@lovenyberg/ove 0.6.1 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovenyberg/ove",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Your grumpy but meticulous dev companion. AI coding agent for Slack, WhatsApp, Telegram, Discord, GitHub, HTTP API, and CLI.",
   "type": "module",
   "bin": {

package/src/adapters/http.ts

@@ -1,5 +1,6 @@
 import { readFileSync, existsSync } from "node:fs";
-import { join, extname } from "node:path";
+import { join, extname, resolve } from "node:path";
+import { timingSafeEqual } from "node:crypto";
 import type { EventAdapter, IncomingEvent, IncomingMessage, ChatAdapter, AdapterStatus } from "./types";
 import type { TraceStore } from "../trace";
 import type { TaskQueue } from "../queue";
@@ -13,6 +14,13 @@ interface PendingChat {
   sseControllers: ReadableStreamDefaultController[];
 }
 
+function safeEqual(a: string, b: string): boolean {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+
 export class HttpApiAdapter implements EventAdapter {
   private port: number;
   private apiKey: string;
@@ -40,7 +48,7 @@ export class HttpApiAdapter implements EventAdapter {
     this.trace = trace;
     this.queue = queue || null;
     this.sessions = sessions || null;
-    const publicDir = join(import.meta.dir, "../../public");
+    const publicDir = resolve(import.meta.dir, "../../public");
     this.publicDir = publicDir;
     try {
       this.webUiHtml = readFileSync(join(publicDir, "index.html"), "utf-8");
@@ -114,7 +122,7 @@ export class HttpApiAdapter implements EventAdapter {
         // Auth check for API routes
         if (path.startsWith("/api/")) {
           const key = req.headers.get("X-API-Key") || url.searchParams.get("key");
-          if (key !== self.apiKey) {
+          if (!key || !safeEqual(key, self.apiKey)) {
             return Response.json({ error: "Unauthorized" }, { status: 401 });
           }
         }
@@ -159,9 +167,20 @@ export class HttpApiAdapter implements EventAdapter {
 
         // POST /api/message — submit a chat message (full chat pipeline)
         if (path === "/api/message" && req.method === "POST") {
-          const body = await req.json() as { text: string; userId?: string };
+          let body: { text: string };
+          try {
+            body = await req.json() as { text: string };
+          } catch {
+            return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+          }
+          if (!body || typeof body.text !== "string" || body.text.trim().length === 0) {
+            return Response.json({ error: "Missing or invalid 'text' field" }, { status: 400 });
+          }
+          if (body.text.length > 50000) {
+            return Response.json({ error: "Message too long (max 50000 chars)" }, { status: 400 });
+          }
           const chatId = crypto.randomUUID();
-          const userId = body.userId || "http:web";
+          const userId = "http:web";
 
           const chat: PendingChat = { status: "pending", replies: [], sseControllers: [] };
           self.chats.set(chatId, chat);
@@ -290,7 +309,10 @@ export class HttpApiAdapter implements EventAdapter {
         const MIME: Record<string, string> = { ".png": "image/png", ".ico": "image/x-icon", ".svg": "image/svg+xml", ".jpg": "image/jpeg", ".css": "text/css", ".js": "application/javascript" };
         const ext = extname(path);
         if (ext && MIME[ext]) {
-          const filePath = join(self.publicDir, path);
+          const filePath = resolve(self.publicDir, "." + path);
+          if (!filePath.startsWith(self.publicDir + "/")) {
+            return Response.json({ error: "Not found" }, { status: 404 });
+          }
           if (existsSync(filePath)) {
             const data = readFileSync(filePath);
             return new Response(data, { headers: { "Content-Type": MIME[ext], "Cache-Control": "public, max-age=3600" } });

package/src/handlers.ts

@@ -6,7 +6,7 @@ import { parseSchedule } from "./schedule-parser";
 import { logger } from "./logger";
 import type { Config } from "./config";
 import type { TaskQueue, Task } from "./queue";
-import type { SessionStore } from "./sessions";
+import type { SessionStore, UserMode } from "./sessions";
 import type { ScheduleStore } from "./schedules";
 import type { RepoRegistry } from "./repo-registry";
 import type { IncomingMessage, EventAdapter, IncomingEvent } from "./adapters/types";
@@ -42,6 +42,19 @@ Keep the personality subtle in code output — don't let it interfere with code
 
 export { OVE_PERSONA };
 
+const ASSISTANT_ADDENDUM = `IMPORTANT MODE OVERRIDE: You are currently in "assistant mode". The user has asked you to be a general-purpose assistant. While you keep your Ove personality (grumble, be direct, sprinkle Swedish), you are now willing to help with ANY request — not just code. This includes:
+- Sending reminders, drafting emails/messages
+- Answering general knowledge questions
+- Helping with personal tasks, recommendations
+- Anything the user asks
+
+You still grumble about it ("Fan, nu ska jag vara sekreterare också...") but you DO the task. If you genuinely cannot do something (no tool/integration available), explain what would be needed rather than just refusing.`;
+
+function getPersona(userId: string, deps: HandlerDeps): string {
+  const mode = deps.sessions.getMode(userId);
+  return mode === "assistant" ? OVE_PERSONA + "\n\n" + ASSISTANT_ADDENDUM : OVE_PERSONA;
+}
+
 const PLATFORM_FORMAT_HINTS: Record<string, string> = {
   telegram: "Format output for Telegram: use *bold* for emphasis, `code` for inline code, ```code blocks```. No markdown tables. Use simple bulleted lists with • instead. Keep it concise.",
   slack: "Format output for Slack: use *bold*, no markdown tables. Use simple bulleted lists with • instead. Keep it concise.",
@@ -147,6 +160,26 @@ async function handleClear(msg: IncomingMessage, deps: HandlerDeps) {
   await msg.reply("Conversation cleared.");
 }
 
+async function handleSetMode(msg: IncomingMessage, args: Record<string, any>, deps: HandlerDeps) {
+  const mode = args.mode;
+  if (mode !== "assistant" && mode !== "strict") {
+    await msg.reply(`Unknown mode "${String(mode)}". Use "mode assistant" or "mode strict".`);
+    return;
+  }
+  try {
+    deps.sessions.setMode(msg.userId, mode);
+  } catch (err) {
+    logger.error("failed to set user mode", { userId: msg.userId, mode, error: String(err) });
+    await msg.reply("Failed to save mode. Try again.");
+    return;
+  }
+  const reply = mode === "assistant"
+    ? "Mja, fine. Assistant mode. Jag hjälper dig med vad du vill. Men klaga inte om resultatet."
+    : "Back to code mode. Äntligen. Riktigt arbete.";
+  await msg.reply(reply);
+  deps.sessions.addMessage(msg.userId, "assistant", reply);
+}
+
 async function handleStatus(msg: IncomingMessage, deps: HandlerDeps) {
   const userTasks = deps.queue.listByUser(msg.userId, 5);
   const running = userTasks.find((t) => t.status === "running");
@@ -199,6 +232,8 @@ async function handleHelp(msg: IncomingMessage, deps: HandlerDeps) {
     "• tasks — see running and pending tasks",
     "• cancel <id> — kill a running or pending task",
     "• trace [task-id] — see what happened step by step",
+    "• mode assistant — I'll (reluctantly) help with anything",
+    "• mode strict — back to code-only (default)",
     "• status / history / clear",
     "• <task> every day/weekday at <time> [on <repo>] — schedule a recurring task",
     "• list schedules — see your scheduled tasks",
@@ -254,6 +289,10 @@ async function handleCancelTask(msg: IncomingMessage, args: Record<string, any>,
     const active = deps.queue.listActive();
     const pendingMatch = active.find((t) => t.id.toLowerCase().startsWith(prefix) && t.status === "pending");
     if (pendingMatch) {
+      if (pendingMatch.userId !== msg.userId) {
+        await msg.reply("That's not your task.");
+        return;
+      }
       deps.queue.cancel(pendingMatch.id);
       await msg.reply(`Cancelled pending task ${pendingMatch.id.slice(0, 7)} on ${pendingMatch.repo}.`);
       return;
@@ -261,6 +300,10 @@ async function handleCancelTask(msg: IncomingMessage, args: Record<string, any>,
     await msg.reply(`No task found matching "${prefix}". Use /tasks to see what's running.`);
     return;
   }
+  if (match.task.userId !== msg.userId) {
+    await msg.reply("That's not your task.");
+    return;
+  }
   match.abort.abort();
   deps.queue.cancel(match.task.id);
   await msg.reply(`Killed task ${match.task.id.slice(0, 7)} on ${match.task.repo}. Gone.`);
@@ -375,7 +418,7 @@ async function handleSchedule(msg: IncomingMessage, parsedRepo: string | undefin
 }
 
 async function handleDiscuss(msg: IncomingMessage, parsed: ParsedMessage, history: { role: string; content: string }[], deps: HandlerDeps) {
-  const prompt = buildContextualPrompt(parsed, history, OVE_PERSONA);
+  const prompt = buildContextualPrompt(parsed, history, getPersona(msg.userId, deps));
 
   await msg.updateStatus("Thinking...");
 
@@ -405,7 +448,7 @@ async function handleDiscuss(msg: IncomingMessage, parsed: ParsedMessage, histor
 
 async function handleCreateProject(msg: IncomingMessage, parsed: ParsedMessage, history: { role: string; content: string }[], deps: HandlerDeps) {
   const projectName = parsed.args.name;
-  const prompt = buildContextualPrompt(parsed, history, OVE_PERSONA);
+  const prompt = buildContextualPrompt(parsed, history, getPersona(msg.userId, deps));
 
   const taskId = deps.queue.enqueue({
     userId: msg.userId,
@@ -477,7 +520,7 @@ async function handleTaskMessage(msg: IncomingMessage, parsed: ParsedMessage, de
   }
 
   const history = deps.sessions.getHistory(msg.userId, 6);
-  const prompt = buildContextualPrompt(parsed, history, OVE_PERSONA);
+  const prompt = buildContextualPrompt(parsed, history, getPersona(msg.userId, deps));
 
   const taskId = deps.queue.enqueue({
     userId: msg.userId,
@@ -507,6 +550,7 @@ export function createMessageHandler(deps: HandlerDeps): (msg: IncomingMessage)
       "help": () => handleHelp(msg, deps),
       "list-tasks": () => handleListTasks(msg, deps),
       "cancel-task": () => handleCancelTask(msg, parsed.args, deps),
+      "set-mode": () => handleSetMode(msg, parsed.args, deps),
       "trace": () => handleTrace(msg, parsed.args, deps),
       "list-schedules": () => handleListSchedules(msg, deps),
       "remove-schedule": () => handleRemoveSchedule(msg, parsed.args, deps),
@@ -572,7 +616,7 @@ export function createEventHandler(deps: HandlerDeps): (event: IncomingEvent, ad
       return;
     }
 
-    const prompt = buildContextualPrompt(parsed, [], OVE_PERSONA);
+    const prompt = buildContextualPrompt(parsed, [], getPersona(event.userId, deps));
     const taskId = deps.queue.enqueue({
       userId: event.userId,
       repo: parsed.repo,

package/src/router.test.ts

@@ -260,6 +260,73 @@ describe("parseMessage", () => {
   });
 });
 
+describe("set-mode parsing", () => {
+  it("parses 'mode assistant'", () => {
+    const result = parseMessage("mode assistant");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("assistant");
+  });
+
+  it("parses 'mode strict'", () => {
+    const result = parseMessage("mode strict");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("strict");
+  });
+
+  it("parses '/mode assistant'", () => {
+    const result = parseMessage("/mode assistant");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("assistant");
+  });
+
+  it("parses 'assistant mode'", () => {
+    const result = parseMessage("assistant mode");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("assistant");
+  });
+
+  it("parses 'yolo mode'", () => {
+    const result = parseMessage("yolo mode");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("assistant");
+  });
+
+  it("parses 'be more helpful'", () => {
+    const result = parseMessage("be more helpful");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("assistant");
+  });
+
+  it("parses 'help me with anything'", () => {
+    const result = parseMessage("help me with anything");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("assistant");
+  });
+
+  it("parses 'strict mode'", () => {
+    const result = parseMessage("strict mode");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("strict");
+  });
+
+  it("parses 'code mode'", () => {
+    const result = parseMessage("code mode");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("strict");
+  });
+
+  it("parses 'back to normal'", () => {
+    const result = parseMessage("back to normal");
+    expect(result.type).toBe("set-mode");
+    expect(result.args.mode).toBe("strict");
+  });
+
+  it("does NOT match 'help me fix a bug on my-app' as set-mode", () => {
+    const result = parseMessage("help me fix a bug on my-app");
+    expect(result.type).not.toBe("set-mode");
+  });
+});
+
 describe("buildPrompt", () => {
   it("builds review-pr prompt", () => {
     const prompt = buildPrompt({ type: "review-pr", repo: "my-app", args: { prNumber: 42 }, rawText: "" });

package/src/router.ts

@@ -16,7 +16,8 @@ export type MessageType =
   | "remove-schedule"
   | "list-tasks"
   | "cancel-task"
-  | "trace";
+  | "trace"
+  | "set-mode";
 
 export interface ParsedMessage {
   type: MessageType;
@@ -49,6 +50,25 @@ export function parseMessage(text: string): ParsedMessage {
   const traceMatch = trimmed.match(/^(?:\/)?trace(?:\s+(\S+))?$/i);
   if (traceMatch) return { type: "trace", args: { taskId: traceMatch[1] }, rawText: trimmed };
 
+  // Mode switching — explicit commands
+  const modeMatch = trimmed.match(/^(?:\/)?mode\s+(assistant|strict)$/i);
+  if (modeMatch) {
+    return { type: "set-mode", args: { mode: modeMatch[1].toLowerCase() }, rawText: trimmed };
+  }
+
+  // Mode switching — natural language for assistant mode
+  if (/^(?:assistant|yolo)\s+mode$/i.test(lower) ||
+      /^be\s+more\s+helpful$/i.test(lower) ||
+      /^help\s+me\s+with\s+(?:anything|everything)$/i.test(lower)) {
+    return { type: "set-mode", args: { mode: "assistant" }, rawText: trimmed };
+  }
+
+  // Mode switching — natural language for strict mode
+  if (/^(?:strict|code|normal)\s+mode$/i.test(lower) ||
+      /^back\s+to\s+(?:normal|code|strict)$/i.test(lower)) {
+    return { type: "set-mode", args: { mode: "strict" }, rawText: trimmed };
+  }
+
   // Natural language status inquiries — short messages asking about progress
   if (isStatusInquiry(lower)) return { type: "status", args: {}, rawText: trimmed };
 

package/src/sessions.test.ts

@@ -42,4 +42,45 @@ describe("SessionStore", () => {
     store.clear("slack:U123");
     expect(store.getHistory("slack:U123").length).toBe(0);
   });
+
+  describe("user modes", () => {
+    it("returns 'strict' as default mode", () => {
+      const mode = store.getMode("slack:U123");
+      expect(mode).toBe("strict");
+    });
+
+    it("stores and retrieves a mode", () => {
+      store.setMode("slack:U123", "assistant");
+      expect(store.getMode("slack:U123")).toBe("assistant");
+    });
+
+    it("upserts mode (overwrites previous)", () => {
+      store.setMode("slack:U123", "assistant");
+      store.setMode("slack:U123", "strict");
+      expect(store.getMode("slack:U123")).toBe("strict");
+    });
+
+    it("keeps separate modes per user", () => {
+      store.setMode("slack:U1", "assistant");
+      store.setMode("slack:U2", "strict");
+      expect(store.getMode("slack:U1")).toBe("assistant");
+      expect(store.getMode("slack:U2")).toBe("strict");
+    });
+
+    it("resets mode when session is cleared", () => {
+      store.setMode("slack:U123", "assistant");
+      store.clear("slack:U123");
+      expect(store.getMode("slack:U123")).toBe("strict");
+    });
+
+    it("falls back to strict for unexpected values in database", () => {
+      // Simulate a corrupted/unexpected value by writing directly to SQLite
+      const db = (store as any).db as Database;
+      db.run(
+        `INSERT INTO user_modes (user_id, mode, updated_at) VALUES (?, ?, ?)`,
+        ["slack:U999", "banana", new Date().toISOString()]
+      );
+      expect(store.getMode("slack:U999")).toBe("strict");
+    });
+  });
 });

package/src/sessions.ts

@@ -1,5 +1,7 @@
 import { Database } from "bun:sqlite";
 
+export type UserMode = "strict" | "assistant";
+
 export interface ChatMessage {
   role: "user" | "assistant";
   content: string;
@@ -27,6 +29,13 @@ export class SessionStore {
       )
     `);
     this.db.run(`CREATE INDEX IF NOT EXISTS idx_chat_user ON chat_history(user_id)`);
+    this.db.run(`
+      CREATE TABLE IF NOT EXISTS user_modes (
+        user_id TEXT PRIMARY KEY,
+        mode TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      )
+    `);
   }
 
   addMessage(userId: string, role: "user" | "assistant", content: string) {
@@ -55,7 +64,25 @@ export class SessionStore {
       }));
   }
 
+  getMode(userId: string): UserMode {
+    const row = this.db
+      .query(`SELECT mode FROM user_modes WHERE user_id = ?`)
+      .get(userId) as { mode: string } | null;
+    if (!row) return "strict";
+    if (row.mode === "assistant" || row.mode === "strict") return row.mode;
+    return "strict";
+  }
+
+  setMode(userId: string, mode: UserMode): void {
+    this.db.run(
+      `INSERT INTO user_modes (user_id, mode, updated_at) VALUES (?, ?, ?)
+       ON CONFLICT(user_id) DO UPDATE SET mode = excluded.mode, updated_at = excluded.updated_at`,
+      [userId, mode, new Date().toISOString()]
+    );
+  }
+
   clear(userId: string) {
     this.db.run(`DELETE FROM chat_history WHERE user_id = ?`, [userId]);
+    this.db.run(`DELETE FROM user_modes WHERE user_id = ?`, [userId]);
   }
 }

package/src/smoke.test.ts

@@ -1,9 +1,10 @@
 import { describe, it, expect } from "bun:test";
 import { Database } from "bun:sqlite";
-import { parseMessage, buildPrompt } from "./router";
+import { parseMessage, buildPrompt, buildContextualPrompt } from "./router";
 import { TaskQueue } from "./queue";
 import { ClaudeRunner } from "./runners/claude";
 import { SessionStore } from "./sessions";
+import { OVE_PERSONA } from "./handlers";
 
 describe("smoke test: full message flow", () => {
   it("routes a PR review through the full pipeline", () => {
@@ -77,4 +78,33 @@ describe("smoke test: full message flow", () => {
     expect(task).not.toBeNull();
     expect(task!.prompt).toContain("auth middleware");
   });
+
+  it("mode switch changes persona in prompts", () => {
+    const db = new Database(":memory:");
+    const sessions = new SessionStore(db);
+    const parsed = parseMessage("explain the auth flow");
+
+    // Default mode — prompt should NOT contain assistant addendum
+    const strictPrompt = buildContextualPrompt(parsed, [], OVE_PERSONA);
+    expect(strictPrompt).toContain("grumpy");
+    expect(strictPrompt).not.toContain("IMPORTANT MODE OVERRIDE");
+
+    // Switch to assistant — prompt should contain the addendum
+    sessions.setMode("slack:U123", "assistant");
+    expect(sessions.getMode("slack:U123")).toBe("assistant");
+
+    const assistantPersona = OVE_PERSONA + "\n\n" + "IMPORTANT MODE OVERRIDE";
+    const assistantPrompt = buildContextualPrompt(parsed, [], assistantPersona);
+    expect(assistantPrompt).toContain("IMPORTANT MODE OVERRIDE");
+    expect(assistantPrompt).toContain("grumpy");
+
+    // Switch back — verify storage round-trips
+    sessions.setMode("slack:U123", "strict");
+    expect(sessions.getMode("slack:U123")).toBe("strict");
+
+    // Verify parseMessage detects mode commands
+    const modeCmd = parseMessage("mode assistant");
+    expect(modeCmd.type).toBe("set-mode");
+    expect(modeCmd.args.mode).toBe("assistant");
+  });
 });