assistme 0.3.4 → 0.3.6

package/src/tools/filesystem.ts

@@ -1,14 +1,23 @@
 import { readFile, writeFile, readdir, stat, mkdir } from "fs/promises";
-import { resolve, relative, join } from "path";
+import { resolve, relative, join, sep } from "path";
 import { glob } from "glob";
 import { getConfig } from "../utils/config.js";
+import { AppError } from "../utils/errors.js";
+import {
+  MAX_FILE_SEARCH_RESULTS,
+  MAX_CONTENT_SEARCH_FILES,
+  MAX_CONTENT_SEARCH_RESULTS,
+} from "../utils/constants.js";
 
 function assertWithinWorkspace(filePath: string): string {
   const config = getConfig();
   const resolved = resolve(config.workspacePath, filePath);
-  if (!resolved.startsWith(config.workspacePath)) {
-    throw new Error(
-      `Access denied: path "${filePath}" is outside workspace "${config.workspacePath}"`
+  // Use path.relative() to prevent path traversal attacks like "/workspace-evil/workspace/file"
+  const rel = relative(config.workspacePath, resolved);
+  if (rel.startsWith("..") || rel.startsWith(sep + sep)) {
+    throw new AppError(
+      `Access denied: path "${filePath}" is outside workspace "${config.workspacePath}"`,
+      "PATH_TRAVERSAL"
     );
   }
   return resolved;
@@ -27,15 +36,10 @@ export async function readFileContent(
   const end = limit ? start + limit : lines.length;
   const selected = lines.slice(start, end);
 
-  return selected
-    .map((line, i) => `${String(start + i + 1).padStart(5)} | ${line}`)
-    .join("\n");
+  return selected.map((line, i) => `${String(start + i + 1).padStart(5)} | ${line}`).join("\n");
 }
 
-export async function writeFileContent(
-  path: string,
-  content: string
-): Promise<string> {
+export async function writeFileContent(path: string, content: string): Promise<string> {
   const resolved = assertWithinWorkspace(path);
   // Ensure parent directory exists
   const dir = resolve(resolved, "..");
@@ -44,14 +48,9 @@ export async function writeFileContent(
   return `File written: ${path} (${content.length} bytes)`;
 }
 
-export async function searchFiles(
-  pattern: string,
-  directory?: string
-): Promise<string> {
+export async function searchFiles(pattern: string, directory?: string): Promise<string> {
   const config = getConfig();
-  const cwd = directory
-    ? assertWithinWorkspace(directory)
-    : config.workspacePath;
+  const cwd = directory ? assertWithinWorkspace(directory) : config.workspacePath;
 
   const matches = await glob(pattern, {
     cwd,
@@ -62,16 +61,14 @@ export async function searchFiles(
   if (matches.length === 0) return "No files found matching the pattern.";
 
   return matches
-    .slice(0, 50) // Cap at 50 results
+    .slice(0, MAX_FILE_SEARCH_RESULTS)
     .map((m) => relative(config.workspacePath, join(cwd, m)))
     .join("\n");
 }
 
 export async function listDirectory(path?: string): Promise<string> {
   const config = getConfig();
-  const resolved = path
-    ? assertWithinWorkspace(path)
-    : config.workspacePath;
+  const resolved = path ? assertWithinWorkspace(path) : config.workspacePath;
 
   const entries = await readdir(resolved, { withFileTypes: true });
   const results: string[] = [];
@@ -80,9 +77,7 @@ export async function listDirectory(path?: string): Promise<string> {
     if (entry.name.startsWith(".") && entry.name !== ".env.example") continue;
     const icon = entry.isDirectory() ? "📁" : "📄";
     const info = entry.isFile()
-      ? await stat(join(resolved, entry.name)).then(
-          (s) => ` (${formatSize(s.size)})`
-        )
+      ? await stat(join(resolved, entry.name)).then((s) => ` (${formatSize(s.size)})`)
       : "";
     results.push(`${icon} ${entry.name}${info}`);
   }
@@ -102,9 +97,7 @@ export async function searchContent(
   directory?: string
 ): Promise<string> {
   const config = getConfig();
-  const cwd = directory
-    ? assertWithinWorkspace(directory)
-    : config.workspacePath;
+  const cwd = directory ? assertWithinWorkspace(directory) : config.workspacePath;
 
   const files = await glob(fileGlob || "**/*", {
     cwd,
@@ -112,10 +105,16 @@ export async function searchContent(
     ignore: ["node_modules/**", ".git/**", "dist/**", ".next/**"],
   });
 
-  const regex = new RegExp(pattern, "gi");
+  let regex: RegExp;
+  try {
+    regex = new RegExp(pattern, "gi");
+  } catch {
+    // Fall back to literal string match if the pattern is invalid regex
+    regex = new RegExp(pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
+  }
   const results: string[] = [];
 
-  for (const file of files.slice(0, 200)) {
+  for (const file of files.slice(0, MAX_CONTENT_SEARCH_FILES)) {
     try {
       const content = await readFile(join(cwd, file), "utf-8");
       const lines = content.split("\n");
@@ -126,17 +125,15 @@ export async function searchContent(
           results.push(`${relPath}:${i + 1}: ${lines[i].trim()}`);
           regex.lastIndex = 0;
 
-          if (results.length >= 30) break;
+          if (results.length >= MAX_CONTENT_SEARCH_RESULTS) break;
         }
       }
 
-      if (results.length >= 30) break;
+      if (results.length >= MAX_CONTENT_SEARCH_RESULTS) break;
     } catch {
       // Skip binary/unreadable files
     }
   }
 
-  return results.length > 0
-    ? results.join("\n")
-    : "No matches found.";
+  return results.length > 0 ? results.join("\n") : "No matches found.";
 }

package/src/tools/shell.ts

@@ -1,33 +1,29 @@
 import { exec } from "child_process";
 import { getConfig } from "../utils/config.js";
-
-const TIMEOUT_MS = 30_000; // 30 seconds
-const MAX_OUTPUT = 50_000; // 50KB output cap
+import { AppError } from "../utils/errors.js";
+import { SHELL_TIMEOUT_MS, SHELL_MAX_OUTPUT } from "../utils/constants.js";
 
 // Commands that are never allowed — matched as case-insensitive regex patterns
 const BLOCKED_PATTERNS: RegExp[] = [
-  /rm\s+(-\w*\s+)*-\w*r\w*\s+\/($|\s)/i,         // rm -rf /, rm -fr /, etc.
-  /rm\s+(-\w*\s+)*-\w*r\w*\s+~($|\s|\/)/i,      // rm -rf ~, rm -fr ~/, etc.
-  /\bmkfs\b/i,                                    // mkfs (any form)
-  /\bdd\s+.*\bif=/i,                              // dd if=
-  /:\s*\(\s*\)\s*\{/,                             // fork bomb :(){}
-  /\bchmod\s+(-\w+\s+)*-R\s+777\s+\//i,          // chmod -R 777 /
-  />\s*\/dev\/sd[a-z]/i,                           // write to raw disk
-  /\bshutdown\b/i,                                 // shutdown
-  /\breboot\b/i,                                   // reboot
-  /\bsystemctl\s+(start|stop|disable|mask)\b/i,   // dangerous systemctl ops
+  /rm\s+(-\w*\s+)*-\w*r\w*\s+\/($|\s)/i, // rm -rf /, rm -fr /, etc.
+  /rm\s+(-\w*\s+)*-\w*r\w*\s+~($|\s|\/)/i, // rm -rf ~, rm -fr ~/, etc.
+  /\bmkfs\b/i, // mkfs (any form)
+  /\bdd\s+.*\bif=/i, // dd if=
+  /:\s*\(\s*\)\s*\{/, // fork bomb :(){}
+  /\bchmod\s+(-\w+\s+)*-R\s+777\s+\//i, // chmod -R 777 /
+  />\s*\/dev\/sd[a-z]/i, // write to raw disk
+  /\bshutdown\b/i, // shutdown
+  /\breboot\b/i, // reboot
+  /\bsystemctl\s+(start|stop|disable|mask)\b/i, // dangerous systemctl ops
 ];
 
 export function isBlocked(command: string): boolean {
   return BLOCKED_PATTERNS.some((pattern) => pattern.test(command));
 }
 
-export async function executeShell(
-  command: string,
-  cwd?: string
-): Promise<string> {
+export async function executeShell(command: string, cwd?: string): Promise<string> {
   if (isBlocked(command)) {
-    throw new Error(`Command blocked for safety: "${command}"`);
+    throw new AppError(`Command blocked for safety: "${command}"`, "COMMAND_BLOCKED");
   }
 
   const config = getConfig();
@@ -38,7 +34,7 @@ export async function executeShell(
       command,
       {
         cwd: workDir,
-        timeout: TIMEOUT_MS,
+        timeout: SHELL_TIMEOUT_MS,
         maxBuffer: 1024 * 1024, // 1MB buffer
         env: { ...process.env, TERM: "dumb" },
       },
@@ -56,10 +52,10 @@ export async function executeShell(
         }
 
         // Truncate if too large
-        if (output.length > MAX_OUTPUT) {
+        if (output.length > SHELL_MAX_OUTPUT) {
           output =
-            output.slice(0, MAX_OUTPUT) +
-            `\n\n[Output truncated at ${MAX_OUTPUT} bytes]`;
+            output.slice(0, SHELL_MAX_OUTPUT) +
+            `\n\n[Output truncated at ${SHELL_MAX_OUTPUT} bytes]`;
         }
 
         resolve(output || "(no output)");

package/src/utils/config.test.ts

@@ -49,7 +49,7 @@ describe("config module", () => {
     const config = getConfig();
     expect(config.sessionName).toBe("Default");
     expect(config.model).toBe("claude-sonnet-4-20250514");
-    expect(config.maxTurns).toBe(50);
+    expect(config.maxTurns).toBe(200);
   });
 
   it("resolves workspacePath to absolute path", () => {

package/src/utils/config.ts

@@ -9,11 +9,18 @@ export interface AssistMeConfig {
   sessionName: string;
   model: string;
   maxTurns: number;
+  taskTimeoutMinutes: number;
 }
 
+/**
+ * Default Supabase values — read from env vars first, then fall back to
+ * compile-time defaults. This keeps secrets out of plain source when deploying
+ * custom instances, while still allowing the hosted service to "just work".
+ */
 const SUPABASE_URL_DEFAULT =
-  "https://msgplwbgohpokajtibew.supabase.co";
+  process.env.ASSISTME_SUPABASE_URL || "https://msgplwbgohpokajtibew.supabase.co";
 const SUPABASE_ANON_KEY_DEFAULT =
+  process.env.ASSISTME_SUPABASE_ANON_KEY ||
   "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im1zZ3Bsd2Jnb2hwb2thanRpYmV3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjE3MTMzNTEsImV4cCI6MjA3NzI4OTM1MX0.YqiluL_mIBWKv5dteIcPAPQ_jRp9rzZlvAXvkQttDjs";
 
 const CONFIG_DEFAULTS: Partial<AssistMeConfig> = {
@@ -21,7 +28,8 @@ const CONFIG_DEFAULTS: Partial<AssistMeConfig> = {
   supabaseAnonKey: SUPABASE_ANON_KEY_DEFAULT,
   sessionName: "Default",
   model: "claude-sonnet-4-20250514",
-  maxTurns: 50,
+  maxTurns: 200,
+  taskTimeoutMinutes: 10,
 };
 
 const config = new Conf<Partial<AssistMeConfig>>({
@@ -30,14 +38,11 @@ const config = new Conf<Partial<AssistMeConfig>>({
 });
 
 export function getConfig(): AssistMeConfig {
-  const supabaseUrl =
-    process.env.SUPABASE_URL || config.get("supabaseUrl") || SUPABASE_URL_DEFAULT;
+  const supabaseUrl = process.env.SUPABASE_URL || config.get("supabaseUrl") || SUPABASE_URL_DEFAULT;
   const supabaseAnonKey =
     process.env.SUPABASE_ANON_KEY || config.get("supabaseAnonKey") || SUPABASE_ANON_KEY_DEFAULT;
-  const anthropicApiKey =
-    process.env.ANTHROPIC_API_KEY || config.get("anthropicApiKey") || "";
-  const workspacePath =
-    config.get("workspacePath") || process.cwd();
+  const anthropicApiKey = process.env.ANTHROPIC_API_KEY || config.get("anthropicApiKey") || "";
+  const workspacePath = config.get("workspacePath") || process.cwd();
 
   return {
     supabaseUrl,
@@ -46,7 +51,8 @@ export function getConfig(): AssistMeConfig {
     workspacePath: resolve(workspacePath),
     sessionName: config.get("sessionName") || "Default",
     model: config.get("model") || "claude-sonnet-4-20250514",
-    maxTurns: config.get("maxTurns") || 50,
+    maxTurns: config.get("maxTurns") || 200,
+    taskTimeoutMinutes: config.get("taskTimeoutMinutes") || 10,
   };
 }
 

package/src/utils/constants.ts

@@ -0,0 +1,77 @@
+/**
+ * Centralized constants for the entire application.
+ * All magic numbers and limits should be defined here.
+ */
+
+// ── Truncation Limits ──────────────────────────────────────────────
+
+/** Max characters for final task response sent to DB */
+export const MAX_RESPONSE_CONTENT_LENGTH = 50_000;
+
+/** Max characters for tool result stored in events */
+export const MAX_TOOL_RESULT_LENGTH = 10_000;
+
+/** Max characters for tool result stored in skill extraction records */
+export const MAX_SKILL_RECORD_RESULT_LENGTH = 300;
+
+/** Max characters for tool input logged to console */
+export const MAX_TOOL_INPUT_LOG_LENGTH = 200;
+
+/** Max characters for job run summary */
+export const MAX_JOB_SUMMARY_LENGTH = 10_000;
+
+/** Max characters for conversation history per response */
+export const MAX_HISTORY_RESPONSE_LENGTH = 1_500;
+
+/** Max conversation history entries to include in prompt */
+export const MAX_HISTORY_ENTRIES = 10;
+
+/** Budget for skill descriptions in system prompt */
+export const SKILL_DESCRIPTION_BUDGET_CHARS = 16_000;
+
+// ── Timeouts ───────────────────────────────────────────────────────
+
+/** Default task timeout in minutes */
+export const DEFAULT_TASK_TIMEOUT_MINUTES = 10;
+
+/** Shell command execution timeout in ms */
+export const SHELL_TIMEOUT_MS = 30_000;
+
+/** Shell output cap in characters */
+export const SHELL_MAX_OUTPUT = 50_000;
+
+/** CDP command timeout in ms */
+export const CDP_COMMAND_TIMEOUT_MS = 15_000;
+
+/** WebSocket connect timeout in ms */
+export const WS_CONNECT_TIMEOUT_MS = 5_000;
+
+/** Scheduler check interval in ms */
+export const SCHEDULER_INTERVAL_MS = 30_000;
+
+// ── Browser Cache Limits ───────────────────────────────────────────
+
+/** Max entries in refCache before pruning */
+export const REF_CACHE_MAX_SIZE = 5_000;
+
+/** Max entries in frameContexts before pruning */
+export const FRAME_CONTEXTS_MAX_SIZE = 500;
+
+// ── Search & Matching ──────────────────────────────────────────────
+
+/** Max file search results */
+export const MAX_FILE_SEARCH_RESULTS = 50;
+
+/** Max files to scan for content search */
+export const MAX_CONTENT_SEARCH_FILES = 200;
+
+/** Max content search result lines */
+export const MAX_CONTENT_SEARCH_RESULTS = 30;
+
+// ── Retry & Polling ────────────────────────────────────────────────
+
+/** Max retries for event emission */
+export const MAX_EMIT_RETRIES = 2;
+
+/** Max retries for task completion */
+export const MAX_COMPLETE_TASK_RETRIES = 2;

package/src/utils/errors.ts

@@ -0,0 +1,37 @@
+/**
+ * Structured error types for consistent error handling.
+ */
+
+export class AppError extends Error {
+  constructor(
+    message: string,
+    public readonly code: ErrorCode,
+    public readonly cause?: unknown
+  ) {
+    super(message);
+    this.name = "AppError";
+  }
+
+  static fromUnknown(err: unknown, code: ErrorCode = "INTERNAL"): AppError {
+    if (err instanceof AppError) return err;
+    const message = err instanceof Error ? err.message : String(err);
+    return new AppError(message, code, err);
+  }
+}
+
+export type ErrorCode =
+  | "INTERNAL"
+  | "NETWORK"
+  | "AUTH"
+  | "VALIDATION"
+  | "TIMEOUT"
+  | "PATH_TRAVERSAL"
+  | "COMMAND_BLOCKED"
+  | "BROWSER"
+  | "DB";
+
+/** Extract error message from unknown error value */
+export function errorMessage(err: unknown): string {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}

package/src/utils/schemas.ts

@@ -0,0 +1,115 @@
+import { z } from "zod";
+
+/**
+ * Zod schemas for runtime validation of MCP handler responses.
+ * Replaces unsafe `as` type casts throughout the codebase.
+ */
+
+// ── Helpers ────────────────────────────────────────────────────────
+
+/** Safely parse data with a Zod schema, returning null on failure */
+export function safeParse<T>(schema: z.ZodType<T>, data: unknown): T | null {
+  const result = schema.safeParse(data);
+  return result.success ? result.data : null;
+}
+
+/** Parse data with a Zod schema, throwing on failure */
+export function parse<T>(schema: z.ZodType<T>, data: unknown): T {
+  return schema.parse(data);
+}
+
+// ── DB Row Schemas ─────────────────────────────────────────────────
+
+export const ConversationMessageSchema = z.object({
+  id: z.string(),
+  conversation_id: z.string(),
+  content: z.string().optional().default(""),
+  status: z.string().optional().nullable(),
+  metadata: z.record(z.string(), z.unknown()).optional().default({}),
+  created_at: z.string().optional(),
+});
+
+export const SkillRowSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  description: z.string().optional().default(""),
+  version: z.string().optional().default("1.0.0"),
+  user_invocable: z.boolean().optional().default(true),
+  disable_model_invocation: z.boolean().optional().default(false),
+  keywords: z.array(z.string()).optional().default([]),
+  allowed_tools: z.array(z.string()).optional().default([]),
+  argument_hint: z.string().optional().default(""),
+  metadata: z.unknown().optional().default({}),
+  homepage: z.string().optional().default(""),
+  content: z.string(),
+  source: z.string().optional().default("manual"),
+  source_skill_id: z.string().optional().nullable(),
+  invocation_count: z.number().optional().default(0),
+});
+
+export const JobRowSchema = z.object({
+  job_id: z.string(),
+  job_name: z.string(),
+  job_description: z.string().optional().default(""),
+  skill_id: z.string().optional().nullable(),
+  skill_name: z.string().optional().nullable(),
+  skill_description: z.string().optional().default(""),
+  skill_emoji: z.string().optional().default(""),
+  skill_content: z.string().optional().default(""),
+});
+
+export const JobListRowSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  description: z.string().optional().default(""),
+  skill_count: z.number().optional().default(0),
+});
+
+export const JobRunRowSchema = z.object({
+  run_id: z.string(),
+  job_name: z.string(),
+  status: z.string(),
+  trigger_type: z.string().optional().default("manual"),
+  started_at: z.string(),
+  completed_at: z.string().optional().nullable(),
+  summary: z.string().optional().nullable(),
+});
+
+export const SkillCreateResultSchema = z
+  .object({
+    out_id: z.string().optional(),
+    id: z.string().optional(),
+    out_name: z.string().optional(),
+    name: z.string().optional(),
+  })
+  .refine((data) => data.out_id || data.id, {
+    message: "Skill create result must have out_id or id",
+  });
+
+export const SkillDecisionSchema = z.object({
+  action: z.enum(["create", "update", "skip"]),
+  name: z.string().optional(),
+  description: z.string().optional(),
+  instructions: z.string().optional(),
+  emoji: z.string().optional(),
+  keywords: z.array(z.string()).optional(),
+  existing_skill_name: z.string().optional(),
+  improved_instructions: z.string().optional(),
+  improved_description: z.string().optional(),
+  reason: z.string(),
+});
+
+export type SkillDecision = z.infer<typeof SkillDecisionSchema>;
+
+export const BrowseSkillRowSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  description: z.string().optional().default(""),
+  emoji: z.string().optional().default(""),
+  version: z.string().optional().default("1.0.0"),
+  author_name: z.string().optional().default(""),
+  category: z.string().optional().default(""),
+  install_count: z.number().optional().default(0),
+  avg_rating: z.number().optional().nullable(),
+  rating_count: z.number().optional().default(0),
+});

package/dist/job-runner-P2L6MOOX.js

@@ -1,7 +0,0 @@
-import {
-  JobRunner
-} from "./chunk-KX7ITO55.js";
-import "./chunk-TTEGHE2E.js";
-export {
-  JobRunner
-};