dr-claw 1.1.2 → 1.1.4

package/server/routes/memory.js

@@ -0,0 +1,143 @@
+import express from 'express';
+import { memoryDb } from '../database/db.js';
+import { syncMemoryFiles } from '../utils/memoryPrompt.js';
+
+const router = express.Router();
+const MAX_CONTENT_LENGTH = 500;
+const VALID_CATEGORIES = new Set(['general', 'preference', 'context', 'workflow']);
+
+/** Parse and validate :id param as a positive integer. */
+function parseId(raw) {
+  const id = parseInt(raw, 10);
+  return Number.isNaN(id) || id <= 0 ? null : id;
+}
+
+// ===============================
+// Memory CRUD
+// ===============================
+
+// Get all memories for the authenticated user
+router.get('/', async (req, res) => {
+  try {
+    const memories = memoryDb.getAll(req.user.id);
+    res.json({ memories });
+  } catch (error) {
+    console.error('Error fetching memories:', error);
+    res.status(500).json({ error: 'Failed to fetch memories' });
+  }
+});
+
+// Create a new memory
+router.post('/', async (req, res) => {
+  try {
+    const { content, category } = req.body;
+    if (!content || !content.trim()) {
+      return res.status(400).json({ error: 'Memory content is required' });
+    }
+    if (content.length > MAX_CONTENT_LENGTH) {
+      return res.status(400).json({ error: `Memory content must be ${MAX_CONTENT_LENGTH} characters or less` });
+    }
+    const cat = VALID_CATEGORIES.has(category) ? category : 'general';
+    const memory = memoryDb.create(req.user.id, content.trim(), cat);
+    syncMemoryFiles(req.user.id).catch(err => console.warn('[memory] sync error:', err.message));
+    res.status(201).json({ memory });
+  } catch (error) {
+    if (error.message?.includes('Maximum of')) {
+      return res.status(400).json({ error: error.message });
+    }
+    console.error('Error creating memory:', error);
+    res.status(500).json({ error: 'Failed to create memory' });
+  }
+});
+
+// Update a memory
+router.put('/:id', async (req, res) => {
+  try {
+    const id = parseId(req.params.id);
+    if (!id) return res.status(400).json({ error: 'Invalid memory ID' });
+
+    const { content, category } = req.body;
+    if (content !== undefined && content.length > MAX_CONTENT_LENGTH) {
+      return res.status(400).json({ error: `Memory content must be ${MAX_CONTENT_LENGTH} characters or less` });
+    }
+    const updates = {};
+    if (content !== undefined) updates.content = content.trim();
+    if (category !== undefined) updates.category = VALID_CATEGORIES.has(category) ? category : 'general';
+
+    const memory = memoryDb.update(req.user.id, id, updates);
+    if (!memory) {
+      return res.status(404).json({ error: 'Memory not found' });
+    }
+    syncMemoryFiles(req.user.id).catch(err => console.warn('[memory] sync error:', err.message));
+    res.json({ memory });
+  } catch (error) {
+    console.error('Error updating memory:', error);
+    res.status(500).json({ error: 'Failed to update memory' });
+  }
+});
+
+// Toggle memory enabled/disabled
+router.patch('/:id/toggle', async (req, res) => {
+  try {
+    const id = parseId(req.params.id);
+    if (!id) return res.status(400).json({ error: 'Invalid memory ID' });
+
+    const memory = memoryDb.toggle(req.user.id, id);
+    if (!memory) {
+      return res.status(404).json({ error: 'Memory not found' });
+    }
+    syncMemoryFiles(req.user.id).catch(err => console.warn('[memory] sync error:', err.message));
+    res.json({ memory });
+  } catch (error) {
+    console.error('Error toggling memory:', error);
+    res.status(500).json({ error: 'Failed to toggle memory' });
+  }
+});
+
+// Delete a memory
+router.delete('/:id', async (req, res) => {
+  try {
+    const id = parseId(req.params.id);
+    if (!id) return res.status(400).json({ error: 'Invalid memory ID' });
+
+    const deleted = memoryDb.delete(req.user.id, id);
+    if (!deleted) {
+      return res.status(404).json({ error: 'Memory not found' });
+    }
+    syncMemoryFiles(req.user.id).catch(err => console.warn('[memory] sync error:', err.message));
+    res.json({ success: true });
+  } catch (error) {
+    console.error('Error deleting memory:', error);
+    res.status(500).json({ error: 'Failed to delete memory' });
+  }
+});
+
+// ===============================
+// Per-User Memory Settings
+// ===============================
+
+// Get memory enabled state for the authenticated user
+router.get('/settings', async (req, res) => {
+  try {
+    const enabled = memoryDb.getMemoryEnabled(req.user.id);
+    res.json({ enabled });
+  } catch (error) {
+    console.error('Error fetching memory settings:', error);
+    res.status(500).json({ error: 'Failed to fetch memory settings' });
+  }
+});
+
+// Set memory enabled state for the authenticated user
+router.patch('/settings', async (req, res) => {
+  try {
+    const { enabled } = req.body;
+    memoryDb.setMemoryEnabled(req.user.id, !!enabled);
+    syncMemoryFiles(req.user.id).catch(err => console.warn('[memory] sync error:', err.message));
+    res.json({ enabled: !!enabled });
+  } catch (error) {
+    console.error('Error updating memory settings:', error);
+    res.status(500).json({ error: 'Failed to update memory settings' });
+  }
+});
+
+export default router;

package/server/routes/news.js

@@ -488,6 +488,9 @@ router.post('/search/:source', (req, res) => handleSearch(req.params.source, req
 // GET /api/news/logs/:source — poll search progress logs
 router.get('/logs/:source', async (req, res) => {
   try {
+    const entry = getSourceEntry(req.params.source);
+    if (!entry) return res.status(404).json({ error: `Unknown source: ${req.params.source}` });
+
     const logPath = path.join(DATA_DIR, `news-log-${req.params.source}.json`);
     const data = await fs.readFile(logPath, 'utf8');
     res.json({ logs: JSON.parse(data) });

package/server/routes/skills.js

@@ -5,6 +5,7 @@ import os from 'os';
 import { fileURLToPath } from 'url';
 import { extractProjectDirectory, ensureProjectSkillLinks } from '../projects.js';
 import { FORBIDDEN_PATHS } from './projects.js';
+import { findSkillMdPath } from '../utils/skillExpander.js';
 
 const GLOBAL_SKILLS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'skills');
 
@@ -223,6 +224,40 @@ async function validateZipBuffer(buffer) {
   };
 }
 
+// GET /resolve — resolve a skill name to its SKILL.md path and content
+router.get('/resolve', async (req, res) => {
+  try {
+    const { name, workingDir } = req.query;
+    if (!name || typeof name !== 'string') {
+      return res.status(400).json({ error: 'name query parameter is required' });
+    }
+    // Prevent path traversal
+    if (/[/\\]|\.\./.test(name)) {
+      return res.status(400).json({ error: 'Invalid skill name' });
+    }
+    const effectiveWorkingDir = (typeof workingDir === 'string' && workingDir.trim()) || process.cwd();
+    // Validate workingDir: must be absolute and not a forbidden system path
+    if (effectiveWorkingDir !== process.cwd()) {
+      if (!path.isAbsolute(effectiveWorkingDir)) {
+        return res.status(400).json({ error: 'workingDir must be an absolute path' });
+      }
+      const normalized = path.normalize(effectiveWorkingDir);
+      if (FORBIDDEN_PATHS.some((fp) => normalized === fp || normalized.startsWith(fp + path.sep))) {
+        return res.status(400).json({ error: 'Invalid workingDir' });
+      }
+    }
+    const skillMdPath = await findSkillMdPath(name, effectiveWorkingDir);
+    if (!skillMdPath) {
+      return res.status(404).json({ error: 'Skill not found' });
+    }
+    const content = await fs.readFile(skillMdPath, 'utf-8');
+    res.json({ path: skillMdPath, content });
+  } catch (error) {
+    console.error('[skills] resolve error:', error.message);
+    res.status(500).json({ error: error.message });
+  }
+});
+
 // GET / — return the file tree of the global skills/ directory
 router.get('/', async (req, res) => {
   try {

package/server/routes/user.js

@@ -2,10 +2,8 @@ import express from 'express';
 import { userDb } from '../database/db.js';
 import { authenticateToken } from '../middleware/auth.js';
 import { getSystemGitConfig } from '../utils/gitConfig.js';
-import { exec } from 'child_process';
-import { promisify } from 'util';
+import spawnAsync from '../utils/spawnAsync.js';
 
-const execAsync = promisify(exec);
 const router = express.Router();
 
 router.get('/git-config', authenticateToken, async (req, res) => {
@@ -55,8 +53,8 @@ router.post('/git-config', authenticateToken, async (req, res) => {
     userDb.updateGitConfig(userId, gitName, gitEmail);
 
     try {
-      await execAsync(`git config --global user.name "${gitName.replace(/"/g, '\\"')}"`);
-      await execAsync(`git config --global user.email "${gitEmail.replace(/"/g, '\\"')}"`);
+      await spawnAsync('git', ['config', '--global', 'user.name', gitName]);
+      await spawnAsync('git', ['config', '--global', 'user.email', gitEmail]);
       console.log(`Applied git config globally: ${gitName} <${gitEmail}>`);
     } catch (gitError) {
       console.error('Error applying git config:', gitError);

package/server/utils/__tests__/safePath.test.js

@@ -0,0 +1,93 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+import { safePath } from '../safePath.js';
+
+// Use a real temporary directory so realpathSync works correctly
+let ROOT;
+
+beforeAll(() => {
+  // Use realpathSync to normalize macOS /var -> /private/var symlink
+  ROOT = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'safepath-test-')));
+  fs.mkdirSync(path.join(ROOT, 'src'), { recursive: true });
+  fs.mkdirSync(path.join(ROOT, 'lib'), { recursive: true });
+  fs.writeFileSync(path.join(ROOT, 'src', 'index.js'), '');
+  fs.writeFileSync(path.join(ROOT, 'lib', 'utils.js'), '');
+});
+
+afterAll(() => {
+  fs.rmSync(ROOT, { recursive: true, force: true });
+});
+
+describe('safePath', () => {
+  it('resolves relative paths within root', () => {
+    const result = safePath('src/index.js', ROOT);
+    expect(result).toBe(path.join(ROOT, 'src', 'index.js'));
+  });
+
+  it('returns root when path is empty/null/undefined', () => {
+    expect(safePath('', ROOT)).toBe(ROOT);
+    expect(safePath(null, ROOT)).toBe(ROOT);
+    expect(safePath(undefined, ROOT)).toBe(ROOT);
+  });
+
+  it('allows absolute paths that land inside root', () => {
+    const absInside = path.join(ROOT, 'src', 'index.js');
+    const result = safePath(absInside, ROOT);
+    expect(result).toBe(absInside);
+  });
+
+  it('blocks absolute paths outside root', () => {
+    expect(() => safePath('/etc/passwd', ROOT)).toThrow(/Path traversal blocked/);
+  });
+
+  it('blocks .. traversal above root', () => {
+    expect(() => safePath('../../../etc/shadow', ROOT)).toThrow(/Path traversal blocked/);
+  });
+
+  it('blocks .. traversal disguised in deeper path', () => {
+    expect(() => safePath('src/../../../../../../etc/passwd', ROOT)).toThrow(
+      /Path traversal blocked/,
+    );
+  });
+
+  it('allows .. that stays within root', () => {
+    const result = safePath('src/../lib/utils.js', ROOT);
+    expect(result).toBe(path.join(ROOT, 'lib', 'utils.js'));
+  });
+
+  it('handles non-existent target gracefully', () => {
+    // Non-existent file in existing directory — should work
+    const result = safePath('src/newfile.js', ROOT);
+    expect(result).toBe(path.join(ROOT, 'src', 'newfile.js'));
+  });
+
+  it('handles non-existent nested path gracefully', () => {
+    // Non-existent nested path — should still resolve within root
+    const result = safePath('deep/nested/new/file.js', ROOT);
+    expect(result.startsWith(ROOT + path.sep)).toBe(true);
+  });
+
+  it('normalizes allowedRoot for falsy input', () => {
+    // Pass a non-normalized root (with trailing segments) to verify
+    // the falsy-input path returns path.resolve(allowedRoot), not the raw string.
+    const nonNormalized = ROOT + path.sep + 'src' + path.sep + '..';
+    const result = safePath('', nonNormalized);
+    expect(result).toBe(ROOT);
+  });
+
+  it('allows symlinks inside the project that point outside the root', () => {
+    // Simulate: project/data -> /tmp (an external location)
+    // This should NOT be blocked — legitimate workflow (shared datasets, etc.)
+    const linkPath = path.join(ROOT, 'external-data');
+    try {
+      fs.symlinkSync(os.tmpdir(), linkPath);
+      // Logical path is inside root, so safePath should allow it
+      const result = safePath('external-data/some-file.csv', ROOT);
+      expect(result).toBe(path.join(ROOT, 'external-data', 'some-file.csv'));
+    } finally {
+      try { fs.unlinkSync(linkPath); } catch { /* ignore cleanup errors */ }
+    }
+  });
+});

package/server/utils/cliResolution.js

@@ -9,6 +9,7 @@ function isCommandNotFoundExitCode(code) {
  *
  * @param {Object} options
  * @param {string} options.envVarName Environment variable name containing an override command.
+ * @param {string[]} [options.legacyEnvVarNames=[]] Older env var names checked after envVarName (migration).
  * @param {string[]} options.defaultCommands Fallback command names in preference order.
  * @param {string} [options.platform=process.platform] Runtime platform, used for Windows suffix handling.
  * @param {boolean} [options.appendWindowsSuffixes=false] Whether to append .cmd/.exe candidates on Windows.
@@ -16,11 +17,19 @@ function isCommandNotFoundExitCode(code) {
  */
 function getCliCommandCandidates({
     envVarName,
+    legacyEnvVarNames = [],
     defaultCommands,
     platform = process.platform,
     appendWindowsSuffixes = false
 }) {
-    const envCommand = String(process.env[envVarName] || '').trim();
+    let envCommand = '';
+    for (const key of [envVarName, ...legacyEnvVarNames].filter(Boolean)) {
+        const s = String(process.env[key] || '').trim();
+        if (s) {
+            envCommand = s;
+            break;
+        }
+    }
     const rawCandidates = [];
 
     if (envCommand) {
@@ -131,6 +140,7 @@ function checkCommandAvailable(command, args = ['--help'], { platform = process.
  *
  * @param {Object} options
  * @param {string} options.envVarName Environment variable with command override.
+ * @param {string[]} [options.legacyEnvVarNames=[]] Older env vars (after envVarName) for migration.
  * @param {string[]} options.defaultCommands Fallback command names in preference order.
  * @param {string[]} [options.args=['--help']] Probe arguments.
  * @param {string} [options.platform=process.platform] Runtime platform.
@@ -140,6 +150,7 @@ function checkCommandAvailable(command, args = ['--help'], { platform = process.
  */
 async function resolveAvailableCliCommand({
     envVarName,
+    legacyEnvVarNames = [],
     defaultCommands,
     args = ['--help'],
     platform = process.platform,
@@ -148,6 +159,7 @@ async function resolveAvailableCliCommand({
 }) {
     const candidates = getCliCommandCandidates({
         envVarName,
+        legacyEnvVarNames,
         defaultCommands,
         platform,
         appendWindowsSuffixes

package/server/utils/codexSessionMessages.js

@@ -0,0 +1,285 @@
+const WINDOWS_ABS_PATH = /^[A-Za-z]:[\\/]/;
+
+function normalizePath(value) {
+  return String(value || '').replace(/\\/g, '/').replace(/\/+/g, '/').trim();
+}
+
+function isAbsolutePath(value) {
+  return value.startsWith('/') || WINDOWS_ABS_PATH.test(value);
+}
+
+function parseJsonObject(value) {
+  if (!value) return null;
+  if (typeof value === 'object') return value;
+  if (typeof value !== 'string') return null;
+
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+function extractTextContent(content) {
+  if (!Array.isArray(content)) return content;
+  return content
+    .map((item) => {
+      if (item?.type === 'input_text' || item?.type === 'output_text' || item?.type === 'text') {
+        return item.text || '';
+      }
+      return '';
+    })
+    .filter(Boolean)
+    .join('\n');
+}
+
+function extractSearchResultFiles(output) {
+  const files = new Set();
+  String(output || '')
+    .split('\n')
+    .forEach((line) => {
+      const trimmed = line.trim();
+      if (!trimmed) return;
+
+      const fileMatch = trimmed.match(/^(.+?):\d+(?::\d+)?:/);
+      if (fileMatch?.[1]) {
+        files.add(fileMatch[1].trim());
+      }
+    });
+
+  return Array.from(files);
+}
+
+function parsePatchFilePaths(patchText) {
+  const files = [];
+  String(patchText || '')
+    .split('\n')
+    .forEach((line) => {
+      // Known limitation: only matches Add/Delete/Update prefixes.
+      // Real-world Codex patches may also use "Create File" — extend if needed.
+      const addMatch = line.match(/^\*\*\* (?:Add|Delete|Update) File: (.+)$/);
+      if (addMatch?.[1]) {
+        files.push(addMatch[1].trim());
+        return;
+      }
+
+      const moveMatch = line.match(/^\*\*\* Move to: (.+)$/);
+      if (moveMatch?.[1]) {
+        files.push(moveMatch[1].trim());
+      }
+    });
+
+  return Array.from(new Set(files));
+}
+
+function toFileChangesToolInput(changes) {
+  return Object.entries(changes || {})
+    .map(([filePath, change]) => `${change?.type || 'update'}: ${filePath}`)
+    .join('\n');
+}
+
+function normalizeCodexFunctionCall(name, rawArguments) {
+  const parsedArguments = parseJsonObject(rawArguments);
+
+  if (name === 'exec_command') {
+    return {
+      toolName: 'Bash',
+      toolInput: JSON.stringify({
+        command: parsedArguments?.cmd || '',
+        workdir: parsedArguments?.workdir || parsedArguments?.cwd || '',
+      }),
+    };
+  }
+
+  if (name === 'write_stdin') {
+    return {
+      toolName: 'write_stdin',
+      toolInput: rawArguments,
+      skip: true,
+    };
+  }
+
+  if (name === 'update_plan') {
+    return {
+      toolName: 'UpdatePlan',
+      toolInput: JSON.stringify(parsedArguments || {}),
+    };
+  }
+
+  if (name === 'view_image') {
+    return {
+      toolName: 'ViewImage',
+      toolInput: JSON.stringify(parsedArguments || {}),
+    };
+  }
+
+  return {
+    toolName: name,
+    toolInput: typeof rawArguments === 'string' ? rawArguments : JSON.stringify(parsedArguments || {}),
+  };
+}
+
+function normalizeCodexCustomToolCall(name, input) {
+  if (name !== 'apply_patch') {
+    return {
+      toolName: name || 'custom_tool',
+      toolInput: input || '',
+    };
+  }
+
+  const filePaths = parsePatchFilePaths(input);
+  return {
+    toolName: 'Edit',
+    toolInput: JSON.stringify({
+      file_path: filePaths[0] || 'unknown',
+      file_paths: filePaths,
+      patch: input || '',
+    }),
+  };
+}
+
+function normalizeExecCommandEvent(payload, fallbackInput) {
+  const parsedCommand = Array.isArray(payload?.parsed_cmd) ? payload.parsed_cmd[0] : null;
+  const output = payload?.aggregated_output || payload?.stdout || payload?.stderr || '';
+  const isError = Number(payload?.exit_code ?? payload?.exitCode ?? 0) !== 0 || payload?.status === 'failed';
+
+  if (parsedCommand?.type === 'read' && parsedCommand?.path) {
+    return {
+      toolName: 'Read',
+      toolInput: JSON.stringify({ file_path: parsedCommand.path }),
+      toolResult: {
+        content: output,
+        isError,
+      },
+    };
+  }
+
+  if (parsedCommand?.type === 'search') {
+    const filenames = extractSearchResultFiles(output);
+    return {
+      toolName: 'Grep',
+      toolInput: JSON.stringify({
+        pattern: parsedCommand.query || '',
+        path: parsedCommand.path || payload?.cwd || '',
+        command: parsedCommand.cmd || fallbackInput?.command || '',
+      }),
+      toolResult: {
+        content: output,
+        isError,
+        toolUseResult: filenames.length > 0 ? { filenames } : null,
+      },
+    };
+  }
+
+  if (parsedCommand?.type === 'list_files') {
+    return {
+      toolName: 'LS',
+      toolInput: JSON.stringify({
+        path: parsedCommand.path || payload?.cwd || '',
+        command: parsedCommand.cmd || fallbackInput?.command || '',
+      }),
+      toolResult: {
+        content: output,
+        isError,
+      },
+    };
+  }
+
+  return {
+    toolName: 'Bash',
+    toolInput: JSON.stringify({
+      command: fallbackInput?.command || '',
+      workdir: fallbackInput?.workdir || payload?.cwd || '',
+      parsed_cmd: payload?.parsed_cmd || [],
+    }),
+    toolResult: {
+      content: output,
+      isError,
+    },
+  };
+}
+
+function normalizePatchApplyEvent(payload) {
+  const changes = payload?.changes || {};
+  const content = [payload?.stdout, payload?.stderr].filter(Boolean).join('\n').trim();
+  return {
+    toolResult: {
+      content,
+      isError: payload?.success === false || payload?.status === 'failed',
+      toolUseResult: { changes },
+    },
+    fileChangesToolInput: toFileChangesToolInput(changes),
+  };
+}
+
+function normalizeWebSearchCall(payload) {
+  const action = payload?.action || {};
+  const type = action?.type;
+
+  if (type === 'search') {
+    return {
+      toolName: 'WebSearch',
+      toolInput: JSON.stringify({
+        query: action.query || '',
+        queries: action.queries || [],
+      }),
+    };
+  }
+
+  if (type === 'open_page') {
+    return {
+      toolName: 'OpenPage',
+      toolInput: JSON.stringify({
+        url: action.url || '',
+      }),
+    };
+  }
+
+  if (type === 'find_in_page') {
+    return {
+      toolName: 'FindInPage',
+      toolInput: JSON.stringify({
+        url: action.url || '',
+        pattern: action.pattern || '',
+      }),
+    };
+  }
+
+  return {
+    toolName: 'WebSearch',
+    toolInput: JSON.stringify(action || {}),
+  };
+}
+
+function buildToolUseMessage(timestamp, toolName, toolInput, toolCallId) {
+  return {
+    type: 'tool_use',
+    timestamp,
+    toolName,
+    toolInput,
+    toolCallId,
+  };
+}
+
+function buildToolResultMessage(timestamp, toolCallId, output, extra = {}) {
+  return {
+    type: 'tool_result',
+    timestamp,
+    toolCallId,
+    output,
+    ...extra,
+  };
+}
+
+export {
+  buildToolResultMessage,
+  buildToolUseMessage,
+  extractTextContent,
+  normalizeCodexCustomToolCall,
+  normalizeCodexFunctionCall,
+  normalizeExecCommandEvent,
+  normalizePatchApplyEvent,
+  normalizeWebSearchCall,
+  parseJsonObject,
+  parsePatchFilePaths,
+};