@miphamai/cli 0.38.0 → 0.39.0

package/src/security/url.ts

@@ -1,10 +1,4 @@
 import dns from 'node:dns'
-const { lookupSync } = dns as unknown as {
-  lookupSync: (
-    hostname: string,
-    options?: { all?: boolean },
-  ) => Array<{ address: string; family: number }>
-}
 
 // ── Protocol allow-list ──
 const ALLOWED_PROTOCOLS = ['http:', 'https:']
@@ -20,7 +14,7 @@ const IPV4_BLOCKED = [
 ]
 
 /** Validate a URL for SSRF safety. Returns null if safe, or an error string. */
-export function validateUrl(urlStr: string): string | null {
+export async function validateUrl(urlStr: string): Promise<string | null> {
   let parsed: URL
   try {
     parsed = new URL(urlStr)
@@ -41,18 +35,17 @@ export function validateUrl(urlStr: string): string | null {
     return `URL hostname "${hostname}" resolves to a blocked IP range (private / loopback / link-local).`
   }
 
-  // 3. Check for raw IPv6 loopback / private
-  // Strip brackets from IPv6 hostnames (Bun's URL parser keeps them)
+  // 3. Check for raw IPv6 loopback / private / IPv4-mapped
   const ipv6Host = hostname.startsWith('[') ? hostname.slice(1, -1) : hostname
   if (isBlockedIPv6(ipv6Host)) {
     return `URL hostname "${hostname}" resolves to a blocked IPv6 address.`
   }
 
-  // 4. DNS rebinding protection: resolve hostname and check resolved IPs
-  // Use the bracket-less version for DNS lookups
-  const dnsHostname = hostname.startsWith('[') ? hostname.slice(1, -1) : hostname
+  // 4. DNS rebinding protection: resolve hostname and check resolved IPs.
+  //    Uses async dns.promises.lookup — the old sync `dns.lookupSync` never existed,
+  //    so this check was previously dead code (always threw → swallowed → "safe").
   try {
-    const addresses = lookupSync(dnsHostname, { all: true })
+    const addresses = await dns.promises.lookup(ipv6Host, { all: true })
     for (const addr of addresses) {
       if (isBlockedIPv4(addr.address)) {
         return `URL hostname "${hostname}" resolved to ${addr.address} (blocked IP range).`
@@ -62,7 +55,7 @@ export function validateUrl(urlStr: string): string | null {
       }
     }
   } catch {
-    // DNS resolution failed — that's OK for validation; the fetch will also fail
+    // DNS resolution failed — the subsequent fetch will fail too; treat as safe.
   }
 
   return null // safe
@@ -92,5 +85,35 @@ function isBlockedIPv6(ip: string): boolean {
   if (ip.startsWith('fc') || ip.startsWith('fd')) return true
   // IPv6 unspecified
   if (ip === '::' || ip === '0:0:0:0:0:0:0:0') return true
+
+  // IPv4-mapped (::ffff:a.b.c.d / ::ffff:xxxx:xxxx) and IPv4-compatible (::a.b.c.d / ::xxxx:xxxx)
+  // — these can smuggle a private IPv4 past the literal-IPv6 checks above.
+  const embedded = extractEmbeddedIPv4(ip)
+  if (embedded && isBlockedIPv4(embedded)) return true
+
   return false
 }
+
+/** Extract the IPv4 address embedded in an IPv4-mapped / IPv4-compatible IPv6 address. */
+function extractEmbeddedIPv4(ip: string): string | null {
+  let rest: string | null = null
+  const mapped = ip.match(/^::ffff:(.+)$/i)
+  const compat = ip.match(/^::([0-9a-fA-F]{1,4}):([0-9a-fA-F]{1,4})$/)
+  if (mapped) {
+    rest = mapped[1]!
+  } else if (compat) {
+    rest = `${compat[1]}:${compat[2]}`
+  } else {
+    return null
+  }
+
+  // Dotted-quad form (::ffff:127.0.0.1)
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(rest)) return rest
+
+  // Hex form (::ffff:7f00:1)
+  const hex = rest.match(/^([0-9a-fA-F]{1,4}):([0-9a-fA-F]{1,4})$/)
+  if (!hex) return null
+  const hi = parseInt(hex[1]!, 16)
+  const lo = parseInt(hex[2]!, 16)
+  return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`
+}

package/src/shared/constants.ts

@@ -1,486 +1,4 @@
-import type { ProviderConfig } from './types'
-
-// Providers: alphabetical by id. Models: Lite/Flash → Text → Vision → Code → Pro/Think
-export const DEFAULT_PROVIDERS: ProviderConfig[] = [
-  {
-    id: 'anthropic',
-    name: 'Anthropic Claude',
-    protocol: 'anthropic',
-    apiKey: '${ANTHROPIC_API_KEY}',
-    models: [
-      {
-        id: 'claude-haiku-4-5-20251001',
-        name: 'Claude Haiku 4.5',
-        providerId: 'anthropic',
-        contextWindow: 200_000,
-        maxOutput: 32_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'claude-sonnet-4-6',
-        name: 'Claude Sonnet 4.6',
-        providerId: 'anthropic',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'claude-opus-4-8',
-        name: 'Claude Opus 4.8',
-        providerId: 'anthropic',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'claude-fable-5',
-        name: 'Claude Fable 5',
-        providerId: 'anthropic',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'claude-sonnet-5',
-        name: 'Claude Sonnet 5',
-        providerId: 'anthropic',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'claude-opus-5',
-        name: 'Claude Opus 5',
-        providerId: 'anthropic',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-    ],
-  },
-  {
-    id: 'deepseek',
-    name: 'DeepSeek',
-    protocol: 'openai-compatible',
-    baseUrl: 'https://api.deepseek.com/v1',
-    apiKey: '${DEEPSEEK_API_KEY}',
-    models: [
-      {
-        id: 'deepseek-v4-flash',
-        name: 'DeepSeek V4 Flash',
-        providerId: 'deepseek',
-        contextWindow: 1_000_000,
-        maxOutput: 384_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'deepseek-v4-pro',
-        name: 'DeepSeek V4 Pro',
-        providerId: 'deepseek',
-        contextWindow: 1_000_000,
-        maxOutput: 384_000,
-        vision: false,
-        status: 'active',
-      },
-    ],
-  },
-  {
-    id: 'google',
-    name: 'Google Gemini',
-    protocol: 'openai-compatible',
-    baseUrl: 'https://generativelanguage.googleapis.com/v1beta/openai',
-    apiKey: '${GEMINI_API_KEY}',
-    models: [
-      {
-        id: 'gemini-3.0-flash',
-        name: 'Gemini 3.0 Flash',
-        providerId: 'google',
-        contextWindow: 1_000_000,
-        maxOutput: 64_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'gemini-3.0-pro',
-        name: 'Gemini 3.0 Pro',
-        providerId: 'google',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'gemini-2.5-pro',
-        name: 'Gemini 2.5 Pro',
-        providerId: 'google',
-        contextWindow: 1_000_000,
-        maxOutput: 64_000,
-        vision: true,
-        status: 'active',
-      },
-    ],
-  },
-  {
-    id: 'doubao',
-    name: '豆包 (字节跳动)',
-    protocol: 'openai-compatible',
-    baseUrl: 'https://ark.cn-beijing.volces.com/api/v3',
-    apiKey: '${DOUBAO_API_KEY}',
-    models: [
-      {
-        id: 'doubao-seed-1.6-flash',
-        name: '豆包 Seed 1.6 Flash',
-        providerId: 'doubao',
-        contextWindow: 256_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'doubao-seed-2.0-mini',
-        name: '豆包 Seed 2.0 Mini',
-        providerId: 'doubao',
-        contextWindow: 256_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'doubao-seed-2.0-lite',
-        name: '豆包 Seed 2.0 Lite',
-        providerId: 'doubao',
-        contextWindow: 256_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'doubao-seed-1.6',
-        name: '豆包 Seed 1.6',
-        providerId: 'doubao',
-        contextWindow: 256_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'doubao-seed-2.0-pro',
-        name: '豆包 Seed 2.0 Pro',
-        providerId: 'doubao',
-        contextWindow: 256_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'doubao-seed-2.0-code',
-        name: '豆包 Seed 2.0 Code',
-        providerId: 'doubao',
-        contextWindow: 256_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-    ],
-  },
-  {
-    id: 'hunyuan',
-    name: '腾讯混元',
-    protocol: 'openai-compatible',
-    baseUrl: 'https://api.hunyuan.cloud.tencent.com/v1',
-    apiKey: '${HUNYUAN_API_KEY}',
-    models: [
-      {
-        id: 'hunyuan-lite',
-        name: '混元 Lite (免费)',
-        providerId: 'hunyuan',
-        contextWindow: 256_000,
-        maxOutput: 6_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'hunyuan-turbos-latest',
-        name: '混元 TurboS',
-        providerId: 'hunyuan',
-        contextWindow: 32_000,
-        maxOutput: 16_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'hunyuan-2.0-instruct-20251111',
-        name: '混元 2.0 Instruct',
-        providerId: 'hunyuan',
-        contextWindow: 144_000,
-        maxOutput: 16_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'hunyuan-t1-vision-20250916',
-        name: '混元 T1 Vision',
-        providerId: 'hunyuan',
-        contextWindow: 32_000,
-        maxOutput: 64_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'hunyuan-a13b',
-        name: '混元 A13B',
-        providerId: 'hunyuan',
-        contextWindow: 224_000,
-        maxOutput: 32_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'hunyuan-2.0-thinking-20251109',
-        name: '混元 2.0 Think',
-        providerId: 'hunyuan',
-        contextWindow: 192_000,
-        maxOutput: 64_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'hunyuan-t1-latest',
-        name: '混元 T1 (推理)',
-        providerId: 'hunyuan',
-        contextWindow: 32_000,
-        maxOutput: 64_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'hy3-preview',
-        name: '混元 Hy3 Preview',
-        providerId: 'hunyuan',
-        contextWindow: 256_000,
-        maxOutput: 128_000,
-        vision: false,
-        status: 'active',
-      },
-    ],
-  },
-  {
-    id: 'kimi',
-    name: 'Kimi (月之暗面)',
-    protocol: 'openai-compatible',
-    baseUrl: 'https://api.moonshot.cn/v1',
-    apiKey: '${KIMI_API_KEY}',
-    models: [
-      {
-        id: 'kimi-latest',
-        name: 'Kimi Latest',
-        providerId: 'kimi',
-        contextWindow: 128_000,
-        maxOutput: 16_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'kimi-k3',
-        name: 'Kimi K3',
-        providerId: 'kimi',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'moonshot-v1-8k',
-        name: 'Moonshot v1 8K',
-        providerId: 'kimi',
-        contextWindow: 8_000,
-        maxOutput: 4_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'moonshot-v1-32k',
-        name: 'Moonshot v1 32K',
-        providerId: 'kimi',
-        contextWindow: 32_000,
-        maxOutput: 4_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'moonshot-v1-128k',
-        name: 'Moonshot v1 128K',
-        providerId: 'kimi',
-        contextWindow: 128_000,
-        maxOutput: 4_000,
-        vision: false,
-        status: 'active',
-      },
-    ],
-  },
-  {
-    id: 'mipham',
-    name: 'MiphamAI',
-    protocol: 'openai-compatible',
-    baseUrl: 'http://127.0.0.1:8080/v1', // Engine 本地端点（om-V5 生产部署待定）
-    apiKey: '${MIPHAM_API_KEY}',
-    models: [
-      {
-        id: 'om-v5-flash',
-        name: 'OM V5 Flash',
-        providerId: 'mipham',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'om-v5-pro',
-        name: 'OM V5 Pro',
-        providerId: 'mipham',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: false,
-        status: 'active',
-      },
-      {
-        id: 'om-v5-visual',
-        name: 'OM V5 Visual',
-        providerId: 'mipham',
-        contextWindow: 200_000,
-        maxOutput: 32_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'om-v5-apex',
-        name: 'OM V5 Apex',
-        providerId: 'mipham',
-        contextWindow: 1_000_000,
-        maxOutput: 128_000,
-        vision: false,
-        status: 'active',
-      },
-    ],
-    status: 'active',
-  },
-  {
-    id: 'ollama',
-    name: 'Ollama (本地)',
-    protocol: 'openai-compatible' as const,
-    baseUrl: 'http://localhost:11434/v1',
-    apiKey: 'ollama-local',
-    models: [], // 动态发现，初值为空
-  },
-  {
-    id: 'openai',
-    name: 'OpenAI',
-    protocol: 'openai-compatible',
-    baseUrl: 'https://api.openai.com/v1',
-    apiKey: '${OPENAI_API_KEY}',
-    models: [
-      {
-        id: 'gpt-5.4-mini',
-        name: 'GPT-5.4 Mini',
-        providerId: 'openai',
-        contextWindow: 400_000,
-        maxOutput: 32_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'gpt-5.4',
-        name: 'GPT-5.4',
-        providerId: 'openai',
-        contextWindow: 1_050_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'gpt-5.5',
-        name: 'GPT-5.5',
-        providerId: 'openai',
-        contextWindow: 1_050_000,
-        maxOutput: 128_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'gpt-5.3-codex',
-        name: 'GPT-5.3 Codex',
-        providerId: 'openai',
-        contextWindow: 400_000,
-        maxOutput: 64_000,
-        vision: false,
-        status: 'active',
-      },
-    ],
-  },
-  {
-    id: 'qwen',
-    name: '通义千问',
-    protocol: 'openai-compatible',
-    baseUrl: 'https://dashscope.aliyuncs.com/compatible-mode/v1',
-    apiKey: '${QWEN_API_KEY}',
-    models: [
-      {
-        id: 'qwen-plus',
-        name: 'Qwen Plus',
-        providerId: 'qwen',
-        contextWindow: 128_000,
-        maxOutput: 32_000,
-        vision: true,
-        status: 'active',
-      },
-      {
-        id: 'qwen-max',
-        name: 'Qwen Max',
-        providerId: 'qwen',
-        contextWindow: 128_000,
-        maxOutput: 32_000,
-        vision: true,
-        status: 'active',
-      },
-    ],
-  },
-]
-
-export const PROTOCOL_LABELS: Record<string, string> = {
-  'openai-compatible': 'OpenAI Compatible',
-  anthropic: 'Anthropic',
-  custom: 'Custom Protocol',
-}
-
-export const TOOL_CATEGORIES = ['file', 'exec', 'agent', 'network', 'system', 'artifact'] as const
-
-/** 预置 Ollama 模型 — 与 ollama list 结果合并去重后展示 */
-export const OLLAMA_PRESET_MODELS = [
-  { id: 'om-v5-flash', source: 'MiphamAI' },
-  { id: 'om-v5-pro', source: 'MiphamAI' },
-  { id: 'om-v5-visual', source: 'MiphamAI' },
-  { id: 'om-v5-apex', source: 'MiphamAI' },
-  { id: 'deepseek-r1:70b', source: '热门' },
-  { id: 'deepseek-v3', source: '热门' },
-  { id: 'qwen2.5:72b', source: '热门' },
-  { id: 'qwen3', source: '热门' },
-] as const
-
-export const CONFIG_FILE_NAME = 'config.yml'
-export const MIPHAM_DIR = '.mipham'
-export const USER_CONFIG_DIR = '.mipham'
-export const MEMORY_DIR = 'memory'
-
-// ── Artifact Constants ──
-export const ARTIFACTS_DIR = 'artifacts'
-export const ARTIFACT_PORT = 9876
-export const ARTIFACT_MAX_PORT_TRIES = 10
-export const ARTIFACT_MAX_SIZE = 5 * 1024 * 1024 // 5MB
-export const ARTIFACT_ALLOWED_EXTENSIONS = ['.html', '.svg']
+// ── 常量唯一真源：@mipham/shared/constants ──
+// DEFAULT_PROVIDERS / PROTOCOL_LABELS / TOOL_CATEGORIES / OLLAMA_PRESET_MODELS
+// 及路径（.mipham/memory）/Artifact 常量均在此包，CLI 直接 re-export。
+export * from '@mipham/shared/constants'