@duckmind/dm-windows-x64 0.63.0 → 0.63.4

package/extensions/.dm-extensions.json

@@ -1,6 +1,6 @@
 {
   "status": "ok",
-  "prepared_at": "2026-08-31T12:13:45.528259+00:00",
+  "prepared_at": "2026-08-31T16:25:06.094476+00:00",
   "managed_entries": [
     {
       "id": "dm-context",
@@ -36,6 +36,11 @@
       "id": "dm-localllm-provider",
       "target_dir": "extensions/dm-localllm-provider",
       "bundle_mode": "source-package"
+    },
+    {
+      "id": "dm-web-access",
+      "target_dir": "extensions/dm-web-access",
+      "bundle_mode": "source-package-with-runtime-deps"
     }
   ],
   "local_entries": [
@@ -593,6 +598,121 @@
         "declaration_files_removed": 0
       }
     },
+    {
+      "id": "dm-web-access",
+      "staged_dir": "extensions/dm-web-access",
+      "bundle_mode": "source-package-with-runtime-deps",
+      "dependencies_installed": false,
+      "dependency_mode": "platform-package-dependency",
+      "dependencies_declared": [
+        "@duckmind/dm-ai",
+        "@duckmind/dm-coding-agent",
+        "@duckmind/dm-tui",
+        "@mozilla/readability",
+        "defuddle",
+        "linkedom",
+        "p-limit",
+        "promise.try",
+        "turndown",
+        "typebox",
+        "undici",
+        "unpdf"
+      ],
+      "dependency_patches": [
+        "dm.extensions ts->js",
+        "drop-dependencies",
+        "drop-devDependencies",
+        "drop-peerDependencies",
+        "drop-repository",
+        "drop-bugs",
+        "drop-homepage",
+        "drop-scripts",
+        "drop-files"
+      ],
+      "stripped_documentation": [
+        "CHANGELOG.md",
+        "LICENSE",
+        "README.md",
+        "banner.png"
+      ],
+      "javascript_compile": {
+        "tool": "bun build --no-bundle",
+        "mode": "module-preserving-transpile",
+        "files": [
+          "activity.js",
+          "anysearch.js",
+          "auth-fetch.js",
+          "bocha.js",
+          "brave.js",
+          "brightdata-unlocker.js",
+          "brightdata.js",
+          "chrome-cookies.js",
+          "content-find.js",
+          "credential-source.js",
+          "curator-page.js",
+          "curator-server.js",
+          "data-uri-sanitize.js",
+          "datalab-pdf-extract.js",
+          "declared-web-links.js",
+          "duckduckgo.js",
+          "exa.js",
+          "extract.js",
+          "feature-config.js",
+          "fetch-params.js",
+          "firecrawl.js",
+          "gemini-adc.js",
+          "gemini-api.js",
+          "gemini-pdf-extract.js",
+          "gemini-search.js",
+          "gemini-url-context.js",
+          "gemini-web-config.js",
+          "gemini-web.js",
+          "github-api.js",
+          "github-extract.js",
+          "github-issue-pr.js",
+          "index.js",
+          "jina-search.js",
+          "kagi.js",
+          "kimi-search.js",
+          "ollama.js",
+          "openai-search.js",
+          "page-query.js",
+          "parallel-mcp.js",
+          "parallel.js",
+          "pdf-extract.js",
+          "perplexity.js",
+          "querit.js",
+          "query-rewrite.js",
+          "render-search-error.js",
+          "rsc-extract.js",
+          "search1api.js",
+          "searchinfinity.js",
+          "searxng.js",
+          "serpbase.js",
+          "serpdive.js",
+          "serper.js",
+          "source-check.js",
+          "ssrf-protection.js",
+          "storage.js",
+          "summary-model-scope.js",
+          "summary-review.js",
+          "tavily.js",
+          "tinyfish.js",
+          "utils.js",
+          "valyu.js",
+          "video-extract.js",
+          "xai-search.js",
+          "xcrawl.js",
+          "youtube-extract.js"
+        ],
+        "file_count": 65,
+        "before_bytes": 1052831,
+        "after_bytes": 943319,
+        "runtime_specifier_rewrites": 54,
+        "runtime_filename_rewrites": 65,
+        "declaration_files_removed": 1
+      }
+    },
     {
       "id": "dm-cua",
       "staged_dir": "extensions/dm-cua",
@@ -674,17 +794,33 @@
     "jiti": "2.7.0",
     "typebox": "^1.1.34",
     "yaml": "2.8.3",
+    "@mozilla/readability": "^0.6.0",
+    "defuddle": "0.19.3",
+    "linkedom": "^0.16.0",
+    "p-limit": "^6.1.0",
+    "promise.try": "^2.0.1",
+    "turndown": "^7.2.0",
+    "undici": "^8.9.0",
+    "unpdf": "^1.6.2",
     "@sinclair/typebox": "^0.34.48"
   },
   "runtime_loader": {
     "status": "verified",
-    "entries": 10,
+    "entries": 11,
     "loader": "dm-coding-agent",
     "platform_dependencies": [
+      "@mozilla/readability",
       "@sinclair/typebox",
       "acorn",
+      "defuddle",
       "jiti",
+      "linkedom",
+      "p-limit",
+      "promise.try",
+      "turndown",
       "typebox",
+      "undici",
+      "unpdf",
       "yaml"
     ]
   }

package/extensions/dm-web-access/SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+Please report suspected vulnerabilities through GitHub private vulnerability reporting for this repository. Do not post exploit details, secrets, or proof-of-concept payloads in public issues or pull requests.
+
+If private vulnerability reporting is unavailable for your account or this repository, open a minimal public issue asking for a private contact path without including technical details.

package/extensions/dm-web-access/activity.js

@@ -0,0 +1,65 @@
+export class ActivityMonitor {
+  entries = [];
+  maxEntries = 10;
+  listeners = new Set;
+  rateLimitInfo = { used: 0, max: 10, oldestTimestamp: null, windowMs: 60000 };
+  nextId = 1;
+  logStart(partial) {
+    const id = `act-${this.nextId++}`;
+    const entry = {
+      ...partial,
+      id,
+      startTime: Date.now(),
+      status: null
+    };
+    this.entries.push(entry);
+    if (this.entries.length > this.maxEntries) {
+      this.entries.shift();
+    }
+    this.notify();
+    return id;
+  }
+  logComplete(id, status) {
+    const entry = this.entries.find((e) => e.id === id);
+    if (entry) {
+      entry.endTime = Date.now();
+      entry.status = status;
+      this.notify();
+    }
+  }
+  logError(id, error) {
+    const entry = this.entries.find((e) => e.id === id);
+    if (entry) {
+      entry.endTime = Date.now();
+      entry.error = error;
+      this.notify();
+    }
+  }
+  getEntries() {
+    return this.entries;
+  }
+  getRateLimitInfo() {
+    return this.rateLimitInfo;
+  }
+  updateRateLimit(info) {
+    this.rateLimitInfo = info;
+    this.notify();
+  }
+  onUpdate(callback) {
+    this.listeners.add(callback);
+    return () => this.listeners.delete(callback);
+  }
+  clear() {
+    this.entries = [];
+    this.rateLimitInfo = { used: 0, max: 10, oldestTimestamp: null, windowMs: 60000 };
+    this.notify();
+  }
+  notify() {
+    for (const cb of this.listeners) {
+      try {
+        cb();
+      } catch {}
+    }
+  }
+}
+export const activityMonitor = new ActivityMonitor;

package/extensions/dm-web-access/anysearch.js

@@ -0,0 +1,158 @@
+import { existsSync, readFileSync } from "node:fs";
+import { activityMonitor } from "./activity.js";
+import { redactCredential, resolveCredential } from "./credential-source.js";
+import { getWebSearchConfigPath } from "./utils.js";
+const ANYSEARCH_API_URL = "https://api.anysearch.com/v1/search";
+const CONFIG_PATH = getWebSearchConfigPath();
+const SEARCH_TIMEOUT_MS = 30000;
+let cachedConfig = null;
+function loadConfig() {
+  if (cachedConfig)
+    return cachedConfig;
+  if (!existsSync(CONFIG_PATH)) {
+    cachedConfig = {};
+    return cachedConfig;
+  }
+  const raw = readFileSync(CONFIG_PATH, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to parse ${CONFIG_PATH}: ${message}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Invalid config in ${CONFIG_PATH}: expected a JSON object`);
+  }
+  cachedConfig = parsed;
+  return cachedConfig;
+}
+async function getApiKey(signal) {
+  return resolveCredential({
+    provider: "AnySearch",
+    configuredValue: loadConfig().anysearchApiKey,
+    environmentValue: process.env.ANYSEARCH_API_KEY,
+    signal
+  });
+}
+function normalizeCount(value) {
+  if (typeof value !== "number" || !Number.isFinite(value))
+    return 5;
+  return Math.max(1, Math.min(Math.floor(value), 20));
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function invalidResponse(message) {
+  return new Error(`AnySearch API returned invalid response: ${message}`);
+}
+function parseResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw invalidResponse("expected an object envelope");
+  }
+  const envelope = value;
+  if (envelope.code !== 0)
+    throw invalidResponse("expected code 0");
+  if (!envelope.data || typeof envelope.data !== "object" || Array.isArray(envelope.data)) {
+    throw invalidResponse("expected data object");
+  }
+  const data = envelope.data;
+  if (!Array.isArray(data.results))
+    throw invalidResponse("expected data.results array");
+  if (!data.metadata || typeof data.metadata !== "object" || Array.isArray(data.metadata)) {
+    throw invalidResponse("expected data.metadata object");
+  }
+  const results = [];
+  for (const [index, value] of data.results.entries()) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw invalidResponse(`expected data.results[${index}] object`);
+    }
+    const result = value;
+    const { title, url, snippet, content } = result;
+    if (typeof title !== "string")
+      throw invalidResponse(`expected data.results[${index}].title string`);
+    if (typeof url !== "string")
+      throw invalidResponse(`expected data.results[${index}].url string`);
+    if (typeof snippet !== "string")
+      throw invalidResponse(`expected data.results[${index}].snippet string`);
+    if (content !== undefined && content !== null && typeof content !== "string") {
+      throw invalidResponse(`expected data.results[${index}].content string`);
+    }
+    if (!url)
+      throw invalidResponse(`expected data.results[${index}].url to be non-empty`);
+    results.push({ title, url, snippet, content: typeof content === "string" ? content : "" });
+  }
+  return { code: 0, data: { results, metadata: data.metadata } };
+}
+function buildAnswer(results) {
+  return results.map((result) => result.snippet ? `${result.snippet}
+Source: ${result.title} (${result.url})` : `Source: ${result.title} (${result.url})`).join(`
+
+`);
+}
+export function isAnySearchAvailable() {
+  return true;
+}
+export async function searchWithAnySearch(query, options = {}) {
+  const apiKey = await getApiKey(options.signal);
+  const numResults = normalizeCount(options.numResults);
+  const body = { query, max_results: numResults };
+  const activityId = activityMonitor.logStart({ type: "api", query });
+  let response;
+  try {
+    response = await fetch(ANYSEARCH_API_URL, {
+      method: "POST",
+      headers: {
+        ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {},
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body),
+      signal: options.signal ? AbortSignal.any([AbortSignal.timeout(SEARCH_TIMEOUT_MS), options.signal]) : AbortSignal.timeout(SEARCH_TIMEOUT_MS)
+    });
+  } catch (err) {
+    const message = errorMessage(err);
+    const redactedMessage = redactCredential(message, apiKey);
+    if (redactedMessage.toLowerCase().includes("abort"))
+      activityMonitor.logComplete(activityId, 0);
+    else
+      activityMonitor.logError(activityId, redactedMessage);
+    if (redactedMessage === message)
+      throw err;
+    const redactedError = new Error(redactedMessage);
+    if (err instanceof Error)
+      redactedError.name = err.name;
+    throw redactedError;
+  }
+  if (!response.ok) {
+    activityMonitor.logComplete(activityId, response.status);
+    const errorText = redactCredential(await response.text(), apiKey);
+    throw new Error(`AnySearch API error ${response.status}: ${errorText.slice(0, 300)}`);
+  }
+  let rawData;
+  try {
+    rawData = await response.json();
+  } catch (err) {
+    activityMonitor.logComplete(activityId, response.status);
+    throw new Error(`AnySearch API returned invalid JSON: ${errorMessage(err)}`);
+  }
+  let data;
+  try {
+    data = parseResponse(rawData);
+  } catch (err) {
+    activityMonitor.logComplete(activityId, response.status);
+    throw err;
+  }
+  activityMonitor.logComplete(activityId, response.status);
+  const results = data.data.results.slice(0, numResults).map((result) => ({
+    title: result.title,
+    url: result.url,
+    snippet: result.snippet
+  }));
+  const mapped = { answer: buildAnswer(results), results };
+  if (options.includeContent) {
+    const inlineContent = data.data.results.slice(0, numResults).filter((result) => result.content.length > 0).map((result) => ({ url: result.url, title: result.title, content: result.content, error: null }));
+    if (inlineContent.length > 0)
+      mapped.inlineContent = inlineContent;
+  }
+  return mapped;
+}

package/extensions/dm-web-access/auth-fetch.js

@@ -0,0 +1,131 @@
+import { existsSync, readFileSync } from "node:fs";
+import { getWebSearchConfigPath } from "./utils.js";
+const WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();
+const AUTH_PROFILE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+export function resolveAuthFetchProfile(request) {
+  const profiles = loadAuthFetchProfiles();
+  if (profiles.length === 0) {
+    throw new Error(`auth requires at least one authFetch profile in ${WEB_SEARCH_CONFIG_PATH}`);
+  }
+  if (request === true) {
+    if (profiles.length !== 1) {
+      throw new Error("auth: true requires exactly one authFetch profile; use a profile name instead");
+    }
+    return profiles[0];
+  }
+  const name = request.trim();
+  const profile = profiles.find((candidate) => candidate.name === name);
+  if (!profile)
+    throw new Error(`Unknown authFetch profile: ${name}`);
+  return profile;
+}
+export function assertAuthFetchUrl(profile, rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Authenticated fetch requires an HTTPS URL: ${message}`);
+  }
+  if (url.protocol !== "https:")
+    throw new Error("Authenticated fetch requires an HTTPS URL");
+  const hostname = normalizeHostname(url.hostname);
+  if (!profile.hosts.some((host) => hostMatches(hostname, host))) {
+    throw new Error(`URL host ${hostname} is not allowed by authFetch profile ${profile.name}`);
+  }
+  return url;
+}
+export function authFetchRedirectGuard(profile, from, to) {
+  if (profile.redirects === "same-origin" && to.origin !== from.origin) {
+    throw new Error(`Authenticated fetch refused cross-origin redirect: ${from.origin} -> ${to.origin}`);
+  }
+}
+function loadAuthFetchProfiles() {
+  if (!existsSync(WEB_SEARCH_CONFIG_PATH))
+    return [];
+  const raw = readFileSync(WEB_SEARCH_CONFIG_PATH, "utf-8");
+  let parsed;
+  try {
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("expected a JSON object");
+    parsed = value;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);
+  }
+  if (parsed.authFetch === undefined || parsed.authFetch === null)
+    return [];
+  if (typeof parsed.authFetch !== "object" || Array.isArray(parsed.authFetch)) {
+    throw new Error(`authFetch in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
+  }
+  return Object.entries(parsed.authFetch).map(([name, value]) => parseProfile(name, value));
+}
+function parseProfile(name, value) {
+  if (!AUTH_PROFILE_NAME_PATTERN.test(name)) {
+    throw new Error(`authFetch profile name ${JSON.stringify(name)} must start with a letter and contain only letters, numbers, underscores, or hyphens`);
+  }
+  if (Array.isArray(value)) {
+    return { name, hosts: parseHosts(value, `authFetch.${name}`), redirects: "same-origin", cache: "session" };
+  }
+  if (!value || typeof value !== "object") {
+    throw new Error(`authFetch.${name} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hosts or an object`);
+  }
+  const config = value;
+  if (!Array.isArray(config.hosts)) {
+    throw new Error(`authFetch.${name}.hosts in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+  }
+  const redirects = config.redirects ?? "same-origin";
+  if (redirects !== "same-origin") {
+    throw new Error(`authFetch.${name}.redirects in ${WEB_SEARCH_CONFIG_PATH} must be "same-origin"`);
+  }
+  const cache = config.cache ?? "session";
+  if (cache !== "session" && cache !== "off") {
+    throw new Error(`authFetch.${name}.cache in ${WEB_SEARCH_CONFIG_PATH} must be "session" or "off"`);
+  }
+  const chromeProfile = parseChromeProfile(config.chromeProfile, `authFetch.${name}.chromeProfile`);
+  return {
+    name,
+    hosts: parseHosts(config.hosts, `authFetch.${name}.hosts`),
+    ...chromeProfile ? { chromeProfile } : {},
+    redirects,
+    cache
+  };
+}
+function parseHosts(value, label) {
+  if (value.length === 0)
+    throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+  const hosts = value.map((entry) => {
+    if (typeof entry !== "string")
+      throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames`);
+    return parseHost(entry, label);
+  });
+  return [...new Set(hosts)];
+}
+function parseHost(value, label) {
+  const host = normalizeHostname(value.trim());
+  if (!host || host.startsWith(".") || host.endsWith(".") || /\s|[\\/?:#@*]/.test(host)) {
+    throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+  }
+  if (host.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(host)) {
+    throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+  }
+  return host;
+}
+function parseChromeProfile(value, label) {
+  if (value === undefined || value === null)
+    return;
+  if (typeof value !== "string")
+    throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a string`);
+  const normalized = value.trim();
+  if (!normalized || normalized === "." || normalized === ".." || normalized.includes("/") || normalized.includes("\\")) {
+    throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a profile directory name, not a path`);
+  }
+  return normalized;
+}
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function hostMatches(hostname, allowedHost) {
+  return hostname === allowedHost || hostname.endsWith(`.${allowedHost}`);
+}