@probelabs/probe 0.6.0-rc103 → 0.6.0-rc105

package/build/agent/mcp/xmlBridge.js

@@ -5,6 +5,7 @@
 
 import { MCPClientManager } from './client.js';
 import { loadMCPConfiguration } from './config.js';
+import { processXmlWithThinkingAndRecovery } from '../xmlParsingUtils.js';
 
 /**
  * Convert MCP tool to XML definition format
@@ -254,18 +255,18 @@ export class MCPXmlBridge {
 
 /**
  * Enhanced XML parser that handles both native and MCP tools
+ * Uses the exact same logic as CLI/SDK mode to ensure consistency
  * @param {string} xmlString - XML string to parse
  * @param {Array<string>} nativeTools - List of native tool names
  * @param {MCPXmlBridge} mcpBridge - MCP bridge instance
  * @returns {Object|null} Parsed tool call
  */
 export function parseHybridXmlToolCall(xmlString, nativeTools = [], mcpBridge = null) {
-  // First try native tools with standard XML parsing
-  for (const toolName of nativeTools) {
-    const nativeResult = parseNativeXmlTool(xmlString, toolName);
-    if (nativeResult) {
-      return { ...nativeResult, type: 'native' };
-    }
+  // First try native tools with the same logic as CLI/SDK mode
+  // This includes thinking tag removal and attempt_complete recovery logic
+  const nativeResult = parseNativeXmlToolWithThinking(xmlString, nativeTools);
+  if (nativeResult) {
+    return { ...nativeResult, type: 'native' };
   }
 
   // Then try MCP tools if bridge is available
@@ -279,6 +280,33 @@ export function parseHybridXmlToolCall(xmlString, nativeTools = [], mcpBridge =
   return null;
 }
 
+/**
+ * Parse native XML tools using the same logic as CLI/SDK mode
+ * Now uses shared utilities instead of duplicating code
+ * @param {string} xmlString - XML string to parse
+ * @param {Array<string>} validTools - List of valid tool names
+ * @returns {Object|null} Parsed tool call
+ */
+function parseNativeXmlToolWithThinking(xmlString, validTools) {
+  // Use the shared processing logic
+  const { cleanedXmlString, recoveryResult } = processXmlWithThinkingAndRecovery(xmlString, validTools);
+  
+  // If recovery found an attempt_complete pattern, return it
+  if (recoveryResult) {
+    return recoveryResult;
+  }
+
+  // Use the original parseNativeXmlTool function to parse the cleaned XML string
+  for (const toolName of validTools) {
+    const result = parseNativeXmlTool(cleanedXmlString, toolName);
+    if (result) {
+      return result;
+    }
+  }
+
+  return null;
+}
+
 /**
  * Parse native XML tool (existing format)
  * @param {string} xmlString - XML string

package/build/agent/probeTool.js

@@ -207,14 +207,24 @@ export function createWrappedTools(baseTools) {
 // Simple file listing tool
 export const listFilesTool = {
   execute: async (params) => {
-    const { directory = '.' } = params;
+    const { directory = '.', workingDirectory } = params;
+    
+    // Use the provided working directory, or fall back to process.cwd()
+    const baseCwd = workingDirectory || process.cwd();
+    
+    // Security: Validate path to prevent traversal attacks
+    const secureBaseDir = path.resolve(baseCwd);
+    const targetDir = path.resolve(secureBaseDir, directory);
+    if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
+      throw new Error('Path traversal attempt detected. Access denied.');
+    }
     
     try {
       const files = await listFilesByLevel({
-        directory,
+        directory: targetDir,
         maxFiles: 100,
         respectGitignore: !process.env.PROBE_NO_GITIGNORE || process.env.PROBE_NO_GITIGNORE === '',
-        cwd: process.cwd()
+        cwd: secureBaseDir
       });
       
       return files;
@@ -227,15 +237,23 @@ export const listFilesTool = {
 // Simple file search tool
 export const searchFilesTool = {
   execute: async (params) => {
-    const { pattern, directory = '.', recursive = true } = params;
+    const { pattern, directory = '.', recursive = true, workingDirectory } = params;
     
     if (!pattern) {
       throw new Error('Pattern is required for file search');
     }
     
+    // Security: Validate path to prevent traversal attacks
+    const baseCwd = workingDirectory || process.cwd();
+    const secureBaseDir = path.resolve(baseCwd);
+    const targetDir = path.resolve(secureBaseDir, directory);
+    if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
+      throw new Error('Path traversal attempt detected. Access denied.');
+    }
+    
     try {
       const options = {
-        cwd: directory,
+        cwd: targetDir,
         ignore: ['node_modules/**', '.git/**'],
         absolute: false
       };

package/build/agent/tools.js

@@ -18,6 +18,7 @@ import {
   parseXmlToolCall
 } from '../index.js';
 import { randomUUID } from 'crypto';
+import { processXmlWithThinkingAndRecovery } from './xmlParsingUtils.js';
 
 // Create configured tool instances
 export function createTools(configOptions) {
@@ -134,30 +135,15 @@ User: Find all markdown files in the docs directory, but only at the top level.
  * @returns {Object|null} - The parsed tool call or null if no valid tool call found
  */
 export function parseXmlToolCallWithThinking(xmlString, validTools) {
-  // Extract thinking content if present (for potential logging or analysis)
-  const thinkingMatch = xmlString.match(/<thinking>([\s\S]*?)<\/thinking>/);
-  const thinkingContent = thinkingMatch ? thinkingMatch[1].trim() : null;
-
-  // Remove thinking tags and their content from the XML string
-  let cleanedXmlString = xmlString.replace(/<thinking>[\s\S]*?<\/thinking>/g, '').trim();
-
-  // Check for attempt_complete shorthand (single tag with no closing tag and no parameters)
-  const attemptCompleteMatch = cleanedXmlString.match(/^<attempt_complete>\s*$/);
-  if (attemptCompleteMatch) {
-    // Convert shorthand to full attempt_completion format with special marker
-    return {
-      toolName: 'attempt_completion',
-      params: { result: '__PREVIOUS_RESPONSE__' }
-    };
+  // Use the shared processing logic
+  const { cleanedXmlString, recoveryResult } = processXmlWithThinkingAndRecovery(xmlString, validTools);
+  
+  // If recovery found an attempt_complete pattern, return it
+  if (recoveryResult) {
+    return recoveryResult;
   }
 
-  // Use the original parseXmlToolCall function to parse the cleaned XML string
-  const parsedTool = parseXmlToolCall(cleanedXmlString, validTools);
-
-  // If debugging is enabled, log the thinking content
-  if (process.env.DEBUG === '1' && thinkingContent) {
-    console.log(`[DEBUG] AI Thinking Process:\n${thinkingContent}`);
-  }
+  // Otherwise, use the original parseXmlToolCall function to parse the cleaned XML string
+  return parseXmlToolCall(cleanedXmlString, validTools);
+}
 
-  return parsedTool;
-}

package/build/agent/xmlParsingUtils.js

@@ -0,0 +1,118 @@
+/**
+ * Shared XML parsing utilities used by both CLI/SDK and MCP modes
+ * This module contains the core logic for thinking tag removal and attempt_complete recovery
+ */
+
+/**
+ * Remove thinking tags and their content from XML string
+ * @param {string} xmlString - The XML string to clean
+ * @returns {string} - Cleaned XML string without thinking tags
+ */
+export function removeThinkingTags(xmlString) {
+  return xmlString.replace(/<thinking>[\s\S]*?<\/thinking>/g, '').trim();
+}
+
+/**
+ * Extract thinking content for potential logging
+ * @param {string} xmlString - The XML string to extract from
+ * @returns {string|null} - Thinking content or null if not found
+ */
+export function extractThinkingContent(xmlString) {
+  const thinkingMatch = xmlString.match(/<thinking>([\s\S]*?)<\/thinking>/);
+  return thinkingMatch ? thinkingMatch[1].trim() : null;
+}
+
+/**
+ * Check for attempt_complete recovery patterns and return standardized result
+ * @param {string} cleanedXmlString - XML string with thinking tags already removed
+ * @param {Array<string>} validTools - List of valid tool names
+ * @returns {Object|null} - Standardized attempt_completion result or null
+ */
+export function checkAttemptCompleteRecovery(cleanedXmlString, validTools = []) {
+  // Enhanced recovery logic for attempt_complete shorthand
+  const attemptCompletePatterns = [
+    // Standard shorthand with optional whitespace
+    /^<attempt_complete>\s*$/,
+    // Empty with proper closing tag (common case from the logs)
+    /^<attempt_complete>\s*<\/attempt_complete>\s*$/,
+    // Self-closing variant
+    /^<attempt_complete\s*\/>\s*$/,
+    // Incomplete opening tag (missing closing bracket)
+    /^<attempt_complete\s*$/,
+    // With trailing content (extract just the tag part) - must come after empty tag pattern
+    /^<attempt_complete>(.*)$/s,
+    // Self-closing with trailing content
+    /^<attempt_complete\s*\/>(.*)$/s
+  ];
+
+  for (const pattern of attemptCompletePatterns) {
+    const match = cleanedXmlString.match(pattern);
+    if (match) {
+      // Convert any form of attempt_complete to the standard format
+      return {
+        toolName: 'attempt_completion',
+        params: { result: '__PREVIOUS_RESPONSE__' }
+      };
+    }
+  }
+
+  // Additional recovery: check if the string contains attempt_complete anywhere
+  // and treat the entire response as a completion signal if no other tool tags are found
+  if (cleanedXmlString.includes('<attempt_complete') && !hasOtherToolTags(cleanedXmlString, validTools)) {
+    // This handles malformed cases where attempt_complete appears but is broken
+    return {
+      toolName: 'attempt_completion', 
+      params: { result: '__PREVIOUS_RESPONSE__' }
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Helper function to check if the XML string contains other tool tags
+ * @param {string} xmlString - The XML string to check
+ * @param {string[]} validTools - List of valid tool names
+ * @returns {boolean} - True if other tool tags are found
+ */
+function hasOtherToolTags(xmlString, validTools = []) {
+  const defaultTools = ['search', 'query', 'extract', 'listFiles', 'searchFiles', 'implement', 'attempt_completion'];
+  const toolsToCheck = validTools.length > 0 ? validTools : defaultTools;
+  
+  // Check for any tool tags other than attempt_complete variants
+  for (const tool of toolsToCheck) {
+    if (tool !== 'attempt_completion' && xmlString.includes(`<${tool}`)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Apply the full thinking tag removal and attempt_complete recovery logic
+ * This replicates the core logic from parseXmlToolCallWithThinking
+ * @param {string} xmlString - The XML string to process
+ * @param {Array<string>} validTools - List of valid tool names
+ * @returns {Object} - Processing result with cleanedXml and potentialRecovery
+ */
+export function processXmlWithThinkingAndRecovery(xmlString, validTools = []) {
+  // Extract thinking content if present (for potential logging or analysis)
+  const thinkingContent = extractThinkingContent(xmlString);
+
+  // Remove thinking tags and their content from the XML string
+  const cleanedXmlString = removeThinkingTags(xmlString);
+
+  // Check for attempt_complete recovery patterns
+  const recoveryResult = checkAttemptCompleteRecovery(cleanedXmlString, validTools);
+
+  // If debugging is enabled, log the thinking content
+  if (process.env.DEBUG === '1' && thinkingContent) {
+    console.log(`[DEBUG] AI Thinking Process:\n${thinkingContent}`);
+  }
+
+  return {
+    cleanedXmlString,
+    thinkingContent,
+    recoveryResult
+  };
+}

package/build/utils.js

@@ -43,7 +43,7 @@ export async function getBinaryPath(options = {}) {
 	
 	// Check bin directory
 	const isWindows = process.platform === 'win32';
-	const binaryName = isWindows ? 'probe.exe' : 'probe';
+	const binaryName = isWindows ? 'probe.exe' : 'probe-binary';
 	const binaryPath = path.join(binDir, binaryName);
 
 	if (fs.existsSync(binaryPath) && !forceDownload) {