lavish-axi 0.1.83 → 0.1.84

package/dist/cli.mjs

@@ -21,7 +21,7 @@ import { access, readFile as readFile6, writeFile as writeFile4 } from "node:fs/
 import { get as httpGet2 } from "node:http";
 import { isIP as isIP4 } from "node:net";
 import os4 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { AxiError, installSessionStartHooks, RESERVED_COMMANDS, runAxiCli } from "axi-sdk-js";
 
@@ -4427,7 +4427,7 @@ function htmlAppRequestError(message, details = {}) {
   if (status !== void 0) Object.defineProperty(error, "status", { value: status, enumerable: true });
   return error;
 }
-async function requestHtmlApp({ method, path: path9, body, bearer, options, env, action = "publish" }) {
+async function requestHtmlApp({ method, path: path10, body, bearer, options, env, action = "publish" }) {
   const apiUrl = (options.apiUrl ? String(options.apiUrl).replace(/\/+$/, "") : "") || htmlAppApiUrl(env);
   const fetchImpl = options.fetch || fetch;
   const headers = { "content-type": "application/json", "user-agent": "lavish-axi" };
@@ -4437,7 +4437,7 @@ async function requestHtmlApp({ method, path: path9, body, bearer, options, env,
   let response;
   let text;
   try {
-    response = await fetchImpl(`${apiUrl}${path9}`, {
+    response = await fetchImpl(`${apiUrl}${path10}`, {
       method,
       headers,
       body: JSON.stringify(body),
@@ -4704,10 +4704,10 @@ function writeTextFileAtomically(file, content, operations = {}) {
   const rename3 = operations.renameSync || renameSync;
   const remove = operations.rmSync || rmSync;
   const chmod2 = operations.chmodSync || chmodSync;
-  const stat3 = operations.statSync || statSync;
+  const stat4 = operations.statSync || statSync;
   let mode;
   try {
-    mode = stat3(file).mode & 511;
+    mode = stat4(file).mode & 511;
   } catch {
   }
   try {
@@ -4829,11 +4829,11 @@ function attrValue(attrs, name) {
 import crypto6 from "node:crypto";
 import { EventEmitter } from "node:events";
 import { existsSync as existsSync2 } from "node:fs";
-import { readFile as readFile5, realpath as realpath3 } from "node:fs/promises";
+import { readFile as readFile5, realpath as realpath4 } from "node:fs/promises";
 import { createServer, get as httpGet } from "node:http";
 import { isIP as isIP3 } from "node:net";
 import { homedir } from "node:os";
-import path7 from "node:path";
+import path8 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import chokidar from "chokidar";
 import express from "express";
@@ -5925,15 +5925,15 @@ function createArtifactSdk(deriveQueueKey, isNativeInteractive = isNativeInterac
     return node.parentElement || document.body;
   }
   function nodePath(node, root) {
-    const path9 = [];
+    const path10 = [];
     let current = node;
     while (current && current !== root) {
       const parentNode = current.parentNode;
       if (!parentNode) break;
-      path9.unshift([...parentNode.childNodes].indexOf(current));
+      path10.unshift([...parentNode.childNodes].indexOf(current));
       current = parentNode;
     }
-    return path9;
+    return path10;
   }
   function rangeBoundary(node, offset) {
     const el = closestElement(node);
@@ -8459,10 +8459,53 @@ function isIncompleteRunningTailscaleStatus(raw) {
   return addresses.some((address) => typeof address === "string" && isIP2(address.trim()) === 4);
 }
 
+// src/artifact-path.js
+import { realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import path5 from "node:path";
+var ARTIFACT_HTML_ERROR = "Lavish Editor expects an HTML file";
+function isHtmlPath(file) {
+  const lower = String(file || "").toLowerCase();
+  return lower.endsWith(".html") || lower.endsWith(".htm");
+}
+function artifactTreeRoot(file) {
+  return path5.dirname(file);
+}
+var ArtifactPathError = class extends Error {
+  /** @type {"VALIDATION_ERROR"} */
+  code = "VALIDATION_ERROR";
+  /** @type {400} */
+  statusCode = 400;
+  /**
+   * @param {string} [message]
+   */
+  constructor(message = ARTIFACT_HTML_ERROR) {
+    super(message);
+    this.name = "ArtifactPathError";
+  }
+};
+function isArtifactPathError(error) {
+  return error instanceof Error && error.name === "ArtifactPathError";
+}
+async function resolveAllowedArtifactFile(file) {
+  const requested = typeof file === "string" ? file : "";
+  if (!isHtmlPath(requested)) {
+    throw new ArtifactPathError();
+  }
+  const canonical = await realpath2(path5.resolve(requested));
+  if (!isHtmlPath(canonical)) {
+    throw new ArtifactPathError();
+  }
+  const info = await stat2(canonical);
+  if (!info.isFile()) {
+    throw new ArtifactPathError();
+  }
+  return canonical;
+}
+
 // src/session-store.js
 import crypto4 from "node:crypto";
-import { readFile as readFile3, realpath as realpath2, writeFile as writeFile2 } from "node:fs/promises";
-import path5 from "node:path";
+import { readFile as readFile3, realpath as realpath3, writeFile as writeFile2 } from "node:fs/promises";
+import path6 from "node:path";
 
 // src/async-mutex.js
 var AsyncMutex = class {
@@ -9118,8 +9161,8 @@ var SessionStore = class {
   }
 };
 async function canonicalFile(file) {
-  const absolute = path5.resolve(file);
-  return realpath2(absolute);
+  const absolute = path6.resolve(file);
+  return realpath3(absolute);
 }
 function sessionKey(file) {
   return crypto4.createHash("sha256").update(file).digest("hex").slice(0, 16);
@@ -9359,8 +9402,8 @@ function generateSharePassword() {
 
 // src/attachment-store.js
 import crypto5 from "node:crypto";
-import { chmod, mkdir as mkdir3, readdir, readFile as readFile4, rename as rename2, rm as rm2, stat as stat2, utimes, writeFile as writeFile3 } from "node:fs/promises";
-import path6 from "node:path";
+import { chmod, mkdir as mkdir3, readdir, readFile as readFile4, rename as rename2, rm as rm2, stat as stat3, utimes, writeFile as writeFile3 } from "node:fs/promises";
+import path7 from "node:path";
 var KEY_RE2 = /^[0-9a-f]{16}$/;
 var ID_RE = /^[0-9a-f]{64}\.(png|jpg|webp)$/;
 var MIME_BY_EXT = { png: "image/png", jpg: "image/jpeg", webp: "image/webp" };
@@ -9388,10 +9431,10 @@ function isValidAttachmentId(id) {
   return ID_RE.test(String(id || ""));
 }
 function attachmentsDir(stateDir2, key) {
-  return path6.join(stateDir2, "attachments", String(key));
+  return path7.join(stateDir2, "attachments", String(key));
 }
 function attachmentFile(stateDir2, key, id) {
-  return path6.join(attachmentsDir(stateDir2, key), id);
+  return path7.join(attachmentsDir(stateDir2, key), id);
 }
 function resolveAttachmentConfig(env = process.env) {
   const maxDiskBytes = diskCapEnv(env.LAVISH_AXI_MAX_ATTACHMENT_DISK_MB);
@@ -9526,7 +9569,7 @@ function buildMetadata(id, file, mime, bytes, dims) {
 }
 async function pathExists(file) {
   try {
-    await stat2(file);
+    await stat3(file);
     return true;
   } catch (error) {
     if (error && error.code === "ENOENT") return false;
@@ -9566,7 +9609,7 @@ async function writeFileAtomically2(file, content) {
   }
 }
 async function ensureAttachmentDir(stateDir2, key) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   const dir = attachmentsDir(stateDir2, key);
   await mkdir3(dir, { recursive: true, mode: ATTACHMENT_DIR_MODE });
   for (const target of [root, dir]) {
@@ -9647,7 +9690,7 @@ async function resolveAttachment(stateDir2, key, id) {
   const file = attachmentFile(stateDir2, key, id);
   let info;
   try {
-    info = await stat2(file);
+    info = await stat3(file);
   } catch (error) {
     if (error && error.code === "ENOENT") return null;
     throw error;
@@ -9661,7 +9704,7 @@ async function statAttachmentForServe(stateDir2, key, id) {
   if (!isValidAttachmentKey(key) || !isValidAttachmentId(id)) return null;
   const file = attachmentFile(stateDir2, key, id);
   try {
-    const info = await stat2(file);
+    const info = await stat3(file);
     if (!info.isFile()) return null;
   } catch (error) {
     if (error && error.code === "ENOENT") return null;
@@ -9690,20 +9733,20 @@ async function removeAttachment(stateDir2, key, id) {
   }
 }
 async function listAttachments(stateDir2) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   const sessionDirs = await readdirSafe(root);
   const files = [];
   for (const dirent of sessionDirs) {
     if (!dirent.isDirectory() || !isValidAttachmentKey(dirent.name)) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     for (const entry of await readdirSafe(dir)) {
       if (!entry.isFile() || !isValidAttachmentId(entry.name)) continue;
-      const filePath = path6.join(dir, entry.name);
+      const filePath = path7.join(dir, entry.name);
       try {
-        const info = await stat2(filePath);
+        const info = await stat3(filePath);
         let sidecarBytes = 0;
         try {
-          sidecarBytes = (await stat2(sidecarPath(filePath))).size;
+          sidecarBytes = (await stat3(sidecarPath(filePath))).size;
         } catch {
         }
         files.push({
@@ -9780,19 +9823,19 @@ async function sweepAttachments(stateDir2, options = {}) {
   const orphans = await reapOrphanFiles(stateDir2, now);
   deleted += orphans.deleted;
   freedBytes += orphans.freedBytes;
-  await pruneEmptyDirs(path6.join(stateDir2, "attachments"));
+  await pruneEmptyDirs(path7.join(stateDir2, "attachments"));
   return { deleted, freedBytes };
 }
 async function committedChargedBytes(stateDir2) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   let total = 0;
   for (const dirent of await readdirSafe(root)) {
     if (!dirent.isDirectory() || !isValidAttachmentKey(dirent.name)) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     for (const entry of await readdirSafe(dir)) {
       if (!entry.isFile()) continue;
       try {
-        total += allocatedBytes((await stat2(path6.join(dir, entry.name))).size);
+        total += allocatedBytes((await stat3(path7.join(dir, entry.name))).size);
       } catch {
       }
     }
@@ -9800,28 +9843,28 @@ async function committedChargedBytes(stateDir2) {
   return total;
 }
 async function reapOrphanFiles(stateDir2, now) {
-  const root = path6.join(stateDir2, "attachments");
+  const root = path7.join(stateDir2, "attachments");
   let deleted = 0;
   let freedBytes = 0;
   for (const dirent of await readdirSafe(root)) {
     if (!dirent.isDirectory() || !isValidAttachmentKey(dirent.name)) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     const entries = await readdirSafe(dir);
     const present = new Set(entries.filter((e) => e.isFile()).map((e) => e.name));
     for (const entry of entries) {
       if (!entry.isFile()) continue;
-      const filePath = path6.join(dir, entry.name);
+      const filePath = path7.join(dir, entry.name);
       const sidecarMatch = SIDECAR_ORPHAN_RE.exec(entry.name);
       try {
         if (TEMP_FILE_RE.test(entry.name)) {
-          const info = await stat2(filePath);
+          const info = await stat3(filePath);
           if (now - info.mtimeMs <= ATTACHMENT_TEMP_GRACE_MS) continue;
           if (await removeFile(filePath)) {
             deleted += 1;
             freedBytes += info.size;
           }
         } else if (sidecarMatch && !present.has(sidecarMatch[1])) {
-          const info = await stat2(filePath);
+          const info = await stat3(filePath);
           if (await removeFile(filePath)) {
             deleted += 1;
             freedBytes += info.size;
@@ -9854,7 +9897,7 @@ async function removeFile(file) {
 async function pruneEmptyDirs(root) {
   for (const dirent of await readdirSafe(root)) {
     if (!dirent.isDirectory()) continue;
-    const dir = path6.join(root, dirent.name);
+    const dir = path7.join(root, dirent.name);
     try {
       if ((await readdir(dir)).length === 0) await rm2(dir, { recursive: true, force: true });
     } catch {
@@ -10233,7 +10276,7 @@ async function serve({
     if (pendingAfterRestore) events.emit("feedback", key);
     await publishChatSync(key);
   }
-  const whiteboardStateRoot = path7.dirname(stateFile2);
+  const whiteboardStateRoot = path8.dirname(stateFile2);
   const allowedHostnames = buildAllowedHostnames({
     host: requestedListenHosts[0],
     hosts: [...requestedListenHosts, ...listenHosts],
@@ -10265,6 +10308,11 @@ async function serve({
       workingUrl: workingUrlFor(req, { includeSessionPath: false })
     });
   }
+  function refuseNonHtmlArtifact(session, res) {
+    if (isHtmlPath(session.file)) return false;
+    res.status(403).send("Forbidden");
+    return true;
+  }
   if (!allowAnyHostname) {
     app.use((req, res, next) => {
       const requestHost = { host: req.headers.host, forwardedHost: req.headers["x-forwarded-host"] };
@@ -10295,7 +10343,7 @@ async function serve({
     next();
   });
   const attachmentConfig = resolveAttachmentConfig();
-  const attachmentStateRoot = path7.dirname(stateFile2);
+  const attachmentStateRoot = path8.dirname(stateFile2);
   const defaultJsonParser = express.json({ limit: "2mb" });
   const whiteboardJsonParser = express.json({ limit: "20mb" });
   app.use((req, res, next) => {
@@ -10318,7 +10366,7 @@ async function serve({
       app: "lavish-axi",
       version,
       state_id: serverStateId,
-      state_dir: path7.dirname(stateFile2),
+      state_dir: path8.dirname(stateFile2),
       // Where this process is listening and every address it was asked to serve (bound or still
       // retrying). The CLI uses both to find one daemon per port whatever host it was configured
       // with, and to tell a same-port daemon at another address apart from this one.
@@ -10346,7 +10394,7 @@ async function serve({
   });
   app.post("/api/sessions", async (req, res, next) => {
     try {
-      const file = await canonicalFile(req.body.file);
+      const file = await resolveAllowedArtifactFile(req.body?.file);
       const key = sessionKey(file);
       const reopen = Boolean(req.body.reopen);
       const existing = await store.findByKey(key);
@@ -10378,6 +10426,14 @@ async function serve({
         ...networkWarningField()
       });
     } catch (error) {
+      if (isArtifactPathError(error)) {
+        res.status(error.statusCode).json({
+          status: "error",
+          code: error.code,
+          error: error.message
+        });
+        return;
+      }
       next(error);
     }
   });
@@ -10806,8 +10862,9 @@ async function serve({
         res.status(404).json({ error: "session not found" });
         return;
       }
+      if (refuseNonHtmlArtifact(session, res)) return;
       const source = await readFile5(session.file, "utf8");
-      const root = path7.dirname(session.file);
+      const root = path8.dirname(session.file);
       const { html, warnings } = await buildSelfContainedHtml(source, {
         baseDir: root,
         confineDir: root,
@@ -10834,11 +10891,12 @@ async function serve({
         res.status(404).json({ error: "session not found" });
         return;
       }
+      if (refuseNonHtmlArtifact(session, res)) return;
       const body = req.body || {};
       const generatePassword = body.generate_password === true;
       const password = generatePassword ? generateSharePassword() : optionalBodyString(body.password);
       const source = await readFile5(session.file, "utf8");
-      const root = path7.dirname(session.file);
+      const root = path8.dirname(session.file);
       const { html, warnings } = await buildSelfContainedHtml(source, {
         baseDir: root,
         confineDir: root,
@@ -10909,6 +10967,7 @@ async function serve({
         return;
       }
       const session = chromeLoad.session;
+      if (refuseNonHtmlArtifact(session, res)) return;
       await watchSession(session, watchers, events, logEvent, reloadDebounceMs);
       const artifactHtml = await readFile5(session.file, "utf8").catch(() => "");
       const { faviconTag, title } = extractArtifactHead(artifactHtml);
@@ -10986,6 +11045,7 @@ async function serve({
         sendSessionNotFound(req, res);
         return;
       }
+      if (refuseNonHtmlArtifact(beforeRead.session, res)) return;
       if (!beforeRead.valid) {
         res.status(409).type("html").send(
           "<!doctype html><title>Artifact load expired</title><p>This artifact load is no longer current. Reload Lavish to continue.</p>"
@@ -11015,7 +11075,8 @@ async function serve({
         sendSessionNotFound(req, res);
         return;
       }
-      const root = path7.dirname(session.file);
+      if (refuseNonHtmlArtifact(session, res)) return;
+      const root = artifactTreeRoot(session.file);
       const file = await resolveArtifactAsset(root, assetPath);
       if (!file) {
         res.status(403).send("Forbidden");
@@ -11122,6 +11183,7 @@ data: ${JSON.stringify({ reason: "server-restarted" })}
         res.status(404).json({ error: "session not found" });
         return;
       }
+      if (refuseNonHtmlArtifact(session, res)) return;
       const html = await readFile5(session.file, "utf8").catch(() => "");
       const sources = extractMermaidSources(html).map(({ index, source }) => ({
         index,
@@ -11837,14 +11899,14 @@ function optionalBodyString(value) {
   return trimmed || void 0;
 }
 async function resolveArtifactAsset(root, assetPath) {
-  const file = path7.resolve(root, assetPath);
-  const relative = path7.relative(root, file);
-  if (relative.startsWith("..") || path7.isAbsolute(relative)) {
+  const file = path8.resolve(root, assetPath);
+  const relative = path8.relative(root, file);
+  if (relative.startsWith("..") || path8.isAbsolute(relative)) {
     return null;
   }
   let real;
   try {
-    real = await realpath3(file);
+    real = await realpath4(file);
   } catch (error) {
     if (error?.code === "ENOENT" || error?.code === "ENOTDIR") {
       return file;
@@ -11853,12 +11915,12 @@ async function resolveArtifactAsset(root, assetPath) {
   }
   let realRoot;
   try {
-    realRoot = await realpath3(root);
+    realRoot = await realpath4(root);
   } catch {
-    realRoot = path7.resolve(root);
+    realRoot = path8.resolve(root);
   }
-  const relativeReal = path7.relative(realRoot, real);
-  if (relativeReal === ".." || relativeReal.startsWith(`..${path7.sep}`) || path7.isAbsolute(relativeReal)) {
+  const relativeReal = path8.relative(realRoot, real);
+  if (relativeReal === ".." || relativeReal.startsWith(`..${path8.sep}`) || path8.isAbsolute(relativeReal)) {
     return null;
   }
   return real;
@@ -11894,7 +11956,7 @@ async function resolveWatchTarget(session) {
     const html = await readFile5(session.file, "utf8");
     if (hasLiveReloadRootOptIn(html)) {
       return {
-        path: path7.dirname(session.file),
+        path: path8.dirname(session.file),
         scope: "directory",
         options: {
           ...baseOptions,
@@ -12348,9 +12410,9 @@ var HttpTelemetryClient = class {
     if (!trimmed) return;
     this.send(trimmed, eventURL(this.app, trimmed), fields);
   }
-  pageview(path9, fields = {}) {
+  pageview(path10, fields = {}) {
     if (this.closed) return;
-    this.send("", normalizePagePath(path9), fields);
+    this.send("", normalizePagePath(path10), fields);
   }
   async close(timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS) {
     this.closed = true;
@@ -12425,8 +12487,8 @@ function eventURL(app, name) {
   if (!name) return `app://${app}`;
   return `app://${app}/${name.replace(/\./g, "/")}`;
 }
-function normalizePagePath(path9) {
-  const trimmed = String(path9 || "").trim();
+function normalizePagePath(path10) {
+  const trimmed = String(path10 || "").trim();
   if (!trimmed) return "/";
   return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
 }
@@ -12468,7 +12530,7 @@ var AGENT_REPLY_INPUT_LIMIT_BYTES = AGENT_REPLY_JSON_LIMIT_BYTES - AGENT_REPLY_J
 var AGENT_REPLY_LIMIT_LABEL = "2 MB JSON request limit";
 var POLL_STATE_HEADER = "lavish-poll-state";
 var CODEX_POLL_WAKE_PATH_GUIDANCE = "Codex detected: completed background tasks may not resume Codex automatically, so keep the poll attached to the active turn.";
-var VERSION = "0.1.83";
+var VERSION = "0.1.84";
 function detectInvokingAgent(env = process.env) {
   return ["CODEX_SANDBOX", "CODEX_THREAD_ID"].some((key) => Object.hasOwn(env, key)) ? "codex" : "generic";
 }
@@ -12946,8 +13008,8 @@ async function exportCommand(args) {
   }
   await assertHtmlFile(file);
   const absolute = await canonicalFile(file);
-  const root = path8.dirname(absolute);
-  const output = path8.resolve(flagValue(args, "--out") || path8.join(root, exportFileName(absolute)));
+  const root = path9.dirname(absolute);
+  const output = path9.resolve(flagValue(args, "--out") || path9.join(root, exportFileName(absolute)));
   const source = await readFile6(absolute, "utf8");
   const { html, warnings } = await buildSelfContainedHtml(source, {
     baseDir: root,
@@ -13002,7 +13064,7 @@ async function shareCommand(args) {
   }
   await assertHtmlFile(request.file);
   const absolute = await canonicalFile(request.file);
-  const root = path8.dirname(absolute);
+  const root = path9.dirname(absolute);
   const source = await readFile6(absolute, "utf8");
   const { html, warnings } = await buildSelfContainedHtml(source, {
     baseDir: root,
@@ -13425,7 +13487,7 @@ async function setupPluginCommand() {
   const manifest = readPluginManifest(pluginRoot);
   if (!manifest) {
     throw new AxiError("No plugin.json found in the lavish-axi package", "SERVER_ERROR", [
-      `Expected a manifest at ${path8.join(pluginRoot, "plugin.json")}`,
+      `Expected a manifest at ${path9.join(pluginRoot, "plugin.json")}`,
       "Reinstall lavish-axi, or run `npm run build:plugin` when working from a source checkout"
     ]);
   }
@@ -13449,7 +13511,7 @@ function collapseHome(target) {
 }
 function registerVsCodePlugin(pluginRoot, pluginName) {
   const settingsFile = resolveVsCodeSettingsFile(process.env, resolveHookHomeDir());
-  const settingsDir = path8.dirname(settingsFile);
+  const settingsDir = path9.dirname(settingsFile);
   const hasSettingsFile = existsSync3(settingsFile);
   if (!hasSettingsFile && !existsSync3(settingsDir)) {
     return { client: "vscode", status: "absent", detail: "no VS Code user configuration found" };
@@ -13478,7 +13540,7 @@ function registerVsCodePlugin(pluginRoot, pluginName) {
   return { client: "vscode", status: "registered", detail: collapseHome(settingsFile) };
 }
 function registerCursorPlugin(pluginRoot, pluginName) {
-  const cursorDir = path8.join(resolveHookHomeDir(), ".cursor");
+  const cursorDir = path9.join(resolveHookHomeDir(), ".cursor");
   if (!existsSync3(cursorDir)) {
     return { client: "cursor", status: "absent", detail: "no ~/.cursor directory found" };
   }
@@ -13551,9 +13613,9 @@ function parseCopilotPluginRecords(output) {
   }
 }
 function installedCopilotPluginSourcePath(pluginName) {
-  const configDir = process.env.COPILOT_HOME || path8.join(resolveHookHomeDir(), ".copilot");
+  const configDir = process.env.COPILOT_HOME || path9.join(resolveHookHomeDir(), ".copilot");
   try {
-    const config = JSON.parse(readFileSync2(path8.join(configDir, "config.json"), "utf8"));
+    const config = JSON.parse(readFileSync2(path9.join(configDir, "config.json"), "utf8"));
     const record = Array.isArray(config.installedPlugins) ? config.installedPlugins.find((candidate) => candidate?.name === pluginName) : null;
     return record ? copilotPluginSourcePath(record) : null;
   } catch {
@@ -13578,7 +13640,7 @@ function copilotPluginSourcePath(record) {
         continue;
       }
     }
-    if (path8.isAbsolute(candidate)) return candidate;
+    if (path9.isAbsolute(candidate)) return candidate;
   }
   return null;
 }
@@ -13586,14 +13648,14 @@ function sameResolvedPath(left, right) {
   try {
     return realpathSync2(left) === realpathSync2(right);
   } catch {
-    return path8.resolve(left) === path8.resolve(right);
+    return path9.resolve(left) === path9.resolve(right);
   }
 }
 function resolveHookHomeDir(env = process.env, fallback = os4.homedir()) {
   return env.HOME || fallback;
 }
 function resolveCopilotHookDir(env = process.env, homeDir = resolveHookHomeDir(env)) {
-  return path8.join(env.COPILOT_HOME || path8.join(homeDir, ".copilot"), "hooks");
+  return path9.join(env.COPILOT_HOME || path9.join(homeDir, ".copilot"), "hooks");
 }
 function createCopilotCliAmbientContextScript(command = "lavish-axi") {
   return [
@@ -13642,9 +13704,9 @@ function installCopilotCliSessionStartHook({
   timeoutSec = 10,
   onError = void 0
 } = {}) {
-  const target = path8.join(hookDir, "lavish-axi.json");
+  const target = path9.join(hookDir, "lavish-axi.json");
   try {
-    mkdirSync2(path8.dirname(target), { recursive: true });
+    mkdirSync2(path9.dirname(target), { recursive: true });
     const current = existsSync3(target) ? JSON.parse(readFileSync2(target, "utf8")) : {};
     const [updated, changed] = computeCopilotCliHookUpdate(
       current,
@@ -13707,9 +13769,6 @@ async function assertHtmlFile(file) {
     ]);
   }
 }
-function isHtmlPath(file) {
-  return file.toLowerCase().endsWith(".html") || file.toLowerCase().endsWith(".htm");
-}
 var HEALTH_PROBE_TIMEOUT_MS = 500;
 var DEFAULT_HEALTH_TIMEOUT_MS = 2e3;
 var MAX_HEALTH_BODY_BYTES = 256 * 1024;
@@ -13922,7 +13981,7 @@ function serverReplacementReason(currentVersion, healthBody, forceRestart = fals
 }
 function shouldForceRestartForLocalBuild(executablePath, sourceServerExists = localSourceServerExists()) {
   const localBuildEntry = fileURLToPath4(new URL("../dist/cli.mjs", import.meta.url));
-  return sourceServerExists && path8.resolve(executablePath) === path8.resolve(localBuildEntry);
+  return sourceServerExists && path9.resolve(executablePath) === path9.resolve(localBuildEntry);
 }
 function localSourceServerExists() {
   return existsSync3(fileURLToPath4(new URL("../src/server.js", import.meta.url)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lavish-axi",
-  "version": "0.1.83",
+  "version": "0.1.84",
   "packageManager": "pnpm@11.1.1",
   "description": "HTML is the new markdown. Lavish is the new editor for your HTML artifacts.",
   "type": "module",

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "lavish-axi",
-  "version": "0.1.83",
+  "version": "0.1.84",
   "description": "HTML is the new markdown. Lavish is the new editor for your HTML artifacts.",
   "author": {
     "name": "Kun Chen",