@dominikcz/greg 0.9.41 → 0.9.44

package/src/lib/MarkdownDocs/SearchModal.svelte

@@ -146,6 +146,8 @@
     let tabMode = $state<"search" | "ai">("search");
     /** Exposed handle from AiChat — gives access to clear() and hasMessages. */
     let aiChatHandle = $state<{ clear: () => void; hasMessages: boolean } | undefined>(undefined);
+    /** Whether the AI chat panel is expanded to full screen. */
+    let aiExpanded = $state(false);
     const serverUrl: string = cfgSearch.serverUrl ?? "/api/search";
     const fuzzyCfg = cfgSearch.fuzzy ?? {};
     const localThreshold: number = Number.isFinite(Number(fuzzyCfg.threshold))
@@ -566,6 +568,7 @@
 {#if open}
     <div
         class="search-backdrop"
+        class:ai-expanded={aiExpanded}
         onclick={handleBackdropClick}
         onkeydown={handleKeydown}
         role="dialog"
@@ -573,7 +576,7 @@
         aria-label={searchModalLabel}
         tabindex="-1"
     >
-        <div class="search-modal" class:ai-mode={aiEnabled && tabMode === "ai"}>
+        <div class="search-modal" class:ai-mode={aiEnabled && tabMode === "ai"} class:ai-expanded={aiExpanded}>
 
             <!-- ── Tab switcher (only when AI is enabled) ── -->
             {#if aiEnabled}
@@ -601,6 +604,19 @@
                         {aiTabLabel}
                     </button>
                     <div class="modal-tabs-end">
+                        {#if tabMode === "ai"}
+                            <button class="ai-expand-btn" type="button" onclick={() => (aiExpanded = !aiExpanded)} title={aiExpanded ? 'Minimize' : 'Expand'} aria-label={aiExpanded ? 'Minimize chat' : 'Expand chat'}>
+                                {#if aiExpanded}
+                                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true">
+                                        <polyline points="4 14 10 14 10 20"/><polyline points="20 10 14 10 14 4"/><line x1="10" y1="14" x2="3" y2="21"/><line x1="21" y1="3" x2="14" y2="10"/>
+                                    </svg>
+                                {:else}
+                                    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true">
+                                        <polyline points="15 3 21 3 21 9"/><polyline points="9 21 3 21 3 15"/><line x1="21" y1="3" x2="14" y2="10"/><line x1="3" y1="21" x2="10" y2="14"/>
+                                    </svg>
+                                {/if}
+                            </button>
+                        {/if}
                         {#if tabMode === "ai" && aiChatHandle?.hasMessages}
                             <button class="ai-clear-btn" type="button" onclick={() => aiChatHandle?.clear()} title={aiClearChatLabel}>
                                 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true">
@@ -853,6 +869,20 @@
             max-height: calc(100vh - 5rem);
             min-height: min(540px, calc(100vh - 5rem));
         }
+
+        &.ai-expanded {
+            max-width: 100%;
+            width: 100%;
+            height: calc(100vh - 2rem);
+            max-height: calc(100vh - 2rem);
+            border-radius: 10px;
+        }
+    }
+
+    .search-backdrop.ai-expanded {
+        padding-top: 0;
+        align-items: center;
+        padding: 1rem;
     }
 
     /* ── Mode tabs ─────────────────────────────────────────────── */
@@ -912,6 +942,31 @@
 
     /* ── Clear chat button (in modal-tabs) ──────────────────── */
 
+    .ai-expand-btn {
+        display: inline-flex;
+        align-items: center;
+        justify-content: center;
+        background: none;
+        border: none;
+        color: var(--greg-menu-section-color);
+        cursor: pointer;
+        padding: 0.2rem 0.3rem;
+        border-radius: 4px;
+        opacity: 0.6;
+        transition: opacity 0.15s, color 0.15s;
+        flex-shrink: 0;
+
+        svg {
+            width: 13px;
+            height: 13px;
+        }
+
+        &:hover {
+            opacity: 1;
+            color: var(--greg-color);
+        }
+    }
+
     .ai-clear-btn {
         display: inline-flex;
         align-items: center;

package/src/lib/MarkdownDocs/__tests__/vitePluginCopyDocs.test.js

@@ -0,0 +1,215 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { vitePluginCopyDocs } from '../vitePluginCopyDocs.js';
+
+/**
+ * Build the plugin, call configResolved to set the project root, then
+ * register the dev-server middleware and return it directly.
+ */
+function createMiddleware(options, root) {
+    const plugin = vitePluginCopyDocs(options);
+    plugin.configResolved({ root, build: { outDir: 'dist' }, base: '/' });
+    let middleware = null;
+    plugin.configureServer({ middlewares: { use(fn) { middleware = fn; } } });
+    return middleware;
+}
+
+/**
+ * Simulate a single GET request through the middleware.
+ * Resolves with the captured response, or with `{ passedThrough: true }` when
+ * the middleware calls next() without writing a response.
+ */
+function request(middleware, url) {
+    return new Promise((resolve) => {
+        const response = { headers: {}, body: null };
+        const res = {
+            setHeader(name, value) { response.headers[name.toLowerCase()] = value; },
+            end(data) { response.body = data; resolve(response); },
+        };
+        middleware({ url }, res, () => resolve({ passedThrough: true }));
+    });
+}
+
+/** Convert a response body (Buffer or string) to a UTF-8 string. */
+function bodyText(body) {
+    return Buffer.isBuffer(body) ? body.toString('utf8') : body;
+}
+
+// ─── helpers ──────────────────────────────────────────────────────────────────
+
+describe('vitePluginCopyDocs › configureServer', () => {
+    const tempDirs = [];
+
+    afterEach(() => {
+        for (const dir of tempDirs.splice(0)) {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+
+    // ── fix: decodeURIComponent in the docs-path handler (line 117) ───────────
+
+    it('serves a file whose name contains Polish characters (percent-encoded URL)', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'docs', 'przewodnik'), { recursive: true });
+        // File name with Polish letters: ścieżki.md  (ś = U+015B, ż = U+017C)
+        writeFileSync(join(root, 'docs', 'przewodnik', 'ścieżki.md'), '# Ścieżki', 'utf8');
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs' }, root);
+
+        // A browser sends Polish characters percent-encoded in the request URL.
+        // %C5%9B = ś, %C5%BCki = żki
+        const res = await request(mw, '/docs/przewodnik/%C5%9Bcie%C5%BCki.md');
+
+        expect(res.passedThrough).toBeUndefined();
+        expect(res.headers['content-type']).toContain('text/plain');
+        expect(bodyText(res.body)).toBe('# Ścieżki');
+    });
+
+    it('serves a file inside a directory whose name contains Polish characters', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        // Directory name with Polish letters: ścieżki  (ś = U+015B, ż = U+017C)
+        mkdirSync(join(root, 'docs', 'ścieżki'), { recursive: true });
+        writeFileSync(join(root, 'docs', 'ścieżki', 'index.md'), '# Start', 'utf8');
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs' }, root);
+
+        // %C5%9B = ś, %C5%BC = ż
+        const res = await request(mw, '/docs/%C5%9Bcie%C5%BCki/index.md');
+
+        expect(res.passedThrough).toBeUndefined();
+        expect(bodyText(res.body)).toBe('# Start');
+    });
+
+    it('serves a file whose path contains multiple Polish-character segments', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        // Both the directory and the file name contain Polish letters.
+        // directory: przewodnik, file: właściwości.md  (ł = U+0142, ś = U+015B, ć = U+0107)
+        mkdirSync(join(root, 'docs', 'przewodnik'), { recursive: true });
+        writeFileSync(
+            join(root, 'docs', 'przewodnik', 'właściwości.md'),
+            '# Właściwości',
+            'utf8',
+        );
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs' }, root);
+
+        // właściwości → w%C5%82a%C5%9Bciwo%C5%9Bci
+        const res = await request(mw, '/docs/przewodnik/w%C5%82a%C5%9Bciwo%C5%9Bci.md');
+
+        expect(res.passedThrough).toBeUndefined();
+        expect(bodyText(res.body)).toBe('# Właściwości');
+    });
+
+    // ── regression guard: ASCII paths must still work after the fix ───────────
+
+    it('serves a plain ASCII path correctly', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'docs', 'guide'), { recursive: true });
+        writeFileSync(join(root, 'docs', 'guide', 'intro.md'), '# Introduction', 'utf8');
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs' }, root);
+        const res = await request(mw, '/docs/guide/intro.md');
+
+        expect(res.passedThrough).toBeUndefined();
+        expect(bodyText(res.body)).toBe('# Introduction');
+    });
+
+    it('calls next() when the decoded path matches no file', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'docs'), { recursive: true });
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs' }, root);
+        const res = await request(mw, '/docs/%C5%9Bcie%C5%BCka-nie-istnieje.md');
+
+        expect(res.passedThrough).toBe(true);
+    });
+
+    // ── fix: URIError on malformed percent-encoding ────────────────────────────
+
+    it('calls next() and does not throw when URL contains malformed percent-encoding', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'docs'), { recursive: true });
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs' }, root);
+        // %GG is not valid percent-encoding – decodeURIComponent throws URIError
+        const res = await request(mw, '/docs/%GGinvalid.md');
+
+        expect(res.passedThrough).toBe(true);
+    });
+
+    // ── fix: path traversal protection ────────────────────────────────────────
+
+    it('blocks path traversal attempt via %2F..%2F in docs URL', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'docs'), { recursive: true });
+        // Create a sensitive file outside the docs dir
+        writeFileSync(join(root, 'secret.md'), '# SECRET', 'utf8');
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs' }, root);
+        // Encoded path traversal: /docs/../secret.md → decodes to /docs/../secret.md
+        const res = await request(mw, '/docs/%2E%2E%2Fsecret.md');
+
+        // Must NOT serve the file outside docs/
+        expect(res.passedThrough).toBe(true);
+    });
+
+    // ── fix: staticDirs – decodeURIComponent + path traversal ─────────────────
+
+    it('serves a snippet file with Polish characters (percent-encoded URL)', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'snippets'), { recursive: true });
+        writeFileSync(join(root, 'snippets', 'przykład.js'), '// przykład', 'utf8');
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs', staticDirs: ['snippets'] }, root);
+        // przykład → przyk%C5%82ad
+        const res = await request(mw, '/snippets/przyk%C5%82ad.js');
+
+        expect(res.passedThrough).toBeUndefined();
+        expect(res.headers['content-type']).toContain('text/plain');
+        expect(bodyText(res.body)).toBe('// przykład');
+    });
+
+    it('calls next() and does not throw when staticDirs URL has malformed percent-encoding', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'snippets'), { recursive: true });
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs', staticDirs: ['snippets'] }, root);
+        const res = await request(mw, '/snippets/%GGinvalid.js');
+
+        expect(res.passedThrough).toBe(true);
+    });
+
+    it('blocks path traversal attempt via %2F..%2F in staticDirs URL', async () => {
+        const root = mkdtempSync(join(tmpdir(), 'greg-plugin-'));
+        tempDirs.push(root);
+
+        mkdirSync(join(root, 'snippets'), { recursive: true });
+        writeFileSync(join(root, 'secret.js'), '// SECRET', 'utf8');
+
+        const mw = createMiddleware({ docsDir: 'docs', srcDir: '/docs', staticDirs: ['snippets'] }, root);
+        // Encoded path traversal: /snippets/../secret.js
+        const res = await request(mw, '/snippets/%2E%2E%2Fsecret.js');
+
+        expect(res.passedThrough).toBe(true);
+    });
+});

package/src/lib/MarkdownDocs/ai/promptBuilder.js

@@ -4,20 +4,19 @@ export function buildSystemPrompt(character, chunks, baseUrl = '') {
 		const link = `${baseUrl}${c.pageId}${anchor}`;
 		const heading = c.sectionHeading ? ` › ${c.sectionHeading}` : '';
 		return (
-			`[${i + 1}] Page: "${c.pageTitle}"${heading}\n` +
-			`    Link: ${link}\n` +
-			`    ${c.content}`
+			`SOURCE ${i + 1}: [${c.pageTitle}${heading}](${link})\n` +
+			c.content
 		);
 	}).join('\n\n');
 
 	return `${character.systemPrompt}
 
 STRICT RULES — follow these without exception:
+- LANGUAGE: You MUST respond in the exact same language as the user's question. Polish question = Polish answer. English question = English answer. This rule overrides everything else including your persona.
 - Base your answer EXCLUSIVELY on the DOCUMENTATION CONTEXT provided below.
-- If the context does not contain enough information to fully answer, say so clearly instead of guessing.
-- ALWAYS include at least one inline markdown link citation: [Section Title](link)
+- If the context does not contain enough information to fully answer, say so clearly. Do NOT include any source links in that case.
+- When you cite information, use the exact markdown links from the context: [Title](link). Do NOT invent, fabricate, or modify any URLs.
 - Do NOT invent, hallucinate, or add information absent from the context.
-- Respond in the same language the user used in their question.
 - Format your response in markdown.
 
 DOCUMENTATION CONTEXT:

package/src/lib/MarkdownDocs/ai/promptBuilder.ts

@@ -15,20 +15,19 @@ export function buildSystemPrompt(
 		const link = `${baseUrl}${c.pageId}${anchor}`;
 		const heading = c.sectionHeading ? ` › ${c.sectionHeading}` : '';
 		return (
-			`[${i + 1}] Page: "${c.pageTitle}"${heading}\n` +
-			`    Link: ${link}\n` +
-			`    ${c.content}`
+			`SOURCE ${i + 1}: [${c.pageTitle}${heading}](${link})\n` +
+			c.content
 		);
 	}).join('\n\n');
 
 	return `${character.systemPrompt}
 
 STRICT RULES — follow these without exception:
+- LANGUAGE: You MUST respond in the exact same language as the user's question. Polish question = Polish answer. English question = English answer. This rule overrides everything else including your persona.
 - Base your answer EXCLUSIVELY on the DOCUMENTATION CONTEXT provided below.
-- If the context does not contain enough information to fully answer, say so clearly instead of guessing.
-- ALWAYS include at least one inline markdown link citation: [Section Title](link)
+- If the context does not contain enough information to fully answer, say so clearly. Do NOT include any source links in that case.
+- When you cite information, use the exact markdown links from the context: [Title](link). Do NOT invent, fabricate, or modify any URLs.
 - Do NOT invent, hallucinate, or add information absent from the context.
-- Respond in the same language the user used in their question.
 - Format your response in markdown.
 
 DOCUMENTATION CONTEXT:

package/src/lib/MarkdownDocs/ai/ragPipeline.js

@@ -1,6 +1,38 @@
 import { buildMessages } from './promptBuilder.js';
 import { extractSources } from './docLinker.js';
 
+/**
+ * Return the set of pageIds that were actually cited in the answer.
+ * Handles both inline markdown links [text](url) and numeric references [N]
+ * mapped back to the chunks array.
+ */
+function extractCitedPageIds(answer, baseUrl, chunks) {
+	const cited = new Set();
+
+	// 1. Inline markdown links: [text](url)
+	const linkRe = /\]\(([^)\s]+)\)/g;
+	let m;
+	while ((m = linkRe.exec(answer)) !== null) {
+		let url = m[1].split('#')[0].trim();
+		if (!url) continue;
+		if (baseUrl && url.startsWith(baseUrl)) url = url.slice(baseUrl.length);
+		url = url.replace(/^\/\/+/, '/');
+		if (url) cited.add(url);
+	}
+
+	// 2. Numeric references [N] — map back to chunk pageId
+	const numRe = /\[(\d+)\]/g;
+	while ((m = numRe.exec(answer)) !== null) {
+		const idx = parseInt(m[1], 10) - 1; // prompt uses 1-based SOURCE N
+		if (idx >= 0 && idx < chunks.length) {
+			const pageId = chunks[idx].pageId.replace(/^\/\/+/, '/');
+			cited.add(pageId);
+		}
+	}
+
+	return cited;
+}
+
 export class RagPipeline {
 	constructor(provider, store, characters) {
 		this.provider = provider;
@@ -43,7 +75,14 @@ export class RagPipeline {
 
 		const messages = buildMessages(character, chunks, query, [], baseUrl);
 		const answer = await this.provider.chat(messages, options.llm);
-		const sources = extractSources(chunks);
+
+		// Show only sources whose pageId was actually cited inline by the LLM.
+		const citedPageIds = extractCitedPageIds(answer, baseUrl, chunks);
+		const citedChunks = chunks.filter(c => {
+			const normalised = c.pageId.replace(/^\/\/+/, '/');
+			return citedPageIds.has(normalised);
+		});
+		const sources = extractSources(citedChunks);
 
 		return { answer, sources, character: character.id };
 	}

package/src/lib/MarkdownDocs/ai/ragPipeline.ts

@@ -1,9 +1,40 @@
 import type { AiProvider } from './aiProvider.js';
 import type { ChunkStore } from './chunkStore.js';
-import type { AiCharacter, AiProviderOptions, AiResponse } from './types.js';
+import type { AiCharacter, AiProviderOptions, AiResponse, RetrievedChunk } from './types.js';
 import { buildMessages } from './promptBuilder.js';
 import { extractSources } from './docLinker.js';
 
+/**
+ * Parse all markdown link URLs from the LLM answer and return the set of
+ * pageIds (URL without anchor and without baseUrl prefix) that were cited.
+ */
+function extractCitedPageIds(answer: string, baseUrl: string, chunks: RetrievedChunk[]): Set<string> {
+	const cited = new Set<string>();
+
+	// 1. Inline markdown links: [text](url)
+	const linkRe = /\]\(([^)\s]+)\)/g;
+	let m: RegExpExecArray | null;
+	while ((m = linkRe.exec(answer)) !== null) {
+		let url = m[1].split('#')[0].trim();
+		if (!url) continue;
+		if (baseUrl && url.startsWith(baseUrl)) url = url.slice(baseUrl.length);
+		url = url.replace(/^\/\/+/, '/');
+		if (url) cited.add(url);
+	}
+
+	// 2. Numeric references [N] — map back to chunk pageId
+	const numRe = /\[(\d+)\]/g;
+	while ((m = numRe.exec(answer)) !== null) {
+		const idx = parseInt(m[1], 10) - 1;
+		if (idx >= 0 && idx < chunks.length) {
+			const pageId = chunks[idx].pageId.replace(/^\/\/+/, '/');
+			cited.add(pageId);
+		}
+	}
+
+	return cited;
+}
+
 export type RagOptions = {
 	/** Number of chunks to retrieve from the store. Default: 8 */
 	topK?: number;
@@ -93,8 +124,14 @@ export class RagPipeline {
 		const messages = buildMessages(character, chunks, query, [], baseUrl);
 		const answer = await this.provider.chat(messages, options.llm);
 
-		// 4. Extract source citations from retrieved chunks
-		const sources = extractSources(chunks);
+		// 4. Collect only sources whose link was actually cited in the answer.
+		//    This is deterministic and doesn't rely on LLM marker compliance.
+		const citedPageIds = extractCitedPageIds(answer, baseUrl, chunks);
+		const citedChunks = chunks.filter(c => {
+			const normalised = c.pageId.replace(/^\/\/+/, '/');
+			return citedPageIds.has(normalised);
+		});
+		const sources = extractSources(citedChunks);
 
 		return { answer, sources, character: character.id };
 	}