assistme 0.3.4 → 0.3.6

package/dist/index.js

@@ -1,20 +1,44 @@
 #!/usr/bin/env node
 import {
+  AppError,
+  BrowseSkillRowSchema,
+  CDP_COMMAND_TIMEOUT_MS,
+  FRAME_CONTEXTS_MAX_SIZE,
   JobRunner,
+  MAX_COMPLETE_TASK_RETRIES,
+  MAX_CONTENT_SEARCH_FILES,
+  MAX_CONTENT_SEARCH_RESULTS,
+  MAX_FILE_SEARCH_RESULTS,
+  MAX_HISTORY_ENTRIES,
+  MAX_HISTORY_RESPONSE_LENGTH,
+  MAX_RESPONSE_CONTENT_LENGTH,
+  MAX_SKILL_RECORD_RESULT_LENGTH,
+  MAX_TOOL_INPUT_LOG_LENGTH,
+  MAX_TOOL_RESULT_LENGTH,
+  SCHEDULER_INTERVAL_MS,
+  SHELL_MAX_OUTPUT,
+  SHELL_TIMEOUT_MS,
+  SKILL_DESCRIPTION_BUDGET_CHARS,
+  SkillCreateResultSchema,
+  SkillDecisionSchema,
+  SkillRowSchema,
+  WS_CONNECT_TIMEOUT_MS,
   callMcpHandler,
+  errorMessage,
   log,
   newCorrelationId,
   readAuthStore,
+  safeParse,
   setCorrelationId,
   setLogLevel,
   writeAuthStore
-} from "./chunk-KX7ITO55.js";
+} from "./chunk-4YWS463E.js";
 import {
   clearConfig,
   getConfig,
   getConfigPath,
   setConfig
-} from "./chunk-TTEGHE2E.js";
+} from "./chunk-JVA6DHXD.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -54,7 +78,7 @@ async function logout() {
 
 // src/db/session.ts
 async function createSession(sessionName, workspacePath, version2) {
-  const { getConfig: getConfig2 } = await import("./config-PUIS2TQL.js");
+  const { getConfig: getConfig2 } = await import("./config-T4357GAE.js");
   const data = await callMcpHandler("session.create", {
     session_name: sessionName,
     workspace_path: workspacePath,
@@ -135,11 +159,11 @@ async function completeTask(messageId, resultSummary, tokenUsage) {
     token_usage: tokenUsage || null
   });
 }
-async function failTask(messageId, errorMessage) {
+async function failTask(messageId, errorMessage2) {
   try {
     await callMcpHandler("task.fail", {
       message_id: messageId,
-      error: errorMessage
+      error: errorMessage2
     });
   } catch (err) {
     log.error(`Failed to update task status: ${err instanceof Error ? err.message : err}`);
@@ -360,6 +384,8 @@ var BrowserController = class {
   connected = false;
   currentTabId = null;
   refCache = /* @__PURE__ */ new Map();
+  frameContexts = /* @__PURE__ */ new Map();
+  // refId → contextId
   constructor(port = 9222) {
     this.debugPort = port;
   }
@@ -410,9 +436,9 @@ var BrowserController = class {
         if (!settled) {
           settled = true;
           this.ws?.close();
-          reject(new Error("Connection timeout (5s)"));
+          reject(new Error(`Connection timeout (${WS_CONNECT_TIMEOUT_MS}ms)`));
         }
-      }, 5e3);
+      }, WS_CONNECT_TIMEOUT_MS);
       this.ws.on("open", () => {
         if (settled) return;
         settled = true;
@@ -460,6 +486,8 @@ var BrowserController = class {
       this.ws = null;
       this.connected = false;
     }
+    this.refCache.clear();
+    this.frameContexts.clear();
     return "Disconnected from browser.";
   }
   // ── CDP Protocol ────────────────────────────────────────────────
@@ -479,7 +507,7 @@ var BrowserController = class {
       const timeout = setTimeout(() => {
         this.callbacks.delete(id);
         reject(new Error(`CDP command timed out: ${method}`));
-      }, 15e3);
+      }, CDP_COMMAND_TIMEOUT_MS);
       this.callbacks.set(id, (response) => {
         clearTimeout(timeout);
         if (response.error) {
@@ -653,13 +681,46 @@ URL: ${info.url}`;
     const result = await this.send("Runtime.evaluate", {
       expression: `
         (function() {
-          const el = document.querySelector(${selectorJS});
+          var el = document.querySelector(${selectorJS});
+
+          // If not found in main document, search same-origin iframes
+          if (!el) {
+            var iframes = document.querySelectorAll('iframe');
+            for (var i = 0; i < iframes.length; i++) {
+              try {
+                var iframeDoc = iframes[i].contentDocument;
+                if (iframeDoc) {
+                  el = iframeDoc.querySelector(${selectorJS});
+                  if (el) break;
+                }
+              } catch(e) { /* cross-origin, skip */ }
+            }
+          }
+
           if (!el) return 'Element not found: ' + ${selectorJS};
 
           el.focus();
 
-          // Clear existing value
-          const nativeInputValueSetter = Object.getOwnPropertyDescriptor(
+          // Check if this is a contenteditable element (rich text editor)
+          var isContentEditable = el.isContentEditable ||
+            el.getAttribute('contenteditable') === 'true' ||
+            el.getAttribute('contenteditable') === '';
+
+          if (isContentEditable) {
+            // For contenteditable: select all content, then replace
+            var ownerDoc = el.ownerDocument;
+            var sel = ownerDoc.defaultView.getSelection();
+            var range = ownerDoc.createRange();
+            range.selectNodeContents(el);
+            sel.removeAllRanges();
+            sel.addRange(range);
+            // Use insertText command which respects undo stack and triggers input events
+            ownerDoc.execCommand('insertText', false, ${textJS});
+            return 'Typed into: ' + (el.tagName || '') + ' [contenteditable]';
+          }
+
+          // For input/textarea: clear and set value
+          var nativeInputValueSetter = Object.getOwnPropertyDescriptor(
             window.HTMLInputElement.prototype, 'value'
           )?.set || Object.getOwnPropertyDescriptor(
             window.HTMLTextAreaElement.prototype, 'value'
@@ -679,7 +740,27 @@ URL: ${info.url}`;
       `,
       returnByValue: true
     });
-    return result.result?.value || "Text entered.";
+    const textResult = result.result?.value || "";
+    if (textResult.startsWith("Element not found")) {
+      return this.typeAtFocus(text);
+    }
+    return textResult || "Text entered.";
+  }
+  /**
+   * Type text into the currently focused element using CDP Input.insertText.
+   * This bypasses DOM queries entirely and works with any focused element,
+   * including those inside cross-origin iframes or shadow DOM.
+   */
+  async typeAtFocus(text) {
+    this.ensureConnected();
+    const modKey = platform() === "darwin" ? "Meta" : "Control";
+    await this.pressKey(`${modKey}+a`);
+    await new Promise((r) => setTimeout(r, 50));
+    await this.pressKey("Backspace");
+    await new Promise((r) => setTimeout(r, 50));
+    await this.send("Input.insertText", { text });
+    await new Promise((r) => setTimeout(r, 100));
+    return "Text entered (into focused element).";
   }
   async pressKey(key) {
     this.ensureConnected();
@@ -929,6 +1010,7 @@ URL: ${info.url}`;
       inputType: r.type || "",
       box: r.box
     }));
+    await this.discoverCrossOriginFrameRefs(refs);
     if (annotate && refs.length <= 40) {
       const refsJson = JSON.stringify(refs);
       await this.send("Runtime.evaluate", {
@@ -1003,6 +1085,199 @@ Refs:
     }
     return table;
   }
+  // ── Cross-Origin Iframe Discovery ────────────────────────────────
+  /**
+   * Use CDP's Page.getFrameTree + Runtime.evaluate with contextId to discover
+   * interactive elements inside cross-origin iframes (e.g., ProtonMail editor,
+   * Google Docs, embedded rich text editors).
+   *
+   * Same-origin iframes are already handled inline by the main snapshot JS.
+   * This method handles the ones that threw cross-origin errors.
+   */
+  async discoverCrossOriginFrameRefs(refs) {
+    this.frameContexts.clear();
+    try {
+      const frameTree = await this.send("Page.getFrameTree");
+      const mainFrameId = frameTree.frameTree?.frame?.id;
+      const childFrames = frameTree.frameTree?.childFrames || [];
+      if (childFrames.length === 0) return;
+      const contexts = await this.getFrameContexts(mainFrameId || "");
+      for (const child of childFrames) {
+        const frameId = child.frame.id;
+        const contextId = contexts.get(frameId);
+        if (!contextId) continue;
+        const iframeOffsetResult = await this.send("Runtime.evaluate", {
+          expression: `
+            (function() {
+              var iframes = document.querySelectorAll('iframe');
+              for (var i = 0; i < iframes.length; i++) {
+                try {
+                  // Match by frame src or name
+                  var f = iframes[i];
+                  if (f.contentWindow) {
+                    var r = f.getBoundingClientRect();
+                    if (r.width > 10 && r.height > 10) {
+                      return JSON.stringify({ x: r.x, y: r.y, width: r.width, height: r.height, index: i });
+                    }
+                  }
+                } catch(e) {}
+              }
+              return 'null';
+            })()
+          `,
+          returnByValue: true
+        });
+        let iframeOffset = { x: 0, y: 0 };
+        try {
+          const parsed = JSON.parse(
+            iframeOffsetResult.result?.value || "null"
+          );
+          if (parsed) iframeOffset = { x: parsed.x, y: parsed.y };
+        } catch {
+        }
+        const startRefId = refs.length + 1;
+        try {
+          const frameResult = await this.send("Runtime.evaluate", {
+            expression: `
+              (function() {
+                var selectors = [
+                  'a[href]', 'button', 'input:not([type="hidden"])', 'select', 'textarea',
+                  '[role="button"]', '[role="link"]', '[role="checkbox"]', '[role="radio"]',
+                  '[role="combobox"]', '[role="listbox"]', '[role="menuitem"]', '[role="tab"]',
+                  '[role="switch"]', '[role="slider"]', '[role="option"]', '[role="searchbox"]',
+                  '[onclick]', '[tabindex]:not([tabindex="-1"])',
+                  '[contenteditable="true"]', '[contenteditable=""]'
+                ].join(', ');
+
+                var all = document.querySelectorAll(selectors);
+                // Also check if the body itself is contenteditable
+                if (document.body && (document.body.isContentEditable || document.body.getAttribute('contenteditable') === 'true')) {
+                  all = [document.body].concat(Array.from(all));
+                }
+
+                var refs = [];
+                var startId = ${startRefId};
+                var vh = window.innerHeight;
+                var vw = window.innerWidth;
+
+                for (var i = 0; i < all.length && refs.length < 20; i++) {
+                  var el = all[i];
+                  var rect = el.getBoundingClientRect();
+                  if (rect.width < 5 || rect.height < 5) continue;
+                  var style = window.getComputedStyle(el);
+                  if (style.display === 'none' || style.visibility === 'hidden' || style.opacity === '0') continue;
+
+                  var role = el.getAttribute('role') || '';
+                  if (!role) {
+                    var tag = el.tagName.toLowerCase();
+                    if (tag === 'a') role = 'link';
+                    else if (tag === 'button') role = 'button';
+                    else if (tag === 'input') {
+                      var t = (el.type || 'text').toLowerCase();
+                      if (t === 'checkbox') role = 'checkbox';
+                      else if (t === 'radio') role = 'radio';
+                      else if (t === 'submit' || t === 'button') role = 'button';
+                      else role = 'textbox';
+                    }
+                    else if (tag === 'select') role = 'combobox';
+                    else if (tag === 'textarea') role = 'textbox';
+                    else if (el.isContentEditable) role = 'textbox';
+                    else role = tag;
+                  }
+
+                  var name = '';
+                  var ariaLabel = el.getAttribute('aria-label');
+                  if (ariaLabel) {
+                    name = ariaLabel;
+                  } else if (el.tagName === 'INPUT' || el.tagName === 'TEXTAREA') {
+                    name = el.getAttribute('placeholder') || el.getAttribute('name') || '';
+                  } else if (el.isContentEditable) {
+                    name = 'compose body';
+                  } else {
+                    name = (el.textContent || '').trim().slice(0, 60);
+                  }
+
+                  var refId = startId + refs.length;
+                  el.setAttribute('data-assistme-ref', String(refId));
+
+                  refs.push({
+                    id: refId,
+                    role: role,
+                    name: name,
+                    tag: el.tagName.toLowerCase(),
+                    type: el.getAttribute('type') || '',
+                    box: {
+                      x: Math.round(rect.x),
+                      y: Math.round(rect.y),
+                      width: Math.round(rect.width),
+                      height: Math.round(rect.height)
+                    },
+                    inFrame: true
+                  });
+                }
+
+                return JSON.stringify(refs);
+              })()
+            `,
+            contextId,
+            returnByValue: true
+          });
+          const frameRefs = JSON.parse(
+            frameResult.result?.value || "[]"
+          );
+          for (const r of frameRefs) {
+            refs.push({
+              id: r.id,
+              role: r.role,
+              name: r.name,
+              tag: r.tag,
+              inputType: r.type || "",
+              box: {
+                x: Math.round(r.box.x + iframeOffset.x),
+                y: Math.round(r.box.y + iframeOffset.y),
+                width: r.box.width,
+                height: r.box.height
+              }
+            });
+            if (this.frameContexts.size < FRAME_CONTEXTS_MAX_SIZE) {
+              this.frameContexts.set(r.id, contextId);
+            }
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  /**
+   * Get execution context IDs for each frame in the page.
+   * Uses Runtime.executionContextCreated events collected during the session,
+   * or falls back to evaluating in known frames.
+   */
+  async getFrameContexts(_mainFrameId) {
+    const contexts = /* @__PURE__ */ new Map();
+    try {
+      await this.send("Runtime.enable").catch(() => {
+      });
+      const frameTree = await this.send("Page.getFrameTree");
+      const childFrames = frameTree.frameTree?.childFrames || [];
+      for (const child of childFrames) {
+        try {
+          const world = await this.send("Page.createIsolatedWorld", {
+            frameId: child.frame.id,
+            worldName: "assistme-snapshot",
+            grantUniveralAccess: true
+          });
+          if (world.executionContextId) {
+            contexts.set(child.frame.id, world.executionContextId);
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+    return contexts;
+  }
   // ── Ref Resolution ────────────────────────────────────────────────
   /**
    * Resolve a ref ID to its current center coordinates in the viewport.
@@ -1115,9 +1390,85 @@ Refs:
       returnByValue: true
     });
     const value = result.result?.value;
-    if (!value || value === "null") return null;
+    if (value && value !== "null") {
+      try {
+        return JSON.parse(value);
+      } catch {
+      }
+    }
+    const frameContextId = this.frameContexts.get(refId);
+    if (frameContextId) {
+      return this.resolveRefInFrame(refId, frameContextId, role, name);
+    }
+    return null;
+  }
+  /**
+   * Resolve a ref inside a cross-origin iframe using its execution context.
+   * Returns coordinates adjusted by the iframe's viewport offset.
+   */
+  async resolveRefInFrame(refId, contextId, role, name) {
+    const roleJS = JSON.stringify(role);
+    const nameJS = JSON.stringify(name);
     try {
-      return JSON.parse(value);
+      const offsetResult = await this.send("Runtime.evaluate", {
+        expression: `
+          (function() {
+            var iframes = document.querySelectorAll('iframe');
+            for (var i = 0; i < iframes.length; i++) {
+              var r = iframes[i].getBoundingClientRect();
+              if (r.width > 10 && r.height > 10) {
+                return JSON.stringify({ x: r.x, y: r.y });
+              }
+            }
+            return JSON.stringify({ x: 0, y: 0 });
+          })()
+        `,
+        returnByValue: true
+      });
+      const offset = JSON.parse(
+        offsetResult.result?.value || '{"x":0,"y":0}'
+      );
+      const frameResult = await this.send("Runtime.evaluate", {
+        expression: `
+          (function() {
+            var el = document.querySelector('[data-assistme-ref="${refId}"]');
+            if (!el && ${roleJS} && ${nameJS}) {
+              // Fallback: search by role
+              var candidates = document.querySelectorAll('*');
+              for (var i = 0; i < candidates.length; i++) {
+                var c = candidates[i];
+                if (c.isContentEditable || c.getAttribute('contenteditable') === 'true') {
+                  el = c; break;
+                }
+              }
+            }
+            if (!el) return 'null';
+
+            el.scrollIntoView({ block: 'center', behavior: 'instant' });
+            var r = el.getBoundingClientRect();
+            if (r.width < 1 || r.height < 1) return JSON.stringify({ error: 'Zero size' });
+
+            return JSON.stringify({
+              x: r.x + r.width / 2,
+              y: r.y + r.height / 2,
+              width: r.width,
+              height: r.height
+            });
+          })()
+        `,
+        contextId,
+        returnByValue: true
+      });
+      const value = frameResult.result?.value;
+      if (!value || value === "null") return null;
+      const parsed = JSON.parse(value);
+      if (parsed.error) return parsed;
+      return {
+        x: parsed.x + offset.x,
+        y: parsed.y + offset.y,
+        width: parsed.width,
+        height: parsed.height
+      };
     } catch {
       return null;
     }
@@ -1204,11 +1555,23 @@ Refs:
     await new Promise((r) => setTimeout(r, 50));
     await this.pressKey("Backspace");
     await new Promise((r) => setTimeout(r, 50));
-    const cleared = await this.send("Runtime.evaluate", {
+    const frameContextId = this.frameContexts.get(refId);
+    const clearEvalOpts = {
       expression: `
         (function() {
           var el = document.querySelector('[data-assistme-ref="${refId}"]');
           if (!el) return 'no_element';
+
+          // For contenteditable elements, check textContent instead of value
+          if (el.isContentEditable || el.getAttribute('contenteditable') === 'true') {
+            if (el.textContent && el.textContent.trim() !== '') {
+              el.textContent = '';
+              el.dispatchEvent(new Event('input', { bubbles: true }));
+              return 'js_cleared';
+            }
+            return 'ok';
+          }
+
           if (el.value !== undefined && el.value !== '') {
             // Ctrl+A didn't work (some frameworks intercept it) \u2014 clear via JS
             var setter = Object.getOwnPropertyDescriptor(
@@ -1226,9 +1589,13 @@ Refs:
         })()
       `,
       returnByValue: true
-    });
+    };
+    if (frameContextId) {
+      clearEvalOpts.contextId = frameContextId;
+    }
+    const cleared = await this.send("Runtime.evaluate", clearEvalOpts);
     const clearStatus = cleared.result?.value || "ok";
-    if (clearStatus === "no_element") {
+    if (clearStatus === "no_element" && !frameContextId) {
       return {
         success: false,
         message: `Ref ${refLabel} not found after click. Take a new snapshot.`
@@ -1989,51 +2356,22 @@ import ora3 from "ora";
 import { createInterface as createInterface2 } from "readline";
 
 // src/agent/scheduler.ts
-var SCHEDULER_INTERVAL = 3e4;
+import { Cron } from "croner";
 function getNextRunTime(cronExpr, timezone, fromDate) {
   const now = fromDate || /* @__PURE__ */ new Date();
-  const parts = cronExpr.trim().split(/\s+/);
-  if (parts.length !== 5) {
-    throw new Error(`Invalid cron expression: ${cronExpr}`);
-  }
-  const [minExpr, hourExpr, domExpr, monExpr, dowExpr] = parts;
-  function parseField(expr, min, max) {
-    const values = [];
-    for (const part of expr.split(",")) {
-      if (part === "*") {
-        for (let i = min; i <= max; i++) values.push(i);
-      } else if (part.startsWith("*/")) {
-        const step = parseInt(part.slice(2));
-        for (let i = min; i <= max; i += step) values.push(i);
-      } else if (part.includes("-")) {
-        const [start, end] = part.split("-").map(Number);
-        for (let i = start; i <= end; i++) values.push(i);
-      } else {
-        values.push(parseInt(part));
-      }
+  try {
+    const job = new Cron(cronExpr, { timezone: timezone || "UTC" });
+    const next = job.nextRun(now);
+    if (!next) {
+      throw new Error(`No future run time found for cron expression: ${cronExpr}`);
     }
-    return values.sort((a, b) => a - b);
-  }
-  const minutes = parseField(minExpr, 0, 59);
-  const hours = parseField(hourExpr, 0, 23);
-  const daysOfMonth = parseField(domExpr, 1, 31);
-  const months = parseField(monExpr, 1, 12);
-  const daysOfWeek = parseField(dowExpr, 0, 6);
-  const useUTC = timezone === "UTC";
-  const candidate = new Date(now.getTime() + 6e4);
-  candidate.setSeconds(0, 0);
-  for (let i = 0; i < 527040; i++) {
-    const m = useUTC ? candidate.getUTCMinutes() : candidate.getMinutes();
-    const h = useUTC ? candidate.getUTCHours() : candidate.getHours();
-    const dom = useUTC ? candidate.getUTCDate() : candidate.getDate();
-    const mon = (useUTC ? candidate.getUTCMonth() : candidate.getMonth()) + 1;
-    const dow = useUTC ? candidate.getUTCDay() : candidate.getDay();
-    if (minutes.includes(m) && hours.includes(h) && daysOfMonth.includes(dom) && months.includes(mon) && (dowExpr === "*" || daysOfWeek.includes(dow))) {
-      return candidate;
-    }
-    candidate.setTime(candidate.getTime() + 6e4);
-  }
-  return new Date(now.getTime() + 864e5);
+    return next;
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("No future run time")) {
+      throw err;
+    }
+    throw new Error(`Invalid cron expression "${cronExpr}": ${errorMessage(err)}`);
+  }
 }
 var Scheduler = class {
   timer = null;
@@ -2043,7 +2381,7 @@ var Scheduler = class {
     this.onScheduledTask = onScheduledTask;
     this.running = true;
     await this.initializeNextRuns();
-    this.timer = setInterval(() => this.checkDueTasks(), SCHEDULER_INTERVAL);
+    this.timer = setInterval(() => this.checkDueTasks(), SCHEDULER_INTERVAL_MS);
     log.info("Scheduler started (checking every 30s)");
   }
   stop() {
@@ -2066,7 +2404,7 @@ var Scheduler = class {
         }
       }
     } catch (err) {
-      log.debug(`Scheduler init: ${err}`);
+      log.debug(`Scheduler init: ${errorMessage(err)}`);
     }
   }
   async checkDueTasks() {
@@ -2090,7 +2428,7 @@ var Scheduler = class {
           last_error: null
         });
       } catch (err) {
-        const errMsg = err instanceof Error ? err.message : String(err);
+        const errMsg = errorMessage(err);
         await callMcpHandler("schedule.update", {
           task_id: task.id,
           last_error: errMsg
@@ -2098,7 +2436,7 @@ var Scheduler = class {
         log.error(`Scheduled task "${task.name}" failed: ${errMsg}`);
       }
     } catch (err) {
-      log.debug(`Scheduler check error: ${err}`);
+      log.debug(`Scheduler check error: ${errorMessage(err)}`);
     }
   }
 };
@@ -2618,7 +2956,7 @@ var SkillManager = class {
   userId = null;
   /** Cache for findRelevant() — keyed by prompt, invalidated on skill changes */
   relevanceCache = /* @__PURE__ */ new Map();
-  DESCRIPTION_BUDGET_CHARS = 16e3;
+  DESCRIPTION_BUDGET_CHARS = SKILL_DESCRIPTION_BUDGET_CHARS;
   setUserId(userId) {
     this.userId = userId;
   }
@@ -2627,7 +2965,9 @@ var SkillManager = class {
     try {
       const data = await callMcpHandler("skill.load");
       this.skills.clear();
-      for (const row of data || []) {
+      for (const raw of data || []) {
+        const row = safeParse(SkillRowSchema, raw);
+        if (!row) continue;
         const skill = this.rowToSkill(row);
         this.skills.set(skill.name, skill);
       }
@@ -2641,22 +2981,22 @@ var SkillManager = class {
   }
   rowToSkill(row) {
     return {
-      name: row.name,
-      description: row.description || "",
-      version: row.version || "1.0.0",
+      name: String(row.name),
+      description: String(row.description ?? ""),
+      version: String(row.version ?? "1.0.0"),
       userInvocable: row.user_invocable !== false,
       disableModelInvocation: row.disable_model_invocation === true,
-      keywords: row.keywords || [],
-      allowedTools: row.allowed_tools || [],
-      argumentHint: row.argument_hint || "",
+      keywords: Array.isArray(row.keywords) ? row.keywords : [],
+      allowedTools: Array.isArray(row.allowed_tools) ? row.allowed_tools : [],
+      argumentHint: String(row.argument_hint ?? ""),
       metadata: parseDbMetadata(row.metadata),
-      homepage: row.homepage || "",
-      content: row.content,
+      homepage: String(row.homepage ?? ""),
+      content: String(row.content ?? ""),
       filePath: "",
       source: row.source || "manual",
-      dbId: row.id,
-      sourceSkillId: row.source_skill_id || void 0,
-      invocationCount: row.invocation_count || 0
+      dbId: row.id != null ? String(row.id) : void 0,
+      sourceSkillId: row.source_skill_id != null ? String(row.source_skill_id) : void 0,
+      invocationCount: typeof row.invocation_count === "number" ? row.invocation_count : 0
     };
   }
   /** Invalidate caches when skills change (create, add, update, remove). */
@@ -2786,13 +3126,14 @@ _(${skills.length - included} additional skills available \u2014 use skill_searc
           metadata
         }
       );
-      const row = Array.isArray(data) ? data[0] : data;
+      const raw = Array.isArray(data) ? data[0] : data;
+      const row = safeParse(SkillCreateResultSchema, raw);
       if (!row) {
-        log.debug(`Skill create returned no data for "${name}"`);
+        log.debug(`Skill create returned invalid data for "${name}"`);
         return null;
       }
       const id = row.out_id || row.id;
-      const skillName = row.out_name || row.name;
+      const skillName = row.out_name || row.name || name;
       this.skills.set(skillName, {
         name: skillName,
         description,
@@ -2962,11 +3303,11 @@ _(${skills.length - included} additional skills available \u2014 use skill_searc
         });
         if (data) {
           return data.map((row) => ({
-            name: row.name,
-            description: row.description || "",
-            emoji: row.emoji || "",
-            source: row.source || "manual",
-            invocationCount: row.invocation_count || 0
+            name: String(row.name),
+            description: String(row.description ?? ""),
+            emoji: String(row.emoji ?? ""),
+            source: String(row.source ?? "manual"),
+            invocationCount: typeof row.invocation_count === "number" ? row.invocation_count : 0
           }));
         }
       } catch {
@@ -3029,17 +3370,17 @@ _(${skills.length - included} additional skills available \u2014 use skill_searc
         limit: options?.limit || 20,
         offset: options?.offset || 0
       });
-      return (data || []).map((r) => ({
+      return (data || []).map((r) => safeParse(BrowseSkillRowSchema, r)).filter(Boolean).map((r) => ({
         id: r.id,
         name: r.name,
-        description: r.description || "",
-        emoji: r.emoji || "",
-        version: r.version || "1.0.0",
-        authorName: r.author_name || "",
-        category: r.category || "",
-        installCount: r.install_count || 0,
-        avgRating: r.avg_rating != null ? r.avg_rating : null,
-        ratingCount: r.rating_count || 0
+        description: r.description,
+        emoji: r.emoji,
+        version: r.version,
+        authorName: r.author_name,
+        category: r.category,
+        installCount: r.install_count,
+        avgRating: r.avg_rating ?? null,
+        ratingCount: r.rating_count
       }));
     } catch {
       return [];
@@ -3064,8 +3405,12 @@ function substituteArguments(content, args) {
   content = content.replace(/\$(\d+)(?!\w)/g, (_, i) => parts[parseInt(i)] || "");
   return content;
 }
+var SAFE_DYNAMIC_COMMANDS = /^(date|whoami|hostname|uname|pwd|echo|node\s+--version|npm\s+--version|git\s+(branch|rev-parse|log\s+--oneline)|cat\s+)/;
 function preprocessDynamicContext(content, cwd) {
   return content.replace(/!`([^`]+)`/g, (_, cmd) => {
+    if (!SAFE_DYNAMIC_COMMANDS.test(cmd.trim())) {
+      return `[command blocked: ${cmd}]`;
+    }
     try {
       return execSync2(cmd, { timeout: 1e4, encoding: "utf-8", cwd }).trim();
     } catch {
@@ -3140,7 +3485,9 @@ Respond with a JSON object now.`;
       } else if (message.type === "result") {
         const resultMsg = message;
         if (resultMsg.subtype === "success" && "total_cost_usd" in resultMsg) {
-          log.debug(`Skill evaluation cost: $${resultMsg.total_cost_usd.toFixed(4)}`);
+          log.debug(
+            `Skill evaluation cost: $${resultMsg.total_cost_usd.toFixed(4)}`
+          );
         }
       }
     }
@@ -3149,13 +3496,9 @@ Respond with a JSON object now.`;
       log.debug("Skill evaluation: no valid JSON in response");
       return;
     }
-    if (!["create", "update", "skip"].includes(decision.action)) {
-      log.debug("Skill evaluation: invalid action");
-      return;
-    }
     await executeSkillDecision(decision, skillManager);
   } catch (err) {
-    log.debug(`Skill evaluation error: ${err}`);
+    log.debug(`Skill evaluation error: ${errorMessage(err)}`);
   }
 }
 async function executeSkillDecision(decision, skillManager) {
@@ -3165,13 +3508,17 @@ async function executeSkillDecision(decision, skillManager) {
         log.debug("Skill create skipped: missing name or instructions");
         return;
       }
-      let skillName = decision.name;
-      if (validateSkillName(skillName)) {
-        skillName = normalizeSkillName(skillName);
-        if (!skillName || validateSkillName(skillName)) {
-          log.debug(`Skill create skipped: name "${decision.name}" cannot be normalized`);
-          return;
-        }
+      let skillName = normalizeSkillName(decision.name);
+      if (!skillName) {
+        log.debug(`Skill create skipped: name "${decision.name}" cannot be normalized`);
+        return;
+      }
+      const validationError = validateSkillName(skillName);
+      if (validationError) {
+        log.debug(`Skill create skipped: ${validationError}`);
+        return;
+      }
+      if (skillName !== decision.name) {
         log.debug(`Normalized skill name: "${decision.name}" \u2192 "${skillName}"`);
       }
       const existing = skillManager.findSimilar(skillName);
@@ -3230,25 +3577,28 @@ async function executeSkillDecision(decision, skillManager) {
 }
 function parseJsonResponse(text) {
   const trimmed = text.trim();
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (parsed.action) return parsed;
-  } catch {
-  }
+  const candidates = [trimmed];
   const start = trimmed.indexOf("{");
-  if (start === -1) return null;
-  let depth = 0;
-  for (let i = start; i < trimmed.length; i++) {
-    if (trimmed[i] === "{") depth++;
-    else if (trimmed[i] === "}") depth--;
-    if (depth === 0) {
-      try {
-        return JSON.parse(trimmed.slice(start, i + 1));
-      } catch {
-        return null;
+  if (start !== -1) {
+    let depth = 0;
+    for (let i = start; i < trimmed.length; i++) {
+      if (trimmed[i] === "{") depth++;
+      else if (trimmed[i] === "}") depth--;
+      if (depth === 0) {
+        candidates.push(trimmed.slice(start, i + 1));
+        break;
       }
     }
   }
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(candidate);
+      const validated = safeParse(SkillDecisionSchema, parsed);
+      if (validated) return validated;
+    } catch {
+      continue;
+    }
+  }
   return null;
 }
 
@@ -3295,14 +3645,16 @@ import { z } from "zod/v4";
 
 // src/tools/filesystem.ts
 import { readFile, writeFile, readdir, stat, mkdir } from "fs/promises";
-import { resolve, relative, join as join2 } from "path";
+import { resolve, relative, join as join2, sep } from "path";
 import { glob } from "glob";
 function assertWithinWorkspace(filePath) {
   const config = getConfig();
   const resolved = resolve(config.workspacePath, filePath);
-  if (!resolved.startsWith(config.workspacePath)) {
-    throw new Error(
-      `Access denied: path "${filePath}" is outside workspace "${config.workspacePath}"`
+  const rel = relative(config.workspacePath, resolved);
+  if (rel.startsWith("..") || rel.startsWith(sep + sep)) {
+    throw new AppError(
+      `Access denied: path "${filePath}" is outside workspace "${config.workspacePath}"`,
+      "PATH_TRAVERSAL"
     );
   }
   return resolved;
@@ -3332,7 +3684,7 @@ async function searchFiles(pattern, directory) {
     ignore: ["node_modules/**", ".git/**", "dist/**", ".next/**"]
   });
   if (matches.length === 0) return "No files found matching the pattern.";
-  return matches.slice(0, 50).map((m) => relative(config.workspacePath, join2(cwd, m))).join("\n");
+  return matches.slice(0, MAX_FILE_SEARCH_RESULTS).map((m) => relative(config.workspacePath, join2(cwd, m))).join("\n");
 }
 async function listDirectory(path) {
   const config = getConfig();
@@ -3342,9 +3694,7 @@ async function listDirectory(path) {
   for (const entry of entries) {
     if (entry.name.startsWith(".") && entry.name !== ".env.example") continue;
     const icon = entry.isDirectory() ? "\u{1F4C1}" : "\u{1F4C4}";
-    const info = entry.isFile() ? await stat(join2(resolved, entry.name)).then(
-      (s) => ` (${formatSize(s.size)})`
-    ) : "";
+    const info = entry.isFile() ? await stat(join2(resolved, entry.name)).then((s) => ` (${formatSize(s.size)})`) : "";
     results.push(`${icon} ${entry.name}${info}`);
   }
   return results.join("\n") || "Empty directory.";
@@ -3362,9 +3712,14 @@ async function searchContent(pattern, fileGlob, directory) {
     nodir: true,
     ignore: ["node_modules/**", ".git/**", "dist/**", ".next/**"]
   });
-  const regex = new RegExp(pattern, "gi");
+  let regex;
+  try {
+    regex = new RegExp(pattern, "gi");
+  } catch {
+    regex = new RegExp(pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
+  }
   const results = [];
-  for (const file of files.slice(0, 200)) {
+  for (const file of files.slice(0, MAX_CONTENT_SEARCH_FILES)) {
     try {
       const content = await readFile(join2(cwd, file), "utf-8");
       const lines = content.split("\n");
@@ -3373,10 +3728,10 @@ async function searchContent(pattern, fileGlob, directory) {
           const relPath = relative(config.workspacePath, join2(cwd, file));
           results.push(`${relPath}:${i + 1}: ${lines[i].trim()}`);
           regex.lastIndex = 0;
-          if (results.length >= 30) break;
+          if (results.length >= MAX_CONTENT_SEARCH_RESULTS) break;
         }
       }
-      if (results.length >= 30) break;
+      if (results.length >= MAX_CONTENT_SEARCH_RESULTS) break;
     } catch {
     }
   }
@@ -3385,8 +3740,6 @@ async function searchContent(pattern, fileGlob, directory) {
 
 // src/tools/shell.ts
 import { exec } from "child_process";
-var TIMEOUT_MS = 3e4;
-var MAX_OUTPUT = 5e4;
 var BLOCKED_PATTERNS = [
   /rm\s+(-\w*\s+)*-\w*r\w*\s+\/($|\s)/i,
   // rm -rf /, rm -fr /, etc.
@@ -3414,7 +3767,7 @@ function isBlocked(command) {
 }
 async function executeShell(command, cwd) {
   if (isBlocked(command)) {
-    throw new Error(`Command blocked for safety: "${command}"`);
+    throw new AppError(`Command blocked for safety: "${command}"`, "COMMAND_BLOCKED");
   }
   const config = getConfig();
   const workDir = cwd || config.workspacePath;
@@ -3423,7 +3776,7 @@ async function executeShell(command, cwd) {
       command,
       {
         cwd: workDir,
-        timeout: TIMEOUT_MS,
+        timeout: SHELL_TIMEOUT_MS,
         maxBuffer: 1024 * 1024,
         // 1MB buffer
         env: { ...process.env, TERM: "dumb" }
@@ -3441,10 +3794,10 @@ ${stderr}` : "";
         if (error && !stdout && !stderr) {
           output = `Error: ${error.message}`;
         }
-        if (output.length > MAX_OUTPUT) {
-          output = output.slice(0, MAX_OUTPUT) + `
+        if (output.length > SHELL_MAX_OUTPUT) {
+          output = output.slice(0, SHELL_MAX_OUTPUT) + `
 
-[Output truncated at ${MAX_OUTPUT} bytes]`;
+[Output truncated at ${SHELL_MAX_OUTPUT} bytes]`;
         }
         resolve2(output || "(no output)");
       }
@@ -3811,7 +4164,7 @@ function createBrowserMcpServer() {
       ),
       tool(
         "browser_type",
-        "Type text into an input field in the user's browser.",
+        "Type text into an input field in the user's browser. If the CSS selector fails, automatically falls back to typing into the currently focused element. Works with contenteditable elements (rich text editors) and cross-origin iframes.",
         {
           selector: z.string().describe("CSS selector of the input element"),
           text: z.string().describe("Text to type")
@@ -5104,7 +5457,7 @@ function createEventHooks(taskId, toolCallRecords) {
     const rawName = preInput.tool_name;
     const displayName = stripMcpPrefix(rawName);
     const toolInput = preInput.tool_input;
-    log.tool(displayName, JSON.stringify(toolInput).slice(0, 200));
+    log.tool(displayName, JSON.stringify(toolInput).slice(0, MAX_TOOL_INPUT_LOG_LENGTH));
     await emitEvent(taskId, "tool_use_start", { name: displayName });
     await emitEvent(taskId, "tool_use_input", { input: toolInput });
     if (displayName === "browser_request_user_action") {
@@ -5123,15 +5476,15 @@ function createEventHooks(taskId, toolCallRecords) {
     const toolInput = postInput.tool_input;
     const toolResponse = postInput.tool_response;
     const resultStr = typeof toolResponse === "string" ? toolResponse : JSON.stringify(toolResponse);
-    log.result(resultStr.slice(0, 200));
+    log.result(resultStr.slice(0, MAX_TOOL_INPUT_LOG_LENGTH));
     await emitEvent(taskId, "tool_result", {
       name: displayName,
-      result: resultStr.slice(0, 1e4)
+      result: resultStr.slice(0, MAX_TOOL_RESULT_LENGTH)
     });
     toolCallRecords.push({
       name: displayName,
       input: toolInput || {},
-      result: resultStr.slice(0, 300)
+      result: resultStr.slice(0, MAX_SKILL_RECORD_RESULT_LENGTH)
     });
     return {};
   };
@@ -5310,8 +5663,6 @@ var TaskTimeout = class {
     }
   }
 };
-var MAX_HISTORY_ENTRIES = 10;
-var MAX_RESPONSE_LENGTH = 1500;
 var TaskProcessor = class {
   memoryManager = null;
   skillManager;
@@ -5346,7 +5697,7 @@ var TaskProcessor = class {
   async processTask(task) {
     const config = getConfig();
     resetEventSequence();
-    const taskTimeoutMs = (config.taskTimeoutMinutes || 10) * 6e4;
+    const taskTimeoutMs = config.taskTimeoutMinutes * 6e4;
     newCorrelationId();
     log.info(`Processing task ${task.id.slice(0, 8)}...`);
     let finalResponse = "";
@@ -5385,7 +5736,7 @@ var TaskProcessor = class {
         for (const entry of history) {
           historyPrompt += `User: ${entry.prompt}
 `;
-          const truncated = entry.response.length > MAX_RESPONSE_LENGTH ? entry.response.slice(0, MAX_RESPONSE_LENGTH) + "\u2026" : entry.response;
+          const truncated = entry.response.length > MAX_HISTORY_RESPONSE_LENGTH ? entry.response.slice(0, MAX_HISTORY_RESPONSE_LENGTH) + "\u2026" : entry.response;
           historyPrompt += `Assistant: ${truncated}
 
 `;
@@ -5464,16 +5815,11 @@ var TaskProcessor = class {
         persistSession: true,
         abortController
       };
-      const taskStartTime = Date.now();
       try {
         for await (const message of query2({
           prompt: promptMessages(),
           options
         })) {
-          if (Date.now() - taskStartTime > taskTimeoutMs) {
-            finalResponse += "\n\n[Task timed out]";
-            break;
-          }
           switch (message.type) {
             case "assistant": {
               const assistantMsg = message;
@@ -5485,7 +5831,8 @@ var TaskProcessor = class {
                     text: block.text
                   });
                 } else if (block.type === "thinking" && "thinking" in block) {
-                  const thinkingText = block.thinking;
+                  const thinkingBlock = block;
+                  const thinkingText = thinkingBlock.thinking;
                   log.debug(`Thinking: ${thinkingText.slice(0, 100)}...`);
                   await emitEvent(task.id, "thinking", {
                     text: thinkingText
@@ -5518,8 +5865,11 @@ var TaskProcessor = class {
               break;
             }
             default:
-              if (message.type === "system" && "subtype" in message && message.subtype === "init") {
-                agentSessionId = message.session_id;
+              if (message.type === "system" && "subtype" in message) {
+                const sysMsg = message;
+                if (sysMsg.subtype === "init" && sysMsg.session_id) {
+                  agentSessionId = sysMsg.session_id;
+                }
               }
               log.debug(`SDK message type: ${message.type}`);
               break;
@@ -5528,10 +5878,9 @@ var TaskProcessor = class {
       } finally {
         taskTimeout.clear();
       }
-      const MAX_CONTENT_LENGTH = 5e4;
-      const truncatedResponse = finalResponse.length > MAX_CONTENT_LENGTH ? finalResponse.slice(0, MAX_CONTENT_LENGTH) + "\n\n[Response truncated]" : finalResponse;
+      const truncatedResponse = finalResponse.length > MAX_RESPONSE_CONTENT_LENGTH ? finalResponse.slice(0, MAX_RESPONSE_CONTENT_LENGTH) + "\n\n[Response truncated]" : finalResponse;
       await withRetry(() => completeTask(task.id, truncatedResponse, tokenUsage), {
-        maxRetries: 2,
+        maxRetries: MAX_COMPLETE_TASK_RETRIES,
         baseDelayMs: 300,
         label: "completeTask"
       });
@@ -5549,7 +5898,7 @@ var TaskProcessor = class {
         );
       }
     } catch (err) {
-      const errorMsg = err instanceof Error ? err.message : String(err);
+      const errorMsg = errorMessage(err);
       log.error(`Task failed: ${errorMsg}`);
       await failTask(task.id, errorMsg);
       await emitEvent(task.id, "error", { message: errorMsg });
@@ -6053,7 +6402,7 @@ function registerJobCommands(program2) {
   jobCmd.command("list").description("List your defined jobs").action(async () => {
     try {
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-P2L6MOOX.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-JT3JWZBV.js");
       const runner = new JobRunner2();
       const jobs = await runner.listJobs();
       if (jobs.length === 0) {
@@ -6077,7 +6426,7 @@ function registerJobCommands(program2) {
   jobCmd.command("status [name]").description("Show run history for a job (or all jobs)").option("-l, --limit <number>", "Max runs to show (default: 5)").action(async (name, opts) => {
     try {
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-P2L6MOOX.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-JT3JWZBV.js");
       const runner = new JobRunner2();
       const runs = await runner.getRunHistory(name, parseInt(opts.limit || "5"));
       if (runs.length === 0) {
@@ -6116,7 +6465,7 @@ Job Run History${name ? ` \u2014 ${name}` : ""}:`));
         process.exit(1);
       }
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-P2L6MOOX.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-JT3JWZBV.js");
       const runner = new JobRunner2();
       const job = await runner.loadJob(name);
       if (!job) {