openfox 2.0.110 → 2.0.111

package/dist/{chunk-GNFDD6LN.js → chunk-BOSKQI62.js}

@@ -5,13 +5,13 @@ import {
   deleteItemFromDir,
   loadItemsFromDir,
   pathExists
-} from "./chunk-VT2X3DMC.js";
+} from "./chunk-JNHKKUGJ.js";
 import {
   SETTINGS_KEYS,
   deleteSetting,
   getSetting,
   setSetting
-} from "./chunk-VXKPZUCT.js";
+} from "./chunk-RT2A2RRL.js";
 
 // src/server/context/instructions.ts
 import { readFile, access } from "fs/promises";
@@ -440,4 +440,4 @@ export {
   deleteSkill,
   deleteProjectSkill
 };
-//# sourceMappingURL=chunk-GNFDD6LN.js.map
+//# sourceMappingURL=chunk-BOSKQI62.js.map

package/dist/{chunk-D6ODGTSZ.js → chunk-C372UH7N.js}

@@ -108,6 +108,7 @@ var mcpServerSchema = z.object({
   env: z.record(z.string(), z.string()).optional(),
   url: z.string().optional(),
   headers: z.record(z.string(), z.string()).optional(),
+  oauth: z.boolean().optional(),
   disabledTools: z.array(z.string()).optional(),
   cachedTools: z.array(cachedToolSchema).optional(),
   timeout: z.number().positive().optional(),
@@ -370,4 +371,4 @@ export {
   removeProvider,
   activateProvider
 };
-//# sourceMappingURL=chunk-D6ODGTSZ.js.map
+//# sourceMappingURL=chunk-C372UH7N.js.map

package/dist/{chunk-4ZXRERIW.js → chunk-C5NQF2K4.js}

@@ -1,6 +1,6 @@
 import {
   resolveDefaultAgentId
-} from "./chunk-VT2X3DMC.js";
+} from "./chunk-JNHKKUGJ.js";
 import {
   getDatabase
 } from "./chunk-LCQ5AN6Y.js";
@@ -245,7 +245,14 @@ function listSessions() {
   return rows.map(mapSessionSummaryRow);
 }
 function listSessionsByProject(projectId, limit = 20, offset = 0) {
+  return listSessionsPaged(projectId, limit, offset);
+}
+function listSessionsLimited(limit = 20, offset = 0) {
+  return listSessionsPaged(null, limit, offset);
+}
+function listSessionsPaged(projectId, limit, offset) {
   const db = getDatabase();
+  const where = projectId ? "WHERE s.project_id = ?" : "";
   const rows = db.prepare(
     `
     SELECT
@@ -264,15 +271,48 @@ function listSessionsByProject(projectId, limit = 20, offset = 0) {
       s.provider_model,
       s.message_count
     FROM sessions s
-    WHERE s.project_id = ?
+    ${where}
     ORDER BY s.updated_at DESC
     LIMIT ? OFFSET ?
   `
-  ).all(projectId, limit + 1, offset);
+  ).all(...projectId ? [projectId] : [], limit + 1, offset);
   const hasMore = rows.length > limit;
   const sessions = rows.slice(0, limit).map(mapSessionSummaryRow);
   return { sessions, hasMore };
 }
+function listHomeSessions(sessionsPerProject = 5) {
+  const db = getDatabase();
+  const rows = db.prepare(
+    `
+    SELECT
+      s.id,
+      s.project_id,
+      s.workdir,
+      s.workspace,
+      s.branch,
+      s.mode,
+      s.workflow_phase,
+      s.is_running,
+      s.created_at,
+      s.updated_at,
+      s.title,
+      s.provider_id,
+      s.provider_model,
+      s.message_count
+    FROM sessions s
+    ORDER BY s.updated_at DESC
+  `
+  ).all();
+  const seen = /* @__PURE__ */ new Map();
+  const result = [];
+  for (const row of rows) {
+    const count = seen.get(row.project_id) ?? 0;
+    if (count >= sessionsPerProject) continue;
+    seen.set(row.project_id, count + 1);
+    result.push(mapSessionSummaryRow(row));
+  }
+  return result;
+}
 function updateSessionWorkdir(id, workdir, workspace, branch) {
   const db = getDatabase();
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -360,6 +400,8 @@ export {
   getSessionMessageCount,
   listSessions,
   listSessionsByProject,
+  listSessionsLimited,
+  listHomeSessions,
   updateSessionWorkdir,
   updateSessionBranch,
   deleteSession,
@@ -368,4 +410,4 @@ export {
   getActiveWorkflowExecution,
   clearWorkflowExecution
 };
-//# sourceMappingURL=chunk-4ZXRERIW.js.map
+//# sourceMappingURL=chunk-C5NQF2K4.js.map

package/dist/{chunk-3HS72YIE.js → chunk-ERYUSG5C.js}

@@ -17,7 +17,7 @@ import {
 import {
   LLMError,
   OpenAIHttpClient
-} from "./chunk-E5HZKNTY.js";
+} from "./chunk-PCC4DBPF.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -310,4 +310,4 @@ function createLLMClient(config, initialBackend = "unknown") {
 export {
   createLLMClient
 };
-//# sourceMappingURL=chunk-3HS72YIE.js.map
+//# sourceMappingURL=chunk-ERYUSG5C.js.map

package/dist/{chunk-PU3IPUSW.js → chunk-FFPCVN5M.js}

@@ -1,9 +1,12 @@
 import {
   getEventStore
-} from "./chunk-LXYNP7LL.js";
+} from "./chunk-NB2D6I64.js";
 import {
   createChatPathConfirmationMessage
-} from "./chunk-B5MH4HQ6.js";
+} from "./chunk-SYJMUIRC.js";
+import {
+  getPlatformShell
+} from "./chunk-N4RTAGFY.js";
 
 // src/server/tools/path-security.ts
 import { realpath } from "fs/promises";
@@ -120,11 +123,19 @@ function looksLikeRegex(str) {
   return /[*?+[\]\\]/.test(str);
 }
 var isWindows = () => process.platform === "win32";
+function usesPosixPaths() {
+  if (process.platform !== "win32") return true;
+  return /^(?:ba|z|)sh(?:\.exe)?$/i.test(win32.basename(getPlatformShell().command));
+}
 function isWindowsAbsolutePath(str) {
   return /^[A-Za-z]:[\\/]/.test(str);
 }
 function normalizeExtracted(path) {
-  return isWindowsAbsolutePath(path) ? win32.normalize(path) : posix.normalize(path);
+  if (isWindowsAbsolutePath(path)) return win32.normalize(path);
+  if (isWindows() && /^\/[A-Za-z]\//.test(path)) {
+    return win32.normalize(`${path[1].toUpperCase()}:\\${path.slice(3)}`);
+  }
+  return posix.normalize(path);
 }
 function isPlaceholderToken(str) {
   return str.includes("__URL__") || str.includes("__FILEURL__") || str.includes("__SED__") || str.includes("__COMMIT_MSG__");
@@ -135,6 +146,7 @@ function extractAbsolutePathsFromCommand(command) {
   }
   const paths = [];
   const home = homedir();
+  const posixShell = usesPosixPaths();
   let sanitized = command.replace(/https?:\/\/[^\s'"]+/g, " __URL__ ").replace(/ftp:\/\/[^\s'"]+/g, " __URL__ ");
   sanitized = sanitized.replace(/(?<!\w)s\/[^/]*\/[^/]*\/[gip]*/g, " __SED__ ");
   sanitized = sanitized.replace(/(?<!\w)s\|[^|]*\|[^|]*\|[gip]*/g, " __SED__ ");
@@ -175,7 +187,7 @@ function extractAbsolutePathsFromCommand(command) {
       if (!isSafePath(resolved)) {
         paths.push(resolved);
       }
-    } else if (!isWindows() && content.startsWith("/")) {
+    } else if (posixShell && content.startsWith("/")) {
       const resolved = normalizeExtracted(content);
       if (!isSafePath(resolved)) {
         paths.push(resolved);
@@ -199,7 +211,8 @@ function extractAbsolutePathsFromCommand(command) {
         paths.push(resolved);
       }
     }
-  } else {
+  }
+  if (posixShell) {
     const absolutePattern = /(?:^|[\s=(])(\/[^\s"'|&;<>`()]+)/g;
     while ((match = absolutePattern.exec(sanitized)) !== null) {
       const candidate = match[1];
@@ -238,9 +251,12 @@ function extractSensitivePathsFromCommand(command) {
   }
   return [...new Set(paths)];
 }
+var WINDOWS_DEVICE_NAMES = /* @__PURE__ */ new Set(["nul", "con", "prn", "aux"]);
 function isSafePath(path) {
   const normalized = posix.normalize(path);
-  return SAFE_PATHS.has(normalized);
+  if (SAFE_PATHS.has(normalized)) return true;
+  if (!isWindows()) return false;
+  return WINDOWS_DEVICE_NAMES.has(win32.basename(path.replace(/^\\\\[.?]\\/, "")).toLowerCase());
 }
 async function checkPathsAccess(paths, workdir, sessionId) {
   if (paths.length === 0) {
@@ -274,9 +290,30 @@ var DANGEROUS_PATTERNS = [
   /dd\s+if=/,
   /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/
 ];
+var WINDOWS_DANGEROUS_PATTERNS = [
+  /\b(?:rd|rmdir)\s+(?:\/[a-z]\s+)*\/s\b/i,
+  // rd /s /q <dir>
+  /\bdel\s+(?:\/[a-z]\s+)*\/s\b/i,
+  // del /f /s /q <pattern>
+  // The operand is a bare drive ("D:", "D:\"), never a file path — that is what
+  // keeps "npm run format -- C:\src\x.ts" out of the dangerous bucket.
+  /\bformat\s+(?:\/\S+\s+)*[a-z]:\\?(?=\s|$)/i,
+  // format D: / format /q D: / format /fs:NTFS D:
+  /\bRemove-Item\b(?=[^|;]*-Recurse\b)(?=[^|;]*-Force\b)/i,
+  // PowerShell recursive force delete (flag order-independent)
+  /\brunas\b/i,
+  // sudo equivalent
+  /\bStart-Process\b[^|;]*-Verb\s+RunAs\b/i,
+  // sudo equivalent (PowerShell)
+  /\bicacls\b[^|;]*\/grant\b[^|;]*Everyone/i,
+  // chmod 777 equivalent
+  /\bdiskpart\b/i
+  // raw disk write, dd/mkfs equivalent
+];
 function extractDangerousPatterns(command) {
+  const patterns = isWindows() ? [...DANGEROUS_PATTERNS, ...WINDOWS_DANGEROUS_PATTERNS] : DANGEROUS_PATTERNS;
   const dangerous = [];
-  for (const pattern of DANGEROUS_PATTERNS) {
+  for (const pattern of patterns) {
     if (pattern.test(command)) {
       dangerous.push(pattern.source);
     }
@@ -498,4 +535,4 @@ export {
   getConfirmationSessionId,
   getPendingConfirmationsBySession
 };
-//# sourceMappingURL=chunk-PU3IPUSW.js.map
+//# sourceMappingURL=chunk-FFPCVN5M.js.map

package/dist/{chunk-KDQJOI2I.js → chunk-FSYRANYR.js}

@@ -1,6 +1,6 @@
 import {
   createLLMClient
-} from "./chunk-3HS72YIE.js";
+} from "./chunk-ERYUSG5C.js";
 import {
   getModelProfile
 } from "./chunk-V4IE7HJY.js";
@@ -804,4 +804,4 @@ export {
   parseDefaultModelSelection,
   createProviderManager
 };
-//# sourceMappingURL=chunk-KDQJOI2I.js.map
+//# sourceMappingURL=chunk-FSYRANYR.js.map

package/dist/chunk-GZOK3FAA.js

@@ -0,0 +1,7 @@
+// src/constants.ts
+var VERSION = "2.0.111";
+
+export {
+  VERSION
+};
+//# sourceMappingURL=chunk-GZOK3FAA.js.map

package/dist/chunk-IJ53Y77N.js

@@ -0,0 +1,142 @@
+import {
+  logger
+} from "./chunk-K44MW7JJ.js";
+import {
+  getGlobalConfigDir
+} from "./chunk-CQGTEGKL.js";
+
+// src/server/mcp/oauth-store.ts
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+var storeMode = "production";
+var storePathOverride;
+function setMcpOAuthStoreMode(mode) {
+  storeMode = mode;
+}
+function setMcpOAuthStorePath(path) {
+  storePathOverride = path;
+}
+function getMcpOAuthStorePath() {
+  return storePathOverride ?? join(getGlobalConfigDir(storeMode), "mcp-auth.json");
+}
+async function readStore() {
+  const path = getMcpOAuthStorePath();
+  let raw;
+  try {
+    raw = await readFile(path, "utf-8");
+  } catch {
+    return { version: 1, servers: {} };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    const servers = parsed.servers;
+    if (!servers || typeof servers !== "object") throw new Error("no servers object");
+    const kept = {};
+    for (const [name, entry] of Object.entries(servers)) {
+      if (entry && typeof entry === "object" && typeof entry.serverUrl === "string") {
+        kept[name] = entry;
+      } else {
+        logger.warn("Dropping an unreadable MCP OAuth entry, this server will have to authorize again", {
+          path,
+          server: name
+        });
+      }
+    }
+    return { version: 1, servers: kept };
+  } catch {
+    logger.error("The MCP OAuth store is unreadable, stored authorizations will be ignored", { path });
+    return { version: 1, servers: {} };
+  }
+}
+async function writeStore(store) {
+  const path = getMcpOAuthStorePath();
+  await mkdir(dirname(path), { recursive: true });
+  const tmpPath = `${path}.tmp`;
+  await writeFile(tmpPath, JSON.stringify(store, null, 2), { mode: 384 });
+  try {
+    await chmod(tmpPath, 384);
+  } catch {
+    logger.warn("Could not restrict permissions on the MCP OAuth store", { path });
+  }
+  await rename(tmpPath, path);
+}
+var writeQueue = Promise.resolve();
+function serialize(work) {
+  const result = writeQueue.then(work, work);
+  writeQueue = result.catch(() => void 0);
+  return result;
+}
+async function mutateEntry(name, serverUrl, mutate) {
+  await serialize(async () => {
+    const store = await readStore();
+    const current = store.servers[name];
+    const base = current && current.serverUrl === serverUrl ? current : { serverUrl };
+    store.servers[name] = mutate(base);
+    await writeStore(store);
+  });
+}
+function withoutAuthorizationState(entry) {
+  const next = { serverUrl: entry.serverUrl };
+  if (entry.clientInformation) next.clientInformation = entry.clientInformation;
+  if (entry.tokens) next.tokens = entry.tokens;
+  return next;
+}
+async function readMcpOAuthEntry(name, serverUrl) {
+  const store = await readStore();
+  const entry = store.servers[name];
+  if (!entry || entry.serverUrl !== serverUrl) return void 0;
+  return entry;
+}
+async function saveMcpOAuthClientInformation(name, serverUrl, clientInformation) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...entry, clientInformation }));
+}
+async function saveMcpOAuthTokens(name, serverUrl, tokens) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...withoutAuthorizationState(entry), tokens }));
+}
+async function saveMcpOAuthCodeVerifier(name, serverUrl, codeVerifier) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...entry, codeVerifier }));
+}
+async function saveMcpOAuthState(name, serverUrl, state) {
+  await mutateEntry(name, serverUrl, (entry) => ({ ...entry, state }));
+}
+async function clearMcpOAuthTokens(name, serverUrl) {
+  await mutateEntry(name, serverUrl, (entry) => {
+    const next = withoutAuthorizationState(entry);
+    delete next.tokens;
+    return next;
+  });
+}
+async function clearMcpOAuthAuthorizationState(name, serverUrl) {
+  await mutateEntry(name, serverUrl, withoutAuthorizationState);
+}
+async function clearMcpOAuthEntry(name) {
+  await serialize(async () => {
+    const store = await readStore();
+    if (!(name in store.servers)) return;
+    delete store.servers[name];
+    await writeStore(store);
+  });
+}
+async function findMcpOAuthEntryByState(state) {
+  const store = await readStore();
+  for (const [name, entry] of Object.entries(store.servers)) {
+    if (entry.state && entry.state === state) return { name, entry };
+  }
+  return null;
+}
+
+export {
+  setMcpOAuthStoreMode,
+  setMcpOAuthStorePath,
+  getMcpOAuthStorePath,
+  readMcpOAuthEntry,
+  saveMcpOAuthClientInformation,
+  saveMcpOAuthTokens,
+  saveMcpOAuthCodeVerifier,
+  saveMcpOAuthState,
+  clearMcpOAuthTokens,
+  clearMcpOAuthAuthorizationState,
+  clearMcpOAuthEntry,
+  findMcpOAuthEntryByState
+};
+//# sourceMappingURL=chunk-IJ53Y77N.js.map

package/dist/{chunk-WCQOHRUX.js → chunk-JDT63SSP.js}

@@ -1,6 +1,6 @@
 import {
   updateSessionMcpDisabledServers
-} from "./chunk-4ZXRERIW.js";
+} from "./chunk-C5NQF2K4.js";
 import {
   getDatabase
 } from "./chunk-LCQ5AN6Y.js";
@@ -62,4 +62,4 @@ export {
   clearSessionOverrides,
   getAllSessionOverrides
 };
-//# sourceMappingURL=chunk-WCQOHRUX.js.map
+//# sourceMappingURL=chunk-JDT63SSP.js.map

package/dist/{chunk-VT2X3DMC.js → chunk-JNHKKUGJ.js}

@@ -1,7 +1,7 @@
 import {
   SETTINGS_KEYS,
   getSetting
-} from "./chunk-VXKPZUCT.js";
+} from "./chunk-RT2A2RRL.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -455,4 +455,4 @@ export {
   getOverrideAgentIds,
   resolveDefaultAgentId
 };
-//# sourceMappingURL=chunk-VT2X3DMC.js.map
+//# sourceMappingURL=chunk-JNHKKUGJ.js.map

package/dist/{chunk-JAX5OEMM.js → chunk-JURM3RPZ.js}

@@ -1,3 +1,7 @@
+import {
+  normalizeAskOptions
+} from "./chunk-LCLH6ZUL.js";
+
 // src/server/utils/async.ts
 function createDeferred() {
   let resolve;
@@ -56,8 +60,21 @@ var askUserTool = {
           },
           options: {
             type: "array",
-            items: { type: "string" },
-            description: "Options for choice-type questions"
+            description: "Options for choice-type questions. Each entry may be a plain string or an object {value, label, description?} (or legacy {label, description?}). The server normalizes everything to {value, label, description?}.",
+            items: {
+              oneOf: [
+                { type: "string" },
+                {
+                  type: "object",
+                  properties: {
+                    value: { type: "string" },
+                    label: { type: "string" },
+                    description: { type: "string" }
+                  },
+                  required: ["label"]
+                }
+              ]
+            }
           }
         },
         required: ["question"]
@@ -67,7 +84,7 @@ var askUserTool = {
   async execute(args, context) {
     const question = args["question"];
     const type = args["type"] ?? "text";
-    const options = args["options"];
+    const options = normalizeAskOptions(args["options"]);
     const callId = context.toolCallId ?? crypto.randomUUID();
     const deferred = createDeferred();
     void deferred.promise.catch(() => {
@@ -156,4 +173,4 @@ export {
   awaitAnswer,
   getPendingQuestionsForSession
 };
-//# sourceMappingURL=chunk-JAX5OEMM.js.map
+//# sourceMappingURL=chunk-JURM3RPZ.js.map

package/dist/chunk-LCLH6ZUL.js

@@ -0,0 +1,43 @@
+// src/shared/ask-options.ts
+function normalizeAskOptions(raw) {
+  if (raw == null) return void 0;
+  if (typeof raw === "string") {
+    const parts = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    return parts.length > 0 ? parts.map((label) => ({ value: label, label })) : void 0;
+  }
+  if (!Array.isArray(raw)) return void 0;
+  const out = [];
+  for (const item of raw) {
+    if (typeof item === "string") {
+      const trimmed = item.trim();
+      if (trimmed.length > 0) {
+        out.push({ value: trimmed, label: trimmed });
+      }
+      continue;
+    }
+    if (item != null && typeof item === "object") {
+      const obj = item;
+      const labelRaw = obj["label"];
+      const valueRaw = obj["value"];
+      if (typeof labelRaw === "string" && labelRaw.trim().length > 0) {
+        const label = labelRaw.trim();
+        const value = typeof valueRaw === "string" && valueRaw.length > 0 ? valueRaw : label;
+        const descRaw = obj["description"];
+        const opt = {
+          value,
+          label
+        };
+        if (typeof descRaw === "string" && descRaw.length > 0) {
+          opt.description = descRaw;
+        }
+        out.push(opt);
+      }
+    }
+  }
+  return out.length > 0 ? out : void 0;
+}
+
+export {
+  normalizeAskOptions
+};
+//# sourceMappingURL=chunk-LCLH6ZUL.js.map

package/dist/{chunk-6EV7X5MP.js → chunk-N4RTAGFY.js}

@@ -1,7 +1,7 @@
 import {
   SETTINGS_KEYS,
   getSetting
-} from "./chunk-VXKPZUCT.js";
+} from "./chunk-RT2A2RRL.js";
 
 // src/server/utils/platform.ts
 import os from "os";
@@ -63,4 +63,4 @@ export {
   isWindowsPath,
   isAbsolutePath
 };
-//# sourceMappingURL=chunk-6EV7X5MP.js.map
+//# sourceMappingURL=chunk-N4RTAGFY.js.map