cowork-os 0.3.21 → 0.3.25

package/src/electron/agent/tools/search-tools.ts

@@ -94,18 +94,36 @@ export class SearchTools {
     });
 
     // Use searchWithFallback for automatic fallback support
-    const response = await SearchProviderFactory.searchWithFallback(searchQuery);
+    try {
+      const response = await SearchProviderFactory.searchWithFallback(searchQuery);
 
-    this.daemon.logEvent(this.taskId, 'tool_result', {
-      tool: 'web_search',
-      result: {
-        query: input.query,
-        searchType: searchQuery.searchType,
-        resultCount: response.results.length,
-        provider: response.provider,
-      },
-    });
+      this.daemon.logEvent(this.taskId, 'tool_result', {
+        tool: 'web_search',
+        result: {
+          query: input.query,
+          searchType: searchQuery.searchType,
+          resultCount: response.results.length,
+          provider: response.provider,
+        },
+      });
+
+      return response;
+    } catch (error: any) {
+      const message = error?.message || 'Web search failed';
+      this.daemon.logEvent(this.taskId, 'tool_result', {
+        tool: 'web_search',
+        error: message,
+      });
 
-    return response;
+      return {
+        query: input.query,
+        searchType: input.searchType || 'web',
+        results: [],
+        provider: (input.provider || settings.primaryProvider || 'none') as SearchProviderType | 'none',
+        metadata: {
+          error: message,
+        },
+      };
+    }
   }
 }

package/src/electron/agent/tools/sharepoint-tools.ts

@@ -0,0 +1,247 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { Workspace } from '../../../shared/types';
+import { AgentDaemon } from '../daemon';
+import { SharePointSettingsManager } from '../../settings/sharepoint-manager';
+import { sharepointRequest } from '../../utils/sharepoint-api';
+
+type SharePointAction =
+  | 'get_current_user'
+  | 'search_sites'
+  | 'get_site'
+  | 'list_site_drives'
+  | 'list_drive_items'
+  | 'get_item'
+  | 'create_folder'
+  | 'upload_file'
+  | 'delete_item';
+
+interface SharePointActionInput {
+  action: SharePointAction;
+  site_id?: string;
+  drive_id?: string;
+  item_id?: string;
+  query?: string;
+  parent_id?: string;
+  name?: string;
+  conflict_behavior?: 'rename' | 'fail' | 'replace';
+  file_path?: string;
+  remote_path?: string;
+}
+
+export class SharePointTools {
+  constructor(
+    private workspace: Workspace,
+    private daemon: AgentDaemon,
+    private taskId: string
+  ) {}
+
+  setWorkspace(workspace: Workspace): void {
+    this.workspace = workspace;
+  }
+
+  static isEnabled(): boolean {
+    return SharePointSettingsManager.loadSettings().enabled;
+  }
+
+  private async requireApproval(summary: string, details: Record<string, unknown>): Promise<void> {
+    const approved = await this.daemon.requestApproval(
+      this.taskId,
+      'external_service',
+      summary,
+      details
+    );
+
+    if (!approved) {
+      throw new Error('User denied SharePoint action');
+    }
+  }
+
+  private resolveFilePath(inputPath: string): string {
+    if (!this.workspace.permissions.read) {
+      throw new Error('Read permission not granted for uploads');
+    }
+
+    const workspaceRoot = path.resolve(this.workspace.path);
+    const allowedPaths = this.workspace.permissions.allowedPaths || [];
+    const canReadOutside = this.workspace.isTemp || this.workspace.permissions.unrestrictedFileAccess;
+
+    const isPathAllowed = (absolutePath: string): boolean => {
+      if (allowedPaths.length === 0) return false;
+      const normalizedPath = path.normalize(absolutePath);
+      return allowedPaths.some((allowed) => {
+        const normalizedAllowed = path.normalize(allowed);
+        return normalizedPath === normalizedAllowed || normalizedPath.startsWith(normalizedAllowed + path.sep);
+      });
+    };
+
+    const candidate = path.isAbsolute(inputPath)
+      ? path.normalize(inputPath)
+      : path.resolve(workspaceRoot, inputPath);
+
+    const relative = path.relative(workspaceRoot, candidate);
+    const isInsideWorkspace = !(relative.startsWith('..') || path.isAbsolute(relative));
+    if (!isInsideWorkspace && !canReadOutside && !isPathAllowed(candidate)) {
+      throw new Error('File path must be inside the workspace or in Allowed Paths');
+    }
+    if (!fs.existsSync(candidate)) {
+      throw new Error(`File not found: ${inputPath}`);
+    }
+    const stats = fs.statSync(candidate);
+    if (!stats.isFile()) {
+      throw new Error(`Path is not a file: ${inputPath}`);
+    }
+    return candidate;
+  }
+
+  private getSiteId(inputSiteId?: string): string {
+    const settings = SharePointSettingsManager.loadSettings();
+    const siteId = inputSiteId || settings.siteId;
+    if (!siteId) {
+      throw new Error('Missing site_id. Provide it in settings or the tool input.');
+    }
+    return siteId;
+  }
+
+  private getDriveId(inputDriveId?: string): string {
+    const settings = SharePointSettingsManager.loadSettings();
+    const driveId = inputDriveId || settings.driveId;
+    if (!driveId) {
+      throw new Error('Missing drive_id. Provide it in settings or the tool input.');
+    }
+    return driveId;
+  }
+
+  async executeAction(input: SharePointActionInput): Promise<any> {
+    const settings = SharePointSettingsManager.loadSettings();
+    if (!settings.enabled) {
+      throw new Error('SharePoint integration is disabled. Enable it in Settings > Integrations > SharePoint.');
+    }
+
+    const action = input.action;
+    if (!action) {
+      throw new Error('Missing required "action" parameter');
+    }
+
+    let result;
+
+    switch (action) {
+      case 'get_current_user': {
+        result = await sharepointRequest(settings, { method: 'GET', path: '/me' });
+        break;
+      }
+      case 'search_sites': {
+        if (!input.query) throw new Error('Missing query for search_sites');
+        result = await sharepointRequest(settings, {
+          method: 'GET',
+          path: '/sites',
+          query: { search: input.query },
+        });
+        break;
+      }
+      case 'get_site': {
+        const siteId = this.getSiteId(input.site_id);
+        result = await sharepointRequest(settings, { method: 'GET', path: `/sites/${siteId}` });
+        break;
+      }
+      case 'list_site_drives': {
+        const siteId = this.getSiteId(input.site_id);
+        result = await sharepointRequest(settings, { method: 'GET', path: `/sites/${siteId}/drives` });
+        break;
+      }
+      case 'list_drive_items': {
+        const driveId = this.getDriveId(input.drive_id);
+        const pathSuffix = input.item_id ? `/items/${input.item_id}/children` : '/root/children';
+        result = await sharepointRequest(settings, { method: 'GET', path: `/drives/${driveId}${pathSuffix}` });
+        break;
+      }
+      case 'get_item': {
+        if (!input.item_id) throw new Error('Missing item_id for get_item');
+        const driveId = this.getDriveId(input.drive_id);
+        result = await sharepointRequest(settings, { method: 'GET', path: `/drives/${driveId}/items/${input.item_id}` });
+        break;
+      }
+      case 'create_folder': {
+        if (!input.name) throw new Error('Missing name for create_folder');
+        const driveId = this.getDriveId(input.drive_id);
+        const parentPath = input.parent_id
+          ? `/items/${input.parent_id}/children`
+          : '/root/children';
+        await this.requireApproval('Create a SharePoint folder', {
+          action: 'create_folder',
+          parent_id: input.parent_id || 'root',
+          name: input.name,
+        });
+        result = await sharepointRequest(settings, {
+          method: 'POST',
+          path: `/drives/${driveId}${parentPath}`,
+          body: {
+            name: input.name,
+            folder: {},
+            '@microsoft.graph.conflictBehavior': input.conflict_behavior || 'rename',
+          },
+        });
+        break;
+      }
+      case 'upload_file': {
+        if (!input.file_path) throw new Error('Missing file_path for upload_file');
+        const driveId = this.getDriveId(input.drive_id);
+        const resolved = this.resolveFilePath(input.file_path);
+        const data = fs.readFileSync(resolved);
+        const fileName = input.name || path.basename(resolved);
+        let uploadPath: string;
+        if (input.remote_path) {
+          const cleaned = input.remote_path.replace(/^\/+/, '');
+          const encoded = cleaned
+            .split('/')
+            .map(segment => encodeURIComponent(segment))
+            .join('/');
+          uploadPath = `/drives/${driveId}/root:/${encoded}:/content`;
+        } else if (input.parent_id) {
+          uploadPath = `/drives/${driveId}/items/${input.parent_id}:/${encodeURIComponent(fileName)}:/content`;
+        } else {
+          uploadPath = `/drives/${driveId}/root:/${encodeURIComponent(fileName)}:/content`;
+        }
+        await this.requireApproval(`Upload file to SharePoint: ${fileName}`, {
+          action: 'upload_file',
+          destination: input.remote_path || input.parent_id || 'root',
+          file: fileName,
+        });
+        result = await sharepointRequest(settings, {
+          method: 'PUT',
+          path: uploadPath,
+          body: data,
+          headers: { 'Content-Type': 'application/octet-stream' },
+        });
+        break;
+      }
+      case 'delete_item': {
+        if (!input.item_id) throw new Error('Missing item_id for delete_item');
+        const driveId = this.getDriveId(input.drive_id);
+        await this.requireApproval('Delete a SharePoint item', {
+          action: 'delete_item',
+          item_id: input.item_id,
+        });
+        result = await sharepointRequest(settings, { method: 'DELETE', path: `/drives/${driveId}/items/${input.item_id}` });
+        break;
+      }
+      default:
+        throw new Error(`Unsupported action: ${action}`);
+    }
+
+    this.daemon.logEvent(this.taskId, 'tool_result', {
+      tool: 'sharepoint_action',
+      action,
+      status: result?.status,
+      hasData: result?.data ? true : false,
+    });
+
+    return {
+      success: true,
+      action,
+      status: result?.status,
+      data: result?.data,
+      raw: result?.raw,
+    };
+  }
+}

package/src/electron/agent/tools/shell-tools.ts

@@ -2,6 +2,7 @@ import { spawn, ChildProcess, execSync } from 'child_process';
 import { Workspace, CommandTerminationReason } from '../../../shared/types';
 import { AgentDaemon } from '../daemon';
 import { GuardrailManager } from '../../guardrails/guardrail-manager';
+import { BuiltinToolsSettingsManager } from './builtin-settings';
 
 // Limits to prevent runaway commands
 const MAX_TIMEOUT = 5 * 60 * 1000; // 5 minutes max
@@ -345,9 +346,9 @@ export class ShellTools {
   }
 
   /**
-   * Execute a shell command (requires user approval)
+   * Execute a shell command (requires user approval unless auto-approve is enabled)
    * Note: We don't check workspace.permissions.shell here because
-   * shell commands always require explicit user approval via requestApproval()
+   * shell commands are gated by approval flow (or auto-approve/trust settings)
    */
   async runCommand(
     command: string,
@@ -376,9 +377,16 @@ export class ShellTools {
 
     // Check if command is trusted (auto-approve without user confirmation)
     const trustCheck = GuardrailManager.isCommandTrusted(command);
+    const autoApproveEnabled = BuiltinToolsSettingsManager.getToolAutoApprove('run_command');
     let approved = false;
 
-    if (trustCheck.trusted) {
+    if (autoApproveEnabled && this.isAutoApprovalSafe(command)) {
+      approved = true;
+      this.daemon.logEvent(this.taskId, 'log', {
+        message: 'Auto-approved command (user setting enabled)',
+        command,
+      });
+    } else if (trustCheck.trusted) {
       // Auto-approve trusted commands
       approved = true;
       this.daemon.logEvent(this.taskId, 'log', {

package/src/electron/agent/tools/x-tools.ts

@@ -119,7 +119,7 @@ export class XTools {
   async executeAction(input: XActionInput): Promise<any> {
     const settings = XSettingsManager.loadSettings();
     if (!settings.enabled) {
-      throw new Error('X integration is disabled. Enable it in Settings > More Channels > X.');
+      throw new Error('X integration is disabled. Enable it in Settings > X (Twitter).');
     }
 
     const action = input.action;

package/src/electron/agents/agent-dispatch.ts

@@ -0,0 +1,79 @@
+export type DispatchRole = {
+  displayName: string;
+  description?: string | null;
+  capabilities?: string[];
+  systemPrompt?: string | null;
+  soul?: string | null;
+};
+
+export type DispatchParentTask = {
+  title: string;
+  prompt: string;
+};
+
+export type DispatchPromptOptions = {
+  planSummary?: string;
+};
+
+const buildSoulSummary = (soul?: string): string | null => {
+  if (!soul) return null;
+  try {
+    const parsed = JSON.parse(soul) as Record<string, unknown>;
+    const parts: string[] = [];
+    if (typeof parsed.name === 'string') parts.push(`Name: ${parsed.name}`);
+    if (typeof parsed.role === 'string') parts.push(`Role: ${parsed.role}`);
+    if (typeof parsed.personality === 'string') parts.push(`Personality: ${parsed.personality}`);
+    if (typeof parsed.communicationStyle === 'string') parts.push(`Style: ${parsed.communicationStyle}`);
+    if (Array.isArray(parsed.focusAreas)) parts.push(`Focus: ${parsed.focusAreas.join(', ')}`);
+    if (Array.isArray(parsed.strengths)) parts.push(`Strengths: ${parsed.strengths.join(', ')}`);
+    if (parts.length === 0) {
+      return null;
+    }
+    return parts.join('\n');
+  } catch {
+    return soul;
+  }
+};
+
+export const buildAgentDispatchPrompt = (
+  role: DispatchRole,
+  parentTask: DispatchParentTask,
+  options?: DispatchPromptOptions
+): string => {
+  const lines: string[] = [
+    `You are ${role.displayName}${role.description ? ` — ${role.description}` : ''}.`,
+  ];
+
+  if (role.capabilities && role.capabilities.length > 0) {
+    lines.push(`Capabilities: ${role.capabilities.join(', ')}`);
+  }
+
+  if (role.systemPrompt) {
+    lines.push('System guidance:');
+    lines.push(role.systemPrompt);
+  }
+
+  const soulSummary = buildSoulSummary(role.soul || undefined);
+  if (soulSummary) {
+    lines.push('Role notes:');
+    lines.push(soulSummary);
+  }
+
+  if (options?.planSummary) {
+    lines.push('');
+    lines.push('Main agent plan summary (context only):');
+    lines.push(options.planSummary);
+  }
+
+  lines.push('');
+  lines.push(`Parent task: ${parentTask.title}`);
+  lines.push('Request:');
+  lines.push(parentTask.prompt);
+  lines.push('');
+  lines.push('Deliverables:');
+  lines.push('- Provide a concise summary of your findings.');
+  lines.push('- Call out risks or open questions.');
+  lines.push('- Recommend next steps.');
+
+  return lines.join('\n');
+};

package/src/electron/database/SecureSettingsRepository.ts

@@ -49,7 +49,13 @@ export type SettingsCategory =
   | 'claude-auth'
   | 'queue'
   | 'tray'
-  | 'x';
+  | 'x'
+  | 'notion'
+  | 'box'
+  | 'onedrive'
+  | 'google-drive'
+  | 'dropbox'
+  | 'sharepoint';
 
 interface SecureSettingsRow {
   id: string;

package/src/electron/database/repositories.ts

@@ -27,17 +27,19 @@ export class WorkspaceRepository {
   constructor(private db: Database.Database) {}
 
   create(name: string, path: string, permissions: WorkspacePermissions): Workspace {
+    const now = Date.now();
     const workspace: Workspace = {
       id: uuidv4(),
       name,
       path,
-      createdAt: Date.now(),
+      createdAt: now,
+      lastUsedAt: now,
       permissions,
     };
 
     const stmt = this.db.prepare(`
-      INSERT INTO workspaces (id, name, path, created_at, permissions)
-      VALUES (?, ?, ?, ?, ?)
+      INSERT INTO workspaces (id, name, path, created_at, last_used_at, permissions)
+      VALUES (?, ?, ?, ?, ?, ?)
     `);
 
     stmt.run(
@@ -45,6 +47,7 @@ export class WorkspaceRepository {
       workspace.name,
       workspace.path,
       workspace.createdAt,
+      workspace.lastUsedAt,
       JSON.stringify(workspace.permissions)
     );
 
@@ -58,7 +61,11 @@ export class WorkspaceRepository {
   }
 
   findAll(): Workspace[] {
-    const stmt = this.db.prepare('SELECT * FROM workspaces ORDER BY created_at DESC');
+    const stmt = this.db.prepare(`
+      SELECT *
+      FROM workspaces
+      ORDER BY COALESCE(last_used_at, created_at) DESC
+    `);
     const rows = stmt.all() as any[];
     return rows.map(row => this.mapRowToWorkspace(row));
   }
@@ -89,6 +96,14 @@ export class WorkspaceRepository {
     stmt.run(JSON.stringify(permissions), id);
   }
 
+  /**
+   * Update last used timestamp for recency ordering
+   */
+  updateLastUsedAt(id: string, lastUsedAt: number = Date.now()): void {
+    const stmt = this.db.prepare('UPDATE workspaces SET last_used_at = ? WHERE id = ?');
+    stmt.run(lastUsedAt, id);
+  }
+
   /**
    * Delete a workspace by ID
    */
@@ -120,6 +135,7 @@ export class WorkspaceRepository {
       name: row.name,
       path: row.path,
       createdAt: row.created_at,
+      lastUsedAt: row.last_used_at ?? undefined,
       permissions: mergedPermissions,
     };
   }
@@ -1054,13 +1070,49 @@ export class ChannelUserRepository {
       WHERE channel_id = ?
         AND allowed = 0
         AND channel_user_id LIKE 'pending_%'
-        AND pairing_expires_at IS NOT NULL
-        AND pairing_expires_at < ?
+        AND (
+          pairing_expires_at IS NULL
+          OR pairing_code IS NULL
+          OR pairing_expires_at < ?
+        )
     `);
     const result = stmt.run(channelId, now);
     return result.changes;
   }
 
+  /**
+   * Delete all pending pairing entries for a channel (valid or expired).
+   */
+  deletePendingByChannel(channelId: string): number {
+    const stmt = this.db.prepare(`
+      DELETE FROM channel_users
+      WHERE channel_id = ?
+        AND allowed = 0
+        AND channel_user_id LIKE 'pending_%'
+    `);
+    const result = stmt.run(channelId);
+    return result.changes;
+  }
+
+  /**
+   * Delete expired or empty pending pairing entries across all channels.
+   */
+  deleteExpiredPendingAll(): number {
+    const now = Date.now();
+    const stmt = this.db.prepare(`
+      DELETE FROM channel_users
+      WHERE allowed = 0
+        AND channel_user_id LIKE 'pending_%'
+        AND (
+          pairing_expires_at IS NULL
+          OR pairing_code IS NULL
+          OR pairing_expires_at < ?
+        )
+    `);
+    const result = stmt.run(now);
+    return result.changes;
+  }
+
   findByPairingCode(channelId: string, pairingCode: string): ChannelUser | undefined {
     const stmt = this.db.prepare('SELECT * FROM channel_users WHERE channel_id = ? AND UPPER(pairing_code) = UPPER(?)');
     const row = stmt.get(channelId, pairingCode) as Record<string, unknown> | undefined;

package/src/electron/database/schema.ts

@@ -234,6 +234,7 @@ export class DatabaseManager {
         name TEXT NOT NULL,
         path TEXT NOT NULL UNIQUE,
         created_at INTEGER NOT NULL,
+        last_used_at INTEGER,
         permissions TEXT NOT NULL
       );
 
@@ -592,6 +593,13 @@ export class DatabaseManager {
       }
     }
 
+    // Migration: Add last_used_at to workspaces for recency ordering
+    try {
+      this.db.exec('ALTER TABLE workspaces ADD COLUMN last_used_at INTEGER');
+    } catch {
+      // Column already exists, ignore
+    }
+
     // Migration: Add Sub-Agent / Parallel Agent columns to tasks table
     const subAgentColumns = [
       'ALTER TABLE tasks ADD COLUMN parent_task_id TEXT REFERENCES tasks(id)',

package/src/electron/gateway/channels/discord.ts

@@ -1014,6 +1014,7 @@ export class DiscordAdapter implements ChannelAdapter {
     // Check for thread context
     const isThread = message.channel.isThread();
     const threadId = isThread ? message.channelId : undefined;
+    const isGroup = message.channel.type !== DiscordChannelType.DM;
 
     return {
       messageId: message.id,
@@ -1021,6 +1022,7 @@ export class DiscordAdapter implements ChannelAdapter {
       userId: message.author.id,
       userName: message.author.displayName || message.author.username,
       chatId: isThread ? (message.channel as ThreadChannel).parentId! : message.channelId,
+      isGroup,
       text: commandText || text,
       timestamp: message.createdAt,
       replyTo: message.reference?.messageId,
@@ -1073,6 +1075,7 @@ export class DiscordAdapter implements ChannelAdapter {
 
     // Check for thread context
     const isThread = interaction.channel?.isThread() ?? false;
+    const isGroup = Boolean(interaction.guildId);
 
     return {
       messageId: interaction.id,
@@ -1080,6 +1083,7 @@ export class DiscordAdapter implements ChannelAdapter {
       userId: interaction.user.id,
       userName: interaction.user.displayName || interaction.user.username,
       chatId: interaction.channelId!,
+      isGroup,
       text,
       timestamp: new Date(interaction.createdTimestamp),
       threadId: isThread ? interaction.channelId! : undefined,

package/src/electron/gateway/channels/google-chat.ts

@@ -464,6 +464,8 @@ export class GoogleChatAdapter implements ChannelAdapter {
     const userName = message.sender?.displayName || 'Unknown User';
     const userId = message.sender?.name || '';
 
+    const isGroup = message.space.type !== 'DM';
+
     // Map to IncomingMessage format
     const incomingMessage: IncomingMessage = {
       messageId: messageId,
@@ -471,6 +473,7 @@ export class GoogleChatAdapter implements ChannelAdapter {
       userId: userId,
       userName: userName,
       chatId: spaceId,
+      isGroup,
       text: text,
       timestamp: message.createTime ? new Date(message.createTime) : new Date(),
       threadId: message.thread?.name,

package/src/electron/gateway/channels/line.ts

@@ -451,6 +451,8 @@ export class LineAdapter implements ChannelAdapter {
       });
     }
 
+    const isGroup = lineMessage.source.type !== 'user';
+
     // Convert to IncomingMessage
     const message: IncomingMessage = {
       messageId: lineMessage.id,
@@ -458,6 +460,7 @@ export class LineAdapter implements ChannelAdapter {
       userId: lineMessage.source.userId || '',
       userName,
       chatId,
+      isGroup,
       text: lineMessage.text,
       timestamp: lineMessage.timestamp,
       raw: lineMessage,

package/src/electron/gateway/channels/matrix-client.ts

@@ -191,6 +191,21 @@ export class MatrixClient extends EventEmitter {
     return response.joined_rooms;
   }
 
+  /**
+   * Get direct (1:1) room IDs from account data
+   */
+  async getDirectRooms(): Promise<string[]> {
+    try {
+      const response = await this.apiRequest<Record<string, string[]>>(
+        'GET',
+        `/_matrix/client/v3/user/${encodeURIComponent(this.options.userId)}/account_data/m.direct`
+      );
+      return Object.values(response || {}).flat().filter(Boolean);
+    } catch {
+      return [];
+    }
+  }
+
   /**
    * Start syncing (receiving messages)
    */