squidclaw 1.3.0 → 1.5.0

package/lib/engine.js

@@ -62,6 +62,8 @@ export class SquidclawEngine {
     pipeline.use('media', mediaMiddleware);
     pipeline.use('auto-links', autoLinksMiddleware);
     pipeline.use('auto-memory', autoMemoryMiddleware);
+    const { configChatMiddleware } = await import('./middleware/config-chat.js');
+    pipeline.use('config-chat', configChatMiddleware);
     pipeline.use('skill-check', skillCheckMiddleware);
     pipeline.use('typing', typingMiddleware);        // wraps AI call with typing indicator
     pipeline.use('ai-process', aiProcessMiddleware);
@@ -136,6 +138,19 @@ export class SquidclawEngine {
     // 5. Features (reminders, auto-memory, usage alerts)
     await this._initFeatures();
 
+    // 5b. Config Manager
+    try {
+      const { ConfigManager } = await import('./features/config-manager.js');
+      this.configManager = new ConfigManager(this);
+    } catch {}
+
+    // 5c. Sub-agents
+    try {
+      const { SubAgentManager } = await import('./features/sub-agents.js');
+      this.subAgents = new SubAgentManager(this);
+      if (this.toolRouter) this.toolRouter._subAgents = this.subAgents;
+    } catch {}
+
     // 6. Message Pipeline
     this.pipeline = await this._buildPipeline();
     console.log(`  🔧 Pipeline: ${this.pipeline.middleware.length} middleware`);

package/lib/features/config-manager.js

@@ -0,0 +1,238 @@
+/**
+ * 🦑 Config Manager
+ * Hot reload, chat commands, .env support, profiles, validation
+ */
+
+import { loadConfig, saveConfig, getHome } from '../core/config.js';
+import { readFileSync, writeFileSync, existsSync, copyFileSync } from 'fs';
+import { join } from 'path';
+import { logger } from '../core/logger.js';
+
+export class ConfigManager {
+  constructor(engine) {
+    this.engine = engine;
+    this.home = getHome();
+    this._loadEnv();
+    this._watchConfig();
+  }
+
+  // ── .env support ──
+
+  _loadEnv() {
+    const envPath = join(this.home, '.env');
+    if (!existsSync(envPath)) return;
+
+    try {
+      const lines = readFileSync(envPath, 'utf8').split('\n');
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) continue;
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx === -1) continue;
+        const key = trimmed.slice(0, eqIdx).trim();
+        const value = trimmed.slice(eqIdx + 1).trim().replace(/^["']|["']$/g, '');
+        process.env[key] = value;
+      }
+      logger.info('config', 'Loaded .env file');
+    } catch {}
+  }
+
+  // ── Hot reload ──
+
+  _watchConfig() {
+    const configPath = join(this.home, 'config.json');
+    try {
+      const { watch } = require('fs');
+      let debounce = null;
+      watch(configPath, () => {
+        if (debounce) clearTimeout(debounce);
+        debounce = setTimeout(() => {
+          try {
+            this.engine.config = loadConfig();
+            logger.info('config', 'Config hot-reloaded');
+          } catch (err) {
+            logger.error('config', 'Hot reload failed: ' + err.message);
+          }
+        }, 1000);
+      });
+    } catch {
+      // fs.watch not available — use polling
+      this._pollConfig(configPath);
+    }
+  }
+
+  _pollConfig(configPath) {
+    let lastMtime = 0;
+    try { lastMtime = readFileSync(configPath).length; } catch {}
+    
+    setInterval(() => {
+      try {
+        const content = readFileSync(configPath, 'utf8');
+        if (content.length !== lastMtime) {
+          lastMtime = content.length;
+          this.engine.config = loadConfig();
+          logger.info('config', 'Config hot-reloaded (poll)');
+        }
+      } catch {}
+    }, 5000);
+  }
+
+  // ── Set config value ──
+
+  set(path, value) {
+    const config = loadConfig();
+    const parts = path.split('.');
+    let obj = config;
+
+    for (let i = 0; i < parts.length - 1; i++) {
+      if (!obj[parts[i]]) obj[parts[i]] = {};
+      obj = obj[parts[i]];
+    }
+
+    // Auto-convert types
+    if (value === 'true') value = true;
+    else if (value === 'false') value = false;
+    else if (!isNaN(value) && value !== '') value = Number(value);
+
+    obj[parts[parts.length - 1]] = value;
+    saveConfig(config);
+    this.engine.config = config;
+
+    logger.info('config', `Set ${path} = ${JSON.stringify(value)}`);
+    return { path, value };
+  }
+
+  // ── Get config value ──
+
+  get(path) {
+    const config = loadConfig();
+    const parts = path.split('.');
+    let obj = config;
+
+    for (const part of parts) {
+      if (obj === undefined) return undefined;
+      obj = obj[part];
+    }
+
+    return obj;
+  }
+
+  // ── Profiles ──
+
+  saveProfile(name) {
+    const configPath = join(this.home, 'config.json');
+    const profilePath = join(this.home, `config.${name}.json`);
+    copyFileSync(configPath, profilePath);
+    return profilePath;
+  }
+
+  loadProfile(name) {
+    const profilePath = join(this.home, `config.${name}.json`);
+    if (!existsSync(profilePath)) throw new Error('Profile not found: ' + name);
+    
+    const configPath = join(this.home, 'config.json');
+    copyFileSync(profilePath, configPath);
+    this.engine.config = loadConfig();
+    return true;
+  }
+
+  listProfiles() {
+    const { readdirSync } = require('fs');
+    return readdirSync(this.home)
+      .filter(f => f.startsWith('config.') && f.endsWith('.json') && f !== 'config.json')
+      .map(f => f.replace('config.', '').replace('.json', ''));
+  }
+
+  // ── Validation ──
+
+  async validate() {
+    const config = loadConfig();
+    const results = [];
+
+    // Check AI providers
+    const providers = config.ai?.providers || {};
+    for (const [name, prov] of Object.entries(providers)) {
+      if (!prov.key || prov.key === 'local') continue;
+      
+      try {
+        const valid = await this._testProvider(name, prov.key);
+        results.push({ name, status: valid ? '✅' : '❌', message: valid ? 'Valid' : 'Invalid key' });
+      } catch (err) {
+        results.push({ name, status: '❌', message: err.message });
+      }
+    }
+
+    // Check Telegram
+    if (config.channels?.telegram?.token) {
+      try {
+        const res = await fetch(`https://api.telegram.org/bot${config.channels.telegram.token}/getMe`);
+        const data = await res.json();
+        results.push({ name: 'Telegram', status: data.ok ? '✅' : '❌', message: data.ok ? '@' + data.result.username : 'Invalid token' });
+      } catch (err) {
+        results.push({ name: 'Telegram', status: '❌', message: err.message });
+      }
+    }
+
+    // Check agents
+    const agentsDir = join(this.home, 'agents');
+    if (existsSync(agentsDir)) {
+      const { readdirSync } = require('fs');
+      const count = readdirSync(agentsDir, { withFileTypes: true }).filter(d => d.isDirectory()).length;
+      results.push({ name: 'Agents', status: '✅', message: count + ' configured' });
+    }
+
+    return results;
+  }
+
+  async _testProvider(name, key) {
+    const urls = {
+      anthropic: 'https://api.anthropic.com/v1/models',
+      openai: 'https://api.openai.com/v1/models',
+      google: `https://generativelanguage.googleapis.com/v1beta/models?key=${key}`,
+      groq: 'https://api.groq.com/openai/v1/models',
+    };
+
+    const url = urls[name];
+    if (!url) return true; // Can't validate, assume OK
+
+    const headers = {};
+    if (name === 'anthropic') {
+      headers['x-api-key'] = key;
+      headers['anthropic-version'] = '2023-06-01';
+    } else if (name !== 'google') {
+      headers['Authorization'] = 'Bearer ' + key;
+    }
+
+    const res = await fetch(url, { headers });
+    return res.ok;
+  }
+
+  // ── Chat command parsing ──
+
+  static parseConfigCommand(message) {
+    const lower = message.toLowerCase().trim();
+
+    // "switch to gpt-4o" / "use gemini"
+    const modelMatch = lower.match(/(?:switch|change|use)\s+(?:to\s+)?(?:model\s+)?(.+)/);
+    if (modelMatch) {
+      const model = modelMatch[1].trim();
+      // Map common names to actual model IDs
+      const aliases = {
+        'gpt4': 'gpt-4o', 'gpt-4': 'gpt-4o', 'gpt4o': 'gpt-4o',
+        'claude': 'claude-sonnet-4-20250514', 'sonnet': 'claude-sonnet-4-20250514',
+        'opus': 'claude-opus-4', 'haiku': 'claude-haiku-3-5',
+        'gemini': 'gemini-2.5-flash', 'flash': 'gemini-2.5-flash',
+        'llama': 'llama-3.3-70b-versatile', 'deepseek': 'deepseek-chat',
+      };
+      return { action: 'set_model', model: aliases[model] || model };
+    }
+
+    // "set temperature to 0.8"
+    const setMatch = lower.match(/set\s+(\w[\w.]*)\s+(?:to\s+)?(.+)/);
+    if (setMatch) {
+      return { action: 'set', path: setMatch[1], value: setMatch[2] };
+    }
+
+    return null;
+  }
+}

package/lib/features/sub-agents.js

@@ -0,0 +1,105 @@
+/**
+ * 🦑 Sub-Agents
+ * Spawn isolated agent tasks that run in the background
+ */
+
+import { logger } from '../core/logger.js';
+
+export class SubAgentManager {
+  constructor(engine) {
+    this.engine = engine;
+    this.running = new Map(); // id -> { task, status, result, startedAt }
+    this.counter = 0;
+  }
+
+  /**
+   * Spawn a sub-agent task
+   */
+  async spawn(agentId, task, options = {}) {
+    const id = 'sub_' + (++this.counter) + '_' + Date.now().toString(36);
+    const model = options.model || this.engine.config.ai?.defaultModel;
+    const timeout = options.timeout || 60000;
+
+    this.running.set(id, {
+      id,
+      task,
+      status: 'running',
+      result: null,
+      startedAt: new Date(),
+      agentId,
+    });
+
+    logger.info('sub-agents', `Spawned ${id}: ${task.slice(0, 80)}`);
+
+    // Run in background
+    this._execute(id, agentId, task, model, timeout).catch(err => {
+      const sub = this.running.get(id);
+      if (sub) {
+        sub.status = 'error';
+        sub.result = err.message;
+      }
+    });
+
+    return id;
+  }
+
+  async _execute(id, agentId, task, model, timeout) {
+    const sub = this.running.get(id);
+    
+    try {
+      const messages = [
+        { role: 'system', content: 'You are a sub-agent. Complete this task concisely and return the result. Do not ask questions.' },
+        { role: 'user', content: task },
+      ];
+
+      const response = await Promise.race([
+        this.engine.aiGateway.chat(messages, { model }),
+        new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), timeout)),
+      ]);
+
+      sub.status = 'complete';
+      sub.result = response.content;
+      sub.completedAt = new Date();
+      
+      logger.info('sub-agents', `Completed ${id}: ${response.content.slice(0, 50)}`);
+    } catch (err) {
+      sub.status = 'error';
+      sub.result = err.message;
+      logger.error('sub-agents', `Failed ${id}: ${err.message}`);
+    }
+  }
+
+  /**
+   * Get sub-agent status
+   */
+  get(id) {
+    return this.running.get(id);
+  }
+
+  /**
+   * List all sub-agents
+   */
+  list(agentId) {
+    return Array.from(this.running.values())
+      .filter(s => !agentId || s.agentId === agentId)
+      .map(s => ({
+        id: s.id,
+        task: s.task.slice(0, 80),
+        status: s.status,
+        result: s.result?.slice(0, 200),
+        duration: s.completedAt ? (s.completedAt - s.startedAt) / 1000 + 's' : 'running',
+      }));
+  }
+
+  /**
+   * Kill a running sub-agent
+   */
+  kill(id) {
+    const sub = this.running.get(id);
+    if (sub) {
+      sub.status = 'killed';
+      return true;
+    }
+    return false;
+  }
+}

package/lib/middleware/commands.js

@@ -16,7 +16,11 @@ export async function commandsMiddleware(ctx, next) {
       '/memories — what I remember about you',
       '/tasks — your todo list',
       '/usage — spending report',
-      '/help — this message',
+      '/config — manage settings',
+              '/exec <cmd> — run a shell command',
+              '/files — list sandbox files',
+              '/subagents — list background tasks',
+              '/help — this message',
       '', 'Just chat normally! 🦑',
     ].join('\n'));
     return;
@@ -117,5 +121,116 @@ export async function commandsMiddleware(ctx, next) {
     return;
   }
 
+  if (cmd === '/config') {
+    const args = msg.slice(8).trim();
+    if (!args || args === 'help') {
+      await ctx.reply([
+        '⚙️ *Config Commands*', '',
+        '/config get <path> — show value',
+        '/config set <path> <value> — set value',
+        '/config test — validate all connections',
+        '/config profiles — list saved profiles',
+        '/config save <name> — save current config',
+        '/config load <name> — switch profile',
+        '', 'Or just say: "switch to gemini" 🦑',
+      ].join('\n'));
+      return;
+    }
+
+    const cm = ctx.engine.configManager;
+    if (!cm) { await ctx.reply('❌ Config manager not available'); return; }
+
+    if (args.startsWith('get ')) {
+      const val = cm.get(args.slice(4).trim());
+      await ctx.reply('⚙️ ' + args.slice(4).trim() + ' = ' + JSON.stringify(val));
+      return;
+    }
+
+    if (args.startsWith('set ')) {
+      const parts = args.slice(4).trim().split(/\s+/);
+      const path = parts[0];
+      const value = parts.slice(1).join(' ');
+      cm.set(path, value);
+      await ctx.reply('✅ Set *' + path + '* = ' + value);
+      return;
+    }
+
+    if (args === 'test' || args === 'validate') {
+      await ctx.reply('🔍 Validating connections...');
+      const results = await cm.validate();
+      const lines = results.map(r => r.status + ' *' + r.name + '* — ' + r.message);
+      await ctx.reply('⚙️ *Config Validation*\n\n' + lines.join('\n'));
+      return;
+    }
+
+    if (args === 'profiles') {
+      const profiles = cm.listProfiles();
+      await ctx.reply(profiles.length ? '📋 Profiles: ' + profiles.join(', ') : '📋 No saved profiles');
+      return;
+    }
+
+    if (args.startsWith('save ')) {
+      cm.saveProfile(args.slice(5).trim());
+      await ctx.reply('✅ Profile saved: ' + args.slice(5).trim());
+      return;
+    }
+
+    if (args.startsWith('load ')) {
+      try {
+        cm.loadProfile(args.slice(5).trim());
+        await ctx.reply('✅ Profile loaded: ' + args.slice(5).trim() + '\n⚠️ Restart recommended');
+      } catch (err) {
+        await ctx.reply('❌ ' + err.message);
+      }
+      return;
+    }
+  }
+
+  if (cmd === '/exec') {
+    const command = msg.slice(6).trim();
+    if (!command) { await ctx.reply('Usage: /exec <command>'); return; }
+    try {
+      const { ShellTool } = await import('../tools/shell.js');
+      const sh = new ShellTool();
+      const result = sh.exec(command);
+      const output = result.error ? '❌ ' + result.error : '```\n' + (result.output || '(no output)') + '\n```';
+      await ctx.reply(output);
+    } catch (err) {
+      await ctx.reply('❌ ' + err.message);
+    }
+    return;
+  }
+
+  if (cmd === '/files') {
+    try {
+      const { ShellTool } = await import('../tools/shell.js');
+      const sh = new ShellTool();
+      const result = sh.listDir('.');
+      const list = result.files?.map(f => (f.type === 'dir' ? '📁 ' : '📄 ') + f.name).join('\n') || 'Empty';
+      await ctx.reply('📂 *Sandbox Files*\n\n' + list);
+    } catch (err) {
+      await ctx.reply('❌ ' + err.message);
+    }
+    return;
+  }
+
+  if (cmd === '/subagents') {
+    if (ctx.engine.subAgents) {
+      const list = ctx.engine.subAgents.list(ctx.agentId);
+      if (list.length === 0) {
+        await ctx.reply('🤖 No sub-agents running');
+      } else {
+        const lines = list.map(s => 
+          (s.status === 'complete' ? '✅' : s.status === 'error' ? '❌' : '⏳') + 
+          ' ' + s.id + '\n  ' + s.task + '\n  ' + s.status + (s.duration ? ' (' + s.duration + ')' : '')
+        );
+        await ctx.reply('🤖 *Sub-Agents*\n\n' + lines.join('\n\n'));
+      }
+    } else {
+      await ctx.reply('🤖 Sub-agents not available');
+    }
+    return;
+  }
+
   await next();
 }

package/lib/middleware/config-chat.js

@@ -0,0 +1,35 @@
+/**
+ * Handle config changes via natural language
+ * "switch to gemini", "use gpt-4o", "set temperature to 0.8"
+ */
+import { logger } from '../core/logger.js';
+
+export async function configChatMiddleware(ctx, next) {
+  if (!ctx.engine.configManager) { await next(); return; }
+
+  const { ConfigManager } = await import('../features/config-manager.js');
+  const parsed = ConfigManager.parseConfigCommand(ctx.message);
+  
+  if (!parsed) { await next(); return; }
+
+  try {
+    if (parsed.action === 'set_model') {
+      ctx.engine.configManager.set('ai.defaultModel', parsed.model);
+      // Update agent's model too
+      if (ctx.agent) ctx.agent.model = parsed.model;
+      await ctx.reply('✅ Model switched to *' + parsed.model + '*\n\nI will use this model from now on 🦑');
+      return;
+    }
+
+    if (parsed.action === 'set') {
+      ctx.engine.configManager.set(parsed.path, parsed.value);
+      await ctx.reply('✅ Set *' + parsed.path + '* = ' + parsed.value);
+      return;
+    }
+  } catch (err) {
+    await ctx.reply('❌ Config error: ' + err.message);
+    return;
+  }
+
+  await next();
+}

package/lib/tools/router.js

@@ -59,6 +59,25 @@ export class ToolRouter {
         'Send an email.');
     }
 
+    tools.push('', '### Run Command',
+      '---TOOL:exec:ls -la---',
+      'Execute a shell command. Output is returned. Sandboxed for safety.',
+      '', '### Read File',
+      '---TOOL:readfile:filename.txt---',
+      'Read contents of a file in the sandbox.',
+      '', '### Write File',
+      '---TOOL:writefile:filename.txt|file contents here---',
+      'Create or overwrite a file. Use pipe (|) to separate filename from content.',
+      '', '### List Files',
+      '---TOOL:ls:path---',
+      'List files in a directory.',
+      '', '### Spawn Sub-Agent',
+      '---TOOL:spawn:Research the latest AI news and summarize top 5 stories---',
+      'Spawn a background task. Runs independently and returns result when done.',
+      '', '### Run Python',
+      '---TOOL:python:print(2+2)---',
+      'Execute Python code and return output.');
+
     tools.push('', '### Screenshot',
       '---TOOL:screenshot:https://example.com---',
       'Take a screenshot of a website. Returns the screenshot as an image.',
@@ -149,6 +168,60 @@ export class ToolRouter {
           }
           break;
         }
+        case 'exec':
+        case 'shell':
+        case 'run': {
+          const { ShellTool } = await import('./shell.js');
+          const sh = new ShellTool();
+          const result = sh.exec(toolArg);
+          toolResult = result.error ? 'Error: ' + result.error : result.output || '(no output)';
+          break;
+        }
+        case 'readfile': {
+          const { ShellTool } = await import('./shell.js');
+          const sh = new ShellTool();
+          const result = sh.readFile(toolArg);
+          toolResult = result.error || result.content;
+          break;
+        }
+        case 'writefile': {
+          const pipeIdx = toolArg.indexOf('|');
+          if (pipeIdx === -1) { toolResult = 'Format: filename|content'; break; }
+          const fname = toolArg.slice(0, pipeIdx).trim();
+          const fcontent = toolArg.slice(pipeIdx + 1);
+          const { ShellTool } = await import('./shell.js');
+          const sh = new ShellTool();
+          const result = sh.writeFile(fname, fcontent);
+          toolResult = result.error || 'File written: ' + fname;
+          break;
+        }
+        case 'ls':
+        case 'listdir': {
+          const { ShellTool } = await import('./shell.js');
+          const sh = new ShellTool();
+          const result = sh.listDir(toolArg || '.');
+          toolResult = result.error || result.files.map(f => (f.type === 'dir' ? '📁 ' : '📄 ') + f.name).join('\n');
+          break;
+        }
+        case 'python':
+        case 'py': {
+          const { ShellTool } = await import('./shell.js');
+          const sh = new ShellTool();
+          // Write Python script then execute
+          sh.writeFile('_run.py', toolArg);
+          const result = sh.exec('python3 _run.py');
+          toolResult = result.error ? 'Error: ' + result.error : result.output || '(no output)';
+          break;
+        }
+        case 'spawn': {
+          if (this._subAgents) {
+            const id = await this._subAgents.spawn(agentId, toolArg);
+            toolResult = 'Sub-agent spawned: ' + id + '. It will complete in the background.';
+          } else {
+            toolResult = 'Sub-agents not available';
+          }
+          break;
+        }
         case 'screenshot': {
           try {
             const { BrowserControl } = await import('./browser-control.js');

package/lib/tools/shell.js

@@ -0,0 +1,111 @@
+/**
+ * 🦑 Shell & File System
+ * Sandboxed command execution and file operations
+ */
+
+import { execSync } from 'child_process';
+import { readFileSync, writeFileSync, readdirSync, existsSync, mkdirSync, statSync } from 'fs';
+import { join, resolve } from 'path';
+import { logger } from '../core/logger.js';
+
+// Sandboxed base directory
+const SANDBOX_DIR = process.env.SQUIDCLAW_SANDBOX || '/tmp/squidclaw-sandbox';
+
+// Blocked commands for safety
+const BLOCKED = [
+  'rm -rf /', 'mkfs', 'dd if=', ':(){', 'fork bomb',
+  'chmod 777 /', 'chown', 'passwd', 'userdel', 'useradd',
+  'shutdown', 'reboot', 'halt', 'poweroff',
+  'iptables', 'ufw', 'firewall',
+];
+
+export class ShellTool {
+  constructor(home) {
+    this.sandbox = SANDBOX_DIR;
+    mkdirSync(this.sandbox, { recursive: true });
+  }
+
+  /**
+   * Execute a shell command (sandboxed)
+   */
+  exec(command, options = {}) {
+    // Safety check
+    const lower = command.toLowerCase();
+    for (const blocked of BLOCKED) {
+      if (lower.includes(blocked)) {
+        return { error: 'Blocked for safety: ' + blocked };
+      }
+    }
+
+    const timeout = options.timeout || 10000;
+    const cwd = options.cwd || this.sandbox;
+
+    try {
+      const output = execSync(command, {
+        cwd,
+        timeout,
+        maxBuffer: 1024 * 1024,
+        encoding: 'utf8',
+        env: { ...process.env, HOME: this.sandbox },
+      });
+      logger.info('shell', `Executed: ${command.slice(0, 80)}`);
+      return { output: output.trim().slice(0, 3000), exitCode: 0 };
+    } catch (err) {
+      return { 
+        output: (err.stdout || '').trim().slice(0, 1000),
+        error: (err.stderr || err.message).trim().slice(0, 1000),
+        exitCode: err.status || 1,
+      };
+    }
+  }
+
+  /**
+   * Read a file (sandboxed)
+   */
+  readFile(path) {
+    const safePath = this._safePath(path);
+    if (!existsSync(safePath)) return { error: 'File not found: ' + path };
+    
+    const stat = statSync(safePath);
+    if (stat.size > 100000) return { error: 'File too large: ' + (stat.size / 1024).toFixed(0) + ' KB' };
+    
+    return { content: readFileSync(safePath, 'utf8').slice(0, 5000) };
+  }
+
+  /**
+   * Write a file (sandboxed)
+   */
+  writeFile(path, content) {
+    const safePath = this._safePath(path);
+    const dir = resolve(safePath, '..');
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(safePath, content);
+    logger.info('shell', `Wrote file: ${path}`);
+    return { success: true, path: safePath };
+  }
+
+  /**
+   * List directory (sandboxed)
+   */
+  listDir(path) {
+    const safePath = this._safePath(path || '.');
+    if (!existsSync(safePath)) return { error: 'Directory not found' };
+    
+    const entries = readdirSync(safePath, { withFileTypes: true });
+    return {
+      files: entries.map(e => ({
+        name: e.name,
+        type: e.isDirectory() ? 'dir' : 'file',
+      })),
+    };
+  }
+
+  _safePath(p) {
+    // Prevent path traversal
+    const resolved = resolve(this.sandbox, p);
+    if (!resolved.startsWith(this.sandbox)) {
+      throw new Error('Path outside sandbox');
+    }
+    return resolved;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squidclaw",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "🦑 AI agent platform — human-like agents for WhatsApp, Telegram & more",
   "main": "lib/engine.js",
   "bin": {