@hasna/oldpal 0.4.0 → 0.4.1

package/dist/config/settings.json

@@ -18,11 +18,26 @@
     }
   },
   "connectors": [
-    "notion",
-    "googledrive",
+    "anthropic",
+    "brandsight",
+    "clickbank",
+    "cloudflare",
+    "discord",
     "gmail",
     "googlecalendar",
+    "googlecontacts",
+    "googledrive",
     "linear",
-    "slack"
+    "maropost",
+    "mercury",
+    "mistral",
+    "notion",
+    "openai",
+    "perplexity",
+    "sedo",
+    "slack",
+    "x",
+    "xai",
+    "zendesk"
   ]
 }

package/dist/index.js

@@ -20451,10 +20451,10 @@ __export(exports_anthropic, {
   AnthropicClient: () => AnthropicClient
 });
 import { readFileSync as readFileSync2, existsSync as existsSync5 } from "fs";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { join as join7 } from "path";
 function loadApiKeyFromSecrets() {
-  const secretsPath = join7(homedir6(), ".secrets");
+  const secretsPath = join7(homedir7(), ".secrets");
   if (existsSync5(secretsPath)) {
     try {
       const content = readFileSync2(secretsPath, "utf-8");
@@ -28328,6 +28328,25 @@ var getInstance = (stdout, createInstance) => {
 };
 // node_modules/.pnpm/ink@5.2.1_@types+react@18.3.27_react-devtools-core@4.28.5_react@18.3.1/node_modules/ink/build/components/Static.js
 var import_react11 = __toESM(require_react(), 1);
+function Static(props) {
+  const { items, children: render2, style: customStyle } = props;
+  const [index, setIndex] = import_react11.useState(0);
+  const itemsToRender = import_react11.useMemo(() => {
+    return items.slice(index);
+  }, [items, index]);
+  import_react11.useLayoutEffect(() => {
+    setIndex(items.length);
+  }, [items.length]);
+  const children = itemsToRender.map((item, itemIndex) => {
+    return render2(item, index + itemIndex);
+  });
+  const style = import_react11.useMemo(() => ({
+    position: "absolute",
+    flexDirection: "column",
+    ...customStyle
+  }), [customStyle]);
+  return import_react11.default.createElement("ink-box", { internal_static: true, style }, children);
+}
 // node_modules/.pnpm/ink@5.2.1_@types+react@18.3.27_react-devtools-core@4.28.5_react@18.3.1/node_modules/ink/build/components/Transform.js
 var import_react12 = __toESM(require_react(), 1);
 // node_modules/.pnpm/ink@5.2.1_@types+react@18.3.27_react-devtools-core@4.28.5_react@18.3.1/node_modules/ink/build/components/Newline.js
@@ -28973,13 +28992,13 @@ class ConnectorBridge {
 class BashTool {
   static tool = {
     name: "bash",
-    description: "Execute a shell command. Use for system operations, running scripts, git commands, etc.",
+    description: "Execute a shell command. RESTRICTED to read-only operations: ls, cat, grep, find, git status/log/diff, pwd, which, echo. Cannot modify files, install packages, or run destructive commands.",
     parameters: {
       type: "object",
       properties: {
         command: {
           type: "string",
-          description: "The shell command to execute"
+          description: "The shell command to execute (read-only commands only)"
         },
         cwd: {
           type: "string",
@@ -28987,29 +29006,111 @@ class BashTool {
         },
         timeout: {
           type: "number",
-          description: "Timeout in milliseconds (default: 120000)"
+          description: "Timeout in milliseconds (default: 30000)"
         }
       },
       required: ["command"]
     }
   };
+  static ALLOWED_COMMANDS = [
+    "cat",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "ls",
+    "tree",
+    "find",
+    "locate",
+    "grep",
+    "rg",
+    "ag",
+    "ack",
+    "wc",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "pwd",
+    "whoami",
+    "date",
+    "which",
+    "where",
+    "type",
+    "env",
+    "printenv",
+    "echo",
+    "git status",
+    "git log",
+    "git diff",
+    "git branch",
+    "git show",
+    "git remote",
+    "git tag",
+    "connect-",
+    "node --version",
+    "bun --version",
+    "npm --version",
+    "pnpm --version"
+  ];
+  static BLOCKED_PATTERNS = [
+    /\brm\b/,
+    /\brmdir\b/,
+    /\bunlink\b/,
+    /\bmv\b/,
+    /\bcp\b/,
+    /\bchmod\b/,
+    /\bchown\b/,
+    /\bchgrp\b/,
+    /\bsudo\b/,
+    /\bsu\b/,
+    /\bdoas\b/,
+    /\bnpm\s+(install|i|add|ci)\b/,
+    /\bpnpm\s+(install|i|add)\b/,
+    /\byarn\s+(install|add)\b/,
+    /\bbun\s+(install|add|i)\b/,
+    /\bpip\s+install\b/,
+    /\bpip3\s+install\b/,
+    /\bbrew\s+install\b/,
+    /\bapt\s+install\b/,
+    /\bapt-get\s+install\b/,
+    /\bgit\s+(push|commit|checkout|reset|rebase|merge|pull|stash|cherry-pick|revert)\b/,
+    /\bgit\s+add\b/,
+    /\|\s*(bash|sh|zsh|fish)\b/,
+    /curl.*\|\s*(bash|sh)/,
+    /wget.*\|\s*(bash|sh)/,
+    />\s*[^|]/,
+    />>/,
+    /\bkill\b/,
+    /\bpkill\b/,
+    /\bkillall\b/,
+    /\bmkfs\b/,
+    /\bdd\b/,
+    /\bfdisk\b/,
+    /\bparted\b/,
+    /\bnc\s+-l/,
+    /\bnetcat\s+-l/,
+    /\bvim?\b/,
+    /\bnano\b/,
+    /\bemacs\b/,
+    /\bmake\b/,
+    /\bcmake\b/,
+    /\bdocker\s+(run|exec|build|push)\b/
+  ];
   static executor = async (input) => {
     const command = input.command;
     const cwd2 = input.cwd || process.cwd();
-    const timeout = input.timeout || 120000;
-    const dangerousPatterns = [
-      /rm\s+-rf\s+[\/~]/i,
-      /rm\s+-rf\s+\*/i,
-      /mkfs/i,
-      /dd\s+if=/i,
-      />\s*\/dev\/sd/i,
-      /chmod\s+-R\s+777\s+\//i
-    ];
-    for (const pattern of dangerousPatterns) {
+    const timeout = input.timeout || 30000;
+    for (const pattern of this.BLOCKED_PATTERNS) {
       if (pattern.test(command)) {
-        return `Error: This command appears dangerous and was blocked for safety.`;
+        return `Error: This command is not allowed. Only read-only commands are permitted (ls, cat, grep, find, git status/log/diff, etc.)`;
       }
     }
+    const commandTrimmed = command.trim().toLowerCase();
+    const isAllowed = this.ALLOWED_COMMANDS.some((allowed) => commandTrimmed.startsWith(allowed.toLowerCase()));
+    if (!isAllowed) {
+      return `Error: Command not in allowed list. Permitted commands: cat, head, tail, ls, find, grep, wc, file, stat, pwd, which, echo, git status/log/diff/branch/show, connect-*`;
+    }
     try {
       const proc = Bun.spawn(["bash", "-c", command], {
         cwd: cwd2,
@@ -29038,15 +29139,31 @@ ${stderr || stdout}`.trim();
 
 // packages/core/src/tools/filesystem.ts
 import { join as join2, resolve, dirname } from "path";
+import { homedir as homedir2 } from "os";
 var {Glob } = globalThis.Bun;
+var currentSessionId = "default";
+function getTempFolder() {
+  return join2(homedir2(), ".oldpal", "temp", currentSessionId);
+}
+function isInTempFolder(path) {
+  const tempFolder = getTempFolder();
+  const resolved = resolve(path);
+  return resolved.startsWith(tempFolder);
+}
 
 class FilesystemTools {
-  static registerAll(registry) {
+  static registerAll(registry, sessionId) {
+    if (sessionId) {
+      currentSessionId = sessionId;
+    }
     registry.register(this.readTool, this.readExecutor);
     registry.register(this.writeTool, this.writeExecutor);
     registry.register(this.globTool, this.globExecutor);
     registry.register(this.grepTool, this.grepExecutor);
   }
+  static setSessionId(sessionId) {
+    currentSessionId = sessionId;
+  }
   static readTool = {
     name: "read",
     description: "Read the contents of a file",
@@ -29093,30 +29210,38 @@ class FilesystemTools {
   };
   static writeTool = {
     name: "write",
-    description: "Write content to a file (creates or overwrites)",
+    description: "Write content to a file. RESTRICTED: Can only write to ~/.oldpal/temp/{session}/ folder. Provide just the filename and it will be saved to the temp folder.",
     parameters: {
       type: "object",
       properties: {
-        path: {
+        filename: {
           type: "string",
-          description: "The file path to write to"
+          description: "The filename to write to (will be saved in temp folder)"
         },
         content: {
           type: "string",
           description: "The content to write"
         }
       },
-      required: ["path", "content"]
+      required: ["filename", "content"]
     }
   };
   static writeExecutor = async (input) => {
-    const path = resolve(process.cwd(), input.path);
+    const filename = input.filename || input.path;
     const content = input.content;
+    const tempFolder = getTempFolder();
+    const sanitizedFilename = filename.replace(/\.\./g, "").replace(/^\/+/, "");
+    const path = join2(tempFolder, sanitizedFilename);
+    if (!isInTempFolder(path)) {
+      return `Error: Cannot write outside temp folder. Files are saved to ${tempFolder}`;
+    }
     try {
       const dir = dirname(path);
       await Bun.$`mkdir -p ${dir}`.quiet();
       await Bun.write(path, content);
-      return `Successfully wrote ${content.length} characters to ${path}`;
+      return `Successfully wrote ${content.length} characters to ${path}
+
+You can review and copy this file to your project if needed.`;
     } catch (error) {
       return `Error: ${error instanceof Error ? error.message : String(error)}`;
     }
@@ -29506,11 +29631,11 @@ class WebTools {
 import { existsSync as existsSync2, writeFileSync, unlinkSync } from "fs";
 import { tmpdir } from "os";
 import { join as join3 } from "path";
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 async function getViuPath() {
   const locations = [
     "viu",
-    join3(homedir2(), ".cargo", "bin", "viu"),
+    join3(homedir3(), ".cargo", "bin", "viu"),
     "/usr/local/bin/viu",
     "/opt/homebrew/bin/viu"
   ];
@@ -29621,12 +29746,12 @@ class ImageTools {
 
 // packages/core/src/skills/loader.ts
 import { join as join4 } from "path";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 var {Glob: Glob2 } = globalThis.Bun;
 class SkillLoader {
   skills = new Map;
   async loadAll(projectDir = process.cwd()) {
-    const userSkillsDir = join4(homedir3(), ".oldpal", "skills");
+    const userSkillsDir = join4(homedir4(), ".oldpal", "skills");
     await this.loadFromDirectory(userSkillsDir);
     const projectSkillsDir = join4(projectDir, ".oldpal", "skills");
     await this.loadFromDirectory(projectSkillsDir);
@@ -29921,7 +30046,7 @@ class HookExecutor {
 // packages/core/src/commands/loader.ts
 import { existsSync as existsSync3, readdirSync, statSync } from "fs";
 import { join as join5, basename, extname } from "path";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 
 class CommandLoader {
   commands = new Map;
@@ -29931,7 +30056,7 @@ class CommandLoader {
   }
   async loadAll() {
     this.commands.clear();
-    const globalDir = join5(homedir4(), ".oldpal", "commands");
+    const globalDir = join5(homedir5(), ".oldpal", "commands");
     await this.loadFromDirectory(globalDir, "global");
     const projectDir = join5(this.cwd, ".oldpal", "commands");
     await this.loadFromDirectory(projectDir, "project");
@@ -30120,7 +30245,7 @@ ${stderr}`;
 }
 // packages/core/src/commands/builtin.ts
 import { join as join6 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 import { existsSync as existsSync4, mkdirSync, writeFileSync as writeFileSync2 } from "fs";
 
 class BuiltinCommands {
@@ -30407,7 +30532,7 @@ Format the summary as a brief bullet-point list. This summary will replace the c
       handler: async (args, context) => {
         const configPaths = [
           join6(context.cwd, ".oldpal", "config.json"),
-          join6(homedir5(), ".oldpal", "config.json")
+          join6(homedir6(), ".oldpal", "config.json")
         ];
         let message = `
 **Configuration**
@@ -30425,7 +30550,7 @@ Format the summary as a brief bullet-point list. This summary will replace the c
 `;
         message += `  - Project: ${join6(context.cwd, ".oldpal", "commands")}
 `;
-        message += `  - Global: ${join6(homedir5(), ".oldpal", "commands")}
+        message += `  - Global: ${join6(homedir6(), ".oldpal", "commands")}
 `;
         context.emit("text", message);
         context.emit("done");
@@ -30647,7 +30772,7 @@ async function createLLMClient(config) {
 
 // packages/core/src/config.ts
 import { join as join8 } from "path";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir8 } from "os";
 var DEFAULT_CONFIG = {
   llm: {
     provider: "anthropic",
@@ -30677,7 +30802,7 @@ var DEFAULT_CONFIG = {
   ]
 };
 function getConfigDir() {
-  return join8(homedir7(), ".oldpal");
+  return join8(homedir8(), ".oldpal");
 }
 function getConfigPath(filename) {
   return join8(getConfigDir(), filename);
@@ -30749,14 +30874,19 @@ async function loadJsonFile(path) {
     return null;
   }
 }
-async function ensureConfigDir() {
+async function ensureConfigDir(sessionId) {
   const { mkdir } = await import("fs/promises");
   const configDir = getConfigDir();
-  await Promise.all([
+  const dirs = [
     mkdir(configDir, { recursive: true }),
     mkdir(join8(configDir, "sessions"), { recursive: true }),
-    mkdir(join8(configDir, "skills"), { recursive: true })
-  ]);
+    mkdir(join8(configDir, "skills"), { recursive: true }),
+    mkdir(join8(configDir, "temp"), { recursive: true })
+  ];
+  if (sessionId) {
+    dirs.push(mkdir(join8(configDir, "temp", sessionId), { recursive: true }));
+  }
+  await Promise.all(dirs);
 }
 async function loadSystemPrompt(cwd2 = process.cwd()) {
   const prompts = [];
@@ -30834,7 +30964,7 @@ class AgentLoop {
   async initialize() {
     const [config] = await Promise.all([
       loadConfig(this.cwd),
-      ensureConfigDir()
+      ensureConfigDir(this.sessionId)
     ]);
     this.config = config;
     const [, , , hooksConfig, systemPrompt] = await Promise.all([
@@ -30848,7 +30978,7 @@ class AgentLoop {
       this.commandLoader.loadAll()
     ]);
     this.toolRegistry.register(BashTool.tool, BashTool.executor);
-    FilesystemTools.registerAll(this.toolRegistry);
+    FilesystemTools.registerAll(this.toolRegistry, this.sessionId);
     WebTools.registerAll(this.toolRegistry);
     ImageTools.registerAll(this.toolRegistry);
     this.connectorBridge.registerAll(this.toolRegistry);
@@ -31060,7 +31190,7 @@ init_anthropic();
 // packages/core/src/logger.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, appendFileSync } from "fs";
 import { join as join9 } from "path";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 
 class Logger {
   logDir;
@@ -31068,7 +31198,7 @@ class Logger {
   sessionId;
   constructor(sessionId) {
     this.sessionId = sessionId;
-    this.logDir = join9(homedir8(), ".oldpal", "logs");
+    this.logDir = join9(homedir9(), ".oldpal", "logs");
     this.ensureDir(this.logDir);
     const date = new Date().toISOString().split("T")[0];
     this.logFile = join9(this.logDir, `${date}.log`);
@@ -31114,7 +31244,7 @@ class SessionStorage {
   sessionId;
   constructor(sessionId) {
     this.sessionId = sessionId;
-    this.sessionsDir = join9(homedir8(), ".oldpal", "sessions");
+    this.sessionsDir = join9(homedir9(), ".oldpal", "sessions");
     this.ensureDir(this.sessionsDir);
     this.sessionFile = join9(this.sessionsDir, `${sessionId}.json`);
   }
@@ -31133,7 +31263,7 @@ class SessionStorage {
   }
 }
 function initOldpalDir() {
-  const baseDir = join9(homedir8(), ".oldpal");
+  const baseDir = join9(homedir9(), ".oldpal");
   const dirs = [
     baseDir,
     join9(baseDir, "sessions"),
@@ -31579,19 +31709,28 @@ function Messages4({
   const startIndex = Math.max(0, endIndex - maxVisible);
   const visibleMessages = messages.slice(startIndex, endIndex);
   const groupedMessages = groupConsecutiveToolMessages(visibleMessages);
+  const historicalItems = groupedMessages.map((group) => {
+    if (group.type === "single") {
+      return { id: group.message.id, group };
+    }
+    return { id: group.messages[0].id, group };
+  });
   return /* @__PURE__ */ jsx_dev_runtime3.jsxDEV(Box_default, {
     flexDirection: "column",
     children: [
-      groupedMessages.map((group) => {
-        if (group.type === "single") {
-          return /* @__PURE__ */ jsx_dev_runtime3.jsxDEV(MessageBubble, {
-            message: group.message
-          }, group.message.id, false, undefined, this);
-        }
-        return /* @__PURE__ */ jsx_dev_runtime3.jsxDEV(CombinedToolMessage, {
-          messages: group.messages
-        }, group.messages[0].id, false, undefined, this);
-      }),
+      /* @__PURE__ */ jsx_dev_runtime3.jsxDEV(Static, {
+        items: historicalItems,
+        children: (item) => {
+          if (item.group.type === "single") {
+            return /* @__PURE__ */ jsx_dev_runtime3.jsxDEV(MessageBubble, {
+              message: item.group.message
+            }, item.id, false, undefined, this);
+          }
+          return /* @__PURE__ */ jsx_dev_runtime3.jsxDEV(CombinedToolMessage, {
+            messages: item.group.messages
+          }, item.id, false, undefined, this);
+        }
+      }, undefined, false, undefined, this),
       activityLog.map((entry) => {
         if (entry.type === "text" && entry.content) {
           return /* @__PURE__ */ jsx_dev_runtime3.jsxDEV(Box_default, {
@@ -32412,8 +32551,8 @@ function App2({ cwd: cwd2 }) {
     padding: 1,
     children: [
       showWelcome && /* @__PURE__ */ jsx_dev_runtime8.jsxDEV(WelcomeBanner, {
-        version: "0.4.0",
-        model: "claude-4-sonnet",
+        version: "0.4.1",
+        model: "claude-sonnet-4",
         directory: cwd2
       }, undefined, false, undefined, this),
       scrollOffset > 0 && /* @__PURE__ */ jsx_dev_runtime8.jsxDEV(Box_default, {
@@ -32502,7 +32641,7 @@ var options = {
   help: args.includes("--help") || args.includes("-h")
 };
 if (options.version) {
-  console.log("oldpal v0.4.0");
+  console.log("oldpal v0.4.1");
   process.exit(0);
 }
 if (options.help) {
@@ -32533,4 +32672,4 @@ waitUntilExit().then(() => {
   process.exit(0);
 });
 
-//# debugId=CE824906A098BE1564756E2164756E21
+//# debugId=165DC707B2BFFF8564756E2164756E21