squidclaw 3.0.13 → 3.0.14

package/dist/plugin-sdk/manager-runtime-DrpyZvO0.js

@@ -0,0 +1,15 @@
+import "./run-with-concurrency-5DMu9szx.js";
+import "./paths-8xF5kDne.js";
+import "./github-copilot-token-Dy-0-Kh3.js";
+import "./config-FhBFLsNm.js";
+import "./logger-DDdrdbDu.js";
+import "./paths-C6W4VHoa.js";
+import "./redact-BoNEjbpF.js";
+import "./errors-B8oJXuCF.js";
+import "./ssrf-B3XRWBsP.js";
+import "./fetch-guard-W_A4uSz2.js";
+import "./api-key-rotation-CrX0fvDj.js";
+import { t as MemoryIndexManager } from "./manager-DzFj9oHX.js";
+import "./query-expansion-eeVz_aEm.js";
+
+export { MemoryIndexManager };

package/dist/plugin-sdk/mattermost.js

@@ -5,7 +5,7 @@ import fs, { constants } from "node:fs";
 import os from "node:os";
 import chalk, { Chalk } from "chalk";
 import { Logger } from "tslog";
-import JSON5 from "json5";
+import json5 from "json5";
 import util, { promisify } from "node:util";
 import fs$1 from "node:fs/promises";
 import process$1 from "node:process";
@@ -400,7 +400,7 @@ function readLoggingConfig() {
 	try {
 		if (!fs.existsSync(configPath)) return;
 		const raw = fs.readFileSync(configPath, "utf-8");
-		const logging = JSON5.parse(raw)?.logging;
+		const logging = json5.parse(raw)?.logging;
 		if (!logging || typeof logging !== "object" || Array.isArray(logging)) return;
 		return logging;
 	} catch {
@@ -4481,7 +4481,7 @@ function resolveSquidClawManifestBlock(params) {
 	const raw = getFrontmatterString(params.frontmatter, params.key ?? "metadata");
 	if (!raw) return;
 	try {
-		const parsed = JSON5.parse(raw);
+		const parsed = json5.parse(raw);
 		if (!parsed || typeof parsed !== "object") return;
 		const manifestKeys = [MANIFEST_KEY, ...LEGACY_MANIFEST_KEYS];
 		for (const key of manifestKeys) {

package/dist/plugin-sdk/outbound-CQ7uBBML.js

@@ -0,0 +1,212 @@
+import { n as loadConfig } from "./config-FhBFLsNm.js";
+import { G as getChildLogger, M as toWhatsappJid, _ as escapeRegExp, a as createSubsystemLogger } from "./logger-DDdrdbDu.js";
+import { n as normalizePollInput } from "./polls-3WJMd-G-.js";
+import { i as resolveMarkdownTableMode, v as loadWebMedia } from "./ir-JaPZ0yKH.js";
+import { t as convertMarkdownTables } from "./tables-bDM_jlLP.js";
+import { n as generateSecureUuid } from "./secure-random-IkuYAMEf.js";
+import { i as redactIdentifier, n as requireActiveWebListener } from "./active-listener-DZCohPuZ.js";
+
+//#region src/markdown/whatsapp.ts
+/**
+* Convert standard Markdown formatting to WhatsApp-compatible markup.
+*
+* WhatsApp uses its own formatting syntax:
+*   bold:          *text*
+*   italic:        _text_
+*   strikethrough: ~text~
+*   monospace:     ```text```
+*
+* Standard Markdown uses:
+*   bold:          **text** or __text__
+*   italic:        *text* or _text_
+*   strikethrough: ~~text~~
+*   code:          `text` (inline) or ```text``` (block)
+*
+* The conversion preserves fenced code blocks and inline code,
+* then converts bold and strikethrough markers.
+*/
+/** Placeholder tokens used during conversion to protect code spans. */
+const FENCE_PLACEHOLDER = "\0FENCE";
+const INLINE_CODE_PLACEHOLDER = "\0CODE";
+/**
+* Convert standard Markdown bold/italic/strikethrough to WhatsApp formatting.
+*
+* Order of operations matters:
+* 1. Protect fenced code blocks (```...```) — already WhatsApp-compatible
+* 2. Protect inline code (`...`) — leave as-is
+* 3. Convert **bold** → *bold* and __bold__ → *bold*
+* 4. Convert ~~strike~~ → ~strike~
+* 5. Restore protected spans
+*
+* Italic *text* and _text_ are left alone since WhatsApp uses _text_ for italic
+* and single * is already WhatsApp bold — no conversion needed for single markers.
+*/
+function markdownToWhatsApp(text) {
+	if (!text) return text;
+	const fences = [];
+	let result = text.replace(/```[\s\S]*?```/g, (match) => {
+		fences.push(match);
+		return `${FENCE_PLACEHOLDER}${fences.length - 1}`;
+	});
+	const inlineCodes = [];
+	result = result.replace(/`[^`\n]+`/g, (match) => {
+		inlineCodes.push(match);
+		return `${INLINE_CODE_PLACEHOLDER}${inlineCodes.length - 1}`;
+	});
+	result = result.replace(/\*\*(.+?)\*\*/g, "*$1*");
+	result = result.replace(/__(.+?)__/g, "*$1*");
+	result = result.replace(/~~(.+?)~~/g, "~$1~");
+	result = result.replace(new RegExp(`${escapeRegExp(INLINE_CODE_PLACEHOLDER)}(\\d+)`, "g"), (_, idx) => inlineCodes[Number(idx)] ?? "");
+	result = result.replace(new RegExp(`${escapeRegExp(FENCE_PLACEHOLDER)}(\\d+)`, "g"), (_, idx) => fences[Number(idx)] ?? "");
+	return result;
+}
+
+//#endregion
+//#region src/web/outbound.ts
+const outboundLog = createSubsystemLogger("gateway/channels/whatsapp").child("outbound");
+async function sendMessageWhatsApp(to, body, options) {
+	let text = body;
+	const correlationId = generateSecureUuid();
+	const startedAt = Date.now();
+	const { listener: active, accountId: resolvedAccountId } = requireActiveWebListener(options.accountId);
+	const tableMode = resolveMarkdownTableMode({
+		cfg: options.cfg ?? loadConfig(),
+		channel: "whatsapp",
+		accountId: resolvedAccountId ?? options.accountId
+	});
+	text = convertMarkdownTables(text ?? "", tableMode);
+	text = markdownToWhatsApp(text);
+	const redactedTo = redactIdentifier(to);
+	const logger = getChildLogger({
+		module: "web-outbound",
+		correlationId,
+		to: redactedTo
+	});
+	try {
+		const jid = toWhatsappJid(to);
+		const redactedJid = redactIdentifier(jid);
+		let mediaBuffer;
+		let mediaType;
+		let documentFileName;
+		if (options.mediaUrl) {
+			const media = await loadWebMedia(options.mediaUrl, { localRoots: options.mediaLocalRoots });
+			const caption = text || void 0;
+			mediaBuffer = media.buffer;
+			mediaType = media.contentType;
+			if (media.kind === "audio") mediaType = media.contentType === "audio/ogg" ? "audio/ogg; codecs=opus" : media.contentType ?? "application/octet-stream";
+			else if (media.kind === "video") text = caption ?? "";
+			else if (media.kind === "image") text = caption ?? "";
+			else {
+				text = caption ?? "";
+				documentFileName = media.fileName;
+			}
+		}
+		outboundLog.info(`Sending message -> ${redactedJid}${options.mediaUrl ? " (media)" : ""}`);
+		logger.info({
+			jid: redactedJid,
+			hasMedia: Boolean(options.mediaUrl)
+		}, "sending message");
+		await active.sendComposingTo(to);
+		const accountId = Boolean(options.accountId?.trim()) ? resolvedAccountId : void 0;
+		const sendOptions = options.gifPlayback || accountId || documentFileName ? {
+			...options.gifPlayback ? { gifPlayback: true } : {},
+			...documentFileName ? { fileName: documentFileName } : {},
+			accountId
+		} : void 0;
+		const messageId = (sendOptions ? await active.sendMessage(to, text, mediaBuffer, mediaType, sendOptions) : await active.sendMessage(to, text, mediaBuffer, mediaType))?.messageId ?? "unknown";
+		const durationMs = Date.now() - startedAt;
+		outboundLog.info(`Sent message ${messageId} -> ${redactedJid}${options.mediaUrl ? " (media)" : ""} (${durationMs}ms)`);
+		logger.info({
+			jid: redactedJid,
+			messageId
+		}, "sent message");
+		return {
+			messageId,
+			toJid: jid
+		};
+	} catch (err) {
+		logger.error({
+			err: String(err),
+			to: redactedTo,
+			hasMedia: Boolean(options.mediaUrl)
+		}, "failed to send via web session");
+		throw err;
+	}
+}
+async function sendReactionWhatsApp(chatJid, messageId, emoji, options) {
+	const correlationId = generateSecureUuid();
+	const { listener: active } = requireActiveWebListener(options.accountId);
+	const redactedChatJid = redactIdentifier(chatJid);
+	const logger = getChildLogger({
+		module: "web-outbound",
+		correlationId,
+		chatJid: redactedChatJid,
+		messageId
+	});
+	try {
+		const redactedJid = redactIdentifier(toWhatsappJid(chatJid));
+		outboundLog.info(`Sending reaction "${emoji}" -> message ${messageId}`);
+		logger.info({
+			chatJid: redactedJid,
+			messageId,
+			emoji
+		}, "sending reaction");
+		await active.sendReaction(chatJid, messageId, emoji, options.fromMe ?? false, options.participant);
+		outboundLog.info(`Sent reaction "${emoji}" -> message ${messageId}`);
+		logger.info({
+			chatJid: redactedJid,
+			messageId,
+			emoji
+		}, "sent reaction");
+	} catch (err) {
+		logger.error({
+			err: String(err),
+			chatJid: redactedChatJid,
+			messageId,
+			emoji
+		}, "failed to send reaction via web session");
+		throw err;
+	}
+}
+async function sendPollWhatsApp(to, poll, options) {
+	const correlationId = generateSecureUuid();
+	const startedAt = Date.now();
+	const { listener: active } = requireActiveWebListener(options.accountId);
+	const redactedTo = redactIdentifier(to);
+	const logger = getChildLogger({
+		module: "web-outbound",
+		correlationId,
+		to: redactedTo
+	});
+	try {
+		const jid = toWhatsappJid(to);
+		const redactedJid = redactIdentifier(jid);
+		const normalized = normalizePollInput(poll, { maxOptions: 12 });
+		outboundLog.info(`Sending poll -> ${redactedJid}`);
+		logger.info({
+			jid: redactedJid,
+			optionCount: normalized.options.length,
+			maxSelections: normalized.maxSelections
+		}, "sending poll");
+		const messageId = (await active.sendPoll(to, normalized))?.messageId ?? "unknown";
+		const durationMs = Date.now() - startedAt;
+		outboundLog.info(`Sent poll ${messageId} -> ${redactedJid} (${durationMs}ms)`);
+		logger.info({
+			jid: redactedJid,
+			messageId
+		}, "sent poll");
+		return {
+			messageId,
+			toJid: jid
+		};
+	} catch (err) {
+		logger.error({
+			err: String(err),
+			to: redactedTo
+		}, "failed to send poll via web session");
+		throw err;
+	}
+}
+
+//#endregion
+export { markdownToWhatsApp as i, sendPollWhatsApp as n, sendReactionWhatsApp as r, sendMessageWhatsApp as t };

package/dist/plugin-sdk/outbound-attachment-dTE6EVdX.js

@@ -0,0 +1,19 @@
+import { t as buildOutboundMediaLoadOptions } from "./load-options-DNSaiajj.js";
+import { v as loadWebMedia } from "./ir-JaPZ0yKH.js";
+import { a as saveMediaBuffer } from "./store-DFvIhzWZ.js";
+
+//#region src/media/outbound-attachment.ts
+async function resolveOutboundAttachmentFromUrl(mediaUrl, maxBytes, options) {
+	const media = await loadWebMedia(mediaUrl, buildOutboundMediaLoadOptions({
+		maxBytes,
+		mediaLocalRoots: options?.localRoots
+	}));
+	const saved = await saveMediaBuffer(media.buffer, media.contentType ?? void 0, "outbound", maxBytes);
+	return {
+		path: saved.path,
+		contentType: saved.contentType
+	};
+}
+
+//#endregion
+export { resolveOutboundAttachmentFromUrl as t };

package/dist/plugin-sdk/path-alias-guards-gBhrAn14.js

@@ -0,0 +1,43 @@
+import { F as resolveBoundaryPath, P as BOUNDARY_PATH_ALIAS_POLICIES, R as isNotFoundPathError } from "./run-with-concurrency-5DMu9szx.js";
+import os from "node:os";
+import fs from "node:fs/promises";
+
+//#region src/infra/hardlink-guards.ts
+async function assertNoHardlinkedFinalPath(params) {
+	if (params.allowFinalHardlinkForUnlink) return;
+	let stat;
+	try {
+		stat = await fs.stat(params.filePath);
+	} catch (err) {
+		if (isNotFoundPathError(err)) return;
+		throw err;
+	}
+	if (!stat.isFile()) return;
+	if (stat.nlink > 1) throw new Error(`Hardlinked path is not allowed under ${params.boundaryLabel} (${shortPath(params.root)}): ${shortPath(params.filePath)}`);
+}
+function shortPath(value) {
+	if (value.startsWith(os.homedir())) return `~${value.slice(os.homedir().length)}`;
+	return value;
+}
+
+//#endregion
+//#region src/infra/path-alias-guards.ts
+const PATH_ALIAS_POLICIES = BOUNDARY_PATH_ALIAS_POLICIES;
+async function assertNoPathAliasEscape(params) {
+	const resolved = await resolveBoundaryPath({
+		absolutePath: params.absolutePath,
+		rootPath: params.rootPath,
+		boundaryLabel: params.boundaryLabel,
+		policy: params.policy
+	});
+	if (params.policy?.allowFinalSymlinkForUnlink === true && resolved.kind === "symlink") return;
+	await assertNoHardlinkedFinalPath({
+		filePath: resolved.absolutePath,
+		root: resolved.rootPath,
+		boundaryLabel: params.boundaryLabel,
+		allowFinalHardlinkForUnlink: params.policy?.allowFinalHardlinkForUnlink
+	});
+}
+
+//#endregion
+export { assertNoPathAliasEscape as n, PATH_ALIAS_POLICIES as t };

package/dist/plugin-sdk/paths-C6W4VHoa.js

@@ -0,0 +1,166 @@
+import { $ as normalizeAgentId, K as DEFAULT_AGENT_ID } from "./run-with-concurrency-5DMu9szx.js";
+import { c as resolveStateDir, d as resolveRequiredHomeDir, l as expandHomePrefix } from "./paths-8xF5kDne.js";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+
+//#region src/config/sessions/paths.ts
+function resolveAgentSessionsDir(agentId, env = process.env, homedir = () => resolveRequiredHomeDir(env, os.homedir)) {
+	const root = resolveStateDir(env, homedir);
+	const id = normalizeAgentId(agentId ?? DEFAULT_AGENT_ID);
+	return path.join(root, "agents", id, "sessions");
+}
+function resolveSessionTranscriptsDirForAgent(agentId, env = process.env, homedir = () => resolveRequiredHomeDir(env, os.homedir)) {
+	return resolveAgentSessionsDir(agentId, env, homedir);
+}
+function resolveDefaultSessionStorePath(agentId) {
+	return path.join(resolveAgentSessionsDir(agentId), "sessions.json");
+}
+const MULTI_STORE_PATH_SENTINEL = "(multiple)";
+function resolveSessionFilePathOptions(params) {
+	const agentId = params.agentId?.trim();
+	const storePath = params.storePath?.trim();
+	if (storePath && storePath !== MULTI_STORE_PATH_SENTINEL) {
+		const sessionsDir = path.dirname(path.resolve(storePath));
+		return agentId ? {
+			sessionsDir,
+			agentId
+		} : { sessionsDir };
+	}
+	if (agentId) return { agentId };
+}
+const SAFE_SESSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
+function validateSessionId(sessionId) {
+	const trimmed = sessionId.trim();
+	if (!SAFE_SESSION_ID_RE.test(trimmed)) throw new Error(`Invalid session ID: ${sessionId}`);
+	return trimmed;
+}
+function resolveSessionsDir(opts) {
+	const sessionsDir = opts?.sessionsDir?.trim();
+	if (sessionsDir) return path.resolve(sessionsDir);
+	return resolveAgentSessionsDir(opts?.agentId);
+}
+function resolvePathFromAgentSessionsDir(agentSessionsDir, candidateAbsPath) {
+	const agentBase = safeRealpathSync(path.resolve(agentSessionsDir)) ?? path.resolve(agentSessionsDir);
+	const realCandidate = safeRealpathSync(candidateAbsPath) ?? candidateAbsPath;
+	const relative = path.relative(agentBase, realCandidate);
+	if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) return;
+	return path.resolve(agentBase, relative);
+}
+function resolveSiblingAgentSessionsDir(baseSessionsDir, agentId) {
+	const resolvedBase = path.resolve(baseSessionsDir);
+	if (path.basename(resolvedBase) !== "sessions") return;
+	const baseAgentDir = path.dirname(resolvedBase);
+	const baseAgentsDir = path.dirname(baseAgentDir);
+	if (path.basename(baseAgentsDir) !== "agents") return;
+	const rootDir = path.dirname(baseAgentsDir);
+	return path.join(rootDir, "agents", normalizeAgentId(agentId), "sessions");
+}
+function resolveAgentSessionsPathParts(candidateAbsPath) {
+	const parts = path.normalize(path.resolve(candidateAbsPath)).split(path.sep).filter(Boolean);
+	const sessionsIndex = parts.lastIndexOf("sessions");
+	if (sessionsIndex < 2 || parts[sessionsIndex - 2] !== "agents") return null;
+	return {
+		parts,
+		sessionsIndex
+	};
+}
+function extractAgentIdFromAbsoluteSessionPath(candidateAbsPath) {
+	const parsed = resolveAgentSessionsPathParts(candidateAbsPath);
+	if (!parsed) return;
+	const { parts, sessionsIndex } = parsed;
+	return parts[sessionsIndex - 1] || void 0;
+}
+function resolveStructuralSessionFallbackPath(candidateAbsPath, expectedAgentId) {
+	const parsed = resolveAgentSessionsPathParts(candidateAbsPath);
+	if (!parsed) return;
+	const { parts, sessionsIndex } = parsed;
+	const agentIdPart = parts[sessionsIndex - 1];
+	if (!agentIdPart) return;
+	const normalizedAgentId = normalizeAgentId(agentIdPart);
+	if (normalizedAgentId !== agentIdPart.toLowerCase()) return;
+	if (normalizedAgentId !== normalizeAgentId(expectedAgentId)) return;
+	const relativeSegments = parts.slice(sessionsIndex + 1);
+	if (relativeSegments.length !== 1) return;
+	const fileName = relativeSegments[0];
+	if (!fileName || fileName === "." || fileName === "..") return;
+	return path.normalize(path.resolve(candidateAbsPath));
+}
+function safeRealpathSync(filePath) {
+	try {
+		return fs.realpathSync(filePath);
+	} catch {
+		return;
+	}
+}
+function resolvePathWithinSessionsDir(sessionsDir, candidate, opts) {
+	const trimmed = candidate.trim();
+	if (!trimmed) throw new Error("Session file path must not be empty");
+	const resolvedBase = path.resolve(sessionsDir);
+	const realBase = safeRealpathSync(resolvedBase) ?? resolvedBase;
+	const realTrimmed = path.isAbsolute(trimmed) ? safeRealpathSync(trimmed) ?? trimmed : trimmed;
+	const normalized = path.isAbsolute(realTrimmed) ? path.relative(realBase, realTrimmed) : realTrimmed;
+	if (normalized.startsWith("..") && path.isAbsolute(realTrimmed)) {
+		const tryAgentFallback = (agentId) => {
+			const normalizedAgentId = normalizeAgentId(agentId);
+			const siblingSessionsDir = resolveSiblingAgentSessionsDir(realBase, normalizedAgentId);
+			if (siblingSessionsDir) {
+				const siblingResolved = resolvePathFromAgentSessionsDir(siblingSessionsDir, realTrimmed);
+				if (siblingResolved) return siblingResolved;
+			}
+			return resolvePathFromAgentSessionsDir(resolveAgentSessionsDir(normalizedAgentId), realTrimmed);
+		};
+		const explicitAgentId = opts?.agentId?.trim();
+		if (explicitAgentId) {
+			const resolvedFromAgent = tryAgentFallback(explicitAgentId);
+			if (resolvedFromAgent) return resolvedFromAgent;
+		}
+		const extractedAgentId = extractAgentIdFromAbsoluteSessionPath(realTrimmed);
+		if (extractedAgentId) {
+			const resolvedFromPath = tryAgentFallback(extractedAgentId);
+			if (resolvedFromPath) return resolvedFromPath;
+			const structuralFallback = resolveStructuralSessionFallbackPath(realTrimmed, extractedAgentId);
+			if (structuralFallback) return structuralFallback;
+		}
+	}
+	if (!normalized || normalized.startsWith("..") || path.isAbsolute(normalized)) throw new Error("Session file path must be within sessions directory");
+	return path.resolve(realBase, normalized);
+}
+function resolveSessionTranscriptPathInDir(sessionId, sessionsDir, topicId) {
+	const safeSessionId = validateSessionId(sessionId);
+	const safeTopicId = typeof topicId === "string" ? encodeURIComponent(topicId) : typeof topicId === "number" ? String(topicId) : void 0;
+	return resolvePathWithinSessionsDir(sessionsDir, safeTopicId !== void 0 ? `${safeSessionId}-topic-${safeTopicId}.jsonl` : `${safeSessionId}.jsonl`);
+}
+function resolveSessionTranscriptPath(sessionId, agentId, topicId) {
+	return resolveSessionTranscriptPathInDir(sessionId, resolveAgentSessionsDir(agentId), topicId);
+}
+function resolveSessionFilePath(sessionId, entry, opts) {
+	const sessionsDir = resolveSessionsDir(opts);
+	const candidate = entry?.sessionFile?.trim();
+	if (candidate) try {
+		return resolvePathWithinSessionsDir(sessionsDir, candidate, { agentId: opts?.agentId });
+	} catch {}
+	return resolveSessionTranscriptPathInDir(sessionId, sessionsDir);
+}
+function resolveStorePath(store, opts) {
+	const agentId = normalizeAgentId(opts?.agentId ?? DEFAULT_AGENT_ID);
+	if (!store) return resolveDefaultSessionStorePath(agentId);
+	if (store.includes("{agentId}")) {
+		const expanded = store.replaceAll("{agentId}", agentId);
+		if (expanded.startsWith("~")) return path.resolve(expandHomePrefix(expanded, {
+			home: resolveRequiredHomeDir(process.env, os.homedir),
+			env: process.env,
+			homedir: os.homedir
+		}));
+		return path.resolve(expanded);
+	}
+	if (store.startsWith("~")) return path.resolve(expandHomePrefix(store, {
+		home: resolveRequiredHomeDir(process.env, os.homedir),
+		env: process.env,
+		homedir: os.homedir
+	}));
+	return path.resolve(store);
+}
+
+//#endregion
+export { resolveSessionTranscriptPathInDir as a, resolveSessionTranscriptPath as i, resolveSessionFilePath as n, resolveSessionTranscriptsDirForAgent as o, resolveSessionFilePathOptions as r, resolveStorePath as s, resolveDefaultSessionStorePath as t };