linkgravity 1.6.0 → 1.6.1

package/bin/cli.js

@@ -49,6 +49,9 @@ function runPm2(args, silent = true) {
             ...process.env,
             // pm2 gives Python a pipe not a TTY, so it block-buffers stdout and can sit on log lines indefinitely - force line buffering.
             PYTHONUNBUFFERED: '1',
+            // pm2 merges --update-env rather than replacing, so a LOG_LEVEL from an earlier run
+            // survives unless a value is passed every time.
+            LOG_LEVEL: process.env.LOG_LEVEL || 'INFO',
             // Version managers (fnm, nvm) put node on PATH from a shell hook the daemon never runs,
             // so the bot's own `node` lookup for voice-service would fail without this.
             PATH: `${path.dirname(process.execPath)}${path.delimiter}${process.env.PATH || ''}`,
@@ -106,7 +109,7 @@ function runSudoStepThen(sudoCommand, successMessage) {
     }
 }
 
-// Matches a leading timestamp from either loguru or aiohttp's access-log format; only strips the first bracket group so aiohttp's second "[INFO ]" bracket is left alone.
+// Matches a leading timestamp from either loguru or aiohttp's access-log format.
 const TIMESTAMP_PREFIX = /^\[?\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}\]?\s*/;
 // loguru's colorize=True puts an ANSI code before the timestamp digits, breaking the '^' anchor above.
 // eslint-disable-next-line no-control-regex
@@ -390,7 +393,15 @@ if (cmd === 'version' || cmd === '-v' || cmd === '--version') {
     }
 
     info('Starting LinkGravity daemon...');
-    runPm2(['start', LGY_SCRIPT_PATH, '--interpreter', pythonExe, '--name', LGY_PM2_NAME]);
+    runPm2([
+        'start',
+        LGY_SCRIPT_PATH,
+        '--interpreter',
+        pythonExe,
+        '--name',
+        LGY_PM2_NAME,
+        '--update-env',
+    ]);
     verifyStartup().then((ok) => process.exit(ok ? 0 : 1));
 } else if (cmd === 'stop') {
     info('Stopping LinkGravity daemon...');
@@ -616,7 +627,15 @@ if (cmd === 'version' || cmd === '-v' || cmd === '--version') {
 
     if (!procBeforeUpdate) {
         info("Daemon wasn't running - starting it fresh...");
-        runPm2(['start', LGY_SCRIPT_PATH, '--interpreter', pythonExe, '--name', LGY_PM2_NAME]);
+        runPm2([
+            'start',
+            LGY_SCRIPT_PATH,
+            '--interpreter',
+            pythonExe,
+            '--name',
+            LGY_PM2_NAME,
+            '--update-env',
+        ]);
         verifyStartup().then((ok) => process.exit(ok ? 0 : 1));
     } else if (wasOnline) {
         info('Restarting daemon to apply the update...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linkgravity",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Discord/Telegram bot bridge for the Antigravity (agy) CLI, with voice interaction support",
   "scripts": {
     "start": "node npm-scripts/run-dev.js",

package/src/api/ui_routes.py

@@ -7,6 +7,7 @@ import uuid
 from aiohttp import web
 
 from api.server import is_tool_allowed
+from approval.protected_paths import protected_reason
 from config import APPROVAL_TIMEOUT_SEC, MAX_EMBED_LEN, logger, session_manager
 from messengers.base import ScopeOption
 from messengers.registry import get_adapter_for_platform, get_adapter_for_thread
@@ -87,6 +88,12 @@ async def handle_approve_request(request):
         # DEBUG-only (see logger.py's LOG_LEVEL). Silent by default.
         logger.debug(f"[APPROVE HOOK] tool_name={tool_name!r} conv_id={conv_id!r} tool_input={tool_input!r}")
 
+        # Ahead of the auto-allow lookup: this must not be overridable by a persistent grant.
+        blocked = protected_reason(tool_input)
+        if blocked:
+            logger.warning(f"Blocked {tool_name} touching protected config: {tool_input!r}")
+            return web.json_response({"decision": "deny", "reason": blocked})
+
         target_thread = None
         target_thread_id = None
         for thread_id_str, sess in session_manager.get_all_sessions().items():

package/src/approval/protected_paths.py

@@ -0,0 +1,42 @@
+import os
+import re
+from pathlib import Path
+
+from config import WORKSPACE_DIR
+
+AGENT_SUBDIR = "workspace"
+
+_DIR_MARKER = f"{WORKSPACE_DIR.parent.name}/{WORKSPACE_DIR.name}"
+
+# Shell commands arrive as one opaque string, so they are matched textually rather than resolved.
+CONFIG_DIR_RE = re.compile(re.escape(_DIR_MARKER) + rf"(?!/{re.escape(AGENT_SUBDIR)}\b)")
+
+NAME_RE = re.compile(r"(?<![\w.-])(?:lgy\.json|persistent_tools\.json|approve_token)(?![\w.])")
+
+REASON = "LinkGravity's own configuration is off limits - it holds the bot tokens."
+
+
+def _is_inside_config(value: str) -> bool:
+    try:
+        resolved = Path(os.path.expandvars(os.path.expanduser(value))).resolve()
+    except (OSError, ValueError):
+        return False
+    root = WORKSPACE_DIR.resolve()
+    return resolved.is_relative_to(root) and not resolved.is_relative_to(root / AGENT_SUBDIR)
+
+
+def protected_reason(tool_input) -> str | None:
+    if isinstance(tool_input, list):
+        return next((r for r in map(protected_reason, tool_input) if r), None)
+    if not isinstance(tool_input, dict):
+        return None
+
+    for value in tool_input.values():
+        if isinstance(value, (dict, list)):
+            nested = protected_reason(value)
+            if nested:
+                return nested
+        elif isinstance(value, str) and value:
+            if NAME_RE.search(value) or CONFIG_DIR_RE.search(value) or _is_inside_config(value):
+                return REASON
+    return None

package/src/core/logger.py

@@ -6,6 +6,17 @@ from sys import stdout
 from loguru import logger
 
 
+class _InterceptHandler(logging.Handler):
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            level = logger.level(record.levelname).name
+        except ValueError:
+            level = record.levelno
+        # Without patching, {name} resolves to this file's frame instead of the library that logged.
+        patched = logger.patch(lambda r, name=record.name: r.update(name=name))
+        patched.opt(exception=record.exc_info).log(level, record.getMessage())
+
+
 def init_logger(workspace_dir: Path):
     logging.getLogger("discord").setLevel(logging.WARNING)
     # httpx is what python-telegram-bot uses under the hood for every getUpdates
@@ -22,6 +33,9 @@ def init_logger(workspace_dir: Path):
     # Defaults to INFO - set LOG_LEVEL=DEBUG then `lgy restart` for
     # verbose detail (e.g. agy_runner.py's raw agy stdout capture).
     level = os.environ.get("LOG_LEVEL", "INFO").upper()
+    # force=True drops handlers third-party libraries install for themselves, which otherwise
+    # print in their own format alongside loguru's.
+    logging.basicConfig(handlers=[_InterceptHandler()], level=getattr(logging, level, logging.INFO), force=True)
     logger.add(stdout, level=level, format=log_format, colorize=True)
     logger.add(
         LOG_DIR / "bot.log",

package/src/main_discord.py

@@ -281,8 +281,6 @@ async def run_discord(stop_event: asyncio.Event) -> None:
         logger.critical("Missing DISCORD_TOKEN - run `lgy setup`")
         return
 
-    discord.utils.setup_logging()
-
     async with bot:
         from cogs.voice_cog import VoiceCog
         from config import bot_settings, save_bot_settings

package/src/messengers/slack_adapter.py

@@ -234,6 +234,8 @@ class SlackAdapter(MessengerAdapter):
         user_id = (body.get("user") or {}).get("id")
         if allowed(user_id, "slack"):
             return True
+        logger.warning(f"Rejected Slack interaction from unauthorized user {user_id}")
+        # Modal submissions carry no channel, so there is nowhere to post the notice.
         channel = (body.get("channel") or {}).get("id")
         if channel and user_id:
             try:
@@ -245,6 +247,8 @@ class SlackAdapter(MessengerAdapter):
         return False
 
     async def handle_view_submission(self, body: dict) -> None:
+        if not await self._reject_unauthorized(body):
+            return
         callback_id = (body.get("view") or {}).get("callback_id")
         handler = self._view_callbacks.pop(callback_id, None)
         if handler is None: