@gotza02/sequential-thinking 10000.0.6 → 10000.0.7

package/dist/codestore.d.ts

@@ -55,7 +55,7 @@ export declare class CodeDatabase {
     /**
      * Atomic save using write-to-temp + rename pattern.
      */
-    private save;
+    save(): Promise<void>;
     /**
      * Reload database from disk
      */

package/dist/graph.d.ts

@@ -11,6 +11,7 @@ export declare class ProjectKnowledgeGraph {
     private cachePath;
     private configResolver;
     private configHash;
+    private MAX_CACHE_SIZE;
     private getConcurrencyLimit;
     constructor();
     /**
@@ -22,7 +23,7 @@ export declare class ProjectKnowledgeGraph {
         cachedFiles: number;
         parsedFiles: number;
     }>;
-    build(rootDir: string): Promise<{
+    build(rootDir: string, onProgress?: (progress: any) => void): Promise<{
         nodeCount: number;
         totalFiles: number;
         cachedFiles: number;
@@ -30,6 +31,13 @@ export declare class ProjectKnowledgeGraph {
     }>;
     private loadCache;
     private saveCache;
+    clearCache(): Promise<void>;
+    getCacheStats(): {
+        fileCount: number;
+        totalSize: string;
+        configHash: string | undefined;
+        version: string;
+    };
     private getAllFiles;
     private isMonorepoRoot;
     private parseFile;

package/dist/graph.js

@@ -184,6 +184,7 @@ export class ProjectKnowledgeGraph {
     cachePath = '';
     configResolver = null;
     configHash = '';
+    MAX_CACHE_SIZE = 1000;
     // Dynamic concurrency based on file count
     getConcurrencyLimit(fileCount) {
         if (fileCount < 100)
@@ -214,9 +215,22 @@ export class ProjectKnowledgeGraph {
         this.configResolver = null;
         return await this.build(rootDir);
     }
-    async build(rootDir) {
+    async build(rootDir, onProgress) {
         try {
+            // Validate input
+            if (!rootDir || typeof rootDir !== 'string') {
+                throw new Error('rootDir must be a non-empty string');
+            }
+            if (rootDir.length > 1000) {
+                throw new Error('rootDir path too long');
+            }
             this.rootDir = path.resolve(rootDir);
+            // Security check: prevent path traversal
+            const resolvedRoot = path.resolve(rootDir);
+            const cwd = process.cwd();
+            if (!resolvedRoot.startsWith(cwd) && !process.env.ALLOW_EXTERNAL_PATHS) {
+                throw new Error('Access denied: Cannot build graph outside current working directory');
+            }
             this.cachePath = path.join(this.rootDir, '.gemini_graph_cache.json');
             // Check if rootDir exists and is a directory
             const stats = await fs.stat(this.rootDir);
@@ -262,6 +276,8 @@ export class ProjectKnowledgeGraph {
             }
             // Step 3: Parse new/modified files concurrently with dynamic limit
             const CONCURRENCY_LIMIT = this.getConcurrencyLimit(filesToParse.length);
+            let processedFiles = files.length - filesToParse.length; // Start with cached files count
+            const totalFiles = files.length;
             for (let i = 0; i < filesToParse.length; i += CONCURRENCY_LIMIT) {
                 const chunk = filesToParse.slice(i, i + CONCURRENCY_LIMIT);
                 await Promise.all(chunk.map(async (file) => {
@@ -274,6 +290,14 @@ export class ProjectKnowledgeGraph {
                         imports: data.imports,
                         symbols: data.symbols
                     };
+                    processedFiles++;
+                    if (onProgress && processedFiles % 10 === 0) {
+                        onProgress({
+                            processed: processedFiles,
+                            total: totalFiles,
+                            percentage: Math.round((processedFiles / totalFiles) * 100)
+                        });
+                    }
                 }));
             }
             // Update config hash in cache
@@ -317,6 +341,20 @@ export class ProjectKnowledgeGraph {
     }
     async saveCache() {
         try {
+            // Limit cache size
+            const fileEntries = Object.entries(this.cache.files);
+            if (fileEntries.length > this.MAX_CACHE_SIZE) {
+                // Sort by access time (if available) or keep most recent
+                // Since we only track mtime, we can't strictly purge by access time unless we add atime.
+                // We'll use mtime as a proxy for relevance or just keep the ones we encountered (if sorted by something else).
+                // Actually, let's just keep the ones with latest mtime? No, that might purge old stable files.
+                // The patch suggests: sort by mtime.
+                const sorted = fileEntries.sort((a, b) => {
+                    return (b[1].mtime || 0) - (a[1].mtime || 0);
+                });
+                this.cache.files = Object.fromEntries(sorted.slice(0, this.MAX_CACHE_SIZE));
+                console.warn(`[Graph] Cache trimmed to ${this.MAX_CACHE_SIZE} entries`);
+            }
             const tmpPath = this.cachePath + '.tmp';
             await fs.writeFile(tmpPath, JSON.stringify(this.cache, null, 2), 'utf-8');
             await fs.rename(tmpPath, this.cachePath);
@@ -325,6 +363,26 @@ export class ProjectKnowledgeGraph {
             console.error('Failed to save graph cache:', e);
         }
     }
+    async clearCache() {
+        this.cache = { version: '2.0', files: {} };
+        try {
+            await fs.unlink(this.cachePath);
+            console.log('[Graph] Cache cleared');
+        }
+        catch {
+            // Ignore if file doesn't exist
+        }
+    }
+    getCacheStats() {
+        const files = Object.keys(this.cache.files);
+        const totalSize = JSON.stringify(this.cache).length;
+        return {
+            fileCount: files.length,
+            totalSize: `${Math.round(totalSize / 1024)}KB`,
+            configHash: this.cache.configHash,
+            version: this.cache.version
+        };
+    }
     async getAllFiles(dir) {
         try {
             const entries = await fs.readdir(dir, { withFileTypes: true });
@@ -387,24 +445,37 @@ export class ProjectKnowledgeGraph {
         return false;
     }
     async parseFile(filePath) {
-        const ext = path.extname(filePath);
-        if (['.ts', '.js', '.tsx', '.jsx', '.mjs', '.cjs'].includes(ext)) {
-            return await this.parseTypeScript(filePath);
-        }
-        else if (ext === '.py') {
-            return await this.parsePython(filePath);
-        }
-        else if (ext === '.go') {
-            return await this.parseGo(filePath);
-        }
-        else if (ext === '.rs') {
-            return await this.parseRust(filePath);
-        }
-        else if (['.java', '.kt', '.kts'].includes(ext)) {
-            return await this.parseJavaLike(filePath);
+        try {
+            const ext = path.extname(filePath);
+            // Check file size before parsing
+            const stats = await fs.stat(filePath);
+            const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5MB
+            if (stats.size > MAX_FILE_SIZE) {
+                console.warn(`[Graph] Skipping large file: ${filePath} (${Math.round(stats.size / 1024 / 1024)}MB)`);
+                return { imports: [], symbols: [] };
+            }
+            if (['.ts', '.js', '.tsx', '.jsx', '.mjs', '.cjs'].includes(ext)) {
+                return await this.parseTypeScript(filePath);
+            }
+            else if (ext === '.py') {
+                return await this.parsePython(filePath);
+            }
+            else if (ext === '.go') {
+                return await this.parseGo(filePath);
+            }
+            else if (ext === '.rs') {
+                return await this.parseRust(filePath);
+            }
+            else if (['.java', '.kt', '.kts'].includes(ext)) {
+                return await this.parseJavaLike(filePath);
+            }
+            else {
+                return await this.parseGeneric(filePath);
+            }
         }
-        else {
-            return await this.parseGeneric(filePath);
+        catch (error) {
+            console.warn(`[Graph] Failed to parse ${filePath}:`, error instanceof Error ? error.message : String(error));
+            return { imports: [], symbols: [] };
         }
     }
     async parseTypeScript(filePath) {

package/dist/http-server.js

@@ -35,7 +35,7 @@ const PORT = process.env.PORT || 3000;
 const corsOrigin = process.env.CORS_ORIGIN;
 let corsOptions = {
     origin: false, // Default: deny all cross-origin requests
-    credentials: true,
+    credentials: false, // Must be false when origin is false
 };
 if (corsOrigin === '*') {
     console.warn('⚠️  WARNING: CORS set to allow all origins (*). This is not secure for production!');
@@ -43,6 +43,7 @@ if (corsOrigin === '*') {
 }
 else if (corsOrigin) {
     const allowedOrigins = corsOrigin.split(',').map(o => o.trim());
+    corsOptions.credentials = true; // Enable credentials for specific origins
     corsOptions.origin = function (origin, callback) {
         // Allow requests with no origin (like mobile apps, curl, Postman)
         if (!origin)
@@ -64,6 +65,39 @@ app.use(cors(corsOptions));
  */
 const bodyLimit = process.env.BODY_LIMIT || '10mb';
 app.use(express.json({ limit: bodyLimit }));
+// Request Logging Middleware
+app.use((req, res, next) => {
+    const start = Date.now();
+    res.on('finish', () => {
+        const duration = Date.now() - start;
+        console.log(`[${new Date().toISOString()}] ${req.method} ${req.path} - ${res.statusCode} (${duration}ms)`);
+    });
+    next();
+});
+// Rate Limiting Middleware
+const requestCounts = new Map();
+const RATE_LIMIT = 100; // requests per minute
+const RATE_WINDOW = 60000; // 1 minute
+app.use((req, res, next) => {
+    const clientIp = req.ip || req.connection.remoteAddress || 'unknown';
+    const now = Date.now();
+    if (!requestCounts.has(clientIp)) {
+        requestCounts.set(clientIp, []);
+    }
+    const requests = requestCounts.get(clientIp);
+    // Remove old requests
+    while (requests.length > 0 && now - requests[0] > RATE_WINDOW) {
+        requests.shift();
+    }
+    if (requests.length >= RATE_LIMIT) {
+        return res.status(429).json({
+            error: 'Rate limit exceeded',
+            retryAfter: Math.ceil((requests[0] + RATE_WINDOW - now) / 1000)
+        });
+    }
+    requests.push(now);
+    next();
+});
 // Log security configuration on startup
 console.log(`Security Configuration:`);
 console.log(`  CORS: ${corsOrigin === '*' ? 'OPEN (all origins)' : corsOrigin ? `Restricted to: ${corsOrigin}` : 'Same-origin only'}`);
@@ -108,12 +142,40 @@ const managers = ServerManagers.getInstance();
  * HEALTH & METADATA ENDPOINTS
  * ============================================================================
  */
-app.get('/health', (req, res) => {
+app.get('/health', async (req, res) => {
+    const memoryUsage = process.memoryUsage();
+    const uptime = process.uptime();
+    // Check disk space (if possible)
+    let diskInfo = null;
+    try {
+        const { execAsync } = await import('./utils.js');
+        const { stdout } = await execAsync('df -h .');
+        diskInfo = stdout.split('\n')[1]?.trim();
+    }
+    catch { }
     res.json({
         status: 'ok',
         service: 'sequential-thinking-http-wrapper',
         version: '2.0',
-        timestamp: new Date().toISOString()
+        timestamp: new Date().toISOString(),
+        system: {
+            memory: {
+                used: Math.round(memoryUsage.heapUsed / 1024 / 1024) + 'MB',
+                total: Math.round(memoryUsage.heapTotal / 1024 / 1024) + 'MB',
+                rss: Math.round(memoryUsage.rss / 1024 / 1024) + 'MB'
+            },
+            uptime: Math.floor(uptime) + 's',
+            disk: diskInfo
+        },
+        managers: {
+            thinking: {
+                historyLength: managers.thinking.getHistoryLength(),
+                currentBlock: managers.thinking.getCurrentBlock()?.id || null
+            },
+            notes: {
+                count: (await managers.notes.listNotes()).length
+            }
+        }
     });
 });
 app.get('/', (req, res) => {
@@ -225,7 +287,10 @@ app.post('/api/thinking/thought', async (req, res) => {
  */
 app.get('/api/thinking/history', async (req, res) => {
     try {
-        const history = await managers.thinking.searchHistory('');
+        const history = await managers.thinking.searchHistory('') || [];
+        if (!Array.isArray(history)) {
+            return res.status(500).json({ error: 'Invalid history data' });
+        }
         const transformedHistory = history.map((t, index) => ({
             id: `thought-${index}-${t.thoughtNumber}`,
             text: t.thought,
@@ -478,8 +543,13 @@ app.get('/api/notes', async (req, res) => {
     try {
         const tag = req.query.tag;
         const includeExpired = req.query.includeExpired === 'true';
-        const notes = await managers.notes.listNotes(tag, includeExpired);
-        const transformedNotes = notes.map(note => ({
+        const page = parseInt(req.query.page) || 1;
+        const limit = Math.min(parseInt(req.query.limit) || 20, 100); // Max 100
+        const allNotes = await managers.notes.listNotes(tag, includeExpired);
+        const total = allNotes.length;
+        const offset = (page - 1) * limit;
+        const paginatedNotes = allNotes.slice(offset, offset + limit);
+        const transformedNotes = paginatedNotes.map(note => ({
             id: note.id,
             _id: note.id,
             title: note.title,
@@ -491,7 +561,15 @@ app.get('/api/notes', async (req, res) => {
             createdAt: note.createdAt,
             updatedAt: note.updatedAt
         }));
-        res.json(transformedNotes);
+        res.json({
+            data: transformedNotes,
+            pagination: {
+                page,
+                limit,
+                total,
+                totalPages: Math.ceil(total / limit)
+            }
+        });
     }
     catch (error) {
         res.status(500).json({
@@ -981,7 +1059,8 @@ app.get('/api/admin/stats', async (req, res) => {
     }
 });
 // Start server
-app.listen(PORT, () => {
+let isShuttingDown = false;
+const server = app.listen(PORT, () => {
     console.log(`Sequential Thinking HTTP Server running on port ${PORT}`);
     console.log(`Health check: http://localhost:${PORT}/health`);
     console.log(`API docs: http://localhost:${PORT}/`);
@@ -990,3 +1069,32 @@ app.listen(PORT, () => {
     console.log('This server uses in-memory storage. Do NOT run in cluster mode');
     console.log('without external storage (Redis/PostgreSQL) for data persistence.');
 });
+async function gracefulShutdown(signal) {
+    if (isShuttingDown)
+        return;
+    isShuttingDown = true;
+    console.log(`\n[${signal}] Starting graceful shutdown...`);
+    // Stop accepting new connections
+    server.close(async () => {
+        console.log('[Shutdown] HTTP server closed');
+        // Save all data
+        try {
+            await managers.thinking.gracefulShutdown?.();
+            await managers.notes.save?.(); // Assuming save exists or will fail safely
+            await managers.codeDb.save?.();
+            console.log('[Shutdown] All data saved');
+        }
+        catch (error) {
+            console.error('[Shutdown] Error saving data:', error);
+        }
+        console.log('[Shutdown] Complete');
+        process.exit(0);
+    });
+    // Force shutdown after 10 seconds
+    setTimeout(() => {
+        console.error('[Shutdown] Forced exit after timeout');
+        process.exit(1);
+    }, 10000);
+}
+process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));

package/dist/lib.d.ts

@@ -40,7 +40,8 @@ export declare class SequentialThinkingServer {
     private confidenceScore;
     private contextManager;
     private ruleManager;
-    constructor(storagePath?: string, delayMs?: number);
+    private maxHistorySize;
+    constructor(storagePath?: string, delayMs?: number, maxHistorySize?: number);
     private loadHistory;
     private attemptRecovery;
     private rebuildBlocks;
@@ -72,6 +73,7 @@ export declare class SequentialThinkingServer {
         thoughtCount: number;
     }[];
     getHistoryLength(): number;
+    gracefulShutdown(): Promise<void>;
     private learnFromFailures;
 }
 export {};

package/dist/lib.js

@@ -19,7 +19,9 @@ export class SequentialThinkingServer {
     confidenceScore = 100; // Meta-Cognition Score (0-100)
     contextManager = new ContextManager();
     ruleManager = new RuleManager();
-    constructor(storagePath = 'thoughts_history.json', delayMs = 0) {
+    maxHistorySize;
+    constructor(storagePath = 'thoughts_history.json', delayMs = 0, maxHistorySize = 1000) {
+        this.maxHistorySize = maxHistorySize;
         this.disableThoughtLogging = (process.env.DISABLE_THOUGHT_LOGGING || "").toLowerCase() === "true";
         this.storagePath = path.resolve(storagePath);
         this.solutionsDbPath = path.resolve(path.dirname(this.storagePath), 'solutions_db.json');
@@ -190,7 +192,13 @@ export class SequentialThinkingServer {
             try {
                 // Auto-Pruning: Keep max 100 thoughts, summarize older blocks
                 if (this.thoughtHistory.length > 100) {
-                    this.autoPrune();
+                    try {
+                        this.autoPrune();
+                    }
+                    catch (pruneError) {
+                        console.error('[AutoPrune] Failed:', pruneError);
+                        // Continue saving without pruning
+                    }
                 }
                 const storage = {
                     version: '2.0',
@@ -199,10 +207,21 @@ export class SequentialThinkingServer {
                 };
                 const tmpPath = `${this.storagePath}.tmp`;
                 await fs.writeFile(tmpPath, JSON.stringify(storage, null, 2), 'utf-8');
+                // Verify file was written correctly
+                const stats = await fs.stat(tmpPath);
+                if (stats.size === 0) {
+                    throw new Error('Temporary file is empty after write');
+                }
                 await fs.rename(tmpPath, this.storagePath);
             }
             catch (error) {
                 console.error(`Error saving history to ${this.storagePath}:`, error);
+                // Cleanup temp file if exists
+                try {
+                    await fs.unlink(`${this.storagePath}.tmp`);
+                }
+                catch { }
+                throw error; // Re-throw to let caller know
             }
         });
     }
@@ -331,6 +350,12 @@ export class SequentialThinkingServer {
         if (input.thoughtNumber > input.totalThoughts) {
             input.totalThoughts = input.thoughtNumber;
         }
+        // Enforce max history size
+        if (this.thoughtHistory.length >= this.maxHistorySize) {
+            const removeCount = this.thoughtHistory.length - this.maxHistorySize + 1;
+            this.thoughtHistory.splice(0, removeCount);
+            console.warn(`[Memory] Removed ${removeCount} old thoughts to maintain limit of ${this.maxHistorySize}`);
+        }
         this.thoughtHistory.push(input);
         if (input.branchFromThought && input.branchId) {
             const branchKey = `${input.branchFromThought}-${input.branchId}`;
@@ -671,8 +696,9 @@ ${typeof wrappedThought === 'string' && wrappedThought.startsWith('│') ? wrapp
                 this.consecutiveStallCount = 0;
             }
             // --- 📊 Update Confidence Score ---
-            if (warnings.length > 0)
-                this.confidenceScore -= (5 * warnings.length);
+            if (warnings.length > 0) {
+                this.confidenceScore = Math.max(0, this.confidenceScore - (5 * warnings.length));
+            }
             if (input.thoughtType === 'reflexion') {
                 this.confidenceScore = Math.min(100, this.confidenceScore + 10);
             }
@@ -819,6 +845,16 @@ ${typeof wrappedThought === 'string' && wrappedThought.startsWith('│') ? wrapp
     getHistoryLength() {
         return this.thoughtHistory.length;
     }
+    async gracefulShutdown() {
+        console.log('[Shutdown] Saving thought history...');
+        try {
+            await this.saveHistory();
+            console.log('[Shutdown] History saved successfully');
+        }
+        catch (error) {
+            console.error('[Shutdown] Failed to save history:', error);
+        }
+    }
     async learnFromFailures(blockId) {
         const blockThoughts = this.thoughtHistory.filter(t => t.blockId === blockId);
         for (let i = 0; i < blockThoughts.length - 1; i++) {

package/dist/notes.d.ts

@@ -33,7 +33,7 @@ export declare class NotesManager {
      * Atomic save using write-to-temp + rename pattern.
      * This ensures either the old file or new file exists, never a partial write.
      */
-    private save;
+    save(): Promise<void>;
     /**
      * Reload notes from disk (useful for external changes)
      */

package/dist/tools/coding.js

@@ -93,6 +93,17 @@ export function registerCodingTools(server, graph) {
     }, async ({ path: filePath, oldText, newText, reasoning, runTest }) => {
         try {
             const absolutePath = validatePath(filePath);
+            const stats = await fs.stat(absolutePath);
+            const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
+            if (stats.size > MAX_FILE_SIZE) {
+                return {
+                    content: [{
+                            type: "text",
+                            text: `Error: File size (${Math.round(stats.size / 1024 / 1024)}MB) exceeds maximum allowed (${MAX_FILE_SIZE / 1024 / 1024}MB)`
+                        }],
+                    isError: true
+                };
+            }
             const content = await fs.readFile(absolutePath, 'utf-8');
             if (!content.includes(oldText)) {
                 return { content: [{ type: "text", text: "Error: Target text not found. Ensure exact match including whitespace." }], isError: true };
@@ -159,10 +170,16 @@ export function registerCodingTools(server, graph) {
                 }
             }
             // -------------------------------------
+            // Cleanup backup file after successful edit (keep only last 10)
+            await cleanupBackups(path.dirname(absolutePath), 10);
+            try {
+                await fs.unlink(backupPath);
+            }
+            catch { }
             return {
                 content: [{
                         type: "text",
-                        text: `Successfully applied edit to ${filePath}.\nReasoning verified: ${reasoning}\n(Backup created at ${backupPath})`
+                        text: `Successfully applied edit to ${filePath}.\nReasoning verified: ${reasoning}`
                     }]
             };
         }
@@ -171,3 +188,28 @@ export function registerCodingTools(server, graph) {
         }
     });
 }
+async function cleanupBackups(dir, maxBackups = 10) {
+    try {
+        const files = await fs.readdir(dir);
+        const backupFiles = await Promise.all(files
+            .filter(f => f.endsWith('.bak'))
+            .map(async (f) => ({
+            name: f,
+            path: path.join(dir, f),
+            stat: await fs.stat(path.join(dir, f))
+        })));
+        // Sort by mtime (newest first)
+        const sortedBackups = backupFiles.sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs);
+        // Remove old backups
+        for (let i = maxBackups; i < sortedBackups.length; i++) {
+            try {
+                await fs.unlink(sortedBackups[i].path);
+                console.log(`[Backup] Cleaned up old backup: ${sortedBackups[i].name}`);
+            }
+            catch { }
+        }
+    }
+    catch {
+        // Ignore cleanup errors
+    }
+}

package/dist/tools/web.d.ts

@@ -1,3 +1,3 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-export declare function scrapeWebpage(url: string): Promise<string>;
+export declare function scrapeWebpage(url: string, timeoutMs?: number): Promise<string>;
 export declare function registerWebTools(server: McpServer): void;

package/dist/tools/web.js

@@ -3,65 +3,100 @@ import { fetchWithRetry, validatePublicUrl } from "../utils.js";
 import { JSDOM } from 'jsdom';
 import { Readability } from '@mozilla/readability';
 import TurndownService from 'turndown';
-export async function scrapeWebpage(url) {
+class SearchRateLimiter {
+    requests = new Map(); // provider -> timestamps[]
+    limits = {
+        brave: { requests: 100, windowMs: 60000 }, // 100/min
+        exa: { requests: 50, windowMs: 60000 }, // 50/min
+        google: { requests: 100, windowMs: 60000 }, // 100/min
+        duckduckgo: { requests: 30, windowMs: 60000 } // 30/min (be nice to DDG)
+    };
+    canProceed(provider) {
+        const limit = this.limits[provider];
+        if (!limit)
+            return true;
+        const now = Date.now();
+        const timestamps = this.requests.get(provider) || [];
+        // Remove old requests outside window
+        const validTimestamps = timestamps.filter((t) => now - t < limit.windowMs);
+        this.requests.set(provider, validTimestamps);
+        return validTimestamps.length < limit.requests;
+    }
+    recordRequest(provider) {
+        const timestamps = this.requests.get(provider) || [];
+        timestamps.push(Date.now());
+        this.requests.set(provider, timestamps);
+    }
+}
+const rateLimiter = new SearchRateLimiter();
+export async function scrapeWebpage(url, timeoutMs = 30000) {
     await validatePublicUrl(url);
-    const response = await fetchWithRetry(url);
-    const html = await response.text();
-    const doc = new JSDOM(html, { url });
-    const reader = new Readability(doc.window.document);
-    const article = reader.parse();
-    if (!article)
-        throw new Error("Could not parse article content");
-    const turndownService = new TurndownService({
-        headingStyle: 'atx',
-        codeBlockStyle: 'fenced'
-    });
-    // Custom Rule for GitHub Flavored Markdown Tables
-    turndownService.addRule('tables', {
-        filter: ['table'],
-        replacement: function (content, node) {
-            const rows = [];
-            const table = node;
-            const trs = Array.from(table.querySelectorAll('tr'));
-            trs.forEach((tr, index) => {
-                const cols = [];
-                const tds = Array.from(tr.querySelectorAll('th, td'));
-                tds.forEach(td => {
-                    // Clean content: remove newlines and pipe characters
-                    cols.push(td.textContent?.replace(/[\n\r]/g, ' ').replace(/\|/g, '\\|').trim() || "");
-                });
-                if (cols.length > 0) {
-                    rows.push(`| ${cols.join(' | ')} |`);
-                    // Add separator after header
-                    if (index === 0 || tr.querySelector('th')) {
-                        rows.push(`| ${cols.map(() => '---').join(' | ')} |`);
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchWithRetry(url, {
+            signal: controller.signal
+        });
+        const html = await response.text();
+        const doc = new JSDOM(html, { url });
+        const reader = new Readability(doc.window.document);
+        const article = reader.parse();
+        if (!article)
+            throw new Error("Could not parse article content");
+        const turndownService = new TurndownService({
+            headingStyle: 'atx',
+            codeBlockStyle: 'fenced'
+        });
+        // Custom Rule for GitHub Flavored Markdown Tables
+        turndownService.addRule('tables', {
+            filter: ['table'],
+            replacement: function (content, node) {
+                const rows = [];
+                const table = node;
+                const trs = Array.from(table.querySelectorAll('tr'));
+                trs.forEach((tr, index) => {
+                    const cols = [];
+                    const tds = Array.from(tr.querySelectorAll('th, td'));
+                    tds.forEach(td => {
+                        // Clean content: remove newlines and pipe characters
+                        cols.push(td.textContent?.replace(/[\n\r]/g, ' ').replace(/\|/g, '\\|').trim() || "");
+                    });
+                    if (cols.length > 0) {
+                        rows.push(`| ${cols.join(' | ')} |`);
+                        // Add separator after header
+                        if (index === 0 || tr.querySelector('th')) {
+                            rows.push(`| ${cols.map(() => '---').join(' | ')} |`);
+                        }
                     }
-                }
-            });
-            // Filter out duplicate separator lines if any
-            const uniqueRows = rows.filter((row, i) => {
-                if (row.includes('---') && rows[i - 1]?.includes('---'))
-                    return false;
-                return true;
-            });
-            return '\n\n' + uniqueRows.join('\n') + '\n\n';
+                });
+                // Filter out duplicate separator lines if any
+                const uniqueRows = rows.filter((row, i) => {
+                    if (row.includes('---') && rows[i - 1]?.includes('---'))
+                        return false;
+                    return true;
+                });
+                return '\n\n' + uniqueRows.join('\n') + '\n\n';
+            }
+        });
+        let markdown = turndownService.turndown(article.content || "");
+        if (markdown.length > 20000) {
+            markdown = markdown.substring(0, 20000) + "\n...(truncated)";
         }
-    });
-    let markdown = turndownService.turndown(article.content || "");
-    if (markdown.length > 20000) {
-        markdown = markdown.substring(0, 20000) + "\n...(truncated)";
+        return `Title: ${article.title}\n\n${markdown}`;
+    }
+    finally {
+        clearTimeout(timeoutId);
     }
-    return `Title: ${article.title}\n\n${markdown}`;
 }
 export function registerWebTools(server) {
     // 1. web_search
     server.tool("web_search", "Search the web using Brave or Exa APIs (requires API keys in environment variables: BRAVE_API_KEY or EXA_API_KEY).", {
         query: z.string().min(1).describe("The search query"),
-        provider: z.enum(['brave', 'exa', 'google']).optional().describe("Preferred search provider")
+        provider: z.enum(['brave', 'exa', 'google', 'duckduckgo']).optional().describe("Preferred search provider")
     }, async ({ query, provider }) => {
         const errors = [];
         // 1. Identify available providers
-        const availableProviders = [];
+        const availableProviders = ['duckduckgo']; // Always available (HTML scraping)
         if (process.env.BRAVE_API_KEY)
             availableProviders.push('brave');
         if (process.env.EXA_API_KEY)
@@ -91,7 +126,45 @@ export function registerWebTools(server) {
         // Default priority if no preference: Brave > Exa > Google (Already respected by push order if mapped correctly, but let's be explicit if needed. Here they are added in that order.)
         // 3. Try providers sequentially
         for (const currentProvider of attemptOrder) {
+            if (!rateLimiter.canProceed(currentProvider)) {
+                errors.push(`[${currentProvider}] Rate limit exceeded`);
+                continue;
+            }
+            rateLimiter.recordRequest(currentProvider);
             try {
+                if (currentProvider === 'duckduckgo') {
+                    try {
+                        // DuckDuckGo HTML interface (no API key required)
+                        const response = await fetchWithRetry(`https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`, {
+                            headers: {
+                                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
+                            }
+                        });
+                        if (!response.ok)
+                            throw new Error(`DuckDuckGo Status ${response.status}`);
+                        const html = await response.text();
+                        // Simple regex extraction (in production, use proper HTML parser)
+                        const results = [];
+                        const resultRegex = /<a[^>]*class="result__a"[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>/g;
+                        let match;
+                        while ((match = resultRegex.exec(html)) !== null && results.length < 5) {
+                            results.push({
+                                title: match[2].replace(/<[^>]*>/g, ''), // Strip HTML tags
+                                url: match[1],
+                                snippet: ''
+                            });
+                        }
+                        return {
+                            content: [{
+                                    type: "text",
+                                    text: JSON.stringify(results, null, 2)
+                                }]
+                        };
+                    }
+                    catch (error) {
+                        throw error; // Let outer loop handle it
+                    }
+                }
                 if (currentProvider === 'brave') {
                     const response = await fetchWithRetry(`https://api.search.brave.com/res/v1/web/search?q=${encodeURIComponent(query)}&count=5`, {
                         headers: {

package/dist/utils.d.ts

@@ -51,4 +51,13 @@ export declare const DEFAULT_HEADERS: {
     'Accept-Language': string;
 };
 export declare function fetchWithRetry(url: string, options?: any, retries?: number, backoff?: number): Promise<Response>;
+export declare function withRetry(fn: () => Promise<any>, maxRetries?: number, baseDelay?: number): Promise<any>;
+export declare class FileLock {
+    locks: Map<any, any>;
+    acquire(filePath: string, timeout?: number): Promise<{
+        release: () => void;
+    }>;
+}
+export declare const fileLock: FileLock;
+export declare function sanitizeInput(input: any, maxLength?: number): string;
 export {};

package/dist/utils.js

@@ -9,7 +9,7 @@ import chalk from 'chalk';
  * Shell metacharacters that could enable command injection
  * Blocking these prevents command chaining like: cmd; rm -rf /
  */
-const SHELL_METACHARACTERS = /[;|&`$()<>]/u;
+const SHELL_METACHARACTERS = /[;|&`$()<>\{\}\[\]\*\?~]|\$\{[^}]*\}|\\x[0-9a-fA-F]{2}|\$[a-zA-Z_][a-zA-Z0-9_]*/gu;
 /**
  * Whitelist of safe commands that can be executed
  * Commands must be explicitly allowed for security
@@ -118,6 +118,13 @@ function validateCommand(command) {
         new RegExp('chown\\s+-R\\s+root:'), // Recursive ownership change
         new RegExp('fdisk'), // Partition tools
         new RegExp('>\\s*/dev/\\w+\\s*\\+w'), // Write to device
+        // New patterns:
+        new RegExp('curl\\s+.*\\s*\\|\\s*sh'), // curl | sh
+        new RegExp('wget\\s+.*\\s*\\|\\s*sh'), // wget | sh
+        new RegExp('base64\\s+-d\\s*\\|'), // encoded commands
+        new RegExp('eval\\s*\\('), // eval()
+        new RegExp('\\$\\(\\(.*\\)\\)'), // $() command substitution
+        new RegExp('`.*`'), // backtick substitution
     ];
     for (const pattern of dangerousPatterns) {
         if (pattern.test(command)) {
@@ -418,3 +425,59 @@ export async function fetchWithRetry(url, options = {}, retries = 3, backoff = 1
         throw error;
     }
 }
+export async function withRetry(fn, maxRetries = 3, baseDelay = 100) {
+    let lastError;
+    for (let i = 0; i < maxRetries; i++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            lastError = error;
+            // Don't retry on certain errors
+            if (error.code === 'ENOENT' || error.code === 'EACCES' || error.code === 'EPERM') {
+                throw error;
+            }
+            if (i < maxRetries - 1) {
+                const delay = baseDelay * Math.pow(2, i);
+                console.warn(`[Retry] Attempt ${i + 1} failed, retrying in ${delay}ms...`);
+                await new Promise(resolve => setTimeout(resolve, delay));
+            }
+        }
+    }
+    throw lastError;
+}
+export class FileLock {
+    locks = new Map();
+    async acquire(filePath, timeout = 5000) {
+        const startTime = Date.now();
+        while (this.locks.has(filePath)) {
+            if (Date.now() - startTime > timeout) {
+                throw new Error(`Timeout acquiring lock for ${filePath}`);
+            }
+            await new Promise(resolve => setTimeout(resolve, 10));
+        }
+        this.locks.set(filePath, true);
+        return {
+            release: () => {
+                this.locks.delete(filePath);
+            }
+        };
+    }
+}
+export const fileLock = new FileLock();
+export function sanitizeInput(input, maxLength = 10000) {
+    if (typeof input !== 'string') {
+        return '';
+    }
+    // Trim whitespace
+    let sanitized = input.trim();
+    // Limit length
+    if (sanitized.length > maxLength) {
+        sanitized = sanitized.substring(0, maxLength);
+    }
+    // Remove null bytes
+    sanitized = sanitized.replace(/\x00/g, '');
+    // Normalize unicode (prevent homograph attacks)
+    sanitized = sanitized.normalize('NFC');
+    return sanitized;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotza02/sequential-thinking",
-  "version": "10000.0.6",
+  "version": "10000.0.7",
   "publishConfig": {
     "access": "public"
   },