@jiangyuan1209/yuan-claw 0.1.0

package/dist/model/providers/openai-compatible.js

@@ -0,0 +1,42 @@
+import OpenAI from "openai";
+export function createOpenAICompatibleClient(options = {}) {
+    const config = options.config ?? {};
+    const apiKey = config.MODEL_API_KEY ??
+        config.OPENAI_API_KEY ??
+        process.env.MODEL_API_KEY ??
+        process.env.OPENAI_API_KEY;
+    const baseURL = config.MODEL_BASE_URL ??
+        config.OPENAI_BASE_URL ??
+        process.env.MODEL_BASE_URL ??
+        process.env.OPENAI_BASE_URL;
+    const model = options.model ??
+        config.MODEL_NAME ??
+        config.OPENAI_MODEL ??
+        process.env.MODEL_NAME ??
+        process.env.OPENAI_MODEL ??
+        "gpt-4o-mini";
+    if (!apiKey) {
+        throw new Error("Missing MODEL_API_KEY / OPENAI_API_KEY in environment variables or ~/.my-agent/settings.json.");
+    }
+    const client = new OpenAI({
+        apiKey,
+        baseURL,
+    });
+    return {
+        async generate(messages) {
+            const response = await client.chat.completions.create({
+                model,
+                messages: messages.map((message) => ({
+                    role: message.role === "tool" ? "user" : message.role,
+                    content: message.content,
+                })),
+                temperature: 0,
+            });
+            const text = response.choices[0]?.message?.content;
+            if (typeof text !== "string" || !text.trim()) {
+                throw new Error("Model returned empty content.");
+            }
+            return text;
+        },
+    };
+}

package/dist/scripts/test-brave.js

@@ -0,0 +1,16 @@
+import { initGlobalProxy } from "../lib/initGlobalProxy.js";
+import { createBraveSearchProvider } from "../tools/web/index.js";
+initGlobalProxy();
+async function main() {
+    const apiKey = process.env.BRAVE_API_KEY;
+    if (!apiKey) {
+        throw new Error("Missing BRAVE_API_KEY");
+    }
+    const search = createBraveSearchProvider({ apiKey });
+    const results = await search("OpenAI", 5);
+    console.log(results);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/security/network-policy.js

@@ -0,0 +1,19 @@
+export function validateUrlByPolicy(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Invalid URL: ${rawUrl}`);
+    }
+    if (!["http:", "https:"].includes(url.protocol)) {
+        throw new Error(`Unsupported URL protocol: ${url.protocol}`);
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "::1") {
+        throw new Error(`Blocked local address: ${hostname}`);
+    }
+    return url;
+}

package/dist/security/path-guards.js

@@ -0,0 +1,18 @@
+import path from "node:path";
+export function resolveWorkspaceRoot(workspaceRoot) {
+    return path.resolve(workspaceRoot ?? process.cwd());
+}
+export function resolveSafePath(workspaceRoot, targetPath) {
+    const root = path.resolve(workspaceRoot);
+    const fullPath = path.resolve(root, targetPath);
+    const relative = path.relative(root, fullPath);
+    if (relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        throw new Error(`Path escapes workspace: ${targetPath}`);
+    }
+    return fullPath;
+}
+export function toWorkspaceRelativePath(workspaceRoot, fullPath) {
+    return path.relative(path.resolve(workspaceRoot), path.resolve(fullPath));
+}

package/dist/security/shell-policy.js

@@ -0,0 +1,40 @@
+const DEFAULT_DENY_PATTERNS = [
+    /\brm\s+-rf\s+\//i,
+    /\bsudo\b/i,
+    /\bshutdown\b/i,
+    /\breboot\b/i,
+    /\bmkfs\b/i,
+    /\bdd\b/i,
+    />\s*\/dev\//i,
+];
+const DEFAULT_ALLOW_PREFIXES = [
+    "ls",
+    "pwd",
+    "cat",
+    "echo",
+    "find",
+    "grep",
+    "head",
+    "tail",
+    "wc",
+    "sort",
+    "uniq",
+    "npm",
+    "node",
+    "git",
+];
+export function validateShellCommand(command) {
+    const trimmed = command.trim();
+    if (!trimmed) {
+        throw new Error("Shell command cannot be empty");
+    }
+    for (const pattern of DEFAULT_DENY_PATTERNS) {
+        if (pattern.test(trimmed)) {
+            throw new Error(`Shell command denied by policy: ${trimmed}`);
+        }
+    }
+    const firstToken = trimmed.split(/\s+/)[0];
+    if (!DEFAULT_ALLOW_PREFIXES.includes(firstToken)) {
+        throw new Error(`Shell command not allowed by policy. Command prefix: ${firstToken}`);
+    }
+}

package/dist/shared/utils.js

@@ -0,0 +1 @@
+export {};

package/dist/tools/file/grep-text.js

@@ -0,0 +1,85 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { resolveSafePath } from "../../security/path-guards.js";
+const GrepTextInputSchema = z.object({
+    query: z.string().min(1),
+    path: z.string().default("."),
+    maxResults: z.number().int().positive().max(200).default(50),
+    caseSensitive: z.boolean().default(false),
+});
+export function createGrepTextTool(options) {
+    return {
+        name: "grep_text",
+        description: "Search text in files under the workspace",
+        riskLevel: "safe",
+        inputSchema: GrepTextInputSchema,
+        async execute(rawArgs) {
+            try {
+                const args = GrepTextInputSchema.parse(rawArgs);
+                const basePath = resolveSafePath(options.workspaceRoot, args.path);
+                const matches = [];
+                async function walk(currentPath) {
+                    const dirents = await fs.readdir(currentPath, { withFileTypes: true });
+                    for (const dirent of dirents) {
+                        if (matches.length >= args.maxResults)
+                            return;
+                        const full = path.join(currentPath, dirent.name);
+                        if (dirent.isDirectory()) {
+                            if (dirent.name === "node_modules" ||
+                                dirent.name === ".git" ||
+                                dirent.name === "dist") {
+                                continue;
+                            }
+                            await walk(full);
+                            continue;
+                        }
+                        if (!dirent.isFile())
+                            continue;
+                        let content;
+                        try {
+                            content = await fs.readFile(full, "utf8");
+                        }
+                        catch {
+                            continue;
+                        }
+                        const lines = content.split(/\r?\n/);
+                        const query = args.caseSensitive
+                            ? args.query
+                            : args.query.toLowerCase();
+                        for (let i = 0; i < lines.length; i++) {
+                            const lineText = lines[i];
+                            const target = args.caseSensitive
+                                ? lineText
+                                : lineText.toLowerCase();
+                            if (target.includes(query)) {
+                                matches.push({
+                                    file: path.relative(options.workspaceRoot, full),
+                                    line: i + 1,
+                                    text: lineText,
+                                });
+                                if (matches.length >= args.maxResults)
+                                    return;
+                            }
+                        }
+                    }
+                }
+                await walk(basePath);
+                return {
+                    success: true,
+                    output: {
+                        query: args.query,
+                        matches,
+                        truncated: matches.length >= args.maxResults,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/file/list-files.js

@@ -0,0 +1,52 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { resolveSafePath } from "../../security/path-guards.js";
+const ListFilesInputSchema = z.object({
+    path: z.string().default("."),
+    recursive: z.boolean().default(false),
+    maxEntries: z.number().int().positive().max(1000).default(200),
+});
+export function createListFilesTool(options) {
+    return {
+        name: "list_files",
+        description: "List files and directories inside the workspace",
+        riskLevel: "safe",
+        inputSchema: ListFilesInputSchema,
+        async execute(rawArgs) {
+            try {
+                const args = ListFilesInputSchema.parse(rawArgs);
+                const basePath = resolveSafePath(options.workspaceRoot, args.path);
+                const results = [];
+                async function walk(currentPath) {
+                    const dirents = await fs.readdir(currentPath, { withFileTypes: true });
+                    for (const dirent of dirents) {
+                        if (results.length >= args.maxEntries)
+                            return;
+                        const full = path.join(currentPath, dirent.name);
+                        const rel = path.relative(options.workspaceRoot, full) || ".";
+                        results.push(dirent.isDirectory() ? `${rel}/` : rel);
+                        if (args.recursive && dirent.isDirectory()) {
+                            await walk(full);
+                        }
+                    }
+                }
+                await walk(basePath);
+                return {
+                    success: true,
+                    output: {
+                        path: args.path,
+                        entries: results,
+                        truncated: results.length >= args.maxEntries,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/file/read-file.js

@@ -0,0 +1,39 @@
+import fs from "node:fs/promises";
+import { z } from "zod";
+import { resolveSafePath } from "../../security/path-guards.js";
+const ReadFileInputSchema = z.object({
+    path: z.string().min(1),
+    maxChars: z.number().int().positive().max(50000).default(12000),
+});
+export function createReadFileTool(options) {
+    return {
+        name: "read_file",
+        description: "Read a UTF-8 text file from the workspace",
+        riskLevel: "safe",
+        inputSchema: ReadFileInputSchema,
+        async execute(rawArgs) {
+            try {
+                const args = ReadFileInputSchema.parse(rawArgs);
+                const fullPath = resolveSafePath(options.workspaceRoot, args.path);
+                const content = await fs.readFile(fullPath, "utf8");
+                const sliced = content.slice(0, args.maxChars);
+                return {
+                    success: true,
+                    output: {
+                        path: args.path,
+                        content: sliced,
+                        truncated: content.length > sliced.length,
+                        totalChars: content.length,
+                        returnedChars: sliced.length,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/file/write-file.js

@@ -0,0 +1,37 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { resolveSafePath } from "../../security/path-guards.js";
+const WriteFileInputSchema = z.object({
+    path: z.string().min(1),
+    content: z.string(),
+});
+export function createWriteFileTool(options) {
+    return {
+        name: "write_file",
+        description: "Write a UTF-8 text file inside the workspace",
+        riskLevel: "confirm",
+        inputSchema: WriteFileInputSchema,
+        async execute(rawArgs) {
+            try {
+                const args = WriteFileInputSchema.parse(rawArgs);
+                const fullPath = resolveSafePath(options.workspaceRoot, args.path);
+                await fs.mkdir(path.dirname(fullPath), { recursive: true });
+                await fs.writeFile(fullPath, args.content, "utf8");
+                return {
+                    success: true,
+                    output: {
+                        path: args.path,
+                        bytes: Buffer.byteLength(args.content, "utf8"),
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/git/git-diff.js

@@ -0,0 +1,54 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { z } from "zod";
+const execFileAsync = promisify(execFile);
+const GitDiffInputSchema = z.object({
+    cached: z.boolean().default(false),
+    path: z.string().optional(),
+    maxChars: z.number().int().positive().max(50000).default(12000),
+});
+export function createGitDiffTool(options) {
+    return {
+        name: "git_diff",
+        description: "Get git diff in the workspace",
+        riskLevel: "safe",
+        inputSchema: GitDiffInputSchema,
+        async execute(rawArgs) {
+            try {
+                const args = GitDiffInputSchema.parse(rawArgs);
+                const gitArgs = ["diff"];
+                if (args.cached) {
+                    gitArgs.push("--cached");
+                }
+                if (args.path) {
+                    gitArgs.push("--", args.path);
+                }
+                const { stdout, stderr } = await execFileAsync("git", gitArgs, {
+                    cwd: options.workspaceRoot,
+                    timeout: 10000,
+                    maxBuffer: 1024 * 1024,
+                });
+                const diff = stdout.slice(0, args.maxChars);
+                return {
+                    success: true,
+                    output: {
+                        cached: args.cached,
+                        path: args.path ?? null,
+                        diff,
+                        truncated: stdout.length > diff.length,
+                        totalChars: stdout.length,
+                        returnedChars: diff.length,
+                        stderr,
+                        empty: stdout.trim().length === 0,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/git/git-status.js

@@ -0,0 +1,44 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export function createGitStatusTool(options) {
+    return {
+        name: "git_status",
+        description: "Get git repository status in the workspace",
+        riskLevel: "safe",
+        async execute(rawArgs) {
+            try {
+                const { stdout: branchStdout } = await execFileAsync("git", ["branch", "--show-current"], {
+                    cwd: options.workspaceRoot,
+                    timeout: 10000,
+                    maxBuffer: 1024 * 1024,
+                });
+                const { stdout, stderr } = await execFileAsync("git", ["status", "--short", "--branch"], {
+                    cwd: options.workspaceRoot,
+                    timeout: 10000,
+                    maxBuffer: 1024 * 1024,
+                });
+                const lines = stdout
+                    .split(/\r?\n/)
+                    .map((line) => line.trimEnd())
+                    .filter(Boolean);
+                return {
+                    success: true,
+                    output: {
+                        branch: branchStdout.trim() || null,
+                        summary: stdout,
+                        stderr,
+                        lines,
+                        dirty: lines.some((line) => !line.startsWith("##")),
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/registry.js

@@ -0,0 +1,41 @@
+import { createReadFileTool } from "./file/read-file.js";
+import { createWriteFileTool } from "./file/write-file.js";
+import { createListFilesTool } from "./file/list-files.js";
+import { createGrepTextTool } from "./file/grep-text.js";
+import { createShellExecTool } from "./shell/shell-exec.js";
+import { createGitStatusTool } from "./git/git-status.js";
+import { createGitDiffTool } from "./git/git-diff.js";
+import { createHttpFetchTool, createWebSearchTool, createExtractReadableTextTool, createBraveSearchProvider, } from "./web/index.js";
+export function createToolRegistry(options) {
+    const tools = [
+        createReadFileTool({ workspaceRoot: options.workspaceRoot }),
+        createWriteFileTool({ workspaceRoot: options.workspaceRoot }),
+        createListFilesTool({ workspaceRoot: options.workspaceRoot }),
+        createGrepTextTool({ workspaceRoot: options.workspaceRoot }),
+        createShellExecTool({ workspaceRoot: options.workspaceRoot }),
+        createGitStatusTool({ workspaceRoot: options.workspaceRoot }),
+        createGitDiffTool({ workspaceRoot: options.workspaceRoot }),
+        createHttpFetchTool(),
+        createExtractReadableTextTool(),
+    ];
+    const config = options.config ?? {};
+    const braveApiKey = config.BRAVE_SEARCH_API_KEY ??
+        config.BRAVE_API_KEY ??
+        process.env.BRAVE_SEARCH_API_KEY ??
+        process.env.BRAVE_API_KEY;
+    if (braveApiKey) {
+        tools.push(createWebSearchTool({
+            provider: createBraveSearchProvider({
+                apiKey: braveApiKey,
+            }),
+        }));
+        console.warn("[tools] web_search enabled via Brave Search API");
+    }
+    else {
+        console.warn("[tools] web_search disabled: set BRAVE_SEARCH_API_KEY or BRAVE_API_KEY");
+    }
+    return new Map(tools.map((tool) => [tool.name, tool]));
+}
+export function getToolsFromRegistry(registry) {
+    return Array.from(registry.values());
+}

package/dist/tools/shell/shell-exec.js

@@ -0,0 +1,41 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { validateShellCommand } from "../../security/shell-policy.js";
+const execFileAsync = promisify(execFile);
+const ShellExecInputSchema = z.object({
+    command: z.string().min(1),
+    timeoutMs: z.number().int().positive().max(20000).default(10000),
+});
+export function createShellExecTool(options) {
+    return {
+        name: "shell_exec",
+        description: "Execute a shell command in the workspace with safety policy",
+        riskLevel: "dangerous",
+        inputSchema: ShellExecInputSchema,
+        async execute(rawArgs) {
+            try {
+                const args = ShellExecInputSchema.parse(rawArgs);
+                validateShellCommand(args.command);
+                const { stdout, stderr } = await execFileAsync("sh", ["-lc", args.command], {
+                    cwd: options.workspaceRoot,
+                    timeout: args.timeoutMs,
+                    maxBuffer: 1024 * 1024,
+                });
+                return {
+                    success: true,
+                    output: {
+                        stdout,
+                        stderr,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/types.js

@@ -0,0 +1 @@
+export {};

package/dist/tools/web/extract-readable-text.js

@@ -0,0 +1,54 @@
+import { z } from "zod";
+const ExtractReadableTextInputSchema = z.object({
+    content: z.string().min(1),
+    maxChars: z.number().int().positive().max(50000).default(12000),
+});
+function stripTags(html) {
+    return html
+        .replace(/<script[\s\S]*?<\/script>/gi, " ")
+        .replace(/<style[\s\S]*?<\/style>/gi, " ")
+        .replace(/<noscript[\s\S]*?<\/noscript>/gi, " ")
+        .replace(/<\/(p|div|section|article|li|tr|h1|h2|h3|h4|h5|h6)>/gi, "\n")
+        .replace(/<br\s*\/?>/gi, "\n")
+        .replace(/<[^>]+>/g, " ")
+        .replace(/&nbsp;/gi, " ")
+        .replace(/&amp;/gi, "&")
+        .replace(/&lt;/gi, "<")
+        .replace(/&gt;/gi, ">")
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;/gi, "'")
+        .replace(/\r/g, "")
+        .replace(/\n{3,}/g, "\n\n")
+        .replace(/[ \t]{2,}/g, " ")
+        .trim();
+}
+export function createExtractReadableTextTool() {
+    return {
+        name: "extract_readable_text",
+        description: "Extract readable text from HTML or plain text content",
+        riskLevel: "safe",
+        inputSchema: ExtractReadableTextInputSchema,
+        async execute(rawArgs) {
+            try {
+                const args = ExtractReadableTextInputSchema.parse(rawArgs);
+                const text = stripTags(args.content);
+                const sliced = text.slice(0, args.maxChars);
+                return {
+                    success: true,
+                    output: {
+                        text: sliced,
+                        truncated: text.length > sliced.length,
+                        totalChars: text.length,
+                        returnedChars: sliced.length,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        },
+    };
+}

package/dist/tools/web/http-fetch.js

@@ -0,0 +1,55 @@
+import { z } from "zod";
+const HttpFetchInputSchema = z.object({
+    url: z.string().url(),
+});
+export function createHttpFetchTool(options = {}) {
+    const timeoutMs = options.timeoutMs ?? 15000;
+    const userAgent = options.userAgent ??
+        "Mozilla/5.0 (compatible; XSimpleHttpFetch/1.0)";
+    return {
+        name: "http_fetch",
+        description: "Fetch a URL and return status, headers, final URL, and response text",
+        riskLevel: "safe",
+        inputSchema: HttpFetchInputSchema,
+        async execute(rawArgs) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                const args = HttpFetchInputSchema.parse(rawArgs);
+                const response = await fetch(args.url, {
+                    method: "GET",
+                    redirect: "follow",
+                    headers: {
+                        "User-Agent": userAgent,
+                        Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,text/plain;q=0.8,*/*;q=0.7",
+                    },
+                    signal: controller.signal,
+                });
+                const text = await response.text();
+                const headers = Object.fromEntries(response.headers.entries());
+                return {
+                    success: true,
+                    output: {
+                        url: args.url,
+                        finalUrl: response.url,
+                        ok: response.ok,
+                        status: response.status,
+                        statusText: response.statusText,
+                        headers,
+                        contentType: response.headers.get("content-type") ?? "",
+                        text,
+                    },
+                };
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}

package/dist/tools/web/index.js

@@ -0,0 +1,4 @@
+export { createHttpFetchTool } from "./http-fetch.js";
+export { createWebSearchTool } from "./web-search.js";
+export { createExtractReadableTextTool } from "./extract-readable-text.js";
+export { createBraveSearchProvider } from "./search-providers/brave.js";