grok-bot-cli 0.2.2 → 0.3.0

package/src/history.js

@@ -0,0 +1,83 @@
+import { appendFileSync, closeSync, constants, createReadStream, fstatSync, mkdirSync, openSync, readSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { entryText, transcriptEntries } from "./transcript.js";
+
+export function historyPath(dir) {
+  return join(resolve(dir || process.env.GROK_BOT_HISTORY_DIR || join(homedir(), ".grok-bot-cli")), "history.jsonl");
+}
+
+// Keep only conversation fields, never gateway responses, session credentials or bot instructions.
+export function saveHistory(out, { dir, disabled, event, prompt, rootId } = {}) {
+  // Opt-in only: plaintext local history stays off unless GROK_BOT_HISTORY=on (or true/1).
+  if (disabled || !/^(on|true|1)$/i.test(process.env.GROK_BOT_HISTORY || "")) return;
+  try {
+    const recordedAt = new Date().toISOString();
+    const target = { id: out.target.id, name: out.target.name, kind: out.target.isGroup ? "group" : "bot" };
+    const payload = out.transcript || out.thread || out;
+    const entries = event === "send" ? [{ role: "user", text: prompt }] : transcriptEntries(payload);
+    const rows = entries.map((entry) => ({
+      version: 1,
+      recordedAt,
+      event,
+      target,
+      ...(rootId ? { rootId } : {}),
+      role: String(entry.role || entry.kind || entry.sender || entry.type || "msg"),
+      ...(entry.id || entry.messageId ? { messageId: String(entry.id || entry.messageId) } : {}),
+      ...(entry.timestamp || entry.createdAt ? { timestamp: String(entry.timestamp || entry.createdAt) } : {}),
+      text: entryText(entry),
+    }));
+    if (!rows.length) return;
+    const path = historyPath(dir);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const fd = openSync(path, constants.O_CREAT | constants.O_APPEND | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+    try {
+      // Separate a previous interrupted append from the next complete record.
+      const size = fstatSync(fd).size;
+      const last = Buffer.alloc(1);
+      if (size) readSync(fd, last, 0, 1, size - 1);
+      const prefix = size && last[0] !== 10 ? "\n" : "";
+      appendFileSync(fd, prefix + rows.map((row) => JSON.stringify(row)).join("\n") + "\n");
+    } finally {
+      closeSync(fd);
+    }
+  } catch {
+    // A successful remote send must not look failed and invite an accidental resend.
+    process.stderr.write("Warning: could not save local history. Check the history directory and permissions.\n");
+  }
+}
+
+export async function readHistory(path, { ref, search, limit = 40 } = {}) {
+  const rows = [];
+  let malformed = 0;
+  const input = createReadStream(path, { encoding: "utf8" });
+  const lines = createInterface({ input, crlfDelay: Infinity });
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      let row;
+      try {
+        row = JSON.parse(line);
+        if (row?.version !== 1 || typeof row.text !== "string" || typeof row.role !== "string" ||
+            typeof row.recordedAt !== "string" || typeof row.target?.id !== "string" || typeof row.target?.name !== "string") {
+          throw new Error("Invalid history record");
+        }
+      } catch {
+        malformed++;
+        continue;
+      }
+      if (ref && row.target.id !== ref && row.target.name.toLowerCase() !== ref.toLowerCase()) continue;
+      if (search !== undefined && !row.text.toLowerCase().includes(search.toLowerCase())) continue;
+      rows.push(row);
+      if (rows.length > limit) rows.shift();
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  } finally {
+    lines.close();
+    input.destroy();
+  }
+  if (malformed) process.stderr.write("Warning: skipped " + malformed + " malformed local history record(s).\n");
+  return rows;
+}

package/src/transcript.js

@@ -0,0 +1,50 @@
+// Shared by `gbot thread` and the grok-bot plugin's gbot_thread tool.
+
+/** Coerce anything to a string without throwing (numbers, BigInt, unserializable objects). */
+export function toSafeText(value) {
+  if (typeof value === "string") return value;
+  if (value == null) return "";
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
+  try {
+    const out = JSON.stringify(value);
+    return typeof out === "string" ? out : "";
+  } catch {
+    return "[unserializable]";
+  }
+}
+
+/** Coerce to string and replace lone surrogates so downstream slicing/JSON never breaks. */
+export function normalizeText(value) {
+  return toSafeText(value).replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "\uFFFD");
+}
+
+export function entryText(e) {
+  return normalizeText(entryTextRaw(e));
+}
+
+function entryTextRaw(e) {
+  if (!e || typeof e !== "object") return "";
+  // Prefer full body fields over `preview` (often truncated for list UIs).
+  const direct = e.text || e.prompt || e.message;
+  if (typeof direct === "string" && direct) return direct;
+  const content = e.content;
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((part) => {
+      if (typeof part === "string") return part;
+      if (part && typeof part === "object") return part.text || part.content || "";
+      return "";
+    }).filter(Boolean).join("\n");
+  }
+  if (content && typeof content === "object") return content.text || toSafeText(content);
+  // Bot replies arrive as `{ kind: "send-message", message: { type, content } }`.
+  if (e.message && typeof e.message === "object" && typeof e.message.content === "string") return e.message.content;
+  return typeof e.preview === "string" ? e.preview : "";
+}
+
+export function transcriptEntries(payload) {
+  if (Array.isArray(payload)) return payload;
+  if (!payload || typeof payload !== "object") return [];
+  const entries = payload.entries || payload.messages || payload.items;
+  return Array.isArray(entries) ? entries : [];
+}

package/src/url-policy.js

@@ -0,0 +1,161 @@
+/**
+ * Gateway / backend URL policy: only send credentials to expected hosts.
+ *
+ * Gateway (box + API): https on *.cursor.sh / *.cursor.com (and apex) /
+ * *.cursorvm.com (EnsureSandBox box hosts, e.g. <id>-pod-<id>.us12.cursorvm.com).
+ * Backend (EnsureSandBox / Cursor API): https on *.cursor.sh / *.cursor.com only —
+ * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
+ * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
+ * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ */
+
+function truthyEnv(name) {
+  const v = (process.env[name] || "").trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+
+export function allowAnyGateway() {
+  return truthyEnv("GROK_BOT_ALLOW_ANY_GATEWAY");
+}
+
+export function allowLocalGateway() {
+  return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
+}
+
+const warned = new Set();
+
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  process.stderr.write(message + "\n");
+}
+
+/** Test hook: clear the one-shot warn set. */
+export function resetPolicyWarnings() {
+  warned.clear();
+}
+
+function isLocalHostname(hostname) {
+  const h = String(hostname || "").toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "localhost" || h === "127.0.0.1" || h === "::1";
+}
+
+function isCursorApiHostname(hostname) {
+  const h = String(hostname || "").toLowerCase();
+  if (!h) return false;
+  if (h === "cursor.sh" || h === "cursor.com") return true;
+  return h.endsWith(".cursor.sh") || h.endsWith(".cursor.com");
+}
+
+function isCursorGatewayHostname(hostname) {
+  const h = String(hostname || "").toLowerCase();
+  return isCursorApiHostname(h) || h.endsWith(".cursorvm.com");
+}
+
+/**
+ * @param {string} rawUrl
+ * @param {{ kind?: "gateway" | "backend" }} [opts]
+ * @returns {string} normalized URL without trailing slash
+ */
+export function assertAllowedCredentialUrl(rawUrl, opts = {}) {
+  const kind = opts.kind || "gateway";
+  const label = kind === "backend" ? "backend URL" : "gateway URL";
+  let parsed;
+  try {
+    parsed = new URL(String(rawUrl));
+  } catch {
+    throw new Error("Invalid " + label + ".");
+  }
+
+  if (parsed.username || parsed.password) {
+    throw new Error("Rejected " + label + ": userinfo is not allowed.");
+  }
+
+  if (allowAnyGateway()) {
+    warnOnce(
+      "ALLOW_ANY",
+      "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.",
+    );
+    return String(rawUrl).replace(/\/$/, "");
+  }
+
+  const host = parsed.hostname;
+  const local = isLocalHostname(host);
+
+  if (local) {
+    if (kind === "backend") {
+      throw new Error(
+        "Rejected backend URL host \"" +
+          host +
+          "\". EnsureSandBox backends must be https on *.cursor.sh / *.cursor.com.",
+      );
+    }
+    if (!allowLocalGateway()) {
+      throw new Error(
+        "Rejected " +
+          label +
+          " host \"" +
+          host +
+          "\". Set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 to permit localhost/127.0.0.1 gateways.",
+      );
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("Rejected " + label + ": local gateways must use http or https.");
+    }
+    warnOnce(
+      "ALLOW_LOCAL",
+      "warning: GROK_BOT_ALLOW_LOCAL_GATEWAY is set; credentials may be sent to a loopback gateway.",
+    );
+    return String(rawUrl).replace(/\/$/, "");
+  }
+
+  if (parsed.protocol !== "https:") {
+    throw new Error("Rejected " + label + ": only https is allowed (got " + parsed.protocol + ").");
+  }
+
+  const allowed =
+    kind === "backend" ? isCursorApiHostname(host) : isCursorGatewayHostname(host);
+  if (!allowed) {
+    const expected =
+      kind === "backend"
+        ? "*.cursor.sh / *.cursor.com"
+        : "*.cursor.sh / *.cursor.com / *.cursorvm.com";
+    throw new Error(
+      "Rejected " +
+        label +
+        " host \"" +
+        host +
+        "\". Expected " +
+        expected +
+        ", or set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 / GROK_BOT_ALLOW_ANY_GATEWAY=1.",
+    );
+  }
+
+  return String(rawUrl).replace(/\/$/, "");
+}
+
+/**
+ * Redact common credential shapes from error / log strings.
+ * Covers Bearer/Basic/scheme Authorization values, cookie headers, and named token fields.
+ */
+export function redactSecrets(text) {
+  let s = String(text);
+  // Cookie headers first so a later Authorization pass cannot swallow them.
+  // Stop the value before the next header-shaped token on the same line.
+  s = s.replace(
+    /(^|[\s,{;])((?:set-cookie|cookie)\s*[:=]\s*)([^\n;]+?)(?=\s+(?:set-cookie|cookie|authorization|proxy-authorization)\b|\s*$)/gi,
+    "$1$2<redacted>",
+  );
+  // Scheme + credential only (e.g. "Basic abc", "Bearer xyz") — not the rest of the line.
+  s = s.replace(
+    /(^|[\s,{;])((?:authorization|proxy-authorization)\s*[:=]\s*)(\S+(?:\s+\S+)?)/gi,
+    "$1$2<redacted>",
+  );
+  s = s.replace(/Bearer\s+[A-Za-z0-9._+\/=-]+/gi, "Bearer <redacted>");
+  s = s.replace(
+    /(["']?(?:authorization|gatewayToken|gateway_token|access_token|accessToken|refresh_token|refreshToken|token|x-anyrun-network-token|cookie|set-cookie)["']?\s*[:=]\s*["']?)([^"',\s}]+)/gi,
+    "$1<redacted>",
+  );
+  s = s.replace(/(x-anyrun-network-token\s*[=:]\s*)(\S+)/gi, "$1<redacted>");
+  return s;
+}