ponzu 1.70.0 → 1.71.0

package/README.md

@@ -34,7 +34,7 @@ This clones the repo into `~/Ponzu/north-brook/ponzu` (or reuses the clone there
 
 Or [download the Mac app](https://ponzu.design/download) (Apple silicon, signed and notarized; it updates itself). Windows (x64) and Linux (x64, an AppImage or a `.deb`) builds are in beta, on the [releases page](https://github.com/north-brook/ponzu/releases/latest); they update themselves too, and the Windows one isn't signed yet, so SmartScreen asks before its first launch. It opens `.design` folders like documents, and on first launch it sets up Claude Code, Codex and Cursor for you. There's nothing else to install or keep running.
 
-Its home screen's **Suggested** tab proposes designs for the projects your agents worked in lately. When you open it (at most every ten minutes, and only to top it up to eight), Ponzu runs your own Claude Code (or Codex, without Claude Code) headless and read-only, on your agent's account, in two steps: a glance at each project's file list and readme, with no tools, names a few designs, then one run for each reads the code it starts from and writes its prompt. Claude Code gets only Read, Glob and Grep, Codex its read-only sandbox, and neither gets any MCP servers. You copy the prompt you like into your agent. The ideas are kept in `~/.ponzu/suggestions.json`.
+Its home screen's **Suggested** tab proposes designs for the projects your agents worked in lately. When you open it (at most every ten minutes, and only to top it up to eight), Ponzu runs your own Claude Code (or Codex, without Claude Code) headless and read-only, on your agent's account, in two steps: a glance at each project's file list and readme, with no tools, names a few designs, then one run for each reads the code it starts from and writes its prompt. Claude Code gets only Read, Glob and Grep, Codex its read-only sandbox, and neither gets any MCP servers. You copy the prompt you like into your agent. The ideas are kept in `~/.ponzu/suggestions.json`. Your other Macs' Ponzu show theirs too, for their own projects, over your tailnet, and opening the tab asks each to look again.
 
 The app also puts `ponzu` in your terminal, running from inside the app so it updates with it. It links the command into a folder your shell already searches that you can write to (`~/.local/bin`, `~/bin` or `/usr/local/bin`), never over another `ponzu`. If there's no such folder, choose **Ponzu › Install Terminal Command…**, which asks for your password to add it to `/usr/local/bin`.
 

package/dist/index.js

@@ -47009,7 +47009,7 @@ function serve(ws, opts = {}) {
       return Response.json({ ok: true });
     }
     if (path === "/api/suggestions" || path === "/api/suggestions/refresh") {
-      if (caller !== "local" || !sameHostOk(req, url))
+      if (caller === "local" && !sameHostOk(req, url))
         return new Response("Forbidden", { status: 403 });
       const refresh = path === "/api/suggestions/refresh";
       if (refresh && req.method !== "POST")
@@ -47449,7 +47449,7 @@ function serve(ws, opts = {}) {
 function peerAllowed(req, pathname) {
   if (isPage(req))
     return false;
-  if (pathname === "/api/shelf" || pathname === "/api/update/install")
+  if (pathname === "/api/shelf" || pathname === "/api/update/install" || pathname === "/api/suggestions/refresh")
     return req.method === "POST";
   if (req.method !== "GET")
     return false;
@@ -47461,6 +47461,7 @@ function peerAllowed(req, pathname) {
     "/api/thumb",
     "/api/info",
     "/api/macs",
+    "/api/suggestions",
     "/ws"
   ].includes(pathname) || /^\/files\/[^/]+\/assets\/.+$/.test(pathname);
 }
@@ -47487,13 +47488,13 @@ function isPage(req) {
 }
 var SHELF_ACTIONS = ["archive", "restore", "scratch", "recent"];
 async function relay(req, target) {
-  const shelf = req.method === "POST" && new URL(target).pathname === "/api/shelf";
-  if (req.method !== "GET" && !shelf)
+  const post = req.method === "POST" && ["/api/shelf", "/api/suggestions/refresh"].includes(new URL(target).pathname);
+  if (req.method !== "GET" && !post)
     return new Response("Method not allowed", { status: 405 });
   try {
     const res = await fetch(target, {
-      signal: AbortSignal.timeout(shelf ? 5000 : 30000),
-      ...shelf ? {
+      signal: AbortSignal.timeout(post ? 5000 : 30000),
+      ...post ? {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: await req.text()
@@ -47638,7 +47639,7 @@ function remoteUpdater(endpoint, token) {
 // apps/cli/package.json
 var package_default = {
   name: "ponzu",
-  version: "1.70.0",
+  version: "1.71.0",
   description: "The open source canvas your agent draws on in HTML and CSS.",
   type: "module",
   license: "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ponzu",
-  "version": "1.70.0",
+  "version": "1.71.0",
   "description": "The open source canvas your agent draws on in HTML and CSS.",
   "license": "MIT",
   "type": "module",