@nordsym/apiclaw 1.8.7 → 1.8.9

package/src/mcp-analytics.ts

@@ -7,7 +7,7 @@ import { appendFileSync, existsSync, mkdirSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 import { ConvexHttpClient } from 'convex/browser';
-import { api } from '../convex/_generated/api.js';
+import { api } from './types/convex-api.js';
 
 export interface APICallLog {
   timestamp: string;

package/src/open-apis.ts

@@ -143,11 +143,105 @@ export const openAPIs: Record<string, OpenAPIConfig> = {
   },
 };
 
+/**
+ * Generic passthrough provider — proxy any open API without pre-configuration.
+ * Enables all 22,000+ indexed APIs to be callable on demand.
+ *
+ * Usage: call_api("generic", "request", {
+ *   url: "https://api.example.com/endpoint",
+ *   method: "GET",               // optional, default GET
+ *   query: { key: "value" },     // optional query params
+ *   body: { key: "value" },      // optional body (POST/PUT/PATCH)
+ *   headers: { "X-Foo": "bar" }, // optional extra headers
+ * })
+ */
+
+const SSRF_BLOCKLIST = [
+  /^https?:\/\/localhost/i,
+  /^https?:\/\/127\./,
+  /^https?:\/\/10\./,
+  /^https?:\/\/172\.(1[6-9]|2\d|3[01])\./,
+  /^https?:\/\/192\.168\./,
+  /^https?:\/\/169\.254\./,       // link-local / AWS metadata
+  /^https?:\/\/metadata\.google/i,
+  /^https?:\/\/\[::1\]/,          // IPv6 loopback
+];
+
+function isSsrfBlocked(url: string): boolean {
+  return SSRF_BLOCKLIST.some(r => r.test(url));
+}
+
+async function executeGeneric(
+  action: string,
+  params: Record<string, any>
+): Promise<{ success: boolean; provider: string; action: string; data?: any; error?: string }> {
+  const url: string = params.url;
+  if (!url) {
+    return { success: false, provider: 'generic', action, error: 'Missing required param: url' };
+  }
+
+  if (isSsrfBlocked(url)) {
+    return { success: false, provider: 'generic', action, error: 'URL is not allowed (private/internal range)' };
+  }
+
+  const method = (params.method || 'GET').toUpperCase();
+  const query: Record<string, string> = params.query || {};
+  const body = params.body;
+  const extraHeaders: Record<string, string> = params.headers || {};
+
+  // Build URL with query params
+  let finalUrl = url;
+  const qKeys = Object.keys(query);
+  if (qKeys.length > 0) {
+    const sep = url.includes('?') ? '&' : '?';
+    finalUrl = url + sep + qKeys.map(k => `${encodeURIComponent(k)}=${encodeURIComponent(query[k])}`).join('&');
+  }
+
+  const headers: Record<string, string> = {
+    'Accept': 'application/json',
+    'User-Agent': 'APIClaw/1.0 (+https://apiclaw.cloud)',
+    ...extraHeaders,
+  };
+
+  const fetchOpts: RequestInit = { method, headers };
+
+  if (body && ['POST', 'PUT', 'PATCH'].includes(method)) {
+    headers['Content-Type'] = 'application/json';
+    fetchOpts.body = JSON.stringify(body);
+  }
+
+  try {
+    const res = await fetch(finalUrl, fetchOpts);
+    const contentType = res.headers.get('content-type') || '';
+
+    let data: any;
+    if (contentType.includes('application/json')) {
+      data = await res.json();
+    } else {
+      data = await res.text();
+    }
+
+    if (!res.ok) {
+      return {
+        success: false,
+        provider: 'generic',
+        action,
+        error: `HTTP ${res.status}: ${res.statusText}`,
+        data,
+      };
+    }
+
+    return { success: true, provider: 'generic', action, data };
+  } catch (e: any) {
+    return { success: false, provider: 'generic', action, error: e.message || 'Request failed' };
+  }
+}
+
 /**
  * Check if a provider is an open API
  */
 export function isOpenAPI(providerId: string): boolean {
-  return providerId in openAPIs;
+  return providerId === 'generic' || providerId in openAPIs;
 }
 
 /**
@@ -165,8 +259,13 @@ export async function executeOpenAPI(
   action: string,
   params: Record<string, any>
 ): Promise<{ success: boolean; provider: string; action: string; data?: any; error?: string }> {
+  // Generic passthrough — proxy any open API on demand
+  if (providerId === 'generic') {
+    return await executeGeneric(action, params);
+  }
+
   const config = openAPIs[providerId];
-  
+
   if (!config) {
     return {
       success: false,
@@ -177,7 +276,7 @@ export async function executeOpenAPI(
   }
 
   const actionConfig = config.actions[action];
-  
+
   if (!actionConfig) {
     return {
       success: false,
@@ -188,6 +287,7 @@ export async function executeOpenAPI(
   }
 
   try {
+
     // Special handling for Kroki - use POST to get actual image data
     if (providerId === 'kroki') {
       const type = params.type || 'mermaid';
@@ -303,10 +403,20 @@ export async function executeOpenAPI(
  * List all open APIs with their actions
  */
 export function listOpenAPIs(): { provider: string; name: string; description: string; actions: string[] }[] {
-  return Object.entries(openAPIs).map(([id, config]) => ({
+  const curated = Object.entries(openAPIs).map(([id, config]) => ({
     provider: id,
     name: config.name,
     description: config.description,
     actions: Object.keys(config.actions),
   }));
+
+  return [
+    {
+      provider: 'generic',
+      name: 'Generic Passthrough',
+      description: 'Proxy any open/public API on demand. Supply url, method, query, body, headers. No pre-configuration needed — unlocks all 22,000+ indexed APIs.',
+      actions: ['request'],
+    },
+    ...curated,
+  ];
 }

package/src/types/convex-api.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Type shim for Convex generated API.
+ *
+ * Replaces the direct import from `../convex/_generated/api.js` which
+ * caused TypeScript to transitively process all convex/*.ts source files
+ * under the main tsconfig (NodeNext strict), producing hundreds of
+ * irrelevant errors. The convex/ directory has its own tsconfig
+ * (Bundler moduleResolution) and is compiled separately via `npx convex deploy`.
+ *
+ * If you add new api.X.Y usages in the codebase, add the shape here.
+ */
+
+declare const api: {
+  analytics: {
+    log: any;
+  };
+  [key: string]: any; // forward-compatible: won't break on new api.* usage
+};
+
+export { api };