codingbuddy 1.0.0 → 1.1.0

package/dist/src/rules/rules.service.js

@@ -15,6 +15,8 @@ const common_1 = require("@nestjs/common");
 const fs = require("fs/promises");
 const fs_1 = require("fs");
 const path = require("path");
+const security_utils_1 = require("../shared/security.utils");
+const agent_schema_1 = require("./agent.schema");
 let RulesService = RulesService_1 = class RulesService {
     constructor() {
         this.logger = new common_1.Logger(RulesService_1.name);
@@ -57,6 +59,10 @@ let RulesService = RulesService_1 = class RulesService {
         }
     }
     async getRuleContent(relativePath) {
+        if (!(0, security_utils_1.isPathSafe)(this.rulesDir, relativePath)) {
+            this.logger.warn(`Path traversal attempt blocked: ${relativePath}`);
+            throw new Error(`Access denied: Invalid path`);
+        }
         const fullPath = path.join(this.rulesDir, relativePath);
         try {
             return await fs.readFile(fullPath, 'utf-8');
@@ -81,7 +87,18 @@ let RulesService = RulesService_1 = class RulesService {
     }
     async getAgent(name) {
         const content = await this.getRuleContent(`agents/${name}.json`);
-        return JSON.parse(content);
+        try {
+            const parsed = JSON.parse(content);
+            const validated = (0, agent_schema_1.parseAgentProfile)(parsed);
+            return validated;
+        }
+        catch (error) {
+            if (error instanceof agent_schema_1.AgentSchemaError) {
+                this.logger.warn(`Invalid agent profile: ${name}`, error.message);
+                throw new Error(`Invalid agent profile: ${name}`);
+            }
+            throw error;
+        }
     }
     async searchRules(query) {
         const results = [];

package/dist/src/rules/rules.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.service.js","sourceRoot":"","sources":["../../../src/rules/rules.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,kCAAkC;AAClC,2BAAgC;AAChC,6BAA6B;AAItB,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAIvB;QAHiB,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;QAStD,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YAGH,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YAEP,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,CAClE,CAAC;YACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAEO,eAAe;QAIrB,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,sCAAsC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC;SAC9C,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAGD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,IAAI,CAAC;YACH,OAAO,IAAA,eAAU,EAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,EAAE,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,KAAK;iBACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG;YACpB,eAAe;YACf,kBAAkB;YAClB,2BAA2B;YAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;gBAEd,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBAC5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAClD,KAAK,EAAE,CAAC;oBACV,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AA5HY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;;GACA,YAAY,CA4HxB"}
+{"version":3,"file":"rules.service.js","sourceRoot":"","sources":["../../../src/rules/rules.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,kCAAkC;AAClC,2BAAgC;AAChC,6BAA6B;AAE7B,6DAAsD;AACtD,iDAAqE;AAG9D,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAIvB;QAHiB,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;QAStD,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YAGH,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YAEP,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,CAClE,CAAC;YACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAEO,eAAe;QAIrB,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,sCAAsC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,mCAAmC,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC;SAC9C,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAGD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,IAAI,CAAC;YACH,OAAO,IAAA,eAAU,EAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,YAAoB;QAEvC,IAAI,CAAC,IAAA,2BAAU,EAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,EAAE,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,KAAK;iBACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEnC,MAAM,SAAS,GAAG,IAAA,gCAAiB,EAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,SAAoC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAAgB,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,IAAI,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG;YACpB,eAAe;YACf,kBAAkB;YAClB,2BAA2B;YAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;SACvC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;gBAEd,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBAC5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC5C,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBAClD,KAAK,EAAE,CAAC;oBACV,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AA7IY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;;GACA,YAAY,CA6IxB"}

package/dist/src/rules/rules.types.d.ts

@@ -1,10 +1,13 @@
 export interface AgentProfile {
     name: string;
-    role: string;
-    expertise: string[];
-    goals: string[];
-    workflow: string[];
-    output_format: string;
+    description: string;
+    role: {
+        title: string;
+        expertise: string[];
+        tech_stack_reference?: string;
+        responsibilities?: string[];
+    };
+    [key: string]: unknown;
 }
 export interface SearchResult {
     file: string;

package/dist/src/rules/skill.schema.d.ts

@@ -0,0 +1,17 @@
+import * as z from 'zod';
+export declare class SkillSchemaError extends Error {
+    readonly details?: z.ZodError | undefined;
+    constructor(message: string, details?: z.ZodError | undefined);
+}
+export declare const SkillFrontmatterSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+}, z.z.core.$strip>;
+export interface Skill {
+    name: string;
+    description: string;
+    content: string;
+    path: string;
+}
+export type SkillFrontmatter = z.infer<typeof SkillFrontmatterSchema>;
+export declare function parseSkill(content: string, filePath: string): Skill;

package/dist/src/rules/skill.schema.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkillFrontmatterSchema = exports.SkillSchemaError = void 0;
+exports.parseSkill = parseSkill;
+const z = require("zod");
+const yaml = require("yaml");
+const security_utils_1 = require("../shared/security.utils");
+class SkillSchemaError extends Error {
+    constructor(message, details) {
+        super(message);
+        this.details = details;
+        this.name = 'SkillSchemaError';
+    }
+}
+exports.SkillSchemaError = SkillSchemaError;
+exports.SkillFrontmatterSchema = z.object({
+    name: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9-]+$/, 'Skill name must be lowercase alphanumeric with hyphens only'),
+    description: z.string().min(1).max(500),
+});
+const FRONTMATTER_REGEX = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+function parseFrontmatter(content) {
+    const match = content.match(FRONTMATTER_REGEX);
+    if (!match) {
+        throw new SkillSchemaError('Invalid skill file: Missing or malformed YAML frontmatter');
+    }
+    const [, yamlStr, body] = match;
+    try {
+        const frontmatter = yaml.parse(yamlStr);
+        return { frontmatter, body: body.trim() };
+    }
+    catch (error) {
+        throw new SkillSchemaError(`Invalid skill file: YAML parsing failed - ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+function parseSkill(content, filePath) {
+    const { frontmatter, body } = parseFrontmatter(content);
+    const dangerousKey = (0, security_utils_1.containsDangerousKeys)(frontmatter);
+    if (dangerousKey) {
+        throw new SkillSchemaError(`Invalid skill: Dangerous key "${dangerousKey}" detected`);
+    }
+    const result = exports.SkillFrontmatterSchema.safeParse(frontmatter);
+    if (!result.success) {
+        const errorMessage = result.error.issues
+            .map(issue => {
+            const pathStr = issue.path.length > 0 ? issue.path.join('.') : 'root';
+            return `${pathStr}: ${issue.message}`;
+        })
+            .join(', ');
+        throw new SkillSchemaError(`Invalid skill frontmatter: ${errorMessage}`, result.error);
+    }
+    if (!body || body.trim().length === 0) {
+        throw new SkillSchemaError('Invalid skill: Content after frontmatter is empty');
+    }
+    return {
+        name: result.data.name,
+        description: result.data.description,
+        content: body,
+        path: filePath,
+    };
+}
+//# sourceMappingURL=skill.schema.js.map

package/dist/src/rules/skill.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.schema.js","sourceRoot":"","sources":["../../../src/rules/skill.schema.ts"],"names":[],"mappings":";;;AAuGA,gCAyCC;AAtID,yBAAyB;AACzB,6BAA6B;AAC7B,6DAAiE;AAMjE,MAAa,gBAAiB,SAAQ,KAAK;IACzC,YACE,OAAe,EACC,OAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,YAAO,GAAP,OAAO,CAAa;QAGpC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AARD,4CAQC;AAWY,QAAA,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CACJ,cAAc,EACd,6DAA6D,CAC9D;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAmBH,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAExE,SAAS,gBAAgB,CAAC,OAAe;IAIvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAE/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CACxB,6CAA6C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAcD,SAAgB,UAAU,CAAC,OAAe,EAAE,QAAgB;IAE1D,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAGxD,MAAM,YAAY,GAAG,IAAA,sCAAqB,EAAC,WAAW,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,YAAY,YAAY,CAC1D,CAAC;IACJ,CAAC;IAGD,MAAM,MAAM,GAAG,8BAAsB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAE7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aACrC,GAAG,CAAC,KAAK,CAAC,EAAE;YACX,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACtE,OAAO,GAAG,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACxC,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,YAAY,EAAE,EAC5C,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAGD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,gBAAgB,CACxB,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;QACtB,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;QACpC,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,QAAQ;KACf,CAAC;AACJ,CAAC"}

package/dist/src/shared/error.utils.d.ts

@@ -0,0 +1 @@
+export declare function sanitizeError(error: unknown): string;

package/dist/src/shared/error.utils.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeError = sanitizeError;
+const SENSITIVE_PATTERNS = [
+    /\/[a-zA-Z0-9_-]+\/[a-zA-Z0-9_./\\-]+/,
+    /[A-Z]:\\[a-zA-Z0-9_\\.-]+/,
+    /node_modules/i,
+    /\s+at\s+.+:\d+:\d+/,
+    /\.[jt]sx?:\d+/,
+];
+function isDebugMode() {
+    return process.env.CODINGBUDDY_DEBUG === 'true';
+}
+function containsSensitiveInfo(message) {
+    return SENSITIVE_PATTERNS.some(pattern => pattern.test(message));
+}
+function sanitizeError(error) {
+    const genericMessage = 'An internal error occurred';
+    if (error === null || error === undefined) {
+        return isDebugMode() ? 'Unknown error: null or undefined' : genericMessage;
+    }
+    if (error instanceof Error) {
+        const message = error.message;
+        if (isDebugMode()) {
+            return message;
+        }
+        if (containsSensitiveInfo(message)) {
+            return genericMessage;
+        }
+        return message;
+    }
+    if (typeof error === 'string') {
+        if (isDebugMode()) {
+            return error;
+        }
+        if (containsSensitiveInfo(error)) {
+            return genericMessage;
+        }
+        return error;
+    }
+    if (isDebugMode()) {
+        return `Unknown error: ${JSON.stringify(error)}`;
+    }
+    return genericMessage;
+}
+//# sourceMappingURL=error.utils.js.map

package/dist/src/shared/error.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.utils.js","sourceRoot":"","sources":["../../../src/shared/error.utils.ts"],"names":[],"mappings":";;AA+CA,sCA2CC;AAnFD,MAAM,kBAAkB,GAAG;IAEzB,sCAAsC;IAEtC,2BAA2B;IAE3B,eAAe;IAEf,oBAAoB;IAEpB,eAAe;CAChB,CAAC;AAKF,SAAS,WAAW;IAClB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;AAClD,CAAC;AAKD,SAAS,qBAAqB,CAAC,OAAe;IAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACnE,CAAC;AAeD,SAAgB,aAAa,CAAC,KAAc;IAC1C,MAAM,cAAc,GAAG,4BAA4B,CAAC;IAGpD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,CAAC;IAGD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAE9B,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QAGD,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAGD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,IAAI,WAAW,EAAE,EAAE,CAAC;QAClB,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/src/shared/security.utils.d.ts

@@ -0,0 +1,2 @@
+export declare function containsDangerousKeys(obj: unknown, objPath?: string): string | null;
+export declare function isPathSafe(basePath: string, relativePath: string): boolean;

package/dist/src/shared/security.utils.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.containsDangerousKeys = containsDangerousKeys;
+exports.isPathSafe = isPathSafe;
+const path = require("path");
+const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'];
+function containsDangerousKeys(obj, objPath = '') {
+    if (obj === null || typeof obj !== 'object') {
+        return null;
+    }
+    if (Array.isArray(obj)) {
+        for (let i = 0; i < obj.length; i++) {
+            const result = containsDangerousKeys(obj[i], `${objPath}[${i}]`);
+            if (result)
+                return result;
+        }
+        return null;
+    }
+    const keys = Object.getOwnPropertyNames(obj);
+    for (const key of keys) {
+        if (DANGEROUS_KEYS.includes(key)) {
+            return objPath ? `${objPath}.${key}` : key;
+        }
+    }
+    for (const key of keys) {
+        if (!DANGEROUS_KEYS.includes(key)) {
+            const result = containsDangerousKeys(obj[key], objPath ? `${objPath}.${key}` : key);
+            if (result)
+                return result;
+        }
+    }
+    return null;
+}
+function isPathSafe(basePath, relativePath) {
+    if (relativePath.includes('\x00')) {
+        return false;
+    }
+    const normalizedRelative = relativePath.replace(/\\/g, '/');
+    const resolvedBase = path.resolve(basePath);
+    const resolvedTarget = path.resolve(basePath, normalizedRelative);
+    if (resolvedTarget === resolvedBase) {
+        return true;
+    }
+    return resolvedTarget.startsWith(resolvedBase + path.sep);
+}
+//# sourceMappingURL=security.utils.js.map

package/dist/src/shared/security.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.utils.js","sourceRoot":"","sources":["../../../src/shared/security.utils.ts"],"names":[],"mappings":";;AAoBA,sDAqCC;AAmBD,gCAuBC;AA/FD,6BAA6B;AAM7B,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAU,CAAC;AAU1E,SAAgB,qBAAqB,CACnC,GAAY,EACZ,OAAO,GAAG,EAAE;IAEZ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,IAAI,GAAG,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAE7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAsC,CAAC,EAAE,CAAC;YACpE,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7C,CAAC;IACH,CAAC;IAGD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAsC,CAAC,EAAE,CAAC;YACrE,MAAM,MAAM,GAAG,qBAAqB,CACjC,GAA+B,CAAC,GAAG,CAAC,EACrC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CACpC,CAAC;YACF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAmBD,SAAgB,UAAU,CAAC,QAAgB,EAAE,YAAoB;IAE/D,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAID,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAG5D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAIlE,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAID,OAAO,cAAc,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/src/shared/validation.constants.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_QUERY_LENGTH = 1000;
+export declare const MAX_PROMPT_LENGTH = 10000;
+export declare const MAX_AGENT_NAME_LENGTH = 100;
+export declare const AGENT_NAME_PATTERN: RegExp;
+export interface ValidationResult {
+    valid: boolean;
+    error?: string;
+}
+export declare function validateQuery(query: string): ValidationResult;
+export declare function validatePrompt(prompt: string): ValidationResult;
+export declare function validateAgentName(name: string): ValidationResult;

package/dist/src/shared/validation.constants.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_NAME_PATTERN = exports.MAX_AGENT_NAME_LENGTH = exports.MAX_PROMPT_LENGTH = exports.MAX_QUERY_LENGTH = void 0;
+exports.validateQuery = validateQuery;
+exports.validatePrompt = validatePrompt;
+exports.validateAgentName = validateAgentName;
+exports.MAX_QUERY_LENGTH = 1000;
+exports.MAX_PROMPT_LENGTH = 10000;
+exports.MAX_AGENT_NAME_LENGTH = 100;
+exports.AGENT_NAME_PATTERN = /^[a-z0-9-]+$/;
+function validateQuery(query) {
+    if (!query || query.trim().length === 0) {
+        return { valid: false, error: 'Query cannot be empty' };
+    }
+    if (query.length > exports.MAX_QUERY_LENGTH) {
+        return {
+            valid: false,
+            error: `Query exceeds maximum length of ${exports.MAX_QUERY_LENGTH} characters`,
+        };
+    }
+    return { valid: true };
+}
+function validatePrompt(prompt) {
+    if (!prompt || prompt.trim().length === 0) {
+        return { valid: false, error: 'Prompt cannot be empty' };
+    }
+    if (prompt.length > exports.MAX_PROMPT_LENGTH) {
+        return {
+            valid: false,
+            error: `Prompt exceeds maximum length of ${exports.MAX_PROMPT_LENGTH} characters`,
+        };
+    }
+    return { valid: true };
+}
+function validateAgentName(name) {
+    if (!name || name.trim().length === 0) {
+        return { valid: false, error: 'Agent name cannot be empty' };
+    }
+    if (name.length > exports.MAX_AGENT_NAME_LENGTH) {
+        return {
+            valid: false,
+            error: `Agent name exceeds maximum length of ${exports.MAX_AGENT_NAME_LENGTH} characters`,
+        };
+    }
+    if (!exports.AGENT_NAME_PATTERN.test(name)) {
+        return {
+            valid: false,
+            error: 'Agent name must contain only lowercase letters, numbers, and hyphens',
+        };
+    }
+    return { valid: true };
+}
+//# sourceMappingURL=validation.constants.js.map

package/dist/src/shared/validation.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.constants.js","sourceRoot":"","sources":["../../../src/shared/validation.constants.ts"],"names":[],"mappings":";;;AAoDA,sCAWC;AAKD,wCAWC;AAKD,8CAkBC;AAvFY,QAAA,gBAAgB,GAAG,IAAI,CAAC;AAMxB,QAAA,iBAAiB,GAAG,KAAK,CAAC;AAM1B,QAAA,qBAAqB,GAAG,GAAG,CAAC;AAW5B,QAAA,kBAAkB,GAAG,cAAc,CAAC;AAcjD,SAAgB,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAgB,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mCAAmC,wBAAgB,aAAa;SACxE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAKD,SAAgB,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAiB,EAAE,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,oCAAoC,yBAAiB,aAAa;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAKD,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,6BAAqB,EAAE,CAAC;QACxC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,wCAAwC,6BAAqB,aAAa;SAClF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,0BAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EACH,sEAAsE;SACzE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC"}