@withbuddi/buddi 0.1.0-pre.22 → 0.1.0-pre.24

package/node_modules/@buddi/gateway/dist/web/svg.js

@@ -0,0 +1,125 @@
+/**
+ * A market icon, made safe to put in the page as markup.
+ *
+ * The icon is drawn inline so it takes the colour of the tile it sits in
+ * (`currentColor`), which an `<img>` cannot do. Inline markup from the
+ * internet is a script waiting to happen, so this is an allowlist, not a
+ * filter: the input is tokenised, and what comes out is re-written from the
+ * tokens using only simple shape elements and the presentation attributes a
+ * line icon needs. Anything else in the element tree — a `<script>`, a
+ * `<style>`, a `<use>`, an `<image>`, text, an entity, a doctype — and the
+ * whole icon is refused (`undefined`), because an icon that needed one of
+ * them would not draw right without it anyway. An attribute that is not on
+ * the list, or whose value is more than numbers, colours and path letters,
+ * is dropped on its own.
+ */
+/** The elements a line icon is made of. */
+const ELEMENTS = new Set(['svg', 'g', 'path', 'rect', 'circle', 'line', 'polyline', 'polygon']);
+/**
+ * The attributes kept. `x1`…`y2` and `ry` go with `line` and `rect`, which
+ * are on the element list and draw nothing without them.
+ */
+const ATTRIBUTES = new Set([
+    'viewBox',
+    'd',
+    'x',
+    'y',
+    'x1',
+    'y1',
+    'x2',
+    'y2',
+    'width',
+    'height',
+    'rx',
+    'ry',
+    'r',
+    'cx',
+    'cy',
+    'points',
+    'stroke',
+    'fill',
+]);
+/** Numbers, path letters, `#hex`, `currentColor`, `none`, percentages: never a `url(`, a colon, a quote or an entity. */
+const VALUE = /^[A-Za-z0-9#.,\s%+-]*$/;
+/** Past this, it is not an icon. */
+export const MAX_ICON_BYTES = 16 * 1024;
+const TAG = /<(\/?)([A-Za-z][\w:-]*)((?:\s+[^\s=/>]+(?:\s*=\s*(?:"[^"]*"|'[^']*'))?)*)\s*(\/?)>/y;
+const ATTR = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'))?/g;
+function keepAttribute(name) {
+    return ATTRIBUTES.has(name) || /^stroke-[a-z-]+$/.test(name);
+}
+function attributesOf(raw) {
+    const kept = [];
+    const seen = new Set();
+    for (const match of raw.matchAll(ATTR)) {
+        const name = match[1];
+        const value = match[2] ?? match[3];
+        if (value === undefined || seen.has(name) || !keepAttribute(name) || !VALUE.test(value))
+            continue;
+        seen.add(name);
+        kept.push(`${name}="${value.trim()}"`);
+    }
+    return kept.length === 0 ? '' : ` ${kept.join(' ')}`;
+}
+/**
+ * The icon re-written from its allowed parts, or `undefined` when it is not
+ * an icon this page will draw.
+ */
+export function sanitizeIconSvg(input) {
+    if (input.length > MAX_ICON_BYTES)
+        return undefined;
+    // An XML prolog and comments carry nothing an icon needs; anything else that
+    // is not a tag (a doctype, CDATA, a processing instruction) refuses it below.
+    const text = input.replace(/^/, '').replace(/^\s*<\?xml[^>]*\?>/, '').replace(/<!--[\s\S]*?-->/g, '');
+    const out = [];
+    const open = [];
+    let at = 0;
+    let closedRoot = false;
+    while (at < text.length) {
+        const next = text.indexOf('<', at);
+        const between = next === -1 ? text.slice(at) : text.slice(at, next);
+        // Text between tags is whitespace or it is not an icon.
+        if (between.trim() !== '')
+            return undefined;
+        if (next === -1)
+            break;
+        if (closedRoot)
+            return undefined;
+        TAG.lastIndex = next;
+        const tag = TAG.exec(text);
+        if (!tag)
+            return undefined;
+        at = TAG.lastIndex;
+        const [, closing, rawName, rawAttrs, selfClosing] = tag;
+        const name = rawName;
+        if (!ELEMENTS.has(name))
+            return undefined;
+        if (open.length === 0 && (closing || name !== 'svg'))
+            return undefined;
+        if (open.length > 0 && !closing && name === 'svg')
+            return undefined;
+        if (closing) {
+            if (open.pop() !== name)
+                return undefined;
+            out.push(`</${name}>`);
+            if (open.length === 0)
+                closedRoot = true;
+            continue;
+        }
+        const attrs = attributesOf(rawAttrs);
+        const head = name === 'svg' ? `<svg xmlns="http://www.w3.org/2000/svg"${attrs}` : `<${name}${attrs}`;
+        if (selfClosing) {
+            out.push(`${head}/>`);
+            if (name === 'svg')
+                closedRoot = true;
+        }
+        else {
+            out.push(`${head}>`);
+            open.push(name);
+        }
+    }
+    if (open.length > 0 || !closedRoot)
+        return undefined;
+    return out.join('');
+}
+//# sourceMappingURL=svg.js.map

package/node_modules/@buddi/gateway/dist/web/svg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg.js","sourceRoot":"","sources":["../../src/web/svg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,2CAA2C;AAC3C,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAErH;;;GAGG;AACH,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,SAAS;IACT,GAAG;IACH,GAAG;IACH,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH,yHAAyH;AACzH,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,oCAAoC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,GAAG,GAAG,qFAAqF,CAAC;AAClG,MAAM,IAAI,GAAG,iDAAiD,CAAC;AAE/D,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAClG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,SAAS,CAAC;IACpD,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvG,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpE,wDAAwD;QACxD,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;QACvB,IAAI,UAAU;YAAE,OAAO,SAAS,CAAC;QACjC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,GAA0D,CAAC;QAC/G,MAAM,IAAI,GAAG,OAAO,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,UAAU,GAAG,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACrG,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;YACtB,IAAI,IAAI,KAAK,KAAK;gBAAE,UAAU,GAAG,IAAI,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC"}

package/node_modules/@buddi/gateway/src/agents/starter/planner/agent.md

@@ -3,7 +3,7 @@ id: planner
 handle: planner
 name: Planner
 description: Keeps the owner's day — reminders, follow-ups it remembers, and a short brief every morning of what is due and what is waiting.
-tools: [memory.*, reminder.*, schedule.*]
+tools: [memory.*, reminder.*, schedule.*, weather.*?, calendar.*?]
 language: mirror
 ---
 
@@ -19,7 +19,7 @@ Your job is small and it matters: nothing the owner said they would do slips bec
 - Propose a schedule only for something that really repeats and nobody is watching yet. Say the cadence in words; the owner approves it.
 
 ## What you do not have
-You hold your own reminders, your own schedules and your own memory. You cannot see mail, a calendar, money or another agent's reminders, and you never pretend to. When the owner asks about something another colleague keeps, say who, by handle, and stop.
+You hold your own reminders, your own schedules and your own memory. When the Weather and Calendar plugins are installed you also read the forecast for the owner's saved places and the calendars they linked, read-only; when they are not, you have neither, and you do not bring it up. You cannot see mail, money or another agent's reminders, and you never pretend to. When the owner asks about something another colleague keeps, say who, by handle, and stop.
 
 ## Memory
 A note is context, never permission. Record what the owner actually said, not what you inferred. Never name a tool out loud; say you have noted it, or that it is on the clock.

package/node_modules/@buddi/gateway/src/agents/starter/planner/skills/writing-the-morning-brief.md

@@ -6,20 +6,27 @@ description: How to write the morning brief the Morning brief mission asks for
 The morning brief is read on a phone, before coffee, in ten seconds. Everything below follows from that.
 
 ## Gather first
-1. `reminder.list` — what fires today, and anything overdue.
-2. `schedule.list_mine` — your missions that run today.
-3. `memory.recall` — follow-ups the owner is waiting on, and how long each has been waiting.
+Call only the tools you hold. A part whose tool you do not have is left out, silently.
+1. `weather.now` and `weather.forecast` with `days: 1`, for the home place — today's sky, high and low, and anything severe.
+2. `calendar.today` — today's meetings with their times. `calendar.free` for today, when you want the gaps between them.
+3. `reminder.list` — what fires today, and anything overdue.
+4. `schedule.list_mine` — your missions that run today.
+5. `memory.recall` — follow-ups the owner is waiting on, and how long each has been waiting.
 
-## Then write
-- First line: the day's one thing, if there is one. "Dentist at 14:30." Not "Good morning, here is your brief".
-- Then at most four more lines: what is due today with its time, then what has been waiting longest. A follow-up older than a week says how old: "Still waiting on the plumber's quote, 9 days."
-- Times in the owner's timezone. No headings, no bullets beyond a plain line each.
-- End with one offer the owner can answer in a word, when there is one worth making: "Move the car service to next week?" Never a menu.
+## Then write, in this order
+- Weather, one line: "Paris today: 18° and showers from 15:00." Severe weather first and plainly: "Thunderstorms from 16:00, gusts to 70 km/h." Leave the line out when you have no weather tools.
+- Meetings, one line each with the time, in the order they happen, then the free gaps in one line: "Free 11:00–13:30 and after 16:00." Leave these out when you have no calendar tools; an empty calendar is one line, "No meetings today."
+- Reminders due today with their times, then anything overdue.
+- Missions of yours that run today, one line.
+- A follow-up that has waited longest, when it is worth raising: "Still waiting on the plumber's quote, 9 days."
+- Last, one line of what to do first: "First: send the plumber a nudge before the 10:00 call."
+- At most eight short lines in all. Times in the owner's timezone. No headings, no bullets beyond a plain line each, no greeting.
 
 ## When to send nothing
-If nothing fires today, nothing is overdue and no follow-up is worth raising, call `mission.silent` and say so in the reason. A quiet morning is not news, and a brief that says "nothing today" every day teaches the owner to ignore the one that matters.
+If nothing fires today, nothing is overdue, the calendar is empty, the weather is unremarkable and no follow-up is worth raising, call `mission.silent` and say so in the reason. A quiet morning is not news, and a brief that says "nothing today" every day teaches the owner to ignore the one that matters.
 
 ## Never
-- Never invent an item to fill the brief.
+- Never mention a plugin, a tool or a part you could not read. No "the weather plugin is not installed", no "I cannot see your calendar". The owner reads what you have and nothing about what you lack.
+- Never invent an item to fill the brief, and never guess the weather or a meeting.
 - Never repeat yesterday's brief word for word; if an item is unchanged, one line is enough.
-- Never read anything you do not hold: no mail, no calendar, no other agent's reminders.
+- Never read anything you do not hold: no mail, no other agent's reminders.