@rozek/nanoclaw 1.2.17

package/src/env.ts

@@ -0,0 +1,42 @@
+import fs from 'fs';
+import path from 'path';
+import { logger } from './logger.js';
+
+/**
+ * Parse the .env file and return values for the requested keys.
+ * Does NOT load anything into process.env — callers decide what to
+ * do with the values. This keeps secrets out of the process environment
+ * so they don't leak to child processes.
+ */
+export function readEnvFile(keys: string[]): Record<string, string> {
+  const envFile = path.join(process.cwd(), '.env');
+  let content: string;
+  try {
+    content = fs.readFileSync(envFile, 'utf-8');
+  } catch (err) {
+    logger.debug({ err }, '.env file not found, using defaults');
+    return {};
+  }
+
+  const result: Record<string, string> = {};
+  const wanted = new Set(keys);
+
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eqIdx = trimmed.indexOf('=');
+    if (eqIdx === -1) continue;
+    const key = trimmed.slice(0, eqIdx).trim();
+    if (!wanted.has(key)) continue;
+    let value = trimmed.slice(eqIdx + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    if (value) result[key] = value;
+  }
+
+  return result;
+}

package/src/formatting.test.ts

@@ -0,0 +1,256 @@
+import { describe, it, expect } from 'vitest';
+
+import { ASSISTANT_NAME, TRIGGER_PATTERN } from './config.js';
+import {
+  escapeXml,
+  formatMessages,
+  formatOutbound,
+  stripInternalTags,
+} from './router.js';
+import { NewMessage } from './types.js';
+
+function makeMsg(overrides: Partial<NewMessage> = {}): NewMessage {
+  return {
+    id: '1',
+    chat_jid: 'group@g.us',
+    sender: '123@s.whatsapp.net',
+    sender_name: 'Alice',
+    content: 'hello',
+    timestamp: '2024-01-01T00:00:00.000Z',
+    ...overrides,
+  };
+}
+
+// --- escapeXml ---
+
+describe('escapeXml', () => {
+  it('escapes ampersands', () => {
+    expect(escapeXml('a & b')).toBe('a &amp; b');
+  });
+
+  it('escapes less-than', () => {
+    expect(escapeXml('a < b')).toBe('a &lt; b');
+  });
+
+  it('escapes greater-than', () => {
+    expect(escapeXml('a > b')).toBe('a &gt; b');
+  });
+
+  it('escapes double quotes', () => {
+    expect(escapeXml('"hello"')).toBe('&quot;hello&quot;');
+  });
+
+  it('handles multiple special characters together', () => {
+    expect(escapeXml('a & b < c > d "e"')).toBe(
+      'a &amp; b &lt; c &gt; d &quot;e&quot;',
+    );
+  });
+
+  it('passes through strings with no special chars', () => {
+    expect(escapeXml('hello world')).toBe('hello world');
+  });
+
+  it('handles empty string', () => {
+    expect(escapeXml('')).toBe('');
+  });
+});
+
+// --- formatMessages ---
+
+describe('formatMessages', () => {
+  const TZ = 'UTC';
+
+  it('formats a single message as XML with context header', () => {
+    const result = formatMessages([makeMsg()], TZ);
+    expect(result).toContain('<context timezone="UTC" />');
+    expect(result).toContain('<message sender="Alice"');
+    expect(result).toContain('>hello</message>');
+    expect(result).toContain('Jan 1, 2024');
+  });
+
+  it('formats multiple messages', () => {
+    const msgs = [
+      makeMsg({
+        id: '1',
+        sender_name: 'Alice',
+        content: 'hi',
+        timestamp: '2024-01-01T00:00:00.000Z',
+      }),
+      makeMsg({
+        id: '2',
+        sender_name: 'Bob',
+        content: 'hey',
+        timestamp: '2024-01-01T01:00:00.000Z',
+      }),
+    ];
+    const result = formatMessages(msgs, TZ);
+    expect(result).toContain('sender="Alice"');
+    expect(result).toContain('sender="Bob"');
+    expect(result).toContain('>hi</message>');
+    expect(result).toContain('>hey</message>');
+  });
+
+  it('escapes special characters in sender names', () => {
+    const result = formatMessages([makeMsg({ sender_name: 'A & B <Co>' })], TZ);
+    expect(result).toContain('sender="A &amp; B &lt;Co&gt;"');
+  });
+
+  it('escapes special characters in content', () => {
+    const result = formatMessages(
+      [makeMsg({ content: '<script>alert("xss")</script>' })],
+      TZ,
+    );
+    expect(result).toContain(
+      '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;',
+    );
+  });
+
+  it('handles empty array', () => {
+    const result = formatMessages([], TZ);
+    expect(result).toContain('<context timezone="UTC" />');
+    expect(result).toContain('<messages>\n\n</messages>');
+  });
+
+  it('converts timestamps to local time for given timezone', () => {
+    // 2024-01-01T18:30:00Z in America/New_York (EST) = 1:30 PM
+    const result = formatMessages(
+      [makeMsg({ timestamp: '2024-01-01T18:30:00.000Z' })],
+      'America/New_York',
+    );
+    expect(result).toContain('1:30');
+    expect(result).toContain('PM');
+    expect(result).toContain('<context timezone="America/New_York" />');
+  });
+});
+
+// --- TRIGGER_PATTERN ---
+
+describe('TRIGGER_PATTERN', () => {
+  const name = ASSISTANT_NAME;
+  const lower = name.toLowerCase();
+  const upper = name.toUpperCase();
+
+  it('matches @name at start of message', () => {
+    expect(TRIGGER_PATTERN.test(`@${name} hello`)).toBe(true);
+  });
+
+  it('matches case-insensitively', () => {
+    expect(TRIGGER_PATTERN.test(`@${lower} hello`)).toBe(true);
+    expect(TRIGGER_PATTERN.test(`@${upper} hello`)).toBe(true);
+  });
+
+  it('does not match when not at start of message', () => {
+    expect(TRIGGER_PATTERN.test(`hello @${name}`)).toBe(false);
+  });
+
+  it('does not match partial name like @NameExtra (word boundary)', () => {
+    expect(TRIGGER_PATTERN.test(`@${name}extra hello`)).toBe(false);
+  });
+
+  it('matches with word boundary before apostrophe', () => {
+    expect(TRIGGER_PATTERN.test(`@${name}'s thing`)).toBe(true);
+  });
+
+  it('matches @name alone (end of string is a word boundary)', () => {
+    expect(TRIGGER_PATTERN.test(`@${name}`)).toBe(true);
+  });
+
+  it('matches with leading whitespace after trim', () => {
+    // The actual usage trims before testing: TRIGGER_PATTERN.test(m.content.trim())
+    expect(TRIGGER_PATTERN.test(`@${name} hey`.trim())).toBe(true);
+  });
+});
+
+// --- Outbound formatting (internal tag stripping + prefix) ---
+
+describe('stripInternalTags', () => {
+  it('strips single-line internal tags', () => {
+    expect(stripInternalTags('hello <internal>secret</internal> world')).toBe(
+      'hello  world',
+    );
+  });
+
+  it('strips multi-line internal tags', () => {
+    expect(
+      stripInternalTags('hello <internal>\nsecret\nstuff\n</internal> world'),
+    ).toBe('hello  world');
+  });
+
+  it('strips multiple internal tag blocks', () => {
+    expect(
+      stripInternalTags('<internal>a</internal>hello<internal>b</internal>'),
+    ).toBe('hello');
+  });
+
+  it('returns empty string when text is only internal tags', () => {
+    expect(stripInternalTags('<internal>only this</internal>')).toBe('');
+  });
+});
+
+describe('formatOutbound', () => {
+  it('returns text with internal tags stripped', () => {
+    expect(formatOutbound('hello world')).toBe('hello world');
+  });
+
+  it('returns empty string when all text is internal', () => {
+    expect(formatOutbound('<internal>hidden</internal>')).toBe('');
+  });
+
+  it('strips internal tags from remaining text', () => {
+    expect(
+      formatOutbound('<internal>thinking</internal>The answer is 42'),
+    ).toBe('The answer is 42');
+  });
+});
+
+// --- Trigger gating with requiresTrigger flag ---
+
+describe('trigger gating (requiresTrigger interaction)', () => {
+  // Replicates the exact logic from processGroupMessages and startMessageLoop:
+  //   if (!isMainGroup && group.requiresTrigger !== false) { check trigger }
+  function shouldRequireTrigger(
+    isMainGroup: boolean,
+    requiresTrigger: boolean | undefined,
+  ): boolean {
+    return !isMainGroup && requiresTrigger !== false;
+  }
+
+  function shouldProcess(
+    isMainGroup: boolean,
+    requiresTrigger: boolean | undefined,
+    messages: NewMessage[],
+  ): boolean {
+    if (!shouldRequireTrigger(isMainGroup, requiresTrigger)) return true;
+    return messages.some((m) => TRIGGER_PATTERN.test(m.content.trim()));
+  }
+
+  it('main group always processes (no trigger needed)', () => {
+    const msgs = [makeMsg({ content: 'hello no trigger' })];
+    expect(shouldProcess(true, undefined, msgs)).toBe(true);
+  });
+
+  it('main group processes even with requiresTrigger=true', () => {
+    const msgs = [makeMsg({ content: 'hello no trigger' })];
+    expect(shouldProcess(true, true, msgs)).toBe(true);
+  });
+
+  it('non-main group with requiresTrigger=undefined requires trigger (defaults to true)', () => {
+    const msgs = [makeMsg({ content: 'hello no trigger' })];
+    expect(shouldProcess(false, undefined, msgs)).toBe(false);
+  });
+
+  it('non-main group with requiresTrigger=true requires trigger', () => {
+    const msgs = [makeMsg({ content: 'hello no trigger' })];
+    expect(shouldProcess(false, true, msgs)).toBe(false);
+  });
+
+  it('non-main group with requiresTrigger=true processes when trigger present', () => {
+    const msgs = [makeMsg({ content: `@${ASSISTANT_NAME} do something` })];
+    expect(shouldProcess(false, true, msgs)).toBe(true);
+  });
+
+  it('non-main group with requiresTrigger=false always processes (no trigger needed)', () => {
+    const msgs = [makeMsg({ content: 'hello no trigger' })];
+    expect(shouldProcess(false, false, msgs)).toBe(true);
+  });
+});

package/src/group-folder.test.ts

@@ -0,0 +1,43 @@
+import path from 'path';
+
+import { describe, expect, it } from 'vitest';
+
+import {
+  isValidGroupFolder,
+  resolveGroupFolderPath,
+  resolveGroupIpcPath,
+} from './group-folder.js';
+
+describe('group folder validation', () => {
+  it('accepts normal group folder names', () => {
+    expect(isValidGroupFolder('main')).toBe(true);
+    expect(isValidGroupFolder('family-chat')).toBe(true);
+    expect(isValidGroupFolder('Team_42')).toBe(true);
+  });
+
+  it('rejects traversal and reserved names', () => {
+    expect(isValidGroupFolder('../../etc')).toBe(false);
+    expect(isValidGroupFolder('/tmp')).toBe(false);
+    expect(isValidGroupFolder('global')).toBe(false);
+    expect(isValidGroupFolder('')).toBe(false);
+  });
+
+  it('resolves safe paths under groups directory', () => {
+    const resolved = resolveGroupFolderPath('family-chat');
+    expect(resolved.endsWith(`${path.sep}groups${path.sep}family-chat`)).toBe(
+      true,
+    );
+  });
+
+  it('resolves safe paths under data ipc directory', () => {
+    const resolved = resolveGroupIpcPath('family-chat');
+    expect(
+      resolved.endsWith(`${path.sep}data${path.sep}ipc${path.sep}family-chat`),
+    ).toBe(true);
+  });
+
+  it('throws for unsafe folder names', () => {
+    expect(() => resolveGroupFolderPath('../../etc')).toThrow();
+    expect(() => resolveGroupIpcPath('/tmp')).toThrow();
+  });
+});

package/src/group-folder.ts

@@ -0,0 +1,44 @@
+import path from 'path';
+
+import { DATA_DIR, GROUPS_DIR } from './config.js';
+
+const GROUP_FOLDER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+const RESERVED_FOLDERS = new Set(['global']);
+
+export function isValidGroupFolder(folder: string): boolean {
+  if (!folder) return false;
+  if (folder !== folder.trim()) return false;
+  if (!GROUP_FOLDER_PATTERN.test(folder)) return false;
+  if (folder.includes('/') || folder.includes('\\')) return false;
+  if (folder.includes('..')) return false;
+  if (RESERVED_FOLDERS.has(folder.toLowerCase())) return false;
+  return true;
+}
+
+export function assertValidGroupFolder(folder: string): void {
+  if (!isValidGroupFolder(folder)) {
+    throw new Error(`Invalid group folder "${folder}"`);
+  }
+}
+
+function ensureWithinBase(baseDir: string, resolvedPath: string): void {
+  const rel = path.relative(baseDir, resolvedPath);
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    throw new Error(`Path escapes base directory: ${resolvedPath}`);
+  }
+}
+
+export function resolveGroupFolderPath(folder: string): string {
+  assertValidGroupFolder(folder);
+  const groupPath = path.resolve(GROUPS_DIR, folder);
+  ensureWithinBase(GROUPS_DIR, groupPath);
+  return groupPath;
+}
+
+export function resolveGroupIpcPath(folder: string): string {
+  assertValidGroupFolder(folder);
+  const ipcBaseDir = path.resolve(DATA_DIR, 'ipc');
+  const ipcPath = path.resolve(ipcBaseDir, folder);
+  ensureWithinBase(ipcBaseDir, ipcPath);
+  return ipcPath;
+}