@ryuu-reinzz/ryuu-cli 0.0.0-stage → 0.3.1

package/src/utils/errors.js

@@ -0,0 +1,160 @@
+/**
+ * Central error types. Every failure surfaced to the user should be one of
+ * these so the CLI can render a consistent, actionable message.
+ */
+
+export class RyuuError extends Error {
+  constructor(message, { code = 'RYUU_ERROR', details, cause, retryable = false } = {}) {
+    super(message, cause ? { cause } : undefined);
+    this.name = new.target.name;
+    this.code = code;
+    this.details = details;
+    this.retryable = retryable;
+  }
+
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      details: this.details,
+      retryable: this.retryable,
+    };
+  }
+}
+
+export class ConfigError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'CONFIG_INVALID', details });
+  }
+}
+
+export class ValidationError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'VALIDATION_FAILED', details });
+  }
+}
+
+export class PathEscapeError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'PATH_ESCAPE', details });
+  }
+}
+
+export class SecretFileError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'SECRET_FILE_BLOCKED', details });
+  }
+}
+
+export class NotFoundError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'NOT_FOUND', details });
+  }
+}
+
+export class FileChangedError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'FILE_CHANGED', details });
+  }
+}
+
+export class ApprovalDeniedError extends RyuuError {
+  constructor(message = 'Action denied by the user.', details) {
+    super(message, { code: 'APPROVAL_DENIED', details });
+  }
+}
+
+export class ToolNotFoundError extends RyuuError {
+  constructor(name) {
+    super(`Unknown tool: ${name}`, { code: 'UNKNOWN_TOOL' });
+  }
+}
+
+export class ToolError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'TOOL_ERROR', details });
+  }
+}
+
+export class SearchError extends RyuuError {
+  constructor(message, { code = 'SEARCH_FAILED', status, retryable = false, details } = {}) {
+    super(message, { code, retryable, details });
+    this.status = status;
+  }
+}
+
+export class FetchError extends RyuuError {
+  constructor(message, { code = 'FETCH_FAILED', status, retryable = false, details } = {}) {
+    super(message, { code, retryable, details });
+    this.status = status;
+  }
+}
+
+export class ProviderError extends RyuuError {
+  constructor(message, { code = 'PROVIDER_ERROR', status, retryable = false, details, cause } = {}) {
+    super(message, { code, retryable, details, cause });
+    this.status = status;
+  }
+}
+
+export class CancelledError extends RyuuError {
+  constructor(message = 'Operation cancelled.') {
+    super(message, { code: 'CANCELLED' });
+  }
+}
+
+export class ProcessError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'PROCESS_ERROR', details });
+  }
+}
+
+export class SessionError extends RyuuError {
+  constructor(message, details) {
+    super(message, { code: 'SESSION_ERROR', details });
+  }
+}
+
+/** Human-friendly one-line description, including provider status when present. */
+export function describeError(error) {
+  if (!error) return 'Unknown error';
+  const status = error.status ? ` (HTTP ${error.status})` : '';
+  const code = error.code ? ` [${error.code}]` : '';
+  return `${error.message || String(error)}${status}${code}`;
+}
+
+/** Full block including stack, intended for --debug or the log file. */
+export function formatErrorBlock(error, { debug = false } = {}) {
+  if (!error) return 'Unknown error';
+  const lines = [describeError(error)];
+  if (error.details) {
+    lines.push(`Details: ${typeof error.details === 'string' ? error.details : JSON.stringify(error.details)}`);
+  }
+  if (debug && error.stack) lines.push(error.stack);
+  else lines.push('Run with --debug (or press /doctor) for more diagnostics.');
+  return lines.join('\n');
+}
+
+export function isAbortError(error) {
+  return error?.name === 'AbortError' || error?.code === 'ABORT_ERR' || error?.code === 'CANCELLED';
+}
+
+/**
+ * True when a failure is worth another attempt.
+ *
+ * Two kinds qualify:
+ *   - transient provider failures (network, timeout, 5xx, rate limit) that
+ *     are flagged `retryable`;
+ *   - a poisoned tool-call payload, which the agent repairs locally before
+ *     replaying the request.
+ *
+ * Cancellation is never recoverable.
+ */
+export function isRecoverableError(error) {
+  if (!error) return false;
+  if (error instanceof CancelledError) return false;
+  if (error.code === 'CANCELLED') return false;
+  if (error.retryable === true) return true;
+  return error.code === 'INVALID_TOOL_ARGUMENTS';
+}

package/src/utils/network.js

@@ -0,0 +1,129 @@
+/**
+ * Network guards for URLs supplied by the model or found on a web page.
+ *
+ * `read_url` and MCP extraction must not become a way to reach the machine's
+ * loopback services, the LAN, or cloud metadata endpoints. The guards reject
+ * obvious names and private IP literals everywhere, and additionally resolve
+ * DNS before a real local fetch. DNS rebinding is not fully solved by a
+ * pre-check, but combined with re-checking every redirect it closes the common
+ * paths without a custom HTTP agent.
+ */
+
+import dns from 'node:dns/promises';
+import net from 'node:net';
+import { FetchError } from './errors.js';
+
+const BLOCKED_HOSTS = new Set([
+  'localhost',
+  'metadata',
+  'metadata.google.internal',
+  'instance-data',
+  'instance-data.ec2.internal',
+]);
+
+const BLOCKED_SUFFIXES = ['.localhost', '.local', '.internal', '.home.arpa'];
+
+function blocked(message) {
+  return new FetchError(message, { code: 'READ_URL_BLOCKED' });
+}
+
+/** True for IPv4/IPv6 addresses that are loopback, private, link-local or metadata. */
+export function isPrivateAddress(address) {
+  const value = String(address || '').trim().toLowerCase();
+  if (!value) return true;
+  if (net.isIPv4(value)) {
+    const [a, b] = value.split('.').map(Number);
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
+    if (a === 169 && b === 254) return true; // link-local, cloud metadata
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 192 && b === 0) return true;
+    if (a === 198 && (b === 18 || b === 19)) return true;
+    if (a === 198 && b === 51) return true;
+    if (a === 203 && b === 0) return true;
+    if (a >= 224) return true; // multicast + reserved
+    return false;
+  }
+  if (net.isIPv6(value)) {
+    if (value === '::' || value === '::1') return true;
+    if (value.startsWith('fe8') || value.startsWith('fe9') || value.startsWith('fea') || value.startsWith('feb')) return true;
+    if (/^f[cd]/.test(value)) return true; // unique local
+    if (/^ff/.test(value)) return true; // multicast
+    if (value.startsWith('2001:db8')) return true;
+    const mapped = value.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+    if (mapped) return isPrivateAddress(mapped[1]);
+    return false;
+  }
+  return true;
+}
+
+/** Reject hostnames that are local by name (before any DNS lookup). */
+export function isBlockedHostname(hostname) {
+  const host = String(hostname || '').replace(/^\[|\]$/g, '').toLowerCase();
+  if (!host) return true;
+  if (BLOCKED_HOSTS.has(host)) return true;
+  if (BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix))) return true;
+  // Single-label names are resolved through local search domains.
+  if (!host.includes('.') && !net.isIP(host)) return true;
+  return false;
+}
+
+/**
+ * Throw READ_URL_BLOCKED when a URL targets a local/private destination.
+ * @param {URL|string} input
+ * @param {object} [options]
+ * @param {boolean} [options.resolve] also resolve DNS and inspect every address
+ */
+export async function assertPublicUrl(input, { resolve = false } = {}) {
+  let url;
+  try {
+    url = input instanceof URL ? input : new URL(String(input));
+  } catch {
+    throw blocked('The URL is not valid.');
+  }
+  if (!['http:', 'https:'].includes(url.protocol)) {
+    throw blocked(`Only http(s) URLs are allowed (received ${url.protocol}).`);
+  }
+  if (url.username || url.password) {
+    throw blocked('URLs with embedded credentials are refused.');
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, '');
+  if (isBlockedHostname(host)) {
+    throw blocked(`Refusing to fetch a local or internal host: ${host}`);
+  }
+  if (net.isIP(host)) {
+    if (isPrivateAddress(host)) throw blocked(`Refusing to fetch a private address: ${host}`);
+    return;
+  }
+  if (!resolve) return;
+  let records;
+  let timer;
+  try {
+    records = await Promise.race([
+      dns.lookup(host, { all: true, verbatim: true }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          reject(new FetchError(`DNS lookup for ${host} timed out.`, {
+            code: 'READ_URL_TIMEOUT',
+            retryable: true,
+          }));
+        }, 5000);
+        if (timer.unref) timer.unref();
+      }),
+    ]);
+  } catch (error) {
+    if (error instanceof FetchError) throw error;
+    throw new FetchError(`Cannot resolve ${host}: ${error.message}`, {
+      code: 'READ_URL_NETWORK',
+      retryable: true,
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+  for (const record of Array.isArray(records) ? records : []) {
+    if (isPrivateAddress(record.address)) {
+      throw blocked(`Refusing to fetch ${host}: it resolves to a private address (${record.address}).`);
+    }
+  }
+}

package/src/utils/redaction.js

@@ -0,0 +1,73 @@
+/**
+ * Secret redaction. Applied before anything is logged, persisted, or rendered
+ * in an error message. Redaction is best-effort defense in depth; credentials
+ * are also never read from secret files by the tools.
+ */
+
+const TOKEN_PATTERNS = [
+  [/nvapi-[A-Za-z0-9._-]{6,}/g, '[REDACTED:nvidia-key]'],
+  [/sk-[A-Za-z0-9._-]{6,}/g, '[REDACTED:api-key]'],
+  [/\bghp_[A-Za-z0-9]{10,}\b/g, '[REDACTED:github-token]'],
+  [/\bgithub_pat_[A-Za-z0-9_]{10,}\b/g, '[REDACTED:github-token]'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{8,}\b/g, '[REDACTED:slack-token]'],
+  [/(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi, '$1[REDACTED]'],
+  [/((?:api[_-]?key|access[_-]?token|auth[_-]?token|token|secret|password|passwd)\s*[:=]\s*["']?)([^\s"',;}]{4,})/gi, '$1[REDACTED]'],
+  [/(-----BEGIN [A-Z ]*PRIVATE KEY-----)[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----)/g, '$1[REDACTED]$2'],
+];
+
+/**
+ * Build a redactor bound to a set of concrete secret values (e.g. the loaded
+ * API key) plus the generic token patterns.
+ */
+export function createRedactor(secrets = []) {
+  const values = [...new Set(secrets.filter((s) => typeof s === 'string' && s.trim().length >= 4))];
+  return function redact(input) {
+    if (input == null) return input;
+    let text = typeof input === 'string' ? input : safeStringify(input);
+    for (const value of values) {
+      text = text.split(value).join('[REDACTED]');
+    }
+    for (const [pattern, replacement] of TOKEN_PATTERNS) {
+      text = text.replace(pattern, replacement);
+    }
+    return text;
+  };
+}
+
+const defaultRedact = createRedactor([]);
+
+export function redact(input) {
+  return defaultRedact(input);
+}
+
+/** Deep-redact strings inside plain objects/arrays; cycles become "[Circular]". */
+export function redactDeep(value, seen = new WeakSet()) {
+  if (typeof value === 'string') return defaultRedact(value);
+  if (value == null || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((item) => redactDeep(item, seen));
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (/password|secret|token|api[_-]?key/i.test(key) && typeof item === 'string' && item) {
+      out[key] = '[REDACTED]';
+    } else {
+      out[key] = redactDeep(item, seen);
+    }
+  }
+  return out;
+}
+
+/** Mask a configured secret without revealing length or characters. */
+export function maskSecret(value) {
+  if (!value) return '(not set)';
+  return 'set (redacted)';
+}
+
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value, (key, item) => (typeof item === 'bigint' ? item.toString() : item));
+  } catch {
+    return String(value);
+  }
+}