dr-claw 1.1.2 → 1.1.4

package/server/cli-chat.js

@@ -14,6 +14,8 @@ import path from 'path';
 import os from 'os';
 import { exec } from 'child_process';
 import { promisify } from 'util';
+import spawnAsync from './utils/spawnAsync.js';
+import { safePath } from './utils/safePath.js';
 
 const execAsync = promisify(exec);
 
@@ -164,10 +166,9 @@ const TOOL_SCHEMAS = [
 // ── Tool execution ────────────────────────────────────────────────────────────
 
 async function executeTool(name, args, workingDir) {
-  const resolve = (p) => {
-    if (!p) return workingDir;
-    return path.isAbsolute(p) ? p : path.resolve(workingDir, p);
-  };
+  // Constrain all paths to the project root to prevent LLM-driven
+  // prompt-injection attacks from reading/writing outside the workspace.
+  const resolve = (p) => safePath(p, workingDir);
   const trunc = (s) =>
     s.length <= MAX_OUTPUT_CHARS ? s : s.slice(0, MAX_OUTPUT_CHARS) + `\n…(truncated)`;
 
@@ -210,23 +211,33 @@ async function executeTool(name, args, workingDir) {
       }
       case 'Glob': {
         const dir = resolve(args.path);
-        const { stdout } = await execAsync(
-          `rg --files --glob '${args.pattern}' 2>/dev/null | head -300`,
-          { cwd: dir, timeout: 30_000, maxBuffer: 1024 * 1024 },
-        ).catch(() =>
-          execAsync(`find . -name '${args.pattern}' -type f 2>/dev/null | head -300`, {
-            cwd: dir, timeout: 30_000, maxBuffer: 1024 * 1024,
-          }),
-        );
-        return trunc(stdout || '(no matches)');
+        try {
+          const { stdout } = await spawnAsync('rg', ['--files', '--glob', args.pattern], {
+            cwd: dir, timeout: 30_000,
+          });
+          const lines = stdout.split('\n').filter(Boolean).slice(0, 300);
+          return trunc(lines.join('\n') || '(no matches)');
+        } catch {
+          try {
+            const { stdout } = await spawnAsync('find', ['.', '-name', args.pattern, '-type', 'f'], {
+              cwd: dir, timeout: 30_000,
+            });
+            const lines = stdout.split('\n').filter(Boolean).slice(0, 300);
+            return trunc(lines.join('\n') || '(no matches)');
+          } catch {
+            return '(no matches)';
+          }
+        }
       }
       case 'Grep': {
         const target = resolve(args.path);
-        let cmd = `rg --line-number --max-count 100 --max-columns 200`;
-        if (args.include) cmd += ` --glob '${args.include}'`;
-        cmd += ` '${args.pattern.replace(/'/g, "'\\''")}' '${target}'`;
+        const rgArgs = ['--line-number', '--max-count', '100', '--max-columns', '200'];
+        if (args.include) rgArgs.push('--glob', args.include);
+        rgArgs.push('-e', args.pattern, '--', target);
         try {
-          const { stdout } = await execAsync(cmd, { cwd: workingDir, timeout: 30_000, maxBuffer: 2 * 1024 * 1024 });
+          const { stdout } = await spawnAsync('rg', rgArgs, {
+            cwd: workingDir, timeout: 30_000,
+          });
           return trunc(stdout || '(no matches)');
         } catch (err) {
           if (err.code === 1) return '(no matches)';

package/server/cli.js

@@ -37,6 +37,7 @@ const colors = {
     yellow: '\x1b[33m',
     blue: '\x1b[34m',
     magenta: '\x1b[35m',
+    red: '\x1b[31m',
     white: '\x1b[37m',
     gray: '\x1b[90m',
 };
@@ -46,7 +47,7 @@ const c = {
     info: (text) => `${colors.cyan}${text}${colors.reset}`,
     ok: (text) => `${colors.green}${text}${colors.reset}`,
     warn: (text) => `${colors.yellow}${text}${colors.reset}`,
-    error: (text) => `${colors.yellow}${text}${colors.reset}`,
+    error: (text) => `${colors.red}${text}${colors.reset}`,
     tip: (text) => `${colors.blue}${text}${colors.reset}`,
     bright: (text) => `${colors.bright}${text}${colors.reset}`,
     dim: (text) => `${colors.dim}${text}${colors.reset}`,
@@ -56,6 +57,18 @@ const c = {
 const packageJsonPath = path.join(__dirname, '../package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
 
+function stripOptionalEnvQuotes(raw) {
+    const v = String(raw).trim();
+    if (v.length >= 2) {
+        const open = v[0];
+        const close = v[v.length - 1];
+        if ((open === '"' && close === '"') || (open === "'" && close === "'")) {
+            return v.slice(1, -1);
+        }
+    }
+    return v;
+}
+
 // Load environment variables from .env file if it exists
 function loadEnvFile() {
     try {
@@ -66,7 +79,7 @@ function loadEnvFile() {
             if (trimmedLine && !trimmedLine.startsWith('#')) {
                 const [key, ...valueParts] = trimmedLine.split('=');
                 if (key && valueParts.length > 0 && !process.env[key]) {
-                    process.env[key] = valueParts.join('=').trim();
+                    process.env[key] = stripOptionalEnvQuotes(valueParts.join('='));
                 }
             }
         });
@@ -202,8 +215,8 @@ function showVersion() {
 
 // Compare semver versions, returns true if v1 > v2
 function isNewerVersion(v1, v2) {
-    const parts1 = v1.split('.').map(Number);
-    const parts2 = v2.split('.').map(Number);
+    const parts1 = v1.split('.').map(p => parseInt(p, 10));
+    const parts2 = v2.split('.').map(p => parseInt(p, 10));
     for (let i = 0; i < 3; i++) {
         if (parts1[i] > parts2[i]) return true;
         if (parts1[i] < parts2[i]) return false;
@@ -211,16 +224,32 @@ function isNewerVersion(v1, v2) {
     return false;
 }
 
+// Detect install mode: 'git' (cloned repo), 'npx', or 'npm' (global install)
+function getInstallMode() {
+    if (fs.existsSync(path.join(__dirname, '..', '.git'))) return 'git';
+    const npmExecpath = process.env.npm_execpath || '';
+    if (npmExecpath.includes('npx') || process.env.npm_command === 'exec') return 'npx';
+    return 'npm';
+}
+
 // Check for updates
 async function checkForUpdates(silent = false) {
     try {
-        const { execSync } = await import('child_process');
-        const latestVersion = execSync('npm show dr-claw version', { encoding: 'utf8' }).trim();
+        const { exec } = await import('child_process');
+        const { promisify } = await import('util');
+        const execAsync = promisify(exec);
+        const { stdout } = await execAsync('npm show dr-claw version', { timeout: 10000 });
+        const latestVersion = stdout.trim();
         const currentVersion = packageJson.version;
+        const mode = getInstallMode();
 
         if (isNewerVersion(latestVersion, currentVersion)) {
             console.log(`\n${c.warn('[UPDATE]')} New version available: ${c.bright(latestVersion)} (current: ${currentVersion})`);
-            console.log(`         Run ${c.bright('dr-claw update')} to update\n`);
+            if (mode === 'npx') {
+                console.log(`         Run ${c.bright('npx dr-claw@latest')} to use the new version\n`);
+            } else {
+                console.log(`         Run ${c.bright('dr-claw update')} to update\n`);
+            }
             return { hasUpdate: true, latestVersion, currentVersion };
         } else if (!silent) {
             console.log(`${c.ok('[OK]')} You are on the latest version (${currentVersion})`);
@@ -237,9 +266,14 @@ async function checkForUpdates(silent = false) {
 // Update the package
 async function updatePackage() {
     try {
-        const { execSync } = await import('child_process');
-        console.log(`${c.info('[INFO]')} Checking for updates...`);
+        const mode = getInstallMode();
+
+        if (mode === 'npx') {
+            console.log(`${c.info('[INFO]')} You're running via npx. Run ${c.bright('npx dr-claw@latest')} to get the latest version.`);
+            return;
+        }
 
+        console.log(`${c.info('[INFO]')} Checking for updates...`);
         const { hasUpdate, latestVersion, currentVersion } = await checkForUpdates(true);
 
         if (!hasUpdate) {
@@ -248,11 +282,14 @@ async function updatePackage() {
         }
 
         console.log(`${c.info('[INFO]')} Updating from ${currentVersion} to ${latestVersion}...`);
-        execSync('npm update -g dr-claw', { stdio: 'inherit' });
+        const { exec } = await import('child_process');
+        const { promisify } = await import('util');
+        const execAsync = promisify(exec);
+        await execAsync('npm update -g dr-claw', { timeout: 120000 });
         console.log(`${c.ok('[OK]')} Update complete! Restart dr-claw to use the new version.`);
     } catch (e) {
         console.error(`${c.error('[ERROR]')} Update failed: ${e.message}`);
-        console.log(`${c.tip('[TIP]')} Try running manually: npm update -g dr-claw`);
+        console.log(`${c.tip('[TIP]')} Try running manually: npm install -g dr-claw@latest`);
     }
 }
 

package/server/data/news-log-arxiv.json

@@ -0,0 +1 @@
+["[runtime] Using python3 | Python 3.9.6 | /Library/Developer/CommandLineTools/usr/bin/python3","/Users/dingjiesong/Library/Python/3.9/lib/python/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020","warnings.warn(","11:54:21 [INFO] Loading config from: /Users/dingjiesong/Documents/workspace/ai-scientist/dr-claw/server/data/research_interests_arxiv.json","11:54:21 [INFO] Using current date: 2026-04-09","11:54:21 [INFO] Date windows:","11:54:21 [INFO]   Recent 30 days: 2026-03-10 to 2026-04-09","11:54:21 [INFO]   Past year (31-365 days): 2025-04-09 to 2026-03-09","11:54:21 [INFO] ======================================================================","11:54:21 [INFO] Step 1: Searching recent papers (last 30 days) from arXiv","11:54:21 [INFO] ======================================================================","11:54:21 [INFO] [arXiv] Searching papers from 2026-03-10 to 2026-04-09","11:54:22 [INFO] [arXiv] Found 200 papers","11:54:22 [INFO] Scored 200 recent papers","11:54:22 [INFO] Skipping Semantic Scholar hot paper search (disabled)","11:54:22 [INFO] ======================================================================","11:54:22 [INFO] Step 3: Merging and ranking results","11:54:22 [INFO] ======================================================================","11:54:22 [INFO] Total unique papers after deduplication: 200","11:54:22 [INFO] Results saved to: /Users/dingjiesong/Documents/workspace/ai-scientist/dr-claw/server/data/news-results-arxiv.json","11:54:22 [INFO] Top 10 papers:","11:54:22 [INFO]   1. TraceSafe: A Systematic Assessment of LLM Guardrails on Mult... (Score: 10.13)","11:54:22 [INFO]   2. Appear2Meaning: A Cross-Cultural Benchmark for Structured Cu... (Score: 8.93)","11:54:22 [INFO]   3. A Systematic Study of Retrieval Pipeline Design for Retrieva... (Score: 8.53)","11:54:22 [INFO]   4. Dynamic Context Evolution for Scalable Synthetic Data Genera... (Score: 8.53)","11:54:22 [INFO]   5. Strategic Persuasion with Trait-Conditioned Multi-Agent Syst... (Score: 8.4)","11:54:22 [INFO]   6. Personalized RewardBench: Evaluating Reward Models with Huma... (Score: 8.13)","11:54:22 [INFO]   7. AgentCity: Constitutional Governance for Autonomous Agent Ec... (Score: 8.0)","11:54:22 [INFO]   8. On the Step Length Confounding in LLM Reasoning Data Selecti... (Score: 7.87)","11:54:22 [INFO]   9. STRIDE-ED: A Strategy-Grounded Stepwise Reasoning Framework ... (Score: 7.73)","11:54:22 [INFO]   10. Differentiable Environment-Trajectory Co-Optimization for Sa... (Score: 7.6)"]

package/server/data/news-log-huggingface.json

@@ -0,0 +1 @@
+["[runtime] Using python3 | Python 3.9.6 | /Library/Developer/CommandLineTools/usr/bin/python3","/Users/dingjiesong/Library/Python/3.9/lib/python/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020","warnings.warn(","11:54:28 [INFO] No config provided — showing all HuggingFace Daily Papers","11:54:28 [INFO] Fetching HuggingFace Daily Papers...","11:54:28 [INFO] [HF] Fetched 50 daily paper entries","11:54:28 [INFO] Normalized 50 papers from 50 raw entries","11:54:28 [INFO] Scored 50 papers (0 filtered out by relevance/exclusion)","11:54:28 [INFO] Results saved to: /Users/dingjiesong/Documents/workspace/ai-scientist/dr-claw/server/data/news-results-huggingface.json","11:54:28 [INFO] Top 30 papers:","11:54:28 [INFO]   1. MegaTrain: Full Precision Training of 100B+ Parameter Large ... (Score: 6.09, Upvotes-based popularity: 2.22)","11:54:28 [INFO]   2. ThinkTwice: Jointly Optimizing Large Language Models for Rea... (Score: 6.08, Upvotes-based popularity: 1.98)","11:54:28 [INFO]   3. GBQA: A Game Benchmark for Evaluating LLMs as Quality Assura... (Score: 6.07, Upvotes-based popularity: 2.34)","11:54:28 [INFO]   4. RAGEN-2: Reasoning Collapse in Agentic RL... (Score: 6.0, Upvotes-based popularity: 2.4)","11:54:28 [INFO]   5. Vanast: Virtual Try-On with Human Image Animation via Synthe... (Score: 5.97, Upvotes-based popularity: 2.1)","11:54:28 [INFO]   6. Think in Strokes, Not Pixels: Process-Driven Image Generatio... (Score: 5.85, Upvotes-based popularity: 2.28)","11:54:28 [INFO]   7. Watch Before You Answer: Learning from Visually Grounded Pos... (Score: 5.62, Upvotes-based popularity: 1.62)","11:54:28 [INFO]   8. How Well Do Agentic Skills Work in the Wild: Benchmarking LL... (Score: 5.61, Upvotes-based popularity: 1.74)","11:54:28 [INFO]   9. In-Place Test-Time Training... (Score: 5.08, Upvotes-based popularity: 1.08)","11:54:28 [INFO]   10. SEVerA: Verified Synthesis of Self-Evolving Agents... (Score: 5.0, Upvotes-based popularity: 0.9)","11:54:28 [INFO]   11. MARS: Enabling Autoregressive Models Multi-Token Generation... (Score: 4.96, Upvotes-based popularity: 1.26)","11:54:28 [INFO]   12. INSPATIO-WORLD: A Real-Time 4D World Simulator via Spatiotem... (Score: 4.94, Upvotes-based popularity: 0.84)","11:54:28 [INFO]   13. Paper Circle: An Open-source Multi-agent Research Discovery ... (Score: 4.93, Upvotes-based popularity: 1.2)","11:54:28 [INFO]   14. General Multimodal Protein Design Enables DNA-Encoding of Ch... (Score: 4.81, Upvotes-based popularity: 1.38)","11:54:28 [INFO]   15. DARE: Diffusion Large Language Models Alignment and Reinforc... (Score: 4.71, Upvotes-based popularity: 1.08)","11:54:28 [INFO]   16. ClawsBench: Evaluating Capability and Safety of LLM Producti... (Score: 4.59, Upvotes-based popularity: 1.02)","11:54:28 [INFO]   17. TC-AE: Unlocking Token Capacity for Deep Compression Autoenc... (Score: 4.54, Upvotes-based popularity: 0.54)","11:54:28 [INFO]   18. MMEmb-R1: Reasoning-Enhanced Multimodal Embedding with Pair-... (Score: 4.52, Upvotes-based popularity: 0.42)","11:54:28 [INFO]   19. FP4 Explore, BF16 Train: Diffusion Reinforcement Learning vi... (Score: 4.42, Upvotes-based popularity: 0.42)","11:54:28 [INFO]   20. MedGemma 1.5 Technical Report... (Score: 4.41, Upvotes-based popularity: 0.54)","11:54:28 [INFO]   21. FlowInOne:Unifying Multimodal Generation as Image-in, Image-... (Score: 4.4, Upvotes-based popularity: 0.3)","11:54:28 [INFO]   22. Scientific Graphics Program Synthesis via Dual Self-Consiste... (Score: 4.28, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   23. Graph-Based Chain-of-Thought Pruning for Reducing Redundant ... (Score: 4.23, Upvotes-based popularity: 0.36)","11:54:28 [INFO]   24. Experience Transfer for Multimodal LLM Agents in Minecraft G... (Score: 4.23, Upvotes-based popularity: 0.36)","11:54:28 [INFO]   25. AgentGL: Towards Agentic Graph Learning with LLMs via Reinfo... (Score: 4.22, Upvotes-based popularity: 0.12)","11:54:28 [INFO]   26. Learning to Hint for Reinforcement Learning... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   27. Personalized RewardBench: Evaluating Reward Models with Huma... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   28. REAM: Merging Improves Pruning of Experts in LLMs... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   29. Context-Value-Action Architecture for Value-Driven Large Lan... (Score: 4.18, Upvotes-based popularity: 0.18)","11:54:28 [INFO]   30. Action Images: End-to-End Policy Learning via Multiview Vide... (Score: 4.14, Upvotes-based popularity: 0.54)"]