happy-coder 0.11.2-0 → 0.12.0-0

package/dist/index.cjs

@@ -1,8 +1,8 @@
 'use strict';
 
 require('chalk');
-require('./index-CFWfkM2k.cjs');
-require('./types-D6ZewYb6.cjs');
+require('./index-BCQGaH21.cjs');
+require('./types-C7skJO9Y.cjs');
 require('zod');
 require('node:child_process');
 require('node:os');

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import 'chalk';
-import './index-B6KoidwE.mjs';
-import './types-CVOFMcT8.mjs';
+import './index-BWDbDDaX.mjs';
+import './types-DdwJ6K-A.mjs';
 import 'zod';
 import 'node:child_process';
 import 'node:os';

package/dist/lib.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var types = require('./types-D6ZewYb6.cjs');
+var types = require('./types-C7skJO9Y.cjs');
 require('axios');
 require('chalk');
 require('fs');

package/dist/lib.d.cts

@@ -66,7 +66,7 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
 }, z.ZodTypeAny, "passthrough">>, z.ZodObject<{
     uuid: z.ZodString;
     type: z.ZodLiteral<"assistant">;
-    message: z.ZodObject<{
+    message: z.ZodOptional<z.ZodObject<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
             cache_creation_input_tokens: z.ZodOptional<z.ZodNumber>;
@@ -86,7 +86,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -107,7 +106,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -128,12 +126,11 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
-    }, z.ZodTypeAny, "passthrough">>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     uuid: z.ZodString;
     type: z.ZodLiteral<"assistant">;
-    message: z.ZodObject<{
+    message: z.ZodOptional<z.ZodObject<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
             cache_creation_input_tokens: z.ZodOptional<z.ZodNumber>;
@@ -153,7 +150,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -174,7 +170,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -195,12 +190,11 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
-    }, z.ZodTypeAny, "passthrough">>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     uuid: z.ZodString;
     type: z.ZodLiteral<"assistant">;
-    message: z.ZodObject<{
+    message: z.ZodOptional<z.ZodObject<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
             cache_creation_input_tokens: z.ZodOptional<z.ZodNumber>;
@@ -220,7 +214,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -241,7 +234,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -262,8 +254,7 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
-    }, z.ZodTypeAny, "passthrough">>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, z.ZodTypeAny, "passthrough">>, z.ZodObject<{
     type: z.ZodLiteral<"summary">;
     summary: z.ZodString;

package/dist/lib.d.mts

@@ -66,7 +66,7 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
 }, z.ZodTypeAny, "passthrough">>, z.ZodObject<{
     uuid: z.ZodString;
     type: z.ZodLiteral<"assistant">;
-    message: z.ZodObject<{
+    message: z.ZodOptional<z.ZodObject<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
             cache_creation_input_tokens: z.ZodOptional<z.ZodNumber>;
@@ -86,7 +86,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -107,7 +106,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -128,12 +126,11 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
-    }, z.ZodTypeAny, "passthrough">>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     uuid: z.ZodString;
     type: z.ZodLiteral<"assistant">;
-    message: z.ZodObject<{
+    message: z.ZodOptional<z.ZodObject<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
             cache_creation_input_tokens: z.ZodOptional<z.ZodNumber>;
@@ -153,7 +150,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -174,7 +170,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -195,12 +190,11 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
-    }, z.ZodTypeAny, "passthrough">>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     uuid: z.ZodString;
     type: z.ZodLiteral<"assistant">;
-    message: z.ZodObject<{
+    message: z.ZodOptional<z.ZodObject<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
             cache_creation_input_tokens: z.ZodOptional<z.ZodNumber>;
@@ -220,7 +214,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -241,7 +234,6 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
         usage: z.ZodOptional<z.ZodObject<{
             input_tokens: z.ZodNumber;
@@ -262,8 +254,7 @@ declare const RawJSONLinesSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
             output_tokens: z.ZodNumber;
             service_tier: z.ZodOptional<z.ZodString>;
         }, z.ZodTypeAny, "passthrough">>>;
-        content: z.ZodAny;
-    }, z.ZodTypeAny, "passthrough">>;
+    }, z.ZodTypeAny, "passthrough">>>;
 }, z.ZodTypeAny, "passthrough">>, z.ZodObject<{
     type: z.ZodLiteral<"summary">;
     summary: z.ZodString;

package/dist/lib.mjs

@@ -1,4 +1,4 @@
-export { A as ApiClient, a as ApiSessionClient, R as RawJSONLinesSchema, c as configuration, l as logger } from './types-CVOFMcT8.mjs';
+export { A as ApiClient, a as ApiSessionClient, R as RawJSONLinesSchema, c as configuration, l as logger } from './types-DdwJ6K-A.mjs';
 import 'axios';
 import 'chalk';
 import 'fs';

package/dist/{runCodex-Dxi7L-oi.cjs → runCodex-BwpHgdkt.cjs}

@@ -2,14 +2,14 @@
 
 var ink = require('ink');
 var React = require('react');
-var types = require('./types-D6ZewYb6.cjs');
+var types = require('./types-C7skJO9Y.cjs');
 var index_js = require('@modelcontextprotocol/sdk/client/index.js');
 var stdio_js = require('@modelcontextprotocol/sdk/client/stdio.js');
 var z = require('zod');
 var types_js = require('@modelcontextprotocol/sdk/types.js');
 var child_process = require('child_process');
 var node_crypto = require('node:crypto');
-var index = require('./index-CFWfkM2k.cjs');
+var index = require('./index-BCQGaH21.cjs');
 var os = require('node:os');
 var node_path = require('node:path');
 var fs = require('node:fs');
@@ -75,7 +75,7 @@ class CodexMcpClient {
   constructor() {
     this.client = new index_js.Client(
       { name: "happy-codex-client", version: "1.0.0" },
-      { capabilities: { tools: {}, elicitation: {} } }
+      { capabilities: { elicitation: {} } }
     );
     this.client.setNotificationHandler(z.z.object({
       method: z.z.literal("codex/event"),

package/dist/{runCodex-BJlyTS8v.mjs → runCodex-IZ3YFeAC.mjs}

@@ -1,13 +1,13 @@
 import { useStdout, useInput, Box, Text, render } from 'ink';
 import React, { useState, useRef, useEffect, useCallback } from 'react';
-import { l as logger, A as ApiClient, r as readSettings, p as projectPath, c as configuration, b as packageJson } from './types-CVOFMcT8.mjs';
+import { l as logger, A as ApiClient, r as readSettings, p as projectPath, c as configuration, b as packageJson } from './types-DdwJ6K-A.mjs';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { z } from 'zod';
 import { ElicitRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { execSync } from 'child_process';
 import { randomUUID } from 'node:crypto';
-import { i as initialMachineMetadata, n as notifyDaemonSessionStarted, M as MessageQueue2, h as hashObject, r as registerKillSessionHandler, a as MessageBuffer, s as startHappyServer, t as trimIdent, b as stopCaffeinate } from './index-B6KoidwE.mjs';
+import { i as initialMachineMetadata, n as notifyDaemonSessionStarted, M as MessageQueue2, h as hashObject, r as registerKillSessionHandler, a as MessageBuffer, s as startHappyServer, t as trimIdent, b as stopCaffeinate } from './index-BWDbDDaX.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import fs from 'node:fs';
@@ -73,7 +73,7 @@ class CodexMcpClient {
   constructor() {
     this.client = new Client(
       { name: "happy-codex-client", version: "1.0.0" },
-      { capabilities: { tools: {}, elicitation: {} } }
+      { capabilities: { elicitation: {} } }
     );
     this.client.setNotificationHandler(z.object({
       method: z.literal("codex/event"),

package/dist/{types-D6ZewYb6.cjs → types-C7skJO9Y.cjs}

@@ -42,7 +42,7 @@ function _interopNamespaceDefault(e) {
 var z__namespace = /*#__PURE__*/_interopNamespaceDefault(z);
 
 var name = "happy-coder";
-var version = "0.11.2-0";
+var version = "0.12.0-0";
 var description = "Mobile and Web client for Claude Code and Codex";
 var author = "Kirill Dubovitskiy";
 var license = "MIT";
@@ -101,7 +101,9 @@ var scripts = {
 	typecheck: "tsc --noEmit",
 	build: "shx rm -rf dist && npx tsc --noEmit && pkgroll",
 	test: "yarn build && tsx --env-file .env.integration-test node_modules/.bin/vitest run",
+	"test:win": "yarn build && npx vitest run",
 	start: "yarn build && ./bin/happy.mjs",
+	"start:win": "yarn build && node ./bin/happy.mjs",
 	dev: "tsx src/index.ts",
 	"dev:local-server": "yarn build && tsx --env-file .env.dev-local-server src/index.ts",
 	"dev:integration-test-env": "yarn build && tsx --env-file .env.integration-test src/index.ts",
@@ -110,32 +112,30 @@ var scripts = {
 	postinstall: "node scripts/unpack-tools.cjs"
 };
 var dependencies = {
-	"@anthropic-ai/claude-code": "^2.0.13",
-	"@anthropic-ai/sdk": "0.65.0",
-	"@modelcontextprotocol/sdk": "^1.15.1",
+	"@modelcontextprotocol/sdk": "^1.22.0",
 	"@stablelib/base64": "^2.0.1",
 	"@stablelib/hex": "^2.0.1",
 	"@types/cross-spawn": "^6.0.6",
-	"@types/http-proxy": "^1.17.16",
+	"@types/http-proxy": "^1.17.17",
 	"@types/ps-list": "^6.2.1",
 	"@types/qrcode-terminal": "^0.12.2",
-	"@types/react": "^19.1.9",
+	"@types/react": "^19.2.7",
 	"@types/tmp": "^0.2.6",
-	axios: "^1.10.0",
-	chalk: "^5.4.1",
+	axios: "^1.13.2",
+	chalk: "^5.6.2",
 	"cross-spawn": "^7.0.6",
 	"expo-server-sdk": "^3.15.0",
-	fastify: "^5.5.0",
+	fastify: "^5.6.2",
 	"fastify-type-provider-zod": "4.0.2",
 	"http-proxy": "^1.18.1",
 	"http-proxy-middleware": "^3.0.5",
-	ink: "^6.1.0",
+	ink: "^6.5.1",
 	open: "^10.2.0",
 	"ps-list": "^8.1.1",
 	"qrcode-terminal": "^0.12.0",
-	react: "^19.1.1",
+	react: "^19.2.0",
 	"socket.io-client": "^4.8.1",
-	tar: "^7.4.3",
+	tar: "^7.5.2",
 	tmp: "^0.2.5",
 	tweetnacl: "^1.0.3",
 	zod: "^3.23.8"
@@ -143,15 +143,15 @@ var dependencies = {
 var devDependencies = {
 	"@eslint/compat": "^1",
 	"@types/node": ">=20",
-	"cross-env": "^10.0.0",
+	"cross-env": "^10.1.0",
 	dotenv: "^16.6.1",
 	eslint: "^9",
 	"eslint-config-prettier": "^10",
 	pkgroll: "^2.14.2",
-	"release-it": "^19.0.4",
+	"release-it": "^19.0.6",
 	shx: "^0.3.3",
 	"ts-node": "^10",
-	tsx: "^4.20.3",
+	tsx: "^4.20.6",
 	typescript: "^5",
 	vitest: "^3.2.4"
 };
@@ -1019,7 +1019,7 @@ class RpcHandlerManager {
   }
 }
 
-const __dirname$1 = path.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('types-D6ZewYb6.cjs', document.baseURI).href))));
+const __dirname$1 = path.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('types-C7skJO9Y.cjs', document.baseURI).href))));
 function projectPath() {
   const path$1 = path.resolve(__dirname$1, "..");
   return path$1;
@@ -1091,10 +1091,28 @@ function run(args, options) {
   });
 }
 
+function validatePath(targetPath, workingDirectory) {
+  const resolvedTarget = path.resolve(workingDirectory, targetPath);
+  const resolvedWorkingDir = path.resolve(workingDirectory);
+  if (!resolvedTarget.startsWith(resolvedWorkingDir + "/") && resolvedTarget !== resolvedWorkingDir) {
+    return {
+      valid: false,
+      error: `Access denied: Path '${targetPath}' is outside the working directory`
+    };
+  }
+  return { valid: true };
+}
+
 const execAsync = util.promisify(child_process.exec);
-function registerCommonHandlers(rpcHandlerManager) {
+function registerCommonHandlers(rpcHandlerManager, workingDirectory) {
   rpcHandlerManager.registerHandler("bash", async (data) => {
     logger.debug("Shell command request:", data.command);
+    if (data.cwd) {
+      const validation = validatePath(data.cwd, workingDirectory);
+      if (!validation.valid) {
+        return { success: false, error: validation.error };
+      }
+    }
     try {
       const options = {
         cwd: data.cwd,
@@ -1130,6 +1148,10 @@ function registerCommonHandlers(rpcHandlerManager) {
   });
   rpcHandlerManager.registerHandler("readFile", async (data) => {
     logger.debug("Read file request:", data.path);
+    const validation = validatePath(data.path, workingDirectory);
+    if (!validation.valid) {
+      return { success: false, error: validation.error };
+    }
     try {
       const buffer = await fs$2.readFile(data.path);
       const content = buffer.toString("base64");
@@ -1141,6 +1163,10 @@ function registerCommonHandlers(rpcHandlerManager) {
   });
   rpcHandlerManager.registerHandler("writeFile", async (data) => {
     logger.debug("Write file request:", data.path);
+    const validation = validatePath(data.path, workingDirectory);
+    if (!validation.valid) {
+      return { success: false, error: validation.error };
+    }
     try {
       if (data.expectedHash !== null && data.expectedHash !== void 0) {
         try {
@@ -1187,6 +1213,10 @@ function registerCommonHandlers(rpcHandlerManager) {
   });
   rpcHandlerManager.registerHandler("listDirectory", async (data) => {
     logger.debug("List directory request:", data.path);
+    const validation = validatePath(data.path, workingDirectory);
+    if (!validation.valid) {
+      return { success: false, error: validation.error };
+    }
     try {
       const entries = await fs$2.readdir(data.path, { withFileTypes: true });
       const directoryEntries = await Promise.all(
@@ -1228,6 +1258,10 @@ function registerCommonHandlers(rpcHandlerManager) {
   });
   rpcHandlerManager.registerHandler("getDirectoryTree", async (data) => {
     logger.debug("Get directory tree request:", data.path, "maxDepth:", data.maxDepth);
+    const validation = validatePath(data.path, workingDirectory);
+    if (!validation.valid) {
+      return { success: false, error: validation.error };
+    }
     async function buildTree(path$1, name, currentDepth) {
       try {
         const stats = await fs$2.stat(path$1);
@@ -1284,6 +1318,12 @@ function registerCommonHandlers(rpcHandlerManager) {
   });
   rpcHandlerManager.registerHandler("ripgrep", async (data) => {
     logger.debug("Ripgrep request with args:", data.args, "cwd:", data.cwd);
+    if (data.cwd) {
+      const validation = validatePath(data.cwd, workingDirectory);
+      if (!validation.valid) {
+        return { success: false, error: validation.error };
+      }
+    }
     try {
       const result = await run$1(data.args, { cwd: data.cwd });
       return {
@@ -1302,6 +1342,12 @@ function registerCommonHandlers(rpcHandlerManager) {
   });
   rpcHandlerManager.registerHandler("difftastic", async (data) => {
     logger.debug("Difftastic request with args:", data.args, "cwd:", data.cwd);
+    if (data.cwd) {
+      const validation = validatePath(data.cwd, workingDirectory);
+      if (!validation.valid) {
+        return { success: false, error: validation.error };
+      }
+    }
     try {
       const result = await run(data.args, { cwd: data.cwd });
       return {
@@ -1351,7 +1397,7 @@ class ApiSessionClient extends node_events.EventEmitter {
       encryptionVariant: this.encryptionVariant,
       logger: (msg, data) => logger.debug(msg, data)
     });
-    registerCommonHandlers(this.rpcHandlerManager);
+    registerCommonHandlers(this.rpcHandlerManager, this.metadata.path);
     this.socket = socket_ioClient.io(configuration.serverUrl, {
       auth: {
         token: this.token,
@@ -1467,7 +1513,7 @@ class ApiSessionClient extends node_events.EventEmitter {
       sid: this.sessionId,
       message: encrypted
     });
-    if (body.type === "assistant" && body.message.usage) {
+    if (body.type === "assistant" && body.message?.usage) {
       try {
         this.sendUsageData(body.message.usage);
       } catch (error) {
@@ -1641,7 +1687,7 @@ class ApiMachineClient {
       encryptionVariant: this.machine.encryptionVariant,
       logger: (msg, data) => logger.debug(msg, data)
     });
-    registerCommonHandlers(this.rpcHandlerManager);
+    registerCommonHandlers(this.rpcHandlerManager, process.cwd());
   }
   socket;
   keepAliveInterval = null;
@@ -1857,7 +1903,7 @@ class PushNotificationClient {
       );
       logger.debug(`Fetched ${response.data.tokens.length} push tokens`);
       response.data.tokens.forEach((token, index) => {
-        logger.debug(`[PUSH] Token ${index + 1}: id=${token.id}, token=${token.token}, created=${new Date(token.createdAt).toISOString()}, updated=${new Date(token.updatedAt).toISOString()}`);
+        logger.debug(`[PUSH] Token ${index + 1}: id=${token.id}, created=${new Date(token.createdAt).toISOString()}, updated=${new Date(token.updatedAt).toISOString()}`);
       });
       return response.data.tokens;
     } catch (error) {
@@ -1931,14 +1977,14 @@ class PushNotificationClient {
         const tokens = await this.fetchPushTokens();
         logger.debug(`[PUSH] Fetched ${tokens.length} push tokens`);
         tokens.forEach((token, index) => {
-          logger.debug(`[PUSH] Using token ${index + 1}: id=${token.id}, token=${token.token}`);
+          logger.debug(`[PUSH] Using token ${index + 1}: id=${token.id}`);
         });
         if (tokens.length === 0) {
           logger.debug("No push tokens found for user");
           return;
         }
         const messages = tokens.map((token, index) => {
-          logger.debug(`[PUSH] Creating message ${index + 1} for token: ${token.token}`);
+          logger.debug(`[PUSH] Creating message ${index + 1} for token`);
           return {
             to: token.token,
             title,
@@ -2135,17 +2181,16 @@ const RawJSONLinesSchema = z.z.discriminatedUnion("type", [
       // Used in sessionScanner.ts
     }).passthrough()
   }).passthrough(),
-  // Assistant message - validates message object with usage and content
+  // Assistant message - only validates uuid and type
+  // message object is optional to handle synthetic error messages (isApiErrorMessage: true)
+  // which may have different structure than normal assistant messages
   z.z.object({
     uuid: z.z.string(),
     type: z.z.literal("assistant"),
     message: z.z.object({
-      // Entire message used in getMessageKey()
-      usage: UsageSchema.optional(),
+      usage: UsageSchema.optional()
       // Used in apiSession.ts
-      content: z.z.any()
-      // Used in tests
-    }).passthrough()
+    }).passthrough().optional()
   }).passthrough(),
   // Summary message - validates summary and leafUuid
   z.z.object({