freddie 0.0.125 → 0.0.127

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freddie",
-  "version": "0.0.125",
+  "version": "0.0.127",
   "type": "module",
   "description": "Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design",
   "bin": {
@@ -28,6 +28,7 @@
     "acptoapi": "^1.0.144",
     "anentrypoint-design": "latest",
     "commander": "^14.0.0",
+    "dotenv": "^16.6.1",
     "express": "^5.0.0",
     "flatspace": "^1.0.18",
     "floosie": "^0.6.14",

package/plugins/edit/handler.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs'
+import path from 'node:path'
 export const _tool = ({
     name: 'edit',
     toolset: 'core',
@@ -16,14 +17,15 @@ export const _tool = ({
             required: ['path', 'old_string', 'new_string'],
         },
     },
-    handler: async ({ path: p, old_string, new_string, replace_all = false }) => {
-        if (!fs.existsSync(p)) return { error: `not found: ${p}` }
-        const src = fs.readFileSync(p, 'utf8')
+    handler: async ({ path: p, old_string, new_string, replace_all = false }, ctx = {}) => {
+        const resolved = ctx.cwd && !path.isAbsolute(p) ? path.join(ctx.cwd, p) : p
+        if (!fs.existsSync(resolved)) return { error: `not found: ${resolved}` }
+        const src = fs.readFileSync(resolved, 'utf8')
         const occurrences = src.split(old_string).length - 1
         if (occurrences === 0) return { error: 'old_string not found' }
         if (occurrences > 1 && !replace_all) return { error: `old_string matches ${occurrences} times; pass replace_all=true` }
         const out = replace_all ? src.split(old_string).join(new_string) : src.replace(old_string, new_string)
-        fs.writeFileSync(p, out, 'utf8')
-        return { path: p, replacements: replace_all ? occurrences : 1 }
+        fs.writeFileSync(resolved, out, 'utf8')
+        return { path: resolved, replacements: replace_all ? occurrences : 1 }
     },
 })

package/plugins/grep/handler.js

@@ -18,7 +18,8 @@ export const _tool = ({
             required: ['pattern'],
         },
     },
-    handler: async ({ pattern, path: root = '.', head_limit = 200, ignore_case = false, glob }) => {
+    handler: async ({ pattern, path: root = '.', head_limit = 200, ignore_case = false, glob }, ctx = {}) => {
+        if (ctx.cwd && !path.isAbsolute(root)) root = path.join(ctx.cwd, root)
         const re = new RegExp(pattern, ignore_case ? 'i' : '')
         const out = []
         const skipDirs = new Set(['node_modules', '.git', 'dist', 'build', '.cache'])

package/plugins/gui-chat/plugin.js

@@ -1,5 +1,27 @@
 import { runTurn } from '../../src/agent/machine.js'
-import { createSession } from '../../src/sessions.js'
+import { createSession, getMessages, appendMessage } from '../../src/sessions.js'
+
+// A client-supplied sessionId continues that conversation: prior turns'
+// messages are reloaded and fed back into runTurn (which otherwise starts a
+// brand-new xstate machine with no memory of anything), and the new turn's
+// messages are persisted back so the NEXT call in this session sees them too.
+// Without this, sessionId was purely a display label -- runTurn never saw it
+// and every call was independently stateless regardless of continuity intent.
+async function loadPriorMessages(sessionId) {
+    if (!sessionId) return []
+    try {
+        const rows = await getMessages(sessionId)
+        return rows.map(r => ({ role: r.role, content: r.content, ...(r.tool_calls ? { tool_calls: r.tool_calls } : {}), ...(r.tool_call_id ? { tool_call_id: r.tool_call_id } : {}) }))
+    } catch (_) { return [] }
+}
+
+async function persistNewMessages(sessionId, allMessages, priorCount) {
+    if (!sessionId) return
+    for (const m of allMessages.slice(priorCount)) {
+        try { await appendMessage(sessionId, { role: m.role, content: m.content, toolCalls: m.tool_calls || null, toolCallId: m.tool_call_id || null }) } catch (_) {}
+    }
+}
+
 export default {
     name: 'gui-chat', surfaces: 'gui',
     register({ gui }) {
@@ -18,11 +40,13 @@ export default {
                     sessionId = await createSession({ platform: 'web', title: prompt.slice(0, 80), cwd: cwd || null, skill: skill || null, model: model || null })
                 } catch (_) { sessionId = null }
             }
+            const priorMessages = await loadPriorMessages(sessionId)
 
             if (!wantsSse) {
                 try {
-                    const out = await runTurn({ prompt, timeoutMs: 120000, cwd, skill, provider, model })
+                    const out = await runTurn({ prompt, messages: priorMessages, sessionKey: sessionId || undefined, timeoutMs: 120000, cwd, skill, provider, model })
                     if (out.error) return res.status(500).json({ error: out.error, sessionId })
+                    await persistNewMessages(sessionId, out.messages || [], priorMessages.length)
                     return res.json({ result: out.result || '', messages: out.messages || [], iterations: out.iterations, sessionId })
                 } catch (e) {
                     return res.status(500).json({ error: String(e.message || e), sessionId })
@@ -35,8 +59,9 @@ export default {
             const send = (event, data) => res.write('event: ' + event + '\ndata: ' + JSON.stringify(data) + '\n\n')
             send('start', { ts: Date.now(), sessionId })
             try {
-                const out = await runTurn({ prompt, timeoutMs: 120000, cwd, skill, provider, model })
+                const out = await runTurn({ prompt, messages: priorMessages, sessionKey: sessionId || undefined, timeoutMs: 120000, cwd, skill, provider, model })
                 if (out.error) { send('error', { error: out.error }); res.end(); return }
+                await persistNewMessages(sessionId, out.messages || [], priorMessages.length)
                 for (const m of out.messages) send('message', m)
                 send('done', { result: out.result || '', iterations: out.iterations, sessionId })
             } catch (e) { send('error', { error: String(e.message || e) }) }

package/plugins/platform-discord/handler.js

@@ -5,6 +5,17 @@ import WebSocket from 'ws'
 const OP = { DISPATCH: 0, HEARTBEAT: 1, IDENTIFY: 2, RESUME: 6, RECONNECT: 7, INVALID_SESSION: 9, HELLO: 10, HEARTBEAT_ACK: 11 }
 // GUILD_MESSAGES(1<<9) + DIRECT_MESSAGES(1<<12) + MESSAGE_CONTENT(1<<15)
 const DEFAULT_INTENTS = (1 << 9) | (1 << 12) | (1 << 15)
+// Discord CDN attachment URLs are directly fetchable with no auth, but with no
+// auth also comes no trust in the advertised size -- guard against buffering
+// something unreasonably large into memory.
+const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024
+const ATTACHMENT_FETCH_TIMEOUT_MS = 10000
+
+function contentTypeCategory(contentType) {
+    const t = (contentType || '').split('/')[0]
+    if (t === 'image' || t === 'audio' || t === 'video') return t
+    return 'other'
+}
 
 export class DiscordAdapter extends EventEmitter {
     constructor(opts = {}) {
@@ -66,7 +77,42 @@ export class DiscordAdapter extends EventEmitter {
         if (p.t === 'MESSAGE_CREATE') {
             const m = p.d
             if (m.author?.bot) return   // ignore bots and our own messages
-            this.emit('message', { from: m.author?.id, text: m.content || '', raw: m, platform: 'discord' })
+            const base = { from: m.author?.id, text: m.content || '', raw: m, platform: 'discord' }
+            if (!m.attachments?.length) { this.emit('message', base); return }
+            // ws.on('message', ...) below is a sync callback and can't await this,
+            // so the fetch-and-emit path runs as a detached async task: the
+            // message still emits exactly once, after attachment fetches settle,
+            // and one attachment's failure (via allSettled) never blocks the
+            // others or drops the message itself.
+            this._resolveAttachments(m.attachments).then(media => {
+                this.emit('message', { ...base, media })
+            })
+            return
+        }
+    }
+
+    async _resolveAttachments(attachments) {
+        const results = await Promise.allSettled(attachments.map(a => this._fetchAttachment(a)))
+        return results.filter(r => r.status === 'fulfilled' && r.value).map(r => r.value)
+    }
+
+    async _fetchAttachment(a) {
+        if (a.size > MAX_ATTACHMENT_BYTES) {
+            console.error(`DiscordAdapter: skipping attachment ${a.filename} (${a.size} bytes exceeds ${MAX_ATTACHMENT_BYTES} byte guard)`)
+            return null
+        }
+        const ac = new AbortController()
+        const timer = setTimeout(() => ac.abort(), ATTACHMENT_FETCH_TIMEOUT_MS)
+        try {
+            const res = await fetch(a.url, { signal: ac.signal })
+            if (!res.ok) throw new Error(`attachment fetch failed with status ${res.status}`)
+            const buffer = Buffer.from(await res.arrayBuffer())
+            return { type: contentTypeCategory(a.content_type), mimeType: a.content_type || '', buffer, filename: a.filename }
+        } catch (err) {
+            console.error(`DiscordAdapter: attachment fetch failed for ${a.filename}`, err)
+            return null
+        } finally {
+            clearTimeout(timer)
         }
     }
 

package/plugins/platform-whatsapp/handler.js

@@ -28,6 +28,29 @@ export class WhatsappAdapter extends EventEmitter {
         try { return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) } catch { return false }
     }
 
+    // WhatsApp Cloud API media download is a two-step handshake: the webhook
+    // payload only ever carries a media id, never a fetchable URL directly.
+    // Step 1 resolves that id to a short-lived signed URL (also bearer-authed);
+    // step 2 fetches the actual bytes from that URL, still with the same
+    // bearer token (Meta requires it on both hops). Each hop is bounded by an
+    // AbortController timeout so a slow/hung Meta response can never wedge the
+    // webhook handler indefinitely.
+    async _downloadMedia(mediaId, timeoutMs = 10000) {
+        const authHeader = { authorization: `Bearer ${this.token}` }
+        const withTimeout = async (url) => {
+            const ac = new AbortController()
+            const timer = setTimeout(() => ac.abort(), timeoutMs)
+            try { return await fetch(url, { headers: authHeader, signal: ac.signal }) }
+            finally { clearTimeout(timer) }
+        }
+        const meta = await withTimeout(`${this.api}/${mediaId}`).then(r => r.json())
+        if (!meta?.url) throw new Error('WhatsappAdapter: media lookup returned no url: ' + JSON.stringify(meta))
+        const res = await withTimeout(meta.url)
+        if (!res.ok) throw new Error(`WhatsappAdapter: media fetch failed with status ${res.status}`)
+        const buffer = Buffer.from(await res.arrayBuffer())
+        return { buffer, mimeType: meta.mime_type || res.headers.get('content-type') || '' }
+    }
+
     async start() {
         if (!this.token || !this.phoneId) throw new Error('WhatsappAdapter: WHATSAPP_API_TOKEN + WHATSAPP_PHONE_NUMBER_ID required')
         const app = express()
@@ -38,19 +61,34 @@ export class WhatsappAdapter extends EventEmitter {
             if (req.query['hub.verify_token'] === this.verifyToken) return res.send(req.query['hub.challenge'])
             res.sendStatus(403)
         })
-        app.post(this.path, (req, res) => {
+        app.post(this.path, async (req, res) => {
             if (!this._verifySignature(req)) return res.sendStatus(401)
             const entries = req.body?.entry || []
             for (const e of entries) for (const c of (e.changes || [])) {
                 const msgs = c.value?.messages || []
                 for (const m of msgs) {
-                    this.emit('message', {
+                    const event = {
                         from: m.from,
                         text: m.text?.body || '',
                         // surface the platform message id for dedup, and the message type
                         // so media-only messages are recognisable upstream.
                         raw: { ...m, id: m.id, type: m.type },
-                    })
+                    }
+                    const mediaObj = m.image || m.audio || m.document || m.video
+                    if (mediaObj?.id) {
+                        const type = m.image ? 'image' : m.audio ? 'audio' : m.document ? 'document' : 'video'
+                        try {
+                            const { buffer, mimeType } = await this._downloadMedia(mediaObj.id)
+                            event.media = { type, mimeType, buffer }
+                        } catch (err) {
+                            // Never let a failed/slow media fetch block the rest of the
+                            // webhook batch or the ack below -- note media as
+                            // present-but-unfetched so the pipeline still proceeds.
+                            console.error('WhatsappAdapter: media download failed', err)
+                            event.media = { type, mimeType: mediaObj.mime_type || '', buffer: null, error: String(err?.message || err) }
+                        }
+                    }
+                    this.emit('message', event)
                 }
             }
             res.json({ ok: true })

package/plugins/read/handler.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs'
+import path from 'node:path'
 export const _tool = ({
     name: 'read',
     toolset: 'core',
@@ -15,10 +16,11 @@ export const _tool = ({
             required: ['path'],
         },
     },
-    handler: async ({ path: p, offset = 0, limit = 2000 }) => {
-        if (!fs.existsSync(p)) return { error: `not found: ${p}` }
-        const lines = fs.readFileSync(p, 'utf8').split('\n')
+    handler: async ({ path: p, offset = 0, limit = 2000 }, ctx = {}) => {
+        const resolved = ctx.cwd && !path.isAbsolute(p) ? path.join(ctx.cwd, p) : p
+        if (!fs.existsSync(resolved)) return { error: `not found: ${resolved}` }
+        const lines = fs.readFileSync(resolved, 'utf8').split('\n')
         const slice = lines.slice(offset, offset + limit)
-        return { path: p, total: lines.length, content: slice.map((l, i) => `${(offset + i + 1).toString().padStart(6)}\t${l}`).join('\n') }
+        return { path: resolved, total: lines.length, content: slice.map((l, i) => `${(offset + i + 1).toString().padStart(6)}\t${l}`).join('\n') }
     },
 })

package/plugins/write/handler.js

@@ -15,9 +15,10 @@ export const _tool = ({
             required: ['path', 'content'],
         },
     },
-    handler: async ({ path: p, content }) => {
-        fs.mkdirSync(path.dirname(p), { recursive: true })
-        fs.writeFileSync(p, content, 'utf8')
-        return { path: p, bytes: Buffer.byteLength(content, 'utf8') }
+    handler: async ({ path: p, content }, ctx = {}) => {
+        const resolved = ctx.cwd && !path.isAbsolute(p) ? path.join(ctx.cwd, p) : p
+        fs.mkdirSync(path.dirname(resolved), { recursive: true })
+        fs.writeFileSync(resolved, content, 'utf8')
+        return { path: resolved, bytes: Buffer.byteLength(content, 'utf8') }
     },
 })

package/src/agent/llm_resolver.js

@@ -116,7 +116,12 @@ export function resolveCallLLM({ provider, model } = {}) {
             // Without this, comma-separated model lists default to ['error'] and
             // rate-limited / empty / timed-out responses don't trigger chain
             // fallback — the request just throws.
-            const opts = { model: m, messages: toMsgs(input.messages), tools: toTools(input.tools), onFallback: input.onFallback, output: 'openai', fallbackOn: ['error', 'rate_limit', 'timeout', 'empty'] }
+            // max_tokens: acptoapi passes an unset value through to some providers
+            // as a very high implicit default (witnessed: 65536), which a
+            // low-credit free-tier account (e.g. openrouter) rejects outright with
+            // a 402 before even trying the request at a smaller size. 4096 matches
+            // acptoapi-bridge.js's own in-process default (see callLLM above).
+            const opts = { model: m, messages: toMsgs(input.messages), tools: toTools(input.tools), max_tokens: input.max_tokens || 4096, onFallback: input.onFallback, output: 'openai', fallbackOn: ['error', 'rate_limit', 'timeout', 'empty'] }
             if (/^queue\//.test(m)) opts.queuesMap = getConfigValue('agent.model_queues', {}) || {}
             if (m.includes(',') || /^queue\//.test(m)) opts.matrixSource = process.env.FREDDIE_MATRIX_URL || MATRIX_FILE
 

package/src/agent/machine.js

@@ -263,7 +263,12 @@ export async function runTurn({ prompt, messages = [], model, provider, callLLM,
     try {
         const { autoRecall, projectNamespace } = await import('../learn/gm-learn.js')
         const hits = await autoRecall(prompt, { limit: 5, namespace: await projectNamespace() })
-        if (hits.length) sysParts.push('Relevant memories (gm rs-learn):\n' + hits.map(h => '- ' + h.text).join('\n'))
+        // Weak models were witnessed answering FROM this block instead of the new
+        // user message below it (asked to remember a number, answered a prior
+        // turn's unrelated question instead) -- the plain "Relevant memories:"
+        // label gave no signal that this is background reference material, not
+        // the current instruction. Explicit priority framing fixes it.
+        if (hits.length) sysParts.push('Background context from past conversations (gm rs-learn) -- for reference only, does not describe the current task:\n' + hits.map(h => '- ' + h.text).join('\n') + '\n\nThe user\'s actual request for THIS turn follows below and takes priority over the above.')
     } catch (_) {}
     if (sysParts.length) initMessages.unshift({ role: 'user', content: sysParts.join('\n\n') })
     const inbound = await h.hooks.invoke('onMessageInbound', { content: prompt })
@@ -272,7 +277,14 @@ export async function runTurn({ prompt, messages = [], model, provider, callLLM,
     // Persist the turn snapshot under kind=agent so an interrupted turn (process
     // refresh mid-tool-call) resumes exactly where it stopped via resumeTurn.
     const key = sessionKey || randomUUID()
-    const machine = createAgentMachine({ model, provider, callLLM, enabledToolsets, disabledToolsets, maxIterations, events, sessionKey: key, toolCtx, tool_choice })
+    // cwd must reach file-path tool handlers (write/read/edit) via toolCtx, not
+    // just the system-prompt text above -- those handlers resolve relative paths
+    // with bare fs calls against process.cwd(), so without this every relative
+    // path silently lands in the freddie server's own cwd instead of the
+    // caller's intended project directory (only `bash` was safe, since it takes
+    // cwd as an explicit tool argument the model was told to pass).
+    const mergedToolCtx = cwd ? { cwd, ...(toolCtx || {}) } : toolCtx
+    const machine = createAgentMachine({ model, provider, callLLM, enabledToolsets, disabledToolsets, maxIterations, events, sessionKey: key, toolCtx: mergedToolCtx, tool_choice })
     const pa = await createPersistentActor(machine, { kind: 'agent', key, input: { messages: initMessages } })
     pa.actor.send({ type: 'SUBMIT', prompt })
     return await driveAgentActor({ pa, h, events, prompt, provider, model, skill, cwd, witnessPath, timeoutMs, sessionKey: key })

package/src/cli/doctor.js

@@ -1,11 +1,13 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
+import { createRequire } from 'node:module'
 import { getFreddieHome } from '../home.js'
+const _require = createRequire(import.meta.url)
 const CHECKS = [
     { name: 'freddie-home', run: () => fs.existsSync(getFreddieHome()) ? { ok: true } : { ok: false, fix: 'mkdir -p ' + getFreddieHome() } },
     { name: 'node-version', run: () => { const v = process.versions.node; const major = Number(v.split('.')[0]); return major >= 20 ? { ok: true, value: v } : { ok: false, fix: 'install node >=20', value: v } } },
-    { name: 'better-sqlite3', run: () => { try { require.resolve('better-sqlite3'); return { ok: true } } catch { return { ok: false, fix: 'npm install' } } } },
+    { name: '@libsql/client', run: () => { try { _require.resolve('@libsql/client'); return { ok: true } } catch { return { ok: false, fix: 'npm install' } } } },
     { name: 'gh-cli', run: () => { const r = spawnSync('gh', ['--version'], { encoding: 'utf8' }); return r.status === 0 ? { ok: true, value: r.stdout.split('\n')[0] } : { ok: false, fix: 'install gh CLI' } } },
     { name: 'git', run: () => { const r = spawnSync('git', ['--version'], { encoding: 'utf8' }); return r.status === 0 ? { ok: true, value: r.stdout.trim() } : { ok: false, fix: 'install git' } } },
     { name: 'config-file', run: () => { const p = path.join(getFreddieHome(), 'config.yaml'); return fs.existsSync(p) ? { ok: true } : { ok: false, fix: 'freddie setup' } } },

package/src/host/index.js

@@ -1,5 +1,6 @@
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import dotenv from 'dotenv'
 import { createHost, discoverPlugins } from './host.js'
 import { getFreddieHome } from '../home.js'
 import { applyActiveProjectFromRegistry } from '../projects.js'
@@ -10,6 +11,13 @@ let _loadPromise = null
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const REPO_PLUGINS = path.resolve(__dirname, '..', '..', 'plugins')
 
+// Every process entrypoint (bin/freddie.js, src/web/server.js, src/acp/server.js,
+// src/gateway/run.js) calls bootHost() before touching a provider key, so this
+// is the one place a `.env` in the invoking cwd reaches process.env for every
+// downstream reader (acptoapi's own process.env.GROQ_API_KEY etc reads, pi-ai's
+// findEnvKeys/getEnvApiKey). Silent no-op when no .env file exists.
+dotenv.config()
+
 export function host() {
     if (!_host) _host = createHost({ surfaces: ['pi', 'gui'] })
     return _host