assistme 0.3.5 → 0.4.0

package/dist/index.js

@@ -1,20 +1,49 @@
 #!/usr/bin/env node
 import {
+  AppError,
+  BrowseSkillRowSchema,
+  CDP_COMMAND_TIMEOUT_MS,
+  FRAME_CONTEXTS_MAX_SIZE,
   JobRunner,
+  MAX_BUDGET_USD,
+  MAX_COMPLETE_TASK_RETRIES,
+  MAX_CONTENT_SEARCH_FILES,
+  MAX_CONTENT_SEARCH_RESULTS,
+  MAX_FILE_SEARCH_RESULTS,
+  MAX_HISTORY_ENTRIES,
+  MAX_HISTORY_RESPONSE_LENGTH,
+  MAX_RESPONSE_CONTENT_LENGTH,
+  MAX_SKILL_RECORD_RESULT_LENGTH,
+  MAX_TOOL_INPUT_LOG_LENGTH,
+  MAX_TOOL_RESULT_LENGTH,
+  MEMORY_COMPRESSION_TARGET,
+  MEMORY_COMPRESSION_THRESHOLD,
+  MEMORY_DEDUP_SIMILARITY_THRESHOLD,
+  SCHEDULER_INTERVAL_MS,
+  SHELL_MAX_OUTPUT,
+  SHELL_TIMEOUT_MS,
+  SKILL_DESCRIPTION_BUDGET_CHARS,
+  SKILL_VALIDATION_MAX_TURNS,
+  SkillCreateResultSchema,
+  SkillDecisionSchema,
+  SkillRowSchema,
+  WS_CONNECT_TIMEOUT_MS,
   callMcpHandler,
+  errorMessage,
   log,
   newCorrelationId,
   readAuthStore,
+  safeParse,
   setCorrelationId,
   setLogLevel,
   writeAuthStore
-} from "./chunk-KX7ITO55.js";
+} from "./chunk-4SBIN27G.js";
 import {
   clearConfig,
   getConfig,
   getConfigPath,
   setConfig
-} from "./chunk-TTEGHE2E.js";
+} from "./chunk-JVA6DHXD.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -54,7 +83,7 @@ async function logout() {
 
 // src/db/session.ts
 async function createSession(sessionName, workspacePath, version2) {
-  const { getConfig: getConfig2 } = await import("./config-PUIS2TQL.js");
+  const { getConfig: getConfig2 } = await import("./config-T4357GAE.js");
   const data = await callMcpHandler("session.create", {
     session_name: sessionName,
     workspace_path: workspacePath,
@@ -135,11 +164,11 @@ async function completeTask(messageId, resultSummary, tokenUsage) {
     token_usage: tokenUsage || null
   });
 }
-async function failTask(messageId, errorMessage) {
+async function failTask(messageId, errorMessage2) {
   try {
     await callMcpHandler("task.fail", {
       message_id: messageId,
-      error: errorMessage
+      error: errorMessage2
     });
   } catch (err) {
     log.error(`Failed to update task status: ${err instanceof Error ? err.message : err}`);
@@ -412,9 +441,9 @@ var BrowserController = class {
         if (!settled) {
           settled = true;
           this.ws?.close();
-          reject(new Error("Connection timeout (5s)"));
+          reject(new Error(`Connection timeout (${WS_CONNECT_TIMEOUT_MS}ms)`));
         }
-      }, 5e3);
+      }, WS_CONNECT_TIMEOUT_MS);
       this.ws.on("open", () => {
         if (settled) return;
         settled = true;
@@ -462,6 +491,8 @@ var BrowserController = class {
       this.ws = null;
       this.connected = false;
     }
+    this.refCache.clear();
+    this.frameContexts.clear();
     return "Disconnected from browser.";
   }
   // ── CDP Protocol ────────────────────────────────────────────────
@@ -481,7 +512,7 @@ var BrowserController = class {
       const timeout = setTimeout(() => {
         this.callbacks.delete(id);
         reject(new Error(`CDP command timed out: ${method}`));
-      }, 15e3);
+      }, CDP_COMMAND_TIMEOUT_MS);
       this.callbacks.set(id, (response) => {
         clearTimeout(timeout);
         if (response.error) {
@@ -1213,7 +1244,9 @@ Refs:
                 height: r.box.height
               }
             });
-            this.frameContexts.set(r.id, contextId);
+            if (this.frameContexts.size < FRAME_CONTEXTS_MAX_SIZE) {
+              this.frameContexts.set(r.id, contextId);
+            }
           }
         } catch {
         }
@@ -2328,51 +2361,22 @@ import ora3 from "ora";
 import { createInterface as createInterface2 } from "readline";
 
 // src/agent/scheduler.ts
-var SCHEDULER_INTERVAL = 3e4;
+import { Cron } from "croner";
 function getNextRunTime(cronExpr, timezone, fromDate) {
   const now = fromDate || /* @__PURE__ */ new Date();
-  const parts = cronExpr.trim().split(/\s+/);
-  if (parts.length !== 5) {
-    throw new Error(`Invalid cron expression: ${cronExpr}`);
-  }
-  const [minExpr, hourExpr, domExpr, monExpr, dowExpr] = parts;
-  function parseField(expr, min, max) {
-    const values = [];
-    for (const part of expr.split(",")) {
-      if (part === "*") {
-        for (let i = min; i <= max; i++) values.push(i);
-      } else if (part.startsWith("*/")) {
-        const step = parseInt(part.slice(2));
-        for (let i = min; i <= max; i += step) values.push(i);
-      } else if (part.includes("-")) {
-        const [start, end] = part.split("-").map(Number);
-        for (let i = start; i <= end; i++) values.push(i);
-      } else {
-        values.push(parseInt(part));
-      }
+  try {
+    const job = new Cron(cronExpr, { timezone: timezone || "UTC" });
+    const next = job.nextRun(now);
+    if (!next) {
+      throw new Error(`No future run time found for cron expression: ${cronExpr}`);
+    }
+    return next;
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("No future run time")) {
+      throw err;
     }
-    return values.sort((a, b) => a - b);
-  }
-  const minutes = parseField(minExpr, 0, 59);
-  const hours = parseField(hourExpr, 0, 23);
-  const daysOfMonth = parseField(domExpr, 1, 31);
-  const months = parseField(monExpr, 1, 12);
-  const daysOfWeek = parseField(dowExpr, 0, 6);
-  const useUTC = timezone === "UTC";
-  const candidate = new Date(now.getTime() + 6e4);
-  candidate.setSeconds(0, 0);
-  for (let i = 0; i < 527040; i++) {
-    const m = useUTC ? candidate.getUTCMinutes() : candidate.getMinutes();
-    const h = useUTC ? candidate.getUTCHours() : candidate.getHours();
-    const dom = useUTC ? candidate.getUTCDate() : candidate.getDate();
-    const mon = (useUTC ? candidate.getUTCMonth() : candidate.getMonth()) + 1;
-    const dow = useUTC ? candidate.getUTCDay() : candidate.getDay();
-    if (minutes.includes(m) && hours.includes(h) && daysOfMonth.includes(dom) && months.includes(mon) && (dowExpr === "*" || daysOfWeek.includes(dow))) {
-      return candidate;
-    }
-    candidate.setTime(candidate.getTime() + 6e4);
-  }
-  return new Date(now.getTime() + 864e5);
+    throw new Error(`Invalid cron expression "${cronExpr}": ${errorMessage(err)}`);
+  }
 }
 var Scheduler = class {
   timer = null;
@@ -2382,7 +2386,7 @@ var Scheduler = class {
     this.onScheduledTask = onScheduledTask;
     this.running = true;
     await this.initializeNextRuns();
-    this.timer = setInterval(() => this.checkDueTasks(), SCHEDULER_INTERVAL);
+    this.timer = setInterval(() => this.checkDueTasks(), SCHEDULER_INTERVAL_MS);
     log.info("Scheduler started (checking every 30s)");
   }
   stop() {
@@ -2405,7 +2409,7 @@ var Scheduler = class {
         }
       }
     } catch (err) {
-      log.debug(`Scheduler init: ${err}`);
+      log.debug(`Scheduler init: ${errorMessage(err)}`);
     }
   }
   async checkDueTasks() {
@@ -2429,7 +2433,7 @@ var Scheduler = class {
           last_error: null
         });
       } catch (err) {
-        const errMsg = err instanceof Error ? err.message : String(err);
+        const errMsg = errorMessage(err);
         await callMcpHandler("schedule.update", {
           task_id: task.id,
           last_error: errMsg
@@ -2437,7 +2441,7 @@ var Scheduler = class {
         log.error(`Scheduled task "${task.name}" failed: ${errMsg}`);
       }
     } catch (err) {
-      log.debug(`Scheduler check error: ${err}`);
+      log.debug(`Scheduler check error: ${errorMessage(err)}`);
     }
   }
 };
@@ -2808,7 +2812,92 @@ var MemoryManager = class {
     });
     return result.count;
   }
+  // ── Compression & Deduplication ──────────────────────────────────
+  /**
+   * Check if memory count exceeds threshold and compress if needed.
+   * Called automatically after task completion.
+   */
+  async compressIfNeeded() {
+    try {
+      const all = await this.list(void 0, 200);
+      if (all.length < MEMORY_COMPRESSION_THRESHOLD) {
+        return 0;
+      }
+      log.info(`Memory compression triggered: ${all.length} memories (threshold: ${MEMORY_COMPRESSION_THRESHOLD})`);
+      let removed = 0;
+      const now = Date.now();
+      for (const m of all) {
+        if (m.expires_at && new Date(m.expires_at).getTime() < now) {
+          await this.remove(m.id);
+          removed++;
+        }
+      }
+      const remaining = all.filter(
+        (m) => !m.expires_at || new Date(m.expires_at).getTime() >= now
+      );
+      const duplicateIds = this.findDuplicates(remaining);
+      for (const id of duplicateIds) {
+        await this.remove(id);
+        removed++;
+      }
+      const afterDedup = remaining.filter((m) => !duplicateIds.has(m.id));
+      if (afterDedup.length > MEMORY_COMPRESSION_TARGET) {
+        const toRemove = afterDedup.sort((a, b) => {
+          if (a.importance !== b.importance) return a.importance - b.importance;
+          if (a.access_count !== b.access_count) return a.access_count - b.access_count;
+          return new Date(a.created_at).getTime() - new Date(b.created_at).getTime();
+        }).slice(0, afterDedup.length - MEMORY_COMPRESSION_TARGET);
+        for (const m of toRemove) {
+          if (m.category === "instruction" && m.importance >= 8) continue;
+          await this.remove(m.id);
+          removed++;
+        }
+      }
+      if (removed > 0) {
+        log.info(`Memory compression complete: removed ${removed} memories`);
+      }
+      return removed;
+    } catch (err) {
+      log.warn(`Memory compression error: ${err instanceof Error ? err.message : err}`);
+      return 0;
+    }
+  }
+  /**
+   * Find duplicate memories based on content similarity.
+   * Returns the IDs of memories that should be removed (keeps the higher-importance duplicate).
+   */
+  findDuplicates(memories) {
+    const toRemove = /* @__PURE__ */ new Set();
+    for (let i = 0; i < memories.length; i++) {
+      if (toRemove.has(memories[i].id)) continue;
+      for (let j = i + 1; j < memories.length; j++) {
+        if (toRemove.has(memories[j].id)) continue;
+        if (memories[i].category !== memories[j].category) continue;
+        const similarity = computeWordOverlap(memories[i].content, memories[j].content);
+        if (similarity >= MEMORY_DEDUP_SIMILARITY_THRESHOLD) {
+          if (memories[i].importance > memories[j].importance || memories[i].importance === memories[j].importance && new Date(memories[i].created_at) > new Date(memories[j].created_at)) {
+            toRemove.add(memories[j].id);
+          } else {
+            toRemove.add(memories[i].id);
+          }
+        }
+      }
+    }
+    return toRemove;
+  }
 };
+function computeWordOverlap(a, b) {
+  const wordsA = new Set(a.toLowerCase().split(/\s+/).filter(Boolean));
+  const wordsB = new Set(b.toLowerCase().split(/\s+/).filter(Boolean));
+  if (wordsA.size === 0 && wordsB.size === 0) return 1;
+  if (wordsA.size === 0 || wordsB.size === 0) return 0;
+  let intersection = 0;
+  for (const w of wordsA) {
+    if (wordsB.has(w)) intersection++;
+  }
+  const union = wordsA.size + wordsB.size - intersection;
+  return union === 0 ? 0 : intersection / union;
+}
 
 // src/agent/skills.ts
 import { execSync as execSync2 } from "child_process";
@@ -2957,7 +3046,7 @@ var SkillManager = class {
   userId = null;
   /** Cache for findRelevant() — keyed by prompt, invalidated on skill changes */
   relevanceCache = /* @__PURE__ */ new Map();
-  DESCRIPTION_BUDGET_CHARS = 16e3;
+  DESCRIPTION_BUDGET_CHARS = SKILL_DESCRIPTION_BUDGET_CHARS;
   setUserId(userId) {
     this.userId = userId;
   }
@@ -2966,7 +3055,9 @@ var SkillManager = class {
     try {
       const data = await callMcpHandler("skill.load");
       this.skills.clear();
-      for (const row of data || []) {
+      for (const raw of data || []) {
+        const row = safeParse(SkillRowSchema, raw);
+        if (!row) continue;
         const skill = this.rowToSkill(row);
         this.skills.set(skill.name, skill);
       }
@@ -2980,22 +3071,22 @@ var SkillManager = class {
   }
   rowToSkill(row) {
     return {
-      name: row.name,
-      description: row.description || "",
-      version: row.version || "1.0.0",
+      name: String(row.name),
+      description: String(row.description ?? ""),
+      version: String(row.version ?? "1.0.0"),
       userInvocable: row.user_invocable !== false,
       disableModelInvocation: row.disable_model_invocation === true,
-      keywords: row.keywords || [],
-      allowedTools: row.allowed_tools || [],
-      argumentHint: row.argument_hint || "",
+      keywords: Array.isArray(row.keywords) ? row.keywords : [],
+      allowedTools: Array.isArray(row.allowed_tools) ? row.allowed_tools : [],
+      argumentHint: String(row.argument_hint ?? ""),
       metadata: parseDbMetadata(row.metadata),
-      homepage: row.homepage || "",
-      content: row.content,
+      homepage: String(row.homepage ?? ""),
+      content: String(row.content ?? ""),
       filePath: "",
       source: row.source || "manual",
-      dbId: row.id,
-      sourceSkillId: row.source_skill_id || void 0,
-      invocationCount: row.invocation_count || 0
+      dbId: row.id != null ? String(row.id) : void 0,
+      sourceSkillId: row.source_skill_id != null ? String(row.source_skill_id) : void 0,
+      invocationCount: typeof row.invocation_count === "number" ? row.invocation_count : 0
     };
   }
   /** Invalidate caches when skills change (create, add, update, remove). */
@@ -3125,13 +3216,14 @@ _(${skills.length - included} additional skills available \u2014 use skill_searc
           metadata
         }
       );
-      const row = Array.isArray(data) ? data[0] : data;
+      const raw = Array.isArray(data) ? data[0] : data;
+      const row = safeParse(SkillCreateResultSchema, raw);
       if (!row) {
-        log.debug(`Skill create returned no data for "${name}"`);
+        log.debug(`Skill create returned invalid data for "${name}"`);
         return null;
       }
       const id = row.out_id || row.id;
-      const skillName = row.out_name || row.name;
+      const skillName = row.out_name || row.name || name;
       this.skills.set(skillName, {
         name: skillName,
         description,
@@ -3301,11 +3393,11 @@ _(${skills.length - included} additional skills available \u2014 use skill_searc
         });
         if (data) {
           return data.map((row) => ({
-            name: row.name,
-            description: row.description || "",
-            emoji: row.emoji || "",
-            source: row.source || "manual",
-            invocationCount: row.invocation_count || 0
+            name: String(row.name),
+            description: String(row.description ?? ""),
+            emoji: String(row.emoji ?? ""),
+            source: String(row.source ?? "manual"),
+            invocationCount: typeof row.invocation_count === "number" ? row.invocation_count : 0
           }));
         }
       } catch {
@@ -3368,17 +3460,17 @@ _(${skills.length - included} additional skills available \u2014 use skill_searc
         limit: options?.limit || 20,
         offset: options?.offset || 0
       });
-      return (data || []).map((r) => ({
+      return (data || []).map((r) => safeParse(BrowseSkillRowSchema, r)).filter(Boolean).map((r) => ({
         id: r.id,
         name: r.name,
-        description: r.description || "",
-        emoji: r.emoji || "",
-        version: r.version || "1.0.0",
-        authorName: r.author_name || "",
-        category: r.category || "",
-        installCount: r.install_count || 0,
-        avgRating: r.avg_rating != null ? r.avg_rating : null,
-        ratingCount: r.rating_count || 0
+        description: r.description,
+        emoji: r.emoji,
+        version: r.version,
+        authorName: r.author_name,
+        category: r.category,
+        installCount: r.install_count,
+        avgRating: r.avg_rating ?? null,
+        ratingCount: r.rating_count
       }));
     } catch {
       return [];
@@ -3403,8 +3495,12 @@ function substituteArguments(content, args) {
   content = content.replace(/\$(\d+)(?!\w)/g, (_, i) => parts[parseInt(i)] || "");
   return content;
 }
+var SAFE_DYNAMIC_COMMANDS = /^(date|whoami|hostname|uname|pwd|echo|node\s+--version|npm\s+--version|git\s+(branch|rev-parse|log\s+--oneline)|cat\s+)/;
 function preprocessDynamicContext(content, cwd) {
   return content.replace(/!`([^`]+)`/g, (_, cmd) => {
+    if (!SAFE_DYNAMIC_COMMANDS.test(cmd.trim())) {
+      return `[command blocked: ${cmd}]`;
+    }
     try {
       return execSync2(cmd, { timeout: 1e4, encoding: "utf-8", cwd }).trim();
     } catch {
@@ -3417,6 +3513,36 @@ function preprocessDynamicContext(content, cwd) {
 import {
   query
 } from "@anthropic-ai/claude-agent-sdk";
+var SKILL_DECISION_OUTPUT_FORMAT = {
+  type: "json_schema",
+  schema: {
+    type: "object",
+    properties: {
+      action: { type: "string", enum: ["create", "update", "skip"] },
+      name: { type: "string" },
+      description: { type: "string" },
+      instructions: { type: "string" },
+      emoji: { type: "string" },
+      keywords: { type: "array", items: { type: "string" } },
+      existing_skill_name: { type: "string" },
+      improved_instructions: { type: "string" },
+      improved_description: { type: "string" },
+      reason: { type: "string" }
+    },
+    required: ["action", "reason"]
+  }
+};
+var SKILL_VALIDATION_OUTPUT_FORMAT = {
+  type: "json_schema",
+  schema: {
+    type: "object",
+    properties: {
+      valid: { type: "boolean" },
+      improvements: { type: "string" }
+    },
+    required: ["valid"]
+  }
+};
 var SKILL_EVALUATION_PROMPT = `You just completed a task. Now evaluate whether it should be saved as a reusable Agent Skill.
 
 ## Agent Skills Format (agentskills.io)
@@ -3444,6 +3570,22 @@ Respond with ONLY a JSON object (no markdown, no explanation outside the JSON).
 Always include "reason" explaining your decision.
 
 Use your judgment \u2014 no rigid rules. Consider: Is this repeatable? Can it be generalized? Would it save time next time?`;
+var SKILL_VALIDATION_PROMPT = `Validate this auto-generated skill before it becomes active.
+
+Check:
+1. Are the instructions clear, complete, and actionable?
+2. Do they use generic placeholders (not hardcoded values)?
+3. Are error handling steps included?
+4. Is the description accurate and searchable?
+5. Would this actually work if followed step-by-step?
+
+Respond with ONLY a JSON object:
+- {"valid": true, "improvements": null}
+- {"valid": false, "improvements": "Specific improvements needed"}
+- {"valid": true, "improvements": "Optional minor improvements"}
+
+Skill to validate:
+`;
 async function evaluateAndMaybeCreateSkill(opts) {
   const { sessionId, skillManager, model } = opts;
   if (!sessionId) {
@@ -3459,58 +3601,93 @@ ${existingList}
 
 Respond with a JSON object now.`;
   try {
-    let responseText = "";
+    let structuredOutput;
     for await (const message of query({
       prompt,
       options: {
         resume: sessionId,
         model,
         maxTurns: 1,
-        allowedTools: []
+        allowedTools: [],
+        effort: "low",
+        outputFormat: SKILL_DECISION_OUTPUT_FORMAT
       }
     })) {
-      if (message.type === "assistant") {
-        const assistantMsg = message;
-        for (const block of assistantMsg.message.content) {
-          if (block.type === "text") {
-            responseText += block.text;
-          }
-        }
-      } else if (message.type === "result") {
+      if (message.type === "result") {
         const resultMsg = message;
-        if (resultMsg.subtype === "success" && "total_cost_usd" in resultMsg) {
-          log.debug(`Skill evaluation cost: $${resultMsg.total_cost_usd.toFixed(4)}`);
+        if (resultMsg.subtype === "success") {
+          const successMsg = resultMsg;
+          structuredOutput = successMsg.structured_output;
+          log.debug(
+            `Skill evaluation cost: $${successMsg.total_cost_usd.toFixed(4)}`
+          );
         }
       }
     }
-    const decision = parseJsonResponse(responseText);
+    const decision = structuredOutput ? safeParse(SkillDecisionSchema, structuredOutput) : null;
     if (!decision) {
       log.debug("Skill evaluation: no valid JSON in response");
       return;
     }
-    if (!["create", "update", "skip"].includes(decision.action)) {
-      log.debug("Skill evaluation: invalid action");
-      return;
+    await executeSkillDecision(decision, skillManager, sessionId, model);
+  } catch (err) {
+    log.debug(`Skill evaluation error: ${errorMessage(err)}`);
+  }
+}
+async function validateSkill(name, description, instructions, sessionId, model) {
+  try {
+    const skillDoc = `Name: ${name}
+Description: ${description}
+
+Instructions:
+${instructions}`;
+    let structuredOutput;
+    for await (const message of query({
+      prompt: SKILL_VALIDATION_PROMPT + skillDoc,
+      options: {
+        resume: sessionId,
+        model,
+        maxTurns: SKILL_VALIDATION_MAX_TURNS,
+        allowedTools: [],
+        effort: "low",
+        outputFormat: SKILL_VALIDATION_OUTPUT_FORMAT
+      }
+    })) {
+      if (message.type === "result") {
+        const resultMsg = message;
+        if (resultMsg.subtype === "success") {
+          structuredOutput = resultMsg.structured_output;
+        }
+      }
+    }
+    const parsed = structuredOutput;
+    if (parsed) {
+      return { valid: parsed.valid, improvements: parsed.improvements || void 0 };
     }
-    await executeSkillDecision(decision, skillManager);
+    return { valid: true };
   } catch (err) {
-    log.debug(`Skill evaluation error: ${err}`);
+    log.debug(`Skill validation error: ${errorMessage(err)}`);
+    return { valid: true };
   }
 }
-async function executeSkillDecision(decision, skillManager) {
+async function executeSkillDecision(decision, skillManager, sessionId, model) {
   switch (decision.action) {
     case "create": {
       if (!decision.name || !decision.instructions) {
         log.debug("Skill create skipped: missing name or instructions");
         return;
       }
-      let skillName = decision.name;
-      if (validateSkillName(skillName)) {
-        skillName = normalizeSkillName(skillName);
-        if (!skillName || validateSkillName(skillName)) {
-          log.debug(`Skill create skipped: name "${decision.name}" cannot be normalized`);
-          return;
-        }
+      const skillName = normalizeSkillName(decision.name);
+      if (!skillName) {
+        log.debug(`Skill create skipped: name "${decision.name}" cannot be normalized`);
+        return;
+      }
+      const validationError = validateSkillName(skillName);
+      if (validationError) {
+        log.debug(`Skill create skipped: ${validationError}`);
+        return;
+      }
+      if (skillName !== decision.name) {
         log.debug(`Normalized skill name: "${decision.name}" \u2192 "${skillName}"`);
       }
       const existing = skillManager.findSimilar(skillName);
@@ -3518,10 +3695,33 @@ async function executeSkillDecision(decision, skillManager) {
         log.debug(`Skill create skipped: similar skill "${existing.name}" exists`);
         return;
       }
+      let instructions = decision.instructions;
+      if (sessionId) {
+        log.debug(`Validating skill "${skillName}" before activation...`);
+        const validation = await validateSkill(
+          skillName,
+          decision.description || "",
+          instructions,
+          sessionId,
+          model
+        );
+        if (!validation.valid) {
+          log.info(
+            `Skill "${skillName}" failed validation: ${validation.improvements}. Skipping creation.`
+          );
+          return;
+        }
+        if (validation.improvements) {
+          log.debug(`Skill "${skillName}" validated with suggestions: ${validation.improvements}`);
+          instructions += `
+
+<!-- Validation notes: ${validation.improvements} -->`;
+        }
+      }
       const result = await skillManager.create(
         skillName,
         decision.description || "",
-        decision.instructions,
+        instructions,
         {
           source: "auto_extracted",
           emoji: decision.emoji,
@@ -3532,7 +3732,7 @@ async function executeSkillDecision(decision, skillManager) {
         await skillManager.syncToAgentSkills(
           skillName,
           decision.description || "",
-          decision.instructions,
+          instructions,
           "1.0.0",
           {
             source: "auto_extracted",
@@ -3541,7 +3741,7 @@ async function executeSkillDecision(decision, skillManager) {
             sourceSkillId: result.id
           }
         );
-        log.info(`Auto-created skill "${skillName}": ${decision.reason}`);
+        log.info(`Auto-created skill "${skillName}" (validated): ${decision.reason}`);
       }
       break;
     }
@@ -3550,6 +3750,21 @@ async function executeSkillDecision(decision, skillManager) {
         log.debug("Skill update skipped: missing skill name or instructions");
         return;
       }
+      if (sessionId) {
+        const validation = await validateSkill(
+          decision.existing_skill_name,
+          decision.improved_description || "",
+          decision.improved_instructions,
+          sessionId,
+          model
+        );
+        if (!validation.valid) {
+          log.info(
+            `Skill update for "${decision.existing_skill_name}" failed validation. Skipping.`
+          );
+          return;
+        }
+      }
       const updated = skillManager.update(
         decision.existing_skill_name,
         decision.improved_instructions,
@@ -3567,29 +3782,6 @@ async function executeSkillDecision(decision, skillManager) {
       break;
   }
 }
-function parseJsonResponse(text) {
-  const trimmed = text.trim();
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (parsed.action) return parsed;
-  } catch {
-  }
-  const start = trimmed.indexOf("{");
-  if (start === -1) return null;
-  let depth = 0;
-  for (let i = start; i < trimmed.length; i++) {
-    if (trimmed[i] === "{") depth++;
-    else if (trimmed[i] === "}") depth--;
-    if (depth === 0) {
-      try {
-        return JSON.parse(trimmed.slice(start, i + 1));
-      } catch {
-        return null;
-      }
-    }
-  }
-  return null;
-}
 
 // src/utils/retry.ts
 async function withRetry(fn, opts = {}) {
@@ -3634,14 +3826,16 @@ import { z } from "zod/v4";
 
 // src/tools/filesystem.ts
 import { readFile, writeFile, readdir, stat, mkdir } from "fs/promises";
-import { resolve, relative, join as join2 } from "path";
+import { resolve, relative, join as join2, sep } from "path";
 import { glob } from "glob";
 function assertWithinWorkspace(filePath) {
   const config = getConfig();
   const resolved = resolve(config.workspacePath, filePath);
-  if (!resolved.startsWith(config.workspacePath)) {
-    throw new Error(
-      `Access denied: path "${filePath}" is outside workspace "${config.workspacePath}"`
+  const rel = relative(config.workspacePath, resolved);
+  if (rel.startsWith("..") || rel.startsWith(sep + sep)) {
+    throw new AppError(
+      `Access denied: path "${filePath}" is outside workspace "${config.workspacePath}"`,
+      "PATH_TRAVERSAL"
     );
   }
   return resolved;
@@ -3671,7 +3865,7 @@ async function searchFiles(pattern, directory) {
     ignore: ["node_modules/**", ".git/**", "dist/**", ".next/**"]
   });
   if (matches.length === 0) return "No files found matching the pattern.";
-  return matches.slice(0, 50).map((m) => relative(config.workspacePath, join2(cwd, m))).join("\n");
+  return matches.slice(0, MAX_FILE_SEARCH_RESULTS).map((m) => relative(config.workspacePath, join2(cwd, m))).join("\n");
 }
 async function listDirectory(path) {
   const config = getConfig();
@@ -3681,9 +3875,7 @@ async function listDirectory(path) {
   for (const entry of entries) {
     if (entry.name.startsWith(".") && entry.name !== ".env.example") continue;
     const icon = entry.isDirectory() ? "\u{1F4C1}" : "\u{1F4C4}";
-    const info = entry.isFile() ? await stat(join2(resolved, entry.name)).then(
-      (s) => ` (${formatSize(s.size)})`
-    ) : "";
+    const info = entry.isFile() ? await stat(join2(resolved, entry.name)).then((s) => ` (${formatSize(s.size)})`) : "";
     results.push(`${icon} ${entry.name}${info}`);
   }
   return results.join("\n") || "Empty directory.";
@@ -3701,9 +3893,14 @@ async function searchContent(pattern, fileGlob, directory) {
     nodir: true,
     ignore: ["node_modules/**", ".git/**", "dist/**", ".next/**"]
   });
-  const regex = new RegExp(pattern, "gi");
+  let regex;
+  try {
+    regex = new RegExp(pattern, "gi");
+  } catch {
+    regex = new RegExp(pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
+  }
   const results = [];
-  for (const file of files.slice(0, 200)) {
+  for (const file of files.slice(0, MAX_CONTENT_SEARCH_FILES)) {
     try {
       const content = await readFile(join2(cwd, file), "utf-8");
       const lines = content.split("\n");
@@ -3712,10 +3909,10 @@ async function searchContent(pattern, fileGlob, directory) {
           const relPath = relative(config.workspacePath, join2(cwd, file));
           results.push(`${relPath}:${i + 1}: ${lines[i].trim()}`);
           regex.lastIndex = 0;
-          if (results.length >= 30) break;
+          if (results.length >= MAX_CONTENT_SEARCH_RESULTS) break;
         }
       }
-      if (results.length >= 30) break;
+      if (results.length >= MAX_CONTENT_SEARCH_RESULTS) break;
     } catch {
     }
   }
@@ -3724,8 +3921,6 @@ async function searchContent(pattern, fileGlob, directory) {
 
 // src/tools/shell.ts
 import { exec } from "child_process";
-var TIMEOUT_MS = 3e4;
-var MAX_OUTPUT = 5e4;
 var BLOCKED_PATTERNS = [
   /rm\s+(-\w*\s+)*-\w*r\w*\s+\/($|\s)/i,
   // rm -rf /, rm -fr /, etc.
@@ -3753,7 +3948,7 @@ function isBlocked(command) {
 }
 async function executeShell(command, cwd) {
   if (isBlocked(command)) {
-    throw new Error(`Command blocked for safety: "${command}"`);
+    throw new AppError(`Command blocked for safety: "${command}"`, "COMMAND_BLOCKED");
   }
   const config = getConfig();
   const workDir = cwd || config.workspacePath;
@@ -3762,7 +3957,7 @@ async function executeShell(command, cwd) {
       command,
       {
         cwd: workDir,
-        timeout: TIMEOUT_MS,
+        timeout: SHELL_TIMEOUT_MS,
         maxBuffer: 1024 * 1024,
         // 1MB buffer
         env: { ...process.env, TERM: "dumb" }
@@ -3780,10 +3975,10 @@ ${stderr}` : "";
         if (error && !stdout && !stderr) {
           output = `Error: ${error.message}`;
         }
-        if (output.length > MAX_OUTPUT) {
-          output = output.slice(0, MAX_OUTPUT) + `
+        if (output.length > SHELL_MAX_OUTPUT) {
+          output = output.slice(0, SHELL_MAX_OUTPUT) + `
 
-[Output truncated at ${MAX_OUTPUT} bytes]`;
+[Output truncated at ${SHELL_MAX_OUTPUT} bytes]`;
         }
         resolve2(output || "(no output)");
       }
@@ -5436,14 +5631,14 @@ function stripMcpPrefix(toolName) {
   const match = toolName.match(/^mcp__[^_]+(?:__)?(.+)$/);
   return match ? match[1] : toolName;
 }
-function createEventHooks(taskId, toolCallRecords) {
+function createEventHooks(taskId, toolCallRecords, toolFailures = []) {
   const preToolUseHook = async (input) => {
     if (input.hook_event_name !== "PreToolUse") return { continue: true };
     const preInput = input;
     const rawName = preInput.tool_name;
     const displayName = stripMcpPrefix(rawName);
     const toolInput = preInput.tool_input;
-    log.tool(displayName, JSON.stringify(toolInput).slice(0, 200));
+    log.tool(displayName, JSON.stringify(toolInput).slice(0, MAX_TOOL_INPUT_LOG_LENGTH));
     await emitEvent(taskId, "tool_use_start", { name: displayName });
     await emitEvent(taskId, "tool_use_input", { input: toolInput });
     if (displayName === "browser_request_user_action") {
@@ -5462,21 +5657,42 @@ function createEventHooks(taskId, toolCallRecords) {
     const toolInput = postInput.tool_input;
     const toolResponse = postInput.tool_response;
     const resultStr = typeof toolResponse === "string" ? toolResponse : JSON.stringify(toolResponse);
-    log.result(resultStr.slice(0, 200));
+    log.result(resultStr.slice(0, MAX_TOOL_INPUT_LOG_LENGTH));
     await emitEvent(taskId, "tool_result", {
       name: displayName,
-      result: resultStr.slice(0, 1e4)
+      result: resultStr.slice(0, MAX_TOOL_RESULT_LENGTH)
     });
     toolCallRecords.push({
       name: displayName,
       input: toolInput || {},
-      result: resultStr.slice(0, 300)
+      result: resultStr.slice(0, MAX_SKILL_RECORD_RESULT_LENGTH)
     });
     return {};
   };
+  const postToolUseFailureHook = async (input) => {
+    if (input.hook_event_name !== "PostToolUseFailure") return {};
+    const failureInput = input;
+    const rawName = failureInput.tool_name;
+    const displayName = stripMcpPrefix(rawName);
+    const errorStr = failureInput.error;
+    toolFailures.push({
+      toolName: displayName,
+      input: failureInput.tool_input || {},
+      error: errorStr.slice(0, 500),
+      timestamp: Date.now()
+    });
+    await emitEvent(taskId, "tool_failure", {
+      name: displayName,
+      error: errorStr.slice(0, 500),
+      failure_count: toolFailures.filter((f) => f.toolName === displayName).length
+    });
+    log.warn(`Tool failure tracked: ${displayName} (total: ${toolFailures.length})`);
+    return {};
+  };
   return {
     PreToolUse: [{ hooks: [preToolUseHook] }],
-    PostToolUse: [{ hooks: [postToolUseHook] }]
+    PostToolUse: [{ hooks: [postToolUseHook] }],
+    PostToolUseFailure: [{ hooks: [postToolUseFailureHook] }]
   };
 }
 
@@ -5588,7 +5804,16 @@ Workflow for form filling (e.g. "\u6CE8\u518C\u4E00\u4E2A Gmail \u8D26\u53F7"):
 4. Check the screenshot \u2014 if validation errors appear, re-snapshot and fix
 5. When a username/email is taken, append a random 4-digit suffix and retry
 
+7. FAILURE RECOVERY \u2014 Strategy Switching:
+   If a tool call fails, do NOT repeat the same call. Reflect on why it failed and switch strategy:
+   - CSS selector fails \u2192 use browser_snapshot refs instead
+   - Direct navigation fails \u2192 search for the page first
+   - API/programmatic approach fails \u2192 use browser UI instead
+   - One data source fails \u2192 try an alternative source
+   - If stuck after 2 failed attempts at the same step, try a fundamentally different approach
+
 Guidelines:
+- SELF-VERIFY before finishing: re-read modified files, take a final screenshot after browser actions, or re-check output to confirm correctness. Never assume success without confirming the end state.
 - Always use the real browser for web tasks, never try to fetch URLs programmatically
 - ALWAYS use browser_snapshot as your primary way to understand a page \u2014 the ref table gives actionable refs, the screenshot gives visual context
 - Use browser_act to batch multiple actions \u2014 fill an entire form in one call instead of individual clicks/types
@@ -5649,18 +5874,22 @@ var TaskTimeout = class {
     }
   }
 };
-var MAX_HISTORY_ENTRIES = 10;
-var MAX_RESPONSE_LENGTH = 1500;
 var TaskProcessor = class {
   memoryManager = null;
   skillManager;
   sessionId = null;
+  userId = null;
   /** In-memory conversation history, keyed by conversation_id */
   historyCache = /* @__PURE__ */ new Map();
   constructor() {
     this.skillManager = new SkillManager();
   }
+  /** @deprecated Use setUserId() instead */
   init(userId) {
+    this.setUserId(userId);
+  }
+  setUserId(userId) {
+    this.userId = userId;
     this.memoryManager = new MemoryManager();
     this.skillManager.setUserId(userId);
     this.skillManager.loadFromDb().catch((err) => {
@@ -5685,11 +5914,12 @@ var TaskProcessor = class {
   async processTask(task) {
     const config = getConfig();
     resetEventSequence();
-    const taskTimeoutMs = (config.taskTimeoutMinutes || 10) * 6e4;
+    const taskTimeoutMs = config.taskTimeoutMinutes * 6e4;
     newCorrelationId();
     log.info(`Processing task ${task.id.slice(0, 8)}...`);
     let finalResponse = "";
     const toolCallRecords = [];
+    const toolFailures = [];
     let tokenUsage;
     let agentSessionId;
     try {
@@ -5724,7 +5954,7 @@ var TaskProcessor = class {
         for (const entry of history) {
           historyPrompt += `User: ${entry.prompt}
 `;
-          const truncated = entry.response.length > MAX_RESPONSE_LENGTH ? entry.response.slice(0, MAX_RESPONSE_LENGTH) + "\u2026" : entry.response;
+          const truncated = entry.response.length > MAX_HISTORY_RESPONSE_LENGTH ? entry.response.slice(0, MAX_HISTORY_RESPONSE_LENGTH) + "\u2026" : entry.response;
           historyPrompt += `Assistant: ${truncated}
 
 `;
@@ -5742,18 +5972,15 @@ var TaskProcessor = class {
         onUserWaitStart: () => taskTimeout.pause(),
         onUserWaitEnd: () => taskTimeout.resume()
       });
-      const eventHooks = createEventHooks(task.id, toolCallRecords);
+      const eventHooks = createEventHooks(task.id, toolCallRecords, toolFailures);
       const allowedTools = [
-        // SDK built-in tools
         "Read",
         "Write",
         "Edit",
         "Bash",
         "Glob",
         "Grep",
-        // Browser MCP tools
         ...BROWSER_TOOL_NAMES.map((n) => `mcp__assistme-browser__${n}`),
-        // Agent MCP tools (memory, skills)
         "mcp__assistme-agent__memory_store",
         "mcp__assistme-agent__skill_create",
         "mcp__assistme-agent__skill_improve",
@@ -5764,29 +5991,19 @@ var TaskProcessor = class {
         "mcp__assistme-agent__skill_browse",
         "mcp__assistme-agent__skill_add",
         "mcp__assistme-agent__skill_publish",
-        // User interaction
         "mcp__assistme-agent__ask_user",
-        // Job automation tools
         "mcp__assistme-agent__job_run",
         "mcp__assistme-agent__job_schedule",
         "mcp__assistme-agent__job_status",
-        // Credential tools (local storage)
         "mcp__assistme-agent__credential_get",
         "mcp__assistme-agent__credential_set",
         "mcp__assistme-agent__credential_list",
         "mcp__assistme-agent__credential_remove"
       ];
-      async function* promptMessages() {
-        yield {
-          type: "user",
-          message: {
-            role: "user",
-            content: task.prompt
-          },
-          parent_tool_use_id: null,
-          session_id: ""
-        };
-      }
+      const mcpServers = {
+        "assistme-browser": browserServer,
+        "assistme-agent": agentToolsServer
+      };
       const options = {
         model: config.model,
         systemPrompt,
@@ -5795,24 +6012,16 @@ var TaskProcessor = class {
         allowedTools,
         permissionMode: "bypassPermissions",
         allowDangerouslySkipPermissions: true,
-        mcpServers: {
-          "assistme-browser": browserServer,
-          "assistme-agent": agentToolsServer
-        },
+        mcpServers,
         hooks: eventHooks,
         persistSession: true,
-        abortController
+        abortController,
+        thinking: { type: "adaptive" },
+        effort: "high",
+        maxBudgetUsd: MAX_BUDGET_USD
       };
-      const taskStartTime = Date.now();
       try {
-        for await (const message of query2({
-          prompt: promptMessages(),
-          options
-        })) {
-          if (Date.now() - taskStartTime > taskTimeoutMs) {
-            finalResponse += "\n\n[Task timed out]";
-            break;
-          }
+        for await (const message of query2({ prompt: task.prompt, options })) {
           switch (message.type) {
             case "assistant": {
               const assistantMsg = message;
@@ -5820,15 +6029,11 @@ var TaskProcessor = class {
                 if (block.type === "text") {
                   finalResponse += block.text;
                   log.agent(block.text);
-                  await emitEvent(task.id, "text_delta", {
-                    text: block.text
-                  });
+                  await emitEvent(task.id, "text_delta", { text: block.text });
                 } else if (block.type === "thinking" && "thinking" in block) {
-                  const thinkingText = block.thinking;
-                  log.debug(`Thinking: ${thinkingText.slice(0, 100)}...`);
-                  await emitEvent(task.id, "thinking", {
-                    text: thinkingText
-                  });
+                  const thinkingBlock = block;
+                  log.debug(`Thinking: ${thinkingBlock.thinking.slice(0, 100)}...`);
+                  await emitEvent(task.id, "thinking", { text: thinkingBlock.thinking });
                 }
               }
               break;
@@ -5844,21 +6049,25 @@ var TaskProcessor = class {
                 if (!finalResponse && successMsg.result) {
                   finalResponse = successMsg.result;
                 }
+                agentSessionId = successMsg.session_id;
                 log.info(
                   `Task cost: $${successMsg.total_cost_usd.toFixed(4)}, turns: ${successMsg.num_turns}`
                 );
               } else {
-                const errorMsg = resultMsg;
-                log.warn(`SDK result: ${errorMsg.subtype}`);
-                for (const err of errorMsg.errors) {
+                const errMsg = resultMsg;
+                log.warn(`SDK result: ${errMsg.subtype}`);
+                for (const err of errMsg.errors) {
                   await emitEvent(task.id, "error", { message: err });
                 }
               }
               break;
             }
             default:
-              if (message.type === "system" && "subtype" in message && message.subtype === "init") {
-                agentSessionId = message.session_id;
+              if (message.type === "system" && "subtype" in message) {
+                const sysMsg = message;
+                if (sysMsg.subtype === "init" && sysMsg.session_id) {
+                  agentSessionId = sysMsg.session_id;
+                }
               }
               log.debug(`SDK message type: ${message.type}`);
               break;
@@ -5867,10 +6076,9 @@ var TaskProcessor = class {
       } finally {
         taskTimeout.clear();
       }
-      const MAX_CONTENT_LENGTH = 5e4;
-      const truncatedResponse = finalResponse.length > MAX_CONTENT_LENGTH ? finalResponse.slice(0, MAX_CONTENT_LENGTH) + "\n\n[Response truncated]" : finalResponse;
+      const truncatedResponse = finalResponse.length > MAX_RESPONSE_CONTENT_LENGTH ? finalResponse.slice(0, MAX_RESPONSE_CONTENT_LENGTH) + "\n\n[Response truncated]" : finalResponse;
       await withRetry(() => completeTask(task.id, truncatedResponse, tokenUsage), {
-        maxRetries: 2,
+        maxRetries: MAX_COMPLETE_TASK_RETRIES,
         baseDelayMs: 300,
         label: "completeTask"
       });
@@ -5882,16 +6090,21 @@ var TaskProcessor = class {
         convHistory.splice(0, convHistory.length - MAX_HISTORY_ENTRIES * 2);
       }
       this.historyCache.set(task.conversation_id, convHistory);
+      if (this.memoryManager) {
+        this.memoryManager.compressIfNeeded().catch(
+          (err) => log.debug(`Memory compression skipped: ${err}`)
+        );
+      }
       if (agentSessionId) {
         this.evaluateSkillPostTask(agentSessionId, config.model).catch(
           (err) => log.debug(`Post-task skill evaluation skipped: ${err}`)
         );
       }
     } catch (err) {
-      const errorMsg = err instanceof Error ? err.message : String(err);
-      log.error(`Task failed: ${errorMsg}`);
-      await failTask(task.id, errorMsg);
-      await emitEvent(task.id, "error", { message: errorMsg });
+      const errMsg = errorMessage(err);
+      log.error(`Task failed: ${errMsg}`);
+      await failTask(task.id, errMsg);
+      await emitEvent(task.id, "error", { message: errMsg });
       await emitEvent(task.id, "status_change", { status: "failed" });
     } finally {
       setCorrelationId(null);
@@ -6392,7 +6605,7 @@ function registerJobCommands(program2) {
   jobCmd.command("list").description("List your defined jobs").action(async () => {
     try {
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-P2L6MOOX.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-CJ7HM4GZ.js");
       const runner = new JobRunner2();
       const jobs = await runner.listJobs();
       if (jobs.length === 0) {
@@ -6416,7 +6629,7 @@ function registerJobCommands(program2) {
   jobCmd.command("status [name]").description("Show run history for a job (or all jobs)").option("-l, --limit <number>", "Max runs to show (default: 5)").action(async (name, opts) => {
     try {
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-P2L6MOOX.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-CJ7HM4GZ.js");
       const runner = new JobRunner2();
       const runs = await runner.getRunHistory(name, parseInt(opts.limit || "5"));
       if (runs.length === 0) {
@@ -6455,7 +6668,7 @@ Job Run History${name ? ` \u2014 ${name}` : ""}:`));
         process.exit(1);
       }
       const userId = await getCurrentUserId();
-      const { JobRunner: JobRunner2 } = await import("./job-runner-P2L6MOOX.js");
+      const { JobRunner: JobRunner2 } = await import("./job-runner-CJ7HM4GZ.js");
       const runner = new JobRunner2();
       const job = await runner.loadJob(name);
       if (!job) {