@bman654/clodex 2.18.6 → 2.18.7

package/README.md

@@ -326,7 +326,7 @@ account's model entitlement.
 
 Providers supported: `openai` (API key, platform.openai.com), `openai-oauth` (ChatGPT/Codex plan), and `opencode-go` (OpenCode Go API key). OpenCode Go exposes its Anthropic Messages, Chat Completions, and Responses models; entries whose transport has not been verified against the live endpoint are left out. See [OpenCode Go provider](docs/opencode-go.md).
 
-A **custom OpenAI-compatible server** is any OpenAI-style API, given by its base URL (the part before `/chat/completions`), such as `https://openrouter.ai/api/v1`. `providers add` asks for a name, the base URL and an API key (leave it empty for a local server without auth), lists the server's models to check the connection, and saves the provider as `custom-<name>`. Its models then appear in `clodex models`; once saved as favorites they are addressed as `clodex:custom-<name>:<model>` and can be given a short alias with `clodex models --alias`. The base URL is checked before anything is saved: plain `http://` is accepted only after you confirm it, and only for loopback or private-network addresses, and an `https://` URL whose host is, or resolves to, a loopback (`127.0.0.0/8`, `::1`), private, link-local, unique-local, carrier-grade-NAT or well-known cloud-metadata address is refused. A model's id and name are stored with surrounding whitespace trimmed, and a model whose trimmed id or name still contains a control character is skipped, whether the list is fetched by `providers add` or by `providers refresh-models`, and error text from the server is shown with control characters replaced by spaces. Only the OpenAI-compatible kind is offered in the menu.
+A **custom OpenAI-compatible server** is any OpenAI-style API, given by its base URL (the part before `/chat/completions`), such as `https://openrouter.ai/api/v1`. `providers add` asks for a name, the base URL and an API key (leave it empty for a local server without auth), lists the server's models to check the connection, and saves the provider as `custom-<name>`. Its models then appear in `clodex models`; once saved as favorites they are addressed as `clodex:custom-<name>:<model>` and can be given a short alias with `clodex models --alias`. The base URL is checked before anything is saved and again when its models are refreshed: plain `http://` is accepted only after you confirm it, and only if every address the host resolves to is on this machine, your LAN or a private network such as Tailscale (loopback, private, unique-local IPv6 or carrier-grade-NAT `100.64.0.0/10` addresses); `https://` is accepted on any of those networks as well as the public internet; and a link-local (`169.254.0.0/16`, `fe80::/10`) or well-known cloud-metadata address is refused whether or not HTTP was approved. A server on another machine in your tailnet can be added by its `100.x` address, its MagicDNS name, or the HTTPS name `tailscale serve` gives it. A model's id and name are stored with surrounding whitespace trimmed, and a model whose trimmed id or name still contains a control character is skipped, whether the list is fetched by `providers add` or by `providers refresh-models`, and error text from the server is shown with control characters replaced by spaces. Only the OpenAI-compatible kind is offered in the menu.
 
 ### `clodex install-vscode-launcher`
 

package/dist/cli.js

@@ -346,7 +346,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.18.6",
+  version: "2.18.7",
   publishConfig: {
     access: "public"
   },
@@ -16009,21 +16009,17 @@ var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
   "169.254.169.254",
   "metadata.google.internal",
   "169.254.170.2",
-  "fd00:ec2::254"
+  "fd00:ec2::254",
+  "100.100.100.200",
+  // Alibaba Cloud ECS
+  "fd20:ce::254"
+  // Google Cloud IPv6
 ]);
-function isBlockedIp(ipStr, allowInsecureLocal) {
+var NON_PUBLIC_RANGES = /* @__PURE__ */ new Set(["loopback", "private", "uniqueLocal", "carrierGradeNat"]);
+function isBlockedIp(ipStr) {
   try {
     const ip = ipaddr.process(ipStr);
-    const range = ip.range();
-    if (allowInsecureLocal && (range === "loopback" || range === "private")) {
-      return false;
-    }
-    if (range === "loopback") return true;
-    if (range === "private") return true;
-    if (range === "linkLocal") return true;
-    if (range === "uniqueLocal") return true;
-    if (range === "carrierGradeNat") return true;
-    return false;
+    return ip.range() === "linkLocal" || BLOCKED_HOSTNAMES.has(ip.toString());
   } catch {
     return true;
   }
@@ -16057,10 +16053,10 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     return {
       ok: false,
       error: "Only HTTPS URLs are allowed.",
-      hint: "For local or LAN servers (Ollama, LM Studio, vLLM), allow insecure HTTP when prompted."
+      hint: "For a server on this machine, your LAN or Tailscale (Ollama, LM Studio, vLLM), allow insecure HTTP when prompted."
     };
   } else if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    return { ok: false, error: "URL must use https:// or user-approved http:// for local/LAN servers." };
+    return { ok: false, error: "URL must use https:// or user-approved http:// for local, LAN or Tailscale servers." };
   }
   const rawHostname = parsed.hostname.toLowerCase();
   const hostname = rawHostname.replace(/^\[(.*)\]$/, "$1");
@@ -16068,7 +16064,7 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     return {
       ok: false,
       error: "This URL points to a blocked internal/metadata host.",
-      hint: "Use a public API endpoint for your provider."
+      hint: "Use your model server's own loopback, LAN, Tailscale or public address."
     };
   }
   const addresses = await resolveHostAddresses(hostname);
@@ -16085,19 +16081,18 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     } catch {
       continue;
     }
-    if (isBlockedIp(addr, allowLocal)) {
+    if (isBlockedIp(addr)) {
       return {
         ok: false,
-        error: "URL resolves to a private or restricted network address.",
-        hint: "Use a public HTTPS endpoint, or explicitly allow insecure HTTP for a trusted local/LAN server."
+        error: "URL resolves to a restricted link-local or cloud metadata address.",
+        hint: "Link-local addresses are not supported. Use the server's loopback, LAN, Tailscale or public address."
       };
     }
   }
   if (parsed.protocol === "http:") {
     const allResolvedAddressesAreLocal = addresses.every((addr) => {
       try {
-        const range = ipaddr.process(addr).range();
-        return range === "loopback" || range === "private" || range === "uniqueLocal";
+        return NON_PUBLIC_RANGES.has(ipaddr.process(addr).range());
       } catch {
         return false;
       }
@@ -16105,8 +16100,8 @@ async function validateCustomEndpointUrl(rawUrl, opts = {}) {
     if (!allowLocal || !allResolvedAddressesAreLocal) {
       return {
         ok: false,
-        error: "HTTP is only allowed for local loopback or private-network addresses.",
-        hint: "Use https://, or allow insecure HTTP for a trusted local/LAN server."
+        error: "HTTP is only allowed for addresses on this machine, your LAN or a private network such as Tailscale.",
+        hint: "Use https:// for a server on the public internet."
       };
     }
   }
@@ -16354,9 +16349,9 @@ async function runCustomEndpointAddFlow(onResult) {
   }
   let allowInsecureLocal = false;
   if (/^http:\/\//i.test(String(baseUrl).trim())) {
-    p3.log.warn("HTTP is not encrypted. Only use it for a trusted local or LAN server.");
+    p3.log.warn("HTTP is not encrypted. Only use it for a trusted server on this machine, your LAN or Tailscale.");
     const allow = await p3.confirm({
-      message: "Allow insecure HTTP for this local/LAN server?",
+      message: "Allow insecure HTTP for this local, LAN or Tailscale server?",
       initialValue: true
     });
     if (p3.isCancel(allow)) {
@@ -16879,8 +16874,9 @@ async function refreshApiListProvider(provider, apiKey) {
   let safeBaseUrl = baseUrl;
   const templateDefault = catalogTemplate?.defaultBaseUrl?.trim();
   if (configuredUrl && configuredUrl !== templateDefault) {
+    const customEndpoint = provider.templateId === "custom-openai" || provider.templateId === "custom-anthropic";
     const urlCheck = await validateCustomEndpointUrl(baseUrl, {
-      allowInsecureLocal: catalogTemplate?.apiKeyOptional === true
+      allowInsecureLocal: catalogTemplate?.apiKeyOptional === true || customEndpoint
     });
     if (!urlCheck.ok || !urlCheck.normalizedUrl) {
       return { models: [], error: `${urlCheck.error ?? "Invalid API base URL."} ${urlCheck.hint ?? ""}`.trim() };
@@ -17078,7 +17074,7 @@ async function refreshProviderModels(providerId, apiKey, registry, credentialSna
       }
     } else {
       const template = resolveProviderTemplate(provider);
-      const keyOptional = template?.apiKeyOptional === true;
+      const keyOptional = template?.apiKeyOptional === true || isAnonymousProvider(provider);
       const effectiveKey = keyOptional && isLikelyPlaceholderKey(apiKey) ? "" : apiKey;
       if (!keyOptional && isLikelyPlaceholderKey(effectiveKey)) {
         if (cachedModelCount(cacheProvider) > 0) {