@gotza02/mathinking 2.9.4 → 2.9.6

package/dist/tools/orchestrator.js

@@ -1,39 +1,72 @@
-import * as vm from 'vm';
+import { getQuickJS } from 'quickjs-emscripten';
+import * as path from 'path';
+import * as os from 'os';
 import { resilienceManager } from '../utils/resilience.js';
 import { toolCache } from '../utils/tool-cache.js';
 import { topologicalSortWithLayers, validateDAG, visualizeDAG, getCriticalPath, getMaxParallelism } from '../utils/dag.js';
-/**
- * Orchestrator Manager (The Body)
- *
- * Provides DAG-based task execution with:
- * - Topological sorting for dependency resolution
- * - Parallel execution of independent tasks
- * - Tool orchestration via registry
- * - Graceful error handling
- * - Result aggregation
- */
 export class OrchestratorManager {
     toolRegistry = {};
     executionHistory = new Map();
     lastActionTimestamp = 0;
     MIN_DELAY_MS = 1000; // 1s delay for orchestrator actions
+    quickJS;
+    // 🔒 Security: Allowed directory roots for file operations
+    ALLOWED_ROOTS = [
+        process.cwd(),
+        path.join(os.homedir(), 'tmp', 'mathinking')
+    ];
     constructor() {
         this.registerBuiltInTools();
     }
+    /**
+     * 🔒 Security: Validate path to prevent directory traversal attacks
+     * Ensures that file operations are limited to allowed directories
+     */
+    validatePath(inputPath) {
+        // Expand ~ to home directory
+        const expandedPath = inputPath.replace(/^~/, os.homedir());
+        // Resolve to absolute path (also normalizes ../ etc)
+        const resolvedPath = path.resolve(expandedPath);
+        // Check if path is within allowed roots
+        const isAllowed = this.ALLOWED_ROOTS.some(root => {
+            const resolvedRoot = path.resolve(root);
+            return resolvedPath.startsWith(resolvedRoot);
+        });
+        if (!isAllowed) {
+            throw new Error(`Security: Path "${resolvedPath}" is outside allowed directories: ` +
+                `[${this.ALLOWED_ROOTS.join(', ')}]`);
+        }
+        return resolvedPath;
+    }
+    async safeEval(code) {
+        if (!this.quickJS) {
+            this.quickJS = await getQuickJS();
+        }
+        const vm = this.quickJS.newContext();
+        try {
+            const result = vm.evalCode(code);
+            if (result.error) {
+                const error = vm.dump(result.error);
+                result.error.dispose();
+                throw new Error(String(error));
+            }
+            const value = vm.dump(result.value);
+            result.value.dispose();
+            return value;
+        }
+        finally {
+            vm.dispose();
+        }
+    }
     sleep(ms) {
         return new Promise((resolve) => setTimeout(resolve, ms));
     }
-    /**
-     * Register built-in tools for testing and common operations
-     */
     registerBuiltInTools() {
-        // Echo tool - returns input as output (useful for testing)
         this.registerTool({
             name: 'echo',
             description: 'Returns the input as output',
             execute: async (input) => input
         });
-        // Delay tool - waits for specified milliseconds
         this.registerTool({
             name: 'delay',
             description: 'Waits for specified milliseconds',
@@ -43,7 +76,6 @@ export class OrchestratorManager {
                 return { delayed: ms, timestamp: new Date().toISOString() };
             }
         });
-        // Transform tool - applies simple transformations
         this.registerTool({
             name: 'transform',
             description: 'Applies transformations to data',
@@ -66,7 +98,6 @@ export class OrchestratorManager {
                 }
             }
         });
-        // Aggregate tool - combines multiple inputs
         this.registerTool({
             name: 'aggregate',
             description: 'Aggregates multiple values',
@@ -90,7 +121,6 @@ export class OrchestratorManager {
                 }
             }
         });
-        // HTTP fetch tool - Real implementation using native fetch
         this.registerTool({
             name: 'fetch',
             description: 'Fetches data from a URL',
@@ -99,8 +129,15 @@ export class OrchestratorManager {
                 const method = input.method || 'GET';
                 const body = input.body ? JSON.stringify(input.body) : undefined;
                 const headers = input.headers || {};
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), 30000); // 30s timeout
                 try {
-                    const response = await fetch(url, { method, body, headers });
+                    const response = await fetch(url, {
+                        method,
+                        body,
+                        headers,
+                        signal: controller.signal
+                    });
                     const contentType = response.headers.get('content-type');
                     let data;
                     if (contentType && contentType.includes('application/json')) {
@@ -120,64 +157,103 @@ export class OrchestratorManager {
                 catch (error) {
                     throw new Error(`Fetch failed: ${error instanceof Error ? error.message : String(error)}`);
                 }
+                finally {
+                    clearTimeout(timeoutId);
+                }
             }
         });
-        // File System: Read file
         this.registerTool({
             name: 'read_file',
             description: 'Reads content from a file',
             execute: async (input) => {
-                const path = (input.file_path || input.path);
+                const rawPath = (input.file_path || input.path);
+                const validatedPath = this.validatePath(rawPath); // 🔒 Security validation
                 const encoding = input.encoding || 'utf8';
                 const fs = await import('fs/promises');
                 try {
-                    const content = await fs.readFile(path, { encoding });
-                    return { path, content, timestamp: new Date().toISOString() };
+                    const content = await fs.readFile(validatedPath, { encoding });
+                    return { path: validatedPath, content, timestamp: new Date().toISOString() };
                 }
                 catch (error) {
                     throw new Error(`Read file failed: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
         });
-        // File System: Write file
         this.registerTool({
             name: 'write_file',
             description: 'Writes content to a file',
             execute: async (input) => {
-                const path = (input.file_path || input.path);
+                const rawPath = (input.file_path || input.path);
+                const validatedPath = this.validatePath(rawPath); // 🔒 Security validation
                 const content = input.content;
                 const fs = await import('fs/promises');
                 try {
-                    await fs.writeFile(path, content);
-                    return { path, success: true, timestamp: new Date().toISOString() };
+                    await fs.writeFile(validatedPath, content);
+                    return { path: validatedPath, success: true, timestamp: new Date().toISOString() };
                 }
                 catch (error) {
                     throw new Error(`Write file failed: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
         });
-        // File System: List directory
         this.registerTool({
             name: 'list_directory',
             description: 'Lists files in a directory',
             execute: async (input) => {
-                const path = (input.dir_path || input.path);
+                const rawPath = (input.dir_path || input.path);
+                const validatedPath = this.validatePath(rawPath); // 🔒 Security validation
                 const fs = await import('fs/promises');
                 try {
-                    const files = await fs.readdir(path);
-                    return { path, files, timestamp: new Date().toISOString() };
+                    const files = await fs.readdir(validatedPath);
+                    return { path: validatedPath, files, timestamp: new Date().toISOString() };
                 }
                 catch (error) {
                     throw new Error(`List directory failed: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
         });
-        // Shell execute
         this.registerTool({
             name: 'shell_execute',
             description: 'Executes a shell command',
             execute: async (input) => {
                 const command = input.command;
+                const path = await import('path');
+                const ALLOWED_COMMANDS = [
+                    'ls',
+                    'echo',
+                    'cat',
+                    'mkdir',
+                    'rm',
+                    'touch',
+                    'git',
+                    'grep',
+                    'pwd',
+                    'find',
+                    'whoami'
+                ];
+                const tokenRegex = /[^\s"]+|"([^"]*)"/gi;
+                const tokens = [];
+                let match;
+                while ((match = tokenRegex.exec(command)) !== null) {
+                    tokens.push(match[1] ? match[1] : match[0]); // match[1] is the content inside quotes
+                }
+                let binaryToken = tokens[0];
+                for (const token of tokens) {
+                    if (!token.includes('=')) {
+                        binaryToken = token;
+                        break;
+                    }
+                }
+                const binary = path.basename(binaryToken);
+                if (!ALLOWED_COMMANDS.includes(binary)) {
+                    throw new Error(`Command "${binary}" is not allowed. Allowed: ${ALLOWED_COMMANDS.join(', ')}`);
+                }
+                if (/[\n\r;&|`>]|\$\(/.test(command)) {
+                    throw new Error('Command contains disallowed characters (newlines, operators, redirection) to prevent injection.');
+                }
+                if (binary === 'git' && (command.includes('-c') || command.includes('--config'))) {
+                    throw new Error('Git configuration flags are not allowed for security reasons.');
+                }
                 const { exec } = await import('child_process');
                 const { promisify } = await import('util');
                 const execAsync = promisify(exec);
@@ -190,7 +266,6 @@ export class OrchestratorManager {
                 }
             }
         });
-        // Web Search tool - Enhanced with Google, Exa, and Brave API support
         this.registerTool({
             name: 'web_search',
             description: 'Searches the web for information (Prioritizes Tools like Brave/Exa, then MPC/Google, then Fallback)',
@@ -200,7 +275,6 @@ export class OrchestratorManager {
                 const freshness = input.freshness || 'year'; // day, week, month, year
                 const getFreshnessParams = (provider) => {
                     if (provider === 'google') {
-                        // d[number], w[number], m[number], y[number]
                         if (freshness === 'day')
                             return 'd1';
                         if (freshness === 'week')
@@ -210,7 +284,6 @@ export class OrchestratorManager {
                         return 'y1'; // Default to past year for "latest" relevance
                     }
                     if (provider === 'brave') {
-                        // pd, pw, pm, py
                         if (freshness === 'day')
                             return 'pd';
                         if (freshness === 'week')
@@ -220,7 +293,6 @@ export class OrchestratorManager {
                         return 'py';
                     }
                     if (provider === 'scraper') {
-                        // qdr:d, qdr:w, qdr:m, qdr:y
                         if (freshness === 'day')
                             return '&tbs=qdr:d';
                         if (freshness === 'week')
@@ -231,7 +303,6 @@ export class OrchestratorManager {
                     }
                     return '';
                 };
-                // 1. Brave Search (Tool) - Priority 1A
                 const braveApiKey = process.env.BRAVE_SEARCH_API_KEY;
                 if (braveApiKey) {
                     try {
@@ -255,10 +326,8 @@ export class OrchestratorManager {
                         console.error('Brave API failed, falling back:', e);
                     }
                 }
-                // 2. Exa.ai Search (Tool) - Priority 1B
                 if (process.env.EXA_API_KEY) {
                     try {
-                        // Exa uses startPublishedDate for freshness
                         let startPublishedDate;
                         const now = new Date();
                         if (freshness === 'day')
@@ -300,7 +369,6 @@ export class OrchestratorManager {
                         console.error('Exa Search failed, falling back:', e);
                     }
                 }
-                // 3. Google Custom Search (MPC/Gemini) - Priority 2
                 if (process.env.GOOGLE_SEARCH_API_KEY && process.env.GOOGLE_SEARCH_CX) {
                     try {
                         const dateRestrict = getFreshnessParams('google');
@@ -324,50 +392,16 @@ export class OrchestratorManager {
                         console.error('Google Search failed, falling back:', e);
                     }
                 }
-                // 4. Fallback to basic scraper
                 try {
-                    const freshParam = getFreshnessParams('scraper');
-                    const searchUrl = `https://www.google.com/search?q=${encodeURIComponent(query)}${freshParam}`;
-                    const response = await fetch(searchUrl, {
-                        headers: {
-                            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'
-                        }
-                    });
-                    const html = await response.text();
-                    const results = [];
-                    // Enhanced patterns for Google search results
-                    const patterns = [
-                        // Standard snippets
-                        /<div class="vvSyob">(.+?)<\/div>| <div class="BNeawe s3v9rd AP7Wnd">(.+?)<\/div>/g,
-                        // Mobile snippets
-                        /<div class="BNeawe vvSyob s3v9rd AP7Wnd">(.+?)<\/div>/g,
-                        // Alternative layout snippets
-                        /<span class="aCOpbd">(.+?)<\/span>/g
-                    ];
-                    for (const pattern of patterns) {
-                        let match;
-                        while ((match = pattern.exec(html)) !== null && results.length < numResults) {
-                            const text = (match[1] || match[2] || match[0]).replace(/<[^>]+>/g, '').trim();
-                            if (text.length > 20 && !results.some((r) => r.snippet === text)) {
-                                results.push({ snippet: text });
-                            }
-                        }
-                    }
-                    // Fallback: If no snippets found, try to extract anything that looks like a title/link description
-                    if (results.length === 0) {
-                        const linkDescRegex = /<h3[^>]*>(.+?)<\/h3>/g;
-                        let match;
-                        while ((match = linkDescRegex.exec(html)) !== null && results.length < numResults) {
-                            const text = match[1].replace(/<[^>]+>/g, '').trim();
-                            if (text.length > 10)
-                                results.push({ snippet: text });
-                        }
-                    }
+                    console.warn('[Web Search] Scraper fallback is deprecated/unstable. Please set GOOGLE_SEARCH_API_KEY or BRAVE_SEARCH_API_KEY.');
                     return {
                         query,
-                        source: 'Scraper Fallback',
-                        results,
-                        searchUrl,
+                        source: 'System',
+                        results: [{
+                                title: 'Configuration Required',
+                                snippet: 'Web search scraping is disabled due to reliability issues. Please configure GOOGLE_SEARCH_API_KEY (and CX) or BRAVE_SEARCH_API_KEY in your environment to enable search functionality.',
+                                url: 'https://console.cloud.google.com/apis/credentials'
+                            }],
                         timestamp: new Date().toISOString()
                     };
                 }
@@ -376,7 +410,6 @@ export class OrchestratorManager {
                 }
             }
         });
-        // Memory Save tool
         this.registerTool({
             name: 'memory_save',
             description: 'Saves a fact or information to long-term memory',
@@ -387,7 +420,6 @@ export class OrchestratorManager {
                 return { success: true, message: `Saved to memory: ${key}`, entry };
             }
         });
-        // Memory Query tool - Enhanced with filters
         this.registerTool({
             name: 'memory_query',
             description: 'Queries long-term memory with optional category and tag filters',
@@ -401,7 +433,6 @@ export class OrchestratorManager {
                 return { query, results, count: results.length };
             }
         });
-        // Memory Delete tool
         this.registerTool({
             name: 'memory_delete',
             description: 'Deletes an entry from long-term memory by its ID or Key',
@@ -412,7 +443,6 @@ export class OrchestratorManager {
                 return { success: true, ...result };
             }
         });
-        // Vector Memory Save
         this.registerTool({
             name: 'vector_save',
             description: 'Saves text to semantic vector memory (The Scholar)',
@@ -423,7 +453,6 @@ export class OrchestratorManager {
                 return { success: true, id: entry.id, message: 'Saved to vector memory' };
             }
         });
-        // Vector Memory Search
         this.registerTool({
             name: 'vector_search',
             description: 'Semantically searches vector memory',
@@ -434,49 +463,39 @@ export class OrchestratorManager {
                 return { query, results };
             }
         });
-        // Compute tool - performs calculations
         this.registerTool({
             name: 'compute',
             description: 'Performs mathematical computations',
             execute: async (input) => {
                 const expression = input.expression;
                 const variables = input.variables || {};
-                // Simple expression evaluator (safe subset)
                 let resultExpr = expression;
                 for (const [key, value] of Object.entries(variables)) {
                     resultExpr = resultExpr.replace(new RegExp(`\\b${key}\\b`, 'g'), String(value));
                 }
-                // Evaluate simple math expressions
                 try {
-                    // Use vm for sandboxed execution
-                    if (/^[\d\s+\-*/().]+$/.test(resultExpr)) {
-                        return { result: vm.runInNewContext(resultExpr, {}) };
+                    if (/^[\d\s+\-*/().,MathPIE_a-zA-Z]+$/.test(resultExpr) &&
+                        !resultExpr.includes('process') &&
+                        !resultExpr.includes('require') &&
+                        !resultExpr.includes('import')) {
+                        const result = await this.safeEval(resultExpr);
+                        return { result };
                     }
                     return { error: 'Invalid expression', expression: resultExpr };
                 }
-                catch {
-                    return { error: 'Computation failed', expression: resultExpr };
+                catch (error) {
+                    return { error: 'Computation failed', expression: resultExpr, details: String(error) };
                 }
             }
         });
     }
-    /**
-     * Register a custom tool
-     */
     registerTool(tool) {
         this.toolRegistry[tool.name] = tool;
     }
-    /**
-     * Get list of registered tools
-     */
     getRegisteredTools() {
         return Object.keys(this.toolRegistry);
     }
-    /**
-     * Process an orchestrator action
-     */
     async process(input) {
-        // Rate limiting / Flood protection
         const now = Date.now();
         const elapsed = now - this.lastActionTimestamp;
         if (elapsed < this.MIN_DELAY_MS) {
@@ -501,9 +520,6 @@ export class OrchestratorManager {
                 };
         }
     }
-    /**
-     * Delete an execution plan from history
-     */
     deletePlan(input) {
         if (!input.planId) {
             return {
@@ -524,9 +540,6 @@ export class OrchestratorManager {
             message: `Successfully deleted execution history for plan: ${input.planId}`
         };
     }
-    /**
-     * Validate an execution plan
-     */
     validatePlan(input) {
         if (!input.plan) {
             return {
@@ -537,7 +550,6 @@ export class OrchestratorManager {
         }
         const validation = validateDAG(input.plan);
         const errors = [...validation.errors];
-        // Check for unregistered tools
         for (const task of input.plan.tasks) {
             if (!this.toolRegistry[task.toolName]) {
                 errors.push(`Task "${task.id}" uses unregistered tool "${task.toolName}". Available tools: ${this.getRegisteredTools().join(', ')}`);
@@ -559,9 +571,6 @@ export class OrchestratorManager {
             executionOrder: topoResult.layers
         };
     }
-    /**
-     * Execute a plan with parallel processing
-     */
     async executePlan(input) {
         if (!input.plan) {
             return {
@@ -569,14 +578,12 @@ export class OrchestratorManager {
                 message: 'Execution plan is required'
             };
         }
-        // Validate first
         const validation = this.validatePlan(input);
         if (!validation.success) {
             return validation;
         }
         const plan = input.plan;
         const startTime = new Date();
-        // Get execution layers
         const topoResult = topologicalSortWithLayers(plan);
         const taskMap = new Map(plan.tasks.map((t) => [t.id, t]));
         const taskResults = [];
@@ -586,19 +593,44 @@ export class OrchestratorManager {
         console.log(`📊 Total tasks: ${plan.tasks.length}`);
         console.log(`📦 Execution layers: ${topoResult.layers.length}`);
         console.log(`⚡ Max parallelism: ${Math.max(...topoResult.layers.map((l) => l.length))}\n`);
-        // Execute layer by layer
         for (let layerIndex = 0; layerIndex < topoResult.layers.length; layerIndex++) {
             const layer = topoResult.layers[layerIndex];
             console.log(`\n📍 Layer ${layerIndex + 1}: Executing ${layer.length} task(s) in parallel`);
             console.log(`   Tasks: [${layer.join(', ')}]`);
-            // Execute all tasks in this layer in parallel
             const layerPromises = layer.map(async (taskId) => {
                 const task = taskMap.get(taskId);
+                const dependencies = task.dependencies.map(d => taskResults.find(r => r.taskId === d));
+                const failedDep = dependencies.find(d => d?.status === 'failed');
+                const skippedDep = dependencies.find(d => d?.status === 'skipped');
+                if (failedDep) {
+                    console.log(`   ○ Skipped: ${task.name} (Dependency "${failedDep.taskName}" failed)`);
+                    return {
+                        taskId: task.id,
+                        taskName: task.name,
+                        status: 'skipped',
+                        error: `Dependency ${failedDep.taskName} failed`,
+                        startTime: new Date().toISOString(),
+                        endTime: new Date().toISOString(),
+                        duration: 0,
+                        retries: 0
+                    };
+                }
+                if (skippedDep) {
+                    console.log(`   ○ Skipped: ${task.name} (Dependency "${skippedDep.taskName}" skipped)`);
+                    return {
+                        taskId: task.id,
+                        taskName: task.name,
+                        status: 'skipped',
+                        error: `Dependency ${skippedDep.taskName} skipped`,
+                        startTime: new Date().toISOString(),
+                        endTime: new Date().toISOString(),
+                        duration: 0,
+                        retries: 0
+                    };
+                }
                 return this.executeTask(task, taskOutputs, errors);
             });
-            // Wait for all tasks in this layer to complete
             const layerResults = await Promise.all(layerPromises);
-            // Store results
             for (const result of layerResults) {
                 taskResults.push(result);
                 if (result.status === 'completed' && result.result !== undefined) {
@@ -608,7 +640,6 @@ export class OrchestratorManager {
         }
         const endTime = new Date();
         const totalDuration = endTime.getTime() - startTime.getTime();
-        // Aggregate results
         const aggregatedResults = {};
         for (const [taskId, output] of taskOutputs) {
             aggregatedResults[taskId] = output;
@@ -647,9 +678,6 @@ export class OrchestratorManager {
             executionOrder: topoResult.layers
         };
     }
-    /**
-     * Execute a single task with error handling, retries, and resilience
-     */
     async executeTask(task, taskOutputs, errors) {
         const startTime = new Date();
         const maxRetries = task.retryCount || 0;
@@ -658,9 +686,9 @@ export class OrchestratorManager {
         let repairAttempts = 0; // Guard against infinite repair loops
         let currentInput = task.toolInput; // Allow modification
         console.log(`   ⚙️ Starting: ${task.name} (${task.id})`);
-        // 1. Check Cache
+        let resolvedInput = this.resolveInput(currentInput, taskOutputs);
         if (['fetch', 'web_search'].includes(task.toolName)) {
-            const cached = toolCache.get(task.toolName, currentInput);
+            const cached = toolCache.get(task.toolName, resolvedInput);
             if (cached) {
                 console.log(`   ⚡ Cached Hit: ${task.name}`);
                 return {
@@ -675,20 +703,14 @@ export class OrchestratorManager {
                 };
             }
         }
-        // Get tool
         const tool = this.toolRegistry[task.toolName];
         if (!tool) {
-            // ... error handling ...
             const error = `Tool "${task.toolName}" not found`;
             errors.push({ taskId: task.id, taskName: task.name, error, timestamp: new Date().toISOString() });
             return { taskId: task.id, taskName: task.name, status: 'failed', error, startTime: startTime.toISOString(), endTime: new Date().toISOString(), duration: 0, retries: 0 };
         }
-        // Resolve input
-        let resolvedInput = this.resolveInput(currentInput, taskOutputs);
-        // Evaluate condition
         if (task.runIf) {
-            // ... existing runIf logic ...
-            const isConditionMet = this.evaluateCondition(task.runIf, taskOutputs);
+            const isConditionMet = await this.evaluateCondition(task.runIf, taskOutputs);
             if (!isConditionMet) {
                 console.log(`   ○ Skipped: ${task.name} (Condition "${task.runIf}" not met)`);
                 return { taskId: task.id, taskName: task.name, status: 'skipped', startTime: startTime.toISOString(), endTime: new Date().toISOString(), duration: 0, retries: 0 };
@@ -701,7 +723,6 @@ export class OrchestratorManager {
                     : await tool.execute(resolvedInput);
                 const endTime = new Date();
                 console.log(`   ✓ Completed: ${task.name} (${endTime.getTime() - startTime.getTime()}ms)`);
-                // Update Cache
                 if (['fetch', 'web_search'].includes(task.toolName)) {
                     toolCache.set(task.toolName, currentInput, result);
                 }
@@ -718,33 +739,27 @@ export class OrchestratorManager {
             }
             catch (err) {
                 const errorMessage = err instanceof Error ? err.message : String(err);
-                // 🛡️ Resilience / Self-Healing
-                // Only attempt repair if we haven't exceeded the limit (hardcoded to 3 for safety)
                 if (repairAttempts < 3) {
-                    // Ask the Immune System what to do
                     const recovery = await resilienceManager.diagnose(err, { ...task, toolInput: currentInput });
                     if (recovery) {
                         console.log(`   🚑 Self-Healing (${recovery.type}): ${recovery.description}`);
                         repairAttempts++; // Increment guard
                         if (recovery.type === 'run_command' && recovery.payload?.command) {
-                            // Execute the fix (e.g., mkdir)
                             try {
                                 await this.toolRegistry['shell_execute'].execute({ command: recovery.payload.command });
-                                continue;
+                                // continue; // Let it fall through to retry logic
                             }
                             catch (fixErr) {
                                 console.log(`   ❌ Fix failed: ${fixErr}`);
                             }
                         }
                         else if (recovery.type === 'modify_input' && recovery.payload) {
-                            // Modify input for next attempt
                             currentInput = { ...currentInput, ...recovery.payload };
                             resolvedInput = this.resolveInput(currentInput, taskOutputs);
-                            continue;
+                            // continue; // Let it fall through to retry logic
                         }
                     }
                 }
-                // Standard Retry Logic
                 retries++;
                 if (retries <= maxRetries) {
                     const backoff = Math.min(retryDelay * Math.pow(2, retries - 1), 30000);
@@ -752,14 +767,12 @@ export class OrchestratorManager {
                     await new Promise((resolve) => setTimeout(resolve, backoff));
                 }
                 else {
-                    // 🚨 ACTIVE LEARNING: All retries failed. Ask Brain for a miracle.
                     console.log(`   🚨 All retries failed for: ${task.name}. Requesting mid-execution re-plan...`);
                     const replanResult = await resilienceManager.requestStrategicReplan(errorMessage, task);
                     if (replanResult?.success && replanResult.executionPlan) {
                         console.log(`   ✨ MIRACLE! Brain provided a recovery plan: ${replanResult.executionPlan.name}`);
                         const subResult = await this.executePlan({ action: 'execute_plan', plan: replanResult.executionPlan });
                         if (subResult.success) {
-                            // If recovery plan succeeded, we can technically count the original task as "recovered"
                             return {
                                 taskId: task.id,
                                 taskName: task.name,
@@ -780,28 +793,24 @@ export class OrchestratorManager {
         }
         return { taskId: task.id, taskName: task.name, status: 'failed', error: 'Unknown', startTime: startTime.toISOString(), endTime: new Date().toISOString(), duration: 0, retries };
     }
-    evaluateCondition(condition, taskOutputs) {
-        // 1. Resolve placeholders in the condition string
-        const resolvedCondition = this.resolveValue(condition, taskOutputs);
-        // 2. Simple evaluation for common cases
-        // Handling literal booleans
-        if (resolvedCondition === 'true')
-            return true;
-        if (resolvedCondition === 'false')
-            return false;
-        try {
-            // 3. Safe evaluation using vm (sandboxed)
-            // This prevents access to global objects like process, require, etc.
-            return !!vm.runInNewContext(resolvedCondition, {});
-        }
-        catch {
-            return false;
+    async evaluateCondition(condition, taskOutputs) {
+        const resolvedCondition = this.resolveValue(condition, taskOutputs, true);
+        if (typeof resolvedCondition === 'boolean')
+            return resolvedCondition;
+        if (typeof resolvedCondition === 'string') {
+            if (resolvedCondition === 'true')
+                return true;
+            if (resolvedCondition === 'false')
+                return false;
+            try {
+                return !!(await this.safeEval(resolvedCondition));
+            }
+            catch {
+                return false;
+            }
         }
+        return !!resolvedCondition;
     }
-    /**
-     * Resolve input placeholders with outputs from previous tasks
-     * Supports syntax: "${taskId.property}" or "${taskId}"
-     */
     resolveInput(input, taskOutputs) {
         const resolved = {};
         for (const [key, value] of Object.entries(input)) {
@@ -809,18 +818,18 @@ export class OrchestratorManager {
         }
         return resolved;
     }
-    resolveValue(value, taskOutputs) {
+    resolveValue(value, taskOutputs, safeForEval = false) {
         if (typeof value === 'string') {
-            // Check for placeholder pattern: ${taskId} or ${taskId.property}
             const placeholderRegex = /\$\{([^}]+)\}/g;
-            // If entire string is a single placeholder, return the actual value (not stringified)
             const singleMatch = value.match(/^\$\{([^}]+)\}$/);
             if (singleMatch) {
                 return this.resolvePlaceholder(singleMatch[1], taskOutputs);
             }
-            // Otherwise, replace placeholders in string
             return value.replace(placeholderRegex, (_, placeholder) => {
                 const resolved = this.resolvePlaceholder(placeholder, taskOutputs);
+                if (safeForEval && typeof resolved === 'string') {
+                    return resolved.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+                }
                 return String(resolved);
             });
         }
@@ -842,10 +851,8 @@ export class OrchestratorManager {
         if (parts.length === 1) {
             return output;
         }
-        // Navigate nested properties
         let current = output;
         for (let i = 1; i < parts.length; i++) {
-            // Allow traversal of objects and strings (for .length etc)
             if (current && (typeof current === 'object' || typeof current === 'string')) {
                 current = current[parts[i]];
             }
@@ -855,18 +862,12 @@ export class OrchestratorManager {
         }
         return current;
     }
-    /**
-     * Execute a promise with timeout
-     */
     async executeWithTimeout(promise, timeoutMs) {
         return Promise.race([
             promise,
             new Promise((_, reject) => setTimeout(() => reject(new Error(`Task timed out after ${timeoutMs}ms`)), timeoutMs))
         ]);
     }
-    /**
-     * Get execution status for a plan
-     */
     getExecutionStatus(input) {
         if (!input.planId) {
             return {
@@ -887,9 +888,6 @@ export class OrchestratorManager {
             result
         };
     }
-    /**
-     * Format execution summary for display
-     */
     formatExecutionSummary(result) {
         const lines = [
             '┌─────────────────────────────────────────────────┐',
@@ -914,6 +912,5 @@ export class OrchestratorManager {
         return lines.join('\n');
     }
 }
-// Export singleton instance
 export const orchestratorManager = new OrchestratorManager();
 //# sourceMappingURL=orchestrator.js.map