ofiere-openclaw-plugin 4.14.0 → 4.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofiere-openclaw-plugin",
-  "version": "4.14.0",
+  "version": "4.16.0",
   "type": "module",
   "description": "OpenClaw plugin for Ofiere PM - 11 meta-tools covering tasks, agents, projects, scheduling, knowledge, workflows, notifications, memory, prompts, constellation, and space file management",
   "keywords": ["openclaw", "ofiere", "project-management", "agents", "plugin"],

package/src/tools.ts

@@ -3232,6 +3232,66 @@ function registerFileOps(
   });
 }
 
+// ── File Ops helpers ─────────────────────────────────────────────────────────
+
+/** MIME types allowed by the space-files storage bucket. */
+const ALLOWED_STORAGE_MIMES = new Set([
+  "image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml",
+  "video/mp4", "video/webm", "video/quicktime",
+  "audio/mpeg", "audio/wav", "audio/ogg",
+  "application/pdf", "text/plain", "text/markdown", "text/csv",
+  "text/html", "text/css", "application/json",
+  "application/javascript", "text/javascript", "application/typescript",
+  "application/zip", "application/x-tar", "application/gzip",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  "application/octet-stream",
+]);
+
+/**
+ * Simple FNV-1a 32-bit hash → 8-char hex string.
+ * Used to generate stable, short slugs from non-ASCII filenames.
+ */
+function fnv1aHash(str: string): string {
+  let hash = 0x811c9dc5;
+  for (let i = 0; i < str.length; i++) {
+    hash ^= str.charCodeAt(i);
+    hash = (hash * 0x01000193) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
+
+/**
+ * Sanitize a filename for safe use as a Supabase storage object key.
+ * Strips characters that break storage APIs while preserving extension and readability.
+ * For Unicode-heavy filenames, generates a hash-based slug to maintain uniqueness.
+ * The original filename is always kept in DB metadata.
+ */
+function sanitizeStorageFileName(fileName: string): string {
+  // Split extension from stem
+  const dotIdx = fileName.lastIndexOf(".");
+  const stem = dotIdx > 0 ? fileName.slice(0, dotIdx) : fileName;
+  const ext = dotIdx > 0 ? fileName.slice(dotIdx) : ""; // includes dot
+
+  // Sanitize stem: spaces → hyphens, strip non-ASCII/non-safe chars
+  let safeStem = stem
+    .replace(/\s+/g, "-")
+    .replace(/[^a-zA-Z0-9_-]/g, "")
+    .replace(/-{2,}/g, "-")
+    .replace(/^-+|-+$/g, "");
+
+  // If stem collapsed (e.g. all Unicode), generate hash-based slug for traceability
+  if (safeStem.length < 3) {
+    safeStem = `f-${fnv1aHash(stem)}`;
+  }
+
+  // Sanitize extension too (should be safe but belt-and-suspenders)
+  const safeExt = ext.replace(/[^a-zA-Z0-9.]/g, "");
+
+  return `${safeStem}${safeExt}` || "file";
+}
+
 // ── File Ops handlers ────────────────────────────────────────────────────────
 
 async function handleListFiles(
@@ -3339,8 +3399,9 @@ async function handleCreateTextFile(
     };
     const mimeType = mimeMap[ext] || "text/plain";
 
-    // Upload to storage
-    const storagePath = `${userId}/${spaceId}/${Date.now()}-${fileName}`;
+    // Upload to storage — sanitize filename for storage key safety
+    const safeFileName = sanitizeStorageFileName(fileName);
+    const storagePath = `${userId}/${spaceId}/${Date.now()}-${safeFileName}`;
     const blob = new Blob([content], { type: mimeType });
     const buffer = await blob.arrayBuffer();
 
@@ -3388,8 +3449,37 @@ async function handleUploadFile(
     const bytes = new Uint8Array(binaryStr.length);
     for (let i = 0; i < binaryStr.length; i++) bytes[i] = binaryStr.charCodeAt(i);
 
-    const mimeType = (params.file_type as string) || "application/octet-stream";
-    const storagePath = `${userId}/${spaceId}/${Date.now()}-${fileName}`;
+    // Auto-detect MIME from extension if not explicitly provided
+    let mimeType = params.file_type as string;
+    let mimeWarning: string | undefined;
+    if (!mimeType) {
+      const ext = fileName.split(".").pop()?.toLowerCase() || "";
+      const binaryMimeMap: Record<string, string> = {
+        png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
+        webp: "image/webp", bmp: "image/bmp", ico: "image/x-icon",
+        svg: "image/svg+xml", avif: "image/avif",
+        pdf: "application/pdf", zip: "application/zip", gz: "application/gzip",
+        tar: "application/x-tar", "7z": "application/x-7z-compressed",
+        mp3: "audio/mpeg", wav: "audio/wav", ogg: "audio/ogg", flac: "audio/flac",
+        mp4: "video/mp4", webm: "video/webm", avi: "video/x-msvideo", mov: "video/quicktime",
+        woff: "font/woff", woff2: "font/woff2", ttf: "font/ttf", otf: "font/otf",
+        doc: "application/msword", docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        xls: "application/vnd.ms-excel", xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        ppt: "application/vnd.ms-powerpoint", pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+        md: "text/markdown", txt: "text/plain", json: "application/json",
+        csv: "text/csv", html: "text/html", css: "text/css",
+        js: "text/javascript", ts: "text/typescript", yaml: "text/yaml",
+        yml: "text/yaml", xml: "text/xml",
+      };
+      mimeType = binaryMimeMap[ext] || "application/octet-stream";
+    } else if (!ALLOWED_STORAGE_MIMES.has(mimeType)) {
+      // Explicit MIME not in bucket allowlist → fall back to octet-stream to prevent upload rejection
+      mimeWarning = `Requested MIME "${mimeType}" is not in storage allowlist — stored as application/octet-stream. The original type is preserved in file metadata.`;
+      mimeType = "application/octet-stream";
+    }
+
+    const safeFileName = sanitizeStorageFileName(fileName);
+    const storagePath = `${userId}/${spaceId}/${Date.now()}-${safeFileName}`;
 
     const { error: uploadErr } = await supabase.storage
       .from("space-files")
@@ -3397,6 +3487,10 @@ async function handleUploadFile(
 
     if (uploadErr) return err(`Storage upload failed: ${uploadErr.message}`);
 
+    // Store the originally-requested MIME type in DB (for downstream consumers),
+    // but use the storage-safe MIME for the actual upload
+    const dbMimeType = (params.file_type as string) || mimeType;
+
     const { data, error } = await supabase
       .from("pm_space_files")
       .insert({
@@ -3404,7 +3498,7 @@ async function handleUploadFile(
         space_id: spaceId,
         folder_id: (params.folder_id as string) || null,
         file_name: fileName,
-        file_type: mimeType,
+        file_type: dbMimeType,
         file_size: bytes.length,
         storage_path: storagePath,
         is_shared: false,
@@ -3414,7 +3508,12 @@ async function handleUploadFile(
       .single();
 
     if (error) return err(error.message);
-    return ok({ message: `File "${fileName}" uploaded (${bytes.length} bytes)`, file: data });
+    const result: Record<string, unknown> = {
+      message: `File "${fileName}" uploaded (${bytes.length} bytes)`,
+      file: data,
+    };
+    if (mimeWarning) result.warning = mimeWarning;
+    return ok(result);
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }
 
@@ -3463,13 +3562,16 @@ async function handleRenameFile(
     if (!fileId) return err("Missing required field: file_id");
     if (!newName) return err("Missing required field: new_name");
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_files")
       .update({ file_name: newName, updated_at: new Date().toISOString() })
       .eq("id", fileId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`File not found: ${fileId}`);
     return ok({ message: `File renamed to "${newName}"` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }
@@ -3483,13 +3585,16 @@ async function handleRenameSpaceFolder(
     if (!folderId) return err("Missing required field: folder_id");
     if (!newName) return err("Missing required field: new_name");
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_folders")
       .update({ name: newName, updated_at: new Date().toISOString() })
       .eq("id", folderId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`Folder not found: ${folderId}`);
     return ok({ message: `Folder renamed to "${newName}"` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }
@@ -3505,13 +3610,16 @@ async function handleMoveFile(
       ? (params.target_folder_id as string | null)
       : null;
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_files")
       .update({ folder_id: targetFolderId, updated_at: new Date().toISOString() })
       .eq("id", fileId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`File not found: ${fileId}`);
     return ok({ message: `File moved to ${targetFolderId || "root"}` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }
@@ -3527,13 +3635,16 @@ async function handleMoveSpaceFolder(
       ? (params.target_parent_id as string | null)
       : null;
 
-    const { error } = await supabase
+    const { data, error } = await supabase
       .from("pm_space_folders")
       .update({ parent_folder_id: targetParentId, updated_at: new Date().toISOString() })
       .eq("id", folderId)
-      .eq("user_id", userId);
+      .eq("user_id", userId)
+      .select("id")
+      .maybeSingle();
 
     if (error) return err(error.message);
+    if (!data) return err(`Folder not found: ${folderId}`);
     return ok({ message: `Folder moved to ${targetParentId || "root"}` });
   } catch (e) { return err(e instanceof Error ? e.message : String(e)); }
 }