nntrivi2001
0f17efe3b4
- Skill snapshot/upload: a key file's name (.env, *.pem, id_rsa, .netrc, .credentials.json…) is always refused, but a word like token/secret/ password/credential only in a data file's name — design-tokens.md or count_tokens.py is skill content, not a key. - System Health: off Linux the History, CPU threads and Busiest processes cards (all read from /proc) are left out instead of shown empty; the CPU bar without a sample and Windows' always-zero Load row go too. - Users pick their own pool account per tool (/api/me/pool-accounts, Settings → AI tools), within their groups, refused while pinned. - Admin user detail, 9router update, session replay and Antigravity catalog changes from parallel sessions.
2.3 KiB
AI Tools catalog
One JSON file per AI coding CLI AgentHub can run in a lane. Loaded by
server/lib/ai-tools.js; the fields are described in
docs/superpowers/specs/2026-09-28-ai-tools-a1-design.md § 1. A file in
DASHBOARD_AI_TOOLS_DIR with the same id replaces the built-in one (it may
not set launcher).
Resume by id
resumeById (string array, e.g. ["--resume"]): the flag(s) a NAMED session's
id follows, as one more argv element — pty-run.js emits them in place of
resume when a start carries resumeSessionId, and only for an id that starts
with a letter or digit. A tool without it (and without a launcher) refuses a
resume by id (EUNSUPPORTED) rather than start fresh under a "resume".
Built-in: omp and Cursor (--resume), Antigravity (--conversation: an agy session's id is its conversation id). omp always gets --allow-home: started in its account's home (a workspace there) it would otherwise move to a temp dir, and its session would name that folder, not the workspace's. A session id may carry _.
Install / update (A2)
Two optional fields, honoured only in built-in files and in the copy of the
newest release's catalog that server/lib/ai-tools-sync.js keeps in
<data dir>/runtime/ai-tools-remote/ — a file in DASHBOARD_AI_TOOLS_DIR
carrying either is rejected, because an Install click would run what it names:
install:{ "kind": "npm", "package": "<npm name>" }(runsnpm install -g <package>@latestwith the login shell's npm) or{ "kind": "script", "url": "https://…" }(https, same site — last two host labels — ashomepageUrl; downloaded by the server, run asbash <file>).update:{ "kind": "npm" }or{ "kind": "script" }(reuseinstall), or{ "kind": "self", "args": ["update"] }(the tool's own updater).
Before adding an npm package, check its owner (npm view <pkg> maintainers repository.url) and that its bin matches detect: a squatted name would
install a stranger's code on every machine that clicks Install.
Attribution
The commands, prompt modes, permission-bypass flags and homepages of the tools
other than Claude Code, Codex and Antigravity come from Orca
(https://github.com/stablyai/orca, MIT License, Copyright (c) Stably AI):
src/renderer/src/lib/agent-catalog.tsx, src/shared/tui-agent-config.ts and
src/shared/tui-agent-permissions.ts.