openfox 2.0.95 → 2.0.96

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.0.96 - 2026-07-26
+
+### Features
+
+- **Remote SSH/SCP/SFTP/MOSH commands are visually distinguished** — tool calls running remote commands show a purple frame and a "REMOTE · SSH" badge, making it easy to spot remote execution at a glance.
+- **Open project folder in OS file explorer from header** — a new folder button opens the project directory in your system's file manager.
+- **Pick a vision fallback model from your configured providers** — choose which model handles vision tasks when the primary model doesn't support images.
+
+### Bug Fixes
+
+- **Project workflow saves no longer silently fall back to user config** — saving a workflow item now correctly updates the file on disk instead of appearing to succeed while leaving the old file intact.
+- **Shell injection prevented when deleting workspaces** — workspace names are no longer interpolated into shell commands, fixing a potential injection vector.
+
 ## 2.0.95 - 2026-07-26
 
 ### Features

package/dist/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.0.96 - 2026-07-26
+
+### Features
+
+- **Remote SSH/SCP/SFTP/MOSH commands are visually distinguished** — tool calls running remote commands show a purple frame and a "REMOTE · SSH" badge, making it easy to spot remote execution at a glance.
+- **Open project folder in OS file explorer from header** — a new folder button opens the project directory in your system's file manager.
+- **Pick a vision fallback model from your configured providers** — choose which model handles vision tasks when the primary model doesn't support images.
+
+### Bug Fixes
+
+- **Project workflow saves no longer silently fall back to user config** — saving a workflow item now correctly updates the file on disk instead of appearing to succeed while leaving the old file intact.
+- **Shell injection prevented when deleting workspaces** — workspace names are no longer interpolated into shell commands, fixing a potential injection vector.
+
 ## 2.0.95 - 2026-07-26
 
 ### Features

package/dist/{chat-handler-5FV3TGQD.js → chat-handler-5OJMACXB.js}

@@ -1,23 +1,23 @@
-import {
-  runChatTurn
-} from "./chunk-OZD247P4.js";
 import {
   buildRunChatTurnParams,
   finalizeTurnCompletion,
   generateSessionNameForSession
-} from "./chunk-5UFTFBNW.js";
-import "./chunk-6RHMIMID.js";
+} from "./chunk-BG4EVBLJ.js";
+import {
+  runChatTurn
+} from "./chunk-C3XL7X4E.js";
+import "./chunk-O5YWFX7H.js";
 import "./chunk-ZASSAZ73.js";
 import "./chunk-HAFRPV7I.js";
 import "./chunk-I72ACQ6R.js";
 import "./chunk-NWO6GRYE.js";
 import "./chunk-VKWVPQJ5.js";
-import "./chunk-62X2MPO6.js";
+import "./chunk-D3SXT3BL.js";
 import "./chunk-J7GAZGZT.js";
-import "./chunk-MB7STVMR.js";
-import "./chunk-MC3MCMAF.js";
-import "./chunk-5N5JXT7R.js";
-import "./chunk-ZMSHE564.js";
+import "./chunk-LZW5LSVH.js";
+import "./chunk-KQPDU65K.js";
+import "./chunk-XLI6PDJG.js";
+import "./chunk-G5JFKTSR.js";
 import {
   createChatMessageMessage,
   createPhaseChangedMessage,
@@ -29,11 +29,11 @@ import "./chunk-K2O7JTCX.js";
 import "./chunk-MRWR3SIT.js";
 import {
   getEventStore
-} from "./chunk-7P7OKBYQ.js";
+} from "./chunk-KNYPBXPW.js";
 import "./chunk-NLN5LPQ4.js";
-import "./chunk-P637C6X3.js";
-import "./chunk-TSHJW7OC.js";
-import "./chunk-OHBY2673.js";
+import "./chunk-O2PLNJIU.js";
+import "./chunk-ZIMGU5ZH.js";
+import "./chunk-3LRYZ7R3.js";
 import "./chunk-J2GP3J3X.js";
 import "./chunk-V4IE7HJY.js";
 import "./chunk-YHEQTVFV.js";
@@ -42,7 +42,7 @@ import "./chunk-UEOEA6BB.js";
 import "./chunk-GLF65XDS.js";
 import "./chunk-K44MW7JJ.js";
 import "./chunk-4R7G5JB6.js";
-import "./chunk-OQTLFO4R.js";
+import "./chunk-URQQOUCS.js";
 import "./chunk-CQGTEGKL.js";
 import "./chunk-5WRI5ZAA.js";
 
@@ -165,4 +165,4 @@ export {
   startChatSession,
   stopSessionExecution
 };
-//# sourceMappingURL=chat-handler-5FV3TGQD.js.map
+//# sourceMappingURL=chat-handler-5OJMACXB.js.map

package/dist/{chunk-YCPUV7AR.js → chunk-3DAZIZ7E.js}

@@ -37,7 +37,7 @@ Options:
 }
 async function runNetworkSetup(mode) {
   const { loadAuthConfig, saveAuthConfig, encryptPassword } = await import("./auth-YY5PJYSC.js");
-  const { saveGlobalConfig } = await import("./config-XIYAPMX3.js");
+  const { saveGlobalConfig } = await import("./config-M7RDIFC5.js");
   const { getAuthKeyPath } = await import("./paths-F27V3S4I.js");
   const existingAuth = await loadAuthConfig(mode);
   if (existingAuth) {
@@ -104,7 +104,7 @@ async function runNetworkSetup(mode) {
   console.log("\u2713 Configuration saved!\n");
 }
 async function runConfig(mode) {
-  const { loadGlobalConfig, getActiveProvider, getDefaultModel } = await import("./config-XIYAPMX3.js");
+  const { loadGlobalConfig, getActiveProvider, getDefaultModel } = await import("./config-M7RDIFC5.js");
   const { getGlobalConfigPath } = await import("./paths-F27V3S4I.js");
   const config = await loadGlobalConfig(mode);
   const configPath = getGlobalConfigPath(mode);
@@ -163,7 +163,7 @@ async function runCli(options) {
       break;
     }
     case "provider": {
-      const { runProviderCommand } = await import("./provider-A74GHQUO.js");
+      const { runProviderCommand } = await import("./provider-LZ3XMDX6.js");
       const [, subcommand] = positionals;
       await runProviderCommand(mode, subcommand);
       break;
@@ -200,7 +200,7 @@ async function runCli(options) {
       break;
     }
     case "update": {
-      const { runUpdate } = await import("./update-VUTN743C.js");
+      const { runUpdate } = await import("./update-2Z6TXHFH.js");
       const code = await runUpdate();
       if (code !== 0) {
         process.exit(code);
@@ -208,12 +208,12 @@ async function runCli(options) {
       break;
     }
     default: {
-      const { configFileExists } = await import("./config-XIYAPMX3.js");
+      const { configFileExists } = await import("./config-M7RDIFC5.js");
       const configExists = await configFileExists(mode);
       if (!configExists) {
         await runNetworkSetup(mode);
       }
-      const { runServe } = await import("./serve-GL5WUPRP.js");
+      const { runServe } = await import("./serve-VGATDJX5.js");
       const serveOptions = { mode };
       if (values.port) serveOptions.port = parseInt(values.port);
       if (values["no-browser"] === true) serveOptions.openBrowser = false;
@@ -225,4 +225,4 @@ async function runCli(options) {
 export {
   runCli
 };
-//# sourceMappingURL=chunk-YCPUV7AR.js.map
+//# sourceMappingURL=chunk-3DAZIZ7E.js.map

package/dist/{chunk-OHBY2673.js → chunk-3LRYZ7R3.js}

@@ -69,21 +69,63 @@ async function loadItemsFromDir(dir, options) {
   }
   return items;
 }
+async function findFileByInternalId(dir, id, ext) {
+  if (!await pathExists(dir)) return null;
+  let files;
+  try {
+    files = await readdir(dir);
+  } catch {
+    return null;
+  }
+  for (const file of files) {
+    if (!file.endsWith(ext)) continue;
+    try {
+      const raw = await readFile(join(dir, file), "utf-8");
+      let parsedId;
+      if (ext === ".md" || ext === ".mdx") {
+        const { data } = matter(raw);
+        parsedId = data.id;
+      } else {
+        const parsed = JSON.parse(raw);
+        parsedId = parsed.metadata?.id ?? parsed.id;
+      }
+      if (parsedId === id) {
+        return join(dir, file);
+      }
+    } catch {
+    }
+  }
+  return null;
+}
 async function saveItemToDir(dir, item, ext, serialize) {
   if (!await pathExists(dir)) {
     await mkdir(dir, { recursive: true });
   }
   const meta = item.metadata;
   const filePath = join(dir, `${meta.id}${ext}`);
+  const existing = await findFileByInternalId(dir, meta.id, ext);
+  if (existing && existing !== filePath) {
+    await unlink(existing).catch(() => {
+    });
+  }
   await writeFile(filePath, serialize(item), "utf-8");
 }
 var jsonSerializer = (item) => JSON.stringify(item, null, 2) + "\n";
 async function deleteItemFromDir(dir, id, ext) {
-  const filePath = join(dir, `${id}${ext}`);
+  const fastPath = join(dir, `${id}${ext}`);
   try {
-    await unlink(filePath);
+    await unlink(fastPath);
     return { success: true };
   } catch {
+    const found = await findFileByInternalId(dir, id, ext);
+    if (found) {
+      try {
+        await unlink(found);
+        return { success: true };
+      } catch {
+        return { success: false };
+      }
+    }
     return { success: false };
   }
 }
@@ -387,6 +429,7 @@ export {
   pathExists,
   getDefaultIds,
   loadItemsFromDir,
+  findFileByInternalId,
   saveItemToDir,
   jsonSerializer,
   deleteItemFromDir,
@@ -412,4 +455,4 @@ export {
   getOverrideAgentIds,
   resolveDefaultAgentId
 };
-//# sourceMappingURL=chunk-OHBY2673.js.map
+//# sourceMappingURL=chunk-3LRYZ7R3.js.map

package/dist/{chunk-W7P5P54O.js → chunk-3W6STALV.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-MRWR3SIT.js";
 import {
   getCurrentWindowMessageOptions
-} from "./chunk-7P7OKBYQ.js";
+} from "./chunk-KNYPBXPW.js";
 
 // src/server/context/compactor.ts
 function appendCompactionPrompt(sessionId, append) {
@@ -36,4 +36,4 @@ export {
   COMPACTION_MAX_RATIO,
   shouldCompact
 };
-//# sourceMappingURL=chunk-W7P5P54O.js.map
+//# sourceMappingURL=chunk-3W6STALV.js.map

package/dist/chunk-62QCBNPE.js

@@ -0,0 +1,15 @@
+// src/server/utils/openFolder.ts
+import { platform } from "os";
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileP = promisify(execFile);
+async function openFolder(dir) {
+  await execFileP("mkdir", ["-p", dir], { timeout: 5e3 });
+  const cmd = platform() === "darwin" ? "open" : platform() === "win32" ? "explorer" : "xdg-open";
+  await execFileP(cmd, [dir], { timeout: 5e3 });
+}
+
+export {
+  openFolder
+};
+//# sourceMappingURL=chunk-62QCBNPE.js.map

package/dist/chunk-7B3XSBRL.js

@@ -0,0 +1,7 @@
+// src/constants.ts
+var VERSION = "2.0.96";
+
+export {
+  VERSION
+};
+//# sourceMappingURL=chunk-7B3XSBRL.js.map

package/dist/{chunk-5UFTFBNW.js → chunk-BG4EVBLJ.js}

@@ -8,17 +8,17 @@ import {
 import {
   combineEventsWithSnapshot,
   getEventStore
-} from "./chunk-7P7OKBYQ.js";
+} from "./chunk-KNYPBXPW.js";
 import {
   buildMessagesFromStoredEvents,
   foldPendingConfirmations
-} from "./chunk-P637C6X3.js";
+} from "./chunk-O2PLNJIU.js";
 import {
   updateSessionMetadata
-} from "./chunk-TSHJW7OC.js";
+} from "./chunk-ZIMGU5ZH.js";
 import {
   getRuntimeConfig
-} from "./chunk-OHBY2673.js";
+} from "./chunk-3LRYZ7R3.js";
 import {
   getMaxVisibleItems
 } from "./chunk-UEOEA6BB.js";
@@ -204,4 +204,4 @@ export {
   needsNameGeneration,
   generateSessionNameForSession
 };
-//# sourceMappingURL=chunk-5UFTFBNW.js.map
+//# sourceMappingURL=chunk-BG4EVBLJ.js.map

package/dist/{chunk-OZD247P4.js → chunk-C3XL7X4E.js}

@@ -4,19 +4,19 @@ import {
   getToolRegistryForAgent,
   processEventsForConversation,
   runTopLevelAgentLoop
-} from "./chunk-6RHMIMID.js";
+} from "./chunk-O5YWFX7H.js";
 import {
   buildCachedPrompt,
   computeDynamicContextHash,
   getToolFingerprint
-} from "./chunk-MB7STVMR.js";
+} from "./chunk-LZW5LSVH.js";
 import {
   getAllInstructions,
   getEnabledSkillMetadata
-} from "./chunk-MC3MCMAF.js";
+} from "./chunk-KQPDU65K.js";
 import {
   PathAccessDeniedError
-} from "./chunk-ZMSHE564.js";
+} from "./chunk-G5JFKTSR.js";
 import {
   TurnMetrics,
   createChatDoneEvent,
@@ -30,16 +30,16 @@ import {
   getCurrentContextWindowId,
   getCurrentWindowMessageOptions,
   getEventStore
-} from "./chunk-7P7OKBYQ.js";
+} from "./chunk-KNYPBXPW.js";
 import {
   buildSnapshotFromSessionState
-} from "./chunk-P637C6X3.js";
+} from "./chunk-O2PLNJIU.js";
 import {
   findAgentById,
   getRuntimeConfig,
   loadAllAgentsDefault,
   resolveDefaultAgentId
-} from "./chunk-OHBY2673.js";
+} from "./chunk-3LRYZ7R3.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -309,4 +309,4 @@ export {
   runChatTurn,
   runAgentTurn
 };
-//# sourceMappingURL=chunk-OZD247P4.js.map
+//# sourceMappingURL=chunk-C3XL7X4E.js.map

package/dist/{chunk-62X2MPO6.js → chunk-D3SXT3BL.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-K44MW7JJ.js";
 
 // src/server/git/workspace.ts
-import { spawn, execSync } from "child_process";
+import { spawn, execSync, execFileSync } from "child_process";
 import { mkdir as mkdir2 } from "fs/promises";
 import { resolve as resolve2, join as join2, isAbsolute } from "path";
 import { homedir, platform } from "os";
@@ -273,10 +273,10 @@ async function deleteWorkspace(projectName, name, projectDir) {
   if (!st?.isDirectory()) {
     throw new Error(`Workspace "${name}" does not exist`);
   }
-  const { rm } = await import("fs/promises");
   try {
-    execSync(`rm -rf "${wsPath}"`, { stdio: "ignore", timeout: 1e4 });
+    execFileSync("rm", ["-rf", wsPath], { stdio: "ignore" });
   } catch {
+    const { rm } = await import("fs/promises");
     await rm(wsPath, { recursive: true, force: true });
   }
   logger.info("Deleted workspace", { projectName, name, path: wsPath });
@@ -324,4 +324,4 @@ export {
   deleteWorkspace,
   isGitRepository
 };
-//# sourceMappingURL=chunk-62X2MPO6.js.map
+//# sourceMappingURL=chunk-D3SXT3BL.js.map

package/dist/{chunk-ZMSHE564.js → chunk-G5JFKTSR.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-27SDWNKL.js";
 import {
   getEventStore
-} from "./chunk-7P7OKBYQ.js";
+} from "./chunk-KNYPBXPW.js";
 
 // src/server/tools/path-security.ts
 import { realpath } from "fs/promises";
@@ -494,4 +494,4 @@ export {
   getConfirmationSessionId,
   getPendingConfirmationsBySession
 };
-//# sourceMappingURL=chunk-ZMSHE564.js.map
+//# sourceMappingURL=chunk-G5JFKTSR.js.map

package/dist/{chunk-7P7OKBYQ.js → chunk-KNYPBXPW.js}

@@ -5,13 +5,13 @@ import {
   foldContextState,
   foldSessionState,
   spreadOptionalMessageFields
-} from "./chunk-P637C6X3.js";
+} from "./chunk-O2PLNJIU.js";
 import {
   updateSessionMessageCount
-} from "./chunk-TSHJW7OC.js";
+} from "./chunk-ZIMGU5ZH.js";
 import {
   getRuntimeConfig
-} from "./chunk-OHBY2673.js";
+} from "./chunk-3LRYZ7R3.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -1175,4 +1175,4 @@ export {
   truncateSessionMessages,
   getRecentUserPromptsForSession
 };
-//# sourceMappingURL=chunk-7P7OKBYQ.js.map
+//# sourceMappingURL=chunk-KNYPBXPW.js.map

package/dist/{chunk-MC3MCMAF.js → chunk-KQPDU65K.js}

@@ -5,7 +5,7 @@ import {
   deleteItemFromDir,
   loadItemsFromDir,
   pathExists
-} from "./chunk-OHBY2673.js";
+} from "./chunk-3LRYZ7R3.js";
 import {
   SETTINGS_KEYS,
   deleteSetting,
@@ -440,4 +440,4 @@ export {
   deleteSkill,
   deleteProjectSkill
 };
-//# sourceMappingURL=chunk-MC3MCMAF.js.map
+//# sourceMappingURL=chunk-KQPDU65K.js.map

package/dist/{chunk-MB7STVMR.js → chunk-LZW5LSVH.js}

@@ -1,7 +1,7 @@
 import {
   getAllInstructions,
   getEnabledSkillMetadata
-} from "./chunk-MC3MCMAF.js";
+} from "./chunk-KQPDU65K.js";
 import {
   buildTopLevelSystemPrompt
 } from "./chunk-MRWR3SIT.js";
@@ -11,7 +11,7 @@ import {
   getSubAgents,
   loadAllAgentsDefault,
   resolveDefaultAgentId
-} from "./chunk-OHBY2673.js";
+} from "./chunk-3LRYZ7R3.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -104,7 +104,7 @@ function resolveAgentDef(sessionManager, sessionId) {
 }
 async function buildCachedPrompt(sessionManager, sessionId, agentDef) {
   const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
-  const { getToolRegistryForAgent } = await import("./tools-UTA3TV7P.js");
+  const { getToolRegistryForAgent } = await import("./tools-I3BAXRVD.js");
   const tools = getToolRegistryForAgent(agentDef, sessionId).definitions;
   const toolFingerprint = getToolFingerprint(tools);
   const allAgents = await loadAllAgentsDefault();
@@ -117,7 +117,7 @@ async function buildCachedPrompt(sessionManager, sessionId, agentDef) {
 async function computeSessionHash(sessionManager, sessionId) {
   const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
   const agentDef = await resolveAgentDef(sessionManager, sessionId);
-  const { getToolRegistryForAgent } = await import("./tools-UTA3TV7P.js");
+  const { getToolRegistryForAgent } = await import("./tools-I3BAXRVD.js");
   const tools = getToolRegistryForAgent(agentDef, sessionId).definitions;
   const toolFingerprint = getToolFingerprint(tools);
   return computeDynamicContextHash(instructionContent, skills, toolFingerprint);
@@ -141,4 +141,4 @@ export {
   computeSessionHash,
   applyDynamicContext
 };
-//# sourceMappingURL=chunk-MB7STVMR.js.map
+//# sourceMappingURL=chunk-LZW5LSVH.js.map