@reconcrap/boss-recommend-mcp 1.3.34 → 1.3.36

package/vendor/boss-chat-cli/src/cli.js

@@ -1,8 +1,9 @@
-#!/usr/bin/env node
-import { spawn } from 'node:child_process';
-import { appendFile, mkdir } from 'node:fs/promises';
-import path from 'node:path';
-import process from 'node:process';
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { appendFile, mkdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
 import * as readlineCore from 'node:readline';
 import readline from 'node:readline/promises';
 import util from 'node:util';
@@ -178,13 +179,14 @@ function parseTargetCount(value) {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
 }
 
-function parseArgs(argv) {
-  const args = {
-    command: 'run',
-    profile: 'default',
-    dryRun: false,
-    noState: false,
-    json: false,
+function parseArgs(argv) {
+  const args = {
+    command: 'run',
+    profile: 'default',
+    dataDir: '',
+    dryRun: false,
+    noState: false,
+    json: false,
     runId: '',
     detachedWorker: false,
     overrides: {
@@ -213,13 +215,17 @@ function parseArgs(argv) {
       index += 1;
     }
 
-    switch (name) {
-      case 'profile':
-        args.profile = value || args.profile;
-        break;
-      case 'dry-run':
-        args.dryRun = true;
-        break;
+    switch (name) {
+      case 'profile':
+        args.profile = value || args.profile;
+        break;
+      case 'data-dir':
+      case 'dataDir':
+        args.dataDir = String(value || '').trim();
+        break;
+      case 'dry-run':
+        args.dryRun = true;
+        break;
       case 'no-state':
         args.noState = true;
         break;
@@ -293,8 +299,86 @@ function parseArgs(argv) {
   if (positionals.length > 0) {
     args.command = positionals[0];
   }
-  return args;
-}
+  return args;
+}
+
+function isRootDirectory(targetPath) {
+  const resolved = path.resolve(String(targetPath || ''));
+  const parsed = path.parse(resolved);
+  return resolved.toLowerCase() === String(parsed.root || '').toLowerCase();
+}
+
+function isSystemDirectoryPath(targetPath) {
+  const resolved = path.resolve(String(targetPath || ''));
+  const normalized = resolved.replace(/\\/g, '/').toLowerCase();
+  if (process.platform === 'win32') {
+    return (
+      normalized.endsWith('/windows')
+      || normalized.endsWith('/windows/system32')
+      || normalized.endsWith('/windows/syswow64')
+      || normalized.endsWith('/program files')
+      || normalized.endsWith('/program files (x86)')
+    );
+  }
+  return (
+    normalized === '/system'
+    || normalized.startsWith('/system/')
+    || normalized === '/usr'
+    || normalized.startsWith('/usr/')
+    || normalized === '/bin'
+    || normalized.startsWith('/bin/')
+    || normalized === '/sbin'
+    || normalized.startsWith('/sbin/')
+  );
+}
+
+function resolveDefaultDataDir(env = process.env) {
+  const stateHomeRaw = String(env?.BOSS_RECOMMEND_HOME || '').trim();
+  const stateHome = stateHomeRaw
+    ? path.resolve(stateHomeRaw)
+    : path.join(os.homedir(), '.boss-recommend-mcp');
+  const source = stateHomeRaw
+    ? 'default:env:BOSS_RECOMMEND_HOME'
+    : 'default:user_home';
+  return {
+    path: path.join(stateHome, 'boss-chat'),
+    source,
+  };
+}
+
+function resolveDataDirDetails(args = {}, env = process.env, cwd = process.cwd()) {
+  const explicit = String(args?.dataDir || '').trim();
+  if (explicit) {
+    return {
+      path: path.resolve(explicit),
+      source: 'arg:data-dir',
+    };
+  }
+  const fromEnv = String(env?.BOSS_CHAT_HOME || '').trim();
+  if (fromEnv) {
+    return {
+      path: path.resolve(fromEnv),
+      source: 'env:BOSS_CHAT_HOME',
+    };
+  }
+  return resolveDefaultDataDir(env);
+}
+
+function resolveDataDir(args = {}, env = process.env, cwd = process.cwd()) {
+  return resolveDataDirDetails(args, env, cwd).path;
+}
+
+function validateDataDir(targetPath) {
+  const resolved = path.resolve(String(targetPath || ''));
+  if (isRootDirectory(resolved) || isSystemDirectoryPath(resolved)) {
+    return {
+      ok: false,
+      code: 'UNSAFE_DATA_DIR',
+      message: `Refusing unsafe boss-chat data dir: ${resolved}. Please use --data-dir or BOSS_CHAT_HOME to a writable user directory.`,
+    };
+  }
+  return { ok: true };
+}
 
 function printUsage() {
   console.log('Usage: boss-chat <command> [options]');
@@ -308,11 +392,12 @@ function printUsage() {
   console.log('  resume-run                      Resume paused async run');
   console.log('  cancel-run                      Cancel async run');
   console.log('');
-  console.log('Common options:');
-  console.log('  --profile <name>                Profile name (default: default)');
-  console.log('  --json                          JSON output for agent integration');
-  console.log('  --run-id <id>                   Target async run_id (for get/pause/resume/cancel)');
-  console.log('');
+  console.log('Common options:');
+  console.log('  --profile <name>                Profile name (default: default)');
+  console.log('  --data-dir <path>               Runtime data dir (default: $BOSS_CHAT_HOME or ~/.boss-recommend-mcp/boss-chat)');
+  console.log('  --json                          JSON output for agent integration');
+  console.log('  --run-id <id>                   Target async run_id (for get/pause/resume/cancel)');
+  console.log('');
   console.log('Run options:');
   console.log('  --dry-run                       Evaluate and click, but do not request resume');
   console.log('  --no-state                      Disable in-run candidate deduplication');
@@ -1511,10 +1596,30 @@ async function executeRunCommand(args, dataDir) {
   }
 }
 
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const dataDir = path.join(process.cwd(), '.boss-chat');
-  await mkdir(dataDir, { recursive: true });
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const resolvedDataDir = resolveDataDirDetails(args);
+  const dataDir = resolvedDataDir.path;
+  const dataDirValidation = validateDataDir(dataDir);
+  if (!dataDirValidation.ok) {
+    const failedPayload = {
+      status: 'FAILED',
+      error: {
+        code: dataDirValidation.code,
+        message: dataDirValidation.message,
+      },
+      data_dir: dataDir,
+      data_dir_source: resolvedDataDir.source,
+    };
+    if (args.json) {
+      console.log(JSON.stringify(failedPayload));
+    } else {
+      console.error(failedPayload.error.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  await mkdir(dataDir, { recursive: true });
 
   if (args.command === 'help') {
     printUsage();
@@ -1548,21 +1653,31 @@ async function main() {
       break;
     default:
       printUsage();
-      process.exitCode = 1;
-      return;
-  }
-
-  outputCommandResult(args, payload);
-  if (payload?.status === 'FAILED') {
-    process.exitCode = 1;
-  }
-}
-
-export const __testables = {
-  parseArgs,
-  connectBossChatPage,
-  hasHydratedChatShell,
-  promptRunProfile,
+      process.exitCode = 1;
+      return;
+  }
+
+  if (payload && typeof payload === 'object') {
+    payload = {
+      ...payload,
+      data_dir: dataDir,
+      data_dir_source: resolvedDataDir.source,
+    };
+  }
+  outputCommandResult(args, payload);
+  if (payload?.status === 'FAILED') {
+    process.exitCode = 1;
+  }
+}
+
+export const __testables = {
+  parseArgs,
+  resolveDataDirDetails,
+  resolveDataDir,
+  validateDataDir,
+  connectBossChatPage,
+  hasHydratedChatShell,
+  promptRunProfile,
   resolveJobsWithRetry,
   waitForChatShellHydration,
 };