@probelabs/probe 0.6.0-rc174 → 0.6.0-rc176

package/build/agent/simpleTelemetry.js

@@ -170,6 +170,19 @@ export class SimpleAppTracer {
     }
   }
 
+  /**
+   * Record a generic event (used by completionPrompt and other features)
+   */
+  // visor-disable: SimpleAppTracer uses this.sessionId because it's a per-session instance. AppTracer extracts from attributes because it's a singleton managing multiple sessions. Different architectures require different approaches.
+  recordEvent(name, attributes = {}) {
+    if (!this.isEnabled()) return;
+
+    this.addEvent(name, {
+      'session.id': this.sessionId,
+      ...attributes
+    });
+  }
+
   /**
    * Record delegation events
    */

package/build/extract.js

@@ -6,6 +6,7 @@
 import { exec, spawn } from 'child_process';
 import { promisify } from 'util';
 import { getBinaryPath, buildCliArgs, escapeString } from './utils.js';
+import { validateCwdPath } from './utils/path-validation.js';
 
 const execAsync = promisify(exec);
 
@@ -27,6 +28,7 @@ const EXTRACT_FLAG_MAP = {
  * @param {string[]} [options.files] - Files to extract from (can include line numbers with colon, e.g., "/path/to/file.rs:10")
  * @param {string} [options.inputFile] - Path to a file containing unstructured text to extract file paths from
  * @param {string|Buffer} [options.content] - Content to pipe to stdin (e.g., git diff output). Alternative to inputFile.
+ * @param {string} [options.cwd] - Working directory for resolving relative file paths
  * @param {boolean} [options.allowTests] - Include test files
  * @param {number} [options.contextLines] - Number of context lines to include
  * @param {string} [options.format] - Output format ('markdown', 'plain', 'json', 'xml', 'color', 'outline-xml', 'outline-diff')
@@ -71,6 +73,10 @@ export async function extract(options) {
 		}
 	}
 
+	// Get the working directory (cwd option sets working directory for relative file resolution)
+	// Validate and normalize the path to prevent path traversal attacks
+	const cwd = await validateCwdPath(options.cwd);
+
 	// Create a single log record with all extract parameters (only in debug mode)
 	if (process.env.DEBUG === '1') {
 		let logMessage = `\nExtract:`;
@@ -79,6 +85,7 @@ export async function extract(options) {
 		}
 		if (options.inputFile) logMessage += ` inputFile="${options.inputFile}"`;
 		if (options.content) logMessage += ` content=(${typeof options.content === 'string' ? options.content.length : options.content.byteLength} bytes)`;
+		if (options.cwd) logMessage += ` cwd="${cwd}"`;
 		if (options.allowTests) logMessage += " allowTests=true";
 		if (options.contextLines) logMessage += ` contextLines=${options.contextLines}`;
 		if (options.format) logMessage += ` format=${options.format}`;
@@ -88,14 +95,14 @@ export async function extract(options) {
 
 	// If content is provided, use spawn with stdin piping
 	if (hasContent) {
-		return extractWithStdin(binaryPath, cliArgs, options.content, options);
+		return extractWithStdin(binaryPath, cliArgs, options.content, options, cwd);
 	}
 
 	// Otherwise use exec for simple command execution
 	const command = `${binaryPath} extract ${cliArgs.join(' ')}`;
 
 	try {
-		const { stdout, stderr } = await execAsync(command);
+		const { stdout, stderr } = await execAsync(command, { cwd });
 
 		if (stderr) {
 			console.error(`stderr: ${stderr}`);
@@ -104,7 +111,7 @@ export async function extract(options) {
 		return processExtractOutput(stdout, options);
 	} catch (error) {
 		// Enhance error message with command details
-		const errorMessage = `Error executing extract command: ${error.message}\nCommand: ${command}`;
+		const errorMessage = `Error executing extract command: ${error.message}\nCommand: ${command}\nCwd: ${cwd}`;
 		throw new Error(errorMessage);
 	}
 }
@@ -113,10 +120,11 @@ export async function extract(options) {
  * Extract with content piped to stdin
  * @private
  */
-function extractWithStdin(binaryPath, cliArgs, content, options) {
+function extractWithStdin(binaryPath, cliArgs, content, options, cwd) {
 	return new Promise((resolve, reject) => {
 		const childProcess = spawn(binaryPath, ['extract', ...cliArgs], {
-			stdio: ['pipe', 'pipe', 'pipe']
+			stdio: ['pipe', 'pipe', 'pipe'],
+			cwd
 		});
 
 		let stdout = '';

package/build/query.js

@@ -6,6 +6,7 @@
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { getBinaryPath, buildCliArgs, escapeString } from './utils.js';
+import { validateCwdPath } from './utils/path-validation.js';
 
 const execAsync = promisify(exec);
 
@@ -26,6 +27,7 @@ const QUERY_FLAG_MAP = {
  * 
  * @param {Object} options - Query options
  * @param {string} options.path - Path to search in
+ * @param {string} [options.cwd] - Working directory for resolving relative paths (defaults to process.cwd())
  * @param {string} options.pattern - The ast-grep pattern to search for
  * @param {string} [options.language] - Programming language to search in
  * @param {string[]} [options.ignore] - Patterns to ignore
@@ -62,9 +64,14 @@ export async function query(options) {
 	// Add pattern and path as positional arguments
 	cliArgs.push(escapeString(options.pattern), escapeString(options.path));
 
+	// Get the working directory (cwd option for resolving relative paths)
+	// Validate and normalize the path to prevent path traversal attacks
+	const cwd = await validateCwdPath(options.cwd);
+
 	// Create a single log record with all query parameters (only in debug mode)
 	if (process.env.DEBUG === '1') {
 		let logMessage = `Query: pattern="${options.pattern}" path="${options.path}"`;
+		if (options.cwd) logMessage += ` cwd="${options.cwd}"`;
 		if (options.language) logMessage += ` language=${options.language}`;
 		if (options.maxResults) logMessage += ` maxResults=${options.maxResults}`;
 		if (options.allowTests) logMessage += " allowTests=true";
@@ -75,7 +82,7 @@ export async function query(options) {
 	const command = `${binaryPath} query ${cliArgs.join(' ')}`;
 
 	try {
-		const { stdout, stderr } = await execAsync(command);
+		const { stdout, stderr } = await execAsync(command, { cwd });
 
 		if (stderr) {
 			console.error(`stderr: ${stderr}`);
@@ -110,7 +117,7 @@ export async function query(options) {
 		return stdout;
 	} catch (error) {
 		// Enhance error message with command details
-		const errorMessage = `Error executing query command: ${error.message}\nCommand: ${command}`;
+		const errorMessage = `Error executing query command: ${error.message}\nCommand: ${command}\nCwd: ${cwd}`;
 		throw new Error(errorMessage);
 	}
 }

package/build/search.js

@@ -6,6 +6,7 @@
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { getBinaryPath, buildCliArgs } from './utils.js';
+import { validateCwdPath } from './utils/path-validation.js';
 
 const execFileAsync = promisify(execFile);
 
@@ -38,6 +39,7 @@ const SEARCH_FLAG_MAP = {
  *
  * @param {Object} options - Search options
  * @param {string} options.path - Path to search in
+ * @param {string} [options.cwd] - Working directory for resolving relative paths (defaults to process.cwd())
  * @param {string|string[]} options.query - Search query or queries
  * @param {boolean} [options.filesOnly] - Only output file paths
  * @param {string[]} [options.ignore] - Patterns to ignore
@@ -125,9 +127,14 @@ export async function search(options) {
 	// Add query and path as positional arguments
 	const queries = Array.isArray(options.query) ? options.query : [options.query];
 
+	// Get the working directory (cwd option for resolving relative paths)
+	// Validate and normalize the path to prevent path traversal attacks
+	const cwd = await validateCwdPath(options.cwd);
+
 	// Create a single log record with all search parameters (only in debug mode)
 	if (process.env.DEBUG === '1') {
 		let logMessage = `\nSearch: query="${queries[0]}" path="${options.path}"`;
+		if (options.cwd) logMessage += ` cwd="${options.cwd}"`;
 		if (options.maxResults) logMessage += ` maxResults=${options.maxResults}`;
 		logMessage += ` maxTokens=${options.maxTokens}`;
 		logMessage += ` timeout=${options.timeout}`;
@@ -154,6 +161,7 @@ export async function search(options) {
 	try {
 		// Execute with execFile (no shell, prevents command injection)
 		const { stdout, stderr } = await execFileAsync(binaryPath, args, {
+			cwd,
 			timeout: options.timeout * 1000, // Convert seconds to milliseconds
 			maxBuffer: 50 * 1024 * 1024 // 50MB buffer for large outputs
 		});
@@ -226,13 +234,13 @@ export async function search(options) {
 	} catch (error) {
 		// Check if the error is a timeout
 		if (error.code === 'ETIMEDOUT' || error.killed) {
-			const timeoutMessage = `Search operation timed out after ${options.timeout} seconds.\nBinary: ${binaryPath}\nArgs: ${args.join(' ')}`;
+			const timeoutMessage = `Search operation timed out after ${options.timeout} seconds.\nBinary: ${binaryPath}\nArgs: ${args.join(' ')}\nCwd: ${cwd}`;
 			console.error(timeoutMessage);
 			throw new Error(timeoutMessage);
 		}
 
 		// Enhance error message with command details
-		const errorMessage = `Error executing search command: ${error.message}\nBinary: ${binaryPath}\nArgs: ${args.join(' ')}`;
+		const errorMessage = `Error executing search command: ${error.message}\nBinary: ${binaryPath}\nArgs: ${args.join(' ')}\nCwd: ${cwd}`;
 		throw new Error(errorMessage);
 	}
 }

package/build/tools/bash.js

@@ -22,15 +22,15 @@ import { executeBashCommand, formatExecutionResult, validateExecutionOptions } f
  * @param {Object} [options.bashConfig.env={}] - Default environment variables
  * @param {number} [options.bashConfig.maxBuffer] - Maximum output buffer size
  * @param {boolean} [options.debug=false] - Enable debug logging
- * @param {string} [options.defaultPath] - Default working directory from probe config
+ * @param {string} [options.cwd] - Working directory from probe config
  * @param {string[]} [options.allowedFolders] - Allowed directories for execution
  * @returns {Object} Configured bash tool
  */
 export const bashTool = (options = {}) => {
-  const { 
+  const {
     bashConfig = {},
     debug = false,
-    defaultPath,
+    cwd,
     allowedFolders = []
   } = options;
 
@@ -48,8 +48,8 @@ export const bashTool = (options = {}) => {
     if (bashConfig.workingDirectory) {
       return bashConfig.workingDirectory;
     }
-    if (defaultPath) {
-      return defaultPath;
+    if (cwd) {
+      return cwd;
     }
     if (allowedFolders && allowedFolders.length > 0) {
       return allowedFolders[0];

package/build/tools/edit.js

@@ -40,7 +40,7 @@ function parseFileToolOptions(options = {}) {
   return {
     debug: options.debug || false,
     allowedFolders: options.allowedFolders || [],
-    defaultPath: options.defaultPath
+    cwd: options.cwd
   };
 }
 
@@ -50,11 +50,11 @@ function parseFileToolOptions(options = {}) {
  * @param {Object} [options] - Configuration options
  * @param {boolean} [options.debug=false] - Enable debug logging
  * @param {string[]} [options.allowedFolders] - Allowed directories for file operations
- * @param {string} [options.defaultPath] - Default working directory
+ * @param {string} [options.cwd] - Working directory
  * @returns {Object} Configured edit tool
  */
 export const editTool = (options = {}) => {
-  const { debug, allowedFolders, defaultPath } = parseFileToolOptions(options);
+  const { debug, allowedFolders, cwd } = parseFileToolOptions(options);
 
   return tool({
     name: 'edit',
@@ -111,7 +111,7 @@ Important:
         }
 
         // Resolve the file path
-        const resolvedPath = isAbsolute(file_path) ? file_path : resolve(defaultPath || process.cwd(), file_path);
+        const resolvedPath = isAbsolute(file_path) ? file_path : resolve(cwd || process.cwd(), file_path);
 
         if (debug) {
           console.error(`[Edit] Attempting to edit file: ${resolvedPath}`);
@@ -182,11 +182,11 @@ Important:
  * @param {Object} [options] - Configuration options
  * @param {boolean} [options.debug=false] - Enable debug logging
  * @param {string[]} [options.allowedFolders] - Allowed directories for file operations
- * @param {string} [options.defaultPath] - Default working directory
+ * @param {string} [options.cwd] - Working directory
  * @returns {Object} Configured create tool
  */
 export const createTool = (options = {}) => {
-  const { debug, allowedFolders, defaultPath } = parseFileToolOptions(options);
+  const { debug, allowedFolders, cwd } = parseFileToolOptions(options);
 
   return tool({
     name: 'create',
@@ -235,7 +235,7 @@ Important:
         }
 
         // Resolve the file path
-        const resolvedPath = isAbsolute(file_path) ? file_path : resolve(defaultPath || process.cwd(), file_path);
+        const resolvedPath = isAbsolute(file_path) ? file_path : resolve(cwd || process.cwd(), file_path);
 
         if (debug) {
           console.error(`[Create] Attempting to create file: ${resolvedPath}`);

package/build/tools/langchain.js

@@ -9,7 +9,9 @@ import { extract } from '../extract.js';
 import { searchSchema, querySchema, extractSchema, searchDescription, queryDescription, extractDescription, parseTargets } from './common.js';
 
 // LangChain tool for searching code
-export function createSearchTool() {
+export function createSearchTool(options = {}) {
+	const { cwd } = options;
+
 	return {
 		name: 'search',
 		description: searchDescription,
@@ -19,7 +21,8 @@ export function createSearchTool() {
 				const results = await search({
 					query: searchQuery,
 					path,
-					allow_tests,
+					cwd, // Working directory for resolving relative paths
+					allowTests: allow_tests ?? true,
 					exact,
 					json: false,
 					maxResults,
@@ -37,7 +40,9 @@ export function createSearchTool() {
 }
 
 // LangChain tool for querying code
-export function createQueryTool() {
+export function createQueryTool(options = {}) {
+	const { cwd } = options;
+
 	return {
 		name: 'query',
 		description: queryDescription,
@@ -47,8 +52,9 @@ export function createQueryTool() {
 				const results = await query({
 					pattern,
 					path,
+					cwd, // Working directory for resolving relative paths
 					language,
-					allow_tests,
+					allowTests: allow_tests ?? true,
 					json: false
 				});
 
@@ -62,7 +68,9 @@ export function createQueryTool() {
 }
 
 // LangChain tool for extracting code
-export function createExtractTool() {
+export function createExtractTool(options = {}) {
+	const { cwd } = options;
+
 	return {
 		name: 'extract',
 		description: extractDescription,
@@ -74,7 +82,8 @@ export function createExtractTool() {
 
 				const results = await extract({
 					files,
-					allowTests: allow_tests,
+					cwd, // Working directory for resolving relative paths
+					allowTests: allow_tests ?? true,
 					contextLines: context_lines,
 					format
 				});

package/build/tools/vercel.js

@@ -31,15 +31,15 @@ export const searchTool = (options = {}) => {
 				// Use parameter maxTokens if provided, otherwise use the default
 				const effectiveMaxTokens = paramMaxTokens || maxTokens;
 
-				// Use the path from parameters if provided, otherwise use defaultPath from config
-				let searchPath = path || options.defaultPath || '.';
+				// Use the path from parameters if provided, otherwise use cwd from config
+				let searchPath = path || options.cwd || '.';
 
-				// If path is "." or "./", use the defaultPath if available
-				if ((searchPath === "." || searchPath === "./") && options.defaultPath) {
+				// If path is "." or "./", use the cwd if available
+				if ((searchPath === "." || searchPath === "./") && options.cwd) {
 					if (debug) {
-						console.error(`Using default path "${options.defaultPath}" instead of "${searchPath}"`);
+						console.error(`Using cwd "${options.cwd}" instead of "${searchPath}"`);
 					}
-					searchPath = options.defaultPath;
+					searchPath = options.cwd;
 				}
 
 				if (debug) {
@@ -49,7 +49,8 @@ export const searchTool = (options = {}) => {
 				const searchOptions = {
 					query: searchQuery,
 					path: searchPath,
-					allowTests: allow_tests,
+					cwd: options.cwd, // Working directory for resolving relative paths
+					allowTests: allow_tests ?? true,
 					exact,
 					json: false,
 					maxTokens: effectiveMaxTokens,
@@ -89,15 +90,15 @@ export const queryTool = (options = {}) => {
 		inputSchema: querySchema,
 		execute: async ({ pattern, path, language, allow_tests }) => {
 			try {
-				// Use the path from parameters if provided, otherwise use defaultPath from config
-				let queryPath = path || options.defaultPath || '.';
+				// Use the path from parameters if provided, otherwise use cwd from config
+				let queryPath = path || options.cwd || '.';
 
-				// If path is "." or "./", use the defaultPath if available
-				if ((queryPath === "." || queryPath === "./") && options.defaultPath) {
+				// If path is "." or "./", use the cwd if available
+				if ((queryPath === "." || queryPath === "./") && options.cwd) {
 					if (debug) {
-						console.error(`Using default path "${options.defaultPath}" instead of "${queryPath}"`);
+						console.error(`Using cwd "${options.cwd}" instead of "${queryPath}"`);
 					}
-					queryPath = options.defaultPath;
+					queryPath = options.cwd;
 				}
 
 				if (debug) {
@@ -107,8 +108,9 @@ export const queryTool = (options = {}) => {
 				const results = await query({
 					pattern,
 					path: queryPath,
+					cwd: options.cwd, // Working directory for resolving relative paths
 					language,
-					allow_tests,
+					allowTests: allow_tests ?? true,
 					json: false
 				});
 
@@ -137,28 +139,20 @@ export const extractTool = (options = {}) => {
 		inputSchema: extractSchema,
 		execute: async ({ targets, input_content, line, end_line, allow_tests, context_lines, format }) => {
 			try {
-				// Use the defaultPath from config for context
-				let extractPath = options.defaultPath || '.';
-
-				// If path is "." or "./", use the defaultPath if available
-				if ((extractPath === "." || extractPath === "./") && options.defaultPath) {
-					if (debug) {
-						console.error(`Using default path "${options.defaultPath}" instead of "${extractPath}"`);
-					}
-					extractPath = options.defaultPath;
-				}
+				// Use the cwd from config for working directory
+				const effectiveCwd = options.cwd || '.';
 
 				if (debug) {
 					if (targets) {
-						console.error(`Executing extract with targets: "${targets}", path: "${extractPath}", context lines: ${context_lines || 10}`);
+						console.error(`Executing extract with targets: "${targets}", cwd: "${effectiveCwd}", context lines: ${context_lines || 10}`);
 					} else if (input_content) {
-						console.error(`Executing extract with input content, path: "${extractPath}", context lines: ${context_lines || 10}`);
+						console.error(`Executing extract with input content, cwd: "${effectiveCwd}", context lines: ${context_lines || 10}`);
 					}
 				}
 
 				// Create a temporary file for input content if provided
 				let tempFilePath = null;
-				let extractOptions = { path: extractPath };
+				let extractOptions = { cwd: effectiveCwd };
 
 				if (input_content) {
 					// Import required modules
@@ -184,7 +178,8 @@ export const extractTool = (options = {}) => {
 					// Set up extract options with input file
 					extractOptions = {
 						inputFile: tempFilePath,
-						allowTests: allow_tests,
+						cwd: effectiveCwd,
+						allowTests: allow_tests ?? true,
 						contextLines: context_lines,
 						format: effectiveFormat
 					};
@@ -202,7 +197,8 @@ export const extractTool = (options = {}) => {
 					// Set up extract options with files
 					extractOptions = {
 						files,
-						allowTests: allow_tests,
+						cwd: effectiveCwd,
+						allowTests: allow_tests ?? true,
 						contextLines: context_lines,
 						format: effectiveFormat
 					};
@@ -241,12 +237,12 @@ export const extractTool = (options = {}) => {
  * @param {Object} [options] - Configuration options
  * @param {boolean} [options.debug=false] - Enable debug logging
  * @param {number} [options.timeout=300] - Default timeout in seconds
- * @param {string} [options.defaultPath] - Default path to use if not specified in call
+ * @param {string} [options.cwd] - Working directory to use if not specified in call
  * @param {string[]} [options.allowedFolders] - Allowed folders for workspace isolation
  * @returns {Object} Configured delegate tool
  */
 export const delegateTool = (options = {}) => {
-	const { debug = false, timeout = 300, defaultPath, allowedFolders } = options;
+	const { debug = false, timeout = 300, cwd, allowedFolders } = options;
 
 	return tool({
 		name: 'delegate',
@@ -289,8 +285,8 @@ export const delegateTool = (options = {}) => {
 			}
 
 			// Use inherited path if not specified in AI call
-			// Priority: explicit path > defaultPath > first allowedFolder
-			const effectivePath = path || defaultPath || (allowedFolders && allowedFolders[0]);
+			// Priority: explicit path > cwd > first allowedFolder
+			const effectivePath = path || cwd || (allowedFolders && allowedFolders[0]);
 
 			if (debug) {
 				console.error(`Executing delegate with task: "${task.substring(0, 100)}${task.length > 100 ? '...' : ''}"`);

package/build/utils/path-validation.js

@@ -0,0 +1,58 @@
+/**
+ * Path validation utilities for the probe package
+ * @module utils/path-validation
+ */
+
+import path from 'path';
+import { promises as fs } from 'fs';
+
+/**
+ * Validates and normalizes a path to be used as working directory (cwd).
+ *
+ * Security considerations:
+ * - Normalizes path to resolve '..' and '.' components
+ * - Returns absolute path to prevent ambiguity
+ * - Does NOT restrict access to specific directories (that's the responsibility
+ *   of higher-level components like ProbeAgent with allowedFolders)
+ *
+ * @param {string} inputPath - The path to validate
+ * @param {string} [defaultPath] - Default path to use if inputPath is not provided
+ * @returns {Promise<string>} Normalized absolute path
+ * @throws {Error} If the path is invalid or doesn't exist
+ */
+export async function validateCwdPath(inputPath, defaultPath = process.cwd()) {
+	// Use default if not provided
+	const targetPath = inputPath || defaultPath;
+
+	// Normalize and resolve to absolute path
+	// This handles '..' traversal and makes the path unambiguous
+	const normalizedPath = path.normalize(path.resolve(targetPath));
+
+	// Verify the path exists and is a directory
+	try {
+		const stats = await fs.stat(normalizedPath);
+		if (!stats.isDirectory()) {
+			throw new Error(`Path is not a directory: ${normalizedPath}`);
+		}
+	} catch (error) {
+		if (error.code === 'ENOENT') {
+			throw new Error(`Path does not exist: ${normalizedPath}`);
+		}
+		throw error;
+	}
+
+	return normalizedPath;
+}
+
+/**
+ * Validates a path option without requiring it to exist.
+ * Use this for paths that might be created or are optional.
+ *
+ * @param {string} inputPath - The path to validate
+ * @param {string} [defaultPath] - Default path to use if inputPath is not provided
+ * @returns {string} Normalized absolute path
+ */
+export function normalizePath(inputPath, defaultPath = process.cwd()) {
+	const targetPath = inputPath || defaultPath;
+	return path.normalize(path.resolve(targetPath));
+}