palmier 0.5.5 → 0.5.6

package/README.md

@@ -22,7 +22,7 @@ The serve daemon always runs a local HTTP server. Three access modes are availab
 
 **Local mode** is always available. The PWA is served at `http://localhost:<port>` and works without pairing or internet. The daemon binds to `127.0.0.1` by default.
 
-**LAN mode** is enabled during `palmier init`. The daemon binds to `0.0.0.0` instead, making the PWA and API endpoints accessible from the local network at `http://<host-ip>:<port>`. Devices must pair via OTP to access. Push notifications are not available.
+**LAN mode** can be enabled during `palmier init`. The daemon binds to `0.0.0.0` instead, making the PWA and API endpoints accessible from the local network at `http://<host-ip>:<port>`. Devices must pair via OTP to access. Push notifications are not available.
 
 **Server mode** relays communication through the Palmier cloud server (via [NATS](https://nats.io), a lightweight messaging system). All features including push notifications are available. The PWA is served over HTTPS. Server mode and LAN mode can be active at the same time.
 

package/dist/agents/codex.js

@@ -12,8 +12,7 @@ export class CodexAgent {
     getTaskRunCommandLine(task, followupPrompt, extraPermissions) {
         const yolo = extraPermissions === "yolo";
         const prompt = followupPrompt ?? (getAgentInstructions(task.frontmatter.id, yolo || !this.supportsPermissions) + "\n\n" + (task.body || task.frontmatter.user_prompt));
-        // Using danger-full-access until workspace-write is fixed: https://github.com/openai/codex/issues/12572
-        const args = ["exec", "--skip-git-repo-check", "--sandbox", "danger-full-access"];
+        const args = ["exec", "--skip-git-repo-check", "--sandbox", yolo ? "danger-full-access" : "workspace-write"];
         if (!yolo) {
             const allPerms = [...(task.frontmatter.permissions ?? []), ...(extraPermissions ?? [])];
             for (const p of allPerms) {

package/dist/commands/run.d.ts

@@ -7,10 +7,6 @@ export declare function stripPalmierMarkers(output: string): string;
  * Execute a task by ID.
  */
 export declare function runCommand(taskId: string): Promise<void>;
-/**
- * Extract report file names from agent output.
- * Looks for lines matching: [PALMIER_REPORT] <filename>
- */
 export declare function parseReportFiles(output: string): string[];
 /**
  * Extract required permissions from agent output.

package/dist/commands/run.js

@@ -70,6 +70,14 @@ async function invokeAgentWithRetries(ctx, invokeTask) {
         }
         writer.end(reportFiles.length > 0 ? reportFiles : undefined);
         await publishHostEvent(ctx.nc, ctx.config.hostId, ctx.taskId, { event_type: "result-updated", run_id: ctx.runId });
+        if (reportFiles.length > 0) {
+            await publishHostEvent(ctx.nc, ctx.config.hostId, ctx.taskId, {
+                event_type: "report-generated",
+                run_id: ctx.runId,
+                name: ctx.task.frontmatter.name,
+                report_files: reportFiles,
+            });
+        }
         // Permission handling — agent requested permissions
         if (requiredPermissions.length > 0) {
             const response = await requestPermission(ctx.config, ctx.task, ctx.taskDir, requiredPermissions);
@@ -408,6 +416,7 @@ async function requestConfirmation(config, task, taskDir) {
  * Extract report file names from agent output.
  * Looks for lines matching: [PALMIER_REPORT] <filename>
  */
+const ALLOWED_REPORT_EXT = [".md", ".txt", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp"];
 export function parseReportFiles(output) {
     const regex = new RegExp(`^\\${TASK_REPORT_PREFIX}\\s+(.+)$`, "gm");
     const files = [];
@@ -415,8 +424,12 @@ export function parseReportFiles(output) {
     while ((match = regex.exec(output)) !== null) {
         const name = match[1].trim();
         // Skip placeholder examples echoed from the prompt (e.g. "<filename>")
-        if (name && !name.startsWith("<"))
-            files.push(name);
+        if (!name || name.startsWith("<"))
+            continue;
+        const ext = name.lastIndexOf(".") >= 0 ? name.slice(name.lastIndexOf(".")).toLowerCase() : "";
+        if (!ALLOWED_REPORT_EXT.includes(ext))
+            continue;
+        files.push(name);
     }
     return files;
 }

package/dist/rpc-handler.js

@@ -154,6 +154,17 @@ export function createRpcHandler(config, nc) {
                     host_platform: process.platform,
                 };
             }
+            case "task.get": {
+                const params = request.params;
+                const taskDir = getTaskDir(config.projectRoot, params.id);
+                try {
+                    const task = parseTaskFile(taskDir);
+                    return flattenTask(task);
+                }
+                catch {
+                    return { error: "Task not found" };
+                }
+            }
             case "task.create": {
                 const params = request.params;
                 // Only generate a plan for longer prompts that benefit from it
@@ -497,11 +508,14 @@ export function createRpcHandler(config, nc) {
                 if (!params.run_id || !Array.isArray(params.report_files) || params.report_files.length === 0) {
                     return { error: "run_id and report_files are required" };
                 }
+                const ALLOWED_EXT = [".md", ".txt", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp"];
+                const IMAGE_EXT = [".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp"];
                 const reports = [];
                 const runDir = path.join(config.projectRoot, "tasks", params.id, params.run_id);
                 for (const file of params.report_files) {
-                    if (!file.endsWith(".md") && !file.endsWith(".txt")) {
-                        reports.push({ file, error: "must end with .md or .txt" });
+                    const ext = path.extname(file).toLowerCase();
+                    if (!ALLOWED_EXT.includes(ext)) {
+                        reports.push({ file, error: `unsupported file type: ${ext}` });
                         continue;
                     }
                     const basename = path.basename(file);
@@ -511,8 +525,15 @@ export function createRpcHandler(config, nc) {
                     }
                     const reportPath = path.join(runDir, basename);
                     try {
-                        const content = fs.readFileSync(reportPath, "utf-8");
-                        reports.push({ file, content });
+                        if (IMAGE_EXT.includes(ext)) {
+                            const buf = fs.readFileSync(reportPath);
+                            const mime = ext === ".svg" ? "image/svg+xml" : `image/${ext.slice(1).replace("jpg", "jpeg")}`;
+                            reports.push({ file, data_url: `data:${mime};base64,${buf.toString("base64")}` });
+                        }
+                        else {
+                            const content = fs.readFileSync(reportPath, "utf-8");
+                            reports.push({ file, content });
+                        }
                     }
                     catch {
                         reports.push({ file, error: "Report file not found" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palmier",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Palmier host CLI - provisions, executes tasks, and serves NATS RPC",
   "license": "Apache-2.0",
   "author": "Hongxu Cai",

package/src/agents/codex.ts

@@ -16,8 +16,7 @@ export class CodexAgent implements AgentTool {
   getTaskRunCommandLine(task: ParsedTask, followupPrompt?: string, extraPermissions?: RequiredPermission[] | "yolo"): CommandLine {
     const yolo = extraPermissions === "yolo";
     const prompt = followupPrompt ?? (getAgentInstructions(task.frontmatter.id, yolo || !this.supportsPermissions) + "\n\n" + (task.body || task.frontmatter.user_prompt));
-    // Using danger-full-access until workspace-write is fixed: https://github.com/openai/codex/issues/12572
-    const args = ["exec", "--skip-git-repo-check", "--sandbox", "danger-full-access"];
+    const args = ["exec", "--skip-git-repo-check", "--sandbox", yolo ? "danger-full-access" : "workspace-write"];
 
     if (!yolo) {
       const allPerms = [...(task.frontmatter.permissions ?? []), ...(extraPermissions ?? [])];

package/src/commands/run.ts

@@ -106,6 +106,15 @@ async function invokeAgentWithRetries(
     writer.end(reportFiles.length > 0 ? reportFiles : undefined);
     await publishHostEvent(ctx.nc, ctx.config.hostId, ctx.taskId, { event_type: "result-updated", run_id: ctx.runId });
 
+    if (reportFiles.length > 0) {
+      await publishHostEvent(ctx.nc, ctx.config.hostId, ctx.taskId, {
+        event_type: "report-generated",
+        run_id: ctx.runId,
+        name: ctx.task.frontmatter.name,
+        report_files: reportFiles,
+      });
+    }
+
     // Permission handling — agent requested permissions
     if (requiredPermissions.length > 0) {
       const response = await requestPermission(ctx.config, ctx.task, ctx.taskDir, requiredPermissions);
@@ -499,6 +508,8 @@ async function requestConfirmation(
  * Extract report file names from agent output.
  * Looks for lines matching: [PALMIER_REPORT] <filename>
  */
+const ALLOWED_REPORT_EXT = [".md", ".txt", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp"];
+
 export function parseReportFiles(output: string): string[] {
   const regex = new RegExp(`^\\${TASK_REPORT_PREFIX}\\s+(.+)$`, "gm");
   const files: string[] = [];
@@ -506,7 +517,10 @@ export function parseReportFiles(output: string): string[] {
   while ((match = regex.exec(output)) !== null) {
     const name = match[1].trim();
     // Skip placeholder examples echoed from the prompt (e.g. "<filename>")
-    if (name && !name.startsWith("<")) files.push(name);
+    if (!name || name.startsWith("<")) continue;
+    const ext = name.lastIndexOf(".") >= 0 ? name.slice(name.lastIndexOf(".")).toLowerCase() : "";
+    if (!ALLOWED_REPORT_EXT.includes(ext)) continue;
+    files.push(name);
   }
   return files;
 }

package/src/rpc-handler.ts

@@ -182,6 +182,17 @@ export function createRpcHandler(config: HostConfig, nc?: NatsConnection) {
         };
       }
 
+      case "task.get": {
+        const params = request.params as { id: string };
+        const taskDir = getTaskDir(config.projectRoot, params.id);
+        try {
+          const task = parseTaskFile(taskDir);
+          return flattenTask(task);
+        } catch {
+          return { error: "Task not found" };
+        }
+      }
+
       case "task.create": {
         const params = request.params as {
           user_prompt: string;
@@ -577,11 +588,14 @@ export function createRpcHandler(config: HostConfig, nc?: NatsConnection) {
         if (!params.run_id || !Array.isArray(params.report_files) || params.report_files.length === 0) {
           return { error: "run_id and report_files are required" };
         }
-        const reports: Array<{ file: string; content?: string; error?: string }> = [];
+        const ALLOWED_EXT = [".md", ".txt", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp"];
+        const IMAGE_EXT = [".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp"];
+        const reports: Array<{ file: string; content?: string; data_url?: string; error?: string }> = [];
         const runDir = path.join(config.projectRoot, "tasks", params.id, params.run_id);
         for (const file of params.report_files) {
-          if (!file.endsWith(".md") && !file.endsWith(".txt")) {
-            reports.push({ file, error: "must end with .md or .txt" });
+          const ext = path.extname(file).toLowerCase();
+          if (!ALLOWED_EXT.includes(ext)) {
+            reports.push({ file, error: `unsupported file type: ${ext}` });
             continue;
           }
           const basename = path.basename(file);
@@ -591,8 +605,14 @@ export function createRpcHandler(config: HostConfig, nc?: NatsConnection) {
           }
           const reportPath = path.join(runDir, basename);
           try {
-            const content = fs.readFileSync(reportPath, "utf-8");
-            reports.push({ file, content });
+            if (IMAGE_EXT.includes(ext)) {
+              const buf = fs.readFileSync(reportPath);
+              const mime = ext === ".svg" ? "image/svg+xml" : `image/${ext.slice(1).replace("jpg", "jpeg")}`;
+              reports.push({ file, data_url: `data:${mime};base64,${buf.toString("base64")}` });
+            } else {
+              const content = fs.readFileSync(reportPath, "utf-8");
+              reports.push({ file, content });
+            }
           } catch {
             reports.push({ file, error: "Report file not found" });
           }