CMIBot improvement backlog

[mrfloris]

CMIBot improvement backlog

Accepted during the improvement review on 2026-08-27. Each item keeps the original suggestion number for easy reference.

Search and user experience

• Bump dotenv from 16.6.1 to 17.4.2 #1 Interactive result pagination with Previous/Next/More controls. Expired or stale sessions must be rejected safely.
• Bump openai from 6.49.0 to 7.5.0 #2 Clickable source links to the exact GitHub file and line in the commit currently deployed by the bot. After a deployment, new responses automatically link to the new deployed commit; old Discord messages retain links to the version that produced their result. An optional "latest on main" link may be shown separately where useful.
• #3 Discord autocomplete for context-aware keywords, indexed files, commands, permissions, placeholders, and other known tokens.
• CMIBot improvement backlog #4 "Did you mean?" suggestions when a valid search produces no useful result.
• #5 Safe /lookup files or /lookup categories browsing. Expose only an allowlisted, indexed, plugin-relative data view. Reject absolute paths, .. traversal, symlink escapes, secret-like files, credentials, logs, and unrelated paths; never display arbitrary file content.
• #6 Expandable results showing the full YAML block and surrounding context.
• #7 Keep existing result output unchanged by default, with opt-in cross-references through related:true. Extend that existing option to commands, permissions, placeholders, FAQs, and other supported profiles. For example, /lookup command balance related:true could add its matching permission, related config settings, examples, and FAQ entries. Do not add broad:true, because mode:broad already has a distinct search meaning.
• #8 Shelved: Locale selection for searching non-English translation files.
• #9 Shelved: richer search filters and operators such as key:, path:, value:, exclusions, and AND/OR terms. Keep in backlog for later.
• #10 Configurable plugin-specific synonyms and aliases, such as tp matching teleport-related entries.
• #11 Zero-cost grounded answer mode using only bounded, redacted indexed evidence and exact source citations. The sole model provider is local Ollama with the approved qwen3:8b model over loopback. Paid, external, and cloud providers are rejected, and the paid budget is hard-locked to $0.00. Private answer and status commands, aggregate-only usage counters, local request limits, strict output validation, and deterministic cited fallback are included. Questions, prompts, evidence, answers, identities, routes, endpoints, and operational details are not retained in usage or audit records.
• #13 Shelved: helpful/not-helpful feedback buttons and missing/outdated-data reporting. Keep in backlog for later.

Reliability and operations

• #14 Admin-only /lookup health showing release, uptime, cache readiness, data freshness, version-check state, and Discord connection state.
• #15 Add a local operator helper for status, restart, deploy, and logs. The destination host, alias, username, filesystem paths, and credentials must live only in untracked local configuration. This is not a Discord command and must not expose operational controls or infrastructure identifiers publicly.
• #16 Rotation and size limits for service stdout/stderr logs, with disk-space protection.
• #17 Structured service logs with request IDs and command timing.
• #18 Performance metrics for search latency, cache reload duration, AI usage, upstream checks, errors, and memory.
• #19 Retry, exponential backoff, and circuit-breaker behavior for temporary upstream version-check failures.
• #20 Admin notifications when tracked upstream versions or indexed data become stale or need attention.
• #21 Scheduled GitHub refresh workflow that tests and opens a PR without auto-deploying. Premium plugins may be unavailable or inaccessible, so each source needs an opt-out/manual-source path and the workflow must never assume that every plugin can be downloaded.
• #22 Optional selective reload by plugin/profile, while the default /lookup reload behavior remains a full reload.
• #23 Stronger startup validation for malformed indexes, duplicate routes, missing files, invalid configuration, and unsafe data drift.

Efficiency and code quality

• #24 Parallel cache warming and reloads with a safe concurrency limit.
• #25 A bounded LRU cache for repeated identical searches, invalidated on reload.
• #26 Prebuilt compact indexes or lazy-loaded plugin contexts, with a force-rebuild option that safely clears/recreates derived caches without deleting source data.
• #27 GitHub Actions CI for tests, syntax checks, dependency audits, and supported Node versions.
• #28 Property-based and fuzz testing for search, YAML parsing, input validation, and generated indexes. Execution must be maintainer-only, local/private, and never exposed as an online or Discord-triggered action.
• #29 Automatic, security-aware schema and documentation generation for environment variables and plugin profiles. Generate from canonical definitions and metadata only; never print, copy, inspect, or serialize real environment values. Secret fields must appear only as empty placeholders with a secret classification.
• #30 Version-diff and release-note support showing what changed between tracked plugin versions.
• #31 Multi-turn support threads where the bot remembers the active plugin and previous search context, with bounded retention and explicit privacy behavior.
• #32 Shelved: search-quality tuning from anonymized feedback and failed-query analysis. Keep in backlog for later.

Design constraints

• Do not weaken channel, role, path, or secret protections for convenience.
• Preserve the current channel-based plugin isolation by default.
• Treat all derived indexes and caches as rebuildable; source data remains authoritative.
• Never put internal hostnames, aliases, usernames, private filesystem paths, credentials, or other infrastructure identifiers in public issues, repository documentation, Discord output, or service logs.
• Internal connection configuration belongs in an untracked, local-only configuration file.
• Source links represent the release that produced the response; each new deployment automatically uses its new commit.
• Paid, external, and cloud AI providers remain disabled. The only supported model path is a cloud-disabled local runtime over loopback, with the paid budget fixed at zero and a deterministic cited fallback.
• The local model receives only the minimum redacted indexed snippets needed for the request, without secrets, identities, source URLs, operational metadata, conversation history, or unrelated user data.
• Documentation generation uses schema metadata and safe placeholders, never live credential values.

[mrfloris]

Completed #26 in commit 4dc9446.

Implemented content-fingerprinted compact profile indexes with owner-only files, opaque artifact names, bounded compression, automatic stale/corrupt rejection, and preserved expandable YAML context. The admin reload command now accepts force:true for full, plugin, or profile rebuilds. Force rebuilding bypasses and atomically replaces only derived artifacts; authoritative source files are never deleted or modified.

Verification: 221 tests passed, including same-size source edits, malformed artifacts, symlink replacement attempts, traversal rejection, file permissions, transactional reload behavior, and force scope handling. Deployment verification rebuilt 44 artifacts on the first startup and reused all 44 on the next startup with zero rebuilds or write failures.