@stackmemoryai/stackmemory 0.8.1 → 1.0.1

package/dist/src/hooks/sms-action-runner.js

@@ -1,371 +0,0 @@
-import { fileURLToPath as __fileURLToPath } from 'url';
-import { dirname as __pathDirname } from 'path';
-const __filename = __fileURLToPath(import.meta.url);
-const __dirname = __pathDirname(__filename);
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
-import { homedir } from "os";
-import { execFileSync } from "child_process";
-import { randomBytes } from "crypto";
-import { writeFileSecure, ensureSecureDir } from "./secure-fs.js";
-import { ActionQueueSchema, parseConfigSafe } from "./schemas.js";
-import { LinearClient } from "../integrations/linear/client.js";
-import { LinearAuthManager } from "../integrations/linear/auth.js";
-function parseCommandArgs(command) {
-  const args = [];
-  let current = "";
-  let inSingleQuote = false;
-  let inDoubleQuote = false;
-  let escaped = false;
-  for (let i = 0; i < command.length; i++) {
-    const char = command[i];
-    if (escaped) {
-      current += char;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && !inSingleQuote) {
-      escaped = true;
-      continue;
-    }
-    if (char === "'" && !inDoubleQuote) {
-      inSingleQuote = !inSingleQuote;
-      continue;
-    }
-    if (char === '"' && !inSingleQuote) {
-      inDoubleQuote = !inDoubleQuote;
-      continue;
-    }
-    if (char === " " && !inSingleQuote && !inDoubleQuote) {
-      if (current.length > 0) {
-        args.push(current);
-        current = "";
-      }
-      continue;
-    }
-    current += char;
-  }
-  if (current.length > 0) {
-    args.push(current);
-  }
-  return args;
-}
-const SAFE_ACTION_PATTERNS = [
-  // Git/GitHub CLI commands (limited to safe operations)
-  { pattern: /^gh pr (view|list|status|checks) (\d+)$/ },
-  { pattern: /^gh pr review (\d+) --approve$/ },
-  { pattern: /^gh pr merge (\d+) --squash$/ },
-  { pattern: /^gh issue (view|list) (\d+)?$/ },
-  // NPM commands (limited to safe operations)
-  { pattern: /^npm run (build|test|lint|lint:fix|test:run)$/ },
-  { pattern: /^npm (test|run build)$/ },
-  // StackMemory commands
-  { pattern: /^stackmemory (status|notify check|context list)$/ },
-  // Task start with optional --assign-me flag (Linear task ID is UUID format)
-  {
-    pattern: /^stackmemory task start ([a-f0-9-]{36})( --assign-me)?$/
-  },
-  // Additional StackMemory commands for mobile/WhatsApp
-  { pattern: /^stackmemory context show$/ },
-  { pattern: /^stackmemory task list$/ },
-  // Git commands
-  { pattern: /^git (status|diff|log|branch)( --[a-z-]+)*$/ },
-  { pattern: /^git add -A && git commit$/ },
-  { pattern: /^gh pr create --fill$/ },
-  // Git log with line limit for mobile-friendly output
-  { pattern: /^git log --oneline -\d{1,2}$/ },
-  // WhatsApp/Mobile quick commands
-  { pattern: /^status$/i },
-  { pattern: /^tasks$/i },
-  { pattern: /^context$/i },
-  { pattern: /^help$/i },
-  { pattern: /^sync$/i },
-  // Claude Code launcher
-  { pattern: /^claude-sm$/ },
-  // Log viewing (safe read-only)
-  { pattern: /^tail -\d+ ~\/\.claude\/logs\/\*\.log$/ },
-  // Custom aliases (cwm = claude worktree merge)
-  { pattern: /^cwm$/ },
-  // Simple echo/confirmation (no variables)
-  {
-    pattern: /^echo "?(Done|OK|Confirmed|Acknowledged|Great work! Time for a coffee break\.)"?$/
-  }
-];
-function isActionAllowed(action) {
-  const trimmed = action.trim();
-  return SAFE_ACTION_PATTERNS.some(({ pattern, validate }) => {
-    const match = trimmed.match(pattern);
-    if (!match) return false;
-    if (validate && !validate(match)) return false;
-    return true;
-  });
-}
-const QUEUE_PATH = join(homedir(), ".stackmemory", "sms-action-queue.json");
-const DEFAULT_QUEUE = {
-  actions: [],
-  lastChecked: (/* @__PURE__ */ new Date()).toISOString()
-};
-function loadActionQueue() {
-  try {
-    if (existsSync(QUEUE_PATH)) {
-      const data = JSON.parse(readFileSync(QUEUE_PATH, "utf8"));
-      return parseConfigSafe(
-        ActionQueueSchema,
-        data,
-        DEFAULT_QUEUE,
-        "action-queue"
-      );
-    }
-  } catch {
-  }
-  return { ...DEFAULT_QUEUE, lastChecked: (/* @__PURE__ */ new Date()).toISOString() };
-}
-function saveActionQueue(queue) {
-  try {
-    ensureSecureDir(join(homedir(), ".stackmemory"));
-    writeFileSecure(QUEUE_PATH, JSON.stringify(queue, null, 2));
-  } catch {
-  }
-}
-function queueAction(promptId, response, action) {
-  const queue = loadActionQueue();
-  const id = randomBytes(8).toString("hex");
-  queue.actions.push({
-    id,
-    promptId,
-    response,
-    action,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    status: "pending"
-  });
-  saveActionQueue(queue);
-  return id;
-}
-function getLinearClient() {
-  const apiKey = process.env["LINEAR_API_KEY"];
-  if (apiKey && apiKey.startsWith("lin_api_")) {
-    return new LinearClient({ apiKey });
-  }
-  try {
-    const authManager = new LinearAuthManager();
-    const tokens = authManager.loadTokens();
-    if (tokens?.accessToken) {
-      return new LinearClient({ accessToken: tokens.accessToken });
-    }
-  } catch {
-  }
-  return null;
-}
-async function handleSpecialAction(action) {
-  const taskStartMatch = action.match(
-    /^stackmemory task start ([a-f0-9-]{36})( --assign-me)?$/
-  );
-  if (taskStartMatch) {
-    const issueId = taskStartMatch[1];
-    const client = getLinearClient();
-    if (!client) {
-      return {
-        handled: true,
-        success: false,
-        error: "Linear not configured. Set LINEAR_API_KEY or run stackmemory linear setup."
-      };
-    }
-    try {
-      const result = await client.startIssue(issueId);
-      if (result.success && result.issue) {
-        return {
-          handled: true,
-          success: true,
-          output: `Started: ${result.issue.identifier} - ${result.issue.title}`
-        };
-      }
-      return {
-        handled: true,
-        success: false,
-        error: result.error || "Failed to start issue"
-      };
-    } catch (err) {
-      return {
-        handled: true,
-        success: false,
-        error: err instanceof Error ? err.message : "Unknown error"
-      };
-    }
-  }
-  return { handled: false };
-}
-async function executeActionSafe(action, _response) {
-  if (!isActionAllowed(action)) {
-    console.error(`[sms-action] Action not in allowlist: ${action}`);
-    return {
-      success: false,
-      error: `Action not allowed. Only pre-approved commands can be executed via SMS.`
-    };
-  }
-  const specialResult = await handleSpecialAction(action);
-  if (specialResult.handled) {
-    return {
-      success: specialResult.success || false,
-      output: specialResult.output,
-      error: specialResult.error
-    };
-  }
-  try {
-    console.log(`[sms-action] Executing safe action: ${action}`);
-    const parts = parseCommandArgs(action);
-    if (parts.length === 0) {
-      return { success: false, error: "Empty command" };
-    }
-    const cmd = parts[0];
-    const args = parts.slice(1);
-    const output = execFileSync(cmd, args, {
-      encoding: "utf8",
-      timeout: 6e4,
-      stdio: ["pipe", "pipe", "pipe"],
-      shell: false
-      // Explicitly disable shell
-    });
-    return { success: true, output };
-  } catch (err) {
-    const error = err instanceof Error ? err.message : String(err);
-    return { success: false, error };
-  }
-}
-function getPendingActions() {
-  const queue = loadActionQueue();
-  return queue.actions.filter((a) => a.status === "pending");
-}
-function markActionRunning(id) {
-  const queue = loadActionQueue();
-  const action = queue.actions.find((a) => a.id === id);
-  if (action) {
-    action.status = "running";
-    saveActionQueue(queue);
-  }
-}
-function markActionCompleted(id, result, error) {
-  const queue = loadActionQueue();
-  const action = queue.actions.find((a) => a.id === id);
-  if (action) {
-    action.status = error ? "failed" : "completed";
-    action.result = result;
-    action.error = error;
-    saveActionQueue(queue);
-  }
-}
-async function executeAction(action) {
-  markActionRunning(action.id);
-  const result = await executeActionSafe(action.action, action.response);
-  if (result.success) {
-    markActionCompleted(action.id, result.output);
-  } else {
-    markActionCompleted(action.id, void 0, result.error);
-  }
-  return result;
-}
-async function processAllPendingActions() {
-  const pending = getPendingActions();
-  let succeeded = 0;
-  let failed = 0;
-  for (const action of pending) {
-    const result = await executeAction(action);
-    if (result.success) {
-      succeeded++;
-    } else {
-      failed++;
-    }
-  }
-  return { processed: pending.length, succeeded, failed };
-}
-function cleanupOldActions() {
-  const queue = loadActionQueue();
-  const completed = queue.actions.filter(
-    (a) => a.status === "completed" || a.status === "failed"
-  );
-  if (completed.length > 50) {
-    const toRemove = completed.slice(0, completed.length - 50);
-    queue.actions = queue.actions.filter(
-      (a) => !toRemove.find((r) => r.id === a.id)
-    );
-    saveActionQueue(queue);
-    return toRemove.length;
-  }
-  return 0;
-}
-const ACTION_TEMPLATES = {
-  // Git/PR actions (PR numbers must be validated as integers)
-  approvePR: (prNumber) => {
-    if (!/^\d+$/.test(prNumber)) {
-      throw new Error("Invalid PR number");
-    }
-    return `gh pr review ${prNumber} --approve`;
-  },
-  mergePR: (prNumber) => {
-    if (!/^\d+$/.test(prNumber)) {
-      throw new Error("Invalid PR number");
-    }
-    return `gh pr merge ${prNumber} --squash`;
-  },
-  viewPR: (prNumber) => {
-    if (!/^\d+$/.test(prNumber)) {
-      throw new Error("Invalid PR number");
-    }
-    return `gh pr view ${prNumber}`;
-  },
-  // Build actions (no user input)
-  rebuild: () => `npm run build`,
-  retest: () => `npm run test:run`,
-  lint: () => `npm run lint:fix`,
-  // Status actions (no user input)
-  status: () => `stackmemory status`,
-  checkNotifications: () => `stackmemory notify check`
-  // REMOVED for security - these templates allowed arbitrary user input:
-  // - requestChanges (allowed arbitrary message)
-  // - closePR (could be used maliciously)
-  // - deploy/rollback (too dangerous for SMS)
-  // - verifyDeployment (allowed arbitrary URL)
-  // - notifySlack (allowed arbitrary message - command injection)
-  // - notifyTeam (allowed arbitrary message - command injection)
-};
-function createAction(template, ...args) {
-  const fn = ACTION_TEMPLATES[template];
-  if (typeof fn === "function") {
-    return fn(...args);
-  }
-  return fn;
-}
-function startActionWatcher(intervalMs = 5e3) {
-  console.log(
-    `[sms-action] Starting action watcher (interval: ${intervalMs}ms)`
-  );
-  return setInterval(() => {
-    const pending = getPendingActions();
-    if (pending.length > 0) {
-      console.log(`[sms-action] Found ${pending.length} pending action(s)`);
-      processAllPendingActions();
-    }
-  }, intervalMs);
-}
-function handleSMSResponse(promptId, response, action) {
-  if (action) {
-    const actionId = queueAction(promptId, response, action);
-    console.log(`[sms-action] Queued action ${actionId}: ${action}`);
-  }
-}
-export {
-  ACTION_TEMPLATES,
-  cleanupOldActions,
-  createAction,
-  executeAction,
-  executeActionSafe,
-  getPendingActions,
-  handleSMSResponse,
-  loadActionQueue,
-  markActionCompleted,
-  markActionRunning,
-  processAllPendingActions,
-  queueAction,
-  saveActionQueue,
-  startActionWatcher
-};
-//# sourceMappingURL=sms-action-runner.js.map

package/dist/src/hooks/sms-action-runner.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/hooks/sms-action-runner.ts"],
-  "sourcesContent": ["/**\n * SMS Action Runner - Executes actions based on SMS responses\n * Bridges SMS responses to Claude Code actions\n *\n * Security: Uses allowlist-based action execution to prevent command injection\n */\n\nimport { existsSync, readFileSync } from 'fs';\nimport { join } from 'path';\nimport { homedir } from 'os';\nimport { execFileSync } from 'child_process';\nimport { randomBytes } from 'crypto';\nimport { writeFileSecure, ensureSecureDir } from './secure-fs.js';\nimport { ActionQueueSchema, parseConfigSafe } from './schemas.js';\nimport { LinearClient } from '../integrations/linear/client.js';\nimport { LinearAuthManager } from '../integrations/linear/auth.js';\n\n/**\n * Parse a command string into an array of arguments, respecting quotes\n * Handles single quotes, double quotes, and escaped characters\n *\n * Examples:\n *   'echo \"hello world\"' -> ['echo', 'hello world']\n *   \"git commit -m 'fix bug'\" -> ['git', 'commit', '-m', 'fix bug']\n *   'npm run build' -> ['npm', 'run', 'build']\n */\nfunction parseCommandArgs(command: string): string[] {\n  const args: string[] = [];\n  let current = '';\n  let inSingleQuote = false;\n  let inDoubleQuote = false;\n  let escaped = false;\n\n  for (let i = 0; i < command.length; i++) {\n    const char = command[i];\n\n    if (escaped) {\n      current += char;\n      escaped = false;\n      continue;\n    }\n\n    if (char === '\\\\' && !inSingleQuote) {\n      escaped = true;\n      continue;\n    }\n\n    if (char === \"'\" && !inDoubleQuote) {\n      inSingleQuote = !inSingleQuote;\n      continue;\n    }\n\n    if (char === '\"' && !inSingleQuote) {\n      inDoubleQuote = !inDoubleQuote;\n      continue;\n    }\n\n    if (char === ' ' && !inSingleQuote && !inDoubleQuote) {\n      if (current.length > 0) {\n        args.push(current);\n        current = '';\n      }\n      continue;\n    }\n\n    current += char;\n  }\n\n  if (current.length > 0) {\n    args.push(current);\n  }\n\n  return args;\n}\n\n// Allowlist of safe action patterns\nconst SAFE_ACTION_PATTERNS: Array<{\n  pattern: RegExp;\n  validate?: (match: RegExpMatchArray) => boolean;\n}> = [\n  // Git/GitHub CLI commands (limited to safe operations)\n  { pattern: /^gh pr (view|list|status|checks) (\\d+)$/ },\n  { pattern: /^gh pr review (\\d+) --approve$/ },\n  { pattern: /^gh pr merge (\\d+) --squash$/ },\n  { pattern: /^gh issue (view|list) (\\d+)?$/ },\n\n  // NPM commands (limited to safe operations)\n  { pattern: /^npm run (build|test|lint|lint:fix|test:run)$/ },\n  { pattern: /^npm (test|run build)$/ },\n\n  // StackMemory commands\n  { pattern: /^stackmemory (status|notify check|context list)$/ },\n  // Task start with optional --assign-me flag (Linear task ID is UUID format)\n  {\n    pattern: /^stackmemory task start ([a-f0-9-]{36})( --assign-me)?$/,\n  },\n  // Additional StackMemory commands for mobile/WhatsApp\n  { pattern: /^stackmemory context show$/ },\n  { pattern: /^stackmemory task list$/ },\n\n  // Git commands\n  { pattern: /^git (status|diff|log|branch)( --[a-z-]+)*$/ },\n  { pattern: /^git add -A && git commit$/ },\n  { pattern: /^gh pr create --fill$/ },\n  // Git log with line limit for mobile-friendly output\n  { pattern: /^git log --oneline -\\d{1,2}$/ },\n\n  // WhatsApp/Mobile quick commands\n  { pattern: /^status$/i },\n  { pattern: /^tasks$/i },\n  { pattern: /^context$/i },\n  { pattern: /^help$/i },\n  { pattern: /^sync$/i },\n\n  // Claude Code launcher\n  { pattern: /^claude-sm$/ },\n\n  // Log viewing (safe read-only)\n  { pattern: /^tail -\\d+ ~\\/\\.claude\\/logs\\/\\*\\.log$/ },\n\n  // Custom aliases (cwm = claude worktree merge)\n  { pattern: /^cwm$/ },\n\n  // Simple echo/confirmation (no variables)\n  {\n    pattern:\n      /^echo \"?(Done|OK|Confirmed|Acknowledged|Great work! Time for a coffee break\\.)\"?$/,\n  },\n];\n\n/**\n * Check if an action is in the allowlist\n */\nfunction isActionAllowed(action: string): boolean {\n  const trimmed = action.trim();\n  return SAFE_ACTION_PATTERNS.some(({ pattern, validate }) => {\n    const match = trimmed.match(pattern);\n    if (!match) return false;\n    if (validate && !validate(match)) return false;\n    return true;\n  });\n}\n\nexport interface ActionResult {\n  success: boolean;\n  output?: string;\n  error?: string;\n}\n\nexport interface PendingAction {\n  id: string;\n  promptId: string;\n  response: string;\n  action: string;\n  timestamp: string;\n  status: 'pending' | 'running' | 'completed' | 'failed';\n  result?: string;\n  error?: string;\n}\n\nexport interface ActionQueue {\n  actions: PendingAction[];\n  lastChecked: string;\n}\n\nconst QUEUE_PATH = join(homedir(), '.stackmemory', 'sms-action-queue.json');\n\nconst DEFAULT_QUEUE: ActionQueue = {\n  actions: [],\n  lastChecked: new Date().toISOString(),\n};\n\nexport function loadActionQueue(): ActionQueue {\n  try {\n    if (existsSync(QUEUE_PATH)) {\n      const data = JSON.parse(readFileSync(QUEUE_PATH, 'utf8'));\n      return parseConfigSafe(\n        ActionQueueSchema,\n        data,\n        DEFAULT_QUEUE,\n        'action-queue'\n      );\n    }\n  } catch {\n    // Use defaults\n  }\n  return { ...DEFAULT_QUEUE, lastChecked: new Date().toISOString() };\n}\n\nexport function saveActionQueue(queue: ActionQueue): void {\n  try {\n    ensureSecureDir(join(homedir(), '.stackmemory'));\n    writeFileSecure(QUEUE_PATH, JSON.stringify(queue, null, 2));\n  } catch {\n    // Silently fail\n  }\n}\n\nexport function queueAction(\n  promptId: string,\n  response: string,\n  action: string\n): string {\n  const queue = loadActionQueue();\n  // Use cryptographically secure random ID\n  const id = randomBytes(8).toString('hex');\n\n  queue.actions.push({\n    id,\n    promptId,\n    response,\n    action,\n    timestamp: new Date().toISOString(),\n    status: 'pending',\n  });\n\n  saveActionQueue(queue);\n  return id;\n}\n\n/**\n * Get Linear client if available\n * Returns null if credentials are missing or invalid\n */\nfunction getLinearClient(): LinearClient | null {\n  // Try API key first - must be valid format (lin_api_*)\n  const apiKey = process.env['LINEAR_API_KEY'];\n  if (apiKey && apiKey.startsWith('lin_api_')) {\n    return new LinearClient({ apiKey });\n  }\n\n  try {\n    const authManager = new LinearAuthManager();\n    const tokens = authManager.loadTokens();\n    if (tokens?.accessToken) {\n      return new LinearClient({ accessToken: tokens.accessToken });\n    }\n  } catch {\n    // Auth not available\n  }\n\n  return null;\n}\n\n/**\n * Handle special actions that require API calls instead of shell commands\n */\nasync function handleSpecialAction(action: string): Promise<{\n  handled: boolean;\n  success?: boolean;\n  output?: string;\n  error?: string;\n}> {\n  // Handle stackmemory task start command\n  const taskStartMatch = action.match(\n    /^stackmemory task start ([a-f0-9-]{36})( --assign-me)?$/\n  );\n  if (taskStartMatch) {\n    const issueId = taskStartMatch[1];\n    const client = getLinearClient();\n\n    if (!client) {\n      return {\n        handled: true,\n        success: false,\n        error:\n          'Linear not configured. Set LINEAR_API_KEY or run stackmemory linear setup.',\n      };\n    }\n\n    try {\n      const result = await client.startIssue(issueId);\n      if (result.success && result.issue) {\n        return {\n          handled: true,\n          success: true,\n          output: `Started: ${result.issue.identifier} - ${result.issue.title}`,\n        };\n      }\n      return {\n        handled: true,\n        success: false,\n        error: result.error || 'Failed to start issue',\n      };\n    } catch (err) {\n      return {\n        handled: true,\n        success: false,\n        error: err instanceof Error ? err.message : 'Unknown error',\n      };\n    }\n  }\n\n  return { handled: false };\n}\n\n/**\n * Execute an action safely using allowlist validation\n * This prevents command injection by only allowing pre-approved commands\n */\nexport async function executeActionSafe(\n  action: string,\n  _response: string\n): Promise<{ success: boolean; output?: string; error?: string }> {\n  // Check if action is in allowlist\n  if (!isActionAllowed(action)) {\n    console.error(`[sms-action] Action not in allowlist: ${action}`);\n    return {\n      success: false,\n      error: `Action not allowed. Only pre-approved commands can be executed via SMS.`,\n    };\n  }\n\n  // Check for special actions that need API calls\n  const specialResult = await handleSpecialAction(action);\n  if (specialResult.handled) {\n    return {\n      success: specialResult.success || false,\n      output: specialResult.output,\n      error: specialResult.error,\n    };\n  }\n\n  try {\n    console.log(`[sms-action] Executing safe action: ${action}`);\n\n    // Parse the action into command and args, respecting quotes\n    const parts = parseCommandArgs(action);\n    if (parts.length === 0) {\n      return { success: false, error: 'Empty command' };\n    }\n\n    const cmd = parts[0];\n    const args = parts.slice(1);\n\n    // Use execFileSync for commands without shell interpretation\n    // This prevents shell injection even if the allowlist is somehow bypassed\n    const output = execFileSync(cmd, args, {\n      encoding: 'utf8',\n      timeout: 60000,\n      stdio: ['pipe', 'pipe', 'pipe'],\n      shell: false, // Explicitly disable shell\n    });\n\n    return { success: true, output };\n  } catch (err) {\n    const error = err instanceof Error ? err.message : String(err);\n    return { success: false, error };\n  }\n}\n\nexport function getPendingActions(): PendingAction[] {\n  const queue = loadActionQueue();\n  return queue.actions.filter((a) => a.status === 'pending');\n}\n\nexport function markActionRunning(id: string): void {\n  const queue = loadActionQueue();\n  const action = queue.actions.find((a) => a.id === id);\n  if (action) {\n    action.status = 'running';\n    saveActionQueue(queue);\n  }\n}\n\nexport function markActionCompleted(\n  id: string,\n  result?: string,\n  error?: string\n): void {\n  const queue = loadActionQueue();\n  const action = queue.actions.find((a) => a.id === id);\n  if (action) {\n    action.status = error ? 'failed' : 'completed';\n    action.result = result;\n    action.error = error;\n    saveActionQueue(queue);\n  }\n}\n\nexport async function executeAction(action: PendingAction): Promise<{\n  success: boolean;\n  output?: string;\n  error?: string;\n}> {\n  markActionRunning(action.id);\n\n  // Use the safe execution path to prevent command injection\n  const result = await executeActionSafe(action.action, action.response);\n\n  if (result.success) {\n    markActionCompleted(action.id, result.output);\n  } else {\n    markActionCompleted(action.id, undefined, result.error);\n  }\n\n  return result;\n}\n\nexport async function processAllPendingActions(): Promise<{\n  processed: number;\n  succeeded: number;\n  failed: number;\n}> {\n  const pending = getPendingActions();\n  let succeeded = 0;\n  let failed = 0;\n\n  for (const action of pending) {\n    const result = await executeAction(action);\n    if (result.success) {\n      succeeded++;\n    } else {\n      failed++;\n    }\n  }\n\n  return { processed: pending.length, succeeded, failed };\n}\n\n// Clean up old completed actions (keep last 50)\nexport function cleanupOldActions(): number {\n  const queue = loadActionQueue();\n  const completed = queue.actions.filter(\n    (a) => a.status === 'completed' || a.status === 'failed'\n  );\n\n  if (completed.length > 50) {\n    const toRemove = completed.slice(0, completed.length - 50);\n    queue.actions = queue.actions.filter(\n      (a) => !toRemove.find((r) => r.id === a.id)\n    );\n    saveActionQueue(queue);\n    return toRemove.length;\n  }\n\n  return 0;\n}\n\n/**\n * Action Templates - Common actions for SMS responses\n *\n * SECURITY NOTE: These templates return command strings that must be\n * validated against SAFE_ACTION_PATTERNS before execution.\n * Templates that accept user input are removed to prevent injection.\n */\nexport const ACTION_TEMPLATES = {\n  // Git/PR actions (PR numbers must be validated as integers)\n  approvePR: (prNumber: string) => {\n    // Validate PR number is numeric only\n    if (!/^\\d+$/.test(prNumber)) {\n      throw new Error('Invalid PR number');\n    }\n    return `gh pr review ${prNumber} --approve`;\n  },\n  mergePR: (prNumber: string) => {\n    if (!/^\\d+$/.test(prNumber)) {\n      throw new Error('Invalid PR number');\n    }\n    return `gh pr merge ${prNumber} --squash`;\n  },\n  viewPR: (prNumber: string) => {\n    if (!/^\\d+$/.test(prNumber)) {\n      throw new Error('Invalid PR number');\n    }\n    return `gh pr view ${prNumber}`;\n  },\n\n  // Build actions (no user input)\n  rebuild: () => `npm run build`,\n  retest: () => `npm run test:run`,\n  lint: () => `npm run lint:fix`,\n\n  // Status actions (no user input)\n  status: () => `stackmemory status`,\n  checkNotifications: () => `stackmemory notify check`,\n\n  // REMOVED for security - these templates allowed arbitrary user input:\n  // - requestChanges (allowed arbitrary message)\n  // - closePR (could be used maliciously)\n  // - deploy/rollback (too dangerous for SMS)\n  // - verifyDeployment (allowed arbitrary URL)\n  // - notifySlack (allowed arbitrary message - command injection)\n  // - notifyTeam (allowed arbitrary message - command injection)\n};\n\n/**\n * Create action string from template\n */\nexport function createAction(\n  template: keyof typeof ACTION_TEMPLATES,\n  ...args: string[]\n): string {\n  const fn = ACTION_TEMPLATES[template];\n  if (typeof fn === 'function') {\n    return (fn as (...args: string[]) => string)(...args);\n  }\n  return fn;\n}\n\n/**\n * Watch for new actions and execute them\n */\nexport function startActionWatcher(intervalMs: number = 5000): NodeJS.Timeout {\n  console.log(\n    `[sms-action] Starting action watcher (interval: ${intervalMs}ms)`\n  );\n\n  return setInterval(() => {\n    const pending = getPendingActions();\n    if (pending.length > 0) {\n      console.log(`[sms-action] Found ${pending.length} pending action(s)`);\n      processAllPendingActions();\n    }\n  }, intervalMs);\n}\n\n/**\n * Integration with SMS webhook - queue action when response received\n */\nexport function handleSMSResponse(\n  promptId: string,\n  response: string,\n  action?: string\n): void {\n  if (action) {\n    const actionId = queueAction(promptId, response, action);\n    console.log(`[sms-action] Queued action ${actionId}: ${action}`);\n  }\n}\n"],
-  "mappings": ";;;;AAOA,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B,SAAS,iBAAiB,uBAAuB;AACjD,SAAS,mBAAmB,uBAAuB;AACnD,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB;AAWlC,SAAS,iBAAiB,SAA2B;AACnD,QAAM,OAAiB,CAAC;AACxB,MAAI,UAAU;AACd,MAAI,gBAAgB;AACpB,MAAI,gBAAgB;AACpB,MAAI,UAAU;AAEd,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,SAAS;AACX,iBAAW;AACX,gBAAU;AACV;AAAA,IACF;AAEA,QAAI,SAAS,QAAQ,CAAC,eAAe;AACnC,gBAAU;AACV;AAAA,IACF;AAEA,QAAI,SAAS,OAAO,CAAC,eAAe;AAClC,sBAAgB,CAAC;AACjB;AAAA,IACF;AAEA,QAAI,SAAS,OAAO,CAAC,eAAe;AAClC,sBAAgB,CAAC;AACjB;AAAA,IACF;AAEA,QAAI,SAAS,OAAO,CAAC,iBAAiB,CAAC,eAAe;AACpD,UAAI,QAAQ,SAAS,GAAG;AACtB,aAAK,KAAK,OAAO;AACjB,kBAAU;AAAA,MACZ;AACA;AAAA,IACF;AAEA,eAAW;AAAA,EACb;AAEA,MAAI,QAAQ,SAAS,GAAG;AACtB,SAAK,KAAK,OAAO;AAAA,EACnB;AAEA,SAAO;AACT;AAGA,MAAM,uBAGD;AAAA;AAAA,EAEH,EAAE,SAAS,0CAA0C;AAAA,EACrD,EAAE,SAAS,iCAAiC;AAAA,EAC5C,EAAE,SAAS,+BAA+B;AAAA,EAC1C,EAAE,SAAS,gCAAgC;AAAA;AAAA,EAG3C,EAAE,SAAS,gDAAgD;AAAA,EAC3D,EAAE,SAAS,yBAAyB;AAAA;AAAA,EAGpC,EAAE,SAAS,mDAAmD;AAAA;AAAA,EAE9D;AAAA,IACE,SAAS;AAAA,EACX;AAAA;AAAA,EAEA,EAAE,SAAS,6BAA6B;AAAA,EACxC,EAAE,SAAS,0BAA0B;AAAA;AAAA,EAGrC,EAAE,SAAS,8CAA8C;AAAA,EACzD,EAAE,SAAS,6BAA6B;AAAA,EACxC,EAAE,SAAS,wBAAwB;AAAA;AAAA,EAEnC,EAAE,SAAS,+BAA+B;AAAA;AAAA,EAG1C,EAAE,SAAS,YAAY;AAAA,EACvB,EAAE,SAAS,WAAW;AAAA,EACtB,EAAE,SAAS,aAAa;AAAA,EACxB,EAAE,SAAS,UAAU;AAAA,EACrB,EAAE,SAAS,UAAU;AAAA;AAAA,EAGrB,EAAE,SAAS,cAAc;AAAA;AAAA,EAGzB,EAAE,SAAS,yCAAyC;AAAA;AAAA,EAGpD,EAAE,SAAS,QAAQ;AAAA;AAAA,EAGnB;AAAA,IACE,SACE;AAAA,EACJ;AACF;AAKA,SAAS,gBAAgB,QAAyB;AAChD,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,qBAAqB,KAAK,CAAC,EAAE,SAAS,SAAS,MAAM;AAC1D,UAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,YAAY,CAAC,SAAS,KAAK,EAAG,QAAO;AACzC,WAAO;AAAA,EACT,CAAC;AACH;AAwBA,MAAM,aAAa,KAAK,QAAQ,GAAG,gBAAgB,uBAAuB;AAE1E,MAAM,gBAA6B;AAAA,EACjC,SAAS,CAAC;AAAA,EACV,cAAa,oBAAI,KAAK,GAAE,YAAY;AACtC;AAEO,SAAS,kBAA+B;AAC7C,MAAI;AACF,QAAI,WAAW,UAAU,GAAG;AAC1B,YAAM,OAAO,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;AACxD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,EAAE,GAAG,eAAe,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE;AACnE;AAEO,SAAS,gBAAgB,OAA0B;AACxD,MAAI;AACF,oBAAgB,KAAK,QAAQ,GAAG,cAAc,CAAC;AAC/C,oBAAgB,YAAY,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,EAC5D,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,YACd,UACA,UACA,QACQ;AACR,QAAM,QAAQ,gBAAgB;AAE9B,QAAM,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAExC,QAAM,QAAQ,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,QAAQ;AAAA,EACV,CAAC;AAED,kBAAgB,KAAK;AACrB,SAAO;AACT;AAMA,SAAS,kBAAuC;AAE9C,QAAM,SAAS,QAAQ,IAAI,gBAAgB;AAC3C,MAAI,UAAU,OAAO,WAAW,UAAU,GAAG;AAC3C,WAAO,IAAI,aAAa,EAAE,OAAO,CAAC;AAAA,EACpC;AAEA,MAAI;AACF,UAAM,cAAc,IAAI,kBAAkB;AAC1C,UAAM,SAAS,YAAY,WAAW;AACtC,QAAI,QAAQ,aAAa;AACvB,aAAO,IAAI,aAAa,EAAE,aAAa,OAAO,YAAY,CAAC;AAAA,IAC7D;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO;AACT;AAKA,eAAe,oBAAoB,QAKhC;AAED,QAAM,iBAAiB,OAAO;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,gBAAgB;AAClB,UAAM,UAAU,eAAe,CAAC;AAChC,UAAM,SAAS,gBAAgB;AAE/B,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,OACE;AAAA,MACJ;AAAA,IACF;AAEA,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,WAAW,OAAO;AAC9C,UAAI,OAAO,WAAW,OAAO,OAAO;AAClC,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,UACT,QAAQ,YAAY,OAAO,MAAM,UAAU,MAAM,OAAO,MAAM,KAAK;AAAA,QACrE;AAAA,MACF;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,OAAO,OAAO,SAAS;AAAA,MACzB;AAAA,IACF,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,OAAO,eAAe,QAAQ,IAAI,UAAU;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,MAAM;AAC1B;AAMA,eAAsB,kBACpB,QACA,WACgE;AAEhE,MAAI,CAAC,gBAAgB,MAAM,GAAG;AAC5B,YAAQ,MAAM,yCAAyC,MAAM,EAAE;AAC/D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,gBAAgB,MAAM,oBAAoB,MAAM;AACtD,MAAI,cAAc,SAAS;AACzB,WAAO;AAAA,MACL,SAAS,cAAc,WAAW;AAAA,MAClC,QAAQ,cAAc;AAAA,MACtB,OAAO,cAAc;AAAA,IACvB;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,IAAI,uCAAuC,MAAM,EAAE;AAG3D,UAAM,QAAQ,iBAAiB,MAAM;AACrC,QAAI,MAAM,WAAW,GAAG;AACtB,aAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,IAClD;AAEA,UAAM,MAAM,MAAM,CAAC;AACnB,UAAM,OAAO,MAAM,MAAM,CAAC;AAI1B,UAAM,SAAS,aAAa,KAAK,MAAM;AAAA,MACrC,UAAU;AAAA,MACV,SAAS;AAAA,MACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,MAC9B,OAAO;AAAA;AAAA,IACT,CAAC;AAED,WAAO,EAAE,SAAS,MAAM,OAAO;AAAA,EACjC,SAAS,KAAK;AACZ,UAAM,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC7D,WAAO,EAAE,SAAS,OAAO,MAAM;AAAA,EACjC;AACF;AAEO,SAAS,oBAAqC;AACnD,QAAM,QAAQ,gBAAgB;AAC9B,SAAO,MAAM,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS;AAC3D;AAEO,SAAS,kBAAkB,IAAkB;AAClD,QAAM,QAAQ,gBAAgB;AAC9B,QAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AACpD,MAAI,QAAQ;AACV,WAAO,SAAS;AAChB,oBAAgB,KAAK;AAAA,EACvB;AACF;AAEO,SAAS,oBACd,IACA,QACA,OACM;AACN,QAAM,QAAQ,gBAAgB;AAC9B,QAAM,SAAS,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;AACpD,MAAI,QAAQ;AACV,WAAO,SAAS,QAAQ,WAAW;AACnC,WAAO,SAAS;AAChB,WAAO,QAAQ;AACf,oBAAgB,KAAK;AAAA,EACvB;AACF;AAEA,eAAsB,cAAc,QAIjC;AACD,oBAAkB,OAAO,EAAE;AAG3B,QAAM,SAAS,MAAM,kBAAkB,OAAO,QAAQ,OAAO,QAAQ;AAErE,MAAI,OAAO,SAAS;AAClB,wBAAoB,OAAO,IAAI,OAAO,MAAM;AAAA,EAC9C,OAAO;AACL,wBAAoB,OAAO,IAAI,QAAW,OAAO,KAAK;AAAA,EACxD;AAEA,SAAO;AACT;AAEA,eAAsB,2BAInB;AACD,QAAM,UAAU,kBAAkB;AAClC,MAAI,YAAY;AAChB,MAAI,SAAS;AAEb,aAAW,UAAU,SAAS;AAC5B,UAAM,SAAS,MAAM,cAAc,MAAM;AACzC,QAAI,OAAO,SAAS;AAClB;AAAA,IACF,OAAO;AACL;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,WAAW,QAAQ,QAAQ,WAAW,OAAO;AACxD;AAGO,SAAS,oBAA4B;AAC1C,QAAM,QAAQ,gBAAgB;AAC9B,QAAM,YAAY,MAAM,QAAQ;AAAA,IAC9B,CAAC,MAAM,EAAE,WAAW,eAAe,EAAE,WAAW;AAAA,EAClD;AAEA,MAAI,UAAU,SAAS,IAAI;AACzB,UAAM,WAAW,UAAU,MAAM,GAAG,UAAU,SAAS,EAAE;AACzD,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,CAAC,MAAM,CAAC,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;AAAA,IAC5C;AACA,oBAAgB,KAAK;AACrB,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO;AACT;AASO,MAAM,mBAAmB;AAAA;AAAA,EAE9B,WAAW,CAAC,aAAqB;AAE/B,QAAI,CAAC,QAAQ,KAAK,QAAQ,GAAG;AAC3B,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AACA,WAAO,gBAAgB,QAAQ;AAAA,EACjC;AAAA,EACA,SAAS,CAAC,aAAqB;AAC7B,QAAI,CAAC,QAAQ,KAAK,QAAQ,GAAG;AAC3B,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AACA,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EACA,QAAQ,CAAC,aAAqB;AAC5B,QAAI,CAAC,QAAQ,KAAK,QAAQ,GAAG;AAC3B,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AACA,WAAO,cAAc,QAAQ;AAAA,EAC/B;AAAA;AAAA,EAGA,SAAS,MAAM;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,MAAM,MAAM;AAAA;AAAA,EAGZ,QAAQ,MAAM;AAAA,EACd,oBAAoB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAS5B;AAKO,SAAS,aACd,aACG,MACK;AACR,QAAM,KAAK,iBAAiB,QAAQ;AACpC,MAAI,OAAO,OAAO,YAAY;AAC5B,WAAQ,GAAqC,GAAG,IAAI;AAAA,EACtD;AACA,SAAO;AACT;AAKO,SAAS,mBAAmB,aAAqB,KAAsB;AAC5E,UAAQ;AAAA,IACN,mDAAmD,UAAU;AAAA,EAC/D;AAEA,SAAO,YAAY,MAAM;AACvB,UAAM,UAAU,kBAAkB;AAClC,QAAI,QAAQ,SAAS,GAAG;AACtB,cAAQ,IAAI,sBAAsB,QAAQ,MAAM,oBAAoB;AACpE,+BAAyB;AAAA,IAC3B;AAAA,EACF,GAAG,UAAU;AACf;AAKO,SAAS,kBACd,UACA,UACA,QACM;AACN,MAAI,QAAQ;AACV,UAAM,WAAW,YAAY,UAAU,UAAU,MAAM;AACvD,YAAQ,IAAI,8BAA8B,QAAQ,KAAK,MAAM,EAAE;AAAA,EACjE;AACF;",
-  "names": []
-}