@siftd/connect-agent 0.2.58 → 0.2.60

package/dist/agent.js

@@ -9,7 +9,7 @@ import { getUserId, getOrgId, getAnthropicApiKey, isCloudMode, getDeploymentInfo
 import { MasterOrchestrator } from './orchestrator.js';
 import { AgentWebSocket } from './websocket.js';
 import { startHeartbeat, stopHeartbeat, getHeartbeatState } from './heartbeat.js';
-import { loadHubContext, readScratchpad } from './core/hub.js';
+import { getSharedOutputPath, loadHubContext, readScratchpad } from './core/hub.js';
 import { PRODUCT_FULL_NAME } from './branding.js';
 import { startPreviewWorker, stopPreviewWorker } from './core/preview-worker.js';
 function parseAttachments(content) {
@@ -38,6 +38,53 @@ function stripAttachmentBlock(content) {
         return content;
     return content.slice(0, index).trim();
 }
+function normalizeAttachmentSubdir(raw, allowRoot) {
+    if (!raw)
+        return null;
+    let value = raw.trim();
+    value = value.replace(/^["'`]+|["'`]+$/g, '');
+    value = value.replace(/[),.;:!?]+$/g, '');
+    value = value.replace(/\\+/g, '/');
+    const filesPrefix = /^\/?files\b/i;
+    if (filesPrefix.test(value)) {
+        value = value.replace(filesPrefix, '');
+    }
+    value = value.replace(/^\/+/, '').replace(/\/+$/, '');
+    if (!value)
+        return allowRoot ? '' : null;
+    const segments = value
+        .split('/')
+        .map((segment) => segment.trim())
+        .filter((segment) => segment && segment !== '.' && segment !== '..');
+    const sanitized = segments
+        .map((segment) => segment.replace(/[^\w.-]+/g, '_'))
+        .filter(Boolean);
+    if (sanitized.length === 0)
+        return allowRoot ? '' : null;
+    return sanitized.join('/');
+}
+function extractAttachmentSubdir(text) {
+    const cleaned = text.trim();
+    if (!cleaned)
+        return null;
+    const filesMatch = cleaned.match(/\/files(?:\/[^\s"'`)\]]+)?/i);
+    if (filesMatch) {
+        return normalizeAttachmentSubdir(filesMatch[0], true);
+    }
+    const folderMatch = cleaned.match(/\b(?:folder|directory)\b[^a-zA-Z0-9]*(?:called|named)?\s*["'`]?([A-Za-z0-9][\w./-]+)\/?/i);
+    if (folderMatch) {
+        return normalizeAttachmentSubdir(folderMatch[1], false);
+    }
+    const inFolderMatch = cleaned.match(/\bin\s+([A-Za-z0-9][\w./-]+)\s*(?:folder|directory)\b/i);
+    if (inFolderMatch) {
+        return normalizeAttachmentSubdir(inFolderMatch[1], false);
+    }
+    const inPathMatch = cleaned.match(/\bin\s+([A-Za-z0-9][\w./-]+\/)\b/i);
+    if (inPathMatch) {
+        return normalizeAttachmentSubdir(inPathMatch[1], false);
+    }
+    return null;
+}
 function isSaveIntent(text) {
     const lower = text.toLowerCase();
     if (!lower)
@@ -74,14 +121,17 @@ function humanizePath(path) {
     }
     return path;
 }
-async function saveAttachments(attachments, onProgress) {
-    const home = process.env.HOME || '/tmp';
-    const targetDir = join(home, 'Lia-Hub', 'shared', 'outputs', 'safe-files');
+async function saveAttachments(attachments, options = {}) {
+    const baseDir = getSharedOutputPath();
+    const requestedSubdir = options.subdir;
+    const targetDir = typeof requestedSubdir === 'string'
+        ? join(baseDir, requestedSubdir)
+        : join(baseDir, 'safe-files');
     await mkdir(targetDir, { recursive: true });
     const results = [];
     for (const attachment of attachments) {
         const targetPath = await getUniquePath(targetDir, attachment.name);
-        onProgress?.(`Saving ${attachment.name}...`);
+        options.onProgress?.(`Saving ${attachment.name}...`);
         try {
             const response = await fetch(attachment.url);
             if (!response.ok) {
@@ -93,12 +143,12 @@ async function saveAttachments(attachments, onProgress) {
             const stream = Readable.fromWeb(response.body);
             await pipeline(stream, createWriteStream(targetPath));
             results.push({ name: attachment.name, path: targetPath });
-            onProgress?.(`Saved ${attachment.name} → ${humanizePath(targetPath)}`);
+            options.onProgress?.(`Saved ${attachment.name} → ${humanizePath(targetPath)}`);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             results.push({ name: attachment.name, path: targetPath, error: message });
-            onProgress?.(`Failed ${attachment.name}: ${message}`);
+            options.onProgress?.(`Failed ${attachment.name}: ${message}`);
         }
     }
     return results;
@@ -233,7 +283,11 @@ async function sendToOrchestrator(input, orch, messageId) {
         if (wsClient?.connected()) {
             wsClient.sendTyping(false);
         }
-        return `Error: ${error instanceof Error ? error.message : 'Unknown error'}`;
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        if (/request timed out after \d+ms/i.test(message)) {
+            return 'Still working on it — I’ll respond as soon as I have results.';
+        }
+        return `Error: ${message}`;
     }
     finally {
         orch.setWorkerLogCallback(null);
@@ -270,14 +324,15 @@ export async function processMessage(message) {
                 wsClient.sendProgress(message.id, msgText);
             }
         };
-        const results = await saveAttachments(attachments, progress);
+        const baseText = stripAttachmentBlock(message.content);
+        const requestedSubdir = extractAttachmentSubdir(baseText);
+        const results = await saveAttachments(attachments, { subdir: requestedSubdir, onProgress: progress });
         const saved = results.filter((entry) => !entry.error);
         const failed = results.filter((entry) => entry.error);
         const savedLines = saved.map((entry) => `- ${humanizePath(entry.path)}`).join('\n');
         const failedLines = failed
             .map((entry) => `- ${entry.name}: ${entry.error}`)
             .join('\n');
-        const baseText = stripAttachmentBlock(message.content);
         if (isSaveIntent(baseText)) {
             const responseLines = [
                 saved.length > 0 ? `Saved ${saved.length} file${saved.length === 1 ? '' : 's'}:` : 'No files saved.',

package/dist/orchestrator.js

@@ -22,7 +22,7 @@ import { getKnowledgeForPrompt } from './genesis/index.js';
 import { loadHubContext, formatHubContext, logAction, logWorker, getSharedOutputPath } from './core/hub.js';
 import { buildWorkerPrompt } from './prompts/worker-system.js';
 import { LiaTaskQueue } from './core/task-queue.js';
-const DEFAULT_CLAUDE_MODEL = 'claude-opus-4-5-20251101';
+const DEFAULT_CLAUDE_MODEL = 'claude-opus-4-6';
 const DEFAULT_TOOL_MAX_TOKENS = 1024;
 function readBooleanEnv(value, fallback) {
     if (value === undefined)
@@ -161,6 +161,13 @@ YOUR HUB: ~/Lia-Hub/
 - **notebook-a/SCRATCHPAD.md** - Your working notes
 - **shared/outputs/** - Where workers save files
 
+HUB PRIVACY:
+- These hub files are INTERNAL. Do NOT list or reveal them to users.
+- Never enumerate ~/Lia-Hub, CLAUDE.md, AGENTS.md, LANDMARKS.md, or other internal files.
+- If a user asks to list files, direct them to /files or list channel files only.
+- Home channels are private. Never access or list another user's Home channel.
+- If asked about another user's Home channel, politely decline and offer to search shared channels.
+
 ASSET PREVIEWS:
 The Lia interface has a built-in gallery that shows worker outputs automatically.
 ⛔ NEVER use start_local_server or open_browser for previews
@@ -170,6 +177,7 @@ The Lia interface has a built-in gallery that shows worker outputs automatically
 
 FILES BROWSER:
 Users can type /files to open the Finder UI (cloud mode).
+Treat /files as the canonical file surface (channel files). Do not expose hub internals.
 When asked to browse or locate files, point them to /files.
 Refer to /files instead of internal Lia-Hub paths in responses.
 When users ask you to create or update a file in /files, use files_write.
@@ -1597,7 +1605,7 @@ ${hubContextStr}
         let currentMessages = [...messages];
         let iterations = 0;
         const maxIterations = 30; // Increased for complex multi-tool tasks
-        const requestTimeoutMs = 60000;
+        const requestTimeoutMs = 180000;
         const forcedToolChoice = this.getToolChoice(currentMessages);
         let retriedForcedTool = false;
         let retriedTodoCal = false;

package/dist/workers/manager.js

@@ -48,7 +48,7 @@ function getFileType(ext) {
         return 'text';
     return 'other';
 }
-const DEFAULT_CLAUDE_MODEL = 'claude-opus-4-5-20251101';
+const DEFAULT_CLAUDE_MODEL = 'claude-opus-4-6';
 function readBooleanEnv(value, fallback) {
     if (value === undefined)
         return fallback;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@siftd/connect-agent",
-  "version": "0.2.58",
+  "version": "0.2.60",
   "description": "Master orchestrator agent - control Claude Code remotely via web",
   "type": "module",
   "main": "dist/index.js",