@gguf/coder 0.3.1 → 0.3.2

package/source/models/models-types.ts

@@ -1,68 +0,0 @@
-/**
- * Type definitions for models.dev API data structures
- */
-
-export type ModelsDevModel = {
-	id: string;
-	name: string;
-	release_date: string;
-	attachment: boolean;
-	reasoning: boolean;
-	temperature: boolean;
-	tool_call: boolean;
-	cost: {
-		input: number;
-		output: number;
-		cache_read?: number;
-		cache_write?: number;
-	};
-	limit: {
-		context: number;
-		output: number;
-	};
-	modalities?: {
-		input: Array<'text' | 'audio' | 'image' | 'video' | 'pdf'>;
-		output: Array<'text' | 'audio' | 'image' | 'video' | 'pdf'>;
-	};
-	experimental?: boolean;
-	status?: 'alpha' | 'beta' | 'deprecated';
-	options: Record<string, unknown>;
-	headers?: Record<string, string>;
-	provider?: {npm: string};
-};
-
-export type ModelsDevProvider = {
-	api?: string;
-	name: string;
-	env: string[];
-	id: string;
-	npm?: string;
-	models: Record<string, ModelsDevModel>;
-};
-
-export type ModelsDevDatabase = Record<string, ModelsDevProvider>;
-
-/**
- * Cached models data with metadata
- */
-export interface CachedModelsData {
-	data: ModelsDevDatabase;
-	fetchedAt: number;
-	expiresAt: number;
-}
-
-/**
- * Model lookup result
- */
-export interface ModelInfo {
-	id: string;
-	name: string;
-	provider: string;
-	contextLimit: number;
-	outputLimit: number;
-	supportsToolCalls: boolean;
-	cost: {
-		input: number;
-		output: number;
-	};
-}

package/source/prompt-history.ts

@@ -1,155 +0,0 @@
-import { getClosestConfigFile } from '@/config/index';
-import { MAX_PROMPT_HISTORY_SIZE } from '@/constants';
-import { logError } from '@/utils/message-queue';
-import fs from 'fs/promises';
-import type { InputState } from './types/hooks';
-
-const HISTORY_FILE = getClosestConfigFile('.coder-history');
-const ENTRY_SEPARATOR = '\n---ENTRY_SEPARATOR---\n';
-const JSON_FORMAT_MARKER = '---JSON_FORMAT---';
-
-class PromptHistory {
-	private history: InputState[] = [];
-	private currentIndex: number = -1;
-
-	async loadHistory(): Promise<void> {
-		try {
-			const content = await fs.readFile(HISTORY_FILE, 'utf8');
-
-			if (content.startsWith(JSON_FORMAT_MARKER)) {
-				// New JSON format with InputState objects
-				const jsonContent = content.slice(JSON_FORMAT_MARKER.length);
-				this.history = JSON.parse(jsonContent) as InputState[];
-			} else if (content.includes(ENTRY_SEPARATOR)) {
-				// Legacy format with separator - migrate to InputState
-				const stringEntries = content
-					.split(ENTRY_SEPARATOR)
-					.filter(entry => entry.trim() !== '');
-				this.history = this.migrateStringArrayToInputState(stringEntries);
-			} else {
-				// Very old format - single lines - migrate to InputState
-				const stringEntries = content
-					.split('\n')
-					.filter(line => line.trim() !== '');
-				this.history = this.migrateStringArrayToInputState(stringEntries);
-			}
-			this.currentIndex = -1;
-		} catch {
-			// File doesn't exist yet, start with empty history
-			this.history = [];
-			this.currentIndex = -1;
-		}
-	}
-
-	private migrateStringArrayToInputState(
-		stringEntries: string[],
-	): InputState[] {
-		return stringEntries.map(entry => ({
-			displayValue: entry,
-			placeholderContent: {},
-		}));
-	}
-
-	async saveHistory(): Promise<void> {
-		try {
-			const jsonContent = JSON.stringify(this.history, null, 2);
-			await fs.writeFile(
-				HISTORY_FILE,
-				JSON_FORMAT_MARKER + jsonContent,
-				'utf8',
-			);
-		} catch (error) {
-			// Silently fail to avoid disrupting the user experience
-			const errorMessage =
-				error instanceof Error ? error.message : 'Unknown error';
-			logError(`Failed to save prompt history: ${errorMessage}`);
-		}
-	}
-
-	addPrompt(inputState: InputState): void;
-	addPrompt(prompt: string): void;
-	addPrompt(input: InputState | string): void {
-		let inputState: InputState;
-
-		if (typeof input === 'string') {
-			const trimmed = input.trim();
-			if (!trimmed) return;
-			inputState = {
-				displayValue: trimmed,
-				placeholderContent: {},
-			};
-		} else {
-			if (!input.displayValue.trim()) return;
-			inputState = input;
-		}
-
-		// Remove duplicate if it exists (compare by displayValue)
-		const existingIndex = this.history.findIndex(
-			entry => entry.displayValue === inputState.displayValue,
-		);
-		if (existingIndex !== -1) {
-			this.history.splice(existingIndex, 1);
-		}
-
-		// Add to the end
-		this.history.push(inputState);
-
-		// Keep only the last MAX_PROMPT_HISTORY_SIZE entries
-		if (this.history.length > MAX_PROMPT_HISTORY_SIZE) {
-			this.history = this.history.slice(-MAX_PROMPT_HISTORY_SIZE);
-		}
-
-		this.currentIndex = -1;
-		void this.saveHistory(); // Fire and forget
-	}
-
-	getPrevious(): InputState | null {
-		if (this.history.length === 0) return null;
-
-		if (this.currentIndex === -1) {
-			this.currentIndex = this.history.length - 1;
-		} else if (this.currentIndex > 0) {
-			this.currentIndex--;
-		}
-
-		return this.history[this.currentIndex] ?? null;
-	}
-
-	getNext(): InputState | null {
-		if (this.history.length === 0 || this.currentIndex === -1) return null;
-
-		if (this.currentIndex < this.history.length - 1) {
-			this.currentIndex++;
-			return this.history[this.currentIndex] ?? null;
-		} else {
-			this.currentIndex = -1;
-			return null; // Changed from empty string to null for consistency
-		}
-	}
-
-	// Legacy methods for backward compatibility
-	getPreviousString(): string | null {
-		const result = this.getPrevious();
-		return result?.displayValue ?? null;
-	}
-
-	getNextString(): string | null {
-		const result = this.getNext();
-		return result?.displayValue ?? '';
-	}
-
-	resetIndex(): void {
-		this.currentIndex = -1;
-	}
-
-	getHistory(): InputState[] {
-		return [...this.history];
-	}
-
-	// Legacy method for backward compatibility
-	getHistoryStrings(): string[] {
-		return this.history.map(entry => entry.displayValue);
-	}
-}
-
-export const promptHistory = new PromptHistory();

package/source/security/command-injection.spec.ts

@@ -1,240 +0,0 @@
-/**
- * Security tests for command injection vulnerabilities
- * Tests that special characters in user input don't cause command injection
- */
-import test from 'ava';
-import {execFileSync} from 'child_process';
-import {mkdirSync, rmSync, writeFileSync} from 'fs';
-import {join} from 'path';
-import {tmpdir} from 'os';
-
-console.log('\ncommand-injection.spec.ts');
-
-// Test for server-discovery.ts - findCommand function
-test('server-discovery: findCommand handles commands with shell metacharacters', t => {
-	// These characters should not break out of the command context
-	const dangerousCommands = [
-		'test; rm -rf /',
-		'test && echo hacked',
-		'test | cat /etc/passwd',
-		'test`whoami`',
-		'test$(whoami)',
-		'test\nrm -rf /',
-		'test&echo pwned',
-	];
-
-	for (const cmd of dangerousCommands) {
-		// Should not throw or execute the injected commands
-		t.notThrows(() => {
-			try {
-				execFileSync('which', [cmd], {stdio: 'ignore'});
-			} catch {
-				// Expected to fail - command doesn't exist
-			}
-		});
-	}
-
-	t.pass('Commands with metacharacters handled safely');
-});
-
-// Test for find-files.tsx - file pattern handling
-test('find-files: handles file patterns with shell metacharacters', async t => {
-	const testDir = join(tmpdir(), `coder-test-${Date.now()}`);
-
-	try {
-		// Create test directory structure
-		mkdirSync(testDir, {recursive: true});
-		mkdirSync(join(testDir, 'safe'), {recursive: true});
-		writeFileSync(join(testDir, 'safe', 'test.txt'), 'safe file');
-
-		// Test patterns that could be dangerous if not properly escaped
-		const dangerousPatterns = [
-			'*.txt; rm -rf /',
-			'*.txt && echo hacked',
-			'*.txt | cat /etc/passwd',
-			'*.txt`whoami`',
-			'*.txt$(whoami)',
-			"*.txt' || echo vulnerable",
-			'*.txt" || echo vulnerable',
-		];
-
-		const {execFile} = await import('node:child_process');
-		const {promisify} = await import('node:util');
-		const execFileAsync = promisify(execFile);
-
-		for (const pattern of dangerousPatterns) {
-			// Build find arguments array (same as the fixed code)
-			const findArgs = ['.', '-name', pattern];
-
-			// Should not execute injected commands
-			try {
-				await execFileAsync('find', findArgs, {
-					cwd: testDir,
-					timeout: 1000,
-				});
-			} catch (error: unknown) {
-				// Expected to fail or find nothing - that's fine
-				// What matters is it doesn't execute injected commands
-			}
-		}
-
-		t.pass('File patterns with metacharacters handled safely');
-	} finally {
-		// Cleanup
-		try {
-			rmSync(testDir, {recursive: true, force: true});
-		} catch {
-			// Ignore cleanup errors
-		}
-	}
-});
-
-// Test for search-file-contents.tsx - search query handling
-test('search-file-contents: handles search queries with shell metacharacters', async t => {
-	const testDir = join(tmpdir(), `coder-test-${Date.now()}`);
-
-	try {
-		// Create test directory with a file to search
-		mkdirSync(testDir, {recursive: true});
-		writeFileSync(join(testDir, 'test.txt'), 'hello world\ntest content');
-
-		// Test queries that could be dangerous if not properly escaped
-		const dangerousQueries = [
-			'test; rm -rf /',
-			'test && echo hacked',
-			'test | cat /etc/passwd',
-			'test`whoami`',
-			'test$(whoami)',
-			"test' || echo vulnerable",
-			'test" || echo vulnerable',
-			'test\nrm -rf /',
-		];
-
-		const {execFile} = await import('node:child_process');
-		const {promisify} = await import('node:util');
-		const execFileAsync = promisify(execFile);
-
-		for (const query of dangerousQueries) {
-			// Build grep arguments array (same as the fixed code)
-			const grepArgs = ['-rn', '-E', '-i', '--include=*', query, '.'];
-
-			// Should not execute injected commands
-			try {
-				await execFileAsync('grep', grepArgs, {
-					cwd: testDir,
-					timeout: 1000,
-				});
-			} catch (error: unknown) {
-				// Expected to fail or find nothing - that's fine
-				// What matters is it doesn't execute injected commands
-			}
-		}
-
-		t.pass('Search queries with metacharacters handled safely');
-	} finally {
-		// Cleanup
-		try {
-			rmSync(testDir, {recursive: true, force: true});
-		} catch {
-			// Ignore cleanup errors
-		}
-	}
-});
-
-// Test that special regex characters are handled correctly
-test('search-file-contents: handles regex special characters correctly', async t => {
-	const testDir = join(tmpdir(), `coder-test-${Date.now()}`);
-
-	try {
-		mkdirSync(testDir, {recursive: true});
-		writeFileSync(join(testDir, 'test.txt'), 'function test() {}');
-
-		const {execFile} = await import('node:child_process');
-		const {promisify} = await import('node:util');
-		const execFileAsync = promisify(execFile);
-
-		// Regex patterns that should work correctly
-		const regexPatterns = [
-			'function.*test',
-			'test\\(\\)',
-			'\\w+\\s+test',
-		];
-
-		for (const pattern of regexPatterns) {
-			const grepArgs = ['-rn', '-E', '-i', '--include=*', pattern, '.'];
-
-			// Should handle regex patterns correctly
-			try {
-				const {stdout} = await execFileAsync('grep', grepArgs, {
-					cwd: testDir,
-					timeout: 1000,
-				});
-				// If it finds matches, that's good
-				t.truthy(stdout !== undefined);
-			} catch (error: unknown) {
-				// If grep exits with code 1 (no matches), that's also fine
-				if (
-					error instanceof Error &&
-					'code' in error &&
-					error.code === 1
-				) {
-					t.pass();
-				}
-			}
-		}
-
-		t.pass('Regex patterns handled correctly');
-	} finally {
-		// Cleanup
-		try {
-			rmSync(testDir, {recursive: true, force: true});
-		} catch {
-			// Ignore cleanup errors
-		}
-	}
-});
-
-// Test that the escaping removed from search-file-contents was necessary
-test('search-file-contents: previous escaping method was insufficient', t => {
-	// This demonstrates why the old escaping method was vulnerable
-	const dangerousQuery = 'test"; rm -rf /';
-
-	// Old method (insufficient): only escapes double quotes
-	const oldEscaped = dangerousQuery.replace(/"/g, '\\"');
-	// Result: 'test\"; rm -rf /' - still vulnerable when used in shell command
-
-	// The old approach would create: grep "test\"; rm -rf /" .
-	// The semicolon would still be interpreted by the shell
-
-	// New method: uses array-based arguments, no escaping needed
-	// grep receives exactly: ['test"; rm -rf /'] as a literal string
-	// The shell never interprets the semicolon
-
-	t.not(oldEscaped, dangerousQuery);
-	t.true(oldEscaped.includes(';'), 'Old escaping leaves semicolon unescaped');
-	t.pass('Demonstrated why old escaping was insufficient');
-});
-
-// Integration test: verify the actual functions handle injection safely
-test('integration: all fixed functions use array-based arguments', t => {
-	// This test verifies that the fixed code uses execFileSync/execFileAsync
-	// with array-based arguments instead of shell string interpolation
-
-	// The key insight: when using execFile/execFileSync with an array,
-	// the shell never interprets the arguments, preventing injection
-
-	const testCommand = 'echo';
-	const testArgs = ['hello; rm -rf /'];
-
-	// This is safe - 'rm -rf /' is never executed
-	const result = execFileSync(testCommand, testArgs, {
-		encoding: 'utf8',
-	});
-
-	// The output literally contains the semicolon and command
-	t.true(result.includes(';'));
-	t.true(result.includes('rm -rf /'));
-
-	// If shell interpretation happened, we wouldn't see these in the output
-	t.pass('Array-based arguments prevent shell interpretation');
-});