thinknagent 0.1.20 → 0.1.23

package/bin/thinkncollab-mcp.js

@@ -0,0 +1,387 @@
+#!/usr/bin/env node
+/**
+ * ThinkNCollab Model Context Protocol (MCP) Server
+ * Strict Spec Compliance: MCP Protocol Version 2024-11-05 / JSON-RPC 2.0
+ */
+
+const readline = require('readline');
+const http = require('http');
+const https = require('https');
+const { URL } = require('url');
+
+const API_BASE_URL = process.env.THINKNCOLLAB_API_URL || 'http://localhost:3001';
+const API_TOKEN = process.env.THINKNCOLLAB_TOKEN || '';
+const BOARD_ID = process.env.THINKNCOLLAB_BOARD_ID || '';
+const ROOM_ID = process.env.THINKNCOLLAB_ROOM_ID || '';
+
+// ── HTTP API Request Helper ───────────────────────────────────────────────────
+function apiRequest(method, endpoint, data = null) {
+  return new Promise((resolve, reject) => {
+    try {
+      const baseObj = new URL(API_BASE_URL);
+      
+      // SECURITY FIX: Ensure endpoint is strictly relative to prevent URL override
+      // and exfiltration of API_TOKEN to third-party endpoints.
+      const safeEndpoint = endpoint.startsWith('http://') || endpoint.startsWith('https://')
+        ? new URL(endpoint).pathname + new URL(endpoint).search
+        : endpoint;
+
+      const parsedUrl = new URL(safeEndpoint, baseObj.origin);
+
+      if (parsedUrl.origin !== baseObj.origin) {
+        return reject(new Error(`Security Error: Request origin mismatch (${parsedUrl.origin} vs ${baseObj.origin})`));
+      }
+
+      const isHttps = parsedUrl.protocol === 'https:';
+      const client = isHttps ? https : http;
+
+      const payload = data ? JSON.stringify(data) : null;
+      const headers = {
+        'Authorization': `Bearer ${API_TOKEN}`,
+        'Content-Type': 'application/json',
+        'User-Agent': 'ThinkNCollab-MCP/1.0.0'
+      };
+      if (payload) {
+        headers['Content-Length'] = Buffer.byteLength(payload);
+      }
+
+      const options = {
+        hostname: parsedUrl.hostname,
+        port: parsedUrl.port || (isHttps ? 443 : 80),
+        path: parsedUrl.pathname + parsedUrl.search,
+        method: method.toUpperCase(),
+        headers
+      };
+
+
+      const req = client.request(options, (res) => {
+        let body = '';
+        res.setEncoding('utf8');
+        res.on('data', chunk => { body += chunk; });
+        res.on('end', () => {
+          try {
+            const json = JSON.parse(body);
+            resolve(json);
+          } catch (e) {
+            resolve({ raw: body, statusCode: res.statusCode });
+          }
+        });
+      });
+
+      req.on('error', (err) => {
+        reject(err);
+      });
+
+      if (payload) {
+        req.write(payload);
+      }
+      req.end();
+    } catch (e) {
+      reject(e);
+    }
+  });
+}
+
+// ── Strict MCP Tool Definitions (JSON Schema draft-07 compatible) ─────────────
+const TOOLS = [
+  {
+    name: 'thinkncollab_get_board_state',
+    description: 'Get full project backlog, columns, and task list from ThinkNCollab board.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        }
+      },
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_plan_and_create_tasks',
+    description: 'Decompose a project or feature into structured tasks and batch-create them on the board.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        },
+        tasks: {
+          type: 'array',
+          description: 'Array of task objects to generate on the board',
+          items: {
+            type: 'object',
+            properties: {
+              title: { type: 'string', description: 'Task title' },
+              description: { type: 'string', description: 'Markdown technical spec & implementation steps' },
+              priority: { type: 'string', enum: ['high', 'medium', 'low'] },
+              category: { type: 'string', description: 'Category e.g. Feature Requests, Security Issues, Bugs' },
+              acceptanceCriteria: {
+                type: 'array',
+                items: { type: 'string' },
+                description: 'List of acceptance criteria checklist items'
+              }
+            },
+            required: ['title']
+          }
+        }
+      },
+      required: ['tasks'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_create_task',
+    description: 'Create a single new task with full technical documentation on the ThinkNCollab board.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        },
+        title: { type: 'string', description: 'Task title' },
+        description: { type: 'string', description: 'Markdown technical specification' },
+        priority: { type: 'string', enum: ['high', 'medium', 'low'] },
+        category: { type: 'string', description: 'Task category' },
+        acceptanceCriteria: {
+          type: 'array',
+          items: { type: 'string' },
+          description: 'List of acceptance criteria checklist items'
+        }
+      },
+      required: ['title'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_get_task_spec',
+    description: 'Read the full markdown specification, acceptance criteria, and comments of a task.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' }
+      },
+      required: ['taskId'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_update_task_spec',
+    description: 'Update the technical documentation, description, or acceptance criteria of a task.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' },
+        description: { type: 'string', description: 'Updated markdown documentation' },
+        acceptanceCriteria: {
+          type: 'array',
+          items: { type: 'string' }
+        },
+        priority: { type: 'string', enum: ['high', 'medium', 'low'] }
+      },
+      required: ['taskId'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_start_task',
+    description: 'Mark a task as in-progress and notify the team that the AI agent is working on it.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' }
+      },
+      required: ['taskId'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_add_comment',
+    description: 'Add a progress note, architectural decision, or question to a task.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' },
+        content: { type: 'string', description: 'Comment text / log' }
+      },
+      required: ['taskId', 'content'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_complete_task',
+    description: 'Mark a task completed, post the completion verification comment, and trigger auto-tests.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        taskId: { type: 'string', description: 'Task ID' },
+        comment: { type: 'string', description: 'Detailed completion summary of what was implemented and tested' }
+      },
+      required: ['taskId', 'comment'],
+      additionalProperties: false
+    }
+  },
+  {
+    name: 'thinkncollab_auto_assign_tasks',
+    description: 'Automatically categorize, tag, and distribute board tasks to team members based on domain skills and workload balance.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        boardId: {
+          type: 'string',
+          description: 'Board ID (optional if set in environment)'
+        }
+      },
+      additionalProperties: false
+    }
+  }
+];
+
+// ── MCP Tool Execution Handler ────────────────────────────────────────────────
+async function handleToolCall(name, args = {}) {
+  const bId = args.boardId || BOARD_ID;
+
+  switch (name) {
+    case 'thinkncollab_get_board_state': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('GET', `/boards/${bId}/api/state`);
+    }
+
+    case 'thinkncollab_plan_and_create_tasks': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('POST', `/boards/${bId}/api/plan`, { tasks: args.tasks });
+    }
+
+    case 'thinkncollab_create_task': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('POST', `/boards/${bId}/api/tasks/create`, args);
+    }
+
+    case 'thinkncollab_auto_assign_tasks': {
+      if (!bId) throw new Error('boardId is required (or set THINKNCOLLAB_BOARD_ID environment variable)');
+      return await apiRequest('POST', `/boards/${bId}/api/auto-assign-all`);
+    }
+
+    case 'thinkncollab_get_task_spec': {
+      return await apiRequest('GET', `/tasks/${args.taskId}/api/spec`);
+    }
+
+    case 'thinkncollab_update_task_spec': {
+      return await apiRequest('PUT', `/tasks/${args.taskId}/api/spec`, args);
+    }
+
+    case 'thinkncollab_start_task': {
+      return await apiRequest('POST', `/tasks/${args.taskId}/api/start`);
+    }
+
+    case 'thinkncollab_add_comment': {
+      return await apiRequest('POST', `/tasks/${args.taskId}/api/comment`, { content: args.content });
+    }
+
+    case 'thinkncollab_complete_task': {
+      return await apiRequest('POST', `/tasks/${args.taskId}/api/complete`, { comment: args.comment });
+    }
+
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}
+
+// ── JSON-RPC 2.0 Response Dispatcher ──────────────────────────────────────────
+function sendResult(id, result) {
+  if (id === null || id === undefined) return;
+  const res = { jsonrpc: '2.0', id, result };
+  process.stdout.write(JSON.stringify(res) + '\n');
+}
+
+function sendError(id, code, message) {
+  if (id === null || id === undefined) return;
+  const res = { jsonrpc: '2.0', id, error: { code, message } };
+  process.stdout.write(JSON.stringify(res) + '\n');
+}
+
+// ── Stdio Stream Listener ─────────────────────────────────────────────────────
+const rl = readline.createInterface({
+  input: process.stdin,
+  output: process.stdout,
+  terminal: false
+});
+
+rl.on('line', async (line) => {
+  const trimmed = line.trim();
+  if (!trimmed) return;
+
+  let msg;
+  try {
+    msg = JSON.parse(trimmed);
+  } catch (err) {
+    sendError(null, -32700, 'Parse error');
+    return;
+  }
+
+  const { id, method, params } = msg;
+
+  // Handle Notifications (No id -> Never respond in JSON-RPC 2.0)
+  if (id === undefined || id === null) {
+    if (method === 'notifications/initialized' || method === 'initialized') {
+      process.stderr.write('[MCP] Client initialized successfully.\n');
+    }
+    return;
+  }
+
+  // Handle Requests
+  try {
+    if (method === 'initialize') {
+      sendResult(id, {
+        protocolVersion: '2024-11-05',
+        capabilities: {
+          tools: {
+            listChanged: false
+          }
+        },
+        serverInfo: {
+          name: 'thinkncollab',
+          version: '1.0.0'
+        }
+      });
+    } else if (method === 'tools/list') {
+      sendResult(id, {
+        tools: TOOLS
+      });
+    } else if (method === 'tools/call') {
+      const toolName = params?.name;
+      const toolArgs = params?.arguments || {};
+      try {
+        const data = await handleToolCall(toolName, toolArgs);
+        sendResult(id, {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify(data, null, 2)
+            }
+          ],
+          isError: false
+        });
+      } catch (callErr) {
+        sendResult(id, {
+          content: [
+            {
+              type: 'text',
+              text: `Tool error (${toolName}): ${callErr.message}`
+            }
+          ],
+          isError: true
+        });
+      }
+    } else if (method === 'ping') {
+      sendResult(id, {});
+    } else {
+      sendError(id, -32601, `Method not found: ${method}`);
+    }
+  } catch (handlerErr) {
+    sendError(id, -32603, `Internal error: ${handlerErr.message}`);
+  }
+});

package/lib/agent.js

@@ -6,34 +6,42 @@ const MetricsPoller = require('./metrics');
 const LogWatcher    = require('./logwatcher');
 const AlertEngine   = require('./alerts');
 const ShellBridge   = require('./shell');
+const HistoryManager = require('./history');
 const store         = require('./store');
 const chokidar      = require('chokidar');
 const fs            = require('fs');
 
-// allowed base dirs for log streaming
-// room owner agent:logs_updated se bahar ke paths reject ho jayenge
+// allowed base dirs for log streaming — only specific, non-writable-by-others paths
+// SECURITY FIX: Removed /tmp (world-writable — attacker can create logs there and stream them)
+// Removed /root (only needed for root-running deployments — overly broad)
 const LOG_PATH_ALLOWLIST = [
   '/var/log',
   '/home',
-  '/root',
-  '/tmp',
 ];
 
 function isSafeLogPath(logPath) {
   const resolved = path.resolve(logPath);
 
-  // path traversal check — resolved path allowlist mein hona chahiye
+  // Must be a .log file (reject binary or unknown extensions)
+  if (!resolved.endsWith('.log') && !resolved.endsWith('.txt') && !resolved.endsWith('.out')) {
+    console.warn(`[agent] Rejected log path (not a .log/.txt/.out file): ${resolved}`);
+    return false;
+  }
+
+  // path traversal check — resolved path must be inside allowlist
   const allowed = LOG_PATH_ALLOWLIST.some(base => resolved.startsWith(base + path.sep) || resolved === base);
   if (!allowed) {
     console.warn(`[agent] Rejected log path (not in allowlist): ${resolved}`);
     return false;
   }
 
-  // sensitive files blocklist
+  // sensitive files / directories blocklist
   const BLOCKED = [
     '/etc/passwd', '/etc/shadow', '/etc/sudoers',
     '.ssh', '.gnupg', '.aws', '.env',
     'id_rsa', 'id_ed25519', 'authorized_keys',
+    '.thinknagent', '.thinkncollab', 'config.json',
+    'session.json', '.npmrc', '.netrc',
   ];
   const blocked = BLOCKED.some(b => resolved.includes(b));
   if (blocked) {
@@ -44,6 +52,7 @@ function isSafeLogPath(logPath) {
   return true;
 }
 
+
 function validateRules(rules) {
   if (!Array.isArray(rules)) return [];
   return rules.filter(r =>
@@ -71,11 +80,16 @@ class Agent {
     });
 
     this.alerts.conn = this.conn;
+    this.history     = new HistoryManager();
 
     this.metrics = new MetricsPoller({
       connection:    this.conn,
       gpu:           cfg.gpu || false,
-      onMetricsEmit: (payload) => this.alerts.evaluate(payload),
+      interval:      cfg.interval || 1000,
+      onMetricsEmit: (payload) => {
+        this.alerts.evaluate(payload);
+        this.history.recordSnapshot(payload);
+      },
     });
 
     this.logs  = new LogWatcher({
@@ -108,6 +122,26 @@ class Agent {
       this.metrics.pollNow();
     });
 
+    this.conn.socket.on('agent:get_history', ({ hours, requestId }) => {
+      const targetHours = typeof hours === 'number' ? hours : 72;
+      console.log(`[agent] Historical metrics requested (${targetHours}h)`);
+      const historyData = this.history.getHistory(targetHours);
+      this.conn.socket.emit('agent:history_data', {
+        requestId,
+        hours: targetHours,
+        history: historyData
+      });
+    });
+
+    this.conn.socket.on('agent:send_logs', () => {
+      console.log('[agent] Logs refresh requested');
+      if (this.logs && this.logs.logPaths) {
+        for (const p of this.logs.logPaths) {
+          this.logs._sendTail(p);
+        }
+      }
+    });
+
     this.conn.socket.on('agent:logs_updated', ({ logs }) => {
       if (!Array.isArray(logs)) return;
 

package/lib/alerts.js

@@ -44,7 +44,7 @@ class AlertEngine {
         const elapsed = (now - state.firstTriggeredAt) / 1000; // seconds
         if (elapsed >= rule.for && !state.fired) {
           state.fired = true;
-          this._fire(rule, val);
+          this._fire(rule, val, metrics);
         }
       } else {
         // Condition cleared
@@ -57,17 +57,19 @@ class AlertEngine {
     }
   }
 
-  _fire(rule, currentValue) {
+  _fire(rule, currentValue, metrics = null) {
     console.warn(`[alerts] FIRING: ${rule.id} — ${rule.metric} ${rule.op} ${rule.value} (current: ${currentValue})`);
     this.conn.emit('agent:alert', {
-      id:       rule.id,
-      metric:   rule.metric,
-      op:       rule.op,
-      threshold: rule.value,
-      current:  currentValue,
-      severity: rule.severity || 'warning',
-      status:   'active',
-      firedAt:  Date.now(),
+      id:           rule.id,
+      metric:       rule.metric,
+      op:           rule.op,
+      threshold:    rule.value,
+      current:      currentValue,
+      severity:     rule.severity || 'warning',
+      status:       'active',
+      firedAt:      Date.now(),
+      diagnostics:  metrics?.diagnostics || null,
+      topProcesses: metrics?.processes?.top || [],
     });
   }
 

package/lib/connect.js

@@ -143,6 +143,24 @@ s.on('agent:approved', ({ agentToken, role, roomId }) => {
       process.exit(0);
     });
 
+    // ── Periodic HMAC Challenge-Response Zero-Trust Protocol ───────────────────
+    s.on('agent:auth_challenge', ({ challenge, ts }) => {
+      const cfg = store.read();
+      const token = cfg.agentToken || this.agentToken;
+      const crypto = require('crypto');
+      if (!token) return;
+
+      const raw = `${challenge}:${ts}:${cfg.agentId}`;
+      const signature = crypto.createHmac('sha256', token).update(raw).digest('hex');
+
+      s.emit('agent:auth_challenge_response', {
+        challenge,
+        ts,
+        signature,
+        agentId: cfg.agentId
+      });
+    });
+
     s.on('connect_error', (err) => {
       console.error(`[thinknagent] Connection error: ${err.message}`);
     });

package/lib/daemon.js

@@ -14,7 +14,7 @@ const LOG_FILE = path.join(CONFIG_DIR, 'daemon.log');
 class DaemonManager {
   constructor() {
     if (!fs.existsSync(CONFIG_DIR)) {
-      fs.mkdirSync(CONFIG_DIR, { recursive: true });
+      fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
     }
   }
 
@@ -26,8 +26,8 @@ class DaemonManager {
       return;
     }
 
-        const supervisorPath = path.resolve(__dirname, 'supervisor.js');
-    const logFd = fs.openSync(LOG_FILE, 'a');
+    const supervisorPath = path.resolve(__dirname, 'supervisor.js');
+    const logFd = fs.openSync(LOG_FILE, 'a', 0o600);
 
     // Spawn detached supervisor process
     const child = spawn(process.execPath, [supervisorPath], {
@@ -36,7 +36,8 @@ class DaemonManager {
     });
 
     child.unref();
-    fs.writeFileSync(PID_FILE, String(child.pid), 'utf8');
+    fs.writeFileSync(PID_FILE, String(child.pid), { encoding: 'utf8', mode: 0o600 });
+
 
     console.log(chalk.green('\n  ✔ ThinkNCollab Agent Daemon started with Auto-Restart!'));
     console.log(chalk.gray('  ─────────────────────────────────────────────'));

package/lib/e2ee.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const crypto = require("crypto");
+
+/*
+ End-to-End Encryption (AES-256-GCM) for ThinkNCollab Agent
+ Matches browser-side WebCrypto implementation in e2ee-vault.js
+
+ SECURITY FIX: Key derivation upgraded from SHA-256 (single pass, brute-forceable)
+ to PBKDF2-SHA256 with 100,000 iterations. The old approach used a predictable seed
+ derived from public roomId — an attacker who knows the roomId could derive the key.
+*/
+
+function deriveKeySync(roomId, secretSeed) {
+  // Use PBKDF2 with a stable per-room salt and 100k iterations
+  // secretSeed is the user-provided secret; falls back to a hardened seed if absent
+  const password = secretSeed || ('tnc_vault_' + roomId + '_agent_secret');
+  const salt     = Buffer.from('thinkncollab-e2ee-agent-salt-v2', 'utf8');
+  // 100,000 iterations — OWASP recommended minimum for PBKDF2-SHA256
+  return crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
+}
+
+function encryptE2EE(plaintext, roomId, secretSeed) {
+  if (!plaintext || typeof plaintext !== "string") return plaintext;
+  try {
+    const key = deriveKeySync(roomId, secretSeed);
+    const iv = crypto.randomBytes(12); // 12-byte random IV
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+
+    const ciphertext = Buffer.concat([
+      cipher.update(plaintext, "utf8"),
+      cipher.final()
+    ]);
+    const tag = cipher.getAuthTag(); // 16-byte auth tag
+
+    // Envelope: [12-byte IV] + [16-byte Tag] + [Ciphertext]
+    const combined = Buffer.concat([iv, tag, ciphertext]);
+    return "e2ee:" + combined.toString("base64");
+  } catch (err) {
+    return plaintext;
+  }
+}
+
+module.exports = { encryptE2EE };
+