@sayknow-cli/coding-agent 0.4.6 → 0.5.0

package/src/web/insane/url-guard.ts

@@ -28,12 +28,36 @@ export type PublicUrlResult = PublicUrlAccepted | PublicUrlRejected;
 /** Resolver seam so tests can inject DNS results without real lookups. */
 export type AddressResolver = (hostname: string) => Promise<string[]>;
 
+type ProxyEnvironment = Record<string, string | undefined>;
+
+export type GuardedPublicFetchResult =
+	| { ok: true; response: Response; logicalUrl: URL; wireUrl: URL }
+	| { ok: false; reason: string; logicalUrl: string };
+
 const defaultResolver: AddressResolver = async hostname => {
 	const records = await dns.lookup(hostname, { all: true, verbatim: true });
 	return records.map(record => record.address);
 };
 
 const BLOCKED_HOSTNAMES = new Set(["localhost", "localhost.localdomain", "0.0.0.0", ""]);
+const PROXY_ENV_KEYS = ["HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy"] as const;
+
+export function hasConfiguredProxy(env: ProxyEnvironment): boolean {
+	return PROXY_ENV_KEYS.some(key => Boolean(env[key]));
+}
+
+async function resolveWithSignal(resolver: AddressResolver, hostname: string, signal?: AbortSignal): Promise<string[]> {
+	if (!signal) return resolver(hostname);
+	if (signal.aborted) throw signal.reason;
+	const { promise, reject } = Promise.withResolvers<never>();
+	const onAbort = () => reject(signal.reason);
+	signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		return await Promise.race([resolver(hostname), promise]);
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
 
 function isBlockedHostname(hostname: string): boolean {
 	const normalized = hostname.toLowerCase().replace(/\.$/, "");
@@ -67,37 +91,81 @@ function isPrivateIPv4(address: string): boolean {
 	);
 }
 
-function normalizeIPv4MappedIPv6(address: string): string {
-	return address.toLowerCase().startsWith("::ffff:") ? address.slice(7) : address;
+function parseIPv6Bytes(address: string): Uint8Array | undefined {
+	let normalized = address.toLowerCase();
+	const ipv4Tail = normalized.slice(normalized.lastIndexOf(":") + 1);
+	if (ipv4Tail.includes(".")) {
+		const parts = ipv4Tail.split(".").map(part => Number.parseInt(part, 10));
+		if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return;
+		normalized = `${normalized.slice(0, normalized.lastIndexOf(":") + 1)}${((parts[0] << 8) | parts[1]).toString(16)}:${((parts[2] << 8) | parts[3]).toString(16)}`;
+	}
+
+	const halves = normalized.split("::");
+	if (halves.length > 2) return;
+	const left = halves[0] ? halves[0].split(":") : [];
+	const right = halves[1] ? halves[1].split(":") : [];
+	const omitted = 8 - left.length - right.length;
+	if ((halves.length === 1 && omitted !== 0) || (halves.length === 2 && omitted < 1)) return;
+	const words = [...left, ...Array.from({ length: omitted }, () => "0"), ...right];
+	if (words.length !== 8 || words.some(word => !/^[0-9a-f]{1,4}$/.test(word))) return;
+
+	const bytes = new Uint8Array(16);
+	for (let index = 0; index < words.length; index++) {
+		const word = Number.parseInt(words[index], 16);
+		bytes[index * 2] = word >> 8;
+		bytes[index * 2 + 1] = word & 0xff;
+	}
+	return bytes;
+}
+
+interface IPv6Cidr {
+	network: Uint8Array;
+	prefixLength: number;
+}
+
+function ipv6Cidr(network: string, prefixLength: number): IPv6Cidr {
+	const bytes = parseIPv6Bytes(network);
+	if (!bytes) throw new Error(`Invalid static IPv6 CIDR: ${network}/${prefixLength}`);
+	return { network: bytes, prefixLength };
 }
 
+function matchesIPv6Cidr(address: Uint8Array, cidr: IPv6Cidr): boolean {
+	const wholeBytes = Math.floor(cidr.prefixLength / 8);
+	for (let index = 0; index < wholeBytes; index++) {
+		if (address[index] !== cidr.network[index]) return false;
+	}
+	const remainingBits = cidr.prefixLength % 8;
+	if (remainingBits === 0) return true;
+	const mask = (0xff << (8 - remainingBits)) & 0xff;
+	return (address[wholeBytes] & mask) === (cidr.network[wholeBytes] & mask);
+}
+
+const IPV6_GLOBAL_UNICAST = ipv6Cidr("2000::", 3);
+const BLOCKED_GLOBAL_IPV6_RANGES = [
+	ipv6Cidr("2001::", 23), // IETF protocol assignments
+	ipv6Cidr("2001:db8::", 32), // documentation
+	ipv6Cidr("2002::", 16), // 6to4
+	ipv6Cidr("2620:4f:8000::", 48), // AS112 service
+	ipv6Cidr("3ffe::", 16), // returned 6bone range
+	ipv6Cidr("3fff::", 20), // documentation
+] as const;
+
 function isPrivateIPv6(address: string): boolean {
-	const normalized = address.toLowerCase();
-	const mapped = normalizeIPv4MappedIPv6(normalized);
-	if (mapped !== normalized && net.isIP(mapped) === 4) return isPrivateIPv4(mapped);
+	const bytes = parseIPv6Bytes(address);
+	if (!bytes) return true;
+	const isIPv4Mapped = bytes.subarray(0, 10).every(byte => byte === 0) && bytes[10] === 0xff && bytes[11] === 0xff;
+	if (isIPv4Mapped) return isPrivateIPv4(`${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`);
 	return (
-		normalized === "::" || // unspecified
-		normalized === "::1" || // loopback
-		normalized.startsWith("fc") || // ULA fc00::/7
-		normalized.startsWith("fd") || // ULA
-		normalized.startsWith("fe8") || // link-local fe80::/10
-		normalized.startsWith("fe9") ||
-		normalized.startsWith("fea") ||
-		normalized.startsWith("feb") ||
-		normalized.startsWith("ff") || // multicast ff00::/8
-		normalized.startsWith("2001:db8") || // documentation
-		normalized.startsWith("::ffff:") // any remaining IPv4-mapped form we could not classify
+		!matchesIPv6Cidr(bytes, IPV6_GLOBAL_UNICAST) ||
+		BLOCKED_GLOBAL_IPV6_RANGES.some(cidr => matchesIPv6Cidr(bytes, cidr))
 	);
 }
 
 /** True for any address that is not a routable public unicast address. */
 export function isPrivateOrSpecialAddress(address: string): boolean {
-	const normalized = normalizeIPv4MappedIPv6(address);
-	const family = net.isIP(normalized);
-	if (family === 4) return isPrivateIPv4(normalized);
-	if (family === 6) return isPrivateIPv6(normalized);
-	// Re-check the raw value in case it was an IPv4-mapped IPv6 literal.
-	if (net.isIP(address) === 6) return isPrivateIPv6(address);
+	const family = net.isIP(address);
+	if (family === 4) return isPrivateIPv4(address);
+	if (family === 6) return isPrivateIPv6(address);
 	return true; // not a recognizable IP -> treat as unsafe
 }
 
@@ -108,7 +176,7 @@ export function isPrivateOrSpecialAddress(address: string): boolean {
  */
 export async function validatePublicHttpUrl(
 	rawUrl: string,
-	options: { resolver?: AddressResolver } = {},
+	options: { resolver?: AddressResolver; signal?: AbortSignal } = {},
 ): Promise<PublicUrlResult> {
 	const resolver = options.resolver ?? defaultResolver;
 
@@ -128,18 +196,20 @@ export async function validatePublicHttpUrl(
 		return { ok: false, reason: "localhost or internal host" };
 	}
 
-	const literalFamily = net.isIP(url.hostname);
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	const literalFamily = net.isIP(hostname);
 	if (literalFamily !== 0) {
-		if (isPrivateOrSpecialAddress(url.hostname)) {
+		if (isPrivateOrSpecialAddress(hostname)) {
 			return { ok: false, reason: "private, loopback, link-local, or reserved IP literal" };
 		}
-		return { ok: true, url, addresses: [url.hostname] };
+		return { ok: true, url, addresses: [hostname] };
 	}
 
 	let addresses: string[];
 	try {
-		addresses = await resolver(url.hostname);
+		addresses = await resolveWithSignal(resolver, hostname, options.signal);
 	} catch {
+		if (options.signal?.aborted) return { ok: false, reason: "host resolution aborted" };
 		return { ok: false, reason: "host could not be resolved" };
 	}
 	if (addresses.length === 0) {
@@ -151,6 +221,49 @@ export async function validatePublicHttpUrl(
 	return { ok: true, url, addresses };
 }
 
+export async function guardedPublicFetch(
+	rawUrl: string,
+	init: BunFetchRequestInit = {},
+	options: { resolver?: AddressResolver } = {},
+): Promise<GuardedPublicFetchResult> {
+	if (Object.hasOwn(init, "proxy") || Object.hasOwn(init, "unix") || hasConfiguredProxy(process.env)) {
+		return { ok: false, reason: "proxy or Unix-socket routing is not allowed", logicalUrl: rawUrl };
+	}
+
+	const signal = init.signal ?? undefined;
+	const guard = await validatePublicHttpUrl(rawUrl, { resolver: options.resolver, signal });
+	if (signal?.aborted) throw signal.reason;
+	if (!guard.ok) return { ok: false, reason: guard.reason, logicalUrl: rawUrl };
+
+	const logicalUrl = guard.url;
+	const headers = new Headers(init.headers);
+	headers.delete("host");
+	headers.set("Host", logicalUrl.host);
+	const hostname = logicalUrl.hostname.replace(/^\[|\]$/g, "");
+	const tls =
+		logicalUrl.protocol === "https:"
+			? { rejectUnauthorized: true, ...(net.isIP(hostname) === 0 ? { serverName: hostname } : {}) }
+			: undefined;
+	const method = (init.method ?? "GET").toUpperCase();
+	const addresses = method === "GET" || method === "HEAD" ? guard.addresses : guard.addresses.slice(0, 1);
+	let lastError: unknown;
+	for (const address of addresses) {
+		if (hasConfiguredProxy(process.env)) {
+			return { ok: false, reason: "proxy routing appeared during resolution", logicalUrl: rawUrl };
+		}
+		const wireUrl = new URL(logicalUrl);
+		wireUrl.hostname = net.isIP(address) === 6 ? `[${address}]` : address;
+		try {
+			const response = await fetch(wireUrl, { ...init, headers, redirect: "manual", keepalive: false, tls });
+			return { ok: true, response, logicalUrl, wireUrl };
+		} catch (error) {
+			if (signal?.aborted) throw signal.reason;
+			lastError = error;
+		}
+	}
+	throw lastError;
+}
+
 export async function validatePublicHttpUrlForInsane(
 	rawUrl: string,
 	options: { resolver?: AddressResolver } = {},

package/src/web/scrapers/docs-rs.ts

@@ -299,7 +299,21 @@ async function readCachedRustdocCrate(
 ): Promise<{ crate: RustdocCrate; fetchedAt: string } | null> {
 	const cachePath = getDocsRsCachePath(target);
 	try {
-		const [jsonStr, stat] = await Promise.all([Bun.file(cachePath).text(), fs.stat(cachePath)]);
+		const stat = await fs.stat(cachePath);
+		if (stat.size > MAX_BYTES) {
+			await fs.rm(cachePath, { force: true });
+			return null;
+		}
+
+		const cacheBytes = await Bun.file(cachePath)
+			.slice(0, MAX_BYTES + 1)
+			.arrayBuffer();
+		if (cacheBytes.byteLength > MAX_BYTES) {
+			await fs.rm(cachePath, { force: true });
+			return null;
+		}
+
+		const jsonStr = Buffer.from(cacheBytes).toString("utf-8");
 		const crate = tryParseJson<RustdocCrate>(jsonStr);
 		if (!crate?.index) return null;
 		return { crate, fetchedAt: stat.mtime.toISOString() };
@@ -378,11 +392,22 @@ export const handleDocsRs: SpecialHandler = async (
 		const requestSignal = ptree.combineSignals(signal, timeout * 1000);
 		const response = await fetch(jsonUrl, {
 			signal: requestSignal,
-			headers: { "User-Agent": "skc-web-fetch/1.0", Accept: "application/gzip" },
+			headers: {
+				"User-Agent": "skc-web-fetch/1.0",
+				Accept: "application/gzip",
+				"Accept-Encoding": "identity",
+			},
 			redirect: "follow",
+			decompress: false,
 		});
 		if (!response.ok) return null;
 
+		const contentEncoding = response.headers.get("Content-Encoding");
+		if (contentEncoding && contentEncoding.trim().toLowerCase() !== "identity") {
+			await response.body?.cancel();
+			return null;
+		}
+
 		const reader = response.body?.getReader();
 		if (!reader) return null;
 
@@ -394,13 +419,13 @@ export const handleDocsRs: SpecialHandler = async (
 			chunks.push(value);
 			totalSize += value.length;
 			if (totalSize > MAX_BYTES) {
-				reader.cancel();
-				break;
+				await reader.cancel();
+				return null;
 			}
 		}
 
 		const compressed = Buffer.concat(chunks);
-		const jsonStr = gunzipSync(compressed).toString("utf-8");
+		const jsonStr = gunzipSync(compressed, { maxOutputLength: MAX_BYTES }).toString("utf-8");
 		crate_ = tryParseJson<RustdocCrate>(jsonStr);
 		if (crate_?.index) {
 			await writeCachedRustdocCrate(target, jsonStr);

package/src/web/scrapers/types.ts

@@ -5,7 +5,7 @@ import { ptree } from "@sayknow-cli/utils";
 import type { AgentStorage } from "../../session/agent-storage";
 import { ToolAbortError } from "../../tools/tool-errors";
 import type { AddressResolver } from "../insane/url-guard";
-import { validatePublicHttpUrl } from "../insane/url-guard";
+import { guardedPublicFetch } from "../insane/url-guard";
 
 export { formatNumber } from "@sayknow-cli/utils";
 
@@ -85,20 +85,6 @@ export interface LoadPageResult {
 	error?: string;
 }
 
-async function guardPublicFetchUrl(
-	rawUrl: string,
-	resolver: AddressResolver | undefined,
-	context: string,
-): Promise<{ ok: true; url: string } | { ok: false; error: string; finalUrl: string }> {
-	const guard = await validatePublicHttpUrl(rawUrl, { resolver });
-	if (guard.ok) return { ok: true, url: guard.url.toString() };
-	return {
-		ok: false,
-		error: `${context}: target URL is not public HTTP(S): ${guard.reason}`,
-		finalUrl: rawUrl,
-	};
-}
-
 function shouldRewriteRedirectMethod(status: number, method: string): boolean {
 	const normalized = method.toUpperCase();
 	return status === 303 || ((status === 301 || status === 302) && normalized === "POST");
@@ -120,20 +106,7 @@ export async function loadPage(url: string, options: LoadPageOptions = {}): Prom
 		maxRedirects = 10,
 	} = options;
 
-	let initialUrl = url;
-	if (publicUrlGuard) {
-		const guarded = await guardPublicFetchUrl(url, resolver, "Blocked URL fetch");
-		if (!guarded.ok) {
-			return {
-				content: "",
-				contentType: "",
-				finalUrl: guarded.finalUrl,
-				ok: false,
-				error: guarded.error,
-			};
-		}
-		initialUrl = guarded.url;
-	}
+	const initialUrl = url;
 
 	attempts: for (let attempt = 0; attempt < USER_AGENTS.length; attempt++) {
 		if (signal?.aborted) {
@@ -165,36 +138,33 @@ export async function loadPage(url: string, options: LoadPageOptions = {}): Prom
 					requestInit.body = currentBody;
 				}
 
-				const response = await fetch(currentUrl, requestInit);
+				const dial = publicUrlGuard
+					? await guardedPublicFetch(currentUrl, requestInit, { resolver })
+					: { ok: true as const, response: await fetch(currentUrl, requestInit), logicalUrl: new URL(currentUrl) };
+				if (!dial.ok) {
+					return {
+						content: "",
+						contentType: "",
+						finalUrl: dial.logicalUrl,
+						ok: false,
+						error: `Blocked URL fetch: target URL is not public HTTP(S): ${dial.reason}`,
+					};
+				}
+				const { response } = dial;
+				const logicalUrl = dial.logicalUrl.toString();
 				if (REDIRECT_STATUSES.has(response.status)) {
 					const location = response.headers.get("location");
 					if (!location) {
 						return {
 							content: "",
 							contentType: "",
-							finalUrl: currentUrl,
+							finalUrl: logicalUrl,
 							ok: false,
 							status: response.status,
 							error: "Redirect response missing Location header",
 						};
 					}
-					const redirectUrl = new URL(location, currentUrl).toString();
-					if (publicUrlGuard) {
-						const guarded = await guardPublicFetchUrl(redirectUrl, resolver, "Blocked URL redirect");
-						if (!guarded.ok) {
-							return {
-								content: "",
-								contentType: "",
-								finalUrl: guarded.finalUrl,
-								ok: false,
-								status: response.status,
-								error: guarded.error,
-							};
-						}
-						currentUrl = guarded.url;
-					} else {
-						currentUrl = redirectUrl;
-					}
+					currentUrl = new URL(location, logicalUrl).toString();
 					if (shouldRewriteRedirectMethod(response.status, currentMethod)) {
 						currentMethod = "GET";
 						currentBody = undefined;
@@ -203,7 +173,7 @@ export async function loadPage(url: string, options: LoadPageOptions = {}): Prom
 				}
 
 				const contentType = response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ?? "";
-				const finalUrl = response.url || currentUrl;
+				const finalUrl = logicalUrl;
 
 				const reader = response.body?.getReader();
 				if (!reader) {

package/src/web/scrapers/utils.ts

@@ -5,7 +5,7 @@ export { isRecord };
 import { ToolAbortError } from "../../tools/tool-errors";
 import { convertBufferWithMarkit } from "../../utils/markit";
 import type { AddressResolver } from "../insane/url-guard";
-import { validatePublicHttpUrl } from "../insane/url-guard";
+import { guardedPublicFetch } from "../insane/url-guard";
 import { MAX_BYTES } from "./types";
 
 export function asRecord(value: unknown): Record<string, unknown> | null {
@@ -70,16 +70,6 @@ async function readResponseWithLimit(response: Response, maxBytes: number, signa
 	return new Uint8Array(Buffer.concat(chunks, totalBytes));
 }
 
-async function guardPublicBinaryUrl(
-	rawUrl: string,
-	resolver: AddressResolver | undefined,
-	context: string,
-): Promise<{ ok: true; url: string } | { ok: false; error: string }> {
-	const guard = await validatePublicHttpUrl(rawUrl, { resolver });
-	if (guard.ok) return { ok: true, url: guard.url.toString() };
-	return { ok: false, error: `${context}: target URL is not public HTTP(S): ${guard.reason}` };
-}
-
 /**
  * Fetch binary content from a URL
  */
@@ -93,32 +83,28 @@ export async function fetchBinary(
 	const { publicUrlGuard = true, resolver, maxRedirects = 10 } = options;
 	try {
 		let currentUrl = url;
-		if (publicUrlGuard) {
-			const guarded = await guardPublicBinaryUrl(url, resolver, "Blocked binary fetch");
-			if (!guarded.ok) return { ok: false, error: guarded.error };
-			currentUrl = guarded.url;
-		}
 
 		for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
-			const response = await fetch(currentUrl, {
+			const requestInit: BunFetchRequestInit = {
 				signal: requestSignal,
 				headers: {
 					"User-Agent": "Mozilla/5.0 (compatible; TextBot/1.0)",
 				},
 				redirect: "manual",
-			});
+			};
+			const dial = publicUrlGuard
+				? await guardedPublicFetch(currentUrl, requestInit, { resolver })
+				: { ok: true as const, response: await fetch(currentUrl, requestInit), logicalUrl: new URL(currentUrl) };
+			if (!dial.ok) {
+				return { ok: false, error: `Blocked binary fetch: target URL is not public HTTP(S): ${dial.reason}` };
+			}
+			const { response } = dial;
+			const logicalUrl = dial.logicalUrl.toString();
 
 			if (REDIRECT_STATUSES.has(response.status)) {
 				const location = response.headers.get("location");
 				if (!location) return { ok: false, error: "Redirect response missing Location header" };
-				const redirectUrl = new URL(location, currentUrl).toString();
-				if (publicUrlGuard) {
-					const guarded = await guardPublicBinaryUrl(redirectUrl, resolver, "Blocked binary redirect");
-					if (!guarded.ok) return { ok: false, error: guarded.error };
-					currentUrl = guarded.url;
-				} else {
-					currentUrl = redirectUrl;
-				}
+				currentUrl = new URL(location, logicalUrl).toString();
 				continue;
 			}
 

package/src/web/search/providers/codex.ts

@@ -36,7 +36,7 @@ const DEFAULT_INSTRUCTIONS =
 	"You are a helpful assistant with web search capabilities. Search the web to answer the user's question accurately and cite your sources.";
 
 function getConfiguredModel(): string | undefined {
-	const configuredModel = $env.PI_CODEX_WEB_SEARCH_MODEL?.trim();
+	const configuredModel = ($env.SKC_OPENAI_CODE_WEB_SEARCH_MODEL ?? $env.PI_CODEX_WEB_SEARCH_MODEL)?.trim();
 	return configuredModel ? configuredModel : undefined;
 }
 

package/src/workflow/workflow-intent-diff.ts

@@ -40,7 +40,10 @@ interface RouteMatch {
 const PROMPT_PREVIEW_LIMIT = 240;
 
 const DURABLE_TRACKING_PATTERNS = [
-	/\bultragoal\b/i,
+	/^\s*\/skill:ultragoal\b/i,
+	/\b(?:use|run|start|create|activate|invoke|execute)\s+(?:the\s+)?ultragoal\b/i,
+	/\bultragoal(?:로|으로)[^.!?\n]{0,40}(?:해|진행|실행|관리|처리)/i,
+	/\bultragoal(?:을|를)\s+(?:(?:사용|실행|시작|활성화|호출|진행|관리|처리)(?:해줘|해주세요|하세요)|(?:써|쓰)(?:줘|주세요|세요)|해줘|해주세요|하세요)/i,
 	/\bdurable (?:goal|tracking|ledger|plan)\b/i,
 	/\b(?:goal|tracking|plan) ledger\b/i,
 	/\bcheckpoint(?:ed|ing)? (?:goal|plan|workflow|release|work)\b/i,