@renxqoo/renx-code 0.0.3 → 0.0.5

package/vendor/agent-root/src/agent/tool/types.ts

@@ -0,0 +1,116 @@
+/* v8 ignore file */
+/* c8 ignore file */
+export interface Tool {
+  name: string;
+  description: string;
+  parameters: unknown;
+}
+
+export interface LLMTool {
+  type: 'function';
+  function: Tool;
+}
+
+export interface ToolCallFunction {
+  name: string;
+  arguments: string;
+}
+
+export interface ToolCall {
+  id: string;
+  type: string;
+  index: number;
+  function: ToolCallFunction;
+}
+
+export interface ToolStreamChunk {
+  type: 'stdout' | 'stderr' | 'progress';
+  data: string;
+}
+
+export interface ToolConfirmInfo {
+  toolCallId: string;
+  toolName: string;
+  arguments: string;
+  reason?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface ToolDecision {
+  approved: boolean;
+  message?: string;
+}
+
+export interface ToolPolicyCheckInfo {
+  toolCallId: string;
+  toolName: string;
+  arguments: string;
+  parsedArguments: Record<string, unknown>;
+}
+
+export interface ToolPolicyDecision {
+  allowed: boolean;
+  code?: string;
+  message?: string;
+  audit?: Record<string, unknown>;
+}
+
+export type ToolConcurrencyMode = 'parallel-safe' | 'exclusive';
+
+export interface ToolConcurrencyPolicy {
+  mode: ToolConcurrencyMode;
+  lockKey?: string;
+}
+
+/**
+ * 工具流式事件类型
+ */
+export type ToolStreamEventType =
+  | 'start'
+  | 'stdout'
+  | 'stderr'
+  | 'progress'
+  | 'artifact'
+  | 'info'
+  | 'end'
+  | 'error';
+
+/**
+ * 工具事件输入
+ */
+export interface ToolStreamEventInput {
+  /** 事件类型 */
+  type: ToolStreamEventType;
+  /** 文本内容 */
+  content?: string;
+  /** 结构化数据 */
+  data?: unknown;
+  /** 自定义序号（可选） */
+  sequence?: number;
+  /** 自定义时间戳（可选） */
+  timestamp?: number;
+}
+
+/**
+ * 工具执行上下文
+ *
+ * 传递给工具执行时的上下文信息
+ */
+export interface ToolExecutionContext {
+  /** 工具调用 ID */
+  toolCallId: string;
+  /** 循环索引 */
+  loopIndex: number;
+  /** Agent 实例引用 */
+  agent: unknown;
+  /** 工具流式事件发射器（可选） */
+  onChunk?: (event: ToolStreamEventInput) => void | Promise<void>;
+  onConfirm?: (info: ToolConfirmInfo) => Promise<ToolDecision>;
+  onPolicyCheck?: (info: ToolPolicyCheckInfo) => ToolPolicyDecision | Promise<ToolPolicyDecision>;
+  /** 当前调用是否已通过用户确认 */
+  confirmationApproved?: boolean;
+  /** 工具执行中断信号（超时/取消时触发） */
+  toolAbortSignal?: AbortSignal;
+}
+
+export const AGENT_TOOL_TYPES_MODULE = 'renx-tool-types';

package/vendor/agent-root/src/agent/tool/web-fetch.ts

@@ -0,0 +1,227 @@
+import { z } from 'zod';
+import { BaseTool, ToolResult } from './base-tool';
+import { ToolExecutionError } from './error';
+import { WEB_FETCH_TOOL_DESCRIPTION } from './tool-prompts';
+import type { ToolExecutionContext } from './types';
+
+// 安全常量
+const MAX_RESPONSE_SIZE = 5 * 1024 * 1024; // 5MB
+const DEFAULT_TIMEOUT_MS = 30_000;
+const MAX_TIMEOUT_MS = 120_000;
+
+// SSRF 防护：禁止访问的地址模式
+const BLOCKED_HOST_PATTERNS: RegExp[] = [
+  // localhost 和回环地址
+  /^(localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\])$/i,
+  // 内网 IP
+  /^10\./,
+  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
+  /^192\.168\./,
+  // 链路本地和云元数据地址
+  /^169\.254\./,
+  /^(metadata\.google\.internal|metadata\.azure|169\.254\.169\.254)$/i,
+];
+
+/**
+ * 检查 URL 是否为内网或敏感地址（SSRF 防护）
+ */
+function isBlockedAddress(url: string): { blocked: boolean; reason?: string } {
+  try {
+    const parsed = new URL(url);
+    const hostname = parsed.hostname.toLowerCase();
+
+    for (const pattern of BLOCKED_HOST_PATTERNS) {
+      if (pattern.test(hostname)) {
+        return { blocked: true, reason: `Blocked address: ${hostname}` };
+      }
+    }
+
+    // 检查协议
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+      return { blocked: true, reason: `Unsupported protocol: ${parsed.protocol}` };
+    }
+
+    return { blocked: false };
+  } catch {
+    return { blocked: true, reason: 'Invalid URL format' };
+  }
+}
+
+/**
+ * 安全地截断输出，避免内存溢出
+ */
+function truncateOutput(
+  content: string,
+  maxLength: number
+): { output: string; truncated: boolean } {
+  if (content.length <= maxLength) {
+    return { output: content, truncated: false };
+  }
+
+  const marker = '\n\n[... Content Truncated ...]\n\n';
+  const available = maxLength - marker.length;
+  if (available <= 100) {
+    return { output: content.slice(0, maxLength), truncated: true };
+  }
+
+  const headLength = Math.floor(available * 0.7);
+  const tailLength = available - headLength;
+
+  return {
+    output: content.slice(0, headLength) + marker + content.slice(content.length - tailLength),
+    truncated: true,
+  };
+}
+
+/**
+ * 简单的 HTML 到纯文本转换（无外部依赖）
+ */
+function htmlToText(html: string): string {
+  let text = html;
+  // 移除 script 和 style 标签
+  text = text.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, '');
+  text = text.replace(/<style[^>]*>[\s\S]*?<\/style>/gi, '');
+  // 移除 HTML 标签
+  text = text.replace(/<[^>]+>/g, ' ');
+  // 解码常见 HTML 实体
+  const entities: Record<string, string> = {
+    '&nbsp;': ' ',
+    '&amp;': '&',
+    '&lt;': '<',
+    '&gt;': '>',
+    '&quot;': '"',
+    '&#39;': "'",
+    '&apos;': "'",
+  };
+  for (const [entity, char] of Object.entries(entities)) {
+    text = text.replace(new RegExp(entity, 'g'), char);
+  }
+  // 清理多余空白
+  return text.replace(/\s+/g, ' ').trim();
+}
+
+const schema = z
+  .object({
+    url: z.string().url().describe('The URL to fetch'),
+    extractMode: z
+      .enum(['text', 'markdown', 'html'])
+      .default('text')
+      .describe('Content extraction mode: text (plain text), markdown (simplified), or html (raw)'),
+    maxChars: z
+      .number()
+      .int()
+      .min(100)
+      .max(100_000)
+      .default(30_000)
+      .describe('Maximum characters to return'),
+    timeout: z
+      .number()
+      .int()
+      .min(1000)
+      .max(MAX_TIMEOUT_MS)
+      .default(DEFAULT_TIMEOUT_MS)
+      .describe('Request timeout in milliseconds'),
+  })
+  .strict();
+
+export class WebFetchTool extends BaseTool<typeof schema> {
+  readonly name = 'web_fetch';
+  readonly description = WEB_FETCH_TOOL_DESCRIPTION;
+  readonly parameters = schema;
+
+  async execute(
+    args: z.input<typeof schema>,
+    _context?: ToolExecutionContext
+  ): Promise<ToolResult> {
+    // Apply defaults (zod defaults may not be applied when calling execute directly)
+    const url = args.url;
+    const extractMode = args.extractMode ?? 'text';
+    const maxChars = args.maxChars ?? 30_000;
+    const timeout = args.timeout ?? DEFAULT_TIMEOUT_MS;
+
+    // SSRF 防护检查
+    const blockCheck = isBlockedAddress(url);
+    if (blockCheck.blocked) {
+      throw new ToolExecutionError(`Security: ${blockCheck.reason}`, 2010);
+    }
+
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+
+    try {
+      const response = await fetch(url, {
+        signal: controller.signal,
+        headers: {
+          'User-Agent': 'Mozilla/5.0 (compatible; AgentBot/1.0)',
+          Accept: 'text/html,text/plain,application/json,*/*',
+        },
+        redirect: 'follow',
+      });
+
+      if (!response.ok) {
+        throw new ToolExecutionError(`HTTP ${response.status}: ${response.statusText}`, 2011);
+      }
+
+      // 检查内容大小
+      const contentLength = response.headers.get('content-length');
+      if (contentLength && parseInt(contentLength) > MAX_RESPONSE_SIZE) {
+        throw new ToolExecutionError(
+          `Response too large: ${contentLength} bytes exceeds limit of ${MAX_RESPONSE_SIZE}`,
+          2012
+        );
+      }
+
+      const contentType = response.headers.get('content-type') || '';
+      let body = await response.text();
+
+      // 限制响应大小
+      if (body.length > MAX_RESPONSE_SIZE) {
+        body = body.slice(0, MAX_RESPONSE_SIZE);
+      }
+
+      // 根据模式提取内容
+      let extractedContent: string;
+      switch (extractMode) {
+        case 'html':
+          extractedContent = body;
+          break;
+        case 'markdown':
+        case 'text':
+        default:
+          extractedContent = htmlToText(body);
+          break;
+      }
+
+      // 截断到指定长度
+      const { output, truncated } = truncateOutput(extractedContent, maxChars);
+
+      return {
+        success: true,
+        output: `URL: ${url}\nContent-Type: ${contentType}\nExtracted: ${extractMode}\n${truncated ? '(Content truncated)\n' : ''}\n${output}`,
+        metadata: {
+          url,
+          contentType,
+          extractMode,
+          truncated,
+          originalLength: extractedContent.length,
+          returnedLength: output.length,
+        },
+      };
+    } catch (error) {
+      if (error instanceof ToolExecutionError) {
+        throw error;
+      }
+      if (error instanceof Error && error.name === 'AbortError') {
+        throw new ToolExecutionError(`Request timeout after ${timeout}ms`, 2013);
+      }
+      throw new ToolExecutionError(
+        `Fetch failed: ${error instanceof Error ? error.message : String(error)}`,
+        2014
+      );
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+}
+
+export default WebFetchTool;

package/vendor/agent-root/src/agent/tool/web-search.ts

@@ -0,0 +1,208 @@
+import { z } from 'zod';
+import { BaseTool, ToolResult } from './base-tool';
+import { ToolExecutionError } from './error';
+import { WEB_SEARCH_TOOL_DESCRIPTION } from './tool-prompts';
+import type { ToolExecutionContext } from './types';
+
+// 搜索结果接口
+interface SearchResult {
+  title: string;
+  url: string;
+  snippet: string;
+  score?: number;
+}
+
+interface SearchResponse {
+  query: string;
+  results: SearchResult[];
+  provider: string;
+}
+
+/**
+ * Tavily 搜索实现
+ */
+async function searchWithTavily(query: string, maxResults: number): Promise<SearchResponse> {
+  const apiKey = process.env.TAVILY_API_KEY;
+  if (!apiKey) {
+    throw new ToolExecutionError('TAVILY_API_KEY environment variable is not set', 2020);
+  }
+
+  const response = await fetch('https://api.tavily.com/search', {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${apiKey}`,
+    },
+    body: JSON.stringify({
+      query,
+      max_results: maxResults,
+      search_depth: 'basic',
+      include_answer: false,
+      include_raw_content: false,
+    }),
+  });
+
+  if (!response.ok) {
+    throw new ToolExecutionError(
+      `Tavily API error: ${response.status} ${response.statusText}`,
+      2021
+    );
+  }
+
+  const data = (await response.json()) as {
+    query?: string;
+    results?: Array<{ title?: string; url?: string; content?: string; score?: number }>;
+  };
+
+  return {
+    query: data.query || query,
+    provider: 'tavily',
+    results: (data.results || []).map((r) => ({
+      title: r.title || 'No title',
+      url: r.url || '',
+      snippet: r.content || '',
+      score: r.score,
+    })),
+  };
+}
+
+/**
+ * Brave Search 实现
+ */
+async function searchWithBrave(query: string, maxResults: number): Promise<SearchResponse> {
+  const apiKey = process.env.BRAVE_SEARCH_API_KEY;
+  if (!apiKey) {
+    throw new ToolExecutionError('BRAVE_SEARCH_API_KEY environment variable is not set', 2022);
+  }
+
+  const url = new URL('https://api.search.brave.com/res/v1/web/search');
+  url.searchParams.set('q', query);
+  url.searchParams.set('count', String(maxResults));
+
+  const response = await fetch(url.toString(), {
+    headers: {
+      Accept: 'application/json',
+      'Accept-Encoding': 'identity',
+      'X-Subscription-Token': apiKey,
+    },
+  });
+
+  if (!response.ok) {
+    throw new ToolExecutionError(
+      `Brave Search API error: ${response.status} ${response.statusText}`,
+      2023
+    );
+  }
+
+  const data = (await response.json()) as {
+    query?: { original?: string };
+    web?: { results?: Array<{ title?: string; url?: string; description?: string }> };
+  };
+
+  return {
+    query: data.query?.original || query,
+    provider: 'brave',
+    results: (data.web?.results || []).map((r) => ({
+      title: r.title || 'No title',
+      url: r.url || '',
+      snippet: r.description || '',
+    })),
+  };
+}
+
+/**
+ * 根据可用的 API Key 选择搜索提供商
+ */
+function getSearchProvider(): 'tavily' | 'brave' {
+  if (process.env.TAVILY_API_KEY) return 'tavily';
+  if (process.env.BRAVE_SEARCH_API_KEY) return 'brave';
+  throw new ToolExecutionError(
+    'No search API key configured. Set TAVILY_API_KEY or BRAVE_SEARCH_API_KEY environment variable.',
+    2024
+  );
+}
+
+const schema = z
+  .object({
+    query: z.string().min(1).max(500).describe('Search query'),
+    maxResults: z
+      .number()
+      .int()
+      .min(1)
+      .max(10)
+      .default(5)
+      .describe('Maximum number of results (1-10)'),
+    provider: z
+      .enum(['tavily', 'brave', 'auto'])
+      .default('auto')
+      .describe('Search provider: tavily, brave, or auto (uses first available)'),
+  })
+  .strict();
+
+export class WebSearchTool extends BaseTool<typeof schema> {
+  readonly name = 'web_search';
+  readonly description = WEB_SEARCH_TOOL_DESCRIPTION;
+  readonly parameters = schema;
+
+  async execute(
+    args: z.input<typeof schema>,
+    _context?: ToolExecutionContext
+  ): Promise<ToolResult> {
+    // Apply defaults (zod defaults may not be applied when calling execute directly)
+    const query = args.query;
+    const maxResults = args.maxResults ?? 5;
+    const provider = args.provider ?? 'auto';
+
+    // 确定使用的搜索提供商
+    const selectedProvider = provider === 'auto' ? getSearchProvider() : provider;
+
+    // 执行搜索
+    let response: SearchResponse;
+    switch (selectedProvider) {
+      case 'tavily':
+        response = await searchWithTavily(query, maxResults);
+        break;
+      case 'brave':
+        response = await searchWithBrave(query, maxResults);
+        break;
+      default:
+        throw new ToolExecutionError(`Unknown search provider: ${selectedProvider}`, 2025);
+    }
+
+    // 格式化输出
+    const lines: string[] = [
+      `Search: "${response.query}"`,
+      `Provider: ${response.provider}`,
+      `Results: ${response.results.length}`,
+      '',
+    ];
+
+    for (let i = 0; i < response.results.length; i++) {
+      const r = response.results[i];
+      lines.push(`[${i + 1}] ${r.title}`);
+      lines.push(`    URL: ${r.url}`);
+      if (r.score !== undefined) {
+        lines.push(`    Score: ${r.score.toFixed(2)}`);
+      }
+      if (r.snippet) {
+        // 截断过长的摘要
+        const snippet = r.snippet.length > 300 ? r.snippet.slice(0, 300) + '...' : r.snippet;
+        lines.push(`    ${snippet}`);
+      }
+      lines.push('');
+    }
+
+    return {
+      success: true,
+      output: lines.join('\n'),
+      metadata: {
+        query: response.query,
+        provider: response.provider,
+        resultCount: response.results.length,
+        results: response.results,
+      },
+    };
+  }
+}
+
+export default WebSearchTool;