@cruxy/cli 0.26.0 → 0.28.0

package/dist/tools/file/edit-file.js

@@ -1,16 +1,7 @@
 import { promises as fs } from "node:fs";
 import { z } from "zod";
 import { resolveToolPath } from "./paths.js";
-/** Count non-overlapping exact occurrences of `needle` in `haystack`. */
-export function countOccurrences(haystack, needle) {
-    let count = 0;
-    let i = haystack.indexOf(needle);
-    while (i !== -1) {
-        count++;
-        i = haystack.indexOf(needle, i + needle.length);
-    }
-    return count;
-}
+import { applyEol, detectEol, findMatch, tierLabel } from "./match.js";
 /**
  * Replace one exact, unique occurrence of `old_str` with `new_str` in a file.
  * The uniqueness requirement is checked before approval so the model can fix an
@@ -47,14 +38,14 @@ export const editFileTool = {
             }
             return { ok: false, error: err.message };
         }
-        const matches = countOccurrences(content, input.old_str);
-        if (matches === 0) {
+        const match = findMatch(content, input.old_str);
+        if (match.kind === "none") {
             return { ok: false, error: `old_str not found in ${input.path}` };
         }
-        if (matches > 1) {
+        if (match.kind === "ambiguous") {
             return {
                 ok: false,
-                error: `old_str not unique (${matches} matches); add surrounding context to disambiguate`,
+                error: `old_str not unique (${match.count} matches${tierLabel(match.tier)}); add surrounding context to disambiguate`,
             };
         }
         const decision = await ctx.requestApproval({
@@ -68,11 +59,11 @@ export const editFileTool = {
                 error: decision.feedback ?? `edit to ${input.path} denied`,
             };
         }
-        // Replace the single occurrence by index to avoid `$`-pattern interpretation.
-        const idx = content.indexOf(input.old_str);
-        const updated = content.slice(0, idx) +
-            input.new_str +
-            content.slice(idx + input.old_str.length);
+        // Splice the matched span by offset (avoids `$`-pattern interpretation) and
+        // re-encode new_str to the file's line ending so a CRLF file stays CRLF.
+        const updated = content.slice(0, match.start) +
+            applyEol(input.new_str, detectEol(content)) +
+            content.slice(match.end);
         try {
             await fs.writeFile(abs, updated, "utf8");
             return { ok: true, output: `edited ${input.path}` };

package/dist/tools/file/match.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Locating `old_str` inside a file for edit_file / apply_patch.
+ *
+ * Models emit `\n` line endings, but a file on disk may be `\r\n` (Windows
+ * checkouts/editors) — a byte-exact `indexOf` then never matches and the model
+ * can't replace existing code. We match in ordered tiers, tightest first, and
+ * stop at the first tier that finds anything:
+ *
+ *   0. exact        — raw bytes; every currently-working edit takes this path
+ *   1. eol          — CRLF and lone CR treated as LF (comparison only)
+ *   2. eol+trailws  — tier 1, plus trailing whitespace ignored per line
+ *
+ * Looser tiers compare against a normalized copy but return offsets into the
+ * ORIGINAL string, so the splice preserves every unmatched byte verbatim (the
+ * file is never wholesale re-encoded). Ambiguity is never resolved by guessing:
+ * more than one match at a tier is a hard error, and we do not fall through to a
+ * looser tier (looser can only be more ambiguous, never less).
+ */
+export type Tier = "exact" | "eol" | "eol+trailws";
+export type MatchResult = {
+    kind: "found";
+    start: number;
+    end: number;
+} | {
+    kind: "ambiguous";
+    count: number;
+    tier: Tier;
+} | {
+    kind: "none";
+};
+/**
+ * Find the single occurrence of `oldStr` in `content`, tolerating line-ending
+ * and trailing-whitespace differences. Returns original-string byte offsets on
+ * a unique match, `ambiguous` if the tightest matching tier had >1 hit, or
+ * `none` if no tier matched.
+ */
+export declare function findMatch(content: string, oldStr: string): MatchResult;
+/** The file's line ending: CRLF if the first newline is `\r\n`, else LF. */
+export declare function detectEol(content: string): "\r\n" | "\n";
+/** Re-encode `text`'s line endings to `eol` so an edit matches the file. */
+export declare function applyEol(text: string, eol: "\r\n" | "\n"): string;
+/** Human phrase for the tier named in an ambiguity error. */
+export declare function tierLabel(tier: Tier): string;

package/dist/tools/file/match.js

@@ -0,0 +1,127 @@
+/**
+ * Locating `old_str` inside a file for edit_file / apply_patch.
+ *
+ * Models emit `\n` line endings, but a file on disk may be `\r\n` (Windows
+ * checkouts/editors) — a byte-exact `indexOf` then never matches and the model
+ * can't replace existing code. We match in ordered tiers, tightest first, and
+ * stop at the first tier that finds anything:
+ *
+ *   0. exact        — raw bytes; every currently-working edit takes this path
+ *   1. eol          — CRLF and lone CR treated as LF (comparison only)
+ *   2. eol+trailws  — tier 1, plus trailing whitespace ignored per line
+ *
+ * Looser tiers compare against a normalized copy but return offsets into the
+ * ORIGINAL string, so the splice preserves every unmatched byte verbatim (the
+ * file is never wholesale re-encoded). Ambiguity is never resolved by guessing:
+ * more than one match at a tier is a hard error, and we do not fall through to a
+ * looser tier (looser can only be more ambiguous, never less).
+ */
+const TIERS = ["exact", "eol", "eol+trailws"];
+/**
+ * Find the single occurrence of `oldStr` in `content`, tolerating line-ending
+ * and trailing-whitespace differences. Returns original-string byte offsets on
+ * a unique match, `ambiguous` if the tightest matching tier had >1 hit, or
+ * `none` if no tier matched.
+ */
+export function findMatch(content, oldStr) {
+    for (const tier of TIERS) {
+        const occ = occurrences(content, oldStr, tier);
+        if (occ.length === 1) {
+            return { kind: "found", start: occ[0].start, end: occ[0].end };
+        }
+        if (occ.length > 1) {
+            return { kind: "ambiguous", count: occ.length, tier };
+        }
+        // 0 matches → try the next, looser tier.
+    }
+    return { kind: "none" };
+}
+/** Non-overlapping occurrences of `oldStr` under `tier`, as original offsets. */
+function occurrences(content, oldStr, tier) {
+    const out = [];
+    if (tier === "exact") {
+        let i = content.indexOf(oldStr);
+        while (i !== -1) {
+            out.push({ start: i, end: i + oldStr.length });
+            i = content.indexOf(oldStr, i + oldStr.length);
+        }
+        return out;
+    }
+    const { norm, map } = normalize(content, tier);
+    const { norm: needle } = normalize(oldStr, tier);
+    // An all-whitespace old_str can normalize to empty under eol+trailws; refuse
+    // to "match everywhere" rather than delete at an arbitrary point.
+    if (needle.length === 0)
+        return out;
+    let i = norm.indexOf(needle);
+    while (i !== -1) {
+        out.push({ start: map[i], end: map[i + needle.length] });
+        i = norm.indexOf(needle, i + needle.length);
+    }
+    return out;
+}
+/**
+ * Build a normalized view of `s` plus `map`, where `map[k]` is the original
+ * offset of the k-th normalized char and `map[norm.length]` is a sentinel
+ * (`s.length`). This lets a match found in normalized space splice back into
+ * the original bytes exactly.
+ */
+function normalize(s, tier) {
+    const stripTrail = tier === "eol+trailws";
+    let norm = "";
+    const map = [];
+    // Whitespace whose trailing-vs-not status isn't known yet: flushed when real
+    // content follows on the line, dropped when a newline / EOF follows.
+    const pending = [];
+    const emit = (ch, off) => {
+        norm += ch;
+        map.push(off);
+    };
+    const flushPending = () => {
+        for (const p of pending)
+            emit(p.ch, p.off);
+        pending.length = 0;
+    };
+    let i = 0;
+    while (i < s.length) {
+        const c = s[i];
+        if (c === "\r" || c === "\n") {
+            pending.length = 0; // any pending whitespace was trailing → drop it
+            emit("\n", i);
+            i += c === "\r" && s[i + 1] === "\n" ? 2 : 1;
+            continue;
+        }
+        if (stripTrail && (c === " " || c === "\t")) {
+            pending.push({ ch: c, off: i });
+            i += 1;
+            continue;
+        }
+        flushPending();
+        emit(c, i);
+        i += 1;
+    }
+    // Trailing whitespace at end-of-string (in `pending`) is intentionally dropped.
+    map.push(s.length);
+    return { norm, map };
+}
+/** The file's line ending: CRLF if the first newline is `\r\n`, else LF. */
+export function detectEol(content) {
+    const i = content.indexOf("\n");
+    return i > 0 && content[i - 1] === "\r" ? "\r\n" : "\n";
+}
+/** Re-encode `text`'s line endings to `eol` so an edit matches the file. */
+export function applyEol(text, eol) {
+    const lf = text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    return eol === "\r\n" ? lf.replace(/\n/g, "\r\n") : lf;
+}
+/** Human phrase for the tier named in an ambiguity error. */
+export function tierLabel(tier) {
+    switch (tier) {
+        case "exact":
+            return "";
+        case "eol":
+            return " after end-of-line normalization";
+        case "eol+trailws":
+            return " after end-of-line + trailing-whitespace normalization";
+    }
+}

package/dist/web/ssrf.d.ts

@@ -17,34 +17,20 @@ import type { HostResolver } from "./types.js";
  *
  * The check runs BEFORE any request is dispatched, and again on every redirect hop
  * (see fetch.ts). A block is a security refusal, distinct from a network failure.
+ *
+ * The IP range math, the pin shim, and the error types now live in the shared
+ * {@link ../net/ip-guard ip-guard} module (JC-A) — the ONE owner of "is this IP
+ * allowed"; this file keeps only the web-specific policy (scheme + the
+ * `allowPrivateHosts` escape hatch) and the web one-shot dispatcher.
  */
-/** Default resolver: node's `dns.lookup` returning ALL addresses. */
-export declare const defaultResolveHost: HostResolver;
-/** Thrown when a URL is refused pre-dispatch; carries a human reason. */
-export declare class BlockedHostError extends Error {
-}
-/** Thrown when the host could not be resolved (a network failure, not a block). */
-export declare class HostUnresolvedError extends Error {
-}
-/** True if an address (v4 or v6) is in a range `web_fetch` must never reach. */
-export declare function isBlockedAddress(addr: string): boolean;
-/**
- * A `dns.lookup`-compatible function that ignores the hostname and always hands
- * back one of the pre-validated `addresses`. This is what pins a connection to the
- * address the SSRF check already approved, defeating DNS rebinding: the socket can
- * only reach a validated IP, never a value re-resolved at connect time.
- */
-export declare function pinnedLookup(addresses: string[]): (_hostname: string, options: unknown, callback: (err: NodeJS.ErrnoException | null, address: string | {
-    address: string;
-    family: number;
-}[], family?: number) => void) => void;
+export { BlockedHostError, HostUnresolvedError, isBlockedAddress, defaultResolveHost, pinnedLookup, } from "../net/ip-guard.js";
 /** An undici dispatcher whose connections are pinned to `addresses`. */
 export declare function createPinnedDispatcher(addresses: string[]): Dispatcher;
 /**
  * Assert that `url` may be fetched and return the validated addresses to pin the
  * connection to. Throws {@link BlockedHostError} for a bad scheme or a host
- * resolving into a blocked range, or {@link HostUnresolvedError} if the host cannot
- * be resolved.
+ * resolving into a blocked range, or `HostUnresolvedError` if the host cannot be
+ * resolved.
  *
  * The returned list is the exact set of addresses the caller must restrict the
  * connection to (via {@link createPinnedDispatcher}). An empty list means "do not

package/dist/web/ssrf.js

@@ -1,5 +1,5 @@
-import { lookup } from "node:dns";
 import { Agent } from "undici";
+import { assertAllPublic, BlockedHostError, pinnedLookup, } from "../net/ip-guard.js";
 /**
  * SSRF guard (C.20). A URL the MODEL chose must not be able to reach the user's
  * internal network, cloud metadata service, or loopback interface. Three layers:
@@ -17,170 +17,14 @@ import { Agent } from "undici";
  *
  * The check runs BEFORE any request is dispatched, and again on every redirect hop
  * (see fetch.ts). A block is a security refusal, distinct from a network failure.
+ *
+ * The IP range math, the pin shim, and the error types now live in the shared
+ * {@link ../net/ip-guard ip-guard} module (JC-A) — the ONE owner of "is this IP
+ * allowed"; this file keeps only the web-specific policy (scheme + the
+ * `allowPrivateHosts` escape hatch) and the web one-shot dispatcher.
  */
-/** Default resolver: node's `dns.lookup` returning ALL addresses. */
-export const defaultResolveHost = (host) => new Promise((resolve, reject) => {
-    lookup(host, { all: true }, (err, addresses) => {
-        if (err)
-            reject(err);
-        else
-            resolve(addresses.map((a) => a.address));
-    });
-});
-/** Thrown when a URL is refused pre-dispatch; carries a human reason. */
-export class BlockedHostError extends Error {
-}
-/** Thrown when the host could not be resolved (a network failure, not a block). */
-export class HostUnresolvedError extends Error {
-}
-/** Parse a dotted-quad IPv4 string into its four octets, or null. */
-function parseIpv4(ip) {
-    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip);
-    if (!m)
-        return null;
-    const octets = m.slice(1, 5).map((s) => Number(s));
-    if (octets.some((o) => o > 255))
-        return null;
-    return octets;
-}
-/** True if an IPv4 address falls in a private/loopback/link-local/reserved range. */
-function isBlockedIpv4(ip) {
-    const octets = parseIpv4(ip);
-    if (!octets)
-        return false;
-    const [a, b] = octets;
-    if (a === 0)
-        return true; // 0.0.0.0/8 "this network" / unspecified
-    if (a === 10)
-        return true; // 10.0.0.0/8 private
-    if (a === 127)
-        return true; // 127.0.0.0/8 loopback
-    if (a === 169 && b === 254)
-        return true; // 169.254.0.0/16 link-local (incl. 169.254.169.254 metadata)
-    if (a === 172 && b >= 16 && b <= 31)
-        return true; // 172.16.0.0/12 private
-    if (a === 192 && b === 168)
-        return true; // 192.168.0.0/16 private
-    if (a === 100 && b >= 64 && b <= 127)
-        return true; // 100.64.0.0/10 CGNAT
-    if (a === 198 && (b === 18 || b === 19))
-        return true; // 198.18.0.0/15 benchmarking
-    if (a === 255 && b === 255)
-        return true; // broadcast-ish
-    return false;
-}
-/**
- * Expand an IPv6 literal into its 8 sixteen-bit groups, or null if unparseable.
- * Handles `::` compression and an embedded IPv4 tail (`::ffff:127.0.0.1`).
- */
-function parseIpv6(input) {
-    let s = input;
-    const tail = [];
-    // Peel off a trailing dotted-quad (IPv4-mapped/-compatible forms).
-    const v4 = /(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(s);
-    if (v4) {
-        const o = parseIpv4(v4[1]);
-        if (!o)
-            return null;
-        tail.push((o[0] << 8) | o[1], (o[2] << 8) | o[3]);
-        s = s.slice(0, v4.index); // leaves a trailing ':' before the compression split
-    }
-    const halves = s.split("::");
-    if (halves.length > 2)
-        return null; // more than one "::" is illegal
-    const head = halves[0] ? halves[0].split(":").filter(Boolean) : [];
-    const rest = halves[1] ? halves[1].split(":").filter(Boolean) : [];
-    const toNums = (groups) => {
-        const out = [];
-        for (const g of groups) {
-            if (!/^[0-9a-f]{1,4}$/.test(g))
-                return null;
-            out.push(parseInt(g, 16));
-        }
-        return out;
-    };
-    const headNums = toNums(head);
-    const restNums = toNums(rest);
-    if (!headNums || !restNums)
-        return null;
-    let groups;
-    if (halves.length === 2) {
-        const fill = 8 - (headNums.length + restNums.length + tail.length);
-        if (fill < 0)
-            return null;
-        groups = [
-            ...headNums,
-            ...Array(fill).fill(0),
-            ...restNums,
-            ...tail,
-        ];
-    }
-    else {
-        groups = [...headNums, ...tail];
-    }
-    return groups.length === 8 ? groups : null;
-}
-/** True if an expanded IPv6 address is in a range `web_fetch` must never reach. */
-function isBlockedIpv6(g) {
-    // IPv4-mapped (::ffff:a.b.c.d) and IPv4-compatible (::a.b.c.d): check the v4 part.
-    const firstFiveZero = g.slice(0, 5).every((x) => x === 0);
-    const firstSixZero = firstFiveZero && g[5] === 0;
-    const embedded = `${g[6] >> 8}.${g[6] & 0xff}.${g[7] >> 8}.${g[7] & 0xff}`;
-    if (firstFiveZero && g[5] === 0xffff)
-        return isBlockedIpv4(embedded); // ::ffff:x
-    if (firstSixZero &&
-        !(g[6] === 0 && g[7] === 0) &&
-        !(g[6] === 0 && g[7] === 1))
-        return isBlockedIpv4(embedded); // ::x.y.z.w (IPv4-compatible, deprecated)
-    if (g.every((x) => x === 0))
-        return true; // :: unspecified
-    if (firstSixZero && g[6] === 0 && g[7] === 1)
-        return true; // ::1 loopback
-    if ((g[0] & 0xffc0) === 0xfe80)
-        return true; // fe80::/10 link-local (fe80–febf)
-    if ((g[0] & 0xfe00) === 0xfc00)
-        return true; // fc00::/7 unique-local (fc00–fdff)
-    if ((g[0] & 0xff00) === 0xff00)
-        return true; // ff00::/8 multicast
-    return false;
-}
-/** True if an address (v4 or v6) is in a range `web_fetch` must never reach. */
-export function isBlockedAddress(addr) {
-    // Strip IPv6 brackets and a scope/zone id (e.g. fe80::1%eth0).
-    const ip = addr
-        .trim()
-        .toLowerCase()
-        .replace(/^\[|\]$/g, "")
-        .split("%")[0];
-    if (ip.includes(":")) {
-        const groups = parseIpv6(ip);
-        if (!groups)
-            return true; // fail closed: an unparseable colon-address is refused
-        return isBlockedIpv6(groups);
-    }
-    return isBlockedIpv4(ip);
-}
-/**
- * A `dns.lookup`-compatible function that ignores the hostname and always hands
- * back one of the pre-validated `addresses`. This is what pins a connection to the
- * address the SSRF check already approved, defeating DNS rebinding: the socket can
- * only reach a validated IP, never a value re-resolved at connect time.
- */
-export function pinnedLookup(addresses) {
-    const resolved = addresses.map((address) => ({
-        address,
-        family: address.includes(":") ? 6 : 4,
-    }));
-    return (_hostname, options, callback) => {
-        const all = typeof options === "object" && options !== null && "all" in options
-            ? options.all
-            : false;
-        if (all)
-            callback(null, resolved);
-        else
-            callback(null, resolved[0].address, resolved[0].family);
-    };
-}
+// Re-export the shared surface so existing web importers/tests are unchanged.
+export { BlockedHostError, HostUnresolvedError, isBlockedAddress, defaultResolveHost, pinnedLookup, } from "../net/ip-guard.js";
 /** An undici dispatcher whose connections are pinned to `addresses`. */
 export function createPinnedDispatcher(addresses) {
     return new Agent({ connect: { lookup: pinnedLookup(addresses) } });
@@ -188,8 +32,8 @@ export function createPinnedDispatcher(addresses) {
 /**
  * Assert that `url` may be fetched and return the validated addresses to pin the
  * connection to. Throws {@link BlockedHostError} for a bad scheme or a host
- * resolving into a blocked range, or {@link HostUnresolvedError} if the host cannot
- * be resolved.
+ * resolving into a blocked range, or `HostUnresolvedError` if the host cannot be
+ * resolved.
  *
  * The returned list is the exact set of addresses the caller must restrict the
  * connection to (via {@link createPinnedDispatcher}). An empty list means "do not
@@ -203,21 +47,5 @@ export async function assertFetchable(url, resolveHost, allowPrivate) {
     }
     if (allowPrivate)
         return [];
-    const host = url.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
-    let addresses;
-    try {
-        addresses = await resolveHost(host);
-    }
-    catch (err) {
-        throw new HostUnresolvedError(`could not resolve host "${host}": ${err.message}`);
-    }
-    if (addresses.length === 0) {
-        throw new HostUnresolvedError(`host "${host}" resolved to no addresses`);
-    }
-    for (const addr of addresses) {
-        if (isBlockedAddress(addr)) {
-            throw new BlockedHostError(`host "${host}" resolves to ${addr}, a private/loopback/link-local address`);
-        }
-    }
-    return addresses;
+    return assertAllPublic(url.hostname, resolveHost);
 }

package/dist/web/types.d.ts

@@ -1,3 +1,4 @@
+import type { HostResolver } from "../net/ip-guard.js";
 import type { WebConfig } from "../config/index.js";
 /**
  * Web subtool seams + shapes (C.20). Everything the `web_search`/`web_fetch`
@@ -44,9 +45,10 @@ export interface SearchProvider {
 /**
  * Resolve a hostname to its IP addresses. Injected so the SSRF guard can be tested
  * deterministically (a hostname that "resolves" to an internal IP) without real
- * DNS. Defaults to node's `dns.lookup` with `all: true`.
+ * DNS. Owned by the shared {@link ../net/ip-guard ip-guard} module (JC-A) and
+ * re-exported here for web importers.
  */
-export type HostResolver = (host: string) => Promise<string[]>;
+export type { HostResolver } from "../net/ip-guard.js";
 /**
  * Injectable dependencies for the web tools. Defaults wire the real `fetch` and
  * DNS; tests pass spies/fakes. No global is ever patched.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cruxy/cli",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "an agentic coding CLI",
   "type": "module",
   "bin": {