openfox 2.0.122 → 2.0.124

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (83) hide show
  1. package/CHANGELOG.md +27 -0
  2. package/dist/CHANGELOG.md +27 -0
  3. package/dist/{auto-config-YXNCBYEY.js → auto-config-454YE6KC.js} +24 -17
  4. package/dist/{chat-handler-JQUVSZT3.js → chat-handler-N43TBYLV.js} +29 -28
  5. package/dist/{chunk-DIALH34K.js → chunk-3B232XG4.js} +2 -2
  6. package/dist/{chunk-RMOKNQAS.js → chunk-3NMLSANH.js} +2 -2
  7. package/dist/{chunk-22D7ZR2X.js → chunk-57UCBFBD.js} +50 -37
  8. package/dist/{chunk-SCP5KBNB.js → chunk-5CCM655F.js} +149 -63
  9. package/dist/{chunk-EZ67GBEO.js → chunk-66MG44TF.js} +2 -2
  10. package/dist/{chunk-YBOU4ZFD.js → chunk-7YP4O4XE.js} +3 -3
  11. package/dist/{chunk-UJRWYZHM.js → chunk-A6EZBX62.js} +59 -23
  12. package/dist/{chunk-SLW3KKPP.js → chunk-AQBRI7TM.js} +21 -8
  13. package/dist/{chunk-OXANSWVZ.js → chunk-EHFIUXWZ.js} +2 -2
  14. package/dist/{chunk-AIXVERRI.js → chunk-FAL4WO4V.js} +6 -6
  15. package/dist/{chunk-Y7FGHKBW.js → chunk-GIJUWPRQ.js} +2 -2
  16. package/dist/chunk-ISE55FOR.js +89 -0
  17. package/dist/{chunk-6A2VIV36.js → chunk-JEZN37KV.js} +3 -3
  18. package/dist/{chunk-2N7KFNMY.js → chunk-KBESUA3W.js} +3 -3
  19. package/dist/{chunk-5A4YN6I7.js → chunk-KD4W3I6C.js} +112 -33
  20. package/dist/{chunk-UOEAKQBH.js → chunk-KGFERMCV.js} +15 -15
  21. package/dist/{chunk-FGVMRFDW.js → chunk-N2Q3KYWM.js} +2 -2
  22. package/dist/{chunk-NYQKSKDB.js → chunk-OYBUJIC3.js} +9 -1
  23. package/dist/{chunk-KDC4QHE7.js → chunk-QJNBQCAF.js} +22 -18
  24. package/dist/{chunk-I22B6KWV.js → chunk-RV5G7QQU.js} +3 -3
  25. package/dist/{chunk-ZT7YTM2U.js → chunk-RXLAFEZB.js} +4 -4
  26. package/dist/chunk-SBADOWVC.js +7 -0
  27. package/dist/{chunk-J77SLE3M.js → chunk-SYTEO5LA.js} +3 -2
  28. package/dist/{chunk-STYGFTEB.js → chunk-UGEFD67O.js} +6 -6
  29. package/dist/{chunk-POTCPZJF.js → chunk-VPRB5FNR.js} +2 -2
  30. package/dist/{chunk-WIZUASFY.js → chunk-VUBFPRKT.js} +278 -142
  31. package/dist/{chunk-YDDBPKVP.js → chunk-W4SM4FFZ.js} +15 -15
  32. package/dist/{chunk-J3IJJ55E.js → chunk-YJD5A375.js} +7 -7
  33. package/dist/{chunk-LSEHJ2WI.js → chunk-ZIL6VKLU.js} +3 -3
  34. package/dist/{chunk-LWXLNE6M.js → chunk-ZIYETXOW.js} +2 -2
  35. package/dist/cli/dev.js +1 -1
  36. package/dist/cli/index.js +1 -1
  37. package/dist/{client-JKPDMJ7S.js → client-XHJHOFMU.js} +5 -5
  38. package/dist/{compactor-MKD3CAFM.js → compactor-VTATJTPN.js} +12 -12
  39. package/dist/{dynamic-context-IWFD7U3D.js → dynamic-context-KTQCAPTK.js} +9 -9
  40. package/dist/{events-6P4TDTSD.js → events-GMHRX4LF.js} +8 -8
  41. package/dist/{folding-3LA2WX2B.js → folding-7K2GRPF4.js} +6 -6
  42. package/dist/http-client-N4ASJEKJ.js +11 -0
  43. package/dist/{inspect-proxy-IDLUAQH5.js → inspect-proxy-UKPU3Z64.js} +4 -4
  44. package/dist/launch-Z5D5YFRJ.js +53 -0
  45. package/dist/{manager-NFKTUR64.js → manager-NOKJQTTF.js} +5 -5
  46. package/dist/model-catalog-ZLOWTQA7.js +14 -0
  47. package/dist/{orchestrator-PEXLQK3T.js → orchestrator-BQBBO4US.js} +31 -30
  48. package/dist/package.json +1 -1
  49. package/dist/{path-security-JUF56IB6.js → path-security-YTPZ35SL.js} +14 -12
  50. package/dist/{platform-FM57ZJHA.js → platform-EMKWQTZX.js} +4 -4
  51. package/dist/{processor-2GEVRLJP.js → processor-WTRVYXAO.js} +39 -35
  52. package/dist/{project-creator-J4ITWDZI.js → project-creator-JF3YVQAH.js} +3 -3
  53. package/dist/{projects-FHRTSV6N.js → projects-TPSLCJP2.js} +3 -3
  54. package/dist/{protocol-BLin669D.d.ts → protocol-DCMH9Ufp.d.ts} +1 -1
  55. package/dist/provider/index.d.ts +4 -4
  56. package/dist/{provider-TAFJCWVP.js → provider-LICG53GG.js} +7 -6
  57. package/dist/{provider-manager-EDJN6ARI.js → provider-manager-3QC2MSSR.js} +7 -6
  58. package/dist/{registry-37GL3DAP.js → registry-Z4GVYFTV.js} +5 -5
  59. package/dist/{serve-3BPQGWYE.js → serve-75G5Z7UQ.js} +34 -33
  60. package/dist/server/index.d.ts +27 -6
  61. package/dist/server/index.js +31 -30
  62. package/dist/server-N3VATHIA.js +56 -0
  63. package/dist/{service-2IOCVEXQ.js → service-OURGS2SI.js} +10 -9
  64. package/dist/{session-overrides-EOKSZO2X.js → session-overrides-4WAD3X5Q.js} +7 -7
  65. package/dist/{sessions-XFNU4DZ6.js → sessions-D7VRCHQY.js} +8 -6
  66. package/dist/{settings-SYYDPV43.js → settings-VOWWO4VG.js} +3 -3
  67. package/dist/shared/index.d.ts +3 -3
  68. package/dist/{tasks-G7ACMQM2.js → tasks-4SOLTX6A.js} +11 -10
  69. package/dist/{tools-IKMNLLAY.js → tools-G44LBKD4.js} +24 -23
  70. package/dist/{types-B5_9KtfJ.d.ts → types-Cr4EgGwK.d.ts} +1 -1
  71. package/dist/{types-DeQIEC1U.d.ts → types-PAKlAzp9.d.ts} +16 -0
  72. package/dist/{update-QX6IIUKB.js → update-R2TEHD7V.js} +2 -2
  73. package/dist/web/assets/{index-D9sfxcRH.css → index-DFMllFkv.css} +1 -1
  74. package/dist/web/assets/index-GZTGHRRr.js +324 -0
  75. package/dist/web/index.html +2 -2
  76. package/dist/web/sw.js +1 -1
  77. package/dist/{workspace-ZNZFEONU.js → workspace-J3JEGF6U.js} +4 -4
  78. package/package.json +1 -1
  79. package/dist/chunk-VC3YCHDO.js +0 -7
  80. package/dist/http-client-IKOARXI7.js +0 -11
  81. package/dist/launch-FOUIDMGW.js +0 -52
  82. package/dist/server-HPIR55OH.js +0 -55
  83. package/dist/web/assets/index-CJuw9bwD.js +0 -324
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  resolveDefaultAgentId
3
- } from "./chunk-2N7KFNMY.js";
3
+ } from "./chunk-KBESUA3W.js";
4
4
  import {
5
5
  getDatabase
6
- } from "./chunk-NYQKSKDB.js";
6
+ } from "./chunk-OYBUJIC3.js";
7
7
 
8
8
  // src/server/db/sessions.ts
9
9
  function getProjectDangerLevel(projectId) {
@@ -96,21 +96,26 @@ function getSession(id) {
96
96
  dangerLevel: row.danger_level ?? "normal"
97
97
  };
98
98
  }
99
- function updateSessionProvider(id, providerId, providerModel, providerManual) {
99
+ function updateSessionProvider(id, providerId, providerModel, providerManual, reasoningEffort) {
100
100
  const db = getDatabase();
101
101
  const now = (/* @__PURE__ */ new Date()).toISOString();
102
+ let resolvedEffort = reasoningEffort ?? null;
103
+ if (reasoningEffort === void 0) {
104
+ const row = db.prepare("SELECT provider_reasoning_effort FROM sessions WHERE id = ?").get(id);
105
+ resolvedEffort = row?.provider_reasoning_effort ?? null;
106
+ }
102
107
  if (providerManual !== void 0) {
103
108
  db.prepare(
104
109
  `
105
- UPDATE sessions SET provider_id = ?, provider_model = ?, provider_manual = ?, updated_at = ? WHERE id = ?
110
+ UPDATE sessions SET provider_id = ?, provider_model = ?, provider_reasoning_effort = ?, provider_manual = ?, updated_at = ? WHERE id = ?
106
111
  `
107
- ).run(providerId, providerModel, providerManual ? 1 : 0, now, id);
112
+ ).run(providerId, providerModel, resolvedEffort, providerManual ? 1 : 0, now, id);
108
113
  } else {
109
114
  db.prepare(
110
115
  `
111
- UPDATE sessions SET provider_id = ?, provider_model = ?, updated_at = ? WHERE id = ?
116
+ UPDATE sessions SET provider_id = ?, provider_model = ?, provider_reasoning_effort = ?, updated_at = ? WHERE id = ?
112
117
  `
113
- ).run(providerId, providerModel, now, id);
118
+ ).run(providerId, providerModel, resolvedEffort, now, id);
114
119
  }
115
120
  }
116
121
  function updateSessionProviderActive(id, active) {
@@ -118,6 +123,11 @@ function updateSessionProviderActive(id, active) {
118
123
  const now = (/* @__PURE__ */ new Date()).toISOString();
119
124
  db.prepare("UPDATE sessions SET provider_manual_active = ?, updated_at = ? WHERE id = ?").run(active ? 1 : 0, now, id);
120
125
  }
126
+ function updateSessionPinnedEffort(id, effort) {
127
+ const db = getDatabase();
128
+ const now = (/* @__PURE__ */ new Date()).toISOString();
129
+ db.prepare("UPDATE sessions SET provider_pinned_effort = ?, updated_at = ? WHERE id = ?").run(effort, now, id);
130
+ }
121
131
  function updateSessionMode(id, mode) {
122
132
  const db = getDatabase();
123
133
  const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -359,6 +369,8 @@ function mapSessionBase(row) {
359
369
  isRunning: Boolean(row.is_running),
360
370
  providerId: row.provider_id ?? null,
361
371
  providerModel: row.provider_model ?? null,
372
+ ..."provider_reasoning_effort" in row ? { providerReasoningEffort: row.provider_reasoning_effort ?? null } : {},
373
+ ..."provider_pinned_effort" in row ? { providerPinnedEffort: row.provider_pinned_effort ?? null } : {},
362
374
  providerManual: Boolean(row.provider_manual),
363
375
  providerManualActive: Boolean(row.provider_manual_active),
364
376
  createdAt: row.created_at,
@@ -429,6 +441,7 @@ export {
429
441
  getSession,
430
442
  updateSessionProvider,
431
443
  updateSessionProviderActive,
444
+ updateSessionPinnedEffort,
432
445
  updateSessionMode,
433
446
  updateSessionDangerLevel,
434
447
  updateSessionPhase,
@@ -453,4 +466,4 @@ export {
453
466
  getLatestWorkflowExecution,
454
467
  clearWorkflowExecution
455
468
  };
456
- //# sourceMappingURL=chunk-SLW3KKPP.js.map
469
+ //# sourceMappingURL=chunk-AQBRI7TM.js.map
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  getProjectByWorkdir
3
- } from "./chunk-DIALH34K.js";
3
+ } from "./chunk-3B232XG4.js";
4
4
  import {
5
5
  logger
6
6
  } from "./chunk-K44MW7JJ.js";
@@ -345,4 +345,4 @@ export {
345
345
  startInspectProxy,
346
346
  stopAllInspectProxies
347
347
  };
348
- //# sourceMappingURL=chunk-OXANSWVZ.js.map
348
+ //# sourceMappingURL=chunk-EHFIUXWZ.js.map
@@ -1,17 +1,17 @@
1
1
  import {
2
2
  getAllInstructions,
3
3
  getEnabledSkillMetadata
4
- } from "./chunk-LSEHJ2WI.js";
4
+ } from "./chunk-ZIL6VKLU.js";
5
5
  import {
6
6
  buildTopLevelSystemPrompt
7
- } from "./chunk-Y7FGHKBW.js";
7
+ } from "./chunk-GIJUWPRQ.js";
8
8
  import {
9
9
  findAgentById,
10
10
  getRuntimeConfig,
11
11
  getSubAgents,
12
12
  loadAllAgentsDefault,
13
13
  resolveDefaultAgentId
14
- } from "./chunk-2N7KFNMY.js";
14
+ } from "./chunk-KBESUA3W.js";
15
15
  import {
16
16
  logger
17
17
  } from "./chunk-K44MW7JJ.js";
@@ -105,7 +105,7 @@ function resolveAgentDef(sessionManager, sessionId) {
105
105
  }
106
106
  async function buildCachedPrompt(sessionManager, sessionId, agentDef, modelName) {
107
107
  const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
108
- const { getToolRegistryForAgent } = await import("./tools-IKMNLLAY.js");
108
+ const { getToolRegistryForAgent } = await import("./tools-G44LBKD4.js");
109
109
  const tools = getToolRegistryForAgent(agentDef, sessionId).definitions;
110
110
  const toolFingerprint = getToolFingerprint(tools);
111
111
  const allAgents = await loadAllAgentsDefault(sessionManager.getProjectWorkdir(sessionId));
@@ -124,7 +124,7 @@ async function buildCachedPrompt(sessionManager, sessionId, agentDef, modelName)
124
124
  async function computeSessionHash(sessionManager, sessionId, modelName) {
125
125
  const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
126
126
  const agentDef = await resolveAgentDef(sessionManager, sessionId);
127
- const { getToolRegistryForAgent } = await import("./tools-IKMNLLAY.js");
127
+ const { getToolRegistryForAgent } = await import("./tools-G44LBKD4.js");
128
128
  const tools = getToolRegistryForAgent(agentDef, sessionId).definitions;
129
129
  const toolFingerprint = getToolFingerprint(tools);
130
130
  return computeDynamicContextHash(instructionContent, skills, toolFingerprint, modelName);
@@ -148,4 +148,4 @@ export {
148
148
  computeSessionHash,
149
149
  applyDynamicContext
150
150
  };
151
- //# sourceMappingURL=chunk-AIXVERRI.js.map
151
+ //# sourceMappingURL=chunk-FAL4WO4V.js.map
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  getPlatformShell
3
- } from "./chunk-EZ67GBEO.js";
3
+ } from "./chunk-66MG44TF.js";
4
4
 
5
5
  // src/server/tools/tool-policy.ts
6
6
  var ALWAYS_ALLOWED = /* @__PURE__ */ new Set(["step_done"]);
@@ -246,4 +246,4 @@ export {
246
246
  buildAgentSmallReminder,
247
247
  COMPACTION_PROMPT
248
248
  };
249
- //# sourceMappingURL=chunk-Y7FGHKBW.js.map
249
+ //# sourceMappingURL=chunk-GIJUWPRQ.js.map
@@ -0,0 +1,89 @@
1
+ // src/shared/reasoning-effort.ts
2
+ var REASONING_EFFORT_VALUES = ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
3
+ function isReasoningEffortValue(value) {
4
+ return REASONING_EFFORT_VALUES.includes(value);
5
+ }
6
+ function resolveEffortForModel({
7
+ reasoningEfforts,
8
+ candidate,
9
+ defaultEffort,
10
+ override
11
+ }) {
12
+ if (candidate === "none") return "none";
13
+ if (!reasoningEfforts || reasoningEfforts.length === 0) {
14
+ return candidate ?? override ?? defaultEffort;
15
+ }
16
+ if (candidate) {
17
+ if (reasoningEfforts.includes(candidate)) return candidate;
18
+ if (override) return override;
19
+ if (defaultEffort && reasoningEfforts.includes(defaultEffort)) return defaultEffort;
20
+ return reasoningEfforts[0];
21
+ }
22
+ if (override) return override;
23
+ return defaultEffort && reasoningEfforts.includes(defaultEffort) ? defaultEffort : void 0;
24
+ }
25
+
26
+ // src/server/providers/model-catalog.ts
27
+ var CATALOG = [
28
+ {
29
+ // DeepSeek V4 Flash/Pro: official API accepts low/high/max
30
+ // (medium → high, xhigh → max are compatibility mappings); 'none'
31
+ // disables thinking mode on setups that honor it.
32
+ pattern: /^deepseek-v4-(flash|pro)(\b|-|$)/i,
33
+ entry: { reasoningEfforts: ["none", "low", "high", "max"], defaultReasoningEffort: "high" }
34
+ },
35
+ {
36
+ // Qwen3.8: official reasoning_effort values are low/medium/xhigh
37
+ // (xhigh is the model default); 'none' disables thinking on setups
38
+ // that honor it.
39
+ pattern: /^qwen3\.8(\b|-)/i,
40
+ entry: { reasoningEfforts: ["none", "low", "medium", "xhigh"], defaultReasoningEffort: "xhigh" }
41
+ },
42
+ {
43
+ // Qwen3.5 / 3.6: on/off thinking only — none (off) or high (thinking on).
44
+ pattern: /^qwen3\.(5|6)(\b|-)/i,
45
+ entry: { reasoningEfforts: ["none", "high"], defaultReasoningEffort: "high" }
46
+ },
47
+ {
48
+ // Z.ai GLM-5.3: only max/high/low are accepted.
49
+ pattern: /^glm-5\.3(\b|-)/i,
50
+ entry: { reasoningEfforts: ["low", "high", "max"], defaultReasoningEffort: "max" }
51
+ },
52
+ {
53
+ // Z.ai GLM-5.2: full range with compatibility mappings (default max).
54
+ pattern: /^glm-5\.2(\b|-)/i,
55
+ entry: {
56
+ reasoningEfforts: ["none", "minimal", "low", "medium", "high", "xhigh", "max"],
57
+ defaultReasoningEffort: "max"
58
+ }
59
+ },
60
+ {
61
+ // Moonshot Kimi K3: low/high/max (default max).
62
+ pattern: /^kimi-k3(\b|-)/i,
63
+ entry: { reasoningEfforts: ["low", "high", "max"], defaultReasoningEffort: "max" }
64
+ },
65
+ {
66
+ // OpenAI GPT-5.x / o-series reasoning models.
67
+ pattern: /^(gpt-5|o[1-9])(\b|-|$)/i,
68
+ entry: { reasoningEfforts: ["minimal", "low", "medium", "high"], defaultReasoningEffort: "medium" }
69
+ }
70
+ ];
71
+ function getCatalogEntry(modelId) {
72
+ const basename = modelId.split("/").pop() ?? modelId;
73
+ for (const rule of CATALOG) {
74
+ if (rule.pattern.test(modelId) || rule.pattern.test(basename)) return rule.entry;
75
+ }
76
+ return void 0;
77
+ }
78
+ function getCatalogDefaultEffort(modelId) {
79
+ return getCatalogEntry(modelId)?.defaultReasoningEffort;
80
+ }
81
+
82
+ export {
83
+ REASONING_EFFORT_VALUES,
84
+ isReasoningEffortValue,
85
+ resolveEffortForModel,
86
+ getCatalogEntry,
87
+ getCatalogDefaultEffort
88
+ };
89
+ //# sourceMappingURL=chunk-ISE55FOR.js.map
@@ -3,10 +3,10 @@ import {
3
3
  } from "./chunk-62GUO2EG.js";
4
4
  import {
5
5
  COMPACTION_PROMPT
6
- } from "./chunk-Y7FGHKBW.js";
6
+ } from "./chunk-GIJUWPRQ.js";
7
7
  import {
8
8
  getCurrentWindowMessageOptions
9
- } from "./chunk-J3IJJ55E.js";
9
+ } from "./chunk-YJD5A375.js";
10
10
 
11
11
  // src/server/context/compactor.ts
12
12
  function appendCompactionPrompt(sessionId, append) {
@@ -36,4 +36,4 @@ export {
36
36
  COMPACTION_MAX_RATIO,
37
37
  shouldCompact
38
38
  };
39
- //# sourceMappingURL=chunk-6A2VIV36.js.map
39
+ //# sourceMappingURL=chunk-JEZN37KV.js.map
@@ -3,11 +3,11 @@ import {
3
3
  } from "./chunk-OSXPQSLW.js";
4
4
  import {
5
5
  getProjectDefaultAgent
6
- } from "./chunk-DIALH34K.js";
6
+ } from "./chunk-3B232XG4.js";
7
7
  import {
8
8
  SETTINGS_KEYS,
9
9
  getSetting
10
- } from "./chunk-FGVMRFDW.js";
10
+ } from "./chunk-N2Q3KYWM.js";
11
11
  import {
12
12
  logger
13
13
  } from "./chunk-K44MW7JJ.js";
@@ -352,4 +352,4 @@ export {
352
352
  getOverrideAgentIds,
353
353
  resolveDefaultAgentId
354
354
  };
355
- //# sourceMappingURL=chunk-2N7KFNMY.js.map
355
+ //# sourceMappingURL=chunk-KBESUA3W.js.map
@@ -1,12 +1,12 @@
1
+ import {
2
+ getEventStore
3
+ } from "./chunk-YJD5A375.js";
1
4
  import {
2
5
  createChatPathConfirmationMessage
3
6
  } from "./chunk-XAAEP5XM.js";
4
- import {
5
- getEventStore
6
- } from "./chunk-J3IJJ55E.js";
7
7
  import {
8
8
  getPlatformShell
9
- } from "./chunk-EZ67GBEO.js";
9
+ } from "./chunk-66MG44TF.js";
10
10
 
11
11
  // src/server/tools/path-security.ts
12
12
  import { realpath } from "fs/promises";
@@ -268,30 +268,90 @@ function extractUnquotedTildePaths(command, home) {
268
268
  return paths;
269
269
  }
270
270
  var TRAVERSAL_SEGMENT_RE = /(?:^|\/)\.\.(?:\/|$)/;
271
- function extractRelativeTraversals(command) {
271
+ var CD_NON_TARGET_KEYWORDS = /* @__PURE__ */ new Set([
272
+ "cd",
273
+ "pushd",
274
+ "popd",
275
+ "echo",
276
+ "exit",
277
+ "export",
278
+ "source",
279
+ "set",
280
+ "true",
281
+ "false"
282
+ ]);
283
+ var DYNAMIC_CD_TARGET_RE = /[$`{}]/;
284
+ function applyCdTarget(cwd, target) {
285
+ if (target === "~") return normalize(homedir());
286
+ if (target.startsWith("~/")) return normalize(resolve(homedir(), target.slice(2)));
287
+ if (target.startsWith("/")) return normalize(target);
288
+ if (target.startsWith("-")) return cwd;
289
+ if (DYNAMIC_CD_TARGET_RE.test(target)) return cwd;
290
+ return normalize(resolve(cwd, target));
291
+ }
292
+ function resolveRelativeTraversals(command, workdir) {
293
+ const masked = maskCommandForPathScan(command);
272
294
  const out = [];
273
- const isTraversal = (token) => TRAVERSAL_SEGMENT_RE.test(token);
274
- const quotedPattern = /["']([^"']+)["']/g;
275
- let m;
276
- while ((m = quotedPattern.exec(command)) !== null) {
277
- const content = m[1];
278
- if (!content || content.startsWith("/") || content.startsWith("~") || isWindowsAbsolutePath(content)) continue;
279
- if (isTraversal(content)) out.push(content);
280
- }
281
- const bare = command.replace(/["'][^"']*["']/g, " ").split(/[\s|&;<>()]+/);
282
- for (const token of bare) {
283
- if (!token || token.startsWith("/") || token.startsWith("~")) continue;
284
- if (isTraversal(token)) out.push(token);
295
+ let cwd = normalize(resolve(workdir));
296
+ let quote = null;
297
+ let word = "";
298
+ let quoted = false;
299
+ let expectCdTarget = false;
300
+ const n = masked.length;
301
+ const flush = () => {
302
+ if (word) {
303
+ const isTraversal = !word.startsWith("/") && !word.startsWith("~") && TRAVERSAL_SEGMENT_RE.test(word);
304
+ if (expectCdTarget) {
305
+ expectCdTarget = false;
306
+ if (!quoted && CD_NON_TARGET_KEYWORDS.has(word)) {
307
+ } else {
308
+ if (isTraversal) out.push(normalize(resolve(cwd, word)));
309
+ cwd = applyCdTarget(cwd, word);
310
+ }
311
+ } else if (!quoted && (word === "cd" || word === "pushd")) {
312
+ expectCdTarget = true;
313
+ } else if (isTraversal) {
314
+ out.push(normalize(resolve(cwd, word)));
315
+ }
316
+ }
317
+ word = "";
318
+ quoted = false;
319
+ };
320
+ for (let i = 0; i < n; i++) {
321
+ const ch = masked[i];
322
+ if (quote !== null) {
323
+ if (ch === "\\" && quote !== "'") {
324
+ word += masked[i + 1] ?? "";
325
+ i += 1;
326
+ continue;
327
+ }
328
+ if (ch === quote) {
329
+ quote = null;
330
+ quoted = true;
331
+ continue;
332
+ }
333
+ word += ch;
334
+ continue;
335
+ }
336
+ if (ch === "'" || ch === '"' || ch === "`") {
337
+ quote = ch;
338
+ continue;
339
+ }
340
+ if (ch === "\\") {
341
+ word += masked[i + 1] ?? "";
342
+ i += 1;
343
+ continue;
344
+ }
345
+ if (/[\s&|;<>()]/.test(ch)) {
346
+ flush();
347
+ continue;
348
+ }
349
+ word += ch;
285
350
  }
351
+ flush();
286
352
  return [...new Set(out)];
287
353
  }
288
- function extractAbsolutePathsFromCommand(command) {
289
- if (!command.trim()) {
290
- return [];
291
- }
292
- const paths = [];
293
- const home = homedir();
294
- const posixShell = usesPosixPaths();
354
+ function maskCommandForPathScan(command) {
295
355
  let sanitized = command.replace(/https?:\/\/[^\s'"]+/g, " __URL__ ").replace(/ftp:\/\/[^\s'"]+/g, " __URL__ ");
296
356
  sanitized = sanitized.replace(/(?<!\w)s\/[^/]*\/[^/]*\/[gip]*/g, " __SED__ ");
297
357
  sanitized = sanitized.replace(/(?<!\w)s\|[^|]*\|[^|]*\|[gip]*/g, " __SED__ ");
@@ -299,8 +359,18 @@ function extractAbsolutePathsFromCommand(command) {
299
359
  sanitized = maskRegexAddresses(sanitized);
300
360
  sanitized = sanitized.replace(
301
361
  /git\s+commit\b.*?(?:-(?:[a-zA-Z]*m)(?=\s)|--message)\s+(["'])(?:(?!\1).)*\1/g,
302
- (match2) => match2.replace(/\/[^\s"'|&;<>`()]+/g, " __COMMIT_MSG__ ")
362
+ (match) => match.replace(/\/[^\s"'|&;<>`()]+/g, " __COMMIT_MSG__ ")
303
363
  );
364
+ return sanitized;
365
+ }
366
+ function extractAbsolutePathsFromCommand(command) {
367
+ if (!command.trim()) {
368
+ return [];
369
+ }
370
+ const paths = [];
371
+ const home = homedir();
372
+ const posixShell = usesPosixPaths();
373
+ const sanitized = maskCommandForPathScan(command);
304
374
  const fileUrlMatches = command.matchAll(/file:\/\/([^\s'"]+)/g);
305
375
  for (const match2 of fileUrlMatches) {
306
376
  const filePath = match2[1];
@@ -308,11 +378,11 @@ function extractAbsolutePathsFromCommand(command) {
308
378
  paths.push(normalizeExtracted(filePath));
309
379
  }
310
380
  }
311
- sanitized = sanitized.replace(/file:\/\/[^\s'"]+/g, " __FILEURL__ ");
312
- paths.push(...extractUnquotedTildePaths(sanitized, home));
381
+ const scanCommand = sanitized.replace(/file:\/\/[^\s'"]+/g, " __FILEURL__ ");
382
+ paths.push(...extractUnquotedTildePaths(scanCommand, home));
313
383
  const quotedPattern = /["']([^"']+)["']/g;
314
384
  let match;
315
- while ((match = quotedPattern.exec(sanitized)) !== null) {
385
+ while ((match = quotedPattern.exec(scanCommand)) !== null) {
316
386
  const content = match[1];
317
387
  if (content.startsWith("/") && content.endsWith("/")) {
318
388
  continue;
@@ -334,7 +404,7 @@ function extractAbsolutePathsFromCommand(command) {
334
404
  }
335
405
  if (isWindows()) {
336
406
  const winAbsolutePattern = /(?:^|[\s=(])([A-Za-z]:[\\/][^\s"'|&;<>`()]+)/g;
337
- while ((match = winAbsolutePattern.exec(sanitized)) !== null) {
407
+ while ((match = winAbsolutePattern.exec(scanCommand)) !== null) {
338
408
  const candidate = match[1];
339
409
  if (isPlaceholderToken(candidate)) continue;
340
410
  const resolved = normalizeExtracted(candidate);
@@ -346,10 +416,19 @@ function extractAbsolutePathsFromCommand(command) {
346
416
  if (posixShell) {
347
417
  const absolutePattern = /(?:^|[\s=(])(\/[^\s"'|&;<>`()]+)/g;
348
418
  const rootPattern = /(?:^|[\s=(])\/(?=$|[\s'"`|&;,<()])/g;
349
- if (rootPattern.test(sanitized)) {
419
+ let isRoot = false;
420
+ for (const match2 of scanCommand.matchAll(rootPattern)) {
421
+ const rest = scanCommand.slice(match2.index + match2[0].length);
422
+ if (/^\s+[0-9]/.test(rest) && !/^\s+[0-9]+[>]/.test(rest)) {
423
+ continue;
424
+ }
425
+ isRoot = true;
426
+ break;
427
+ }
428
+ if (isRoot) {
350
429
  paths.push("/");
351
430
  }
352
- while ((match = absolutePattern.exec(sanitized)) !== null) {
431
+ while ((match = absolutePattern.exec(scanCommand)) !== null) {
353
432
  const candidate = match[1];
354
433
  if (isPlaceholderToken(candidate)) continue;
355
434
  if (looksLikeRegex(candidate)) continue;
@@ -360,7 +439,6 @@ function extractAbsolutePathsFromCommand(command) {
360
439
  }
361
440
  }
362
441
  }
363
- paths.push(...extractRelativeTraversals(sanitized));
364
442
  return [...new Set(paths)];
365
443
  }
366
444
  function extractSensitivePathsFromCommand(command) {
@@ -656,6 +734,7 @@ export {
656
734
  isPathAllowed,
657
735
  clearAllowedPaths,
658
736
  isPathWithinSandbox,
737
+ resolveRelativeTraversals,
659
738
  extractAbsolutePathsFromCommand,
660
739
  extractSensitivePathsFromCommand,
661
740
  checkPathsAccess,
@@ -671,4 +750,4 @@ export {
671
750
  getConfirmationSessionId,
672
751
  getPendingConfirmationsBySession
673
752
  };
674
- //# sourceMappingURL=chunk-5A4YN6I7.js.map
753
+ //# sourceMappingURL=chunk-KD4W3I6C.js.map
@@ -1,15 +1,19 @@
1
1
  import {
2
2
  runAgentTurn
3
- } from "./chunk-KDC4QHE7.js";
3
+ } from "./chunk-QJNBQCAF.js";
4
4
  import {
5
5
  executeSubAgent,
6
6
  getToolRegistryForAgent
7
- } from "./chunk-SCP5KBNB.js";
7
+ } from "./chunk-5CCM655F.js";
8
+ import {
9
+ TurnMetrics,
10
+ createMessageStartEvent
11
+ } from "./chunk-62GUO2EG.js";
8
12
  import {
9
13
  checkAborted,
10
14
  decodeUtf8,
11
15
  spawnShellProcess
12
- } from "./chunk-I22B6KWV.js";
16
+ } from "./chunk-RV5G7QQU.js";
13
17
  import {
14
18
  terminateProcessTree
15
19
  } from "./chunk-I72ACQ6R.js";
@@ -23,28 +27,24 @@ import {
23
27
  loadProjectWorkflows,
24
28
  loadUserWorkflows,
25
29
  normalizeWorkflowScope
26
- } from "./chunk-STYGFTEB.js";
30
+ } from "./chunk-UGEFD67O.js";
31
+ import {
32
+ getCurrentContextWindowId,
33
+ getEventStore
34
+ } from "./chunk-YJD5A375.js";
27
35
  import {
28
36
  createChatMessageMessage,
29
37
  createSessionRunningMessage
30
38
  } from "./chunk-XAAEP5XM.js";
31
- import {
32
- TurnMetrics,
33
- createMessageStartEvent
34
- } from "./chunk-62GUO2EG.js";
35
- import {
36
- getCurrentContextWindowId,
37
- getEventStore
38
- } from "./chunk-J3IJJ55E.js";
39
39
  import {
40
40
  findAgentById,
41
41
  getRuntimeConfig,
42
42
  loadAllAgentsDefault,
43
43
  resolveDefaultAgentId
44
- } from "./chunk-2N7KFNMY.js";
44
+ } from "./chunk-KBESUA3W.js";
45
45
  import {
46
46
  LLMError
47
- } from "./chunk-POTCPZJF.js";
47
+ } from "./chunk-VPRB5FNR.js";
48
48
  import {
49
49
  logger
50
50
  } from "./chunk-K44MW7JJ.js";
@@ -1002,4 +1002,4 @@ export {
1002
1002
  abortRunnerRun,
1003
1003
  launchWorkflowRun
1004
1004
  };
1005
- //# sourceMappingURL=chunk-UOEAKQBH.js.map
1005
+ //# sourceMappingURL=chunk-KGFERMCV.js.map
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  getDatabase
3
- } from "./chunk-NYQKSKDB.js";
3
+ } from "./chunk-OYBUJIC3.js";
4
4
 
5
5
  // src/server/db/settings.ts
6
6
  var SETTINGS_KEYS = {
@@ -131,4 +131,4 @@ export {
131
131
  getAllSettings,
132
132
  getMaxVisibleItems
133
133
  };
134
- //# sourceMappingURL=chunk-FGVMRFDW.js.map
134
+ //# sourceMappingURL=chunk-N2Q3KYWM.js.map
@@ -164,6 +164,14 @@ function runMigrations(db2) {
164
164
  logger.info("Migrating sessions table: adding provider_manual_active column");
165
165
  db2.exec(`ALTER TABLE sessions ADD COLUMN provider_manual_active INTEGER NOT NULL DEFAULT 1`);
166
166
  }
167
+ if (!columnNames.includes("provider_reasoning_effort")) {
168
+ logger.info("Migrating sessions table: adding provider_reasoning_effort column");
169
+ db2.exec(`ALTER TABLE sessions ADD COLUMN provider_reasoning_effort TEXT`);
170
+ }
171
+ if (!columnNames.includes("provider_pinned_effort")) {
172
+ logger.info("Migrating sessions table: adding provider_pinned_effort column");
173
+ db2.exec(`ALTER TABLE sessions ADD COLUMN provider_pinned_effort TEXT`);
174
+ }
167
175
  if (!columnNames.includes("message_count")) {
168
176
  logger.info("Migrating sessions table: adding message_count column");
169
177
  db2.exec(`ALTER TABLE sessions ADD COLUMN message_count INTEGER NOT NULL DEFAULT 0`);
@@ -332,4 +340,4 @@ export {
332
340
  initDatabase,
333
341
  getDatabase
334
342
  };
335
- //# sourceMappingURL=chunk-NYQKSKDB.js.map
343
+ //# sourceMappingURL=chunk-OYBUJIC3.js.map