clitrigger 0.2.24 → 0.2.26

package/dist/server/utils/net-safety.js

@@ -0,0 +1,28 @@
+// SSRF guard for user-supplied base URLs (e.g. Jira base_url). Requires http(s)
+// and blocks loopback / link-local hosts — notably the cloud metadata endpoint
+// (169.254.169.254). Private LAN ranges (10./192.168./172.16-31.) are allowed
+// so self-hosted/internal Jira still works. Does not defend against DNS
+// rebinding (out of scope for a single-user tool).
+export function assertPublicHttpUrl(raw) {
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        throw new Error('Invalid URL');
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        throw new Error('URL must use http or https');
+    }
+    const host = u.hostname.toLowerCase();
+    const blocked = host === 'localhost' ||
+        host.endsWith('.localhost') ||
+        host === '::1' ||
+        host === '0.0.0.0' ||
+        /^127\./.test(host) ||
+        /^169\.254\./.test(host);
+    if (blocked) {
+        throw new Error('URL host is not allowed');
+    }
+}
+//# sourceMappingURL=net-safety.js.map

package/dist/server/utils/net-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"net-safety.js","sourceRoot":"","sources":["../../../src/server/utils/net-safety.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,OAAO,GACX,IAAI,KAAK,WAAW;QACpB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,SAAS;QAClB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/server/utils/open-path.d.ts

@@ -0,0 +1,4 @@
+export declare function osOpenPath(target: string, opts?: {
+    reveal?: boolean;
+}): void;
+//# sourceMappingURL=open-path.d.ts.map

package/dist/server/utils/open-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-path.d.ts","sourceRoot":"","sources":["../../../src/server/utils/open-path.ts"],"names":[],"mappings":"AAOA,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAShF"}

package/dist/server/utils/open-path.js

@@ -0,0 +1,19 @@
+import { execFile } from 'child_process';
+import path from 'path';
+// Open a file/folder with the OS default handler, or reveal a file in the file
+// manager. Uses execFile (argv array, no shell) so a path containing shell
+// metacharacters — e.g. an agent-created filename like `$(touch pwned).md` —
+// cannot inject a command. Exit codes from explorer/open are ignored.
+export function osOpenPath(target, opts = {}) {
+    const done = () => { };
+    if (process.platform === 'win32') {
+        execFile('explorer.exe', [opts.reveal ? `/select,${target}` : target], done);
+    }
+    else if (process.platform === 'darwin') {
+        execFile('open', opts.reveal ? ['-R', target] : [target], done);
+    }
+    else {
+        execFile('xdg-open', [opts.reveal ? path.dirname(target) : target], done);
+    }
+}
+//# sourceMappingURL=open-path.js.map

package/dist/server/utils/open-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-path.js","sourceRoot":"","sources":["../../../src/server/utils/open-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,OAA6B,EAAE;IACxE,MAAM,IAAI,GAAG,GAAG,EAAE,GAAkC,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/dist/server/utils/path-safety.d.ts

@@ -0,0 +1,2 @@
+export declare function isRealpathWithinRoot(root: string, abs: string): boolean;
+//# sourceMappingURL=path-safety.d.ts.map

package/dist/server/utils/path-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.d.ts","sourceRoot":"","sources":["../../../src/server/utils/path-safety.ts"],"names":[],"mappings":"AAOA,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAevE"}

package/dist/server/utils/path-safety.js

@@ -0,0 +1,25 @@
+import fs from 'fs';
+import path from 'path';
+// Returns true if `abs` (an already lexically-resolved path) stays within
+// `root` even after resolving symlinks. For a not-yet-created file it checks
+// the nearest existing ancestor. Defends against an in-tree symlink that points
+// outside the project root (which a lexical `startsWith` check would miss).
+export function isRealpathWithinRoot(root, abs) {
+    try {
+        let probe = abs;
+        while (!fs.existsSync(probe)) {
+            const parent = path.dirname(probe);
+            if (parent === probe)
+                break;
+            probe = parent;
+        }
+        const realRoot = fs.realpathSync(root);
+        const realProbe = fs.realpathSync(probe);
+        const sep = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
+        return realProbe === realRoot || realProbe.startsWith(sep);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=path-safety.js.map

package/dist/server/utils/path-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../../src/server/utils/path-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,0EAA0E;AAC1E,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,GAAW;IAC5D,IAAI,CAAC;QACH,IAAI,KAAK,GAAG,GAAG,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,KAAK;gBAAE,MAAM;YAC5B,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;QACD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;QACzE,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/server/websocket/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/websocket/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAQnC,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAqKlD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/websocket/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AASnC,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CA2LlD"}

package/dist/server/websocket/index.js

@@ -4,6 +4,7 @@ import { sessionMiddleware } from '../middleware/auth.js';
 import { claudeManager } from '../services/claude-manager.js';
 import { sessionManager } from '../services/session-manager.js';
 import { getTodoById, createTaskLog, getSessionById, createSessionLog, getSessionRawChunks } from '../db/queries.js';
+import { getSetting } from '../db/app-settings.js';
 export function initWebSocket(server) {
     const wss = new WebSocketServer({ noServer: true });
     // Handle upgrade manually to validate session auth
@@ -48,6 +49,13 @@ export function initWebSocket(server) {
                 socket.destroy();
                 return;
             }
+            // Reject sessions issued before the last password change (parity with HTTP).
+            const changedAt = Number(getSetting('auth.password_changed_at') || 0);
+            if (changedAt && (session.createdAt ?? 0) < changedAt) {
+                socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                socket.destroy();
+                return;
+            }
             wss.handleUpgrade(req, socket, head, (ws) => {
                 wss.emit('connection', ws, req);
             });
@@ -112,9 +120,26 @@ export function initWebSocket(server) {
                         try {
                             sessionManager.flushPendingRaw(msg.sessionId);
                             const chunks = getSessionRawChunks(msg.sessionId);
+                            // Coalesce DB rows into large frames. A long session holds tens
+                            // of thousands of tiny rows (one per 100ms flush); one ws frame
+                            // per row made re-opening a terminal take seconds.
+                            const REPLAY_FRAME_BYTES = 256 * 1024;
+                            let batch = [];
+                            let batchBytes = 0;
+                            const sendBatch = () => {
+                                if (batch.length === 0)
+                                    return;
+                                ws.send(encodeSessionFrame(msg.sessionId, Buffer.concat(batch)), { binary: true });
+                                batch = [];
+                                batchBytes = 0;
+                            };
                             for (const c of chunks) {
-                                ws.send(encodeSessionFrame(msg.sessionId, c.bytes), { binary: true });
+                                batch.push(c.bytes);
+                                batchBytes += c.bytes.length;
+                                if (batchBytes >= REPLAY_FRAME_BYTES)
+                                    sendBatch();
                             }
+                            sendBatch();
                         }
                         catch { /* ignore replay errors */ }
                         ws.send(JSON.stringify({ type: 'session:replay-end', sessionId: msg.sessionId }));

package/dist/server/websocket/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/websocket/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAGrC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAErH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,mDAAmD;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAEpD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC1D,uBAAuB;QACvB,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW;gBAC5C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,CAAC,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;YACvD,MAAM,eAAe,GAAG,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClF,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzD,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,yDAAyD;QACzD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACnB,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACzB,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;QAC1B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC;QAEhC,iBAAiB,CAAC,GAAU,EAAE,GAAU,EAAE,GAAG,EAAE;YAC7C,MAAM,OAAO,GAAI,GAAW,CAAC,OAAO,CAAC;YACrC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE;QAC1B,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAE1B,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;YACvC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,wDAAwD;QACxD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvC,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACrC,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;wBAC/E,IAAI,OAAO,EAAE,CAAC;4BACZ,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;4BAC9C,WAAW,CAAC,SAAS,CAAC;gCACpB,IAAI,EAAE,UAAU;gCAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gCAClB,OAAO,EAAE,GAAG,CAAC,KAAK;gCAClB,OAAO,EAAE,OAAO;6BACjB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,sBAAsB;gBACtB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnF,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC9C,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBACnE,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;wBAClF,IAAI,OAAO,EAAE,CAAC;4BACZ,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;4BACpD,WAAW,CAAC,SAAS,CAAC;gCACpB,IAAI,EAAE,aAAa;gCACnB,SAAS,EAAE,GAAG,CAAC,SAAS;gCACxB,OAAO,EAAE,GAAG,CAAC,KAAK;gCAClB,OAAO,EAAE,OAAO;6BACjB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,iDAAiD;gBAEjD,wEAAwE;gBACxE,kEAAkE;gBAClE,gEAAgE;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC9C,IAAI,OAAO,EAAE,CAAC;wBACZ,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;wBACzC,IAAI,CAAC;4BACH,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;4BAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;4BAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gCACvB,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;4BACxE,CAAC;wBACH,CAAC;wBAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;wBACtC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5E,WAAW,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7C,CAAC;gBAED,8DAA8D;gBAC9D,yEAAyE;gBACzE,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAChH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,kEAAkE;oBAClE,gEAAgE;oBAChE,kCAAkC;oBAClC,IAAI,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;wBAAE,OAAO;oBAC3D,iEAAiE;oBACjE,+DAA+D;oBAC/D,8DAA8D;oBAC9D,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9D,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;oBAClE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC9C,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBACnE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;wBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;wBACtD,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,uBAAuB;QACvB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/websocket/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAGrC,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACrH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,mDAAmD;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAEpD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC1D,uBAAuB;QACvB,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW;gBAC5C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvD,CAAC,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;YACvD,MAAM,eAAe,GAAG,4CAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClF,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzD,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,yDAAyD;QACzD,+DAA+D;QAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACnB,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACzB,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;QAC1B,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC;QAEhC,iBAAiB,CAAC,GAAU,EAAE,GAAU,EAAE,GAAG,EAAE;YAC7C,MAAM,OAAO,GAAI,GAAW,CAAC,OAAO,CAAC;YACrC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,6EAA6E;YAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE,CAAC;gBACtD,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE;QAC1B,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAE1B,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;YACvC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,wDAAwD;QACxD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvC,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACrC,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;wBAC/E,IAAI,OAAO,EAAE,CAAC;4BACZ,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;4BAC9C,WAAW,CAAC,SAAS,CAAC;gCACpB,IAAI,EAAE,UAAU;gCAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gCAClB,OAAO,EAAE,GAAG,CAAC,KAAK;gCAClB,OAAO,EAAE,OAAO;6BACjB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,sBAAsB;gBACtB,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnF,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC9C,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBACnE,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;wBAClF,IAAI,OAAO,EAAE,CAAC;4BACZ,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;4BACpD,WAAW,CAAC,SAAS,CAAC;gCACpB,IAAI,EAAE,aAAa;gCACnB,SAAS,EAAE,GAAG,CAAC,SAAS;gCACxB,OAAO,EAAE,GAAG,CAAC,KAAK;gCAClB,OAAO,EAAE,OAAO;6BACjB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,iDAAiD;gBAEjD,wEAAwE;gBACxE,kEAAkE;gBAClE,gEAAgE;gBAChE,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,mEAAmE;gBACnE,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC9C,IAAI,OAAO,EAAE,CAAC;wBACZ,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;wBACzC,IAAI,CAAC;4BACH,cAAc,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;4BAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;4BAClD,gEAAgE;4BAChE,gEAAgE;4BAChE,mDAAmD;4BACnD,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;4BACtC,IAAI,KAAK,GAAa,EAAE,CAAC;4BACzB,IAAI,UAAU,GAAG,CAAC,CAAC;4BACnB,MAAM,SAAS,GAAG,GAAG,EAAE;gCACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oCAAE,OAAO;gCAC/B,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gCACnF,KAAK,GAAG,EAAE,CAAC;gCACX,UAAU,GAAG,CAAC,CAAC;4BACjB,CAAC,CAAC;4BACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gCACvB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gCACpB,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;gCAC7B,IAAI,UAAU,IAAI,kBAAkB;oCAAE,SAAS,EAAE,CAAC;4BACpD,CAAC;4BACD,SAAS,EAAE,CAAC;wBACd,CAAC;wBAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;wBACtC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC5E,WAAW,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC7C,CAAC;gBAED,8DAA8D;gBAC9D,yEAAyE;gBACzE,IAAI,GAAG,CAAC,IAAI,KAAK,wBAAwB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAChH,8DAA8D;oBAC9D,+DAA+D;oBAC/D,kEAAkE;oBAClE,gEAAgE;oBAChE,kCAAkC;oBAClC,IAAI,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;wBAAE,OAAO;oBAC3D,iEAAiE;oBACjE,+DAA+D;oBAC/D,8DAA8D;oBAC9D,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC9D,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;oBAClE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC9C,IAAI,OAAO,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBACnE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;wBACvD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;wBACtD,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,uBAAuB;QACvB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/electron/main.cjs

@@ -160,7 +160,7 @@ function createWindow(port) {
       preload: path.join(__dirname, 'preload.cjs'),
       contextIsolation: true,
       nodeIntegration: false,
-      sandbox: false,
+      sandbox: true,
     },
   });
 
@@ -194,7 +194,11 @@ function createWindow(port) {
   mainWindow.webContents.setWindowOpenHandler(({ url, features }) => {
     const isLocal = localOrigins.some((o) => url.startsWith(o));
     if (!isLocal) {
-      shell.openExternal(url);
+      // Only hand safe schemes to the OS — never file:/smb:/custom handlers.
+      try {
+        const proto = new URL(url).protocol;
+        if (proto === 'http:' || proto === 'https:' || proto === 'mailto:') shell.openExternal(url);
+      } catch { /* invalid url — ignore */ }
       return { action: 'deny' };
     }
     // Session pop-out windows: open as a real OS child window with the same
@@ -237,7 +241,7 @@ function createWindow(port) {
             preload: path.join(__dirname, 'preload.cjs'),
             contextIsolation: true,
             nodeIntegration: false,
-            sandbox: false,
+            sandbox: true,
           },
         },
       };
@@ -245,11 +249,21 @@ function createWindow(port) {
     return { action: 'allow' };
   });
 
+  // Block top-level navigation to off-origin URLs so injected content / links
+  // can't load a remote page inside the trusted, preload-attached window.
+  const blockOffOriginNav = (contents) => {
+    contents.on('will-navigate', (e, navUrl) => {
+      if (!localOrigins.some((o) => navUrl.startsWith(o))) e.preventDefault();
+    });
+  };
+  blockOffOriginNav(mainWindow.webContents);
+
   // Newly-created child windows (popouts) inherit the main window's
   // setWindowOpenHandler but not the lock-screen focus-recovery handler.
   // Attach the same focus → webContents.focus() bridge so xterm typing
   // doesn't go dead after resume.
   mainWindow.webContents.on('did-create-window', (childWin) => {
+    blockOffOriginNav(childWin.webContents);
     childWin.on('focus', () => {
       // Skip when webContents already holds focus — a redundant programmatic
       // focus() resets the Windows IME (TSF) caret context, which is the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clitrigger",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "description": "Spawn isolated git worktrees and orchestrate Claude/Gemini/Codex CLI tasks in parallel from a web UI.",
   "keywords": [
     "claude",
@@ -71,7 +71,7 @@
   "dependencies": {
     "@iarna/toml": "^2.2.5",
     "@types/iarna__toml": "^2.0.5",
-    "better-sqlite3": "^12.10.0",
+    "better-sqlite3": "^12.11.1",
     "cloudflared": "^0.7.1",
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
@@ -89,7 +89,7 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@electron/rebuild": "^3.7.0",
+    "@electron/rebuild": "^4.1.0",
     "@types/better-sqlite3": "^7.6.12",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.0",
@@ -101,9 +101,9 @@
     "@types/ws": "^8.5.13",
     "@vitest/coverage-v8": "^4.1.1",
     "concurrently": "^9.1.0",
-    "electron": "^33.2.0",
-    "electron-builder": "^25.1.8",
-    "esbuild": "^0.27.0",
+    "electron": "^43.0.0",
+    "electron-builder": "^26.15.3",
+    "esbuild": "^0.28.1",
     "png-to-ico": "^3.0.1",
     "sharp": "^0.34.5",
     "tsx": "^4.19.0",

package/dist/client/assets/FloatingComposerController-5A3GJtK4-D5OJqjB6.js

@@ -1 +0,0 @@
-import{t as b,M as d,N as u,v as l,z as x,B as g,K as C,Z as h,r as m,T as v,j as i,q as j,P as y,U as E,o as S,s as O,f as P,G as T,D as F}from"./index-7c5uNap1.js";var I=m.memo(({isEmpty:t,onSave:o,Components:s,dict:e})=>i.jsx(s.Generic.Toolbar.Root,{className:F("bn-action-toolbar","bn-comment-actions"),variant:"action-toolbar",children:i.jsx(s.Generic.Toolbar.Button,{className:"bn-button",mainTooltip:e.comments.save_button_text,variant:"compact",isDisabled:t,onClick:o,children:e.comments.save_button_text})}));function U(){let t=d(),o=u(l),s=x(),e=g(),r=C({trailingBlock:!1,dictionary:{...e,placeholders:{emptyDocument:e.placeholders.new_comment}},schema:o.commentEditorSchema||h}),c=m.useCallback(async()=>{await o.createThread({initialComment:{body:r.document}}),o.stopPendingComment(),t.transact(a=>{a.setSelection(v.create(a.doc,a.selection.to))}),t.focus()},[o,r,t]);return i.jsx(s.Comments.Card,{className:"bn-thread",children:i.jsx(j,{autoFocus:!0,editable:!0,editor:r,actions:({isFocused:a,isEmpty:n})=>i.jsx(I,{isFocused:a,isEmpty:n,onSave:c,Components:s,dict:e})})})}var N=b({default:()=>_});function _(t){let o=d(),s=u(l),e=y(l,{editor:o,selector:n=>n.pendingComment}),r=E({editor:o,selector:({editor:n})=>e?{from:n.prosemirrorState.selection.from,to:n.prosemirrorState.selection.to}:void 0}),c=m.useMemo(()=>{var n,p;return{...t.floatingUIOptions,useFloatingOptions:{open:!!e,onOpenChange:f=>{f||(s.stopPendingComment(),o.focus())},placement:"bottom",middleware:[S(10),O(),P()],...(n=t.floatingUIOptions)==null?void 0:n.useFloatingOptions},focusManagerProps:{disabled:!1},elementProps:{style:{zIndex:60},...(p=t.floatingUIOptions)==null?void 0:p.elementProps}}},[s,o,e,t.floatingUIOptions]),a=t.floatingComposer||U;return i.jsx(T,{position:r,portalElement:t.portalElement,...c,children:i.jsx(a,{})})}export{N as n,U as r,_ as t};