@gajae-code/coding-agent 0.7.1 → 0.7.3

package/dist/types/web/search/types.d.ts

@@ -4,7 +4,7 @@
  * Unified types for web search responses across supported providers.
  */
 /** Supported web search providers */
-export type SearchProviderId = "duckduckgo" | "exa" | "brave" | "jina" | "kimi" | "zai" | "anthropic" | "perplexity" | "gemini" | "codex" | "xai" | "tavily" | "parallel" | "kagi" | "synthetic" | "searxng" | "openai-compatible";
+export type SearchProviderId = "duckduckgo" | "insane" | "exa" | "brave" | "jina" | "kimi" | "zai" | "anthropic" | "perplexity" | "gemini" | "codex" | "xai" | "tavily" | "parallel" | "kagi" | "synthetic" | "searxng" | "openai-compatible";
 export type WebSearchMode = "on" | "off" | "auto";
 export interface ActiveSearchModelContext {
     provider: string;
@@ -15,7 +15,7 @@ export interface ActiveSearchModelContext {
     headers?: Record<string, string>;
     webSearch?: WebSearchMode;
 }
-export declare const CONFIGURABLE_SEARCH_PROVIDER_IDS: readonly ["duckduckgo", "exa", "brave", "jina", "kimi", "zai", "anthropic", "perplexity", "gemini", "codex", "xai", "tavily", "parallel", "kagi", "synthetic", "searxng"];
+export declare const CONFIGURABLE_SEARCH_PROVIDER_IDS: readonly ["duckduckgo", "insane", "exa", "brave", "jina", "kimi", "zai", "anthropic", "perplexity", "gemini", "codex", "xai", "tavily", "parallel", "kagi", "synthetic", "searxng"];
 export declare function isSearchProviderId(value: string): value is SearchProviderId;
 export declare function isConfigurableSearchProviderId(value: string): value is (typeof CONFIGURABLE_SEARCH_PROVIDER_IDS)[number];
 export declare function isSearchProviderPreference(value: string): value is (typeof CONFIGURABLE_SEARCH_PROVIDER_IDS)[number] | "auto";
@@ -96,6 +96,14 @@ export interface AnthropicCitation {
     cited_text: string;
     encrypted_index: string;
 }
+/**
+ * Error payload returned in `web_search_tool_result.content` when a server-side
+ * web search fails. Unlike the success case, this is an object, not an array.
+ */
+export interface AnthropicWebSearchToolResultError {
+    type: "web_search_tool_result_error";
+    error_code?: string;
+}
 export interface AnthropicContentBlock {
     type: string;
     /** Text content (for type="text") */
@@ -108,8 +116,8 @@ export interface AnthropicContentBlock {
     input?: {
         query: string;
     };
-    /** Search results (for type="web_search_tool_result") */
-    content?: AnthropicSearchResult[];
+    /** Search results array on success, or an error object on failure (type="web_search_tool_result") */
+    content?: AnthropicSearchResult[] | AnthropicWebSearchToolResultError;
 }
 export interface AnthropicApiResponse {
     id: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.7.1",
+	"version": "0.7.3",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gaebal-gajae.dev",
 	"author": "Yeachan-Heo",
@@ -45,18 +45,19 @@
 		"generate-docs-index": "bun scripts/generate-docs-index.ts",
 		"prepack": "bun scripts/generate-docs-index.ts",
 		"generate-template": "bun scripts/generate-template.ts",
-		"install:defaults": "bun src/cli.ts setup defaults"
+		"install:defaults": "bun src/cli.ts setup defaults",
+		"verify:insane-vendor": "bun scripts/verify-insane-vendor.ts"
 	},
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.21.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.7.1",
-		"@gajae-code/agent-core": "0.7.1",
-		"@gajae-code/ai": "0.7.1",
-		"@gajae-code/natives": "0.7.1",
-		"@gajae-code/tui": "0.7.1",
-		"@gajae-code/utils": "0.7.1",
+		"@gajae-code/stats": "0.7.3",
+		"@gajae-code/agent-core": "0.7.3",
+		"@gajae-code/ai": "0.7.3",
+		"@gajae-code/natives": "0.7.3",
+		"@gajae-code/tui": "0.7.3",
+		"@gajae-code/utils": "0.7.3",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",
@@ -84,6 +85,7 @@
 		"examples",
 		"README.md",
 		"CHANGELOG.md",
+		"vendor",
 		"dist/types"
 	],
 	"exports": {

package/scripts/verify-insane-vendor.ts

@@ -0,0 +1,132 @@
+#!/usr/bin/env bun
+/**
+ * Vendor verification for packages/coding-agent/vendor/insane-search.
+ *
+ * Asserts:
+ *   1. Forbidden upstream paths/patterns are absent (install hooks, star-baiting,
+ *      update-notifier, transcript-language scanner, .claude-plugin).
+ *   2. MANIFEST.json exists and pins a full 40-char upstream commit SHA.
+ *   3. The vendored runtime files are present.
+ *   4. `npm pack --dry-run --json` includes the vendor tree (engine entrypoint,
+ *      templates, LICENSE, manifest) in the published package.
+ *
+ * Exit code 0 on success, 1 on any failure.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const pkgDir = join(dirname(fileURLToPath(import.meta.url)), "..");
+const vendorDir = join(pkgDir, "vendor", "insane-search");
+const failures: string[] = [];
+
+function fail(msg: string): void {
+	failures.push(msg);
+}
+
+function walk(dir: string): string[] {
+	const out: string[] = [];
+	for (const entry of readdirSync(dir)) {
+		const full = join(dir, entry);
+		if (statSync(full).isDirectory()) out.push(...walk(full));
+		else out.push(full);
+	}
+	return out;
+}
+
+// 1. Forbidden paths / patterns
+if (!existsSync(vendorDir)) {
+	fail(`vendor tree missing at ${vendorDir}`);
+} else {
+	const files = walk(vendorDir).map(f => relative(vendorDir, f));
+	const forbiddenNames = ["setup.sh", "gptaku-update-check.cjs"];
+	const forbiddenSubpaths = [".claude-plugin/", "/references/", "/tests/coverage_battery"];
+	for (const f of files) {
+		const base = f.split("/").pop() ?? f;
+		if (forbiddenNames.includes(base)) fail(`forbidden file present: ${f}`);
+		for (const sub of forbiddenSubpaths) {
+			if (`/${f}`.includes(sub)) fail(`forbidden path present: ${f}`);
+		}
+	}
+	// Scan for star-baiting / settings.json mutation / transcript scanning patterns.
+	const forbiddenPatterns: Array<[RegExp, string]> = [
+		[/user\/starred/, "github star-baiting (user/starred)"],
+		[/gh\s+api\s+-X\s+PUT/, "gh api star write"],
+		[/SessionStart/, "settings.json SessionStart hook injection"],
+		[/\.claude\/projects/, "past-session transcript scanner"],
+	];
+	for (const f of files) {
+		if (f === "MANIFEST.json") continue; // manifest documents the excluded patterns by name
+		let body = "";
+		try {
+			body = readFileSync(join(vendorDir, f), "utf8");
+		} catch {
+			continue;
+		}
+		for (const [re, label] of forbiddenPatterns) {
+			if (re.test(body)) fail(`forbidden pattern (${label}) found in ${f}`);
+		}
+	}
+}
+
+// 2. Manifest with pinned SHA
+const manifestPath = join(vendorDir, "MANIFEST.json");
+let commit = "";
+if (!existsSync(manifestPath)) {
+	fail("MANIFEST.json missing");
+} else {
+	try {
+		const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+			upstream?: { commit?: string };
+		};
+		commit = manifest.upstream?.commit ?? "";
+		if (!/^[0-9a-f]{40}$/.test(commit)) fail(`MANIFEST upstream.commit is not a full 40-char SHA: "${commit}"`);
+	} catch (err) {
+		fail(`MANIFEST.json is not valid JSON: ${(err as Error).message}`);
+	}
+}
+
+// 3. Required runtime files present
+const requiredFiles = [
+	"engine/__main__.py",
+	"engine/__init__.py",
+	"engine/fetch_chain.py",
+	"engine/templates/package.json",
+	"engine/templates/playwright_real_chrome.js",
+	"engine/waf_profiles.yaml",
+	"LICENSE",
+	"MANIFEST.json",
+];
+for (const rel of requiredFiles) {
+	if (!existsSync(join(vendorDir, rel))) fail(`required vendored file missing: ${rel}`);
+}
+
+// 4. Package pack inclusion
+try {
+	const raw = execFileSync("npm", ["pack", "--dry-run", "--json"], {
+		cwd: pkgDir,
+		encoding: "utf8",
+		stdio: ["ignore", "pipe", "ignore"],
+	});
+	const parsed = JSON.parse(raw) as Array<{ files?: Array<{ path: string }> }>;
+	const packed = new Set((parsed[0]?.files ?? []).map(f => f.path.replace(/\\/g, "/")));
+	const mustPack = [
+		"vendor/insane-search/engine/__main__.py",
+		"vendor/insane-search/engine/templates/playwright_real_chrome.js",
+		"vendor/insane-search/LICENSE",
+		"vendor/insane-search/MANIFEST.json",
+	];
+	for (const rel of mustPack) {
+		if (!packed.has(rel)) fail(`package pack does not include ${rel}`);
+	}
+} catch (err) {
+	fail(`npm pack --dry-run failed: ${(err as Error).message}`);
+}
+
+if (failures.length > 0) {
+	console.error("insane-vendor verification FAILED:");
+	for (const f of failures) console.error(`  - ${f}`);
+	process.exit(1);
+}
+console.log(`insane-vendor verification passed (pinned ${commit}).`);

package/src/cli/args.ts

@@ -265,7 +265,7 @@ export function getExtraHelpText(): string {
   GJC_SLOW_MODEL              - Override slow/reasoning model (see --slow)
   GJC_PLAN_MODEL              - Override planning model (see --plan)
   GJC_NO_PTY                  - Disable PTY-based interactive bash execution
-  --tmux                       - Launch interactive startup inside a new tmux session
+  --tmux                       - Launch interactive startup inside a fresh tmux session
   gjc session                  - List, inspect, create, remove, or attach tagged GJC-managed tmux sessions
   GJC_LAUNCH_POLICY           - Launch policy for --tmux startup: tmux or direct
   GJC_TMUX_SESSION            - Explicit tmux session name override for --tmux startup

package/src/cli/fast-help.ts

@@ -50,7 +50,7 @@ export function getExtraHelpText(): string {
   GJC_SLOW_MODEL              - Override slow/reasoning model (see --slow)
   GJC_PLAN_MODEL              - Override planning model (see --plan)
   GJC_NO_PTY                  - Disable PTY-based interactive bash execution
-  --tmux                       - Launch interactive startup inside a new tmux session
+  --tmux                       - Launch interactive startup inside a fresh tmux session
   gjc session                  - List, inspect, create, remove, or attach tagged GJC-managed tmux sessions
   GJC_LAUNCH_POLICY           - Launch policy for --tmux startup: tmux or direct
   GJC_TMUX_SESSION            - Explicit tmux session name override for --tmux startup

package/src/cli/mcp-cli.ts

@@ -0,0 +1,272 @@
+/**
+ * Direct MCP server registration CLI helpers.
+ *
+ * This surface only writes explicit user-provided server definitions to GJC's
+ * own MCP config. It never imports or inherits live configs from other agents.
+ */
+import { getMCPConfigPath, getProjectDir } from "@gajae-code/utils";
+import { getMCPServer, readMCPConfigFile, removeMCPServer, upsertMCPServer } from "../runtime-mcp/config-writer";
+import type { MCPConfigFile, MCPServerConfig } from "../runtime-mcp/types";
+
+export type MCPAction = "add" | "list" | "remove";
+
+export interface MCPCommandArgs {
+	action: MCPAction;
+	name?: string;
+	commandArgs?: string[];
+	flags: {
+		project?: boolean;
+		force?: boolean;
+		json?: boolean;
+		type?: "stdio" | "http" | "sse";
+		command?: string;
+		url?: string;
+		arg?: string[];
+		env?: string[];
+		header?: string[];
+		cwd?: string;
+		timeout?: number;
+	};
+	cwd?: string;
+}
+
+export class MCPArgsError extends Error {}
+
+interface ScopedPath {
+	scope: "user" | "project";
+	path: string;
+}
+
+interface RedactedServerEntry {
+	name: string;
+	config: MCPServerConfig;
+}
+
+const REDACTED = "<redacted>";
+const SENSITIVE_KEY_PATTERN =
+	/(?:token|secret|key|credential|password|passwd|pwd|authorization|auth|bearer|cookie|session)/i;
+
+function resolvePath(args: MCPCommandArgs): ScopedPath {
+	const scope = args.flags.project ? "project" : "user";
+	return { scope, path: getMCPConfigPath(scope, args.cwd ?? getProjectDir()) };
+}
+
+function parsePairs(values: string[] | undefined, label: string): Record<string, string> | undefined {
+	if (!values || values.length === 0) return undefined;
+	const parsed: Record<string, string> = {};
+	for (const value of values) {
+		const index = value.indexOf("=");
+		if (index <= 0) {
+			throw new MCPArgsError(`Invalid ${label}. Use KEY=VALUE.`);
+		}
+		const key = value.slice(0, index).trim();
+		if (!key) {
+			throw new MCPArgsError(`Invalid ${label}. Key cannot be empty.`);
+		}
+		parsed[key] = value.slice(index + 1);
+	}
+	return parsed;
+}
+
+function buildServerConfig(args: MCPCommandArgs): MCPServerConfig {
+	const type = args.flags.type ?? (args.flags.url ? "http" : "stdio");
+	const timeout = args.flags.timeout;
+	const shared = timeout === undefined ? {} : { timeout };
+
+	if (type === "stdio") {
+		const command = args.flags.command ?? args.commandArgs?.[0];
+		if (!command) {
+			throw new MCPArgsError("`gjc mcp add` requires --command <cmd> or a positional command for stdio servers.");
+		}
+		const config: MCPServerConfig = {
+			...shared,
+			type: "stdio",
+			command,
+		};
+		const positionalArgs = args.flags.command ? [] : (args.commandArgs ?? []).slice(1);
+		const serverArgs = [...positionalArgs, ...(args.flags.arg ?? [])];
+		if (serverArgs.length > 0) config.args = serverArgs;
+		const env = parsePairs(args.flags.env, "env");
+		if (env) config.env = env;
+		if (args.flags.cwd) config.cwd = args.flags.cwd;
+		return config;
+	}
+
+	const url = args.flags.url ?? args.commandArgs?.[0];
+	if (!url) {
+		throw new MCPArgsError(`\`gjc mcp add --type ${type}\` requires --url <url> or a positional URL.`);
+	}
+	const headers = parsePairs(args.flags.header, "header");
+	if (type === "http") {
+		const config: MCPServerConfig = {
+			...shared,
+			type,
+			url,
+		};
+		if (headers) config.headers = headers;
+		return config;
+	}
+	const config: MCPServerConfig = {
+		...shared,
+		type,
+		url,
+	};
+	if (headers) config.headers = headers;
+	return config;
+}
+
+function redactRecord(
+	record: Record<string, string> | undefined,
+	redactAllValues: boolean,
+): Record<string, string> | undefined {
+	if (!record) return undefined;
+	return Object.fromEntries(
+		Object.entries(record).map(([key, value]) => [
+			key,
+			redactAllValues || SENSITIVE_KEY_PATTERN.test(key) ? REDACTED : value,
+		]),
+	);
+}
+
+export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig {
+	const redacted = { ...config } as MCPServerConfig;
+	if ("env" in redacted) {
+		const env = redactRecord(redacted.env, true);
+		if (env) redacted.env = env;
+	}
+	if ("headers" in redacted) {
+		const headers = redactRecord(redacted.headers, true);
+		if (headers) redacted.headers = headers;
+	}
+	if (redacted.auth) {
+		redacted.auth = {
+			type: redacted.auth.type,
+			credentialId: redacted.auth.credentialId ? REDACTED : undefined,
+			tokenUrl: redacted.auth.tokenUrl,
+			clientId: redacted.auth.clientId ? REDACTED : undefined,
+			clientSecret: redacted.auth.clientSecret ? REDACTED : undefined,
+		};
+	}
+	if (redacted.oauth) {
+		redacted.oauth = {
+			clientId: redacted.oauth.clientId ? REDACTED : undefined,
+			clientSecret: redacted.oauth.clientSecret ? REDACTED : undefined,
+			redirectUri: redacted.oauth.redirectUri,
+			callbackPort: redacted.oauth.callbackPort,
+			callbackPath: redacted.oauth.callbackPath,
+		};
+	}
+	return redacted;
+}
+
+function collectEntries(config: MCPConfigFile): RedactedServerEntry[] {
+	return Object.entries(config.mcpServers ?? {})
+		.sort(([a], [b]) => a.localeCompare(b))
+		.map(([name, serverConfig]) => ({ name, config: redactMCPServerConfig(serverConfig) }));
+}
+
+function writeJson(value: unknown): void {
+	process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function renderServerLine(entry: RedactedServerEntry): string {
+	const config = entry.config;
+	if (config.type === "http" || config.type === "sse") {
+		return `${entry.name}\t${config.type}\t${config.url}`;
+	}
+	const args = config.args && config.args.length > 0 ? ` ${config.args.join(" ")}` : "";
+	return `${entry.name}\tstdio\t${config.command}${args}`;
+}
+
+function renderDetails(entry: RedactedServerEntry): string {
+	return `${renderServerLine(entry)}\n${JSON.stringify(entry.config, null, 2)}`;
+}
+
+async function runAdd(args: MCPCommandArgs, scoped: ScopedPath): Promise<void> {
+	if (!args.name) throw new MCPArgsError("`gjc mcp add` requires a server name.");
+	const config = buildServerConfig(args);
+	const result = await upsertMCPServer(scoped.path, args.name, config, { force: args.flags.force });
+	const redacted = redactMCPServerConfig(config);
+	if (args.flags.json) {
+		writeJson({
+			action: "add",
+			status: result.status,
+			name: args.name,
+			scope: scoped.scope,
+			path: scoped.path,
+			config: redacted,
+		});
+		return;
+	}
+	if (result.status === "skipped") {
+		process.stdout.write(
+			`MCP server "${args.name}" already exists in ${scoped.scope} config. Pass --force to overwrite.\n`,
+		);
+		return;
+	}
+	process.stdout.write(`MCP server "${args.name}" ${result.status} in ${scoped.scope} config: ${scoped.path}\n`);
+}
+
+async function runList(args: MCPCommandArgs, scoped: ScopedPath): Promise<void> {
+	const config = await readMCPConfigFile(scoped.path);
+	const entries = collectEntries(config);
+	if (args.flags.json) {
+		writeJson({ action: "list", scope: scoped.scope, path: scoped.path, servers: entries });
+		return;
+	}
+	if (entries.length === 0) {
+		process.stdout.write(`No MCP servers registered in ${scoped.scope} config: ${scoped.path}\n`);
+		return;
+	}
+	process.stdout.write(`MCP servers in ${scoped.scope} config: ${scoped.path}\n`);
+	for (const entry of entries) {
+		process.stdout.write(`${renderDetails(entry)}\n`);
+	}
+}
+
+async function runRemove(args: MCPCommandArgs, scoped: ScopedPath): Promise<void> {
+	if (!args.name) throw new MCPArgsError("`gjc mcp remove` requires a server name.");
+	const existing = await getMCPServer(scoped.path, args.name);
+	if (!existing) {
+		throw new MCPArgsError(`MCP server "${args.name}" not found in ${scoped.scope} config.`);
+	}
+	await removeMCPServer(scoped.path, args.name);
+	const entry = { name: args.name, config: redactMCPServerConfig(existing) };
+	if (args.flags.json) {
+		writeJson({
+			action: "remove",
+			status: "removed",
+			name: args.name,
+			scope: scoped.scope,
+			path: scoped.path,
+			removed: entry,
+		});
+		return;
+	}
+	process.stdout.write(`Removed MCP server "${args.name}" from ${scoped.scope} config: ${scoped.path}\n`);
+	process.stdout.write(`${renderDetails(entry)}\n`);
+}
+
+export async function runMCPCommand(args: MCPCommandArgs): Promise<void> {
+	const scoped = resolvePath(args);
+	try {
+		switch (args.action) {
+			case "add":
+				await runAdd(args, scoped);
+				return;
+			case "list":
+				await runList(args, scoped);
+				return;
+			case "remove":
+				await runRemove(args, scoped);
+				return;
+		}
+	} catch (error) {
+		if (error instanceof MCPArgsError) {
+			process.stderr.write(`${error.message}\n`);
+			process.exitCode = 2;
+			return;
+		}
+		throw error;
+	}
+}