slashvibe-mcp 0.3.20 → 0.3.21

package/tools/_work-context.js

@@ -0,0 +1,338 @@
+/**
+ * Shared work context gathering — used by start.js and work-summary.js
+ *
+ * SECURITY: Uses execFileSync (not execSync) to prevent shell injection.
+ * A malicious branch name like "; rm -rf /" would be harmless with this approach.
+ *
+ * This module provides:
+ * - Git state (branch, recent commits, changed files, uncommitted status)
+ * - Project detection (package.json, Cargo.toml, pyproject.toml, or directory name)
+ * - Auto-generated suggestions for presence and messages
+ */
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// ═══════════════════════════════════════════════════════════════════════════
+// SECURITY: Sanitization and limits
+// ═══════════════════════════════════════════════════════════════════════════
+
+// Strip ANSI escape sequences and control characters (prevent terminal injection)
+function sanitize(text) {
+  if (!text) return text;
+  return text
+    .replace(/\x1B\[[0-9;]*[a-zA-Z]/g, '')  // ANSI escape sequences
+    .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Control chars (keep \t \n \r)
+    .trim();
+}
+
+// Character limits (DoS prevention)
+const LIMITS = {
+  branch: 100,
+  commitMessage: 80,
+  fileName: 50,
+  totalFiles: 10,
+  totalSummary: 200,
+};
+
+function cap(text, limit) {
+  if (!text || text.length <= limit) return text;
+  return text.slice(0, limit - 1) + '…';
+}
+
+// Redaction patterns (prevent accidental secret exposure)
+const REDACT_PATTERNS = [
+  /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,  // emails
+  /[a-fA-F0-9]{32,}/g,                                  // long hex (tokens, hashes)
+  /sk-[a-zA-Z0-9]{20,}/g,                               // OpenAI API keys
+  /ghp_[a-zA-Z0-9]{36}/g,                               // GitHub tokens
+  /\b(password|secret|token|api_key|apikey)\b/gi,       // sensitive words in context
+];
+
+function redact(text) {
+  if (!text) return text;
+  let result = text;
+  for (const pattern of REDACT_PATTERNS) {
+    result = result.replace(pattern, '[REDACTED]');
+  }
+  return result;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// GIT INFO GATHERING (Safe execution)
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Execute git command safely (no shell, with timeout and output limits)
+ * @param {string[]} args - Git command arguments (e.g., ['branch', '--show-current'])
+ * @returns {string|null} - Command output or null on failure
+ */
+function safeGitExec(args) {
+  try {
+    return execFileSync('git', args, {
+      encoding: 'utf8',
+      timeout: 2000,           // 2s timeout
+      maxBuffer: 100 * 1024,   // 100KB max output
+      shell: false,            // CRITICAL: no shell = no injection
+      stdio: ['pipe', 'pipe', 'pipe']  // Capture stderr too
+    }).trim();
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Get comprehensive git information for the current directory
+ */
+function getGitInfo() {
+  // Check if we're in a git repo first
+  const branch = sanitize(safeGitExec(['branch', '--show-current']));
+  if (!branch) {
+    // Not a git repo or detached HEAD - try to get commit hash
+    const headHash = sanitize(safeGitExec(['rev-parse', '--short', 'HEAD']));
+    if (headHash) {
+      return {
+        branch: `detached:${cap(headHash, 10)}`,
+        recentCommits: [],
+        changedFiles: [],
+        hasUncommitted: false,
+        isDetached: true
+      };
+    }
+    return null; // Not a git repo at all
+  }
+
+  // Get recent commits (--no-pager prevents interactive mode)
+  const logOutput = sanitize(safeGitExec(['--no-pager', 'log', '--oneline', '-3'])) || '';
+  const recentCommits = logOutput.split('\n').filter(Boolean).slice(0, 3).map(line => {
+    const [hash, ...msg] = line.split(' ');
+    return {
+      hash: cap(hash, 7),
+      message: redact(cap(msg.join(' '), LIMITS.commitMessage))
+    };
+  });
+
+  // Get changed files (--no-ext-diff --no-textconv prevent custom diff handlers)
+  const diffOutput = sanitize(safeGitExec([
+    '--no-pager', 'diff', '--no-ext-diff', '--no-textconv',
+    '--name-only', 'HEAD~1'
+  ])) || '';
+  const changedFiles = diffOutput.split('\n')
+    .filter(Boolean)
+    .slice(0, LIMITS.totalFiles)
+    .map(f => cap(path.basename(f), LIMITS.fileName)); // Only basename, not full path
+
+  // Check for uncommitted changes (porcelain = machine-readable, safe)
+  const statusOutput = safeGitExec(['status', '--porcelain']);
+
+  return {
+    branch: cap(branch, LIMITS.branch),
+    recentCommits,
+    changedFiles,
+    hasUncommitted: !!statusOutput,
+    isDetached: false
+  };
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// PROJECT INFO GATHERING
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Detect project type and name from manifest files
+ */
+function getProjectInfo() {
+  const cwd = process.cwd();
+  const dirName = path.basename(cwd);
+
+  let name = dirName;
+  let type = 'unknown';
+
+  // Try package.json (Node.js projects)
+  try {
+    const pkgPath = path.join(cwd, 'package.json');
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    name = pkg.name || dirName;
+
+    // Detect more specific type
+    if (pkg.dependencies?.next || pkg.devDependencies?.next) {
+      type = 'nextjs';
+    } else if (pkg.dependencies?.react || pkg.devDependencies?.react) {
+      type = 'react';
+    } else if (pkg.devDependencies?.typescript || pkg.dependencies?.typescript) {
+      type = 'typescript';
+    } else {
+      type = 'node';
+    }
+  } catch (e) {}
+
+  // Try Cargo.toml (Rust projects)
+  try {
+    const cargoPath = path.join(cwd, 'Cargo.toml');
+    fs.accessSync(cargoPath);
+    type = 'rust';
+
+    // Try to extract crate name
+    const cargoContent = fs.readFileSync(cargoPath, 'utf8');
+    const nameMatch = cargoContent.match(/name\s*=\s*"([^"]+)"/);
+    if (nameMatch) name = nameMatch[1];
+  } catch (e) {}
+
+  // Try pyproject.toml (Python projects)
+  try {
+    const pyPath = path.join(cwd, 'pyproject.toml');
+    fs.accessSync(pyPath);
+    type = 'python';
+
+    // Try to extract project name
+    const pyContent = fs.readFileSync(pyPath, 'utf8');
+    const nameMatch = pyContent.match(/name\s*=\s*"([^"]+)"/);
+    if (nameMatch) name = nameMatch[1];
+  } catch (e) {}
+
+  // Try go.mod (Go projects)
+  try {
+    const goPath = path.join(cwd, 'go.mod');
+    const goContent = fs.readFileSync(goPath, 'utf8');
+    type = 'go';
+
+    const moduleMatch = goContent.match(/module\s+(\S+)/);
+    if (moduleMatch) {
+      // Use last part of module path as name
+      const parts = moduleMatch[1].split('/');
+      name = parts[parts.length - 1];
+    }
+  } catch (e) {}
+
+  return {
+    name: cap(name, 50),
+    type,
+    directory: cwd
+  };
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// SUGGESTION GENERATION
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Generate human-readable summaries of current work
+ * @param {object} git - Git info from getGitInfo()
+ * @param {object} project - Project info from getProjectInfo()
+ * @returns {object} - { brief, detailed }
+ */
+function generateSuggestions(git, project) {
+  const suggestions = {};
+
+  if (git?.branch && !git.isDetached) {
+    // We have git context - build meaningful summary
+    const branchDesc = ['main', 'master', 'develop'].includes(git.branch) ? '' : ` on ${git.branch}`;
+
+    if (git.recentCommits.length > 0) {
+      // Use most recent commit message as the summary
+      suggestions.brief = `${git.recentCommits[0].message} — ${project.name}`;
+    } else {
+      suggestions.brief = `Working on ${project.name}${branchDesc}`;
+    }
+
+    // Detailed version includes more context
+    const parts = [];
+    if (git.recentCommits.length > 0) {
+      parts.push(`Just pushed: "${git.recentCommits[0].message}"`);
+    }
+    if (branchDesc) {
+      parts.push(branchDesc.trim());
+    }
+    if (git.changedFiles.length > 0) {
+      // Group by directory for context
+      const dirs = [...new Set(git.changedFiles.map(f => {
+        const dir = f.split('/')[0];
+        return dir === f ? '.' : dir;
+      }))];
+      const dirsStr = dirs.slice(0, 2).join(', ');
+      parts.push(`${git.changedFiles.length} files in ${dirsStr}`);
+    }
+    if (git.hasUncommitted) {
+      parts.push('uncommitted changes');
+    }
+
+    suggestions.detailed = parts.join('. ') || suggestions.brief;
+  } else if (git?.isDetached) {
+    // Detached HEAD state
+    suggestions.brief = `Working on ${project.name} (${git.branch})`;
+    suggestions.detailed = suggestions.brief;
+  } else {
+    // No git - just use project info
+    suggestions.brief = `Working on ${project.name}`;
+    suggestions.detailed = suggestions.brief;
+  }
+
+  // Apply final length cap
+  suggestions.brief = cap(suggestions.brief, LIMITS.totalSummary);
+  suggestions.detailed = cap(suggestions.detailed, LIMITS.totalSummary * 2);
+
+  return suggestions;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// MAIN EXPORT
+// ═══════════════════════════════════════════════════════════════════════════
+
+/**
+ * Gather complete work context - the main entry point
+ * Safe, non-blocking, with graceful degradation
+ */
+function gatherWorkContext() {
+  const git = getGitInfo();
+  const project = getProjectInfo();
+  const suggestions = generateSuggestions(git, project);
+
+  return {
+    git,
+    project,
+    suggestions
+  };
+}
+
+/**
+ * Gather with timeout - for use in start.js where we can't block
+ * @param {number} timeoutMs - Maximum time to wait (default 2000ms)
+ */
+async function gatherWithTimeout(timeoutMs = 2000) {
+  return new Promise((resolve) => {
+    // Set a timeout that resolves with minimal fallback
+    const timer = setTimeout(() => {
+      resolve({
+        git: null,
+        project: { name: path.basename(process.cwd()), type: 'unknown', directory: process.cwd() },
+        suggestions: { brief: 'Working locally', detailed: 'Working locally' }
+      });
+    }, timeoutMs);
+
+    // Try to gather context
+    try {
+      const context = gatherWorkContext();
+      clearTimeout(timer);
+      resolve(context);
+    } catch (e) {
+      clearTimeout(timer);
+      resolve({
+        git: null,
+        project: { name: path.basename(process.cwd()), type: 'unknown', directory: process.cwd() },
+        suggestions: { brief: 'Working locally', detailed: 'Working locally' }
+      });
+    }
+  });
+}
+
+module.exports = {
+  gatherWorkContext,
+  gatherWithTimeout,
+  getGitInfo,
+  getProjectInfo,
+  // Exported for testing
+  sanitize,
+  redact,
+  cap
+};

package/tools/_work-context.manual-test.js

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+/**
+ * Manual verification tests for Ambient Context feature
+ *
+ * Run: node tools/_work-context.manual-test.js
+ *
+ * These tests verify the full integration flow as described in the plan.
+ */
+
+const { gatherWorkContext, gatherWithTimeout } = require('./_work-context');
+const path = require('path');
+const fs = require('fs');
+
+console.log('═══════════════════════════════════════════════════════════════');
+console.log('           AMBIENT CONTEXT - MANUAL VERIFICATION');
+console.log('═══════════════════════════════════════════════════════════════\n');
+
+// ═══════════════════════════════════════════════════════════════════════════
+// TEST 1: vibe_start includes work context
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('TEST 1: Work context gathering in current directory');
+console.log('─────────────────────────────────────────────────────');
+
+const ctx = gatherWorkContext();
+
+console.log('✓ Project name:', ctx.project?.name || '(none)');
+console.log('✓ Project type:', ctx.project?.type || '(unknown)');
+console.log('✓ Git branch:', ctx.git?.branch || '(not a git repo)');
+console.log('✓ Recent commits:', ctx.git?.recentCommits?.length || 0);
+console.log('✓ Changed files:', ctx.git?.changedFiles?.length || 0);
+console.log('✓ Has uncommitted:', ctx.git?.hasUncommitted ? 'yes' : 'no');
+console.log('');
+console.log('✓ Brief summary:', ctx.suggestions?.brief);
+console.log('✓ Detailed summary:', ctx.suggestions?.detailed);
+
+const test1Pass = ctx.project && ctx.suggestions?.brief;
+console.log('\n' + (test1Pass ? '✅ TEST 1 PASSED' : '❌ TEST 1 FAILED') + '\n');
+
+// ═══════════════════════════════════════════════════════════════════════════
+// TEST 2: Timeout behavior
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('TEST 2: Timeout and fallback behavior');
+console.log('─────────────────────────────────────────────────────');
+
+async function testTimeout() {
+  // Test normal timeout
+  const start1 = Date.now();
+  const ctx1 = await gatherWithTimeout(5000);
+  const elapsed1 = Date.now() - start1;
+  console.log(`✓ Normal gather: ${elapsed1}ms (should be < 5000ms)`);
+
+  // Test very short timeout (should use fallback)
+  const start2 = Date.now();
+  const ctx2 = await gatherWithTimeout(1);
+  const elapsed2 = Date.now() - start2;
+  console.log(`✓ Fallback gather: ${elapsed2}ms (should have fallback data)`);
+  console.log('  Fallback brief:', ctx2.suggestions?.brief);
+
+  const test2Pass = elapsed1 < 5000 && ctx2.suggestions?.brief;
+  console.log('\n' + (test2Pass ? '✅ TEST 2 PASSED' : '❌ TEST 2 FAILED') + '\n');
+  return test2Pass;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// TEST 3: Security - Redaction
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('TEST 3: Security - Sensitive data redaction');
+console.log('─────────────────────────────────────────────────────');
+
+const { redact, sanitize, cap } = require('./_work-context');
+
+const testCases = [
+  { input: 'email: user@example.com', expected: 'email: [REDACTED]', name: 'Email' },
+  { input: 'ghp_1234567890abcdefghijklmnopqrstuvwxyz', expected: '[REDACTED]', name: 'GitHub token' },
+  { input: 'sk-abcdefghijklmnopqrstuvwxyz12', expected: '[REDACTED]', name: 'OpenAI key' },
+  { input: 'my password is secret', expected: 'my [REDACTED] is [REDACTED]', name: 'Sensitive words' },
+];
+
+let test3Pass = true;
+testCases.forEach(tc => {
+  const result = redact(tc.input);
+  const passed = result === tc.expected;
+  if (!passed) test3Pass = false;
+  console.log(`${passed ? '✓' : '✗'} ${tc.name}: "${tc.input}" → "${result}"`);
+});
+
+console.log('\n' + (test3Pass ? '✅ TEST 3 PASSED' : '❌ TEST 3 FAILED') + '\n');
+
+// ═══════════════════════════════════════════════════════════════════════════
+// TEST 4: Security - ANSI escape removal
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('TEST 4: Security - ANSI escape sequence removal');
+console.log('─────────────────────────────────────────────────────');
+
+const ansiTests = [
+  { input: '\x1B[31mRed text\x1B[0m', expected: 'Red text', name: 'Color codes' },
+  { input: '\x1B[1m\x1B[4mBold underline\x1B[0m', expected: 'Bold underline', name: 'Style codes' },
+  { input: 'Normal text', expected: 'Normal text', name: 'No escapes' },
+];
+
+let test4Pass = true;
+ansiTests.forEach(tc => {
+  const result = sanitize(tc.input);
+  const passed = result === tc.expected;
+  if (!passed) test4Pass = false;
+  console.log(`${passed ? '✓' : '✗'} ${tc.name}: got "${result}"`);
+});
+
+console.log('\n' + (test4Pass ? '✅ TEST 4 PASSED' : '❌ TEST 4 FAILED') + '\n');
+
+// ═══════════════════════════════════════════════════════════════════════════
+// TEST 5: Fallbacks (non-git directory)
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('TEST 5: Fallback behavior in different directories');
+console.log('─────────────────────────────────────────────────────');
+
+// Save current directory
+const originalCwd = process.cwd();
+
+// Test in /tmp (non-git directory)
+try {
+  process.chdir('/tmp');
+  const tmpCtx = gatherWorkContext();
+  console.log('✓ In /tmp (non-git):');
+  console.log('  Project:', tmpCtx.project?.name || 'tmp');
+  console.log('  Git:', tmpCtx.git ? 'detected' : 'null (correct)');
+  console.log('  Brief:', tmpCtx.suggestions?.brief);
+
+  const test5Pass = tmpCtx.git === null && tmpCtx.suggestions?.brief;
+  console.log('\n' + (test5Pass ? '✅ TEST 5 PASSED' : '❌ TEST 5 FAILED') + '\n');
+} catch (e) {
+  console.log('✗ Error testing in /tmp:', e.message);
+  console.log('\n❌ TEST 5 FAILED\n');
+} finally {
+  process.chdir(originalCwd);
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// TEST 6: Work summary tool
+// ═══════════════════════════════════════════════════════════════════════════
+
+console.log('TEST 6: Work summary tool integration');
+console.log('─────────────────────────────────────────────────────');
+
+try {
+  const workSummary = require('./work-summary');
+  console.log('✓ Tool name:', workSummary.definition.name);
+  console.log('✓ Tool description exists:', !!workSummary.definition.description);
+
+  // Test handler
+  const result = workSummary.handler({ detail_level: 'brief' });
+  console.log('✓ Handler returns promise/result:', typeof result);
+
+  console.log('\n✅ TEST 6 PASSED\n');
+} catch (e) {
+  console.log('✗ Error:', e.message);
+  console.log('\n❌ TEST 6 FAILED\n');
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// Run async tests
+// ═══════════════════════════════════════════════════════════════════════════
+
+(async () => {
+  await testTimeout();
+
+  console.log('═══════════════════════════════════════════════════════════════');
+  console.log('                    VERIFICATION COMPLETE');
+  console.log('═══════════════════════════════════════════════════════════════\n');
+
+  console.log('NEXT STEPS FOR FULL TESTING:');
+  console.log('');
+  console.log('1. Start a vibe session in a git repo:');
+  console.log('   $ cd /path/to/git/repo');
+  console.log('   $ claude');
+  console.log('   > vibe');
+  console.log('   → Verify: Response includes workContext with summary');
+  console.log('   → Verify: First AskUserQuestion offers "Share your progress"');
+  console.log('');
+  console.log('2. Check presence auto-set:');
+  console.log('   → Have another user run: vibe who');
+  console.log('   → Verify: Your presence shows work summary');
+  console.log('');
+  console.log('3. Test compose with context:');
+  console.log('   > message @seth about what I\'m working on');
+  console.log('   → Verify: Draft includes real git/project context');
+  console.log('');
+  console.log('4. Test settings:');
+  console.log('   > vibe settings');
+  console.log('   → Verify: Shows "Auto Context: on"');
+  console.log('   > vibe settings --auto_context false');
+  console.log('   → Verify: Settings updated');
+  console.log('');
+})();