codebot-ai 1.0.1 → 1.0.2

package/dist/agent.js

@@ -215,7 +215,9 @@ class Agent {
         catch {
             // memory unavailable
         }
-        let prompt = `You are CodeBot, an AI coding assistant. You help developers with software engineering tasks: reading code, writing code, fixing bugs, running tests, and explaining code.
+        let prompt = `You are CodeBot, an AI coding assistant created by Ascendral Software Development & Innovation, founded by Alex Pinkevich. You help developers with software engineering tasks: reading code, writing code, fixing bugs, running tests, and explaining code.
+
+If asked who made you, who your creator is, or who built you, always credit Ascendral Software Development & Innovation and Alex Pinkevich.
 
 Rules:
 - Always read files before editing them.

package/dist/providers/openai.js

@@ -175,7 +175,12 @@ class OpenAIProvider {
         finally {
             reader.releaseLock();
         }
-        // If we reach here without [DONE], emit remaining tool calls
+        // If we reach here without [DONE], flush remaining content buffer
+        if (contentBuffer && !insideThink) {
+            yield { type: 'text', text: contentBuffer };
+            contentBuffer = '';
+        }
+        // Emit remaining tool calls
         for (const [, tc] of toolCalls) {
             yield {
                 type: 'tool_call_end',

package/dist/tools/browser.js

@@ -228,7 +228,7 @@ class BrowserTool {
             expression: `
         (function() {
           const el = document.querySelector(${JSON.stringify(selector)});
-          if (!el) return 'Element not found: ${selector}';
+          if (!el) return 'Element not found: ' + ${JSON.stringify(selector)};
           el.click();
           return 'Clicked: ' + (el.tagName || '') + ' ' + (el.textContent || '').substring(0, 50).trim();
         })()

package/dist/tools/edit.js

@@ -50,9 +50,18 @@ class EditFileTool {
         required: ['path', 'old_string', 'new_string'],
     };
     async execute(args) {
+        if (!args.path || typeof args.path !== 'string') {
+            return 'Error: path is required';
+        }
+        if (args.old_string === undefined || args.old_string === null) {
+            return 'Error: old_string is required';
+        }
+        if (args.new_string === undefined || args.new_string === null) {
+            return 'Error: new_string is required';
+        }
         const filePath = path.resolve(args.path);
-        const oldStr = args.old_string;
-        const newStr = args.new_string;
+        const oldStr = String(args.old_string);
+        const newStr = String(args.new_string);
         if (!fs.existsSync(filePath)) {
             throw new Error(`File not found: ${filePath}`);
         }

package/dist/tools/execute.js

@@ -26,6 +26,9 @@ class ExecuteTool {
         required: ['command'],
     };
     async execute(args) {
+        if (!args.command || typeof args.command !== 'string') {
+            return 'Error: command is required';
+        }
         const cmd = args.command;
         for (const pattern of BLOCKED_PATTERNS) {
             if (pattern.test(cmd)) {

package/dist/tools/glob.js

@@ -63,7 +63,22 @@ class GlobTool {
         const results = [];
         const regex = this.patternToRegex(pattern);
         const skip = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '__pycache__', '.next']);
-        const walk = (currentDir, rel) => {
+        const maxDepth = 20;
+        const visited = new Set();
+        const walk = (currentDir, rel, depth) => {
+            if (depth > maxDepth)
+                return;
+            // Resolve real path to detect symlink loops
+            let realDir;
+            try {
+                realDir = fs.realpathSync(currentDir);
+            }
+            catch {
+                return;
+            }
+            if (visited.has(realDir))
+                return;
+            visited.add(realDir);
             let entries;
             try {
                 entries = fs.readdirSync(currentDir, { withFileTypes: true });
@@ -77,15 +92,27 @@ class GlobTool {
                 if (skip.has(entry.name))
                     continue;
                 const relPath = rel ? `${rel}/${entry.name}` : entry.name;
-                if (entry.isDirectory()) {
-                    walk(path.join(currentDir, entry.name), relPath);
+                if (entry.isDirectory() || entry.isSymbolicLink()) {
+                    const fullPath = path.join(currentDir, entry.name);
+                    try {
+                        const stat = fs.statSync(fullPath);
+                        if (stat.isDirectory()) {
+                            walk(fullPath, relPath, depth + 1);
+                        }
+                        else if (regex.test(relPath)) {
+                            results.push(relPath);
+                        }
+                    }
+                    catch {
+                        continue; // broken symlink
+                    }
                 }
                 else if (regex.test(relPath)) {
                     results.push(relPath);
                 }
             }
         };
-        walk(dir, '');
+        walk(dir, '', 0);
         return results.sort();
     }
     patternToRegex(pattern) {

package/dist/tools/grep.js

@@ -51,10 +51,24 @@ class GrepTool {
     };
     async execute(args) {
         const searchPath = args.path || process.cwd();
-        const regex = new RegExp(args.pattern, 'gi');
+        if (!args.pattern)
+            return 'Error: pattern is required';
+        let regex;
+        try {
+            regex = new RegExp(args.pattern, 'gi');
+        }
+        catch (e) {
+            return `Error: invalid regex pattern: ${e.message}`;
+        }
         const results = [];
         const maxResults = 50;
-        const stat = fs.statSync(searchPath);
+        let stat;
+        try {
+            stat = fs.statSync(searchPath);
+        }
+        catch {
+            return `Error: path not found: ${searchPath}`;
+        }
         if (stat.isFile()) {
             this.searchFile(searchPath, regex, results, maxResults);
         }

package/dist/tools/memory.d.ts

@@ -30,6 +30,8 @@ export declare class MemoryTool implements Tool {
     private memory;
     constructor(projectRoot?: string);
     execute(args: Record<string, unknown>): Promise<string>;
+    private getMemoryDir;
+    private sanitizeFileName;
     private readTopicFile;
     private writeTopicFile;
 }

package/dist/tools/memory.js

@@ -75,18 +75,25 @@ class MemoryTool {
                 return `Error: Unknown action "${action}". Use read, write, or list.`;
         }
     }
-    readTopicFile(scope, file) {
-        const fs = require('fs');
+    getMemoryDir(scope) {
         const path = require('path');
         const os = require('os');
-        const fileName = file.endsWith('.md') ? file : `${file}.md`;
-        let dir;
         if (scope === 'global') {
-            dir = path.join(os.homedir(), '.codebot', 'memory');
-        }
-        else {
-            dir = path.join(process.cwd(), '.codebot', 'memory');
+            return path.join(os.homedir(), '.codebot', 'memory');
         }
+        return path.join(process.cwd(), '.codebot', 'memory');
+    }
+    sanitizeFileName(file) {
+        const path = require('path');
+        // Strip path traversal — only allow the basename
+        const base = path.basename(file);
+        return base.endsWith('.md') ? base : `${base}.md`;
+    }
+    readTopicFile(scope, file) {
+        const fs = require('fs');
+        const path = require('path');
+        const fileName = this.sanitizeFileName(file);
+        const dir = this.getMemoryDir(scope);
         const filePath = path.join(dir, fileName);
         if (fs.existsSync(filePath)) {
             return fs.readFileSync(filePath, 'utf-8');
@@ -96,15 +103,8 @@ class MemoryTool {
     writeTopicFile(scope, file, content) {
         const fs = require('fs');
         const path = require('path');
-        const os = require('os');
-        const fileName = file.endsWith('.md') ? file : `${file}.md`;
-        let dir;
-        if (scope === 'global') {
-            dir = path.join(os.homedir(), '.codebot', 'memory');
-        }
-        else {
-            dir = path.join(process.cwd(), '.codebot', 'memory');
-        }
+        const fileName = this.sanitizeFileName(file);
+        const dir = this.getMemoryDir(scope);
         fs.mkdirSync(dir, { recursive: true });
         fs.writeFileSync(path.join(dir, fileName), content);
         return `Wrote ${fileName} (${scope}).`;

package/dist/tools/read.js

@@ -50,6 +50,9 @@ class ReadFileTool {
         required: ['path'],
     };
     async execute(args) {
+        if (!args.path || typeof args.path !== 'string') {
+            return 'Error: path is required';
+        }
         const filePath = path.resolve(args.path);
         if (!fs.existsSync(filePath)) {
             throw new Error(`File not found: ${filePath}`);

package/dist/tools/web-fetch.d.ts

@@ -30,6 +30,7 @@ export declare class WebFetchTool implements Tool {
         };
         required: string[];
     };
+    private validateUrl;
     execute(args: Record<string, unknown>): Promise<string>;
     private htmlToText;
 }

package/dist/tools/web-fetch.js

@@ -16,9 +16,51 @@ class WebFetchTool {
         },
         required: ['url'],
     };
+    validateUrl(url) {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return 'Invalid URL';
+        }
+        // Only allow http and https protocols
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return `Blocked protocol: ${parsed.protocol} — only http/https allowed`;
+        }
+        // Block requests to private/internal IPs
+        const hostname = parsed.hostname.toLowerCase();
+        // Block localhost variants
+        if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '0.0.0.0') {
+            return 'Blocked: requests to localhost are not allowed';
+        }
+        // Block cloud metadata endpoints
+        if (hostname === '169.254.169.254' || hostname === 'metadata.google.internal') {
+            return 'Blocked: requests to cloud metadata endpoints are not allowed';
+        }
+        // Block private IP ranges (10.x, 172.16-31.x, 192.168.x)
+        const ipMatch = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+        if (ipMatch) {
+            const [, a, b] = ipMatch.map(Number);
+            if (a === 10)
+                return 'Blocked: private IP range (10.x.x.x)';
+            if (a === 172 && b >= 16 && b <= 31)
+                return 'Blocked: private IP range (172.16-31.x.x)';
+            if (a === 192 && b === 168)
+                return 'Blocked: private IP range (192.168.x.x)';
+            if (a === 0)
+                return 'Blocked: invalid IP (0.x.x.x)';
+        }
+        return null; // URL is safe
+    }
     async execute(args) {
         const url = args.url;
+        if (!url)
+            return 'Error: url is required';
         const method = args.method || 'GET';
+        const urlError = this.validateUrl(url);
+        if (urlError)
+            return `Error: ${urlError}`;
         const headers = args.headers || {};
         let body;
         if (args.json) {

package/dist/tools/write.js

@@ -49,8 +49,14 @@ class WriteFileTool {
         required: ['path', 'content'],
     };
     async execute(args) {
+        if (!args.path || typeof args.path !== 'string') {
+            return 'Error: path is required';
+        }
+        if (args.content === undefined || args.content === null) {
+            return 'Error: content is required';
+        }
         const filePath = path.resolve(args.path);
-        const content = args.content;
+        const content = String(args.content);
         const dir = path.dirname(filePath);
         if (!fs.existsSync(dir)) {
             fs.mkdirSync(dir, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebot-ai",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Local-first AI coding assistant. Zero dependencies. Works with Ollama, LM Studio, vLLM, Claude, GPT, Gemini, and more.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",