shadow-claw 1.24.0 → 1.24.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (67) hide show
  1. package/dist/public/AGENTS.md +7 -0
  2. package/dist/public/agent.worker.js +49 -49
  3. package/dist/public/backup-controller-CvzDOq4T.js +1 -0
  4. package/dist/public/{configurePeerJs-CxpZeDJJ.js → configurePeerJs-UfQ6HUlv.js} +1 -1
  5. package/dist/public/docs/example/article/index.html +1 -1
  6. package/dist/public/docs/publishing/index.html +1 -1
  7. package/dist/public/docs/skill-creator/index.html +1 -1
  8. package/dist/public/docs/subsystems/control-plane.md +11 -0
  9. package/dist/public/{downloadGroupFile-By0GR6eV.js → downloadGroupFile-9niHBj9n.js} +1 -1
  10. package/dist/public/{e2e-bridge-IGWsRl4i.js → e2e-bridge-D28tOggc.js} +1 -1
  11. package/dist/public/{file-viewer-D0eflgt6.js → file-viewer-BVg3B_JH.js} +1 -1
  12. package/dist/public/index.html +1 -1
  13. package/dist/public/index.js +1 -1
  14. package/dist/public/initControlPlane-DKNht5ph.js +1 -0
  15. package/dist/public/main/index.html +1 -1
  16. package/dist/public/main/memory/index.html +1 -1
  17. package/dist/public/{markdown-BnpKxSxl.js → markdown-SiFq0PTy.js} +1 -1
  18. package/dist/public/{orchestrator-nJj59RqD.js → orchestrator-8w9-exfN.js} +1 -1
  19. package/dist/public/{orchestrator-3h9xxHUm.js → orchestrator-tHWrqi_F.js} +5 -5
  20. package/dist/public/{peerjs-BP4laMXj.js → peerjs-D8hck8Ih.js} +1 -1
  21. package/dist/public/push-client-D0lkwrK0.js +1 -0
  22. package/dist/public/service-worker/fetch-proxy.js +1 -1
  23. package/dist/public/service-worker.js +1 -1
  24. package/dist/public/{shadow-claw-CbwETBWf.js → shadow-claw-Cs8wbk3d.js} +2 -2
  25. package/dist/public/{shadow-claw-channels-BDWG5Qa3.js → shadow-claw-channels-mY-JMvib.js} +1 -1
  26. package/dist/public/{shadow-claw-chat-Crv0DTCY.js → shadow-claw-chat-DGPKpmU5.js} +1 -1
  27. package/dist/public/{shadow-claw-control-plane-CX1IGbh9.js → shadow-claw-control-plane-B1F0jnPk.js} +2 -2
  28. package/dist/public/{shadow-claw-conversations-_9qAaRXk.js → shadow-claw-conversations-0Q-VC_7N.js} +1 -1
  29. package/dist/public/{shadow-claw-file-viewer-Blf6yGVD.js → shadow-claw-file-viewer-AZfG4D-u.js} +1 -1
  30. package/dist/public/{shadow-claw-files-CYySBDCl.js → shadow-claw-files-Bx4v0Ggp.js} +1 -1
  31. package/dist/public/{shadow-claw-git-v8S0JjuR.js → shadow-claw-git-DD7iQRxq.js} +2 -2
  32. package/dist/public/{shadow-claw-llm-GWgoVfhI.js → shadow-claw-llm-CfeDBZKB.js} +1 -1
  33. package/dist/public/{shadow-claw-networking-qHbP95z9.js → shadow-claw-networking-e0EarDVs.js} +1 -1
  34. package/dist/public/{shadow-claw-notifications-YyHOK2Fr.js → shadow-claw-notifications-BkxuDEQI.js} +3 -3
  35. package/dist/public/{shadow-claw-pages-DFZHhzFZ.js → shadow-claw-pages-BWSE91I1.js} +1 -1
  36. package/dist/public/{shadow-claw-settings-DhxrKIfA.js → shadow-claw-settings-D6lPBn6m.js} +2 -2
  37. package/dist/public/{shadow-claw-storage-BFynbP0j.js → shadow-claw-storage-Crs6LY15.js} +1 -1
  38. package/dist/public/{shadow-claw-task-server-3BIeb5oZ.js → shadow-claw-task-server-CKm_Ennl.js} +1 -1
  39. package/dist/public/{shadow-claw-tasks-Caxc9atL.js → shadow-claw-tasks-Czx6Ucf5.js} +1 -1
  40. package/dist/public/{shadow-claw-terminal-Beb5qF-U.js → shadow-claw-terminal-Dmtr9KY1.js} +1 -1
  41. package/dist/public/{shadow-claw-tools-BfJx3A9W.js → shadow-claw-tools-t3Qq4TDO.js} +1 -1
  42. package/dist/public/{shadow-claw-webvm-BCS8ykeP.js → shadow-claw-webvm-CIuSywD_.js} +1 -1
  43. package/dist/public/{syncWebMcpRegistration-B_M2fCjH.js → syncWebMcpRegistration-DzC80wVG.js} +1 -1
  44. package/dist/server.js +3 -3
  45. package/package.json +1 -1
  46. package/src/components/settings/shadow-claw-notifications/shadow-claw-notifications.test.ts +3 -0
  47. package/src/components/settings/shadow-claw-notifications/shadow-claw-notifications.ts +43 -9
  48. package/src/core/backup-controller.ts +33 -4
  49. package/src/core/control-plane-client.test.ts +9 -2
  50. package/src/core/control-plane-client.ts +18 -2
  51. package/src/core/orchestrator/utils/operations/task.ts +46 -15
  52. package/src/server/app.ts +2 -0
  53. package/src/server/control-plane.test.ts +36 -0
  54. package/src/server/control-plane.ts +39 -13
  55. package/src/server/middleware/pna.test.ts +15 -3
  56. package/src/server/middleware/pna.ts +6 -2
  57. package/src/server/routes/backup.test.ts +14 -0
  58. package/src/server/routes/backup.ts +44 -15
  59. package/src/server/server.ts +2 -0
  60. package/src/service-worker/fetch-proxy-rules.test.ts +41 -0
  61. package/src/service-worker/fetch-proxy-rules.ts +15 -8
  62. package/src/service-worker/fetch-proxy.ts +18 -2
  63. package/src/subsystems/notifications/push-client.test.ts +5 -1
  64. package/src/subsystems/notifications/push-client.ts +50 -12
  65. package/dist/public/backup-controller-C_s9in2t.js +0 -1
  66. package/dist/public/initControlPlane-C9jpnWev.js +0 -1
  67. package/dist/public/push-client-CrjEXK3U.js +0 -1
package/dist/public/AGENTS.md CHANGED
@@ -106,6 +106,13 @@ To prevent infinite execution loops, the system enforces a strict recursion guar
106
106
  - Do not call `executeTool` from provider loops without passing the active enabled tool list (`allowedTools`). Runtime allowlist checks are enforced in `executeTool` and are required even when schemas already constrain generation.
107
107
  - Conversation-level `pinnedMaxTokens` overrides are optional and must remain model-aware (clamped to provider/model output limits).
108
108
 
109
+ ### Private Network Access & Loopback Connections
110
+
111
+ - **Service Worker Loopback Bypass:** The Service Worker fetch proxy (`src/service-worker/fetch-proxy-rules.ts`) unconditionally bypasses all loopback (`localhost`, `127.0.0.1`, `::1`, `[::1]`) and private IP ranges (`10.x`, `172.16-31.x`, `192.168.x`) so browser tabs hosted on static platforms (such as GitHub Pages or Cloudflare Pages) can connect directly to local servers without Service Worker interception.
112
+ - **Client `targetAddressSpace` Signaling:** Outgoing client fetch requests targeting local or private network endpoints (`control-plane-client.ts`, `backup-controller.ts`, `push-client.ts`, `task.ts`, and `fetch-proxy.ts`) must supply `targetAddressSpace: 'loopback'` (or `'private'`) for Chromium Private Network Access (PNA) compliance.
113
+ - **Server PNA & Cross-Origin Headers:** Server endpoints set `Access-Control-Allow-Private-Network: true` on both preflight (`OPTIONS`) and cross-origin responses, and trust `.github.io` / `.pages.dev` / `allowedOrigins` origins for browser integration.
114
+
115
+
109
116
  ### HTML Sanitization & Trusted Types
110
117
 
111
118
  - **Explicit Pre-Sanitization:** All dynamically rendered HTML, inline SVGs, or iframe `srcdoc` values must be sanitized using DOMPurify (e.g., `sanitizeToTrustedHtml` or `sanitizeSrcdocHtml`) **before** being passed to the Trusted Types policy.