@chrysb/alphaclaw 0.3.5-beta.0 → 0.3.5-beta.1

package/lib/server/routes/browse/path-utils.js

@@ -0,0 +1,53 @@
+const path = require("path");
+
+const normalizeRelativePath = (inputPath) => {
+  const rawPath = String(inputPath || "").trim();
+  if (!rawPath) return "";
+  return rawPath.replace(/\\/g, "/").replace(/^\/+/, "");
+};
+
+const normalizePolicyPath = (inputPath) =>
+  String(inputPath || "")
+    .replace(/\\/g, "/")
+    .replace(/^\.\/+/, "")
+    .replace(/^\/+/, "")
+    .trim()
+    .toLowerCase();
+
+const resolveSafePath = (inputPath, kRootResolved, kRootWithSep, kRootDisplayName) => {
+  const relativePath = normalizeRelativePath(inputPath);
+  const absolutePath = path.resolve(kRootResolved, relativePath);
+  const isInsideRoot =
+    absolutePath === kRootResolved || absolutePath.startsWith(kRootWithSep);
+  if (!isInsideRoot) {
+    return { ok: false, error: `Path must stay within ${kRootDisplayName}` };
+  }
+  return { ok: true, relativePath, absolutePath };
+};
+
+const toRelativePath = (absolutePath, kRootResolved) => {
+  const relative = path.relative(kRootResolved, absolutePath);
+  return relative === "" ? "" : relative.split(path.sep).join("/");
+};
+
+const matchesPolicyPath = (policyPathSet, normalizedPath) => {
+  const safeNormalizedPath = String(normalizedPath || "").trim();
+  if (!safeNormalizedPath) return false;
+  for (const policyPath of policyPathSet) {
+    if (
+      safeNormalizedPath === policyPath ||
+      safeNormalizedPath.endsWith(`/${policyPath}`)
+    ) {
+      return true;
+    }
+  }
+  return false;
+};
+
+module.exports = {
+  normalizeRelativePath,
+  normalizePolicyPath,
+  resolveSafePath,
+  toRelativePath,
+  matchesPolicyPath,
+};

package/lib/server/routes/browse/sqlite.js

@@ -0,0 +1,140 @@
+const { kSqliteTablePageSize } = require("./constants");
+
+const quoteSqliteIdentifier = (value) =>
+  `"${String(value || "").replaceAll('"', '""')}"`;
+
+const readSqliteSummary = (targetPath) => {
+  let DatabaseSync = null;
+  try {
+    ({ DatabaseSync } = require("node:sqlite"));
+  } catch {
+    throw new Error("SQLite preview is unavailable on this Node runtime");
+  }
+  const database = new DatabaseSync(targetPath, { readOnly: true });
+  try {
+    const allObjects = database
+      .prepare(
+        `
+          SELECT name, type
+          FROM sqlite_master
+          WHERE type IN ('table', 'view')
+            AND name NOT LIKE 'sqlite_%'
+          ORDER BY type, name
+        `,
+      )
+      .all();
+    const maxObjects = 12;
+    const objects = allObjects.slice(0, maxObjects).map((entry) => {
+      const objectName = String(entry?.name || "").trim();
+      const objectType = String(entry?.type || "table").trim() || "table";
+      if (!objectName) return null;
+      const quotedName = quoteSqliteIdentifier(objectName);
+      const columns = database
+        .prepare(`PRAGMA table_info(${quotedName})`)
+        .all()
+        .map((column) => ({
+          name: String(column?.name || "").trim(),
+          type: String(column?.type || "").trim(),
+          notNull: Number(column?.notnull || 0) === 1,
+          isPrimaryKey: Number(column?.pk || 0) > 0,
+        }));
+      let sampleRows = [];
+      if (objectType === "table") {
+        try {
+          sampleRows = database.prepare(`SELECT * FROM ${quotedName} LIMIT 5`).all();
+        } catch {
+          sampleRows = [];
+        }
+      }
+      return {
+        name: objectName,
+        type: objectType,
+        columns,
+        sampleRows,
+      };
+    });
+    return {
+      totalObjects: allObjects.length,
+      truncated: allObjects.length > maxObjects,
+      objects: objects.filter(Boolean),
+    };
+  } finally {
+    database.close();
+  }
+};
+
+const clampSqlitePageValue = (value, fallbackValue, maxValue) => {
+  const parsedValue = Number.parseInt(String(value ?? ""), 10);
+  if (!Number.isFinite(parsedValue)) return fallbackValue;
+  return Math.max(0, Math.min(maxValue, parsedValue));
+};
+
+const readSqliteTableData = (targetPath, tableName, limit, offset) => {
+  const safeTableName = String(tableName || "").trim();
+  if (!safeTableName) {
+    return { ok: false, error: "table is required" };
+  }
+  let DatabaseSync = null;
+  try {
+    ({ DatabaseSync } = require("node:sqlite"));
+  } catch {
+    return { ok: false, error: "SQLite preview is unavailable on this Node runtime" };
+  }
+  const database = new DatabaseSync(targetPath, { readOnly: true });
+  try {
+    const quotedTableName = quoteSqliteIdentifier(safeTableName);
+    const tableExists = database
+      .prepare(
+        `
+          SELECT 1
+          FROM sqlite_master
+          WHERE type IN ('table', 'view')
+            AND name = ?
+          LIMIT 1
+        `,
+      )
+      .get(safeTableName);
+    if (!tableExists) {
+      return { ok: false, error: "table not found" };
+    }
+    const columns = database
+      .prepare(`PRAGMA table_info(${quotedTableName})`)
+      .all()
+      .map((column) => ({
+        name: String(column?.name || "").trim(),
+        type: String(column?.type || "").trim(),
+        notNull: Number(column?.notnull || 0) === 1,
+        isPrimaryKey: Number(column?.pk || 0) > 0,
+      }));
+    const totalRowsResult = database
+      .prepare(`SELECT COUNT(*) AS count FROM ${quotedTableName}`)
+      .get();
+    const totalRows = Number(totalRowsResult?.count || 0);
+    const safeLimit =
+      clampSqlitePageValue(limit, kSqliteTablePageSize, 200) || kSqliteTablePageSize;
+    const safeOffset = clampSqlitePageValue(offset, 0, Number.MAX_SAFE_INTEGER);
+    const rows = database
+      .prepare(`SELECT * FROM ${quotedTableName} LIMIT ? OFFSET ?`)
+      .all(safeLimit, safeOffset);
+    return {
+      ok: true,
+      table: safeTableName,
+      columns,
+      rows,
+      limit: safeLimit,
+      offset: safeOffset,
+      totalRows,
+    };
+  } catch (error) {
+    return { ok: false, error: error.message || "Could not read sqlite table" };
+  } finally {
+    database.close();
+  }
+};
+
+module.exports = {
+  quoteSqliteIdentifier,
+  readSqliteSummary,
+  clampSqlitePageValue,
+  readSqliteTableData,
+};

package/lib/server/routes/proxy.js

@@ -5,20 +5,26 @@ const registerProxyRoutes = ({
   requireAuth,
   webhookMiddleware,
 }) => {
+  const kOpenClawPathPattern = /^\/openclaw\/.+/;
+  const kAssetsPathPattern = /^\/assets\/.+/;
+  const kHooksPathPattern = /^\/hooks\/.+/;
+  const kWebhookPathPattern = /^\/webhook\/.+/;
+  const kApiPathPattern = /^\/api\/.+/;
+
   app.all("/openclaw", requireAuth, (req, res) => {
     req.url = "/";
     proxy.web(req, res);
   });
-  app.all("/openclaw/*", requireAuth, (req, res) => {
+  app.all(kOpenClawPathPattern, requireAuth, (req, res) => {
     req.url = req.url.replace(/^\/openclaw/, "");
     proxy.web(req, res);
   });
-  app.all("/assets/*", requireAuth, (req, res) => proxy.web(req, res));
+  app.all(kAssetsPathPattern, requireAuth, (req, res) => proxy.web(req, res));
 
-  app.all("/hooks/*", webhookMiddleware);
-  app.all("/webhook/*", webhookMiddleware);
+  app.all(kHooksPathPattern, webhookMiddleware);
+  app.all(kWebhookPathPattern, webhookMiddleware);
 
-  app.all("/api/*", (req, res) => {
+  app.all(kApiPathPattern, (req, res) => {
     if (SETUP_API_PREFIXES.some((p) => req.path.startsWith(p))) return;
     proxy.web(req, res);
   });

package/lib/setup/core-prompts/TOOLS.md

@@ -27,10 +27,6 @@ Google Workspace is connected via the **General** tab (`{{SETUP_UI_URL}}#general
 
 **Commit and push after every set of changes.** Your entire .openclaw directory (config, cron, workspace) is version controlled. This is how your work survives container restarts.
 
-```bash
-alphaclaw git-sync --message "description"
-```
-
 Never force push. Always pull before pushing if there might be remote changes.
 After pushing, include a link to the commit using the abbreviated hash: [abc1234](https://github.com/owner/repo/commit/abc1234) format. No backticks.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrysb/alphaclaw",
-  "version": "0.3.5-beta.0",
+  "version": "0.3.5-beta.1",
   "publishConfig": {
     "access": "public"
   },