osborn 0.9.154 → 0.9.156

package/Dockerfile.sandbox

@@ -101,6 +101,7 @@ ENV OSBORN_CWD=/workspace
 # Caveat: native user modules are tied to the image's Node ABI (currently 22) —
 # a future Node-major image bump would need an `npm rebuild` of volume globals.
 ENV NPM_CONFIG_PREFIX=/workspace/.npm-global
+ENV NPM_CONFIG_CACHE=/tmp/npm-cache
 ENV PATH=/workspace/.npm-global/bin:$PATH
 
 WORKDIR /workspace

package/dist/claude-llm.js

@@ -140,10 +140,17 @@ function ensureCompactionSettings() {
         else {
             mkdirSync(claudeDir, { recursive: true });
         }
+        let dirty = false;
         if (settings.autoCompactWindow !== 1_000_000) {
             settings.autoCompactWindow = 1_000_000;
+            dirty = true;
+        }
+        if (settings.cleanupPeriodDays !== 3650) {
+            settings.cleanupPeriodDays = 3650;
+            dirty = true;
+        }
+        if (dirty) {
             writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
-            console.log('🪟 autoCompactWindow set to 1,000,000 in', settingsPath);
         }
     }
     catch (err) {

package/dist/index.js

@@ -267,6 +267,7 @@ let codeServerStartHook = null;
 // code-server runs on 127.0.0.1:8300; the agent proxies it through its own
 // public HTTP server so no Cloudflare tunnel is needed.
 const IDE_TARGET = 'http://127.0.0.1:8300';
+const OSBORN_API_PORT = parseInt(process.env.OSBORN_API_PORT || '8741', 10);
 // Route prefixes that belong to the agent itself. The proxy fall-through checks
 // this list FIRST so it never intercepts an agent API path.
 const AGENT_ROUTE_PREFIXES = [
@@ -1498,21 +1499,44 @@ function startApiServer(workingDir, port) {
         // 3 s until ready.
         if (url.pathname === '/editor' && req.method === 'GET') {
             // AUTH GATE (future): validate key / signed session before minting the cookie
+            // Optional ?folder= param: must be an absolute path under /workspace with no
+            // directory-traversal sequences. If absent or invalid, fall back to bare '/'.
+            const rawFolder = url.searchParams.get('folder') ?? '';
+            const folderParam = (() => {
+                if (!rawFolder)
+                    return '';
+                // Must be absolute, start with /workspace, no traversal sequences
+                if (!rawFolder.startsWith('/workspace') ||
+                    rawFolder.includes('..') ||
+                    rawFolder.includes('\0'))
+                    return '';
+                // Normalise and re-check (catches encoded or doubled slashes resolving outside /workspace)
+                const normalised = rawFolder.replace(/\/+/g, '/');
+                if (!normalised.startsWith('/workspace'))
+                    return '';
+                return normalised;
+            })();
             if (ideProxyEnabled && ideSessionToken) {
-                // code-server is up — set cookie and redirect to root (code-server's asset base)
+                // code-server is up — set cookie and redirect into the requested folder (if valid)
+                // or to root if no valid folder was supplied.
+                const location = folderParam ? `/?folder=${encodeURIComponent(folderParam)}` : '/';
                 res.writeHead(302, {
                     'Set-Cookie': `osborn_ide=${ideSessionToken}; Path=/; HttpOnly; SameSite=Lax`,
-                    'Location': '/',
+                    'Location': location,
                 });
                 res.end();
             }
             else {
-                // Not yet running — kick off start in the background, show "Starting…" page
+                // Not yet running — kick off start in the background, show "Starting…" page.
+                // Preserve ?folder= in the refresh URL so it survives the polling loop.
                 if (codeServerStartHook) {
                     codeServerStartHook().catch((err) => {
                         console.error('❌ startCodeServer() from /editor failed:', err);
                     });
                 }
+                const refreshTarget = folderParam
+                    ? `/editor?folder=${encodeURIComponent(folderParam)}`
+                    : '/editor';
                 res.writeHead(200, {
                     'Content-Type': 'text/html; charset=utf-8',
                     'Cache-Control': 'no-store, must-revalidate',
@@ -1520,7 +1544,7 @@ function startApiServer(workingDir, port) {
                 });
                 res.end(`<!DOCTYPE html><html><head>
 <meta charset="utf-8">
-<meta http-equiv="refresh" content="3;url=/editor">
+<meta http-equiv="refresh" content="3;url=${refreshTarget}">
 <title>Starting editor…</title>
 <style>body{font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;background:#1e1e1e;color:#ccc}</style>
 </head><body><p>Starting your editor…</p></body></html>`);
@@ -1528,6 +1552,37 @@ function startApiServer(workingDir, port) {
             return;
         }
         // ────────────────────────────────────────────────────────────────────────
+        // ── Port proxy: /proxy/PORT/* → localhost:PORT/proxy/PORT/* ─────────────
+        // Forwards to a local dev server while PRESERVING the full path so that
+        // basePath-aware apps (e.g. Next.js with basePath: '/proxy/3000') receive
+        // the complete URL and can strip the prefix themselves. No cookie required —
+        // the machine is per-user and Fly's HTTPS is the outer auth boundary.
+        const portProxyMatch = url.pathname.match(/^\/proxy\/(\d+)(\/.*)?$/);
+        if (portProxyMatch) {
+            const targetPort = parseInt(portProxyMatch[1]);
+            if (targetPort > 1024 && targetPort < 65536 && targetPort !== 8300 && targetPort !== OSBORN_API_PORT) {
+                const portProxyOptions = {
+                    hostname: '127.0.0.1',
+                    port: targetPort,
+                    path: url.pathname + (url.search || ''),
+                    method: req.method,
+                    headers: { ...req.headers, host: `127.0.0.1:${targetPort}` },
+                };
+                const portProxyReq = httpRequest(portProxyOptions, (portProxyRes) => {
+                    res.writeHead(portProxyRes.statusCode || 502, portProxyRes.headers);
+                    portProxyRes.pipe(res);
+                });
+                portProxyReq.on('error', () => {
+                    if (!res.headersSent) {
+                        res.writeHead(502);
+                        res.end('Port proxy error');
+                    }
+                });
+                req.pipe(portProxyReq);
+                return;
+            }
+        }
+        // ────────────────────────────────────────────────────────────────────────
         // ── IDE reverse proxy (cookie-gated fall-through) ────────────────────────
         // Forwards to code-server ONLY when:
         //   1. ideProxyEnabled is true (code-server is confirmed ready), AND

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.154",
+  "version": "0.9.156",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {