* feat(bluebubbles): auto-strip markdown from outbound messages (#7402) * fix(security): add timeout to webhook body reading (#6762) Adds 30-second timeout to readBody() in voice-call, bluebubbles, and nostr webhook handlers. Prevents Slow-Loris DoS (CWE-400, CVSS 7.5). Merged with existing maxBytes protection in voice-call. * fix(security): unify Error objects and lint fixes in webhook timeouts (#6762) * fix: prevent plugins from auto-enabling without user consent (#3961) Changes default plugin enabled state from true to false in enablePluginEntry(). Preserves existing enabled:true values. Fixes #3932. * fix: apply hierarchical mediaMaxMb config to all channels (#8749) Generalizes resolveAttachmentMaxBytes() to use account → channel → global config resolution for all channels, not just BlueBubbles. Fixes #7847. * fix(bluebubbles): sanitize attachment filenames against header injection (#10333) Strip ", \r, \n, and \\ from filenames after path.basename() to prevent multipart Content-Disposition header injection (CWE-93, CVSS 5.4). Also adds sanitization to setGroupIconBlueBubbles which had zero filename sanitization. * fix(lint): exclude extensions/ from Oxlint preflight check (#9313) Extensions use PluginRuntime|null patterns that trigger no-redundant-type-constituents because PluginRuntime resolves to any. Excluding extensions/ from Oxlint unblocks user upgrades. Re-applies the approach from closed PR #10087. * fix(bluebubbles): add tempGuid to createNewChatWithMessage payload (#7745) Non-Private-API mode (AppleScript) requires tempGuid in send payloads. The main sendMessageBlueBubbles already had it, but createNewChatWithMessage was missing it, causing 400 errors for new chat creation without Private API. * fix: send stop-typing signal when run ends with NO_REPLY (#8785) Adds onCleanup callback to the typing controller that fires when the controller is cleaned up while typing was active (e.g., after NO_REPLY). Channels using createTypingCallbacks automatically get stop-typing on cleanup. This prevents the typing indicator from lingering in group chats when the agent decides not to reply. * fix(telegram): deduplicate skill commands in multi-agent setup (#5717) Two fixes: 1. Skip duplicate workspace dirs when listing skill commands across agents. Multiple agents sharing the same workspace would produce duplicate commands with _2, _3 suffixes. 2. Clear stale commands via deleteMyCommands before registering new ones. Commands from deleted skills now get cleaned up on restart. * fix: add size limits to unbounded in-memory caches (#4948) Adds max-size caps with oldest-entry eviction to prevent OOM in long-running deployments: - BlueBubbles serverInfoCache: 64 entries (already has TTL) - Google Chat authCache: 32 entries - Matrix directRoomCache: 1024 entries - Discord presenceCache: 5000 entries per account * fix: address review concerns (#11093) - Chain deleteMyCommands → setMyCommands to prevent race condition (#5717) - Rename enablePluginEntry to registerPluginEntry (now sets enabled: false) - Add Slow-Loris timeout test for readJsonBody (#6023)
142 lines
4.3 KiB
TypeScript
142 lines
4.3 KiB
TypeScript
import fs from "node:fs";
|
|
import type { OpenClawConfig } from "../config/config.js";
|
|
import { listAgentIds, resolveAgentWorkspaceDir } from "../agents/agent-scope.js";
|
|
import { buildWorkspaceSkillCommandSpecs, type SkillCommandSpec } from "../agents/skills.js";
|
|
import { getRemoteSkillEligibility } from "../infra/skills-remote.js";
|
|
import { listChatCommands } from "./commands-registry.js";
|
|
|
|
function resolveReservedCommandNames(): Set<string> {
|
|
const reserved = new Set<string>();
|
|
for (const command of listChatCommands()) {
|
|
if (command.nativeName) {
|
|
reserved.add(command.nativeName.toLowerCase());
|
|
}
|
|
for (const alias of command.textAliases) {
|
|
const trimmed = alias.trim();
|
|
if (!trimmed.startsWith("/")) {
|
|
continue;
|
|
}
|
|
reserved.add(trimmed.slice(1).toLowerCase());
|
|
}
|
|
}
|
|
return reserved;
|
|
}
|
|
|
|
export function listSkillCommandsForWorkspace(params: {
|
|
workspaceDir: string;
|
|
cfg: OpenClawConfig;
|
|
skillFilter?: string[];
|
|
}): SkillCommandSpec[] {
|
|
return buildWorkspaceSkillCommandSpecs(params.workspaceDir, {
|
|
config: params.cfg,
|
|
skillFilter: params.skillFilter,
|
|
eligibility: { remote: getRemoteSkillEligibility() },
|
|
reservedNames: resolveReservedCommandNames(),
|
|
});
|
|
}
|
|
|
|
export function listSkillCommandsForAgents(params: {
|
|
cfg: OpenClawConfig;
|
|
agentIds?: string[];
|
|
}): SkillCommandSpec[] {
|
|
const used = resolveReservedCommandNames();
|
|
const entries: SkillCommandSpec[] = [];
|
|
const agentIds = params.agentIds ?? listAgentIds(params.cfg);
|
|
// Track visited workspace dirs to avoid registering duplicate commands
|
|
// when multiple agents share the same workspace directory (#5717).
|
|
const visitedDirs = new Set<string>();
|
|
for (const agentId of agentIds) {
|
|
const workspaceDir = resolveAgentWorkspaceDir(params.cfg, agentId);
|
|
if (!fs.existsSync(workspaceDir)) {
|
|
continue;
|
|
}
|
|
// Resolve to canonical path to handle symlinks and relative paths
|
|
const canonicalDir = fs.realpathSync(workspaceDir);
|
|
if (visitedDirs.has(canonicalDir)) {
|
|
continue;
|
|
}
|
|
visitedDirs.add(canonicalDir);
|
|
const commands = buildWorkspaceSkillCommandSpecs(workspaceDir, {
|
|
config: params.cfg,
|
|
eligibility: { remote: getRemoteSkillEligibility() },
|
|
reservedNames: used,
|
|
});
|
|
for (const command of commands) {
|
|
used.add(command.name.toLowerCase());
|
|
entries.push(command);
|
|
}
|
|
}
|
|
return entries;
|
|
}
|
|
|
|
function normalizeSkillCommandLookup(value: string): string {
|
|
return value
|
|
.trim()
|
|
.toLowerCase()
|
|
.replace(/[\s_]+/g, "-");
|
|
}
|
|
|
|
function findSkillCommand(
|
|
skillCommands: SkillCommandSpec[],
|
|
rawName: string,
|
|
): SkillCommandSpec | undefined {
|
|
const trimmed = rawName.trim();
|
|
if (!trimmed) {
|
|
return undefined;
|
|
}
|
|
const lowered = trimmed.toLowerCase();
|
|
const normalized = normalizeSkillCommandLookup(trimmed);
|
|
return skillCommands.find((entry) => {
|
|
if (entry.name.toLowerCase() === lowered) {
|
|
return true;
|
|
}
|
|
if (entry.skillName.toLowerCase() === lowered) {
|
|
return true;
|
|
}
|
|
return (
|
|
normalizeSkillCommandLookup(entry.name) === normalized ||
|
|
normalizeSkillCommandLookup(entry.skillName) === normalized
|
|
);
|
|
});
|
|
}
|
|
|
|
export function resolveSkillCommandInvocation(params: {
|
|
commandBodyNormalized: string;
|
|
skillCommands: SkillCommandSpec[];
|
|
}): { command: SkillCommandSpec; args?: string } | null {
|
|
const trimmed = params.commandBodyNormalized.trim();
|
|
if (!trimmed.startsWith("/")) {
|
|
return null;
|
|
}
|
|
const match = trimmed.match(/^\/([^\s]+)(?:\s+([\s\S]+))?$/);
|
|
if (!match) {
|
|
return null;
|
|
}
|
|
const commandName = match[1]?.trim().toLowerCase();
|
|
if (!commandName) {
|
|
return null;
|
|
}
|
|
if (commandName === "skill") {
|
|
const remainder = match[2]?.trim();
|
|
if (!remainder) {
|
|
return null;
|
|
}
|
|
const skillMatch = remainder.match(/^([^\s]+)(?:\s+([\s\S]+))?$/);
|
|
if (!skillMatch) {
|
|
return null;
|
|
}
|
|
const skillCommand = findSkillCommand(params.skillCommands, skillMatch[1] ?? "");
|
|
if (!skillCommand) {
|
|
return null;
|
|
}
|
|
const args = skillMatch[2]?.trim();
|
|
return { command: skillCommand, args: args || undefined };
|
|
}
|
|
const command = params.skillCommands.find((entry) => entry.name.toLowerCase() === commandName);
|
|
if (!command) {
|
|
return null;
|
|
}
|
|
const args = match[2]?.trim();
|
|
return { command, args: args || undefined };
|
|
}
|