thinknagent 0.1.19 → 0.1.22

package/bin/thinkncollab-mcp.js

@@ -0,0 +1,387 @@
+#!/usr/bin/env node
+/**
+ * ThinkNCollab Model Context Protocol (MCP) Server
+ * Strict Spec Compliance: MCP Protocol Version 2024-11-05 / JSON-RPC 2.0
+ */
+
+const readline = require('readline');
+const http = require('http');
+const https = require('https');
+const { URL } = require('url');
+
+const API_BASE_URL = process.env.THINKNCOLLAB_API_URL || 'http://localhost:3001';
+const API_TOKEN = process.env.THINKNCOLLAB_TOKEN || '';
+const BOARD_ID = process.env.THINKNCOLLAB_BOARD_ID || '';
+const ROOM_ID = process.env.THINKNCOLLAB_ROOM_ID || '';
+
+// ── HTTP API Request Helper ───────────────────────────────────────────────────
+function apiRequest(method, endpoint, data = null) {
+  return new Promise((resolve, reject) => {
+    try {
+      const baseObj = new URL(API_BASE_URL);
+      
+      // SECURITY FIX: Ensure endpoint is strictly relative to prevent URL override
+      // and exfiltration of API_TOKEN to third-party endpoints.
+      const safeEndpoint = endpoint.startsWith('http://') || endpoint.startsWith('https://')
+        ? new URL(endpoint).pathname + new URL(endpoint).search
+        : endpoint;
+
+      const parsedUrl = new URL(safeEndpoint, baseObj.origin);
+
+      if (parsedUrl.origin !== baseObj.origin) {
+        return reject(new Error(`Security Error: Request origin mismatch (${parsedUrl.origin} vs ${baseObj.origin})`));
+      }
+
+      const isHttps = parsedUrl.protocol === 'https:';
+      const client = isHttps ? https : http;
+
+      const payload = data ? JSON.stringify(data) : null;
+      const headers = {
+        'Authorization': `Bearer ${API_TOKEN}`,
+        'Content-Type': 'application/json',
+        'User-Agent': 'ThinkNCollab-MCP/1.0.0'
+      };
+      if (payload) {
+        headers['Content-Length'] = Buffer.byteLength(payload);
+      }
+
+      const options = {
+        hostname: parsedUrl.hostname,
+        port: parsedUrl.port || (isHttps ? 443 : 80),
+        path: parsedUrl.pathname + parsedUrl.search,
+        method: method.toUpperCase(),
+        headers
+      };
+
+
+      const req = client.request(options, (res) => {
+        let body = '';
+        res.setEncoding('utf8');
+        res.on('data', chunk => { body += chunk; });
+        res.on('end', () => {
+          try {
+            const json = JSON.parse(body);
+            resolve(json);
+          } catch (e) {
+            resolve({ raw: body, statusCode: res.statusCode });
+          }
+        });
+      });
+
+      req.on('error', (err) => {
+        reject(err);
+      });
+
+      if (payload) {
+        req.write(payload);
+      }
+      req.end();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}
+
+// ── Strict MCP Tool Definitions (JSON Schema draft-07 compatible) ─────────────
+const TOOLS = [
+  {
+    name: 'thinkncollab_get_board_state',
+    description: 'Get full project backlog, columns, and task list from ThinkNCollab board.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        }
+      },
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_plan_and_create_tasks',
+    description: 'Decompose a project or feature into structured tasks and batch-create them on the board.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        },
+        tasks: {
+          type: 'array',
+          description: 'Array of task objects to generate on the board',
+          items: {
+            type: 'object',
+            properties: {
+              title: { type: 'string', description: 'Task title' },
+              description: { type: 'string', description: 'Markdown technical spec & implementation steps' },
+              priority: { type: 'string', enum: ['high', 'medium', 'low'] },
+              category: { type: 'string', description: 'Category e.g. Feature Requests, Security Issues, Bugs' },
+              acceptanceCriteria: {
+                type: 'array',
+                items: { type: 'string' },
+                description: 'List of acceptance criteria checklist items'
+              }
+            },
+            required: ['title']
+          }
+        }
+      },
+      required: ['tasks'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_create_task',
+    description: 'Create a single new task with full technical documentation on the ThinkNCollab board.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        },
+        title: { type: 'string', description: 'Task title' },
+        description: { type: 'string', description: 'Markdown technical specification' },
+        priority: { type: 'string', enum: ['high', 'medium', 'low'] },
+        category: { type: 'string', description: 'Task category' },
+        acceptanceCriteria: {
+          type: 'array',
+          items: { type: 'string' },
+          description: 'List of acceptance criteria checklist items'
+        }
+      },
+      required: ['title'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_get_task_spec',
+    description: 'Read the full markdown specification, acceptance criteria, and comments of a task.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' }
+      },
+      required: ['taskId'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_update_task_spec',
+    description: 'Update the technical documentation, description, or acceptance criteria of a task.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' },
+        description: { type: 'string', description: 'Updated markdown documentation' },
+        acceptanceCriteria: {
+          type: 'array',
+          items: { type: 'string' }
+        },
+        priority: { type: 'string', enum: ['high', 'medium', 'low'] }
+      },
+      required: ['taskId'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_start_task',
+    description: 'Mark a task as in-progress and notify the team that the AI agent is working on it.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' }
+      },
+      required: ['taskId'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_add_comment',
+    description: 'Add a progress note, architectural decision, or question to a task.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' },
+        content: { type: 'string', description: 'Comment text / log' }
+      },
+      required: ['taskId', 'content'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_complete_task',
+    description: 'Mark a task completed, post the completion verification comment, and trigger auto-tests.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' },
+        comment: { type: 'string', description: 'Detailed completion summary of what was implemented and tested' }
+      },
+      required: ['taskId', 'comment'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_auto_assign_tasks',
+    description: 'Automatically categorize, tag, and distribute board tasks to team members based on domain skills and workload balance.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        }
+      },
+      additionalProperties: false
+    }
+  }
+];
+
+// ── MCP Tool Execution Handler ────────────────────────────────────────────────
+async function handleToolCall(name, args = {}) {
+  const bId = args.boardId || BOARD_ID;
+
+  switch (name) {
+    case 'thinkncollab_get_board_state': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('GET', `/boards/${bId}/api/state`);
+    }
+
+    case 'thinkncollab_plan_and_create_tasks': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('POST', `/boards/${bId}/api/plan`, { tasks: args.tasks });
+    }
+
+    case 'thinkncollab_create_task': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('POST', `/boards/${bId}/api/tasks/create`, args);
+    }
+
+    case 'thinkncollab_auto_assign_tasks': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('POST', `/boards/${bId}/api/auto-assign-all`);
+    }
+
+    case 'thinkncollab_get_task_spec': {
+      return await apiRequest('GET', `/tasks/${args.taskId}/api/spec`);
+    }
+
+    case 'thinkncollab_update_task_spec': {
+      return await apiRequest('PUT', `/tasks/${args.taskId}/api/spec`, args);
+    }
+
+    case 'thinkncollab_start_task': {
+      return await apiRequest('POST', `/tasks/${args.taskId}/api/start`);
+    }
+
+    case 'thinkncollab_add_comment': {
+      return await apiRequest('POST', `/tasks/${args.taskId}/api/comment`, { content: args.content });
+    }
+
+    case 'thinkncollab_complete_task': {
+      return await apiRequest('POST', `/tasks/${args.taskId}/api/complete`, { comment: args.comment });
+    }
+
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}
+
+// ── JSON-RPC 2.0 Response Dispatcher ──────────────────────────────────────────
+function sendResult(id, result) {
+  if (id === null || id === undefined) return;
+  const res = { jsonrpc: '2.0', id, result };
+  process.stdout.write(JSON.stringify(res) + '\n');
+}
+
+function sendError(id, code, message) {
+  if (id === null || id === undefined) return;
+  const res = { jsonrpc: '2.0', id, error: { code, message } };
+  process.stdout.write(JSON.stringify(res) + '\n');
+}
+
+// ── Stdio Stream Listener ─────────────────────────────────────────────────────
+const rl = readline.createInterface({
+  input: process.stdin,
+  output: process.stdout,
+  terminal: false
+});
+
+rl.on('line', async (line) => {
+  const trimmed = line.trim();
+  if (!trimmed) return;
+
+  let msg;
+  try {
+    msg = JSON.parse(trimmed);
+  } catch (err) {
+    sendError(null, -32700, 'Parse error');
+    return;
+  }
+
+  const { id, method, params } = msg;
+
+  // Handle Notifications (No id -> Never respond in JSON-RPC 2.0)
+  if (id === undefined || id === null) {
+    if (method === 'notifications/initialized' || method === 'initialized') {
+      process.stderr.write('[MCP] Client initialized successfully.\n');
+    }
+    return;
+  }
+
+  // Handle Requests
+  try {
+    if (method === 'initialize') {
+      sendResult(id, {
+        protocolVersion: '2024-11-05',
+        capabilities: {
+          tools: {
+            listChanged: false
+          }
+        },
+        serverInfo: {
+          name: 'thinkncollab',
+          version: '1.0.0'
+        }
+      });
+    } else if (method === 'tools/list') {
+      sendResult(id, {
+        tools: TOOLS
+      });
+    } else if (method === 'tools/call') {
+      const toolName = params?.name;
+      const toolArgs = params?.arguments || {};
+      try {
+        const data = await handleToolCall(toolName, toolArgs);
+        sendResult(id, {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify(data, null, 2)
+            }
+          ],
+          isError: false
+        });
+      } catch (callErr) {
+        sendResult(id, {
+          content: [
+            {
+              type: 'text',
+              text: `Tool error (${toolName}): ${callErr.message}`
+            }
+          ],
+          isError: true
+        });
+      }
+    } else if (method === 'ping') {
+      sendResult(id, {});
+    } else {
+      sendError(id, -32601, `Method not found: ${method}`);
+    }
+  } catch (handlerErr) {
+    sendError(id, -32603, `Internal error: ${handlerErr.message}`);
+  }
+});

package/lib/agent.js

@@ -10,30 +10,37 @@ const store         = require('./store');
 const chokidar      = require('chokidar');
 const fs            = require('fs');
 
-// allowed base dirs for log streaming
-// room owner agent:logs_updated se bahar ke paths reject ho jayenge
+// allowed base dirs for log streaming — only specific, non-writable-by-others paths
+// SECURITY FIX: Removed /tmp (world-writable — attacker can create logs there and stream them)
+// Removed /root (only needed for root-running deployments — overly broad)
 const LOG_PATH_ALLOWLIST = [
   '/var/log',
   '/home',
-  '/root',
-  '/tmp',
 ];
 
 function isSafeLogPath(logPath) {
   const resolved = path.resolve(logPath);
 
-  // path traversal check — resolved path allowlist mein hona chahiye
+  // Must be a .log file (reject binary or unknown extensions)
+  if (!resolved.endsWith('.log') && !resolved.endsWith('.txt') && !resolved.endsWith('.out')) {
+    console.warn(`[agent] Rejected log path (not a .log/.txt/.out file): ${resolved}`);
+    return false;
+  }
+
+  // path traversal check — resolved path must be inside allowlist
   const allowed = LOG_PATH_ALLOWLIST.some(base => resolved.startsWith(base + path.sep) || resolved === base);
   if (!allowed) {
     console.warn(`[agent] Rejected log path (not in allowlist): ${resolved}`);
     return false;
   }
 
-  // sensitive files blocklist
+  // sensitive files / directories blocklist
   const BLOCKED = [
     '/etc/passwd', '/etc/shadow', '/etc/sudoers',
     '.ssh', '.gnupg', '.aws', '.env',
     'id_rsa', 'id_ed25519', 'authorized_keys',
+    '.thinknagent', '.thinkncollab', 'config.json',
+    'session.json', '.npmrc', '.netrc',
   ];
   const blocked = BLOCKED.some(b => resolved.includes(b));
   if (blocked) {
@@ -44,6 +51,7 @@ function isSafeLogPath(logPath) {
   return true;
 }
 
+
 function validateRules(rules) {
   if (!Array.isArray(rules)) return [];
   return rules.filter(r =>
@@ -75,6 +83,7 @@ class Agent {
     this.metrics = new MetricsPoller({
       connection:    this.conn,
       gpu:           cfg.gpu || false,
+      interval:      cfg.interval || 1000,
       onMetricsEmit: (payload) => this.alerts.evaluate(payload),
     });
 
@@ -108,6 +117,15 @@ class Agent {
       this.metrics.pollNow();
     });
 
+    this.conn.socket.on('agent:send_logs', () => {
+      console.log('[agent] Logs refresh requested');
+      if (this.logs && this.logs.logPaths) {
+        for (const p of this.logs.logPaths) {
+          this.logs._sendTail(p);
+        }
+      }
+    });
+
     this.conn.socket.on('agent:logs_updated', ({ logs }) => {
       if (!Array.isArray(logs)) return;
 

package/lib/daemon.js

@@ -14,7 +14,7 @@ const LOG_FILE = path.join(CONFIG_DIR, 'daemon.log');
 class DaemonManager {
   constructor() {
     if (!fs.existsSync(CONFIG_DIR)) {
-      fs.mkdirSync(CONFIG_DIR, { recursive: true });
+      fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     }
   }
 
@@ -26,8 +26,8 @@ class DaemonManager {
       return;
     }
 
-        const supervisorPath = path.resolve(__dirname, 'supervisor.js');
-    const logFd = fs.openSync(LOG_FILE, 'a');
+    const supervisorPath = path.resolve(__dirname, 'supervisor.js');
+    const logFd = fs.openSync(LOG_FILE, 'a', 0o600);
 
     // Spawn detached supervisor process
     const child = spawn(process.execPath, [supervisorPath], {
@@ -36,7 +36,8 @@ class DaemonManager {
     });
 
     child.unref();
-    fs.writeFileSync(PID_FILE, String(child.pid), 'utf8');
+    fs.writeFileSync(PID_FILE, String(child.pid), { encoding: 'utf8', mode: 0o600 });
+
 
     console.log(chalk.green('\n  ✔ ThinkNCollab Agent Daemon started with Auto-Restart!'));
     console.log(chalk.gray('  ─────────────────────────────────────────────'));

package/lib/e2ee.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const crypto = require("crypto");
+
+/*
+ End-to-End Encryption (AES-256-GCM) for ThinkNCollab Agent
+ Matches browser-side WebCrypto implementation in e2ee-vault.js
+
+ SECURITY FIX: Key derivation upgraded from SHA-256 (single pass, brute-forceable)
+ to PBKDF2-SHA256 with 100,000 iterations. The old approach used a predictable seed
+ derived from public roomId — an attacker who knows the roomId could derive the key.
+*/
+
+function deriveKeySync(roomId, secretSeed) {
+  // Use PBKDF2 with a stable per-room salt and 100k iterations
+  // secretSeed is the user-provided secret; falls back to a hardened seed if absent
+  const password = secretSeed || ('tnc_vault_' + roomId + '_agent_secret');
+  const salt     = Buffer.from('thinkncollab-e2ee-agent-salt-v2', 'utf8');
+  // 100,000 iterations — OWASP recommended minimum for PBKDF2-SHA256
+  return crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
+}
+
+function encryptE2EE(plaintext, roomId, secretSeed) {
+  if (!plaintext || typeof plaintext !== "string") return plaintext;
+  try {
+    const key = deriveKeySync(roomId, secretSeed);
+    const iv = crypto.randomBytes(12); // 12-byte random IV
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+
+    const ciphertext = Buffer.concat([
+      cipher.update(plaintext, "utf8"),
+      cipher.final()
+    ]);
+    const tag = cipher.getAuthTag(); // 16-byte auth tag
+
+    // Envelope: [12-byte IV] + [16-byte Tag] + [Ciphertext]
+    const combined = Buffer.concat([iv, tag, ciphertext]);
+    return "e2ee:" + combined.toString("base64");
+  } catch (err) {
+    return plaintext;
+  }
+}
+
+module.exports = { encryptE2EE };
+

package/lib/logwatcher.js

@@ -4,6 +4,8 @@ const fs      = require('fs');
 const path    = require('path');
 const chokidar = require('chokidar');
 const { EventEmitter } = require('events');
+const { encryptE2EE }  = require('./e2ee');
+const store            = require('./store');
 
 const BUFFER_LINES = 100;
 const CHUNK_DELAY  = 50;
@@ -24,7 +26,7 @@ class LogWatcher extends EventEmitter {
     for (const p of this.logPaths) {
       this._watch(p);
     }
-    console.log(`[logs] Watching ${this.logPaths.length} file(s)`);
+    console.log(`[logs] Watching ${this.logPaths.length} file(s) (AES-256 E2EE active)`);
   }
 
   stop() {
@@ -66,37 +68,47 @@ class LogWatcher extends EventEmitter {
     });
 
     watcher.on('change', (fpath, stats) => {
-      const newSize = stats ? stats.size : fs.statSync(absPath).size;
+      try {
+        if (!fs.existsSync(absPath)) return;
+        const newSize = stats ? stats.size : fs.statSync(absPath).size;
 
-      if (newSize < state.size) {
-        // log rotated — reset
-        state.size = 0;
-      }
+        if (newSize < state.size) {
+          // log rotated — reset
+          state.size = 0;
+        }
+
+        const newBytes = newSize - state.size;
+        if (newBytes <= 0) return;
 
-      const newBytes = newSize - state.size;
-      if (newBytes <= 0) return;
-
-      const buf = Buffer.alloc(newBytes);
-      const fd  = fs.openSync(absPath, 'r');
-      fs.readSync(fd, buf, 0, newBytes, state.size);
-      fs.closeSync(fd);
-      state.size = newSize;
-
-      const newLines = buf.toString('utf8').split('\n').filter(Boolean);
-      state.lines.push(...newLines);
-
-      clearTimeout(state.timer);
-      state.timer = setTimeout(() => {
-        const toSend = state.lines.splice(0);
-        if (toSend.length) {
-          this.conn.emit('agent:logs', {
-            file:  absPath,
-            lines: toSend.map(l => ({ ts: Date.now(), text: l })),
-          });
+        const buf = Buffer.alloc(newBytes);
+        const fd  = fs.openSync(absPath, 'r');
+        try {
+          fs.readSync(fd, buf, 0, newBytes, state.size);
+        } finally {
+          fs.closeSync(fd);
         }
-      }, CHUNK_DELAY);
+        state.size = newSize;
+
+        const newLines = buf.toString('utf8').split('\n').filter(Boolean);
+        state.lines.push(...newLines);
+
+        clearTimeout(state.timer);
+        state.timer = setTimeout(() => {
+          const toSend = state.lines.splice(0);
+          if (toSend.length) {
+            const roomId = this.conn?.roomId || store.get('roomId') || '';
+            this.conn.emit('agent:logs', {
+              file:  absPath,
+              lines: toSend.map(l => ({ ts: Date.now(), text: encryptE2EE(l, roomId) })),
+            });
+          }
+        }, CHUNK_DELAY);
+      } catch (err) {
+        console.error(`[logs] Error reading log slice from ${absPath}:`, err.message);
+      }
     });
 
+
     watcher.on('error', (err) => {
       console.error(`[logs] Watch error on ${absPath}:`, err.message);
     });
@@ -107,12 +119,17 @@ class LogWatcher extends EventEmitter {
 
   _sendTail(filePath) {
     try {
-      const content = fs.readFileSync(filePath, 'utf8');
+      const absPath = filePath.startsWith('~')
+        ? path.join(process.env.HOME || '/', filePath.slice(1))
+        : path.resolve(filePath);
+      if (!fs.existsSync(absPath)) return;
+      const content = fs.readFileSync(absPath, 'utf8');
       const lines   = content.split('\n').filter(Boolean).slice(-BUFFER_LINES);
       if (lines.length) {
+        const roomId = this.conn?.roomId || store.get('roomId') || '';
         this.conn.emit('agent:logs:tail', {
           file:  filePath,
-          lines: lines.map(l => ({ ts: null, text: l })),
+          lines: lines.map(l => ({ ts: null, text: encryptE2EE(l, roomId) })),
         });
       }
     } catch (err) {