@miphamai/cli 0.2.3

package/src/providers/openai-compat.ts

@@ -0,0 +1,158 @@
+import type {
+  ProviderConfig,
+  ModelInfo,
+  Message,
+  StreamChunk,
+  ContentBlock,
+} from '../shared/index.ts'
+import type { ProviderInstance, ChatRequest } from './registry'
+
+export class OpenAICompatProvider implements ProviderInstance {
+  constructor(public config: ProviderConfig) {}
+
+  async *chat(req: ChatRequest): AsyncGenerator<StreamChunk> {
+    const baseUrl = this.config.baseUrl?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
+    const apiKey = this.resolveApiKey(this.config.apiKey)
+
+    const body = {
+      model: req.model,
+      messages: this.convertMessages(req.messages, req.systemPrompt),
+      stream: true,
+      max_tokens: req.maxTokens,
+      temperature: req.temperature,
+      tools: req.tools?.map((t) => ({ type: 'function', function: t })),
+    }
+
+    const response = await fetch(`${baseUrl}/chat/completions`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify(body),
+    })
+
+    if (!response.ok) {
+      const errText = await response.text()
+      yield { type: 'error', error: `OpenAI API error ${response.status}: ${errText}` }
+      return
+    }
+
+    if (!response.body) {
+      yield { type: 'error', error: 'No response body' }
+      return
+    }
+
+    const reader = response.body.getReader()
+    const decoder = new TextDecoder()
+    let buffer = ''
+
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+
+      buffer += decoder.decode(value, { stream: true })
+      const lines = buffer.split('\n')
+      buffer = lines.pop() || ''
+
+      for (const line of lines) {
+        const trimmed = line.trim()
+        if (!trimmed || !trimmed.startsWith('data: ')) continue
+        const data = trimmed.slice(6)
+        if (data === '[DONE]') {
+          yield { type: 'stop' }
+          return
+        }
+
+        try {
+          const parsed = JSON.parse(data)
+          const choice = parsed.choices?.[0]
+          if (!choice) continue
+
+          const delta = choice.delta
+
+          if (delta?.tool_calls) {
+            for (const tc of delta.tool_calls) {
+              yield {
+                type: 'tool_use',
+                toolUse: {
+                  type: 'tool_use',
+                  id: tc.id || `call_${Date.now()}`,
+                  name: tc.function?.name || '',
+                  input: tc.function?.arguments ? JSON.parse(tc.function.arguments) : {},
+                },
+              }
+            }
+            continue
+          }
+
+          if (delta?.content) {
+            yield { type: 'text', content: delta.content }
+          }
+
+          if (choice.finish_reason === 'stop') {
+            yield { type: 'stop' }
+          }
+        } catch {
+          // skip unparseable chunks
+        }
+      }
+    }
+
+    yield { type: 'stop' }
+  }
+
+  async listModels(): Promise<ModelInfo[]> {
+    return this.config.models.filter((m) => m.status === 'active')
+  }
+
+  async healthCheck(): Promise<boolean> {
+    try {
+      const baseUrl = this.config.baseUrl?.replace(/\/+$/, '') || 'https://api.openai.com/v1'
+      const apiKey = this.resolveApiKey(this.config.apiKey)
+      const res = await fetch(`${baseUrl}/models`, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+      })
+      return res.ok
+    } catch {
+      return false
+    }
+  }
+
+  private convertMessages(
+    messages: Message[],
+    systemPrompt?: string,
+  ): { role: string; content: string | unknown[] }[] {
+    const result: { role: string; content: string | unknown[] }[] = []
+
+    if (systemPrompt) {
+      result.push({ role: 'system', content: systemPrompt })
+    }
+
+    for (const msg of messages) {
+      if (typeof msg.content === 'string') {
+        result.push({ role: msg.role, content: msg.content })
+      } else {
+        const parts: unknown[] = []
+        for (const block of msg.content) {
+          if (block.type === 'text') {
+            parts.push({ type: 'text', text: block.text })
+          } else if (block.type === 'image_url') {
+            parts.push({ type: 'image_url', image_url: block.image_url })
+          }
+        }
+        result.push({ role: msg.role, content: parts })
+      }
+    }
+
+    return result
+  }
+
+  private resolveApiKey(keyTemplate: string): string {
+    const match = keyTemplate.match(/^\$\{(.+)\}$/)
+    if (match?.[1]) {
+      return process.env[match[1]] || ''
+    }
+    return keyTemplate
+  }
+}

package/src/providers/registry.ts

@@ -0,0 +1,70 @@
+import type { ProviderConfig, ModelInfo, Message, StreamChunk } from '../shared/index.ts'
+
+export interface ProviderInstance {
+  config: ProviderConfig
+  chat(req: ChatRequest): AsyncGenerator<StreamChunk>
+  listModels(): Promise<ModelInfo[]>
+  healthCheck(): Promise<boolean>
+}
+
+export interface ChatRequest {
+  model: string
+  messages: Message[]
+  systemPrompt?: string
+  tools?: Record<string, unknown>[]
+  maxTokens?: number
+  temperature?: number
+}
+
+export class ProviderRegistry {
+  private providers = new Map<string, ProviderInstance>()
+  private activeProviderId: string
+  private activeModelId: string
+
+  constructor(providers: ProviderConfig[], defaultProvider: string, defaultModel: string) {
+    this.activeProviderId = defaultProvider
+    this.activeModelId = defaultModel
+  }
+
+  register(id: string, instance: ProviderInstance): void {
+    this.providers.set(id, instance)
+  }
+
+  get(id: string): ProviderInstance | undefined {
+    return this.providers.get(id)
+  }
+
+  getActive(): ProviderInstance {
+    const p = this.providers.get(this.activeProviderId)
+    if (!p) throw new Error(`Provider "${this.activeProviderId}" not registered`)
+    return p
+  }
+
+  getActiveModel(): string {
+    return this.activeModelId
+  }
+
+  switchProvider(providerId: string, modelId?: string): void {
+    if (!this.providers.has(providerId)) {
+      throw new Error(
+        `Provider "${providerId}" not registered. Available: ${this.listIds().join(', ')}`,
+      )
+    }
+    this.activeProviderId = providerId
+    if (modelId) this.activeModelId = modelId
+  }
+
+  listIds(): string[] {
+    return Array.from(this.providers.keys())
+  }
+
+  listModels(): ModelInfo[] {
+    const provider = this.getActive()
+    return provider.config.models.filter((m) => m.status === 'active')
+  }
+
+  async *chat(req: ChatRequest): AsyncGenerator<StreamChunk> {
+    const provider = this.getActive()
+    yield* provider.chat({ ...req, model: req.model || this.activeModelId })
+  }
+}

package/src/security/path.ts

@@ -0,0 +1,90 @@
+import { resolve, normalize } from 'node:path'
+import { realpathSync, existsSync } from 'node:fs'
+
+/**
+ * Sensitive system paths that tools should never access.
+ * Relative to filesystem root; checked after resolving symlinks.
+ */
+const BLOCKED_PATHS = ['/etc', '/proc', '/sys', '/dev', '/boot', '/root']
+
+/**
+ * Resolve a user-supplied path relative to cwd, with sandbox enforcement.
+ *
+ * Rules:
+ * - The resolved canonical path MUST be within `cwd` (or a subdirectory).
+ * - Symlinks are resolved via realpathSync so attackers can't use
+ *   `ln -s /etc project/foo` to escape the sandbox.
+ * - Sensitive system directories are always rejected.
+ * - If the path doesn't exist yet (e.g. for Write), we resolve its parent
+ *   directory and check that the target is still within cwd.
+ *
+ * @returns The safe canonical path.
+ * @throws {Error} with a human-readable message if the path is blocked.
+ */
+export function resolveSafe(cwd: string, inputPath: string): string {
+  const raw = resolve(cwd, inputPath)
+  const normalized = normalize(raw)
+
+  // Resolve symlinks if the path (or its parent) already exists on disk
+  let canonical: string
+  if (existsSync(normalized)) {
+    canonical = realpathSync(normalized)
+  } else {
+    // For paths that don't exist yet (e.g. Write tool creating a new file),
+    // walk up to find the first existing parent, resolve that, then
+    // reconstruct the full path.
+    const existingParent = findExistingParent(normalized)
+    if (!existingParent) {
+      throw new Error(`Path rejected: no existing parent directory found for "${inputPath}"`)
+    }
+    const realParent = realpathSync(existingParent)
+    const relative = normalized.slice(existingParent.length)
+    canonical = realParent + relative
+  }
+
+  // Normalize cwd as well (it may contain symlinks)
+  const realCwd = realpathSync(cwd)
+
+  // Check 1: must be within cwd
+  if (!isWithin(canonical, realCwd)) {
+    throw new Error(
+      `Path rejected: "${inputPath}" is outside the project workspace.\n` +
+        `Resolved: ${canonical}\nWorkspace: ${realCwd}`,
+    )
+  }
+
+  // Check 2: must not target sensitive system directories
+  for (const blocked of BLOCKED_PATHS) {
+    if (canonical === blocked || canonical.startsWith(blocked + '/')) {
+      throw new Error(
+        `Path rejected: "${inputPath}" resolves to a protected system directory (${blocked}).`,
+      )
+    }
+  }
+
+  return canonical
+}
+
+/**
+ * Find the first existing parent directory of a path.
+ * Returns undefined if no parent exists (shouldn't happen for valid paths).
+ */
+function findExistingParent(p: string): string | undefined {
+  let current = p
+  while (current.length > 1) {
+    const parent = current.slice(0, current.lastIndexOf('/')) || '/'
+    if (existsSync(parent)) return parent
+    current = parent
+  }
+  return undefined
+}
+
+/**
+ * Check if `child` is within `parent` (or equal to it).
+ */
+function isWithin(child: string, parent: string): boolean {
+  // Normalize trailing slashes for comparison
+  const c = child.endsWith('/') ? child.slice(0, -1) : child
+  const p = parent.endsWith('/') ? parent.slice(0, -1) : parent
+  return c === p || c.startsWith(p + '/')
+}

package/src/security/url.ts

@@ -0,0 +1,96 @@
+import dns from 'node:dns'
+const { lookupSync } = dns as unknown as {
+  lookupSync: (
+    hostname: string,
+    options?: { all?: boolean },
+  ) => Array<{ address: string; family: number }>
+}
+
+// ── Protocol allow-list ──
+const ALLOWED_PROTOCOLS = ['http:', 'https:']
+
+// ── IPv4 private / reserved ranges ──
+const IPV4_BLOCKED = [
+  { prefix: 0x7f000000, mask: 0xff000000 }, // 127.0.0.0/8   loopback
+  { prefix: 0x0a000000, mask: 0xff000000 }, // 10.0.0.0/8    private
+  { prefix: 0xac100000, mask: 0xfff00000 }, // 172.16.0.0/12 private
+  { prefix: 0xc0a80000, mask: 0xffff0000 }, // 192.168.0.0/16 private
+  { prefix: 0x00000000, mask: 0xff000000 }, // 0.0.0.0/8     "this network"
+  { prefix: 0xa9fe0000, mask: 0xffff0000 }, // 169.254.0.0/16 link-local
+]
+
+/** Validate a URL for SSRF safety. Returns null if safe, or an error string. */
+export function validateUrl(urlStr: string): string | null {
+  let parsed: URL
+  try {
+    parsed = new URL(urlStr)
+  } catch {
+    return `Invalid URL: "${urlStr}"`
+  }
+
+  // 1. Protocol allow-list
+  if (!ALLOWED_PROTOCOLS.includes(parsed.protocol)) {
+    return `URL protocol "${parsed.protocol}" is not allowed. Only http: and https: are permitted.`
+  }
+
+  // Hostname may include brackets for IPv6 (e.g. "[::1]") — strip them for checks
+  const hostname = parsed.hostname
+
+  // 2. Check for raw IPv4 in hostname
+  if (isBlockedIPv4(hostname)) {
+    return `URL hostname "${hostname}" resolves to a blocked IP range (private / loopback / link-local).`
+  }
+
+  // 3. Check for raw IPv6 loopback / private
+  // Strip brackets from IPv6 hostnames (Bun's URL parser keeps them)
+  const ipv6Host = hostname.startsWith('[') ? hostname.slice(1, -1) : hostname
+  if (isBlockedIPv6(ipv6Host)) {
+    return `URL hostname "${hostname}" resolves to a blocked IPv6 address.`
+  }
+
+  // 4. DNS rebinding protection: resolve hostname and check resolved IPs
+  // Use the bracket-less version for DNS lookups
+  const dnsHostname = hostname.startsWith('[') ? hostname.slice(1, -1) : hostname
+  try {
+    const addresses = lookupSync(dnsHostname, { all: true })
+    for (const addr of addresses) {
+      if (isBlockedIPv4(addr.address)) {
+        return `URL hostname "${hostname}" resolved to ${addr.address} (blocked IP range).`
+      }
+      if (isBlockedIPv6(addr.address)) {
+        return `URL hostname "${hostname}" resolved to ${addr.address} (blocked IPv6 address).`
+      }
+    }
+  } catch {
+    // DNS resolution failed — that's OK for validation; the fetch will also fail
+  }
+
+  return null // safe
+}
+
+function isBlockedIPv4(ip: string): boolean {
+  // Skip if it's not an IPv4 string
+  const parts = ip.split('.')
+  if (parts.length !== 4) return false
+
+  const nums = parts.map((p) => parseInt(p, 10))
+  if (nums.some((n) => isNaN(n) || n < 0 || n > 255)) return false
+
+  // Use >>> 0 to avoid signed 32-bit overflow for octets > 127
+  const asInt = ((nums[0]! << 24) | (nums[1]! << 16) | (nums[2]! << 8) | nums[3]!) >>> 0
+
+  return IPV4_BLOCKED.some(({ prefix, mask }) => (asInt & mask) >>> 0 === prefix >>> 0)
+}
+
+function isBlockedIPv6(ip: string): boolean {
+  // IPv6 loopback
+  if (ip === '::1' || ip === '0:0:0:0:0:0:0:1') return true
+  // IPv6 link-local (fe80::/10)
+  if (ip.startsWith('fe8') || ip.startsWith('fe9') || ip.startsWith('fea') || ip.startsWith('feb'))
+    return true
+  // IPv6 unique local (fc00::/7)
+  if (ip.startsWith('fc') || ip.startsWith('fd')) return true
+  // IPv6 unspecified
+  if (ip === '::' || ip === '0:0:0:0:0:0:0:0') return true
+  return false
+}