ofiere-openclaw-plugin 4.14.0 → 4.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofiere-openclaw-plugin",
-  "version": "4.14.0",
+  "version": "4.15.0",
   "type": "module",
   "description": "OpenClaw plugin for Ofiere PM - 11 meta-tools covering tasks, agents, projects, scheduling, knowledge, workflows, notifications, memory, prompts, constellation, and space file management",
   "keywords": ["openclaw", "ofiere", "project-management", "agents", "plugin"],

package/src/tools.ts

@@ -3232,6 +3232,23 @@ function registerFileOps(
   });
 }
 
+// ── File Ops helpers ─────────────────────────────────────────────────────────
+
+/**
+ * Sanitize a filename for safe use as a Supabase storage object key.
+ * Strips characters that break storage APIs (parens, em-dashes, exclamation marks, etc.)
+ * while preserving extension and readability. The original filename is kept in DB metadata.
+ */
+function sanitizeStorageFileName(fileName: string): string {
+  // Replace spaces with hyphens, strip anything not alphanumeric, hyphen, underscore, or dot
+  return fileName
+    .replace(/\s+/g, "-")
+    .replace(/[^a-zA-Z0-9._-]/g, "")
+    .replace(/-{2,}/g, "-")     // collapse multiple hyphens
+    .replace(/^-+|-+$/g, "")    // trim leading/trailing hyphens
+    || "file";                   // fallback if everything was stripped
+}
+
 // ── File Ops handlers ────────────────────────────────────────────────────────
 
 async function handleListFiles(
@@ -3339,8 +3356,9 @@ async function handleCreateTextFile(
     };
     const mimeType = mimeMap[ext] || "text/plain";
 
-    // Upload to storage
-    const storagePath = `${userId}/${spaceId}/${Date.now()}-${fileName}`;
+    // Upload to storage — sanitize filename for storage key safety
+    const safeFileName = sanitizeStorageFileName(fileName);
+    const storagePath = `${userId}/${spaceId}/${Date.now()}-${safeFileName}`;
     const blob = new Blob([content], { type: mimeType });
     const buffer = await blob.arrayBuffer();
 
@@ -3388,8 +3406,32 @@ async function handleUploadFile(
     const bytes = new Uint8Array(binaryStr.length);
     for (let i = 0; i < binaryStr.length; i++) bytes[i] = binaryStr.charCodeAt(i);
 
-    const mimeType = (params.file_type as string) || "application/octet-stream";
-    const storagePath = `${userId}/${spaceId}/${Date.now()}-${fileName}`;
+    // Auto-detect MIME from extension if not explicitly provided
+    let mimeType = params.file_type as string;
+    if (!mimeType) {
+      const ext = fileName.split(".").pop()?.toLowerCase() || "";
+      const binaryMimeMap: Record<string, string> = {
+        png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
+        webp: "image/webp", bmp: "image/bmp", ico: "image/x-icon",
+        svg: "image/svg+xml", avif: "image/avif",
+        pdf: "application/pdf", zip: "application/zip", gz: "application/gzip",
+        tar: "application/x-tar", "7z": "application/x-7z-compressed",
+        mp3: "audio/mpeg", wav: "audio/wav", ogg: "audio/ogg", flac: "audio/flac",
+        mp4: "video/mp4", webm: "video/webm", avi: "video/x-msvideo", mov: "video/quicktime",
+        woff: "font/woff", woff2: "font/woff2", ttf: "font/ttf", otf: "font/otf",
+        doc: "application/msword", docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        xls: "application/vnd.ms-excel", xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        ppt: "application/vnd.ms-powerpoint", pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+        md: "text/markdown", txt: "text/plain", json: "application/json",
+        csv: "text/csv", html: "text/html", css: "text/css",
+        js: "text/javascript", ts: "text/typescript", yaml: "text/yaml",
+        yml: "text/yaml", xml: "text/xml",
+      };
+      mimeType = binaryMimeMap[ext] || "application/octet-stream";
+    }
+
+    const safeFileName = sanitizeStorageFileName(fileName);
+    const storagePath = `${userId}/${spaceId}/${Date.now()}-${safeFileName}`;
 
     const { error: uploadErr } = await supabase.storage
       .from("space-files")
@@ -3463,13 +3505,16 @@ async function handleRenameFile(
     if (!fileId) return err("Missing required field: file_id");
     if (!newName) return err("Missing required field: new_name");
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_files")
       .update({ file_name: newName, updated_at: new Date().toISOString() })
       .eq("id", fileId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`File not found: ${fileId}`);
     return ok({ message: `File renamed to "${newName}"` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }
@@ -3483,13 +3528,16 @@ async function handleRenameSpaceFolder(
     if (!folderId) return err("Missing required field: folder_id");
     if (!newName) return err("Missing required field: new_name");
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_folders")
       .update({ name: newName, updated_at: new Date().toISOString() })
       .eq("id", folderId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`Folder not found: ${folderId}`);
     return ok({ message: `Folder renamed to "${newName}"` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }
@@ -3505,13 +3553,16 @@ async function handleMoveFile(
       ? (params.target_folder_id as string | null)
       : null;
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_files")
       .update({ folder_id: targetFolderId, updated_at: new Date().toISOString() })
       .eq("id", fileId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`File not found: ${fileId}`);
     return ok({ message: `File moved to ${targetFolderId || "root"}` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }
@@ -3527,13 +3578,16 @@ async function handleMoveSpaceFolder(
       ? (params.target_parent_id as string | null)
       : null;
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_folders")
       .update({ parent_folder_id: targetParentId, updated_at: new Date().toISOString() })
       .eq("id", folderId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`Folder not found: ${folderId}`);
     return ok({ message: `Folder moved to ${targetParentId || "root"}` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }