adom-vscode

@@ -20,7 +20,7 @@ Installed in every Adom container. Open the Extensions sidebar and search for `a - **Reveal** files/folders in the Explorer sidebar - **Preview** Markdown files in rendered view - **Settings, live**: get/set any VS Code setting, theme, fonts, font sizes. Changes apply immediately via the native VS Code API (no reload, active AI sessions survive)-- **Exec**: run shell commands in the container as the workspace user, streamed (SSE) or buffered, no host-side `wsl.exe` needed+- **Exec** (HD-local only): run shell commands in the container as the workspace user, streamed (SSE) or buffered, no host-side `wsl.exe` needed. Disabled on cloud (hw) containers by security policy - **Event queue**: any container process pushes events; the HD/HW frontend pulls them when it wants (login-refresh needed, long-job progress, anything) - **Container identity**: query whether this is an `hd` (local Hydrogen Desktop) or `hw` (Adom cloud) container, OS, kernel, key env vars - **API key**: check the health of `/var/run/adom/api-key` and inject a fresh key after a frontend login refresh@@ -72,8 +72,8 @@ Everything the CLI does is a plain HTTP call, so HD, HW, and any script can hit | theme.set | `POST /theme` `{theme}` | Switch color theme live | | fonts.get | `GET /fonts` | All font settings (editor, terminal, chat prose `chat.fontFamily`, chat code `chat.editor.fontFamily`) plus the RESOLVED families the renderer actually shows (via `document.fonts.check`) | | fonts.set | `POST /fonts` `{editorFamily?, proseFamily?, proseCodeFamily?, editorSize?, terminalSize?, proseSize?, proseCodeSize?}` | Set any subset live |-| exec | `POST /exec` `{command, cwd?, timeoutSec?}` | Buffered: run `bash -lc` as the workspace user, return `{exitCode, stdout, stderr, timedOut}` |-| exec.stream | `POST /exec/stream` `{command, cwd?, timeoutSec?}` | Streaming: SSE events `start`, `stdout`, `stderr`, `exit {exitCode, timedOut}` |+| exec | `POST /exec` `{command, cwd?, timeoutSec?}` | Buffered: run `bash -lc` as the workspace user, return `{exitCode, stdout, stderr, timedOut}`. HD-local only; cloud (hw) refuses with `exec_disabled_on_cloud` |+| exec.stream | `POST /exec/stream` `{command, cwd?, timeoutSec?}` | Streaming: SSE events `start`, `stdout`, `stderr`, `exit {exitCode, timedOut}`. HD-local only, same policy | | queue.push | `POST /queue/push` `{topic?, type?, payload?, ttlSec?}` | Push an event for the frontend; returns `{id, depth}` | | queue.pull | `GET/POST /queue/pull` `{topic?, max?, peek?}` | Pull (consume) events; `peek` reads without consuming | | queue.status | `GET /queue/status` | Depth + per-topic counts |@@ -222,3 +222,5 @@ One version number everywhere: the `VERSION` file, the extension, the CLI `--ver v1.1.10 added: live config/theme/font verbs, streamed exec, the frontend event queue, container identity (hd/hw), api-key status/inject, extension query/update (incl. Claude/Codex/Kimi), port fallback + `port.json` discovery, and verb-roster feature detection on `/health`.  v1.1.11 added: the skill pack (parent + 6 sub-skills) installed by both the wiki package and `adom-vscode install`.++v1.1.12: exec verbs are HD-local only (disabled on cloud hw containers with errorCode exec_disabled_on_cloud); /health reports execAllowed and omits exec verbs where disabled.

⋯ 1 unchanged line ⋯

@@ -1,6 +1,6 @@ {   "slug": "adom-vscode",-  "version": "1.1.11",+  "version": "1.1.12",   "type": "app",   "description": "CLI + VS Code extension that lets AI assistants and the Hydrogen Desktop frontend drive VS Code from inside an Adom container: open files, live get/set of any setting/theme/font (no reload), native streamed exec, a frontend event queue, container identity (hd/hw), api-key status/inject, extension query/update, modes, paste screenshots, and any VS Code command via a local HTTP API on port 8821 (with port-file fallback discovery).",   "license": "PROPRIETARY",

@@ -4,7 +4,7 @@   "slug": "adom-vscode",   "title": "adom-vscode",   "brief": "Drive VS Code from your AI: a CLI + extension that lets Claude Code, Codex, Kimi, and the Hydrogen Desktop frontend open files, change settings/theme/fonts LIVE (no reload), run streamed container commands, pass events on a frontend queue, check container identity and the Adom api key, query/update extensions, and run any VS Code command via a local HTTP API. Pre-installed in every Adom container.",-  "version": "1.1.11",+  "version": "1.1.12",   "license": "PROPRIETARY",   "visibility": "public",   "hero": {@@ -13,13 +13,17 @@     "thumbnail": "screenshots/hero.png"   },   "tags": [+    "automation",+    "claude",     "cli",-    "vscode",     "code-server",+    "docker",+    "exec",+    "hydrogen-desktop",     "ide",-    "claude",-    "automation",-    "docker"+    "queue",+    "settings",+    "vscode"   ],   "discovery_triggers": [     "adom-vscode",@@ -114,11 +118,21 @@     "install.sh",     "uninstall.sh",     "bin/**",-    "screenshots/**"+    "screenshots/**",+    "skills/**"   ],   "org": "adom",   "author": {     "name": "John Lauer",     "email": "[email protected]"-  }+  },+  "confirmed_user_skills": [+    "adom-vscode",+    "adom-vscode-settings",+    "adom-vscode-exec",+    "adom-vscode-queue",+    "adom-vscode-container",+    "adom-vscode-extensions",+    "adom-vscode-modes"+  ] }\ No newline at end of file

@@ -22,7 +22,7 @@ Returns `kind` plus the raw evidence so callers can gate precisely:  Also included: `hostname`, `os` (from /etc/os-release), `kernel`, `arch`, `workspaceUser`, and `env.carbonUrl` (`ADOM_CARBON_URL`), `env.hydrogenUrl`,-`env.vscodeProxyUri`, plus the `markers` object itself. HTTP: `GET /container`.+`env.vscodeProxyUri`, plus the `markers` object itself and `execAllowed` (whether the exec verbs are enabled here; they are HD-local only). HTTP: `GET /container`.  ## API key (/var/run/adom/api-key) @@ -67,5 +67,7 @@ adom-vscode health  `GET /health` returns `{version, port, preferredPort, portFile, verbs: [...]}`. Gate on the `verbs` array (e.g. `exec.stream`, `queue.push`, `apikey.set`), not-on version strings. An extension that answers /health without a `verbs` field+on version strings. Note: `exec` / `exec.stream` only appear on HD-local+containers; on cloud (hw) containers they are disabled by security policy and+absent from the roster (`execAllowed: false`). An extension that answers /health without a `verbs` field predates 1.1.10 and needs a window reload or update.

@@ -1,12 +1,23 @@ --- name: adom-vscode-exec-description: "Run shell commands inside the Adom container through the adom-vscode extension, streamed live (SSE) or buffered, as the workspace user via a login shell. THE native replacement for routing container commands through host-side wsl.exe (which wedges, serializes behind a global lock, and flakes with E_UNEXPECTED). Trigger words: exec in container, run command in container, adom-vscode exec, stream exec, streamed output, exec stream, container shell, run npm test in container, long running command, exec timeout, exec cwd, no wsl.exe, wsl exec replacement, POST /exec, SSE exec."+description: "Run shell commands inside the Adom container through the adom-vscode extension, streamed live (SSE) or buffered, as the workspace user via a login shell. HD-LOCAL ONLY: cloud (hw) containers refuse exec (exec_disabled_on_cloud), check /health verbs first. THE native replacement for routing container commands through host-side wsl.exe (which wedges, serializes behind a global lock, and flakes with E_UNEXPECTED). Trigger words: exec disabled, exec_disabled_on_cloud, exec in container, run command in container, adom-vscode exec, stream exec, streamed output, exec stream, container shell, run npm test in container, long running command, exec timeout, exec cwd, no wsl.exe, wsl exec replacement, POST /exec, SSE exec." ---  Parent skill: **adom-vscode**  # adom-vscode-exec, run container commands natively +> **HD-LOCAL ONLY (security policy).** exec runs only on local Hydrogen Desktop+> workspaces (`container` reports `kind: hd`). Cloud (hw) containers refuse both+> exec verbs with `errorCode: exec_disabled_on_cloud` (HTTP 403), and /health+> omits `exec` / `exec.stream` from its verb roster there, so feature-detect+> before offering exec. Rationale: adom-vscode is a core install for every Adom+> user, and an arbitrary-shell verb on an internet-facing cloud container is an+> unnecessary exposure; HD workspaces sit behind the user's own firewall. On a+> cloud container, run commands in your own terminal/session instead. Debug+> escape hatch: `ADOM_VSCODE_ALLOW_EXEC=1` set in the EXTENSION HOST env by the+> platform (a remote caller cannot set it).+ Commands run as the workspace user (`adom`) via `bash -lc` inside the container, spawned by the extension host itself. LOGIN shell matters: tools like adom-desktop need the workspace env from `/etc/profile.d/`, and a bare `-c`