@hongymagic/q 2026.306.0 → 2026.306.1-next.3e2fb1d

package/dist/q.js

@@ -14641,7 +14641,7 @@ import { parseArgs } from "node:util";
 // package.json
 var package_default = {
   name: "@hongymagic/q",
-  version: "2026.306.0",
+  version: "2026.306.1-next.3e2fb1d",
   description: "Quick AI answers from the command line",
   main: "dist/q.js",
   type: "module",
@@ -14691,21 +14691,21 @@ var package_default = {
     "release:dry": "bun run scripts/release.ts --dry-run"
   },
   dependencies: {
-    "@ai-sdk/amazon-bedrock": "4.0.75",
-    "@ai-sdk/anthropic": "3.0.56",
-    "@ai-sdk/azure": "3.0.40",
-    "@ai-sdk/google": "3.0.40",
-    "@ai-sdk/groq": "3.0.27",
-    "@ai-sdk/openai": "3.0.39",
-    "@ai-sdk/openai-compatible": "2.0.33",
+    "@ai-sdk/amazon-bedrock": "4.0.77",
+    "@ai-sdk/anthropic": "3.0.58",
+    "@ai-sdk/azure": "3.0.42",
+    "@ai-sdk/google": "3.0.43",
+    "@ai-sdk/groq": "3.0.29",
+    "@ai-sdk/openai": "3.0.41",
+    "@ai-sdk/openai-compatible": "2.0.35",
     "@t3-oss/env-core": "0.13.10",
-    ai: "6.0.114",
+    ai: "6.0.116",
     clipboardy: "5.3.1",
     "ollama-ai-provider-v2": "3.3.1",
     zod: "4.3.6"
   },
   devDependencies: {
-    "@biomejs/biome": "2.4.5",
+    "@biomejs/biome": "2.4.6",
     "@types/bun": "1.3.10",
     "@vitest/coverage-v8": "4.0.18",
     lefthook: "2.1.2",
@@ -33569,8 +33569,114 @@ async function readResponseWithSizeLimit({
   }
   return result;
 }
+function validateDownloadUrl(url2) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch (e) {
+    throw new DownloadError({
+      url: url2,
+      message: `Invalid URL: ${url2}`
+    });
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new DownloadError({
+      url: url2,
+      message: `URL scheme must be http or https, got ${parsed.protocol}`
+    });
+  }
+  const hostname3 = parsed.hostname;
+  if (!hostname3) {
+    throw new DownloadError({
+      url: url2,
+      message: `URL must have a hostname`
+    });
+  }
+  if (hostname3 === "localhost" || hostname3.endsWith(".local") || hostname3.endsWith(".localhost")) {
+    throw new DownloadError({
+      url: url2,
+      message: `URL with hostname ${hostname3} is not allowed`
+    });
+  }
+  if (hostname3.startsWith("[") && hostname3.endsWith("]")) {
+    const ipv63 = hostname3.slice(1, -1);
+    if (isPrivateIPv6(ipv63)) {
+      throw new DownloadError({
+        url: url2,
+        message: `URL with IPv6 address ${hostname3} is not allowed`
+      });
+    }
+    return;
+  }
+  if (isIPv4(hostname3)) {
+    if (isPrivateIPv4(hostname3)) {
+      throw new DownloadError({
+        url: url2,
+        message: `URL with IP address ${hostname3} is not allowed`
+      });
+    }
+    return;
+  }
+}
+function isIPv4(hostname3) {
+  const parts = hostname3.split(".");
+  if (parts.length !== 4)
+    return false;
+  return parts.every((part) => {
+    const num = Number(part);
+    return Number.isInteger(num) && num >= 0 && num <= 255 && String(num) === part;
+  });
+}
+function isPrivateIPv4(ip) {
+  const parts = ip.split(".").map(Number);
+  const [a, b] = parts;
+  if (a === 0)
+    return true;
+  if (a === 10)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  return false;
+}
+function isPrivateIPv6(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "::1")
+    return true;
+  if (normalized === "::")
+    return true;
+  if (normalized.startsWith("::ffff:")) {
+    const mappedPart = normalized.slice(7);
+    if (isIPv4(mappedPart)) {
+      return isPrivateIPv4(mappedPart);
+    }
+    const hexParts = mappedPart.split(":");
+    if (hexParts.length === 2) {
+      const high = parseInt(hexParts[0], 16);
+      const low = parseInt(hexParts[1], 16);
+      if (!isNaN(high) && !isNaN(low)) {
+        const a = high >> 8 & 255;
+        const b = high & 255;
+        const c = low >> 8 & 255;
+        const d = low & 255;
+        return isPrivateIPv4(`${a}.${b}.${c}.${d}`);
+      }
+    }
+  }
+  if (normalized.startsWith("fc") || normalized.startsWith("fd"))
+    return true;
+  if (normalized.startsWith("fe80"))
+    return true;
+  return false;
+}
 async function downloadBlob(url2, options) {
   var _a23, _b22;
+  validateDownloadUrl(url2);
   try {
     const response = await fetch(url2, {
       signal: options == null ? undefined : options.abortSignal
@@ -33731,7 +33837,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
   normalizedHeaders.set("user-agent", [currentUserAgentHeader, ...userAgentSuffixParts].filter(Boolean).join(" "));
   return Object.fromEntries(normalizedHeaders.entries());
 }
-var VERSION2 = "4.0.17";
+var VERSION2 = "4.0.19";
 var getOriginalFetch = () => globalThis.fetch;
 var getFromApi = async ({
   url: url2,
@@ -33902,8 +34008,8 @@ function mediaTypeToExtension(mediaType) {
     "x-m4a": "m4a"
   }[subtype]) != null ? _a23 : subtype;
 }
-var suspectProtoRx = /"__proto__"\s*:/;
-var suspectConstructorRx = /"constructor"\s*:/;
+var suspectProtoRx = /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*:/;
+var suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
 function _parse2(text) {
   const obj = JSON.parse(text);
   if (obj === null || typeof obj !== "object") {
@@ -33923,7 +34029,7 @@ function filter(obj) {
       if (Object.prototype.hasOwnProperty.call(node, "__proto__")) {
         throw new SyntaxError("Object contains forbidden prototype property");
       }
-      if (Object.prototype.hasOwnProperty.call(node, "constructor") && Object.prototype.hasOwnProperty.call(node.constructor, "prototype")) {
+      if (Object.prototype.hasOwnProperty.call(node, "constructor") && node.constructor !== null && typeof node.constructor === "object" && Object.prototype.hasOwnProperty.call(node.constructor, "prototype")) {
         throw new SyntaxError("Object contains forbidden prototype property");
       }
       for (const key in node) {
@@ -35499,7 +35605,7 @@ async function* executeTool({
 }
 
 // node_modules/@ai-sdk/anthropic/dist/index.mjs
-var VERSION3 = "3.0.56";
+var VERSION3 = "3.0.58";
 var anthropicErrorDataSchema = lazySchema(() => zodSchema(exports_external.object({
   type: exports_external.literal("error"),
   error: exports_external.object({
@@ -36500,6 +36606,7 @@ async function prepareTools({
           canCache: true
         });
         const anthropicOptions = (_a16 = tool2.providerOptions) == null ? undefined : _a16.anthropic;
+        const eagerInputStreaming = anthropicOptions == null ? undefined : anthropicOptions.eagerInputStreaming;
         const deferLoading = anthropicOptions == null ? undefined : anthropicOptions.deferLoading;
         const allowedCallers = anthropicOptions == null ? undefined : anthropicOptions.allowedCallers;
         anthropicTools2.push({
@@ -36507,6 +36614,7 @@ async function prepareTools({
           description: tool2.description,
           input_schema: tool2.inputSchema,
           cache_control: cacheControl,
+          ...eagerInputStreaming ? { eager_input_streaming: true } : {},
           ...supportsStructuredOutput === true && tool2.strict != null ? { strict: tool2.strict } : {},
           ...deferLoading != null ? { defer_loading: deferLoading } : {},
           ...allowedCallers != null ? { allowed_callers: allowedCallers } : {},
@@ -45220,7 +45328,7 @@ var azureOpenaiTools = {
   imageGeneration,
   webSearchPreview
 };
-var VERSION4 = "3.0.40";
+var VERSION4 = "3.0.42";
 function createAzure(options = {}) {
   var _a16;
   const getHeaders = () => {
@@ -46332,6 +46440,7 @@ async function prepareTools2({
           canCache: true
         });
         const anthropicOptions = (_a16 = tool2.providerOptions) == null ? undefined : _a16.anthropic;
+        const eagerInputStreaming = anthropicOptions == null ? undefined : anthropicOptions.eagerInputStreaming;
         const deferLoading = anthropicOptions == null ? undefined : anthropicOptions.deferLoading;
         const allowedCallers = anthropicOptions == null ? undefined : anthropicOptions.allowedCallers;
         anthropicTools2.push({
@@ -46339,6 +46448,7 @@ async function prepareTools2({
           description: tool2.description,
           input_schema: tool2.inputSchema,
           cache_control: cacheControl,
+          ...eagerInputStreaming ? { eager_input_streaming: true } : {},
           ...supportsStructuredOutput === true && tool2.strict != null ? { strict: tool2.strict } : {},
           ...deferLoading != null ? { defer_loading: deferLoading } : {},
           ...allowedCallers != null ? { allowed_callers: allowedCallers } : {},
@@ -49371,7 +49481,7 @@ var bedrockImageResponseSchema = exports_external.object({
   details: exports_external.record(exports_external.string(), exports_external.unknown()).optional(),
   preview: exports_external.unknown().optional()
 });
-var VERSION5 = "4.0.75";
+var VERSION5 = "4.0.77";
 function createSigV4FetchFunction(getCredentials, fetch2 = globalThis.fetch) {
   return async (input, init) => {
     var _a16, _b16;
@@ -49667,7 +49777,7 @@ function createBedrockProvider(config2, providerName) {
 }
 
 // node_modules/@ai-sdk/google/dist/index.mjs
-var VERSION6 = "3.0.40";
+var VERSION6 = "3.0.43";
 var googleErrorDataSchema = lazySchema(() => zodSchema(exports_external.object({
   error: exports_external.object({
     code: exports_external.number().nullable(),
@@ -49973,8 +50083,8 @@ function convertToGoogleGenerativeAIMessages(prompt, options) {
         contents.push({
           role: "model",
           parts: content.map((part) => {
-            var _a23, _b22, _c2;
-            const providerOpts = (_c2 = (_a23 = part.providerOptions) == null ? undefined : _a23[providerOptionsName]) != null ? _c2 : providerOptionsName !== "google" ? (_b22 = part.providerOptions) == null ? undefined : _b22.google : undefined;
+            var _a23, _b22, _c2, _d;
+            const providerOpts = (_d = (_a23 = part.providerOptions) == null ? undefined : _a23[providerOptionsName]) != null ? _d : providerOptionsName !== "google" ? (_b22 = part.providerOptions) == null ? undefined : _b22.google : (_c2 = part.providerOptions) == null ? undefined : _c2.vertex;
             const thoughtSignature = (providerOpts == null ? undefined : providerOpts.thoughtSignature) != null ? String(providerOpts.thoughtSignature) : undefined;
             switch (part.type) {
               case "text": {
@@ -52528,7 +52638,7 @@ var browserSearch = createProviderToolFactory({
 var groqTools = {
   browserSearch
 };
-var VERSION7 = "3.0.27";
+var VERSION7 = "3.0.29";
 function createGroq(options = {}) {
   var _a16;
   const baseURL = (_a16 = withoutTrailingSlash(options.baseURL)) != null ? _a16 : "https://api.groq.com/openai/v1";
@@ -60921,7 +61031,7 @@ var OpenAITranscriptionModel2 = class {
     };
   }
 };
-var VERSION9 = "3.0.39";
+var VERSION9 = "3.0.41";
 function createOpenAI(options = {}) {
   var _a16, _b16;
   const baseURL = (_a16 = withoutTrailingSlash(loadOptionalSetting({
@@ -62469,7 +62579,7 @@ async function fileToBlob3(file2) {
 function toCamelCase(str) {
   return str.replace(/[_-]([a-z])/g, (g) => g[1].toUpperCase());
 }
-var VERSION10 = "2.0.33";
+var VERSION10 = "2.0.35";
 function createOpenAICompatible(options) {
   const baseURL = withoutTrailingSlash(options.baseURL);
   const providerName = options.name;
@@ -63760,7 +63870,7 @@ async function getVercelRequestId() {
   var _a92;
   return (_a92 = import_oidc.getContext().headers) == null ? undefined : _a92["x-vercel-id"];
 }
-var VERSION11 = "3.0.64";
+var VERSION11 = "3.0.66";
 var AI_GATEWAY_PROTOCOL_VERSION = "0.0.1";
 function createGatewayProvider(options = {}) {
   var _a92, _b92;
@@ -64508,7 +64618,7 @@ function detectMediaType({
   }
   return;
 }
-var VERSION12 = "6.0.114";
+var VERSION12 = "6.0.116";
 var download = async ({
   url: url2,
   maxBytes,
@@ -64516,6 +64626,7 @@ var download = async ({
 }) => {
   var _a21;
   const urlText = url2.toString();
+  validateDownloadUrl(urlText);
   try {
     const response = await fetch(urlText, {
       headers: withUserAgentSuffix({}, `ai-sdk/${VERSION12}`, getRuntimeEnvironmentUserAgent()),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hongymagic/q",
-  "version": "2026.306.0",
+  "version": "2026.306.1-next.3e2fb1d",
   "description": "Quick AI answers from the command line",
   "main": "dist/q.js",
   "type": "module",
@@ -50,21 +50,21 @@
     "release:dry": "bun run scripts/release.ts --dry-run"
   },
   "dependencies": {
-    "@ai-sdk/amazon-bedrock": "4.0.75",
-    "@ai-sdk/anthropic": "3.0.56",
-    "@ai-sdk/azure": "3.0.40",
-    "@ai-sdk/google": "3.0.40",
-    "@ai-sdk/groq": "3.0.27",
-    "@ai-sdk/openai": "3.0.39",
-    "@ai-sdk/openai-compatible": "2.0.33",
+    "@ai-sdk/amazon-bedrock": "4.0.77",
+    "@ai-sdk/anthropic": "3.0.58",
+    "@ai-sdk/azure": "3.0.42",
+    "@ai-sdk/google": "3.0.43",
+    "@ai-sdk/groq": "3.0.29",
+    "@ai-sdk/openai": "3.0.41",
+    "@ai-sdk/openai-compatible": "2.0.35",
     "@t3-oss/env-core": "0.13.10",
-    "ai": "6.0.114",
+    "ai": "6.0.116",
     "clipboardy": "5.3.1",
     "ollama-ai-provider-v2": "3.3.1",
     "zod": "4.3.6"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.4.5",
+    "@biomejs/biome": "2.4.6",
     "@types/bun": "1.3.10",
     "@vitest/coverage-v8": "4.0.18",
     "lefthook": "2.1.2",