-z]:[\\/]/.test(normalizedPath) : normalizedPath.startsWith('/');
+  const isAbsolute = IS_WINDOWS ? /^[A-Za-z]:[\\/]/.test(normalizedPath) : normalizedPath.startsWith('/');
   const within = (p) => {
-    const np = isWindows ? p.toLowerCase() : p;
+    const np = IS_WINDOWS ? p.toLowerCase() : p;
     return norms.some(root => {
-      const r = isWindows ? root.toLowerCase() : root;
+      const r = IS_WINDOWS ? root.toLowerCase() : root;
       return np === r || np.startsWith(r + path.sep);
     });
   };
@@ -82,6 +84,26 @@ function sanitizeEntryName(name) {
   return n;
 }
 
+// Map a Node.js filesystem error code to a safe human-readable string that
+// does not disclose host paths or internal stack context. Used everywhere an
+// err.message would otherwise be returned to the client.
+function safeErrMsg(err) {
+  if (!err) return 'unknown error';
+  switch (err.code) {
+    case 'ENOENT': return 'file not found';
+    case 'EACCES': return 'permission denied';
+    case 'EPERM':  return 'operation not permitted';
+    case 'EISDIR': return 'path is a directory';
+    case 'ENOTDIR': return 'path is not a directory';
+    case 'ENOTEMPTY': return 'directory is not empty';
+    case 'EEXIST': return 'file already exists';
+    case 'EXDEV': return 'cannot move across drives';
+    case 'EMFILE': return 'too many open files';
+    case 'ENOSPC': return 'no space left on device';
+    default: return 'operation failed';
+  }
+}
+
 // Read a request body with a hard size cap; resolves a Buffer or rejects with
 // .code='TOO_LARGE' so the caller can answer 413 without buffering the rest.
 function readBody(req, maxBytes) {
@@ -101,12 +123,20 @@ function readBody(req, maxBytes) {
 // themselves are never mutation targets (rename/delete of a root would orphan
 // the whole surface).
 function isAllowRoot(realPath, allowRoots) {
-  const isWindows = os.platform() === 'win32';
-  const p = isWindows ? realPath.toLowerCase() : realPath;
-  return allowRoots.some(r => (isWindows ? r.toLowerCase() : r) === p);
+  const p = IS_WINDOWS ? realPath.toLowerCase() : realPath;
+  return allowRoots.some(r => (IS_WINDOWS ? r.toLowerCase() : r) === p);
 }
 
 export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, serveFile, staticDir, messageQueues, getWss, activeExecutions, getACPStatus, discoveredAgents, PKG_VERSION, RATE_LIMIT_MAX, rateLimitMap, routes, PORT }) {
+  // Warn operators when CORS_ORIGIN=* is combined with no PASSWORD: any
+  // cross-origin page can make credentialless fetch() calls to all /api/*
+  // endpoints (list, file, download, rename, delete, mkdir) and read or
+  // modify the filesystem. The existing code is structurally correct (no
+  // Access-Control-Allow-Credentials with wildcard), but the exposure is
+  // easy to miss.
+  if (process.env.CORS_ORIGIN === '*' && !process.env.PASSWORD) {
+    console.warn('[agentgui] WARNING: CORS_ORIGIN=* is set without PASSWORD. Any cross-origin page can make credentialless requests to all /api/* endpoints and read/modify the filesystem. Set PASSWORD or restrict CORS_ORIGIN to a specific origin.');
+  }
   return async function httpHandler(req, res) {
     // CORS: emit ACAO only when CORS_ORIGIN is explicitly set. A wildcard would
     // let any webpage the user visits make credentialless fetches to /api/list,
@@ -117,17 +147,29 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       // Never set a wildcard when credentials (cookies) may be in play — a
       // wildcard + credentials is rejected by browsers and leaks session tokens.
       // A specific origin allows credentialed cross-origin requests safely.
-      res.setHeader('Access-Control-Allow-Origin', _corsOrigin === '*' ? _corsOrigin : _corsOrigin);
+      res.setHeader('Access-Control-Allow-Origin', _corsOrigin);
       if (_corsOrigin !== '*') res.setHeader('Access-Control-Allow-Credentials', 'true');
       res.setHeader('Vary', 'Origin');
+      // Allow-Methods and Allow-Headers are only meaningful on CORS preflights
+      // or CORS requests; emitting them unconditionally leaks the method surface
+      // to same-origin (and non-CORS) responses unnecessarily.
+      if (req.method === 'OPTIONS' || req.headers['origin']) {
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+      }
     } // no ACAO header -> browsers enforce same-origin by default
-    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
     // The password can ride in a ?token= query param (EventSource/deep-links
     // can't set headers), so a navigation away from the app would leak it in
     // the Referer header to the destination. Strip the referrer on every
     // response so the credential never crosses an origin boundary that way.
     res.setHeader('Referrer-Policy', 'no-referrer');
+    // Prevent MIME-sniffing attacks on all responses including file downloads.
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    // Emit HSTS when the connection is known-TLS so clients pin HTTPS and
+    // refuse future downgrade attempts (protects cookie + ?token= in transit).
+    if (req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https') {
+      res.setHeader('Strict-Transport-Security', 'max-age=31536000');
+    }
     // CSP: the markdown stack (marked/dompurify/prismjs) and the DS kit load
     // from unpkg/jsdelivr; everything else is self. connect-src also allows
     // self for the same-origin WS/SSE. script-src drops 'unsafe-inline' in
@@ -161,6 +203,9 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
     } else {
       clientIp = req.socket.remoteAddress;
     }
+    // Normalize IPv4-mapped IPv6 addresses (::ffff:1.2.3.4 -> 1.2.3.4) so the
+    // rate-limit bucket is the same regardless of how the OS presents the peer.
+    if (clientIp && clientIp.startsWith('::ffff:')) clientIp = clientIp.slice(7);
     const hits = (rateLimitMap.get(clientIp) || 0) + 1;
     rateLimitMap.set(clientIp, hits);
     res.setHeader('X-RateLimit-Limit', RATE_LIMIT_MAX);
@@ -191,7 +236,10 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
           if (_ci !== -1) _ok = _checkToken(_decoded.slice(_ci + 1));
         } catch (_) {}
       } else if (_auth.startsWith('Bearer ')) {
-        _ok = _checkToken(_auth.slice(7));
+        const bearerToken = _auth.slice(7);
+        // Validate Bearer token format: non-empty, no whitespace. Prevents
+        // timing-attack length inference if PASSWORD contains spaces.
+        if (/^[\S]+$/.test(bearerToken)) _ok = _checkToken(bearerToken);
       }
       // EventSource and same-origin links can't set headers - accept ?token= as fallback.
       let _viaQuery = false;
@@ -338,7 +386,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
           const st = fs.statSync(conf.realPath);
           sendJSON(req, res, 200, { ok: true, dir: st.isDirectory(), path: conf.realPath });
         } catch (err) {
-          sendJSON(req, res, err.code === 'ENOENT' ? 404 : 403, { error: err.message });
+          sendJSON(req, res, err.code === 'ENOENT' ? 404 : 403, { error: safeErrMsg(err) });
         }
         return;
       }
@@ -353,7 +401,13 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         let p = {}; try { p = body ? JSON.parse(body) : {}; } catch {}
         // Never honour a client-supplied shell or env - that would be a direct
         // command/arg injection into the spawned process. Only geometry + cwd.
-        const s = term.createSession({ cwd: p.cwd, cols: p.cols, rows: p.rows });
+        // Confine cwd to allowed roots; fall back to STARTUP_CWD on failure.
+        let termCwd = process.env.STARTUP_CWD || process.cwd();
+        if (p.cwd) {
+          const cwdConf = confineToRoots(p.cwd, fsAllowRoots());
+          if (cwdConf.ok) termCwd = cwdConf.realPath;
+        }
+        const s = term.createSession({ cwd: termCwd, cols: p.cols, rows: p.rows });
         sendJSON(req, res, 200, { sid: s.sid, kind: s.kind, shell: s.shell, cwd: s.cwd, cols: s.cols, rows: s.rows, pid: s.proc.pid });
         return;
       }
@@ -440,7 +494,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
           sendJSON(req, res, 200, { path: normalizedPath, segments, entries, roots: allowRoots });
         } catch (err) {
           const code = err && err.code === 'ENOENT' ? 404 : (err && err.code === 'EACCES' ? 403 : 400);
-          sendJSON(req, res, code, { error: err.message });
+          sendJSON(req, res, code, { error: safeErrMsg(err) });
         }
         return;
       }
@@ -490,7 +544,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
           res.end(buf);
         } catch (err) {
           const code = err && err.code === 'ENOENT' ? 404 : (err && err.code === 'EACCES' ? 403 : 400);
-          res.writeHead(code); res.end(err.message);
+          res.writeHead(code); res.end(safeErrMsg(err));
         }
         return;
       }
@@ -521,10 +575,12 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
             'Content-Length': String(st.size),
             'Cache-Control': 'no-cache',
           });
-          fs.createReadStream(normalizedPath).pipe(res);
+          const rs = fs.createReadStream(normalizedPath);
+          rs.on('error', (streamErr) => { if (!res.writableEnded) res.destroy(streamErr); });
+          rs.pipe(res);
         } catch (err) {
           const code = err && err.code === 'ENOENT' ? 404 : (err && err.code === 'EACCES' ? 403 : 400);
-          res.writeHead(code); res.end(err.message);
+          res.writeHead(code); res.end(safeErrMsg(err));
         }
         return;
       }
@@ -557,7 +613,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         if (!tConf.ok) { sendJSON(req, res, 403, { error: 'forbidden: target outside allowed roots' }); return; }
         if (fs.existsSync(target)) { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
         try { fs.renameSync(conf.realPath, target); sendJSON(req, res, 200, { ok: true, path: target }); }
-        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: safeErrMsg(err) }); }
         return;
       }
 
@@ -654,6 +710,17 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       if (routePath.split('?')[0] === '/api/upload-file' && req.method === 'PUT') {
         let qs;
         try { qs = new URL(req.url, 'http://localhost').searchParams; } catch { qs = new URLSearchParams(); }
+        // Require Content-Length header: rejects chunked or missing-length requests
+        // that could claim any size. Pre-validates the announced size before streaming.
+        const contentLength = req.headers['content-length'];
+        if (!contentLength) {
+          sendJSON(req, res, 411, { error: 'length required' }); return;
+        }
+        const MAX_UPLOAD = 50 * 1024 * 1024;
+        const len = parseInt(contentLength, 10);
+        if (isNaN(len) || len < 0 || len > MAX_UPLOAD) {
+          sendJSON(req, res, 413, { error: `file too large (max ${MAX_UPLOAD} bytes)` }); return;
+        }
         const allowRoots = fsAllowRoots();
         const conf = confineToRoots(qs.get('dir') || '', allowRoots);
         if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: 'forbidden: ' + conf.reason }); return; }
@@ -662,11 +729,36 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         if (SECRET_RE.test(name)) { sendJSON(req, res, 403, { error: 'forbidden: secret/dotfile name' }); return; }
         const target = path.join(conf.realPath, name);
         if (fs.existsSync(target) && qs.get('overwrite') !== '1') { sendJSON(req, res, 409, { error: 'a file with that name already exists' }); return; }
-        let buf;
-        try { buf = await readBody(req, 50 * 1024 * 1024); }
-        catch (e) { sendJSON(req, res, e.code === 'TOO_LARGE' ? 413 : 400, { error: e.code === 'TOO_LARGE' ? 'file too large (50MB cap)' : 'upload failed' }); return; }
-        try { fs.writeFileSync(target, buf); sendJSON(req, res, 200, { ok: true, path: target, size: buf.length }); }
-        catch (err) { sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: err.message }); }
+        // Stream the upload body to a temp file to keep memory constant and
+        // avoid blocking the event loop with a large synchronous writeFileSync.
+        const tmpPath = target + '.tmp.' + crypto.randomBytes(6).toString('hex');
+        try {
+          await new Promise((resolve, reject) => {
+            const ws = fs.createWriteStream(tmpPath);
+            let total = 0;
+            ws.on('error', reject);
+            req.on('error', reject);
+            req.on('data', (chunk) => {
+              total += chunk.length;
+              if (total > MAX_UPLOAD) {
+                ws.destroy();
+                req.destroy();
+                const e = new Error('file too large (50MB cap)'); e.code = 'TOO_LARGE';
+                reject(e); return;
+              }
+              ws.write(chunk);
+            });
+            req.on('end', () => ws.end());
+            ws.on('finish', () => resolve(total));
+          });
+          fs.renameSync(tmpPath, target);
+          const uploadedSize = fs.statSync(target).size;
+          sendJSON(req, res, 200, { ok: true, path: target, size: uploadedSize });
+        } catch (err) {
+          try { fs.unlinkSync(tmpPath); } catch (_) {}
+          if (err.code === 'TOO_LARGE') { sendJSON(req, res, 413, { error: 'file too large (50MB cap)' }); return; }
+          sendJSON(req, res, err.code === 'EACCES' || err.code === 'EPERM' ? 403 : 400, { error: 'upload failed' });
+        }
         return;
       }
 
@@ -698,9 +790,15 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
           // Files preview uses /api/file/download (attachment) for SVG.
           const contentType = mimeTypes[ext];
           if (!contentType) { res.writeHead(403); res.end('Forbidden'); return; }
-          res.writeHead(200, { 'Content-Type': contentType, 'Cache-Control': 'no-cache', 'X-Content-Type-Options': 'nosniff' });
-          res.end(fs.readFileSync(normalizedPath));
-        } catch (err) { sendJSON(req, res, 400, { error: err.message }); }
+          const imgSt = fs.statSync(normalizedPath);
+          const IMG_MAX = 20 * 1024 * 1024; // 20MB hard cap
+          if (imgSt.size > IMG_MAX) { res.writeHead(413); res.end('Image too large'); return; }
+          // Always stream to avoid blocking the event loop on large synchronous reads.
+          res.writeHead(200, { 'Content-Type': contentType, 'Cache-Control': 'no-cache', 'Content-Length': String(imgSt.size) });
+          const imgRs = fs.createReadStream(normalizedPath);
+          imgRs.on('error', (streamErr) => { if (!res.writableEnded) res.destroy(streamErr); });
+          imgRs.pipe(res);
+        } catch (err) { sendJSON(req, res, 400, { error: 'cannot read image' }); }
         return;
       }
 
@@ -720,8 +818,8 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         } else { serveFile(filePath, res, req, cspNonce); }
       });
     } catch (e) {
-      console.error('Server error:', maskToken(e.message), '| path:', maskToken(req.url.split('?')[0]));
-      sendJSON(req, res, 500, { error: e.message });
+      console.error('Server error:', maskToken(e.message), e.stack, '| path:', maskToken(req.url.split('?')[0]));
+      sendJSON(req, res, 500, { error: 'internal server error' });
     }
   };
 }

package/lib/plugins/acp-plugin.js

@@ -1,9 +1,22 @@
 // ACP plugin - OpenCode, Gemini, Kilo, Codex startup and health checks
 
-import { spawn } from 'child_process';
+import { spawn, execFileSync } from 'child_process';
 import path from 'path';
 import fs from 'fs';
 
+// Resolve a binary name to an absolute path (mirrors lib/claude-runner-direct.js pattern).
+// Returns the resolved path, or null if not found.
+function resolveBinaryPath(name) {
+  try {
+    const which = process.platform === 'win32' ? 'where' : 'which';
+    const result = execFileSync(which, [name], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    const first = result.trim().split(/\r?\n/)[0];
+    return first || null;
+  } catch {
+    return null;
+  }
+}
+
 export default {
   name: 'acp',
   version: '1.0.0',
@@ -15,16 +28,24 @@ export default {
     const restartCounts = new Map();
     const acpPorts = new Map();
 
+    // Each spec uses argv (binary + args) rather than a shell command string so
+    // spawn runs with shell:false — no shell injection risk even if port/name
+    // values are later sourced from config. Mirrors lib/claude-runner-direct.js.
     const toolSpecs = [
-      { name: 'opencode', port: 18100, cmd: 'opencode acp --port 18100' },
-      { name: 'gemini', port: 18101, cmd: 'gemini acp --port 18101' },
-      { name: 'kilo', port: 18102, cmd: 'kilo acp --port 18102' },
-      { name: 'codex', port: 18103, cmd: 'codex acp --port 18103' },
+      { name: 'opencode', port: 18100, argv: ['opencode', 'acp', '--port', '18100'] },
+      { name: 'gemini',   port: 18101, argv: ['gemini',   'acp', '--port', '18101'] },
+      { name: 'kilo',     port: 18102, argv: ['kilo',     'acp', '--port', '18102'] },
+      { name: 'codex',    port: 18103, argv: ['codex',    'acp', '--port', '18103'] },
     ];
 
     const startTool = async (spec) => {
       try {
-        const proc = spawn('bash', ['-c', spec.cmd]);
+        const [bin, ...args] = spec.argv;
+        // Resolve to an absolute path so spawn never relies on PATH expansion
+        // inside a shell; shell:false is the default for spawn() when called
+        // this way, matching the project-wide rule in AGENTS.md.
+        const resolvedBin = resolveBinaryPath(bin) || bin;
+        const proc = spawn(resolvedBin, args, { shell: false });
         toolProcesses.set(spec.name, proc);
         acpPorts.set(spec.name, spec.port);
         restartCounts.set(spec.name, 0);

package/lib/plugins/files-plugin.js

@@ -2,6 +2,7 @@
 
 import path from 'path';
 import fs from 'fs';
+import { confineToRoots, fsAllowRoots } from '../http-handler.js';
 
 export default {
   name: 'files',
@@ -13,18 +14,24 @@ export default {
     const uploadedFiles = new Map();
 
     const browseDirectory = (dir) => {
+      const conf = confineToRoots(dir, fsAllowRoots());
+      if (!conf.ok) return [];
       try {
-        const entries = fs.readdirSync(dir);
+        const entries = fs.readdirSync(conf.realPath);
         return entries.map(entry => {
-          const fullPath = path.join(dir, entry);
-          const stat = fs.statSync(fullPath);
-          return {
-            name: entry,
-            path: fullPath,
-            isDirectory: stat.isDirectory(),
-            size: stat.size,
-          };
-        });
+          const fullPath = path.join(conf.realPath, entry);
+          try {
+            const stat = fs.statSync(fullPath);
+            return {
+              name: entry,
+              path: fullPath,
+              isDirectory: stat.isDirectory(),
+              size: stat.size,
+            };
+          } catch (_) {
+            return null;
+          }
+        }).filter(Boolean);
       } catch (e) {
         return [];
       }
@@ -38,8 +45,13 @@ export default {
           handler: (req, res) => {
             const { conversationId } = req.params;
             const { dir } = req.query;
-            const entries = browseDirectory(dir || process.cwd());
-            res.json({ entries, currentDir: dir || process.cwd() });
+            const requestedDir = dir || process.cwd();
+            const conf = confineToRoots(requestedDir, fsAllowRoots());
+            if (!conf.ok) {
+              return res.status(403).json({ error: 'Path not allowed' });
+            }
+            const entries = browseDirectory(conf.realPath);
+            res.json({ entries, currentDir: conf.realPath });
           },
         },
         {
@@ -56,6 +68,25 @@ export default {
           path: '/api/folders',
           handler: async (req, res) => {
             const { path: folderPath } = req.body;
+            if (!folderPath || typeof folderPath !== 'string') {
+              return res.status(400).json({ error: 'path is required' });
+            }
+            // Sanitize each path component - reject traversal attempts
+            const parts = folderPath.split(/[/\\]/);
+            for (const part of parts) {
+              if (part === '..' || part === '.' || /[<>:"|?*\x00-\x1f]/.test(part)) {
+                return res.status(400).json({ error: 'Invalid path component' });
+              }
+            }
+            const conf = confineToRoots(folderPath, fsAllowRoots());
+            if (!conf.ok && conf.reason !== 'not found') {
+              return res.status(403).json({ error: 'Path not allowed' });
+            }
+            // For mkdir, path may not exist yet; re-check parent is confined
+            const parentConf = confineToRoots(path.dirname(folderPath), fsAllowRoots());
+            if (!parentConf.ok) {
+              return res.status(403).json({ error: 'Path not allowed' });
+            }
             try {
               fs.mkdirSync(folderPath, { recursive: true });
               res.json({ success: true, path: folderPath });

package/lib/plugins/workflow-plugin.js

@@ -19,11 +19,20 @@ export default {
         .map(name => ({ name, path: path.join(workflowDir, name) }));
     };
 
+    const resolvedWorkflowDir = path.resolve(process.cwd(), '.github', 'workflows');
+
+    const isNameSafe = (name) => !/[/\\]/.test(name);
+
     const parseWorkflow = (filePath) => {
       try {
-        const content = fs.readFileSync(filePath, 'utf8');
+        // Confine to workflowDir: resolve and verify the path stays within the allowed directory
+        const resolved = path.resolve(filePath);
+        if (!resolved.startsWith(resolvedWorkflowDir + path.sep) && resolved !== resolvedWorkflowDir) {
+          return null;
+        }
+        const content = fs.readFileSync(resolved, 'utf8');
         // Parse YAML manually or return raw content
-        return { name: path.basename(filePath), content };
+        return { name: path.basename(resolved), content };
       } catch {
         return null;
       }
@@ -43,6 +52,9 @@ export default {
           method: 'GET',
           path: '/api/workflows/:name/history',
           handler: (req, res) => {
+            if (!isNameSafe(req.params.name)) {
+              return res.status(400).json({ error: 'Invalid workflow name' });
+            }
             res.json({ history: [] });
           },
         },
@@ -50,6 +62,9 @@ export default {
           method: 'POST',
           path: '/api/workflows/:name/trigger',
           handler: async (req, res) => {
+            if (!isNameSafe(req.params.name)) {
+              return res.status(400).json({ error: 'Invalid workflow name' });
+            }
             res.json({ success: true, message: 'Workflow trigger requires GitHub API' });
           },
         },
@@ -57,6 +72,9 @@ export default {
           method: 'GET',
           path: '/api/workflows/:name/status',
           handler: (req, res) => {
+            if (!isNameSafe(req.params.name)) {
+              return res.status(400).json({ error: 'Invalid workflow name' });
+            }
             res.json({ status: 'unknown' });
           },
         },

package/lib/ws-handlers-util.js

@@ -6,6 +6,7 @@ import { execSync, spawnSync } from 'child_process';
 import { runClaudeWithStreaming } from './claude-runner-run.js';
 import { registry } from './claude-runner-agents.js';
 import { confineToRoots, fsAllowRoots } from './http-handler.js';
+import { restart as restartAcpAgent } from './acp-sdk-manager.js';
 
 function err(code, message) { const e = new Error(message); e.code = code; throw e; }
 
@@ -297,6 +298,12 @@ export function register(router, deps) {
 
   router.handle('ws.stats', () => wsOptimizer.getStats());
 
+  router.handle('acp.restart', async (p) => {
+    if (!p.id) err(400, 'Missing agent id');
+    const ok = await restartAcpAgent(p.id);
+    return { ok: !!ok };
+  });
+
   router.handle('agent.subagents', async (p) => {
     if (!p.id) err(400, 'Missing agent id');
     if (p.id === 'claude-code' || p.id === 'cli-claude') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.985",
+  "version": "1.0.987",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",
@@ -18,6 +18,7 @@
   "scripts": {
     "start": "bun server.js || node server.js",
     "dev": "node server.js --watch",
+    "test": "bun test.js && bun test-integration.js",
     "postinstall": "node scripts/patch-fsbrowse.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true",
     "electron": "electron electron/main.js",
     "electron:dev": "PORT=3000 electron electron/main.js"

package/server.js

@@ -10,7 +10,6 @@ import { queries } from './database.js';
 import { runClaudeWithStreaming } from './lib/claude-runner-run.js';
 import { initializeDescriptors, getAgentDescriptor } from './lib/agent-descriptors.js';
 import { discoverExternalACPServers, initializeAgentDiscovery } from './lib/agent-discovery.js';
-import { createRegistry } from './lib/routes-registry.js';
 import { register as registerWsHandlers } from './lib/ws-handlers-util.js';
 import { BROADCAST_TYPES } from './lib/broadcast.js';
 import { WSOptimizer } from './lib/ws-optimizer.js';
@@ -154,7 +153,6 @@ const { processMessageWithStreaming } = createProcessMessage({
 
 const activeChats = new Map();
 const wsRouter = new WsRouter();
-createRegistry(wsRouter, { queries, sendJSON, parseBody, broadcastSync, debugLog, PORT, BASE_URL, rootDir, STARTUP_CWD, PKG_VERSION, processMessageWithStreaming, activeExecutions, activeProcessesByRunId, activeScripts, messageQueues, rateLimitState, cleanupExecution, discoveredAgents, getACPStatus, modelCache, getModelsForAgent, logError, syncClients, wsOptimizer, errLogPath, getJsonlWatcher: () => getJsonlWatcher(), routes: _routes });
 registerWsHandlers(wsRouter, { queries, wsOptimizer, broadcastSync, getProviderConfigs, saveProviderConfig, STARTUP_CWD, discoveredAgents, subscriptionIndex, activeChats, getModelsForAgent });
 
 

package/site/app/index.html

@@ -30,7 +30,6 @@
        247420.css bundle, scoped under .ds-247420. The kit owns all design. -->
 </head>
 <body>
-  <a href="#app" class="skip-link">Skip to main content</a>
   <div id="app"><div class="boot-splash" role="status">loading agentgui…</div></div>
   <script type="module" src="./js/app.js"></script>
 </body>