openfox 2.0.55 → 2.0.56

package/dist/{chat-handler-C3NO5RY3.js → chat-handler-TVFUXHXP.js}

@@ -5,8 +5,8 @@ import {
 } from "./chunk-UOKVBO67.js";
 import {
   runChatTurn
-} from "./chunk-JQ4FVPIM.js";
-import "./chunk-ZIW47U5D.js";
+} from "./chunk-4R6YPRLX.js";
+import "./chunk-H5YF6DVQ.js";
 import "./chunk-LBGHZLLH.js";
 import "./chunk-OCILP3SJ.js";
 import "./chunk-CYJEQF7U.js";
@@ -154,4 +154,4 @@ export {
   startChatSession,
   stopSessionExecution
 };
-//# sourceMappingURL=chat-handler-C3NO5RY3.js.map
+//# sourceMappingURL=chat-handler-TVFUXHXP.js.map

package/dist/{chunk-JQ4FVPIM.js → chunk-4R6YPRLX.js}

@@ -12,7 +12,7 @@ import {
   loadAllAgentsDefault,
   processEventsForConversation,
   runTopLevelAgentLoop
-} from "./chunk-ZIW47U5D.js";
+} from "./chunk-H5YF6DVQ.js";
 import {
   TurnMetrics,
   WORKFLOW_KICKOFF_PROMPT,
@@ -324,4 +324,4 @@ export {
   runAgentTurn,
   injectWorkflowKickoffIfNeeded
 };
-//# sourceMappingURL=chunk-JQ4FVPIM.js.map
+//# sourceMappingURL=chunk-4R6YPRLX.js.map

package/dist/{chunk-PRYVRROH.js → chunk-7VFX3QXQ.js}

@@ -2,7 +2,7 @@ import {
   injectWorkflowKickoffIfNeeded,
   runAgentTurn,
   runChatTurn
-} from "./chunk-JQ4FVPIM.js";
+} from "./chunk-4R6YPRLX.js";
 import {
   applyDynamicContext,
   checkAborted,
@@ -16,7 +16,7 @@ import {
   loadAllAgentsDefault,
   saveItemToDir,
   spawnShellProcess
-} from "./chunk-ZIW47U5D.js";
+} from "./chunk-H5YF6DVQ.js";
 import {
   getPlatformShell,
   onProcessEvent
@@ -2091,4 +2091,4 @@ export {
   signalMcpReady,
   createWebSocketServer
 };
-//# sourceMappingURL=chunk-PRYVRROH.js.map
+//# sourceMappingURL=chunk-7VFX3QXQ.js.map

package/dist/{chunk-ZIW47U5D.js → chunk-H5YF6DVQ.js}

@@ -170,10 +170,23 @@ function isPathAllowed(sessionId, path) {
   return allowed.has(normalize(path));
 }
 async function safeRealpath(path) {
+  const absolutePath = normalize(resolve(path));
   try {
-    return await realpath(path);
+    return await realpath(absolutePath);
   } catch {
-    return normalize(resolve(path));
+    const missingSegments = [];
+    let current = absolutePath;
+    while (true) {
+      try {
+        const canonicalParent = await realpath(current);
+        return normalize(join(canonicalParent, ...missingSegments.reverse()));
+      } catch {
+        const parent = resolve(current, "..");
+        if (parent === current) return absolutePath;
+        missingSegments.push(basename(current));
+        current = parent;
+      }
+    }
   }
 }
 async function isPathWithinSandbox(path, workdir, sessionId) {
@@ -186,9 +199,9 @@ async function isPathWithinSandbox(path, workdir, sessionId) {
       const { readlink } = await import("fs/promises");
       const linkTarget = await readlink(path);
       const linkDir = resolve(path, "..");
-      resolvedPath = normalize(resolve(linkDir, linkTarget));
+      resolvedPath = await safeRealpath(resolve(linkDir, linkTarget));
     } catch {
-      resolvedPath = normalize(resolve(path));
+      resolvedPath = await safeRealpath(path);
     }
   }
   resolvedPath = resolvedPath.replace(/\/+$/, "");
@@ -196,12 +209,12 @@ async function isPathWithinSandbox(path, workdir, sessionId) {
     return { allowed: true, resolvedPath };
   }
   for (const root of ALLOWED_ROOTS) {
-    const normalizedRoot = normalize(root);
+    const normalizedRoot = normalize((await safeRealpath(root)).replace(/\/+$/, ""));
     if (resolvedPath === normalizedRoot || resolvedPath.startsWith(normalizedRoot + sep)) {
       return { allowed: true, resolvedPath };
     }
   }
-  if (sessionId && isPathAllowed(sessionId, resolvedPath)) {
+  if (sessionId && (isPathAllowed(sessionId, path) || isPathAllowed(sessionId, resolvedPath))) {
     return { allowed: true, resolvedPath };
   }
   return { allowed: false, resolvedPath };
@@ -3411,7 +3424,7 @@ var callSubAgentTool = {
       };
     }
     try {
-      const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-32PBXC2S.js");
+      const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-3ULXCV6F.js");
       const toolRegistry = getToolRegistryForAgent2(agentDef);
       const turnMetrics = new TurnMetrics();
       const result = await executeSubAgent({
@@ -4227,7 +4240,7 @@ function resolveAgentDef2(sessionManager, sessionId) {
 }
 async function buildCachedPrompt(sessionManager, sessionId, agentDef) {
   const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
-  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-32PBXC2S.js");
+  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-3ULXCV6F.js");
   const tools = getToolRegistryForAgent2(agentDef).definitions;
   const toolFingerprint = getToolFingerprint(tools);
   const allAgents = await loadAllAgentsDefault();
@@ -4240,7 +4253,7 @@ async function buildCachedPrompt(sessionManager, sessionId, agentDef) {
 async function computeSessionHash(sessionManager, sessionId) {
   const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
   const agentDef = await resolveAgentDef2(sessionManager, sessionId);
-  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-32PBXC2S.js");
+  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-3ULXCV6F.js");
   const tools = getToolRegistryForAgent2(agentDef).definitions;
   const toolFingerprint = getToolFingerprint(tools);
   return computeDynamicContextHash(instructionContent, skills, toolFingerprint);
@@ -4347,7 +4360,7 @@ var mcpConfigTool = createTool(
       await saveGlobalConfig(mcpConfigMode, { ...globalConfig, mcpServers: updated });
     }
     async function rebuildTools() {
-      const { setMcpTools: setMcpTools2 } = await import("./tools-32PBXC2S.js");
+      const { setMcpTools: setMcpTools2 } = await import("./tools-3ULXCV6F.js");
       const mcpTools = createMcpTools(mcpManagerForTools);
       setMcpTools2(mcpTools);
     }
@@ -5017,4 +5030,4 @@ export {
   getToolRegistryForAgent,
   createToolRegistry
 };
-//# sourceMappingURL=chunk-ZIW47U5D.js.map
+//# sourceMappingURL=chunk-H5YF6DVQ.js.map

package/dist/{chunk-5UHSEVAP.js → chunk-ITN5PD7H.js}

@@ -208,7 +208,7 @@ async function runCli(options) {
       if (!configExists) {
         await runNetworkSetup(mode);
       }
-      const { runServe } = await import("./serve-UX6YYIMR.js");
+      const { runServe } = await import("./serve-QD3KZNSX.js");
       const serveOptions = { mode };
       if (values.port) serveOptions.port = parseInt(values.port);
       if (values["no-browser"] === true) serveOptions.openBrowser = false;
@@ -220,4 +220,4 @@ async function runCli(options) {
 export {
   runCli
 };
-//# sourceMappingURL=chunk-5UHSEVAP.js.map
+//# sourceMappingURL=chunk-ITN5PD7H.js.map

package/dist/{chunk-7V3JBKYK.js → chunk-YVRGXDIX.js}

@@ -21,7 +21,7 @@ import {
   tokenFromPassword,
   verifyPassword,
   workflowExists
-} from "./chunk-PRYVRROH.js";
+} from "./chunk-7VFX3QXQ.js";
 import {
   agentExists,
   createToolRegistry,
@@ -61,7 +61,7 @@ import {
   setMcpTools,
   setNotifyMcpServersChanged,
   skillExists
-} from "./chunk-ZIW47U5D.js";
+} from "./chunk-H5YF6DVQ.js";
 import {
   getPathSeparator,
   isAbsolutePath
@@ -2948,14 +2948,14 @@ var SessionManager = class {
     const msg = {
       queueId: crypto.randomUUID(),
       mode,
-      content,
+      content: content ?? "",
       ...attachments ? { attachments } : {},
       ...messageKind ? { messageKind } : {},
       queuedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     queue.push(msg);
     this.messageQueues.set(sessionId, queue);
-    this.emit({ type: "queue_added", sessionId, queueId: msg.queueId, mode, content });
+    this.emit({ type: "queue_added", sessionId, queueId: msg.queueId, mode, content: content ?? "" });
     return msg;
   }
   cancelQueuedMessage(sessionId, queueId) {
@@ -3849,7 +3849,7 @@ import { Router as Router7 } from "express";
 import { spawn as spawn2 } from "child_process";
 
 // src/constants.ts
-var VERSION = "2.0.55";
+var VERSION = "2.0.56";
 
 // src/server/routes/auto-update.ts
 var updateInProgress = false;
@@ -4050,7 +4050,7 @@ async function createServerHandle(config4) {
       setMcpTools(mcpTools);
       logger.info("MCP tools registered", { count: mcpTools.length });
     }
-    const { signalMcpReady } = await import("./server-ILO7GYZE.js");
+    const { signalMcpReady } = await import("./server-URL2FOSC.js");
     signalMcpReady();
   });
   const app = express();
@@ -4243,7 +4243,7 @@ async function createServerHandle(config4) {
   app.get("/api/sessions/:id", async (req, res) => {
     const { getEventStore: getEventStore2 } = await import("./events-52XADT6Y.js");
     const { buildMessagesFromStoredEvents } = await import("./folding-2BGFLV5J.js");
-    const { getPendingQuestionsForSession } = await import("./tools-32PBXC2S.js");
+    const { getPendingQuestionsForSession } = await import("./tools-3ULXCV6F.js");
     const session = sessionManager.getSession(req.params.id);
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
@@ -4262,8 +4262,8 @@ async function createServerHandle(config4) {
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-C3NO5RY3.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-32PBXC2S.js");
+    const { stopSessionExecution } = await import("./chat-handler-TVFUXHXP.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-3ULXCV6F.js");
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
     abortSession(sessionId);
@@ -4417,7 +4417,7 @@ async function createServerHandle(config4) {
     if (!callId || approved === void 0) {
       return res.status(400).json({ error: "callId and approved are required" });
     }
-    const { providePathConfirmation } = await import("./tools-32PBXC2S.js");
+    const { providePathConfirmation } = await import("./tools-3ULXCV6F.js");
     const result = providePathConfirmation(callId, approved, alwaysAllow);
     if (!result.found) {
       return res.status(404).json({ error: "No pending path confirmation with that ID" });
@@ -4425,7 +4425,7 @@ async function createServerHandle(config4) {
     const { getEventStore: getEventStore2 } = await import("./events-52XADT6Y.js");
     const { buildMessagesFromStoredEvents, foldPendingConfirmations } = await import("./folding-2BGFLV5J.js");
     const { createSessionStateMessage } = await import("./protocol-CTNE3ANP.js");
-    const { getPendingQuestionsForSession } = await import("./tools-32PBXC2S.js");
+    const { getPendingQuestionsForSession } = await import("./tools-3ULXCV6F.js");
     const eventStore = getEventStore2();
     const events = eventStore.getEvents(sessionId);
     const messages = buildMessagesFromStoredEvents(events);
@@ -4446,7 +4446,7 @@ async function createServerHandle(config4) {
     if (!skip && typeof answer !== "string") {
       return res.status(400).json({ error: "answer is required when not skipping" });
     }
-    const { provideAnswer } = await import("./tools-32PBXC2S.js");
+    const { provideAnswer } = await import("./tools-3ULXCV6F.js");
     const found = provideAnswer(callId, answer ?? "", skip ?? false);
     if (!found) {
       return res.status(404).json({ error: "No pending question with that ID" });
@@ -4460,8 +4460,10 @@ async function createServerHandle(config4) {
       return res.status(404).json({ error: "Session not found" });
     }
     const { content, attachments, messageKind } = req.body;
-    if (!content?.trim()) {
-      return res.status(400).json({ error: "content is required" });
+    const hasContent = content?.trim();
+    const hasAttachments = Array.isArray(attachments) && attachments.length > 0;
+    if (!hasContent && !hasAttachments) {
+      return res.status(400).json({ error: "content or attachments is required" });
     }
     sessionManager.queueMessage(sessionId, "asap", content, attachments, messageKind);
     res.json({ success: true, queueState: sessionManager.getQueueState(sessionId) });
@@ -4482,7 +4484,7 @@ async function createServerHandle(config4) {
     if (sessionManager.isWarmedUp(sessionId)) {
       return res.json({ success: false, reason: "already_warmed" });
     }
-    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-2OPDGKLZ.js");
+    const { runAgentTurn, TurnMetrics } = await import("./orchestrator-ZBWWJZPN.js");
     runAgentTurn(
       {
         sessionManager,
@@ -4525,8 +4527,8 @@ async function createServerHandle(config4) {
     if (!session) {
       return res.status(404).json({ error: "Session not found" });
     }
-    const { stopSessionExecution } = await import("./chat-handler-C3NO5RY3.js");
-    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-32PBXC2S.js");
+    const { stopSessionExecution } = await import("./chat-handler-TVFUXHXP.js");
+    const { cancelQuestionsForSession, cancelPathConfirmationsForSession } = await import("./tools-3ULXCV6F.js");
     const queuedMessages = sessionManager.getQueueState(sessionId);
     sessionManager.clearMessageQueue(sessionId);
     stopSessionExecution(sessionId, sessionManager);
@@ -5036,7 +5038,7 @@ async function createServerHandle(config4) {
   });
   async function rebuildMcpTools() {
     const { createMcpTools: createMcpTools2 } = await import("./tool-adapter-MOGEI6TP.js");
-    const { setMcpTools: setMcpTools2 } = await import("./tools-32PBXC2S.js");
+    const { setMcpTools: setMcpTools2 } = await import("./tools-3ULXCV6F.js");
     const mcpTools = createMcpTools2(mcpManager);
     setMcpTools2(mcpTools);
   }
@@ -5344,7 +5346,7 @@ async function createServerHandle(config4) {
     const state = sessionManager.getContextState(sessionId);
     wssExports.broadcastForSession(sessionId, createContextStateMessage(state));
   });
-  const { QueueProcessor } = await import("./processor-VUAIB4Z6.js");
+  const { QueueProcessor } = await import("./processor-KXXQKBQV.js");
   const queueProcessor = new QueueProcessor({
     sessionManager,
     providerManager,
@@ -5419,4 +5421,4 @@ export {
   createServerHandle,
   createServer
 };
-//# sourceMappingURL=chunk-7V3JBKYK.js.map
+//# sourceMappingURL=chunk-YVRGXDIX.js.map

package/dist/cli/dev.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "../chunk-5UHSEVAP.js";
+} from "../chunk-ITN5PD7H.js";
 import "../chunk-XY3LESVZ.js";
 import {
   logger

package/dist/cli/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "../chunk-5UHSEVAP.js";
+} from "../chunk-ITN5PD7H.js";
 import "../chunk-XY3LESVZ.js";
 import {
   logger

package/dist/{orchestrator-2OPDGKLZ.js → orchestrator-ZBWWJZPN.js}

@@ -2,8 +2,8 @@ import {
   injectWorkflowKickoffIfNeeded,
   runAgentTurn,
   runChatTurn
-} from "./chunk-JQ4FVPIM.js";
-import "./chunk-ZIW47U5D.js";
+} from "./chunk-4R6YPRLX.js";
+import "./chunk-H5YF6DVQ.js";
 import "./chunk-LBGHZLLH.js";
 import "./chunk-OCILP3SJ.js";
 import "./chunk-CYJEQF7U.js";
@@ -43,4 +43,4 @@ export {
   runAgentTurn,
   runChatTurn
 };
-//# sourceMappingURL=orchestrator-2OPDGKLZ.js.map
+//# sourceMappingURL=orchestrator-ZBWWJZPN.js.map

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openfox",
-  "version": "2.0.55",
+  "version": "2.0.56",
   "description": "Local-LLM-first agentic coding assistant",
   "type": "module",
   "bin": {

package/dist/{processor-VUAIB4Z6.js → processor-KXXQKBQV.js}

@@ -3,7 +3,7 @@ import {
   finalizeTurnCompletion,
   generateSessionNameForSession
 } from "./chunk-UOKVBO67.js";
-import "./chunk-ZIW47U5D.js";
+import "./chunk-H5YF6DVQ.js";
 import "./chunk-LBGHZLLH.js";
 import "./chunk-OCILP3SJ.js";
 import "./chunk-CYJEQF7U.js";
@@ -174,7 +174,7 @@ var QueueProcessor = class {
       backend: provider?.backend ?? llmClient.getBackend(),
       model: llmClient.getModel()
     };
-    const { runChatTurn } = await import("./orchestrator-2OPDGKLZ.js");
+    const { runChatTurn } = await import("./orchestrator-ZBWWJZPN.js");
     const runChatTurnParams = buildRunChatTurnParams({
       sessionManager,
       sessionId,
@@ -222,4 +222,4 @@ var QueueProcessor = class {
 export {
   QueueProcessor
 };
-//# sourceMappingURL=processor-VUAIB4Z6.js.map
+//# sourceMappingURL=processor-KXXQKBQV.js.map

package/dist/{serve-UX6YYIMR.js → serve-QD3KZNSX.js}

@@ -1,10 +1,10 @@
 import {
   VERSION,
   createServer
-} from "./chunk-7V3JBKYK.js";
-import "./chunk-PRYVRROH.js";
-import "./chunk-JQ4FVPIM.js";
-import "./chunk-ZIW47U5D.js";
+} from "./chunk-YVRGXDIX.js";
+import "./chunk-7VFX3QXQ.js";
+import "./chunk-4R6YPRLX.js";
+import "./chunk-H5YF6DVQ.js";
 import "./chunk-LBGHZLLH.js";
 import "./chunk-OCILP3SJ.js";
 import "./chunk-CYJEQF7U.js";
@@ -205,4 +205,4 @@ async function runServe(options) {
 export {
   runServe
 };
-//# sourceMappingURL=serve-UX6YYIMR.js.map
+//# sourceMappingURL=serve-QD3KZNSX.js.map

package/dist/server/index.d.ts

@@ -544,7 +544,7 @@ declare class SessionManager {
     removeCriterion(sessionId: string, criterionId: string): Criterion[];
     setMetadataEntries(sessionId: string, key: string, entries: MetadataEntry[]): void;
     private messageQueues;
-    queueMessage(sessionId: string, mode: 'asap' | 'completion', content: string, attachments?: Attachment[], messageKind?: string): QueuedMessage;
+    queueMessage(sessionId: string, mode: 'asap' | 'completion', content?: string, attachments?: Attachment[], messageKind?: string): QueuedMessage;
     cancelQueuedMessage(sessionId: string, queueId: string): boolean;
     drainAsapMessages(sessionId: string): QueuedMessage[];
     drainCompletionMessages(sessionId: string): QueuedMessage[];

package/dist/server/index.js

@@ -1,10 +1,10 @@
 import {
   createServer,
   createServerHandle
-} from "../chunk-7V3JBKYK.js";
-import "../chunk-PRYVRROH.js";
-import "../chunk-JQ4FVPIM.js";
-import "../chunk-ZIW47U5D.js";
+} from "../chunk-YVRGXDIX.js";
+import "../chunk-7VFX3QXQ.js";
+import "../chunk-4R6YPRLX.js";
+import "../chunk-H5YF6DVQ.js";
 import "../chunk-LBGHZLLH.js";
 import "../chunk-OCILP3SJ.js";
 import "../chunk-CYJEQF7U.js";

package/dist/{server-ILO7GYZE.js → server-URL2FOSC.js}

@@ -1,9 +1,9 @@
 import {
   createWebSocketServer,
   signalMcpReady
-} from "./chunk-PRYVRROH.js";
-import "./chunk-JQ4FVPIM.js";
-import "./chunk-ZIW47U5D.js";
+} from "./chunk-7VFX3QXQ.js";
+import "./chunk-4R6YPRLX.js";
+import "./chunk-H5YF6DVQ.js";
 import "./chunk-LBGHZLLH.js";
 import "./chunk-OCILP3SJ.js";
 import "./chunk-CYJEQF7U.js";
@@ -35,4 +35,4 @@ export {
   createWebSocketServer,
   signalMcpReady
 };
-//# sourceMappingURL=server-ILO7GYZE.js.map
+//# sourceMappingURL=server-URL2FOSC.js.map

package/dist/{tools-32PBXC2S.js → tools-3ULXCV6F.js}

@@ -12,7 +12,7 @@ import {
   setMcpTools,
   stepDoneTool,
   validateToolAction
-} from "./chunk-ZIW47U5D.js";
+} from "./chunk-H5YF6DVQ.js";
 import "./chunk-LBGHZLLH.js";
 import "./chunk-OCILP3SJ.js";
 import "./chunk-CYJEQF7U.js";
@@ -58,4 +58,4 @@ export {
   stepDoneTool,
   validateToolAction
 };
-//# sourceMappingURL=tools-32PBXC2S.js.map
+//# sourceMappingURL=tools-3ULXCV6F.js.map