grok-bot-cli 0.3.0 → 0.4.0

package/src/store.js

@@ -1,358 +0,0 @@
-import { randomUUID } from "node:crypto";
-import {
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  rmSync,
-  statSync,
-  writeFileSync,
-} from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-export const GROUP_JSON_VERSION = 1;
-export const MAX_GROUP_MEMBERS = 6;
-export const PROFILE_FILE = "profile.json";
-export const GROUP_FILE = "group.json";
-export const SETTINGS_FILE = "settings.json";
-
-export const AVATAR_SHAPES = [
-  "blob",
-  "pebble",
-  "bean",
-  "egg",
-  "squircle",
-  "tablet",
-  "capsule",
-  "cylinder",
-  "hex",
-  "gem",
-  "crystal",
-  "wedge",
-  "shield",
-  "dome",
-  "arch",
-  "cloud",
-  "teardrop",
-  "leaf",
-];
-
-export const AVATAR_COLORS = [
-  "black",
-  "brown",
-  "red",
-  "orange",
-  "yellow",
-  "green",
-  "cyan",
-  "blue",
-  "violet",
-  "magenta",
-  "gray",
-];
-
-const UUID_RE =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
-export class StoreError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "StoreError";
-  }
-}
-
-function readJson(path) {
-  return JSON.parse(readFileSync(path, "utf8"));
-}
-
-function writeJson(path, value) {
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
-}
-
-function isUuid(value) {
-  return UUID_RE.test(value);
-}
-
-export function defaultCandidateRoots() {
-  const home = homedir();
-  const env = [
-    process.env.GROK_BOT_AGENTS_DIR,
-    process.env.SAND_AGENTS_DIR,
-    process.env.SAND_DATA_ROOT && join(process.env.SAND_DATA_ROOT, "agents"),
-    process.env.SAND_DATA_ROOT && join(process.env.SAND_DATA_ROOT, "agent-data", "agents"),
-  ].filter(Boolean);
-
-  return [
-    ...env,
-    "/home/box/agent-data/agents",
-    "/home/box/sand-data/agents",
-    join(home, ".grokbot", "agent-data", "agents"),
-    join(home, ".grokbot", "sand-data", "agents"),
-    join(home, "Library", "Application Support", "Grok Bot", "agent-data", "agents"),
-    join(home, "Library", "Application Support", "Grok Bot", "sand-data", "agents"),
-  ];
-}
-
-export function looksLikeAgentsRoot(dir) {
-  if (!dir || !existsSync(dir) || !statSync(dir).isDirectory()) return false;
-  const entries = readdirSync(dir, { withFileTypes: true });
-  return entries.some(
-    (e) => e.isDirectory() && isUuid(e.name) && existsSync(join(dir, e.name, PROFILE_FILE)),
-  );
-}
-
-export function resolveAgentsRoot(explicit) {
-  if (explicit) {
-    mkdirSync(explicit, { recursive: true });
-    return explicit;
-  }
-  for (const candidate of defaultCandidateRoots()) {
-    if (looksLikeAgentsRoot(candidate)) return candidate;
-  }
-  throw new StoreError(
-    "Could not find a Grok Bot agents directory. Pass --dir or set GROK_BOT_AGENTS_DIR.\nThe macOS app keeps the live roster on its cloud computer (agent-data/agents), not in ~/Library/Application Support/Grok Bot.",
-  );
-}
-
-function readProfile(dir) {
-  const path = join(dir, PROFILE_FILE);
-  if (!existsSync(path)) return null;
-  const raw = readJson(path);
-  return {
-    name: String(raw.name ?? ""),
-    description: String(raw.description ?? ""),
-    title: String(raw.title ?? ""),
-    avatarShape: String(raw.avatarShape ?? ""),
-    avatarColor: String(raw.avatarColor ?? ""),
-  };
-}
-
-function readGroup(dir) {
-  const path = join(dir, GROUP_FILE);
-  if (!existsSync(path)) return null;
-  const raw = readJson(path);
-  const memberIds = Array.isArray(raw.memberIds) ? raw.memberIds.map(String) : [];
-  return {
-    version: Number(raw.version ?? GROUP_JSON_VERSION),
-    memberIds,
-  };
-}
-
-function readRawSettings(dir) {
-  const path = join(dir, SETTINGS_FILE);
-  if (!existsSync(path)) return {};
-  try {
-    const raw = readJson(path);
-    return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-  } catch {
-    return {};
-  }
-}
-
-function readSettings(dir) {
-  const raw = readRawSettings(dir);
-  return {
-    notifyOnAgentUpdates: typeof raw.notifyOnAgentUpdates === "boolean" ? raw.notifyOnAgentUpdates : true,
-    hiddenFromSidebar: typeof raw.hiddenFromSidebar === "boolean" ? raw.hiddenFromSidebar : false,
-  };
-}
-
-export function listRecords(root) {
-  if (!existsSync(root)) return [];
-  const out = [];
-  for (const entry of readdirSync(root, { withFileTypes: true })) {
-    if (!entry.isDirectory() || !isUuid(entry.name)) continue;
-    const dir = join(root, entry.name);
-    const profile = readProfile(dir);
-    if (!profile) continue;
-    const group = readGroup(dir);
-    out.push({
-      id: entry.name,
-      path: dir,
-      ...profile,
-      ...readSettings(dir),
-      isGroup: group != null,
-      memberIds: group?.memberIds ?? [],
-    });
-  }
-  return out.sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id));
-}
-
-export function resolveRef(root, ref) {
-  const records = listRecords(root);
-  if (isUuid(ref)) {
-    const exact = records.find((r) => r.id.toLowerCase() === ref.toLowerCase());
-    if (!exact) throw new StoreError(`No bot or group with id ${ref}`);
-    return exact;
-  }
-  const needle = ref.trim().toLowerCase();
-  const matches = records.filter(
-    (r) => r.name.toLowerCase() === needle || r.title.toLowerCase() === needle,
-  );
-  if (matches.length === 1) return matches[0];
-  if (matches.length === 0) throw new StoreError(`No bot or group named "${ref}"`);
-  throw new StoreError(
-    `Ambiguous name "${ref}": ${matches.map((m) => `${m.name} (${m.id})`).join(", ")}`,
-  );
-}
-
-function assertAvatar(kind, value, allowed) {
-  const trimmed = (value ?? "").trim();
-  if (!trimmed) return "";
-  if (!allowed.includes(trimmed)) {
-    throw new StoreError(`Unknown avatar ${kind} "${value}". Use: ${allowed.join(" ")}`);
-  }
-  return trimmed;
-}
-
-function writeProfile(dir, profile) {
-  writeJson(join(dir, PROFILE_FILE), {
-    name: profile.name.trim(),
-    description: (profile.description ?? "").trim(),
-    title: (profile.title ?? "").trim(),
-    avatarShape: assertAvatar("shape", profile.avatarShape, AVATAR_SHAPES),
-    avatarColor: assertAvatar("color", profile.avatarColor, AVATAR_COLORS),
-  });
-}
-
-function writeSettings(dir) {
-  writeJson(join(dir, SETTINGS_FILE), { notifyOnAgentUpdates: true });
-}
-
-function mergeSettings(dir, patch) {
-  const update = {};
-  if (patch.notifyOnAgentUpdates !== undefined) update.notifyOnAgentUpdates = Boolean(patch.notifyOnAgentUpdates);
-  if (patch.hiddenFromSidebar !== undefined) update.hiddenFromSidebar = Boolean(patch.hiddenFromSidebar);
-  if (Object.keys(update).length === 0) return;
-  writeJson(join(dir, SETTINGS_FILE), { ...readRawSettings(dir), ...update });
-}
-
-function writeGroup(dir, memberIds) {
-  writeJson(join(dir, GROUP_FILE), {
-    version: GROUP_JSON_VERSION,
-    memberIds,
-  });
-}
-
-function normalizeMemberIds(root, memberRefs) {
-  const records = listRecords(root);
-  const groups = new Set(records.filter((r) => r.isGroup).map((r) => r.id));
-  const resolved = [];
-  const seen = new Set();
-  for (const ref of memberRefs) {
-    const rec = resolveRef(root, ref);
-    if (groups.has(rec.id)) {
-      throw new StoreError(`Cannot add group "${rec.name}" as a member. Nested groups are not allowed.`);
-    }
-    if (seen.has(rec.id)) continue;
-    seen.add(rec.id);
-    resolved.push(rec.id);
-  }
-  if (resolved.length > MAX_GROUP_MEMBERS) {
-    throw new StoreError(`A group can have at most ${MAX_GROUP_MEMBERS} members.`);
-  }
-  return resolved;
-}
-
-export function createAgent(root, input) {
-  const name = (input.name ?? "").trim();
-  if (!name) throw new StoreError("Name is required.");
-  const id = randomUUID();
-  const dir = join(root, id);
-  mkdirSync(dir, { recursive: true });
-  mkdirSync(join(dir, "memory"), { recursive: true });
-  mkdirSync(join(dir, "automations"), { recursive: true });
-  writeProfile(dir, {
-    name,
-    description: input.description ?? "",
-    title: input.title ?? "",
-    avatarShape: input.avatarShape ?? "",
-    avatarColor: input.avatarColor ?? "",
-  });
-  writeSettings(dir);
-  return resolveRef(root, id);
-}
-
-export function updateAgent(root, ref, patch = {}) {
-  const rec = resolveRef(root, ref);
-  if (patch.name !== undefined) {
-    const name = String(patch.name).trim();
-    if (!name) throw new StoreError("Name cannot be blank.");
-  }
-  const hasProfile =
-    patch.name !== undefined ||
-    patch.description !== undefined ||
-    patch.title !== undefined ||
-    patch.avatarShape !== undefined ||
-    patch.avatarColor !== undefined;
-  if (hasProfile) {
-    writeProfile(rec.path, {
-      name: patch.name !== undefined ? String(patch.name) : rec.name,
-      description: patch.description !== undefined ? String(patch.description) : rec.description,
-      title: patch.title !== undefined ? String(patch.title) : rec.title,
-      avatarShape: patch.avatarShape !== undefined ? String(patch.avatarShape) : rec.avatarShape,
-      avatarColor: patch.avatarColor !== undefined ? String(patch.avatarColor) : rec.avatarColor,
-    });
-  }
-  mergeSettings(rec.path, patch);
-  return resolveRef(root, rec.id);
-}
-
-export function deleteAgent(root, ref) {
-  const rec = resolveRef(root, ref);
-  rmSync(rec.path, { recursive: true, force: true });
-  for (const other of listRecords(root).filter((r) => r.isGroup)) {
-    if (!other.memberIds.includes(rec.id)) continue;
-    writeGroup(
-      other.path,
-      other.memberIds.filter((id) => id !== rec.id),
-    );
-  }
-  return rec;
-}
-
-export function createGroup(root, input) {
-  const memberIds = normalizeMemberIds(root, input.memberIds ?? []);
-  if (memberIds.length === 0) {
-    throw new StoreError("A group needs at least one existing member agent.");
-  }
-  const existing = listRecords(root).find(
-    (r) =>
-      r.isGroup &&
-      r.memberIds.length === memberIds.length &&
-      r.memberIds.every((id) => memberIds.includes(id)),
-  );
-  if (existing) return existing;
-  const group = createAgent(root, {
-    name: input.name,
-    description: input.description ?? "",
-    title: input.title ?? "",
-    avatarShape: input.avatarShape ?? "",
-    avatarColor: input.avatarColor ?? "",
-  });
-  writeGroup(join(root, group.id), memberIds);
-  return resolveRef(root, group.id);
-}
-
-export function setGroupMembers(root, groupRef, memberRefs) {
-  const group = resolveRef(root, groupRef);
-  if (!group.isGroup) throw new StoreError(`"${group.name}" is a bot, not a group.`);
-  const memberIds = normalizeMemberIds(root, memberRefs);
-  if (memberIds.length === 0) {
-    throw new StoreError("A group needs at least one existing member agent.");
-  }
-  writeGroup(group.path, memberIds);
-  return resolveRef(root, group.id);
-}
-
-export function addGroupMember(root, groupRef, memberRef) {
-  const group = resolveRef(root, groupRef);
-  return setGroupMembers(root, group.id, [...group.memberIds, memberRef]);
-}
-
-export function removeGroupMember(root, groupRef, memberRef) {
-  const group = resolveRef(root, groupRef);
-  const member = resolveRef(root, memberRef);
-  return setGroupMembers(root, group.id, group.memberIds.filter((id) => id !== member.id));
-}

package/src/transcript.js

@@ -1,50 +0,0 @@
-// Shared by `gbot thread` and the grok-bot plugin's gbot_thread tool.
-
-/** Coerce anything to a string without throwing (numbers, BigInt, unserializable objects). */
-export function toSafeText(value) {
-  if (typeof value === "string") return value;
-  if (value == null) return "";
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
-  try {
-    const out = JSON.stringify(value);
-    return typeof out === "string" ? out : "";
-  } catch {
-    return "[unserializable]";
-  }
-}
-
-/** Coerce to string and replace lone surrogates so downstream slicing/JSON never breaks. */
-export function normalizeText(value) {
-  return toSafeText(value).replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, "\uFFFD");
-}
-
-export function entryText(e) {
-  return normalizeText(entryTextRaw(e));
-}
-
-function entryTextRaw(e) {
-  if (!e || typeof e !== "object") return "";
-  // Prefer full body fields over `preview` (often truncated for list UIs).
-  const direct = e.text || e.prompt || e.message;
-  if (typeof direct === "string" && direct) return direct;
-  const content = e.content;
-  if (typeof content === "string") return content;
-  if (Array.isArray(content)) {
-    return content.map((part) => {
-      if (typeof part === "string") return part;
-      if (part && typeof part === "object") return part.text || part.content || "";
-      return "";
-    }).filter(Boolean).join("\n");
-  }
-  if (content && typeof content === "object") return content.text || toSafeText(content);
-  // Bot replies arrive as `{ kind: "send-message", message: { type, content } }`.
-  if (e.message && typeof e.message === "object" && typeof e.message.content === "string") return e.message.content;
-  return typeof e.preview === "string" ? e.preview : "";
-}
-
-export function transcriptEntries(payload) {
-  if (Array.isArray(payload)) return payload;
-  if (!payload || typeof payload !== "object") return [];
-  const entries = payload.entries || payload.messages || payload.items;
-  return Array.isArray(entries) ? entries : [];
-}

package/src/url-policy.js

@@ -1,161 +0,0 @@
-/**
- * Gateway / backend URL policy: only send credentials to expected hosts.
- *
- * Gateway (box + API): https on *.cursor.sh / *.cursor.com (and apex) /
- * *.cursorvm.com (EnsureSandBox box hosts, e.g. <id>-pod-<id>.us12.cursorvm.com).
- * Backend (EnsureSandBox / Cursor API): https on *.cursor.sh / *.cursor.com only —
- * never *.cursorvm.com, so a CURSOR_ACCESS_TOKEN cannot be pointed at a box host.
- * Local/dev gateways: http(s)://127.0.0.1|localhost|::1 when GROK_BOT_ALLOW_LOCAL_GATEWAY=1.
- * Escape hatch: GROK_BOT_ALLOW_ANY_GATEWAY=1 (unsafe; disables host checks; warns once).
- */
-
-function truthyEnv(name) {
-  const v = (process.env[name] || "").trim().toLowerCase();
-  return v === "1" || v === "true" || v === "yes";
-}
-
-export function allowAnyGateway() {
-  return truthyEnv("GROK_BOT_ALLOW_ANY_GATEWAY");
-}
-
-export function allowLocalGateway() {
-  return truthyEnv("GROK_BOT_ALLOW_LOCAL_GATEWAY");
-}
-
-const warned = new Set();
-
-function warnOnce(key, message) {
-  if (warned.has(key)) return;
-  warned.add(key);
-  process.stderr.write(message + "\n");
-}
-
-/** Test hook: clear the one-shot warn set. */
-export function resetPolicyWarnings() {
-  warned.clear();
-}
-
-function isLocalHostname(hostname) {
-  const h = String(hostname || "").toLowerCase().replace(/^\[|\]$/g, "");
-  return h === "localhost" || h === "127.0.0.1" || h === "::1";
-}
-
-function isCursorApiHostname(hostname) {
-  const h = String(hostname || "").toLowerCase();
-  if (!h) return false;
-  if (h === "cursor.sh" || h === "cursor.com") return true;
-  return h.endsWith(".cursor.sh") || h.endsWith(".cursor.com");
-}
-
-function isCursorGatewayHostname(hostname) {
-  const h = String(hostname || "").toLowerCase();
-  return isCursorApiHostname(h) || h.endsWith(".cursorvm.com");
-}
-
-/**
- * @param {string} rawUrl
- * @param {{ kind?: "gateway" | "backend" }} [opts]
- * @returns {string} normalized URL without trailing slash
- */
-export function assertAllowedCredentialUrl(rawUrl, opts = {}) {
-  const kind = opts.kind || "gateway";
-  const label = kind === "backend" ? "backend URL" : "gateway URL";
-  let parsed;
-  try {
-    parsed = new URL(String(rawUrl));
-  } catch {
-    throw new Error("Invalid " + label + ".");
-  }
-
-  if (parsed.username || parsed.password) {
-    throw new Error("Rejected " + label + ": userinfo is not allowed.");
-  }
-
-  if (allowAnyGateway()) {
-    warnOnce(
-      "ALLOW_ANY",
-      "warning: GROK_BOT_ALLOW_ANY_GATEWAY is set; credential host checks are disabled.",
-    );
-    return String(rawUrl).replace(/\/$/, "");
-  }
-
-  const host = parsed.hostname;
-  const local = isLocalHostname(host);
-
-  if (local) {
-    if (kind === "backend") {
-      throw new Error(
-        "Rejected backend URL host \"" +
-          host +
-          "\". EnsureSandBox backends must be https on *.cursor.sh / *.cursor.com.",
-      );
-    }
-    if (!allowLocalGateway()) {
-      throw new Error(
-        "Rejected " +
-          label +
-          " host \"" +
-          host +
-          "\". Set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 to permit localhost/127.0.0.1 gateways.",
-      );
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new Error("Rejected " + label + ": local gateways must use http or https.");
-    }
-    warnOnce(
-      "ALLOW_LOCAL",
-      "warning: GROK_BOT_ALLOW_LOCAL_GATEWAY is set; credentials may be sent to a loopback gateway.",
-    );
-    return String(rawUrl).replace(/\/$/, "");
-  }
-
-  if (parsed.protocol !== "https:") {
-    throw new Error("Rejected " + label + ": only https is allowed (got " + parsed.protocol + ").");
-  }
-
-  const allowed =
-    kind === "backend" ? isCursorApiHostname(host) : isCursorGatewayHostname(host);
-  if (!allowed) {
-    const expected =
-      kind === "backend"
-        ? "*.cursor.sh / *.cursor.com"
-        : "*.cursor.sh / *.cursor.com / *.cursorvm.com";
-    throw new Error(
-      "Rejected " +
-        label +
-        " host \"" +
-        host +
-        "\". Expected " +
-        expected +
-        ", or set GROK_BOT_ALLOW_LOCAL_GATEWAY=1 / GROK_BOT_ALLOW_ANY_GATEWAY=1.",
-    );
-  }
-
-  return String(rawUrl).replace(/\/$/, "");
-}
-
-/**
- * Redact common credential shapes from error / log strings.
- * Covers Bearer/Basic/scheme Authorization values, cookie headers, and named token fields.
- */
-export function redactSecrets(text) {
-  let s = String(text);
-  // Cookie headers first so a later Authorization pass cannot swallow them.
-  // Stop the value before the next header-shaped token on the same line.
-  s = s.replace(
-    /(^|[\s,{;])((?:set-cookie|cookie)\s*[:=]\s*)([^\n;]+?)(?=\s+(?:set-cookie|cookie|authorization|proxy-authorization)\b|\s*$)/gi,
-    "$1$2<redacted>",
-  );
-  // Scheme + credential only (e.g. "Basic abc", "Bearer xyz") — not the rest of the line.
-  s = s.replace(
-    /(^|[\s,{;])((?:authorization|proxy-authorization)\s*[:=]\s*)(\S+(?:\s+\S+)?)/gi,
-    "$1$2<redacted>",
-  );
-  s = s.replace(/Bearer\s+[A-Za-z0-9._+\/=-]+/gi, "Bearer <redacted>");
-  s = s.replace(
-    /(["']?(?:authorization|gatewayToken|gateway_token|access_token|accessToken|refresh_token|refreshToken|token|x-anyrun-network-token|cookie|set-cookie)["']?\s*[:=]\s*["']?)([^"',\s}]+)/gi,
-    "$1<redacted>",
-  );
-  s = s.replace(/(x-anyrun-network-token\s*[=:]\s*)(\S+)/gi, "$1<redacted>");
-  return s;
-}