verybot 0.1.8

package/dist/security/env-filter.js

@@ -0,0 +1,41 @@
+/**
+ * Environment variable filtering for bash tool security.
+ *
+ * Strips dangerous env vars that could be used for code injection
+ * (LD_PRELOAD, DYLD_*, NODE_OPTIONS, etc.) before passing to child processes.
+ */
+/** Exact env var names to strip (from Verybot's DANGEROUS_HOST_ENV_VARS). */
+const BLOCKED_VARS = new Set([
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "LD_AUDIT",
+    "DYLD_INSERT_LIBRARIES",
+    "DYLD_LIBRARY_PATH",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "RUBYLIB",
+    "PERL5LIB",
+    "BASH_ENV",
+    "ENV",
+    "GCONV_PATH",
+    "IFS",
+    "SSLKEYLOGFILE",
+]);
+/** Env var prefixes to strip (catches all DYLD_* and LD_* variants). */
+const BLOCKED_PREFIXES = ["DYLD_", "LD_"];
+/** Returns a copy of process.env with dangerous variables removed. */
+export function sanitizeEnv() {
+    const clean = {};
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value === undefined)
+            continue;
+        if (BLOCKED_VARS.has(key))
+            continue;
+        if (BLOCKED_PREFIXES.some((prefix) => key.startsWith(prefix)))
+            continue;
+        clean[key] = value;
+    }
+    return clean;
+}

package/dist/skills/loader.d.ts

@@ -0,0 +1,33 @@
+import type { Tool } from "ai";
+import type { SkillEntry } from "./types.js";
+/**
+ * Manages skills with optional file watching for hot-reload.
+ * The Agent reads `systemPrompt` and `readTool` on each run,
+ * so changes are picked up automatically.
+ */
+export declare class SkillManager {
+    private _entries;
+    private _systemPrompt;
+    private _readTool;
+    private watcher;
+    private retryTimer;
+    private retryCount;
+    private stopped;
+    private dir;
+    constructor(dir: string);
+    get entries(): SkillEntry[];
+    get systemPrompt(): string;
+    get readTool(): Tool | null;
+    /** Scan the skills directory and update state. */
+    scan(): Promise<void>;
+    /** Start watching the skills directory for changes. Retries with backoff if directory is missing. */
+    startWatching(): void;
+    /** Stop the file watcher and cancel any pending retries. */
+    stopWatching(): void;
+    private attemptWatch;
+    private scheduleRetry;
+}
+/**
+ * Load skills from the given directory and start watching for changes.
+ */
+export declare function loadSkills(dir: string): Promise<SkillManager>;

package/dist/skills/loader.js

@@ -0,0 +1,132 @@
+import { watch as chokidarWatch } from "chokidar";
+import { resolve } from "path";
+import { scanSkills } from "./scanner.js";
+import { buildSkillListing } from "./prompt.js";
+import { createReadSkillTool } from "./read-tool.js";
+import { logger } from "../logger.js";
+/** Debounce delay for file watcher to avoid rapid rescans. */
+const WATCH_DEBOUNCE_MS = 500;
+/** Initial retry delay when watcher fails or directory is missing. */
+const WATCH_RETRY_BASE_MS = 2_000;
+/** Maximum retry delay (caps exponential backoff). */
+const WATCH_RETRY_MAX_MS = 60_000;
+/**
+ * Manages skills with optional file watching for hot-reload.
+ * The Agent reads `systemPrompt` and `readTool` on each run,
+ * so changes are picked up automatically.
+ */
+export class SkillManager {
+    _entries = [];
+    _systemPrompt = "";
+    _readTool = null;
+    watcher = null;
+    retryTimer = null;
+    retryCount = 0;
+    stopped = false;
+    dir;
+    constructor(dir) {
+        this.dir = resolve(dir);
+    }
+    get entries() {
+        return this._entries;
+    }
+    get systemPrompt() {
+        return this._systemPrompt;
+    }
+    get readTool() {
+        return this._readTool;
+    }
+    /** Scan the skills directory and update state. */
+    async scan() {
+        const entries = await scanSkills(this.dir);
+        this._entries = entries;
+        if (entries.length === 0) {
+            this._systemPrompt = "";
+            this._readTool = null;
+            return;
+        }
+        this._systemPrompt = buildSkillListing(entries);
+        this._readTool = createReadSkillTool(entries);
+        logger.info(`Skills loaded: ${entries.map((s) => s.name).join(", ")}`);
+    }
+    /** Start watching the skills directory for changes. Retries with backoff if directory is missing. */
+    startWatching() {
+        this.stopped = false;
+        this.attemptWatch();
+    }
+    /** Stop the file watcher and cancel any pending retries. */
+    stopWatching() {
+        this.stopped = true;
+        if (this.retryTimer) {
+            clearTimeout(this.retryTimer);
+            this.retryTimer = null;
+        }
+        this.watcher?.close();
+        this.watcher = null;
+    }
+    attemptWatch() {
+        if (this.stopped)
+            return;
+        this.watcher?.close();
+        this.watcher = null;
+        let debounceTimer = null;
+        try {
+            this.watcher = chokidarWatch(this.dir, {
+                ignoreInitial: true,
+                persistent: true,
+                depth: 2,
+            });
+        }
+        catch {
+            this.scheduleRetry();
+            return;
+        }
+        const debouncedRescan = (path) => {
+            if (debounceTimer)
+                clearTimeout(debounceTimer);
+            debounceTimer = setTimeout(() => {
+                logger.info(`Skills directory changed (${path}), rescanning...`);
+                this.scan().catch((err) => {
+                    logger.warn(`Skills rescan failed: ${err instanceof Error ? err.message : err}`);
+                });
+            }, WATCH_DEBOUNCE_MS);
+        };
+        this.watcher
+            .on("add", debouncedRescan)
+            .on("change", debouncedRescan)
+            .on("unlink", debouncedRescan)
+            .on("unlinkDir", debouncedRescan)
+            .on("error", (err) => {
+            logger.warn(`Skills watcher error: ${err instanceof Error ? err.message : err}`);
+            this.scheduleRetry();
+        });
+        this.retryCount = 0;
+        logger.info(`Watching skills directory: ${this.dir}`);
+    }
+    scheduleRetry() {
+        if (this.stopped)
+            return;
+        this.watcher?.close();
+        this.watcher = null;
+        const delay = Math.min(WATCH_RETRY_BASE_MS * 2 ** this.retryCount, WATCH_RETRY_MAX_MS);
+        this.retryCount++;
+        logger.info(`Skills watcher will retry in ${delay / 1000}s (attempt ${this.retryCount})`);
+        this.retryTimer = setTimeout(() => {
+            this.retryTimer = null;
+            this.scan()
+                .catch((err) => {
+                logger.warn(`Skills rescan on retry failed: ${err instanceof Error ? err.message : err}`);
+            })
+                .finally(() => this.attemptWatch());
+        }, delay);
+    }
+}
+/**
+ * Load skills from the given directory and start watching for changes.
+ */
+export async function loadSkills(dir) {
+    const manager = new SkillManager(dir);
+    await manager.scan();
+    manager.startWatching();
+    return manager;
+}

package/dist/skills/prompt.d.ts

@@ -0,0 +1,6 @@
+import type { SkillEntry } from "./types.js";
+/**
+ * Build a compact system prompt section listing available skills.
+ * The model uses `read_skill` to fetch full content on demand.
+ */
+export declare function buildSkillListing(skills: SkillEntry[]): string;

package/dist/skills/prompt.js

@@ -0,0 +1,17 @@
+/**
+ * Build a compact system prompt section listing available skills.
+ * The model uses `read_skill` to fetch full content on demand.
+ */
+export function buildSkillListing(skills) {
+    if (skills.length === 0)
+        return "";
+    const lines = skills.map((s) => `  - **${s.name}**: ${s.description || "(no description)"}`);
+    return `## Available Skills
+You have access to specialized skills. Use the \`read_skill\` tool to read the full instructions for a skill before applying it.
+
+<available_skills>
+${lines.join("\n")}
+</available_skills>
+
+When a user's request matches a skill, read it first, then follow its instructions.`;
+}

package/dist/skills/read-tool.d.ts

@@ -0,0 +1,7 @@
+import { type Tool } from "ai";
+import type { SkillEntry } from "./types.js";
+/**
+ * Create the read_skill tool with the given skill entries baked in.
+ * Returns the full SKILL.md content for the requested skill name.
+ */
+export declare function createReadSkillTool(skills: SkillEntry[]): Tool;

package/dist/skills/read-tool.js

@@ -0,0 +1,24 @@
+import { tool } from "ai";
+import { z } from "zod";
+/**
+ * Create the read_skill tool with the given skill entries baked in.
+ * Returns the full SKILL.md content for the requested skill name.
+ */
+export function createReadSkillTool(skills) {
+    const skillMap = new Map(skills.map((s) => [s.name.toLowerCase(), s]));
+    const validNames = skills.map((s) => s.name).join(", ");
+    return tool({
+        description: `Read the full instructions for a skill. Available: ${validNames}. ` +
+            `Call this before applying a skill so you know its full instructions.`,
+        inputSchema: z.object({
+            name: z.string().describe("The skill name to read"),
+        }),
+        execute: async ({ name }) => {
+            const entry = skillMap.get(name.toLowerCase());
+            if (!entry) {
+                return `Unknown skill "${name}". Available: ${validNames}`;
+            }
+            return entry.content;
+        },
+    });
+}

package/dist/skills/scanner.d.ts

@@ -0,0 +1,6 @@
+import type { SkillEntry } from "./types.js";
+/**
+ * Scan `dir` for subdirectories containing SKILL.md files.
+ * Returns metadata for each discovered skill.
+ */
+export declare function scanSkills(dir: string): Promise<SkillEntry[]>;

package/dist/skills/scanner.js

@@ -0,0 +1,73 @@
+import { readdir, readFile, stat } from "fs/promises";
+import { join, basename, resolve } from "path";
+import { logger } from "../logger.js";
+const SKILL_FILENAME = "SKILL.md";
+/** Parse optional YAML frontmatter delimited by --- */
+function parseFrontmatter(raw) {
+    const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+    if (!match)
+        return { meta: {}, body: raw };
+    const meta = {};
+    for (const line of match[1].split("\n")) {
+        const colon = line.indexOf(":");
+        if (colon === -1)
+            continue;
+        const key = line.slice(0, colon).trim();
+        let value = line.slice(colon + 1).trim();
+        // Handle inline YAML list: tools: [a, b, c]
+        if (typeof value === "string" && value.startsWith("[") && value.endsWith("]")) {
+            value = value
+                .slice(1, -1)
+                .split(",")
+                .map((s) => s.trim())
+                .filter(Boolean);
+        }
+        meta[key] = value;
+    }
+    return { meta, body: match[2] };
+}
+/**
+ * Scan `dir` for subdirectories containing SKILL.md files.
+ * Returns metadata for each discovered skill.
+ */
+export async function scanSkills(dir) {
+    const absDir = resolve(dir);
+    let entries;
+    try {
+        entries = await readdir(absDir);
+    }
+    catch {
+        logger.info(`Skills directory not found: ${absDir} (skipping)`);
+        return [];
+    }
+    const skills = [];
+    const seenNames = new Set();
+    for (const entry of entries) {
+        const entryPath = join(absDir, entry);
+        const entryStat = await stat(entryPath).catch(() => null);
+        if (!entryStat?.isDirectory())
+            continue;
+        const skillFile = join(entryPath, SKILL_FILENAME);
+        let raw;
+        try {
+            raw = await readFile(skillFile, "utf-8");
+        }
+        catch {
+            continue; // no SKILL.md in this directory
+        }
+        const { meta, body } = parseFrontmatter(raw);
+        const name = meta.name ?? basename(entryPath);
+        const description = meta.description ?? "";
+        const tools = Array.isArray(meta.tools) ? meta.tools : [];
+        const icon = meta.icon ?? undefined;
+        const normalizedName = name.toLowerCase();
+        if (seenNames.has(normalizedName)) {
+            logger.warn(`Duplicate skill name "${name}" at ${skillFile}, skipping`);
+            continue;
+        }
+        seenNames.add(normalizedName);
+        skills.push({ name, description, content: body, tools, icon, path: skillFile });
+        // logger.info(`Loaded skill: ${name}${description ? ` — ${description}` : ""}`);
+    }
+    return skills;
+}

package/dist/skills/types.d.ts

@@ -0,0 +1,15 @@
+/** Metadata parsed from a SKILL.md frontmatter during startup scan. */
+export interface SkillEntry {
+    /** Skill name (from frontmatter `name` or directory name) */
+    name: string;
+    /** One-line description (from frontmatter `description`) */
+    description: string;
+    /** Full raw content of SKILL.md (cached for read_skill tool) */
+    content: string;
+    /** Optional list of tool names this skill references */
+    tools: string[];
+    /** Optional Lucide icon name */
+    icon?: string;
+    /** Absolute path to the SKILL.md file */
+    path: string;
+}

package/dist/skills/types.js

@@ -0,0 +1 @@
+export {};

package/dist/tasks/inline-attachment-content.d.ts

@@ -0,0 +1,9 @@
+export interface InlineAttachmentContentResolution {
+    normalizedText: string;
+    imageDataUrls: string[];
+}
+/**
+ * Resolve `attachment://...` markdown references in text into image data URLs.
+ * The returned text replaces inline attachment markdown with `[image attached]`.
+ */
+export declare function resolveInlineAttachmentContent(text: string): Promise<InlineAttachmentContentResolution>;

package/dist/tasks/inline-attachment-content.js

@@ -0,0 +1,64 @@
+import { readFile } from "node:fs/promises";
+import { basename, extname, join } from "node:path";
+import { ATTACHMENTS_DIR } from "../paths.js";
+import { EXT_FOR_MIME } from "./types.js";
+const INLINE_TASK_ATTACHMENT_MARKDOWN_PATTERN = /!\[[^\]]*\]\(attachment:\/\/([^)]+)\)/g;
+const INLINE_TASK_ATTACHMENT_PLACEHOLDER = "[image attached]";
+const MIME_FOR_EXT = Object.fromEntries(Object.entries(EXT_FOR_MIME).map(([mime, ext]) => [ext.toLowerCase(), mime]));
+function extractInlineAttachmentIds(text) {
+    const ids = [];
+    const seenIds = new Set();
+    for (const match of text.matchAll(INLINE_TASK_ATTACHMENT_MARKDOWN_PATTERN)) {
+        const rawId = (match[1] ?? "").trim();
+        if (!rawId || seenIds.has(rawId))
+            continue;
+        seenIds.add(rawId);
+        ids.push(rawId);
+    }
+    return ids;
+}
+function normalizeAttachmentId(rawId) {
+    const candidate = rawId.trim();
+    const safe = basename(candidate);
+    if (!safe || safe !== candidate || safe.startsWith("."))
+        return null;
+    return safe;
+}
+function resolveMimeType(fileName) {
+    const extension = extname(fileName).toLowerCase();
+    return MIME_FOR_EXT[extension] ?? "application/octet-stream";
+}
+async function readAttachmentAsDataUrl(rawId) {
+    const safeId = normalizeAttachmentId(rawId);
+    if (!safeId)
+        return null;
+    try {
+        const filePath = join(ATTACHMENTS_DIR, safeId);
+        const content = await readFile(filePath);
+        const mimeType = resolveMimeType(safeId);
+        return `data:${mimeType};base64,${content.toString("base64")}`;
+    }
+    catch {
+        return null;
+    }
+}
+function replaceInlineAttachmentMarkdown(text) {
+    return text
+        .replace(INLINE_TASK_ATTACHMENT_MARKDOWN_PATTERN, INLINE_TASK_ATTACHMENT_PLACEHOLDER)
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+}
+/**
+ * Resolve `attachment://...` markdown references in text into image data URLs.
+ * The returned text replaces inline attachment markdown with `[image attached]`.
+ */
+export async function resolveInlineAttachmentContent(text) {
+    const attachmentIds = extractInlineAttachmentIds(text);
+    if (attachmentIds.length === 0) {
+        return { normalizedText: text, imageDataUrls: [] };
+    }
+    const resolvedImages = await Promise.all(attachmentIds.map((attachmentId) => readAttachmentAsDataUrl(attachmentId)));
+    const imageDataUrls = resolvedImages.filter((url) => Boolean(url));
+    const normalizedText = replaceInlineAttachmentMarkdown(text);
+    return { normalizedText, imageDataUrls };
+}

package/dist/tasks/store.d.ts

@@ -0,0 +1,112 @@
+import type { Task, TaskAttachment, TaskComment, TaskStatus, TaskPriority } from "./types.js";
+export interface CreateTaskInput {
+    title: string;
+    description?: string;
+    teamId?: string;
+    assignee?: string;
+    priority?: TaskPriority;
+    status?: TaskStatus;
+    needsHumanReview?: boolean;
+    attachments?: TaskAttachment[];
+}
+export interface CreateTaskOptions {
+    /** Actor that created the task. */
+    updatedBy?: string;
+}
+export interface UpdateTaskInput {
+    title?: string;
+    description?: string | null;
+    status?: TaskStatus;
+    assignee?: string | null;
+    priority?: TaskPriority;
+    teamId?: string | null;
+    needsHumanReview?: boolean;
+    attachments?: TaskAttachment[];
+}
+export interface UpdateTaskOptions {
+    /** Whether to clear claim ownership when the task status changes. */
+    clearClaimOnStatusChange?: boolean;
+    /** Actor that performed the update. */
+    updatedBy?: string;
+}
+export interface ListTasksFilter {
+    teamId?: string;
+    status?: TaskStatus;
+    assignee?: string;
+    needsHumanReview?: boolean;
+    includeArchived?: boolean;
+}
+export interface CreateTaskCommentOptions {
+    /** Actor that created the comment. */
+    actor?: string;
+}
+export interface UpdateTaskCommentOptions {
+    /** Actor that edited the comment. */
+    actor?: string;
+}
+export interface DeleteTaskCommentOptions {
+    /** Actor that deleted the comment. */
+    actor?: string;
+}
+/**
+ * SQLite-backed persistence for team tasks.
+ * Shares the same DB file as MemoryStore, ScheduleStore, etc.
+ */
+export declare class TaskStore {
+    private db;
+    private constructor();
+    static create(dbPath: string): Promise<TaskStore>;
+    private createSchema;
+    /** Add position column for existing databases that lack it. */
+    private migrate;
+    /** Initialize or bump task ID counter based on highest numeric task id in DB. */
+    private ensureTaskIdCounter;
+    /** Allocate next task ID as an incrementing number persisted in SQLite. */
+    private nextTaskId;
+    /** Get the next position value for a given status (appends to end). */
+    private nextPosition;
+    /** Get the next position value for a given status (prepends to top). */
+    private topPosition;
+    create(input: CreateTaskInput, options?: CreateTaskOptions): Task;
+    update(id: string, input: UpdateTaskInput, options?: UpdateTaskOptions): Task | null;
+    /**
+     * Bulk-reorder tasks within a status column. Sets positions 0, 1, 2, ...
+     * Reordering is a board-layout concern and must not mutate task freshness fields
+     * (for example updated_at), otherwise subscription workers re-run unchanged tasks.
+     */
+    reorder(status: TaskStatus, orderedIds: string[]): void;
+    delete(id: string): boolean;
+    getById(id: string): Task | null;
+    list(filter?: ListTasksFilter): Task[];
+    listComments(taskId: string): TaskComment[];
+    addComment(taskId: string, content: string, options?: CreateTaskCommentOptions): TaskComment | null;
+    updateComment(id: string, content: string, options?: UpdateTaskCommentOptions): TaskComment | null;
+    deleteComment(id: string, options?: DeleteTaskCommentOptions): TaskComment | null;
+    /** Bulk-archive all tasks currently in the provided completion status, optionally scoped to a team. */
+    archiveDone(teamId?: string, doneStatus?: string, updatedBy?: string): number;
+    /**
+     * Atomically claim the oldest unclaimed task matching the given status for an agent.
+     * Respects assignee: assigned tasks only go to that agent, unassigned to any subscriber.
+     */
+    claimTask(agentId: string, status: string): Task | null;
+    /** Atomically claim a specific task by ID for an agent. Returns the task if claimed, null if already taken. */
+    claimTaskById(taskId: string, agentId: string): Task | null;
+    /** Release a claimed task so it can be retried. */
+    releaseTask(taskId: string): void;
+    /**
+     * Release claim only when held by the provided agent id.
+     * Returns true when a claim was released.
+     */
+    releaseTaskIfClaimedBy(taskId: string, agentId: string): boolean;
+    /**
+     * Mark a claimed task as processed by the given agent for the current task version,
+     * then release the claim atomically.
+     * Returns true when the task was finalized by the expected claim owner.
+     */
+    finalizeClaimedTaskRun(taskId: string, agentId: string): boolean;
+    /** Release claims older than the given cutoff timestamp. Returns count of released claims. */
+    cleanupStaleClaims(cutoffTimestamp: number): number;
+    close(): void;
+    getCommentById(id: string): TaskComment | null;
+    private touchTaskAudit;
+}