@yeaft/webchat-agent 1.0.434 → 1.0.435

package/index.js

@@ -13,6 +13,7 @@ import ctx from './context.js';
 import {
   getDefaultAgentName,
   getDefaultYeaftDir,
+  resolveAgentWorkDir,
   resolveRuntimeIdentity,
   getConfigPath,
   loadServiceConfig,
@@ -58,7 +59,7 @@ function loadConfig() {
   const defaults = {
     serverUrl: 'ws://localhost:3456',
     agentName: DEFAULT_AGENT_NAME,
-    workDir: process.cwd(),
+    workDir: '',
     reconnectInterval: 5000,
     agentSecret: 'agent-shared-secret'
   };
@@ -116,12 +117,23 @@ try {
 const agentSecret = process.env.AGENT_SECRET_FILE
   ? readFileSync(process.env.AGENT_SECRET_FILE, 'utf8').trim()
   : (process.env.AGENT_SECRET || fileConfig.agentSecret);
+const WORK_DIR = resolveAgentWorkDir(fileConfig, process.env, AGENT_NAME);
+if (!process.env.WORK_DIR && !fileConfig.workDir) {
+  try {
+    if (!existsSync(WORK_DIR)) {
+      mkdirSync(WORK_DIR, { recursive: true, mode: 0o700 });
+      console.log(`[Agent] Created default work dir: ${WORK_DIR}`);
+    }
+  } catch (err) {
+    console.warn(`[Agent] Could not ensure default work dir ${WORK_DIR}: ${err?.message || err}`);
+  }
+}
 
 const CONFIG = {
   instanceId: INSTANCE_ID,
   serverUrl: process.env.SERVER_URL || fileConfig.serverUrl,
   agentName: AGENT_NAME,
-  workDir: process.env.WORK_DIR || fileConfig.workDir || process.cwd(),
+  workDir: WORK_DIR,
   yeaftDir: YEAFT_DIR,
   telemetry: loadYeaftConfig({ dir: YEAFT_DIR }).telemetry,
   reconnectInterval: fileConfig.reconnectInterval,

package/local-runtime/version.json

@@ -1 +1 @@
-{"version":"1.0.434"}
+{"version":"1.0.435"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.434",
+  "version": "1.0.435",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/service/config.js

@@ -10,10 +10,18 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 export const SERVICE_NAME = 'yeaft-agent';
 export const DEFAULT_INSTANCE_ID = 'default';
 
+function assertSafeIdentitySegment(value, label) {
+  const normalized = String(value ?? '').trim();
+  if (normalized === '.' || normalized === '..') {
+    throw new Error(`${label} may not be "." or ".."`);
+  }
+  return normalized;
+}
+
 export function getDefaultAgentName(machineName = hostname()) {
   const raw = String(machineName || '');
   if (!raw) return DEFAULT_INSTANCE_ID;
-  return raw.replace(/[^A-Za-z0-9._-]/gu, '-');
+  return assertSafeIdentitySegment(raw.replace(/[^A-Za-z0-9._-]/gu, '-'), 'Agent name');
 }
 
 /**
@@ -57,7 +65,7 @@ export function isDefaultInstance(instanceId) {
 }
 
 export function validateInstanceId(instanceId) {
-  const normalized = normalizeInstanceId(instanceId);
+  const normalized = assertSafeIdentitySegment(normalizeInstanceId(instanceId), 'Instance id');
   if (!/^[A-Za-z0-9_.-]+$/.test(normalized)) {
     throw new Error('Instance id may only contain letters, numbers, dot, underscore, or dash');
   }
@@ -86,10 +94,11 @@ function readIdentityArgs(args = []) {
 
 export function resolveDisplayName(args = [], env = process.env, fallbackName = getDefaultAgentName()) {
   const { explicitName } = readIdentityArgs(args);
-  return explicitName
+  const resolved = explicitName
     || env.AGENT_NAME
     || fallbackName
     || getDefaultAgentName();
+  return assertSafeIdentitySegment(resolved, 'Agent name');
 }
 
 export function resolveRuntimeIdentity(fileConfig = {}, env = process.env) {
@@ -98,6 +107,17 @@ export function resolveRuntimeIdentity(fileConfig = {}, env = process.env) {
   return { agentName, instanceId };
 }
 
+/** Resolve the default project working directory for an Agent display name. */
+export function getDefaultWorkDir(agentName = DEFAULT_INSTANCE_ID) {
+  const normalizedName = getDefaultAgentName(String(agentName || '').trim() || DEFAULT_INSTANCE_ID);
+  return join(homedir(), '.yeaft', 'instances', normalizedName);
+}
+
+/** Resolve explicit workDir configuration before falling back to the Agent root. */
+export function resolveAgentWorkDir(fileConfig = {}, env = process.env, agentName = DEFAULT_INSTANCE_ID) {
+  return env.WORK_DIR || fileConfig.workDir || getDefaultWorkDir(agentName);
+}
+
 export function shouldLoadLegacyLocalConfig(env = process.env) {
   return !String(env.YEAFT_AGENT_INSTANCE || '').trim();
 }

package/service/index.js

@@ -40,6 +40,8 @@ export {
   getPm2AppName,
   getLaunchdLabel,
   getDefaultYeaftDir,
+  getDefaultWorkDir,
+  resolveAgentWorkDir,
 } from './config.js';
 // Re-export the launchd plist-path resolver so consumers (e.g. the upgrade
 // flow) reach it via the service barrel instead of deep-importing macos.js.

package/service.js

@@ -33,6 +33,8 @@ export {
   getLaunchdLabel,
   getLaunchdPlistPath,
   getDefaultYeaftDir,
+  getDefaultWorkDir,
+  resolveAgentWorkDir,
   install,
   uninstall,
   start,