grok-bot-cli 0.2.3 → 0.3.1

package/src/gateway.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { ensureSandboxHeaders, headersFromEnsureSandbox, headersFromEnv, mergeGatewayHeaders, normalizeHeaderMap, requestHeaders } from "./headers.js";
 import { hasGrokBotGatewaySession, loadGrokBotGatewaySession } from "./app-session.js";
-import { AVATAR_COLORS, AVATAR_SHAPES } from "./store.js";
+import { AVATAR_COLORS, AVATAR_SHAPES, MAX_GROUP_MEMBERS } from "./store.js";
+import { assertAllowedCredentialUrl, redactSecrets } from "./url-policy.js";
 
 export class GatewayError extends Error {
   constructor(message, { status, method } = {}) {
@@ -12,6 +13,10 @@ export class GatewayError extends Error {
   }
 }
 
+// ponytail: fixed 30 s deadline and buffered byte cap; upgrade path is per-method budgets plus streaming reads.
+export const GATEWAY_TIMEOUT_MS = 30000;
+export const GATEWAY_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+
 function backendBase() {
   return (
     process.env.SAND_BACKEND_URL ||
@@ -45,15 +50,29 @@ function gatewayOverride() {
     ? "http://127.0.0.1:" + (process.env.SAND_HOST_PORT || "1340")
     : "";
   const url = explicitUrl || localUrl;
-  if (url && token) return { gatewayUrl: url.replace(/\/$/, ""), gatewayToken: token, gatewayHeaders: headersFromEnv() };
+  if (url && token) {
+    return {
+      gatewayUrl: assertAllowedCredentialUrl(url.replace(/\/$/, ""), { kind: "gateway" }),
+      gatewayToken: token,
+      gatewayHeaders: headersFromEnv(),
+    };
+  }
   return null;
 }
 
 function sessionFromApp() {
-  const loaded = loadGrokBotGatewaySession();
+  let loaded;
+  try {
+    loaded = loadGrokBotGatewaySession();
+  } catch (error) {
+    // Descriptor present but unusable (e.g. Windows Local State missing). Fall
+    // through to CURSOR_ACCESS_TOKEN → EnsureSandBox when that token is set.
+    if (accessTokenFromEnv()) return null;
+    throw error instanceof Error ? new GatewayError(error.message) : error;
+  }
   if (!loaded) return null;
   return {
-    gatewayUrl: loaded.gatewayUrl,
+    gatewayUrl: assertAllowedCredentialUrl(loaded.gatewayUrl, { kind: "gateway" }),
     gatewayToken: loaded.gatewayToken,
     gatewayHeaders: mergeGatewayHeaders(normalizeHeaderMap(loaded.headers), headersFromEnv()),
   };
@@ -63,8 +82,32 @@ export function hasGatewayAuth() {
   return Boolean(gatewayOverride() || accessTokenFromEnv() || hasGrokBotGatewaySession());
 }
 
+async function readTextCapped(res, maxBytes) {
+  if (!res.body || typeof res.body.getReader !== "function") {
+    const text = await res.text();
+    if (Buffer.byteLength(text, "utf8") > maxBytes) {
+      throw new GatewayError("Gateway response too large (over " + maxBytes + " bytes)");
+    }
+    return text;
+  }
+  const reader = res.body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    bytes += value.byteLength ?? value.length;
+    if (bytes > maxBytes) {
+      try { await reader.cancel(); } catch { /* already closed */ }
+      throw new GatewayError("Gateway response too large (over " + maxBytes + " bytes)");
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks.map((c) => Buffer.from(c.buffer ?? c, c.byteOffset ?? 0, c.byteLength ?? c.length))).toString("utf8");
+}
+
 async function readJson(res) {
-  const text = await res.text();
+  const text = await readTextCapped(res, GATEWAY_MAX_RESPONSE_BYTES);
   if (!text) return {};
   try {
     return JSON.parse(text);
@@ -82,23 +125,25 @@ function pick(obj, ...keys) {
 }
 
 export async function ensureSandbox(accessToken) {
-  const url = backendBase() + "/aiserver.v1.GrokBotService/EnsureSandBox";
+  const url = assertAllowedCredentialUrl(backendBase(), { kind: "backend" }) + "/aiserver.v1.GrokBotService/EnsureSandBox";
   const res = await fetch(url, {
     method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(GATEWAY_TIMEOUT_MS),
     headers: ensureSandboxHeaders(accessToken),
     body: "{}",
   });
   const body = await readJson(res);
   if (!res.ok) {
     const detail = body.message || body.error || body.raw || res.statusText;
-    throw new GatewayError("EnsureSandBox failed: " + res.status + " " + detail, { status: res.status, method: "EnsureSandBox" });
+    throw new GatewayError("EnsureSandBox failed: " + res.status + " " + redactSecrets(detail), { status: res.status, method: "EnsureSandBox" });
   }
   const gatewayUrl = pick(body, "gatewayUrl", "gateway_url");
   const gatewayToken = pick(body, "gatewayToken", "gateway_token");
   if (!gatewayUrl || !gatewayToken) {
     throw new GatewayError("EnsureSandBox returned no gatewayUrl/gatewayToken. Auth may be a dashboard API key (those do not work).");
   }
-  return { gatewayUrl: String(gatewayUrl).replace(/\/$/, ""), gatewayToken: String(gatewayToken), gatewayHeaders: mergeGatewayHeaders(headersFromEnsureSandbox(body), headersFromEnv()) };
+  return { gatewayUrl: assertAllowedCredentialUrl(String(gatewayUrl).replace(/\/$/, ""), { kind: "gateway" }), gatewayToken: String(gatewayToken), gatewayHeaders: mergeGatewayHeaders(headersFromEnsureSandbox(body), headersFromEnv()) };
 }
 
 export async function connectGateway() {
@@ -114,16 +159,19 @@ export async function connectGateway() {
 }
 
 export async function gatewayCall(session, method, body = {}) {
-  const url = session.gatewayUrl + "/api/" + method;
+  const base = assertAllowedCredentialUrl(session.gatewayUrl, { kind: "gateway" });
+  const url = base + "/api/" + method;
   const res = await fetch(url, {
     method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(GATEWAY_TIMEOUT_MS),
     headers: requestHeaders(session),
     body: JSON.stringify(body),
   });
   const data = await readJson(res);
   if (!res.ok) {
     const detail = data.message || data.error || data.raw || res.statusText;
-    throw new GatewayError(method + " failed: " + res.status + " " + String(detail).slice(0, 300), { status: res.status, method });
+    throw new GatewayError(method + " failed: " + res.status + " " + redactSecrets(String(detail).slice(0, 300)), { status: res.status, method });
   }
   return data;
 }
@@ -228,9 +276,27 @@ export async function deleteAgent(session, ref) {
   return rec;
 }
 
+function normalizeMemberIds(records, memberRefs) {
+  const memberIds = new Set();
+  for (const ref of memberRefs) {
+    const rec = resolveFromList(records, ref);
+    if (rec.isGroup) {
+      throw new GatewayError(`Cannot add group "${rec.name}" as a member. Nested groups are not allowed.`);
+    }
+    memberIds.add(rec.id);
+  }
+  if (memberIds.size === 0) {
+    throw new GatewayError("A group needs at least one existing member agent.");
+  }
+  if (memberIds.size > MAX_GROUP_MEMBERS) {
+    throw new GatewayError(`A group can have at most ${MAX_GROUP_MEMBERS} members.`);
+  }
+  return [...memberIds];
+}
+
 export async function createGroup(session, input) {
   const records = await listAgents(session);
-  const memberAgentIds = (input.memberIds || []).map((ref) => resolveFromList(records, ref).id);
+  const memberAgentIds = normalizeMemberIds(records, input.memberIds || []);
   const data = await gatewayCall(session, "createGroup", {
     name: input.name,
     description: input.description || "",
@@ -248,7 +314,8 @@ export async function createGroup(session, input) {
 export async function setGroupMembers(session, groupRef, memberRefs) {
   const records = await listAgents(session);
   const group = resolveFromList(records, groupRef);
-  const memberAgentIds = memberRefs.map((ref) => resolveFromList(records, ref).id);
+  if (!group.isGroup) throw new GatewayError(`"${group.name}" is a bot, not a group.`);
+  const memberAgentIds = normalizeMemberIds(records, memberRefs);
   const data = await gatewayCall(session, "setGroupMembers", {
     id: group.id,
     memberAgentIds,
@@ -259,6 +326,7 @@ export async function setGroupMembers(session, groupRef, memberRefs) {
 export async function addGroupMember(session, groupRef, memberRef) {
   const records = await listAgents(session);
   const group = resolveFromList(records, groupRef);
+  if (!group.isGroup) throw new GatewayError(`"${group.name}" is a bot, not a group.`);
   const member = resolveFromList(records, memberRef);
   const next = [...new Set([...group.memberIds, member.id])];
   return setGroupMembers(session, group.id, next);
@@ -267,6 +335,7 @@ export async function addGroupMember(session, groupRef, memberRef) {
 export async function removeGroupMember(session, groupRef, memberRef) {
   const records = await listAgents(session);
   const group = resolveFromList(records, groupRef);
+  if (!group.isGroup) throw new GatewayError(`"${group.name}" is a bot, not a group.`);
   const member = resolveFromList(records, memberRef);
   const next = group.memberIds.filter((id) => id !== member.id);
   return setGroupMembers(session, group.id, next);
@@ -280,13 +349,31 @@ export async function sendPrompt(session, ref, prompt, extra = {}) {
     clientNonce: extra.clientNonce || randomUUID(),
   };
   if (extra.replyToId) body.replyToId = extra.replyToId;
-  const data = await gatewayCall(session, "sendPrompt", body);
-  return { target: rec, result: data };
+  let data;
+  try {
+    data = await gatewayCall(session, "sendPrompt", body);
+  } catch (err) {
+    // Delivery states: the server answered no (rejected) vs the request may have landed (unknown).
+    // Never retry an unknown delivery blindly; read the thread first.
+    if (err && err.delivery == null) {
+      err.delivery = err instanceof GatewayError && err.status != null && err.status < 500 ? "rejected" : "unknown";
+    }
+    if (err && err.targetId == null) err.targetId = rec.id;
+    if (err && err.delivery === "unknown" && err instanceof Error && !/delivery unknown/.test(err.message)) {
+      err.message += " (delivery unknown; check the thread before resending)";
+    }
+    throw err;
+  }
+  const messageId = data && typeof data === "object" && typeof data.messageId === "string" ? data.messageId : null;
+  // Only a confirmed receipt counts as accepted; anything else is unknown, never a silent accept.
+  // ponytail: full send/execution correlation envelope stays in #37.
+  return { target: rec, result: data && typeof data === "object" ? data : {}, delivery: messageId ? "accepted" : "unknown", ...(messageId ? { messageId } : {}) };
 }
 
-export async function getTranscriptTail(session, ref, limit = 50) {
+export async function getTranscriptTail(session, ref, limit = 40) {
   const rec = await resolveRef(session, ref);
-  const data = await gatewayCall(session, "getAgentTranscriptTail", { id: rec.id, limit });
+  const bounded = Math.min(Math.max(Math.trunc(limit) || 40, 1), 200);
+  const data = await gatewayCall(session, "getAgentTranscriptTail", { id: rec.id, limit: bounded });
   return { target: rec, transcript: data };
 }
 

package/src/history.js

@@ -0,0 +1,83 @@
+import { appendFileSync, closeSync, constants, createReadStream, fstatSync, mkdirSync, openSync, readSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { createInterface } from "node:readline";
+import { entryText, transcriptEntries } from "./transcript.js";
+
+export function historyPath(dir) {
+  return join(resolve(dir || process.env.GROK_BOT_HISTORY_DIR || join(homedir(), ".grok-bot-cli")), "history.jsonl");
+}
+
+// Keep only conversation fields, never gateway responses, session credentials or bot instructions.
+export function saveHistory(out, { dir, disabled, event, prompt, rootId } = {}) {
+  // Opt-in only: plaintext local history stays off unless GROK_BOT_HISTORY=on (or true/1).
+  if (disabled || !/^(on|true|1)$/i.test(process.env.GROK_BOT_HISTORY || "")) return;
+  try {
+    const recordedAt = new Date().toISOString();
+    const target = { id: out.target.id, name: out.target.name, kind: out.target.isGroup ? "group" : "bot" };
+    const payload = out.transcript || out.thread || out;
+    const entries = event === "send" ? [{ role: "user", text: prompt }] : transcriptEntries(payload);
+    const rows = entries.map((entry) => ({
+      version: 1,
+      recordedAt,
+      event,
+      target,
+      ...(rootId ? { rootId } : {}),
+      role: String(entry.role || entry.kind || entry.sender || entry.type || "msg"),
+      ...(entry.id || entry.messageId ? { messageId: String(entry.id || entry.messageId) } : {}),
+      ...(entry.timestamp || entry.createdAt ? { timestamp: String(entry.timestamp || entry.createdAt) } : {}),
+      text: entryText(entry),
+    }));
+    if (!rows.length) return;
+    const path = historyPath(dir);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const fd = openSync(path, constants.O_CREAT | constants.O_APPEND | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+    try {
+      // Separate a previous interrupted append from the next complete record.
+      const size = fstatSync(fd).size;
+      const last = Buffer.alloc(1);
+      if (size) readSync(fd, last, 0, 1, size - 1);
+      const prefix = size && last[0] !== 10 ? "\n" : "";
+      appendFileSync(fd, prefix + rows.map((row) => JSON.stringify(row)).join("\n") + "\n");
+    } finally {
+      closeSync(fd);
+    }
+  } catch {
+    // A successful remote send must not look failed and invite an accidental resend.
+    process.stderr.write("Warning: could not save local history. Check the history directory and permissions.\n");
+  }
+}
+
+export async function readHistory(path, { ref, search, limit = 40 } = {}) {
+  const rows = [];
+  let malformed = 0;
+  const input = createReadStream(path, { encoding: "utf8" });
+  const lines = createInterface({ input, crlfDelay: Infinity });
+  try {
+    for await (const line of lines) {
+      if (!line.trim()) continue;
+      let row;
+      try {
+        row = JSON.parse(line);
+        if (row?.version !== 1 || typeof row.text !== "string" || typeof row.role !== "string" ||
+            typeof row.recordedAt !== "string" || typeof row.target?.id !== "string" || typeof row.target?.name !== "string") {
+          throw new Error("Invalid history record");
+        }
+      } catch {
+        malformed++;
+        continue;
+      }
+      if (ref && row.target.id !== ref && row.target.name.toLowerCase() !== ref.toLowerCase()) continue;
+      if (search !== undefined && !row.text.toLowerCase().includes(search.toLowerCase())) continue;
+      rows.push(row);
+      if (rows.length > limit) rows.shift();
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  } finally {
+    lines.close();
+    input.destroy();
+  }
+  if (malformed) process.stderr.write("Warning: skipped " + malformed + " malformed local history record(s).\n");
+  return rows;
+}

package/src/transcript.js

@@ -0,0 +1,50 @@
+// Shared by `gbot thread` and the grok-bot plugin's gbot_thread tool.
+
+/** Coerce anything to a string without throwing (numbers, BigInt, unserializable objects). */
+export function toSafeText(value) {
+  if (typeof value === "string") return value;
+  if (value == null) return "";
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
+  try {
+    const out = JSON.stringify(value);
+    return typeof out === "string" ? out : "";
+  } catch {
+    return "[unserializable]";
+  }
+}
+
+/** Coerce to string and replace lone surrogates so downstream slicing/JSON never breaks. */
+export function normalizeText(value) {
+  return toSafeText(value).replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "\uFFFD");
+}
+
+export function entryText(e) {
+  return normalizeText(entryTextRaw(e));
+}
+
+function entryTextRaw(e) {
+  if (!e || typeof e !== "object") return "";
+  // Prefer full body fields over `preview` (often truncated for list UIs).
+  const direct = e.text || e.prompt || e.message;
+  if (typeof direct === "string" && direct) return direct;
+  const content = e.content;
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((part) => {
+      if (typeof part === "string") return part;
+      if (part && typeof part === "object") return part.text || part.content || "";
+      return "";
+    }).filter(Boolean).join("\n");
+  }
+  if (content && typeof content === "object") return content.text || toSafeText(content);
+  // Bot replies arrive as `{ kind: "send-message", message: { type, content } }`.
+  if (e.message && typeof e.message === "object" && typeof e.message.content === "string") return e.message.content;
+  return typeof e.preview === "string" ? e.preview : "";
+}
+
+export function transcriptEntries(payload) {
+  if (Array.isArray(payload)) return payload;
+  if (!payload || typeof payload !== "object") return [];
+  const entries = payload.entries || payload.messages || payload.items;
+  return Array.isArray(entries) ? entries : [];
+}

package/src/url-policy.js

@@ -0,0 +1,161 @@
+/**
+ * Gateway / backend URL policy: only send credentials to expected hosts.
+ *
+ * Gateway (box + API): https on *.cursor.sh / *.cursor.com (and apex) /
+ * *.cursorvm.com (EnsureSandBox box hosts, e.g. <id>-pod-<id>.us12.cursorvm.com).
+ * Backend (EnsureSandBox / Cursor API): https on *.cursor.sh / *.cursor.com only —
+ * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
+ * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
+ * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
+ */
+
+function truthyEnv(name) {
+  const v = (process.env[name] || "").trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+
+export function allowAnyGateway() {
+  return truthyEnv("GROK_BOT_ALLOW_ANY_GATEWAY");
+}
+
+export function allowLocalGateway() {
+  return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
+}
+
+const warned = new Set();
+
+function warnOnce(key, message) {
+  if (warned.has(key)) return;
+  warned.add(key);
+  process.stderr.write(message + "\n");
+}
+
+/** Test hook: clear the one-shot warn set. */
+export function resetPolicyWarnings() {
+  warned.clear();
+}
+
+function isLocalHostname(hostname) {
+  const h = String(hostname || "").toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "localhost" || h === "127.0.0.1" || h === "::1";
+}
+
+function isCursorApiHostname(hostname) {
+  const h = String(hostname || "").toLowerCase();
+  if (!h) return false;
+  if (h === "cursor.sh" || h === "cursor.com") return true;
+  return h.endsWith(".cursor.sh") || h.endsWith(".cursor.com");
+}
+
+function isCursorGatewayHostname(hostname) {
+  const h = String(hostname || "").toLowerCase();
+  return isCursorApiHostname(h) || h.endsWith(".cursorvm.com");
+}
+
+/**
+ * @param {string} rawUrl
+ * @param {{ kind?: "gateway" | "backend" }} [opts]
+ * @returns {string} normalized URL without trailing slash
+ */
+export function assertAllowedCredentialUrl(rawUrl, opts = {}) {
+  const kind = opts.kind || "gateway";
+  const label = kind === "backend" ? "backend URL" : "gateway URL";
+  let parsed;
+  try {
+    parsed = new URL(String(rawUrl));
+  } catch {
+    throw new Error("Invalid " + label + ".");
+  }
+
+  if (parsed.username || parsed.password) {
+    throw new Error("Rejected " + label + ": userinfo is not allowed.");
+  }
+
+  if (allowAnyGateway()) {
+    warnOnce(
+      "ALLOW_ANY",
+      "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.",
+    );
+    return String(rawUrl).replace(/\/$/, "");
+  }
+
+  const host = parsed.hostname;
+  const local = isLocalHostname(host);
+
+  if (local) {
+    if (kind === "backend") {
+      throw new Error(
+        "Rejected backend URL host \"" +
+          host +
+          "\". EnsureSandBox backends must be https on *.cursor.sh / *.cursor.com.",
+      );
+    }
+    if (!allowLocalGateway()) {
+      throw new Error(
+        "Rejected " +
+          label +
+          " host \"" +
+          host +
+          "\". Set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 to permit localhost/127.0.0.1 gateways.",
+      );
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("Rejected " + label + ": local gateways must use http or https.");
+    }
+    warnOnce(
+      "ALLOW_LOCAL",
+      "warning: GROK_BOT_ALLOW_LOCAL_GATEWAY is set; credentials may be sent to a loopback gateway.",
+    );
+    return String(rawUrl).replace(/\/$/, "");
+  }
+
+  if (parsed.protocol !== "https:") {
+    throw new Error("Rejected " + label + ": only https is allowed (got " + parsed.protocol + ").");
+  }
+
+  const allowed =
+    kind === "backend" ? isCursorApiHostname(host) : isCursorGatewayHostname(host);
+  if (!allowed) {
+    const expected =
+      kind === "backend"
+        ? "*.cursor.sh / *.cursor.com"
+        : "*.cursor.sh / *.cursor.com / *.cursorvm.com";
+    throw new Error(
+      "Rejected " +
+        label +
+        " host \"" +
+        host +
+        "\". Expected " +
+        expected +
+        ", or set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 / GROK_BOT_ALLOW_ANY_GATEWAY=1.",
+    );
+  }
+
+  return String(rawUrl).replace(/\/$/, "");
+}
+
+/**
+ * Redact common credential shapes from error / log strings.
+ * Covers Bearer/Basic/scheme Authorization values, cookie headers, and named token fields.
+ */
+export function redactSecrets(text) {
+  let s = String(text);
+  // Cookie headers first so a later Authorization pass cannot swallow them.
+  // Stop the value before the next header-shaped token on the same line.
+  s = s.replace(
+    /(^|[\s,{;])((?:set-cookie|cookie)\s*[:=]\s*)([^\n;]+?)(?=\s+(?:set-cookie|cookie|authorization|proxy-authorization)\b|\s*$)/gi,
+    "$1$2<redacted>",
+  );
+  // Scheme + credential only (e.g. "Basic abc", "Bearer xyz") — not the rest of the line.
+  s = s.replace(
+    /(^|[\s,{;])((?:authorization|proxy-authorization)\s*[:=]\s*)(\S+(?:\s+\S+)?)/gi,
+    "$1$2<redacted>",
+  );
+  s = s.replace(/Bearer\s+[A-Za-z0-9._+\/=-]+/gi, "Bearer <redacted>");
+  s = s.replace(
+    /(["']?(?:authorization|gatewayToken|gateway_token|access_token|accessToken|refresh_token|refreshToken|token|x-anyrun-network-token|cookie|set-cookie)["']?\s*[:=]\s*["']?)([^"',\s}]+)/gi,
+    "$1<redacted>",
+  );
+  s = s.replace(/(x-anyrun-network-token\s*[=:]\s*)(\S+)/gi, "$1<redacted>");
+  return s;
+}