openclaw-node-harness 2.0.4 → 2.1.1

package/lib/kanban-io.js

@@ -28,47 +28,31 @@ const ACTIVE_TASKS_PATH = path.join(
 // Prevents lost updates when mesh-bridge and memory-daemon write concurrently.
 // See architecture note above for why this is local-only.
 
-function withMkdirLock(filePath, fn) {
+async function withMkdirLock(filePath, fn) {
   const lockDir = filePath + '.lk';
-  const maxWait = 5000; // 5s max wait
+  const maxWait = 5000;
+  const pollInterval = 50;
   const start = Date.now();
 
-  // Acquire: mkdir is atomic on POSIX
-  while (true) {
+  while (Date.now() - start < maxWait) {
     try {
       fs.mkdirSync(lockDir);
-      break; // got the lock
-    } catch (err) {
-      if (err.code !== 'EEXIST') throw err;
-      // Lock held by another process — check for stale lock (>30s)
       try {
-        const lockAge = Date.now() - fs.statSync(lockDir).mtimeMs;
-        if (lockAge > 30000) {
-          // Stale lock — previous holder crashed
-          fs.rmdirSync(lockDir);
-          continue;
-        }
-      } catch { /* stat failed, lock was just released */ continue; }
-
-      if (Date.now() - start > maxWait) {
-        throw new Error(`kanban-io: lock timeout after ${maxWait}ms on ${filePath}`);
+        return await fn();
+      } finally {
+        try { fs.rmdirSync(lockDir); } catch {}
       }
-      // Sleep ~10ms — Atomics.wait is precise but throws on main thread
-      // in some Node.js builds; fall back to busy-spin (rare contention path)
-      try {
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
-      } catch {
-        const end = Date.now() + 10;
-        while (Date.now() < end) { /* busy-wait fallback */ }
+    } catch (err) {
+      if (err.code === 'EEXIST') {
+        await new Promise(r => setTimeout(r, pollInterval));
+        continue;
       }
+      throw err;
     }
   }
-
-  try {
-    return fn();
-  } finally {
-    try { fs.rmdirSync(lockDir); } catch { /* already released */ }
-  }
+  // Timeout — force acquire (stale lock)
+  try { fs.rmdirSync(lockDir); } catch {}
+  return fn();
 }
 
 // ── Parser ──────────────────────────────────────────
@@ -212,6 +196,15 @@ function parseTasks(content) {
           catch { current.collab_result = null; }
           currentArrayKey = null;
           break;
+        // Circling Strategy display fields
+        case 'circling_phase': current.circling_phase = value || null; currentArrayKey = null; break;
+        case 'circling_subround': current.circling_subround = parseInt(value, 10) || 0; currentArrayKey = null; break;
+        case 'circling_step': current.circling_step = parseInt(value, 10) || 0; currentArrayKey = null; break;
+        case 'circling_nodes':
+          try { current.circling_nodes = value ? JSON.parse(value) : null; }
+          catch { current.circling_nodes = null; }
+          currentArrayKey = null;
+          break;
         default:
           currentArrayKey = null;
           break;

package/lib/llm-providers.js

@@ -21,6 +21,19 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
+// ── Shell Command Security ─────────────────────────
+const SHELL_PROVIDER_ALLOWED_PREFIXES = [
+  'npm test', 'npm run', 'node ', 'python ', 'pytest', 'cargo test',
+  'go test', 'make', 'jest', 'vitest', 'mocha', 'bash ', 'sh ',
+  'cat ', 'echo ', 'ls ', 'grep ', 'find ', 'git '
+];
+
+function validateShellCommand(cmd) {
+  const trimmed = (cmd || '').trim();
+  if (!trimmed) return false;
+  return SHELL_PROVIDER_ALLOWED_PREFIXES.some(p => trimmed.startsWith(p));
+}
+
 // ── Generic Provider Factory ────────────────────────
 // Most agentic coding CLIs follow a similar pattern:
 //   binary [prompt-flag] "prompt" [model-flag] model [cwd-flag] dir
@@ -167,6 +180,9 @@ const PROVIDERS = {
     buildArgs(prompt, model, task) {
       // Use task.description (the raw command) if available, fall back to prompt
       const cmd = (task && task.description) ? task.description : prompt;
+      if (!validateShellCommand(cmd)) {
+        throw new Error(`Shell provider: command blocked by security filter: ${cmd.slice(0, 80)}`);
+      }
       return ['-c', cmd];
     },
     cleanEnv(env) {

package/lib/mcp-knowledge/bench.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * Benchmark: index real workspace files and run search queries
+ */
+import { pipeline } from '@huggingface/transformers';
+import { statSync, rmSync } from 'node:fs';
+
+import {
+  scanMarkdownFiles,
+  chunkMarkdown,
+  hashContent,
+  initDatabase,
+  EMBEDDING_DIM,
+  MAX_CHUNK_CHARS,
+  INCLUDE_DIRS,
+  EXCLUDE_PATTERNS,
+  MODEL_NAME,
+} from './core.mjs';
+import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+
+const WORKSPACE = process.env.KNOWLEDGE_ROOT || '/Users/moltymac/.openclaw/workspace';
+const DB_PATH = '/tmp/mcp-knowledge-bench.db';
+
+// Clean previous run
+try { rmSync(DB_PATH); } catch {}
+
+// Init DB
+const db = initDatabase(DB_PATH);
+
+const files = scanMarkdownFiles(WORKSPACE, INCLUDE_DIRS, EXCLUDE_PATTERNS);
+console.log(`Scanning ${files.length} files...`);
+
+console.log('Loading embedding model...');
+const extractor = await pipeline('feature-extraction', MODEL_NAME, { dtype: 'fp32' });
+console.log('Model loaded.\n');
+
+const insertDoc = db.prepare('INSERT INTO documents (path, content_hash, last_indexed, chunk_count) VALUES (?, ?, ?, ?)');
+const insertChunk = db.prepare('INSERT INTO chunks (doc_path, section, text, snippet) VALUES (?, ?, ?, ?)');
+
+let totalChunks = 0;
+let totalFiles = 0;
+const start = Date.now();
+
+for (const file of files) {
+  let content;
+  try { content = readFileSync(file.path, 'utf-8'); } catch { continue; }
+  if (!content.trim()) continue;
+
+  const hash = hashContent(content);
+  const chunks = chunkMarkdown(content);
+  const vectors = [];
+  for (const c of chunks) {
+    const r = await extractor(c.text, { pooling: 'mean', normalize: true, truncation: true, max_length: 256 });
+    vectors.push(new Float32Array(r.data));
+  }
+
+  db.transaction(() => {
+    insertDoc.run(file.rel, hash, Date.now(), chunks.length);
+    for (let i = 0; i < chunks.length; i++) {
+      const snippet = chunks[i].text.slice(0, 250).replace(/\n/g, ' ');
+      const info = insertChunk.run(file.rel, chunks[i].section, chunks[i].text, snippet);
+      const vecBuf = Buffer.from(vectors[i].buffer);
+      db.prepare(`INSERT INTO chunk_vectors VALUES (${info.lastInsertRowid}, ?)`).run(vecBuf);
+    }
+  })();
+  totalChunks += chunks.length;
+  totalFiles++;
+  if (totalFiles % 50 === 0) console.log(`  ${totalFiles}/${files.length} files, ${totalChunks} chunks...`);
+}
+
+const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+console.log(`\nIndexed: ${totalFiles} files → ${totalChunks} chunks in ${elapsed}s`);
+
+// Search queries
+console.log('\n═══ Semantic Search Tests ═══');
+async function search(query) {
+  const t0 = Date.now();
+  const r = await extractor(query, { pooling: 'mean', normalize: true, truncation: true, max_length: 256 });
+  const buf = Buffer.from(new Float32Array(r.data).buffer);
+  const results = db.prepare(`
+    SELECT cv.distance, c.doc_path, c.section, c.snippet
+    FROM chunk_vectors cv JOIN chunks c ON c.id = cv.rowid
+    WHERE embedding MATCH ? AND k = 5 ORDER BY distance
+  `).all(buf);
+  const ms = Date.now() - t0;
+  return { results, ms };
+}
+
+const queries = [
+  'oracle threat model GPS spoofing',
+  'faction lore verdant pact nature magic',
+  'smart contract mana well architecture',
+  'Daedalus identity soul companion',
+  'what is the mana harvesting mechanism',
+  'biome oracle location verification',
+];
+
+for (const q of queries) {
+  const { results, ms } = await search(q);
+  console.log(`\nQuery: "${q}" (${ms}ms)`);
+  for (const r of results.slice(0, 3)) {
+    const score = (1 - r.distance * r.distance / 2).toFixed(3);
+    console.log(`  [${score}] ${r.doc_path} → ${r.section.slice(0, 60)}`);
+  }
+}
+
+// Stats
+const { size } = statSync(DB_PATH);
+console.log(`\n═══ Stats ═══`);
+console.log(`DB size: ${(size / 1024 / 1024).toFixed(1)} MB`);
+console.log(`Files: ${totalFiles}`);
+console.log(`Chunks: ${totalChunks}`);
+console.log(`Index time: ${elapsed}s`);
+console.log(`Avg per file: ${(parseFloat(elapsed) * 1000 / totalFiles).toFixed(0)}ms`);
+
+db.close();
+setTimeout(() => process.exit(0), 200);