mercury-agent 0.4.6 → 0.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mercury-agent",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Personal AI assistant for chat platforms (WhatsApp, Slack, Discord, Telegram)",
   "license": "MIT",
   "author": "Avishai Tsabari",

package/src/adapters/whatsapp.ts

@@ -147,7 +147,7 @@ export class WhatsAppBaileysAdapter
   private readonly outgoingQueue: Array<{ jid: string; text: string }> = [];
   private flushing = false;
   private connectedAtMs = 0;
-  private readonly seenMessageIds = new Set<string>();
+  private seenMessageIds = new Set<string>();
   private reconnectAttempt = 0;
   private readonly pushNames = new Map<string, string>();
   private currentQr: string | null = null;
@@ -474,7 +474,10 @@ export class WhatsAppBaileysAdapter
     if (messageId) {
       if (this.seenMessageIds.has(messageId)) return;
       this.seenMessageIds.add(messageId);
-      if (this.seenMessageIds.size > 5000) this.seenMessageIds.clear();
+      if (this.seenMessageIds.size > 5000) {
+        const ids = [...this.seenMessageIds];
+        this.seenMessageIds = new Set(ids.slice(ids.length - 2500));
+      }
     }
 
     const tsMs = Number(msg.messageTimestamp ?? 0) * 1000;

package/src/bridges/discord.ts

@@ -62,18 +62,25 @@ export class DiscordBridge implements PlatformBridge {
         const inboxDir = path.join(workspace, "inbox");
         for (const att of rawAttachments) {
           if (!att.url) continue;
-          const type = mimeToMediaType(
-            att.mimeType || "application/octet-stream",
-          );
-          const result = await downloadMediaFromUrl(att.url, {
-            type,
-            mimeType: att.mimeType || "application/octet-stream",
-            filename: att.name,
-            expectedSizeBytes: att.size,
-            maxSizeBytes: ctx.media.maxSizeBytes,
-            outputDir: inboxDir,
-          });
-          if (result) attachments.push(result);
+          try {
+            const type = mimeToMediaType(
+              att.mimeType || "application/octet-stream",
+            );
+            const result = await downloadMediaFromUrl(att.url, {
+              type,
+              mimeType: att.mimeType || "application/octet-stream",
+              filename: att.name,
+              expectedSizeBytes: att.size,
+              maxSizeBytes: ctx.media.maxSizeBytes,
+              outputDir: inboxDir,
+            });
+            if (result) attachments.push(result);
+          } catch (err) {
+            logger.warn("Discord attachment download failed", {
+              filename: att.name,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          }
         }
       }
     }

package/src/bridges/slack.ts

@@ -133,12 +133,14 @@ export class SlackBridge implements PlatformBridge {
   ): Promise<void> {
     const parts = threadId.split(":");
     const channelId = parts.length >= 2 ? parts[1] : threadId;
+    const threadTs = parts.length >= 3 ? parts[2] : undefined;
 
     for (const file of files) {
       try {
         const buffer = fs.readFileSync(file.path);
         const form = new FormData();
         form.append("channel_id", channelId);
+        if (threadTs) form.append("thread_ts", threadTs);
         form.append("filename", file.filename);
         form.append(
           "file",

package/src/bridges/teams.ts

@@ -73,9 +73,11 @@ export class TeamsBridge implements PlatformBridge {
 
     const { externalId, isDM } = this.parseThread(threadId);
 
-    // Check reply-to-bot via raw activity
+    // Reply-to-bot detection: in DMs every reply is to the bot;
+    // in channels we cannot reliably determine the target, so default to false
+    // to avoid responding to conversations not directed at us.
     const raw = msg.raw as { replyToId?: string; id?: string } | undefined;
-    const isReplyToBot = Boolean(raw?.replyToId);
+    const isReplyToBot = isDM && Boolean(raw?.replyToId);
 
     return {
       platform: "teams",

package/src/bridges/telegram.ts

@@ -479,13 +479,21 @@ export class TelegramBridge implements PlatformBridge {
     const { chatId } = this.parseThreadId(threadId);
     const apiUrl = `${TELEGRAM_API_BASE}/bot${this.botToken}/editMessageText`;
     try {
+      let formatted: string;
+      try {
+        formatted = markdownToTelegramHtml(text);
+      } catch {
+        formatted = escapeHtml(text);
+      }
+      const truncated = truncateTelegramHtml(formatted, TELEGRAM_MESSAGE_LIMIT);
       const resp = await fetch(apiUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           chat_id: chatId,
           message_id: Number(messageId),
-          text: applyRtlDirection(normalizeChatMarkdown(text)),
+          text: applyRtlDirection(truncated),
+          parse_mode: "HTML",
         }),
       });
       if (!resp.ok) return false;

package/src/cli/mercury.ts

@@ -70,7 +70,14 @@ function loadEnvFile(envPath: string): Record<string, string> {
     if (!trimmed || trimmed.startsWith("#")) continue;
     const match = trimmed.match(/^([^=]+)=(.*)$/);
     if (match) {
-      vars[match[1]] = match[2];
+      let value = match[2];
+      if (
+        (value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))
+      ) {
+        value = value.slice(1, -1);
+      }
+      vars[match[1]] = value;
     }
   }
   return vars;
@@ -266,16 +273,14 @@ function statusAction(): void {
     `Configuration:   ${hasEnv ? "✓ .env exists" : "✗ .env missing (run 'mercury init')"}`,
   );
 
-  const imageCheck = spawnSync(
-    "docker",
-    ["image", "inspect", "mercury-agent:latest"],
-    {
-      stdio: "pipe",
-    },
-  );
+  const cfg = loadConfig();
+  const imageName = cfg.agentContainerImage;
+  const imageCheck = spawnSync("docker", ["image", "inspect", imageName], {
+    stdio: "pipe",
+  });
   const hasImage = imageCheck.status === 0;
   console.log(
-    `Container image: ${hasImage ? "✓ mercury-agent:latest" : "✗ not built (run 'mercury build')"}`,
+    `Container image: ${hasImage ? `✓ ${imageName}` : `✗ not available (run 'mercury build' or pull '${imageName}')`}`,
   );
 
   if (hasEnv) {
@@ -1747,7 +1752,7 @@ async function addAction(source: string): Promise<void> {
     }
 
     console.log("\nRestart mercury to activate:");
-    console.log("  mercury service restart");
+    console.log("  mercury service uninstall && mercury service install");
   } finally {
     cleanup();
   }
@@ -1762,7 +1767,7 @@ function removeAction(name: string): void {
 
   console.log(`✓ Extension "${name}" removed`);
   console.log("\nRestart mercury to apply:");
-  console.log("  mercury service restart");
+  console.log("  mercury service uninstall && mercury service install");
 }
 
 function extensionsListAction(): void {

package/src/core/permissions.ts

@@ -30,6 +30,10 @@ const BUILT_IN_PERMISSIONS = new Set([
   "media.purge",
   /** Host Text-to-Speech (/api/tts); admin-only by default. */
   "tts.synthesize",
+  /** Mute/unmute users and list mutes; admin-only by default. */
+  "mutes.list",
+  "mutes.mute",
+  "mutes.unmute",
 ]);
 
 // ---------------------------------------------------------------------------

package/src/core/router.ts

@@ -106,7 +106,7 @@ export function routeInput(input: {
       .split(/\s+/);
     const category = rawCategory.toLowerCase();
     const verb = rawVerb?.toLowerCase() || undefined;
-    const arg = argParts.join(" ").trim().toLowerCase() || undefined;
+    const arg = argParts.join(" ").trim() || undefined;
     if (SLASH_COMMANDS.some((c) => c.name === category)) {
       return gateSlashCommand(
         input.db,

package/src/core/routes/chat.ts

@@ -62,9 +62,16 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
     const authorName =
       typeof body.authorName === "string" ? body.authorName.trim() : undefined;
 
+    if (!core.db.getSpace(spaceId)) {
+      return c.json({ error: "Space not found" }, 404);
+    }
+
     // Save incoming files to inbox/
     const attachments: MessageAttachment[] = [];
     if (Array.isArray(body.files)) {
+      if (body.files.length > 20) {
+        return c.json({ error: "Too many files (max 20)" }, 400);
+      }
       if (await isOverQuota(core.config)) {
         return c.json({ error: "Storage quota exceeded" }, 413);
       }
@@ -100,10 +107,6 @@ export function createChatRoute(core: MercuryCoreRuntime): Hono {
       }
     }
 
-    if (!core.db.getSpace(spaceId)) {
-      return c.json({ error: "Space not found" }, 404);
-    }
-
     if (authenticated) {
       core.db.seedAdmins(spaceId, [callerId]);
     }

package/src/core/routes/messages.ts

@@ -22,7 +22,7 @@ messages.get("/search", (c) => {
     if (!Number.isFinite(n) || n < 1) {
       return c.json({ error: "Invalid limit" }, 400);
     }
-    limit = n;
+    limit = Math.min(n, 200);
   }
 
   const found = db.searchMessages(spaceId, q, limit);

package/src/core/routes/mutes.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import type { Env } from "../api-types.js";
-import { getApiCtx, getAuth } from "../api-types.js";
+import { checkPerm, getApiCtx, getAuth } from "../api-types.js";
 import { parseMuteDuration } from "../mute-duration.js";
 
 export const mutes = new Hono<Env>();
@@ -8,6 +8,8 @@ export const mutes = new Hono<Env>();
 // ─── List mutes ─────────────────────────────────────────────────────────
 
 mutes.get("/", (c) => {
+  const denied = checkPerm(c, "mutes.list");
+  if (denied) return denied;
   const { spaceId } = getAuth(c);
   const { db } = getApiCtx(c);
   return c.json({ mutes: db.listMutes(spaceId) });
@@ -16,6 +18,8 @@ mutes.get("/", (c) => {
 // ─── Mute a user ────────────────────────────────────────────────────────
 
 mutes.post("/", async (c) => {
+  const denied = checkPerm(c, "mutes.mute");
+  if (denied) return denied;
   const { spaceId, callerId } = getAuth(c);
   const { db } = getApiCtx(c);
   const body = await c.req.json<{
@@ -76,6 +80,8 @@ mutes.post("/", async (c) => {
 // ─── Unmute a user ──────────────────────────────────────────────────────
 
 mutes.delete("/:userId", (c) => {
+  const denied = checkPerm(c, "mutes.unmute");
+  if (denied) return denied;
   const { spaceId } = getAuth(c);
   const { db } = getApiCtx(c);
   const targetUserId = decodeURIComponent(c.req.param("userId"));

package/src/core/routes/roles.ts

@@ -33,6 +33,16 @@ roles.post("/", async (c) => {
   }
 
   const targetRole = body.role ?? "admin";
+  const VALID_ROLES = /^[a-z][a-z0-9_-]{0,31}$/;
+  if (!VALID_ROLES.test(targetRole)) {
+    return c.json(
+      {
+        error:
+          "Invalid role name. Use lowercase alphanumeric, hyphens, underscores (max 32 chars).",
+      },
+      400,
+    );
+  }
   db.setRole(spaceId, body.platformUserId, targetRole, callerId);
 
   return c.json({

package/src/core/task-scheduler.ts

@@ -101,10 +101,17 @@ export class TaskScheduler {
     let updated = 0;
     for (const task of tasks) {
       if (!task.active || !task.cron) continue;
-      const correct = this.computeNextRun(
-        task.cron,
-        task.timezone ?? undefined,
-      );
+      let correct: number;
+      try {
+        correct = this.computeNextRun(task.cron, task.timezone ?? undefined);
+      } catch (err) {
+        logger.warn("Skipping task with invalid cron expression", {
+          taskId: task.id,
+          cron: task.cron,
+          error: err instanceof Error ? err.message : String(err),
+        });
+        continue;
+      }
       if (correct !== task.nextRunAt) {
         this.db.updateTaskNextRun(task.id, correct);
         updated++;

package/src/extensions/hooks.ts

@@ -86,6 +86,11 @@ export class HookDispatcher {
         this.log.error(
           `Hook "before_container" handler failed: ${err instanceof Error ? err.message : String(err)}`,
         );
+        return {
+          block: {
+            reason: `Extension hook failed: ${err instanceof Error ? err.message : String(err)}`,
+          },
+        };
       }
     }
 

package/src/extensions/loader.ts

@@ -242,7 +242,7 @@ async function loadExtension(
   }
 
   const api = new MercuryExtensionAPIImpl(name, extDir, db);
-  setup(api);
+  await setup(api);
   const meta = api.getMeta();
 
   if (meta.connection) {

package/src/storage/db.ts

@@ -55,6 +55,7 @@ export class Db {
     this.db = new Database(dbPath, { create: true });
     this.db.exec("PRAGMA journal_mode = WAL;");
     this.db.exec("PRAGMA foreign_keys = ON;");
+    this.db.exec("PRAGMA busy_timeout = 5000;");
     this.migrate();
   }