[asyntai]

New package: asyntai-ai-assistant

Adds Asyntai AI Assistant (0.1.0). Asyntai is an AI chatbot that answers website visitors from the site's own pages, docs and FAQ. This package brings those answers into any text field, which is handy for support replies.

Trigger	What it does
:ask	Form with one question field, then types the chatbot's answer
:clipask	Answers the text on the clipboard (for example a customer email)
:asyntaikey	One-time setup: paste the Asyntai API key; it is checked before it is saved

Docs: https://asyntai.com/documentation/integrations/espanso/

For review: what the scripts run

Each match has one shell var. The command is written so both Espanso default shells read it:

• macOS / Linux (sh, bash, zsh): line 1 runs python3 asyntai.py <mode> and exit 0, so line 2 and 3 are never reached.
• Windows (PowerShell): `# on line 1 is an escaped #, then <# opens a block comment that #> on line 2 closes. PowerShell runs asyntai.ps1 on line 3 (loaded with [scriptblock]::Create, so the execution policy does not block it).

The comment at the top of package.yml explains this too.

The two scripts do the same thing:

• Read the question from ESPANSO_FORM1_QUESTION / ESPANSO_CLIP, never from the command text, so quotes, $ and backticks in a question cannot change the command.
• One HTTPS request to https://asyntai.com/api/v1/chat/ (or /api/v1/websites/ to check the key), API key in the Authorization header.
• Print the answer as plain text (links as text (url), no Markdown bold or headings).
• Write one file only: the saved key in %APPDATA%\asyntai\ or ~/.config/asyntai/ (mode 0600). Nothing is deleted, nothing is downloaded or executed.
• Errors are printed as a short Asyntai: ... line, and the scripts always exit 0.

No dependencies: Windows PowerShell 5.1 on Windows; Python 3 standard library on macOS and Linux.

Testing

• .github/scripts/validate passes locally (0 errors).
• Real Espanso 2.4.1 (Linux X11 build): :clipask and the :ask / :asyntaikey commands expand correctly, Unicode intact. Windows Espanso 2.4.1 (portable) loads all three matches.
• Each command run the way Espanso's shell extension runs it, against a local server: Windows PowerShell 36/36 checks, bash 37/37, dash 37/37, Python 3.8 to 3.12. The checks cover hostile characters, empty input, bad / revoked keys, rate limits and the server being down.
• Not tested on macOS (no Mac here). The README says the default shell must be sh, bash or zsh.

Source and tests: https://github.com/asyntai/espanso-ai-assistant

Disclosure

We build Asyntai, the service this package calls.

[Copilot]

🟡 Changes recommended

Automatic redirects can expose questions or API credentials to hosts outside Asyntai.

2 open findings

• Automatic redirects can replay POST data to arbitrary hosts · New
• Redirects can leak Authorization headers to arbitrary hosts · New

What changed in this PR

Adds the Asyntai AI Assistant package, enabling Espanso users to query their website chatbot from text fields.

Changes:

• Adds :ask, :clipask, and :asyntaikey triggers.
• Implements Python and PowerShell API clients.
• Adds package metadata, documentation, licensing, and setup instructions.

File	Description
README.md	Documents setup, triggers, and requirements.
package.yml	Defines triggers and cross-platform launch commands.
LICENSE	Adds the MIT license.
asyntai.py	Implements the macOS/Linux client.
asyntai.ps1	Implements the Windows client.
_manifest.yml	Defines package metadata.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[smeech]

This is a more complex package than most, Copilot is already raising some security concerns, and I am about to go away so am short on time! I'll see if others would like to contribute. I may be back on a mobile device but can't do any testing of my own. The automated checks pass, but this needs closer inspection before we merge.

If you've solved the issue of running OS-agnostic scripts I will be most impressed! I have been wrestling with this for a while. 😄 .

[asyntai]

Thanks for the quick look, and have a good trip!

Copilot was right about the redirects. Fixed in a052a1b: both scripts now never follow a redirect (AllowAutoRedirect = $false in PowerShell, a no-redirect handler in Python), and any non-2xx answer becomes a short error line. We added a test with a local server that answers 307/302 and checks that nothing reaches the second host. It failed on the old code and passes now.

On the OS-agnostic part: each match runs one command that both default shells can read. On sh/bash/zsh, line 1 runs the Python script and exits. In PowerShell, `# is an escaped # and <# opens a block comment that #> on line 2 closes, so PowerShell skips straight to line 3. Tested in real Espanso 2.4.1 on Linux, plus Windows PowerShell 5.1, bash and dash. Happy to explain anything else.

[smeech]

Thank you for drawing this to my attention! Just documenting it to share, and for future reference.