@cryer/star-cli 0.3.12 → 0.3.14

package/dist/{chunk-Q5FJN4LN.js → chunk-54KH4JSO.js}

@@ -18,11 +18,12 @@ import {
   nextSnapshotId,
   probeImageDimensions,
   pushSnapshot,
+  realpathForCheck,
   sharedTodoStore,
   starHome,
   walkFiles,
   webFetchTool
-} from "./chunk-LSYGHLRU.js";
+} from "./chunk-2ISBRSBA.js";
 
 // src/tools/fs/edit.ts
 import { readFile, stat, writeFile } from "fs/promises";
@@ -41,6 +42,31 @@ function countOccurrences(haystack, needle) {
 function normalizeEol(text) {
   return text.replace(/\r\n/g, "\n");
 }
+function normalizedOffsets(text) {
+  const offsets = [0];
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === "\r" && text[i + 1] === "\n") i++;
+    offsets.push(i + 1);
+  }
+  return offsets;
+}
+function replacePreservingEol(raw, normalized, offsets, oldString, newString, replaceAll, useCrlf) {
+  const replacement = useCrlf ? newString.replace(/\n/g, "\r\n") : newString;
+  let normalizedFrom = 0;
+  let rawFrom = 0;
+  let updated = "";
+  while (true) {
+    const match = normalized.indexOf(oldString, normalizedFrom);
+    if (match < 0) break;
+    const rawStart = offsets[match] ?? raw.length;
+    const rawEnd = offsets[match + oldString.length] ?? raw.length;
+    updated += raw.slice(rawFrom, rawStart) + replacement;
+    rawFrom = rawEnd;
+    normalizedFrom = match + oldString.length;
+    if (!replaceAll) break;
+  }
+  return updated + raw.slice(rawFrom);
+}
 var schema = z.object({
   path: z.string().describe("File path, absolute or relative to the working directory"),
   old_string: z.string().min(1).describe("Exact text to replace"),
@@ -54,6 +80,10 @@ var editFileTool = {
   parameters: schema,
   async execute(args, ctx) {
     const filePath = path.resolve(ctx.cwd, args.path);
+    const resolvedPath = await realpathForCheck(filePath);
+    if (isSensitivePath(filePath) || resolvedPath !== null && isSensitivePath(resolvedPath)) {
+      return { content: `Refused to edit sensitive file: ${args.path}`, isError: true };
+    }
     let content;
     let readMtimeMs;
     try {
@@ -76,7 +106,8 @@ var editFileTool = {
     let working = content;
     let oldString = args.old_string;
     let newString = args.new_string;
-    let restoreEol = null;
+    let offsets = null;
+    let useCrlf = false;
     let count = countOccurrences(working, oldString);
     if (count === 0) {
       const normalizedContent = normalizeEol(content);
@@ -85,7 +116,8 @@ var editFileTool = {
       if (normalizedCount > 0) {
         const crlfCount = countOccurrences(content, "\r\n");
         const loneLfCount = countOccurrences(content.replace(/\r\n/g, ""), "\n");
-        restoreEol = crlfCount > 0 && crlfCount >= loneLfCount ? (text) => text.replace(/\n/g, "\r\n") : null;
+        useCrlf = crlfCount > 0 && crlfCount >= loneLfCount;
+        offsets = normalizedOffsets(content);
         working = normalizedContent;
         oldString = normalizedOld;
         newString = normalizeEol(newString);
@@ -101,10 +133,15 @@ var editFileTool = {
         isError: true
       };
     }
-    let updated = args.replace_all ? working.split(oldString).join(newString) : working.replace(oldString, () => newString);
-    if (restoreEol) {
-      updated = restoreEol(updated);
-    }
+    const updated = offsets ? replacePreservingEol(
+      content,
+      working,
+      offsets,
+      oldString,
+      newString,
+      args.replace_all === true,
+      useCrlf
+    ) : args.replace_all ? working.split(oldString).join(newString) : working.replace(oldString, () => newString);
     try {
       const now = await stat(filePath).catch(() => null);
       if (!now || now.mtimeMs !== readMtimeMs) {
@@ -175,13 +212,17 @@ var globTool = {
     const prefixSegments = literalDirPrefix(args.pattern);
     const walkRoot = prefixSegments.length > 0 ? path2.join(root, ...prefixSegments) : root;
     const prefix = prefixSegments.length > 0 ? `${prefixSegments.join("/")}/` : "";
-    const { files, aborted } = await walkFiles(walkRoot, void 0, {
+    let matched = [];
+    const { aborted } = await walkFiles(walkRoot, void 0, {
       ignore: createIgnorePredicate(ctx.cwd),
       signal: ctx.abortSignal,
       symlinkBoundary: ctx.cwd,
-      nestedIgnore: true
+      nestedIgnore: true,
+      collect: false,
+      onBatch: (files) => {
+        matched = matched.concat(files.filter((f) => matchesGlob(args.pattern, `${prefix}${f.rel}`))).sort((a, b) => b.mtimeMs - a.mtimeMs || (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0)).slice(0, MAX_RESULTS);
+      }
     });
-    const matched = files.filter((f) => matchesGlob(args.pattern, `${prefix}${f.rel}`)).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, MAX_RESULTS);
     if (matched.length === 0) {
       return {
         content: aborted ? `Search interrupted before any files matched pattern: ${args.pattern}` : `No files matched pattern: ${args.pattern}`
@@ -231,44 +272,13 @@ var grepTool = {
       return { content: `Invalid regular expression: ${err.message}`, isError: true };
     }
     const root = path3.resolve(ctx.cwd, args.path ?? ".");
-    let files;
     let interrupted = false;
-    try {
-      const st = await stat2(root);
-      if (st.isFile()) {
-        const resolved = await realpath(root).catch(() => null);
-        if (isSensitivePath(root) || resolved !== null && isSensitivePath(resolved)) {
-          return {
-            content: `Refused to grep sensitive file: ${args.path ?? "."}`,
-            isError: true
-          };
-        }
-        files = [{ abs: root, rel: path3.basename(root), mtimeMs: st.mtimeMs }];
-      } else {
-        const walked = await walkFiles(root, void 0, {
-          ignore: createIgnorePredicate(ctx.cwd),
-          withMtime: false,
-          signal: ctx.abortSignal,
-          symlinkBoundary: ctx.cwd,
-          nestedIgnore: true
-        });
-        interrupted = walked.aborted;
-        files = walked.files.filter(
-          (f) => !isSensitivePath(f.abs) && (f.resolved === void 0 || !isSensitivePath(f.resolved))
-        );
-      }
-    } catch {
-      return { content: `Path not found: ${args.path ?? "."}`, isError: true };
-    }
-    if (args.glob) {
-      const glob = args.glob;
-      files = files.filter((f) => matchesGlob(glob, f.rel));
-    }
+    const out = [];
+    let truncated = false;
+    let skippedLarge = 0;
     const scanFile = async (file) => {
       const st = await stat2(file.abs).catch(() => null);
-      if (!st) {
-        return null;
-      }
+      if (!st) return null;
       if (st.size > MAX_FILE_BYTES) {
         skippedLarge += 1;
         return null;
@@ -279,12 +289,10 @@ var grepTool = {
       } catch {
         return null;
       }
-      if (buf.includes(0)) {
-        return null;
-      }
+      if (buf.includes(0)) return null;
       const hits = [];
       const lines = buf.toString("utf8").split("\n");
-      for (let i = 0; i < lines.length; i++) {
+      for (let i = 0; i < lines.length && hits.length < MAX_MATCHES; i += 1) {
         const line = lines[i] ?? "";
         if (re.test(line)) {
           const shown = line.length > MAX_LINE_CHARS ? `${line.slice(0, MAX_LINE_CHARS)}\u2026` : line;
@@ -293,29 +301,55 @@ var grepTool = {
       }
       return hits;
     };
-    const out = [];
-    let truncated = false;
-    let skippedLarge = 0;
-    outer: for (let i = 0; i < files.length; i += WALK_CONCURRENCY) {
-      if (ctx.abortSignal?.aborted) {
-        interrupted = true;
-        break;
-      }
-      const chunk = await Promise.all(
-        files.slice(i, i + WALK_CONCURRENCY).map((file) => scanFile(file))
+    const scanBatch = async (batch) => {
+      const files = batch.filter(
+        (f) => !isSensitivePath(f.abs) && (f.resolved === void 0 || !isSensitivePath(f.resolved)) && (!args.glob || matchesGlob(args.glob, f.rel))
       );
-      for (const hits of chunk) {
-        if (!hits) {
-          continue;
+      outer: for (let i = 0; i < files.length; i += WALK_CONCURRENCY) {
+        if (ctx.abortSignal?.aborted) {
+          interrupted = true;
+          return false;
         }
-        for (const hit of hits) {
-          out.push(hit);
-          if (out.length >= MAX_MATCHES) {
-            truncated = true;
-            break outer;
+        const chunk = await Promise.all(
+          files.slice(i, i + WALK_CONCURRENCY).map((file) => scanFile(file))
+        );
+        for (const hits of chunk) {
+          for (const hit of hits ?? []) {
+            out.push(hit);
+            if (out.length >= MAX_MATCHES) {
+              truncated = true;
+              break outer;
+            }
           }
         }
       }
+      return !truncated && !ctx.abortSignal?.aborted;
+    };
+    try {
+      const st = await stat2(root);
+      if (st.isFile()) {
+        const resolved = await realpath(root).catch(() => null);
+        if (isSensitivePath(root) || resolved !== null && isSensitivePath(resolved)) {
+          return {
+            content: `Refused to grep sensitive file: ${args.path ?? "."}`,
+            isError: true
+          };
+        }
+        await scanBatch([{ abs: root, rel: path3.basename(root), mtimeMs: st.mtimeMs }]);
+      } else {
+        const walked = await walkFiles(root, void 0, {
+          ignore: createIgnorePredicate(ctx.cwd),
+          withMtime: false,
+          signal: ctx.abortSignal,
+          symlinkBoundary: ctx.cwd,
+          nestedIgnore: true,
+          collect: false,
+          onBatch: scanBatch
+        });
+        interrupted = walked.aborted;
+      }
+    } catch {
+      return { content: `Path not found: ${args.path ?? "."}`, isError: true };
     }
     const skippedNote = skippedLarge > 0 ? `(skipped ${skippedLarge} file(s) larger than 5MB)` : null;
     if (out.length === 0) {
@@ -578,38 +612,82 @@ var codeOutlineTool = {
 // src/tools/fs/read.ts
 import { open, realpath as realpath3, stat as stat4 } from "fs/promises";
 import path5 from "path";
+import { StringDecoder } from "string_decoder";
 import { z as z5 } from "zod";
 var DEFAULT_LIMIT = 2e3;
 var MAX_CHARS = 100 * 1024;
-var MAX_READ_BYTES = 1024 * 1024;
 var BINARY_PROBE_BYTES2 = 8192;
-function decodeUtf16be(buf) {
-  const len = buf.length - buf.length % 2;
-  const swapped = Buffer.allocUnsafe(len);
-  for (let k = 0; k < len; k += 2) {
-    swapped[k] = buf[k + 1] ?? 0;
-    swapped[k + 1] = buf[k] ?? 0;
-  }
-  return swapped.toString("utf16le");
-}
-function decodeTextBuffer(buf) {
-  if (buf.length >= 2 && buf[0] === 255 && buf[1] === 254) {
-    return { text: buf.subarray(2).toString("utf16le") };
-  }
-  if (buf.length >= 2 && buf[0] === 254 && buf[1] === 255) {
-    return { text: decodeUtf16be(buf.subarray(2)) };
-  }
-  if (buf.subarray(0, BINARY_PROBE_BYTES2).includes(0)) {
-    return { binary: true };
-  }
-  return { text: buf.toString("utf8") };
-}
+var READ_CHUNK_BYTES = 64 * 1024;
 var schema5 = z5.object({
   path: z5.string().describe("File path, absolute or relative to the working directory"),
   offset: z5.number().int().positive().optional().describe("1-based line number to start reading from"),
   limit: z5.number().int().positive().optional().describe("Maximum number of lines to read (default 2000)")
 });
 var READ_CACHE_MAX_ENTRIES = 200;
+async function readWindow(handle, size, start, limit) {
+  const probe = Buffer.alloc(Math.min(size, BINARY_PROBE_BYTES2));
+  const { bytesRead: probeBytes } = await handle.read(probe, 0, probe.length, 0);
+  const head = probe.subarray(0, probeBytes);
+  const utf16le = head[0] === 255 && head[1] === 254;
+  const utf16be = head[0] === 254 && head[1] === 255;
+  if (!utf16le && !utf16be && head.includes(0)) return { binary: true };
+  const decoder = new StringDecoder(utf16le || utf16be ? "utf16le" : "utf8");
+  const requestedEnd = start - 1 + limit;
+  const result = {
+    totalLines: 1,
+    out: [],
+    lastShown: start - 1,
+    truncatedBySize: false
+  };
+  let lineNumber = 1;
+  let outputSize = 0;
+  let pending = "";
+  let beRemainder;
+  const showLine = (raw) => {
+    if (lineNumber >= start && lineNumber <= requestedEnd && !result.truncatedBySize) {
+      const numbered = `${lineNumber}	${raw.replace(/\r$/, "")}`;
+      if (outputSize + numbered.length > MAX_CHARS) {
+        result.truncatedBySize = true;
+      } else {
+        result.out.push(numbered);
+        outputSize += numbered.length;
+        result.lastShown = lineNumber;
+      }
+    }
+  };
+  const accept = (text) => {
+    const parts = `${pending}${text}`.split("\n");
+    for (let i = 0; i < parts.length - 1; i += 1) {
+      showLine(parts[i] ?? "");
+      lineNumber += 1;
+    }
+    pending = parts[parts.length - 1] ?? "";
+  };
+  let position = utf16le || utf16be ? 2 : 0;
+  while (position < size) {
+    const length = Math.min(READ_CHUNK_BYTES, size - position);
+    const { bytesRead, buffer } = await handle.read(Buffer.alloc(length), 0, length, position);
+    if (bytesRead === 0) break;
+    position += bytesRead;
+    let chunk = buffer.subarray(0, bytesRead);
+    if (utf16be) {
+      const combined = beRemainder === void 0 ? chunk : Buffer.concat([Buffer.from([beRemainder]), chunk]);
+      const pairedLength = combined.length - combined.length % 2;
+      const swapped = Buffer.allocUnsafe(pairedLength);
+      for (let i = 0; i < pairedLength; i += 2) {
+        swapped[i] = combined[i + 1] ?? 0;
+        swapped[i + 1] = combined[i] ?? 0;
+      }
+      beRemainder = pairedLength < combined.length ? combined[combined.length - 1] : void 0;
+      chunk = swapped;
+    }
+    accept(decoder.write(chunk));
+  }
+  accept(decoder.end());
+  showLine(pending);
+  result.totalLines = lineNumber;
+  return result;
+}
 function createReadFileTool() {
   const cache = /* @__PURE__ */ new Map();
   return {
@@ -643,55 +721,33 @@ function createReadFileTool() {
           };
         }
       }
-      const bytesToRead = Math.min(st.size, MAX_READ_BYTES);
-      const fileCapped = st.size > MAX_READ_BYTES;
       const handle = await open(filePath, "r").catch(() => null);
       if (!handle) {
         return { content: `Failed to read ${args.path}`, isError: true };
       }
-      let buf;
+      let decoded;
       try {
-        const { bytesRead, buffer } = await handle.read(
-          Buffer.alloc(bytesToRead),
-          0,
-          bytesToRead,
-          0
-        );
-        buf = buffer.subarray(0, bytesRead);
+        decoded = await readWindow(handle, st.size, start, limit);
+      } catch {
+        return { content: `Failed to read ${args.path}`, isError: true };
       } finally {
         await handle.close().catch(() => {
         });
       }
-      const decoded = decodeTextBuffer(buf);
       if ("binary" in decoded) {
         return { content: `Cannot read binary file: ${args.path}`, isError: true };
       }
-      const lines = decoded.text.split("\n");
-      const totalDesc = fileCapped ? `at least ${lines.length}` : `${lines.length}`;
-      if (start > lines.length) {
-        return { content: `(offset ${start} beyond end of file; file has ${totalDesc} lines)` };
-      }
-      const end = Math.min(lines.length, start - 1 + limit);
-      const out = [];
-      let size = 0;
-      let truncatedBySize = false;
-      for (let i = start - 1; i < end; i++) {
-        const line = (lines[i] ?? "").replace(/\r$/, "");
-        const numbered = `${i + 1}	${line}`;
-        if (size + numbered.length > MAX_CHARS) {
-          truncatedBySize = true;
-          break;
-        }
-        out.push(numbered);
-        size += numbered.length;
+      const { totalLines, out, lastShown, truncatedBySize } = decoded;
+      if (start > totalLines) {
+        return { content: `(offset ${start} beyond end of file; file has ${totalLines} lines)` };
       }
-      const lastShown = start - 1 + out.length;
+      const end = Math.min(totalLines, start - 1 + limit);
       if (truncatedBySize) {
         out.push(
-          `... (truncated: output exceeds 100KB, showing lines ${start}-${lastShown} of ${totalDesc})`
+          `... (truncated: output exceeds 100KB, showing lines ${start}-${lastShown} of ${totalLines})`
         );
-      } else if (end < lines.length || fileCapped) {
-        out.push(`... (truncated: showing lines ${start}-${end} of ${totalDesc})`);
+      } else if (end < totalLines) {
+        out.push(`... (truncated: showing lines ${start}-${end} of ${totalLines})`);
       }
       if (out.length > 0) {
         if (cache.size >= READ_CACHE_MAX_ENTRIES) cache.clear();
@@ -699,7 +755,7 @@ function createReadFileTool() {
         cache.set(cacheKey, {
           mtimeMs: st.mtimeMs,
           size: st.size,
-          totalLines: lines.length,
+          totalLines,
           // Extend the remembered range when the new read overlaps or abuts
           // the previous one; disjoint ranges replace it.
           start: prev && start <= prev.end + 1 ? Math.min(prev.start, start) : start,
@@ -811,6 +867,10 @@ var writeFileTool = {
   parameters: schema7,
   async execute(args, ctx) {
     const filePath = path7.resolve(ctx.cwd, args.path);
+    const resolvedPath = await realpathForCheck(filePath);
+    if (isSensitivePath(filePath) || resolvedPath !== null && isSensitivePath(resolvedPath)) {
+      return { content: `Refused to write sensitive file: ${args.path}`, isError: true };
+    }
     if (args.content.includes("\0")) {
       return {
         content: `Refused to write ${args.path}: content contains NUL bytes (write_file is text-only)`,
@@ -825,6 +885,13 @@ var writeFileTool = {
       };
     }
     const snapshot = await captureSnapshot(filePath, "write_file", ctx.snapshotContext);
+    if (snapshot.existed && snapshot.content === null) {
+      const reason = snapshot.contentTooLarge ? "existing content is over the 5MB snapshot limit" : "existing content could not be read";
+      return {
+        content: `Refused to overwrite ${args.path}: ${reason}, and no restorable snapshot is available`,
+        isError: true
+      };
+    }
     try {
       await mkdir(path7.dirname(filePath), { recursive: true });
       await writeFile2(filePath, args.content, "utf8");
@@ -1146,6 +1213,7 @@ function debugStreamLog(event, data) {
 
 // src/tools/web/search.ts
 var TIMEOUT_MS = 15e3;
+var MAX_BODY_BYTES = 2 * 1024 * 1024;
 var DEFAULT_MAX_RESULTS = 5;
 var MAX_RESULTS_LIMIT = 10;
 var USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
@@ -1268,6 +1336,26 @@ var SEARCH_SOURCES = [
     parse: parseBingResults
   }
 ];
+async function readLimitedBody(res) {
+  if (!res.body) return "";
+  const reader = res.body.getReader();
+  const decoder = new TextDecoder();
+  let bytes = 0;
+  let text = "";
+  try {
+    while (bytes < MAX_BODY_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+  return text;
+}
 var webSearchTool = {
   name: "web_search",
   description: "Search the web and return a numbered list of results with title, URL and snippet. Uses DuckDuckGo with automatic fallback to DuckDuckGo Lite and Bing when a source fails or returns nothing. No API key required. Use web_fetch to read a result's full page.",
@@ -1307,7 +1395,7 @@ var webSearchTool = {
       }
       let html;
       try {
-        html = await res.text();
+        html = await readLimitedBody(res);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         failures.push(`${source.name}: failed to read search response: ${message}`);
@@ -1415,4 +1503,4 @@ export {
   ToolRegistry,
   createDefaultRegistry
 };
-//# sourceMappingURL=chunk-Q5FJN4LN.js.map
+//# sourceMappingURL=chunk-54KH4JSO.js.map