@probelabs/probe 0.6.0-rc117 → 0.6.0-rc119

package/build/agent/probeTool.js

@@ -223,9 +223,22 @@ export const listFilesTool = {
 
     // Security: Validate path to prevent traversal attacks
     const secureBaseDir = path.resolve(baseCwd);
-    const targetDir = path.resolve(secureBaseDir, directory);
-    if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
-      throw new Error('Path traversal attempt detected. Access denied.');
+
+    // If directory is absolute, check if it's within the secure base directory
+    // If it's relative, resolve it against the secure base directory
+    let targetDir;
+    if (path.isAbsolute(directory)) {
+      targetDir = path.resolve(directory);
+      // Check if the absolute path is within the secure base directory
+      if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
+        throw new Error(`Path traversal attempt detected. Cannot access directory outside workspace: ${directory}`);
+      }
+    } else {
+      targetDir = path.resolve(secureBaseDir, directory);
+      // Double-check the resolved path is still within the secure base directory
+      if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
+        throw new Error(`Path traversal attempt detected. Access denied: ${directory}`);
+      }
     }
 
     const debug = process.env.DEBUG === '1';
@@ -309,9 +322,22 @@ export const searchFilesTool = {
     // Security: Validate path to prevent traversal attacks
     const baseCwd = workingDirectory || process.cwd();
     const secureBaseDir = path.resolve(baseCwd);
-    const targetDir = path.resolve(secureBaseDir, directory);
-    if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
-      throw new Error('Path traversal attempt detected. Access denied.');
+
+    // If directory is absolute, check if it's within the secure base directory
+    // If it's relative, resolve it against the secure base directory
+    let targetDir;
+    if (path.isAbsolute(directory)) {
+      targetDir = path.resolve(directory);
+      // Check if the absolute path is within the secure base directory
+      if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
+        throw new Error(`Path traversal attempt detected. Cannot access directory outside workspace: ${directory}`);
+      }
+    } else {
+      targetDir = path.resolve(secureBaseDir, directory);
+      // Double-check the resolved path is still within the secure base directory
+      if (!targetDir.startsWith(secureBaseDir + path.sep) && targetDir !== secureBaseDir) {
+        throw new Error(`Path traversal attempt detected. Access denied: ${directory}`);
+      }
     }
 
     // Validate pattern complexity to prevent DoS

package/build/agent/tokenCounter.js

@@ -1,14 +1,14 @@
-import { get_encoding } from 'tiktoken';
+import { encode } from 'gpt-tokenizer';
 
 /**
  * TokenCounter class to track token usage in the agent
  */
 export class TokenCounter {
   constructor() {
-    // Initialize the tokenizer with cl100k_base encoding (works for both Claude and GPT models)
+    // Initialize the tokenizer with gpt-tokenizer (works for both Claude and GPT models)
     try {
-      // Initialize tokenizer
-      this.tokenizer = get_encoding('cl100k_base');
+      // gpt-tokenizer uses encode directly, no need to initialize
+      this.tokenizer = encode;
 
       // Context window tracking
       this.contextSize = 0; // Current size based on history
@@ -30,7 +30,7 @@ export class TokenCounter {
 
     } catch (error) {
       console.error('Error initializing tokenizer:', error);
-      // Fallback to a simple token counting method if tiktoken fails
+      // Fallback to a simple token counting method if gpt-tokenizer fails
       this.tokenizer = null;
       this.contextSize = 0;
       this.requestTokens = 0;
@@ -49,7 +49,7 @@ export class TokenCounter {
   }
 
   /**
-   * Count tokens in a string using tiktoken or fallback method
+   * Count tokens in a string using gpt-tokenizer or fallback method
    * @param {string} text - The text to count tokens for
    * @returns {number} - The number of tokens
    */
@@ -60,7 +60,7 @@ export class TokenCounter {
 
     if (this.tokenizer) {
       try {
-        const tokens = this.tokenizer.encode(text);
+        const tokens = this.tokenizer(text);
         return tokens.length;
       } catch (error) {
         // Fallback to a simple approximation (1 token ≈ 4 characters)