wolverine-ai 3.7.2 → 3.7.4

package/bin/wolverine.js

@@ -144,9 +144,10 @@ console.log(chalk.yellow.bold("\n  🐺 Wolverine Node.js — Autonomous Server
 logSystemInfo(systemInfo);
 console.log("");
 
-console.log(chalk.bold("  Models:"));
+console.log(chalk.bold(`  Models (${config.provider}):`));
 logModelConfig(chalk);
 console.log("");
+console.log(chalk.gray(`  Provider:   ${config.provider}`));
 console.log(chalk.gray(`  Script:     ${scriptPath}`));
 console.log(chalk.gray(`  Port:       ${config.server.port}`));
 console.log(chalk.gray(`  Retries:    ${config.server.maxRetries}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wolverine-ai",
-  "version": "3.7.2",
+  "version": "3.7.4",
   "description": "Self-healing Node.js server framework powered by AI. Catches crashes, diagnoses errors, generates fixes, verifies, and restarts — automatically.",
   "main": "src/index.js",
   "bin": {

package/src/agent/agent-engine.js

@@ -414,7 +414,7 @@ class AgentEngine {
       }
 
       let response;
-      const AI_CALL_TIMEOUT_MS = 45000; // 45s per API call — prevents indefinite hangs
+      const AI_CALL_TIMEOUT_MS = parseInt(process.env.WOLVERINE_AI_CALL_TIMEOUT_MS, 10) || 90000; // 90s per API call — self-hosted GPU needs more time
       try {
         response = await Promise.race([
           aiCallWithHistory({
@@ -423,7 +423,7 @@ class AgentEngine {
             tools: allTools,
             maxTokens: 4096,
           }),
-          new Promise((_, reject) => setTimeout(() => reject(new Error("AI call timed out after 45s")), AI_CALL_TIMEOUT_MS)),
+          new Promise((_, reject) => setTimeout(() => reject(new Error(`AI call timed out after ${AI_CALL_TIMEOUT_MS / 1000}s`)), AI_CALL_TIMEOUT_MS)),
         ]);
       } catch (err) {
         console.log(chalk.red(`  Agent API error: ${err.message}`));

package/src/core/config.js

@@ -43,6 +43,7 @@ function loadConfig() {
       classifier: process.env.CLASSIFIER_MODEL   || modelSource.classifier || "gpt-4o-mini",
       audit:      process.env.AUDIT_MODEL        || modelSource.audit      || "gpt-4o-mini",
       compacting: process.env.COMPACTING_MODEL   || modelSource.compacting || "gpt-4o-mini",
+      utility:    process.env.COMPACTING_MODEL   || modelSource.compacting || "gpt-4o-mini",
       research:   process.env.RESEARCH_MODEL     || modelSource.research   || "gpt-4o",
       embedding:  process.env.TEXT_EMBEDDING_MODEL || modelSource.embedding || "text-embedding-3-small",
     },

package/src/core/models.js

@@ -119,9 +119,12 @@ function getModel(role) {
 function getModelConfig() {
   const config = {};
   for (const [role, def] of Object.entries(MODEL_ROLES)) {
+    const resolved = getModel(role);
+    const fromEnv = !!process.env[def.envKey];
+    const fromDefault = resolved === def.default;
     config[role] = {
-      model: process.env[def.envKey] || def.default,
-      source: process.env[def.envKey] ? "env" : "default",
+      model: resolved,
+      source: fromEnv ? "env" : fromDefault ? "default" : "settings",
       tier: def.tier,
     };
   }

package/src/security/injection-detector.js

@@ -98,13 +98,31 @@ Respond with ONLY valid JSON:
     category: "audit",
   });
 
-  const content = result.content;
-  const cleaned = content.replace(/^```(?:json)?\n?/, "").replace(/\n?```$/, "");
+  const content = (result.content || "").trim();
+  // Strip markdown code blocks, thinking tags, and any prefix text
+  let cleaned = content
+    .replace(/^```(?:json)?\s*/gm, "")
+    .replace(/```\s*$/gm, "")
+    .replace(/<\|channel>.*?<channel\|>/gs, "") // Gemma thinking tags
+    .replace(/<\|think\|>[\s\S]*?<\|\/think\|>/g, "") // thinking blocks
+    .trim();
+
+  // Extract JSON object from response (might have text before/after)
+  const jsonMatch = cleaned.match(/\{[\s\S]*"safe"\s*:\s*(true|false)[\s\S]*\}/);
+  if (jsonMatch) cleaned = jsonMatch[0];
 
   try {
-    return JSON.parse(cleaned);
+    const parsed = JSON.parse(cleaned);
+    return parsed;
   } catch {
-    return { safe: false, risk_level: "medium", explanation: "Could not parse safety scan response" };
+    // If the response contains "safe" as text, infer the result
+    if (/\bsafe\b.*\btrue\b/i.test(content) || /\bnone\b.*\brisk/i.test(content)) {
+      return { safe: true, risk_level: "none", explanation: "Inferred safe from unparseable response" };
+    }
+    // Default to SAFE for parse failures — blocking heals on bad JSON is worse than allowing a safe error through
+    // The regex layer already caught obvious injection patterns
+    console.log(chalk.yellow(`  ⚠️  AI audit: could not parse response, defaulting to safe`));
+    return { safe: true, risk_level: "none", explanation: "Could not parse safety scan — defaulting safe (regex layer passed)" };
   }
 }