@sleepy-ai/cli 0.0.0-main-202607032053 → 0.1.4

package/src/util/sleepy-process.ts

@@ -0,0 +1,24 @@
+export const SLEEPYCODE_RUN_ID = "SLEEPYCODE_RUN_ID"
+export const SLEEPYCODE_PROCESS_ROLE = "SLEEPYCODE_PROCESS_ROLE"
+
+export function ensureRunID() {
+  return (process.env[SLEEPYCODE_RUN_ID] ??= crypto.randomUUID())
+}
+
+export function ensureProcessRole(fallback: "main" | "worker") {
+  return (process.env[SLEEPYCODE_PROCESS_ROLE] ??= fallback)
+}
+
+export function ensureProcessMetadata(fallback: "main" | "worker") {
+  return {
+    runID: ensureRunID(),
+    processRole: ensureProcessRole(fallback),
+  }
+}
+
+export function sanitizedProcessEnv(overrides?: Record<string, string>) {
+  const env = Object.fromEntries(
+    Object.entries(process.env).filter((entry): entry is [string, string] => entry[1] !== undefined),
+  )
+  return overrides ? Object.assign(env, overrides) : env
+}

package/src/util/ssrf.ts

@@ -0,0 +1,116 @@
+import { lookup } from "dns/promises"
+
+const BLOCKED_HOSTNAMES = new Set([
+  "metadata.google.internal",
+  "metadata.goog",
+  "kubernetes.default.svc",
+])
+
+const BLOCKED_IPV4_PREFIXES = [
+  "10.", // private class A
+  "0.", // current network
+]
+
+const BLOCKED_IPV4_RANGES: Array<{ start: number; end: number }> = [
+  { start: ip4ToInt("172.16.0.0"), end: ip4ToInt("172.31.255.255") }, // private class B
+  { start: ip4ToInt("192.168.0.0"), end: ip4ToInt("192.168.255.255") }, // private class C
+  { start: ip4ToInt("169.254.0.0"), end: ip4ToInt("169.254.255.255") }, // link-local
+  { start: ip4ToInt("100.64.0.0"), end: ip4ToInt("100.127.255.255") }, // shared address (CGN)
+  { start: ip4ToInt("100.100.100.200"), end: ip4ToInt("100.100.100.200") }, // Alibaba Cloud metadata
+]
+
+function ip4ToInt(ip: string): number {
+  const parts = ip.split(".")
+  return ((+parts[0]! << 24) | (+parts[1]! << 16) | (+parts[2]! << 8) | +parts[3]!) >>> 0
+}
+
+function isBlockedIPv4(ip: string): boolean {
+  for (const prefix of BLOCKED_IPV4_PREFIXES) {
+    if (ip.startsWith(prefix)) return true
+  }
+  const n = ip4ToInt(ip)
+  for (const range of BLOCKED_IPV4_RANGES) {
+    if (n >= range.start && n <= range.end) return true
+  }
+  return false
+}
+
+function isBlockedIPv6(ip: string): boolean {
+  const normalized = ip.toLowerCase()
+  if (normalized.startsWith("fe80:")) return true // link-local
+  if (normalized.startsWith("fc") || normalized.startsWith("fd")) return true // ULA
+  // IPv4-mapped IPv6 in dotted-decimal form (::ffff:a.b.c.d)
+  const mapped = normalized.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)
+  if (mapped) return isBlockedIPv4(mapped[1]!)
+  // IPv4-mapped IPv6 in hex form (::ffff:HHHH:HHHH) — URL parsers normalize to this
+  const hexMapped = normalized.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)
+  if (hexMapped) {
+    const hi = parseInt(hexMapped[1]!, 16)
+    const lo = parseInt(hexMapped[2]!, 16)
+    const ipv4 = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`
+    return isBlockedIPv4(ipv4)
+  }
+  return false
+}
+
+const MAX_REDIRECTS = 5
+
+export async function safeFetch(
+  url: string,
+  init?: RequestInit,
+  fetchImpl: typeof fetch = fetch,
+): Promise<Response> {
+  await assertSafeUrl(url)
+  let currentUrl = url
+  for (let i = 0; i < MAX_REDIRECTS; i++) {
+    const response = await fetchImpl(currentUrl, { ...init, redirect: "manual" })
+    if (response.status >= 300 && response.status < 400) {
+      const location = response.headers.get("location")
+      if (!location) return response
+      currentUrl = new URL(location, currentUrl).toString()
+      await assertSafeUrl(currentUrl)
+      continue
+    }
+    return response
+  }
+  throw new Error("SSRF protection: too many redirects")
+}
+
+export async function assertSafeUrl(url: string): Promise<void> {
+  const parsed = new URL(url)
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "")
+
+  if (BLOCKED_HOSTNAMES.has(hostname)) {
+    throw new Error(`SSRF protection: blocked hostname "${hostname}"`)
+  }
+
+  // Numeric IPv4 check (before DNS)
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(hostname)) {
+    if (isBlockedIPv4(hostname)) {
+      throw new Error(`SSRF protection: blocked private/internal IP "${hostname}"`)
+    }
+    return
+  }
+
+  // Numeric IPv6 check (before DNS)
+  if (hostname.includes(":")) {
+    if (isBlockedIPv6(hostname)) {
+      throw new Error(`SSRF protection: blocked private/internal IPv6 "${hostname}"`)
+    }
+    return
+  }
+
+  // DNS resolution check to prevent DNS rebinding
+  try {
+    const { address, family } = await lookup(hostname)
+    if (family === 4 && isBlockedIPv4(address)) {
+      throw new Error(`SSRF protection: hostname "${hostname}" resolves to blocked IP "${address}"`)
+    }
+    if (family === 6 && isBlockedIPv6(address)) {
+      throw new Error(`SSRF protection: hostname "${hostname}" resolves to blocked IPv6 "${address}"`)
+    }
+  } catch (e: any) {
+    if (e.message?.startsWith("SSRF protection:")) throw e
+    throw new Error(`SSRF protection: DNS resolution failed for "${hostname}"`)
+  }
+}

package/src/util/timeout.ts

@@ -0,0 +1,14 @@
+export function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {
+  let timeout: NodeJS.Timeout
+  return Promise.race([
+    promise.then((result) => {
+      clearTimeout(timeout)
+      return result
+    }),
+    new Promise<never>((_, reject) => {
+      timeout = setTimeout(() => {
+        reject(new Error(`Operation timed out after ${ms}ms`))
+      }, ms)
+    }),
+  ])
+}

package/src/util/token.ts

@@ -0,0 +1,5 @@
+const CHARS_PER_TOKEN = 4
+
+export function estimate(input: string) {
+  return Math.max(0, Math.round((input || "").length / CHARS_PER_TOKEN))
+}

package/src/util/tool-compat.ts

@@ -0,0 +1,144 @@
+import type { JSONSchema7 } from "@ai-sdk/provider"
+import { isRecord } from "./record"
+
+/** Collapse PascalCase, camelCase, snake_case, and kebab-case to one comparable token. */
+export function canonical(name: string): string {
+  return name.replace(/[-_\s]+/g, "").toLowerCase()
+}
+
+/** Resolve a model-provided identifier to a registered name when casing or separators differ. */
+export function resolveName(name: string, candidates: readonly string[]): string | undefined {
+  if (candidates.includes(name)) return name
+
+  const lower = name.toLowerCase()
+  const caseMatch = candidates.find((candidate) => candidate.toLowerCase() === lower)
+  if (caseMatch) return caseMatch
+
+  const key = canonical(name)
+  return candidates.find((candidate) => canonical(candidate) === key)
+}
+
+export function schemaPropertyKeys(schema: JSONSchema7): string[] {
+  if (!isRecord(schema.properties)) return []
+  return Object.keys(schema.properties)
+}
+
+function combinedSchemas(schema: JSONSchema7): JSONSchema7[] {
+  const out: JSONSchema7[] = []
+  for (const key of ["allOf", "anyOf", "oneOf"] as const) {
+    const branch = schema[key]
+    if (!Array.isArray(branch)) continue
+    for (const entry of branch) {
+      if (typeof entry === "object" && entry !== null) out.push(entry as JSONSchema7)
+    }
+  }
+  return out
+}
+
+function normalizeValue(value: unknown, schema: JSONSchema7 | undefined): unknown {
+  if (!schema) return value
+
+  if (Array.isArray(value)) {
+    const items = schema.items
+    const itemSchema =
+      typeof items === "object" && items !== null && !Array.isArray(items) ? (items as JSONSchema7) : undefined
+    if (!itemSchema) return value
+    return value.map((entry) => normalizeValue(entry, itemSchema))
+  }
+
+  if (isRecord(value)) return normalizeInput(value, schema)
+
+  return value
+}
+
+/** Remap object keys to the schema's canonical property names, recursively. */
+export function normalizeInput(input: unknown, schema: JSONSchema7): unknown {
+  if (!isRecord(input)) return input
+
+  const propertyKeys = schemaPropertyKeys(schema)
+  const combinedBranches = combinedSchemas(schema)
+  if (propertyKeys.length === 0 && combinedBranches.length === 0) return input
+
+  const properties = isRecord(schema.properties) ? schema.properties : {}
+  const byCanonical = new Map(propertyKeys.map((key) => [canonical(key), key]))
+  const propertyKeySet = new Set(propertyKeys)
+  const exactKeys = new Set<string>()
+  const normalized: Record<string, unknown> = {}
+
+  const childSchemaFor = (key: string): JSONSchema7 | undefined => {
+    const propertySchema = properties[key]
+    return typeof propertySchema === "object" && propertySchema !== null ? (propertySchema as JSONSchema7) : undefined
+  }
+
+  // Pass 1: exact matches always win over aliases regardless of iteration order.
+  for (const [key, value] of Object.entries(input)) {
+    if (!propertyKeySet.has(key)) continue
+    normalized[key] = normalizeValue(value, childSchemaFor(key))
+    exactKeys.add(key)
+  }
+
+  // Pass 2: alias keys only fill slots not claimed by an exact match.
+  for (const [key, value] of Object.entries(input)) {
+    if (propertyKeySet.has(key)) continue
+    const resolvedKey = byCanonical.get(canonical(key))
+    if (resolvedKey) {
+      if (exactKeys.has(resolvedKey) || resolvedKey in normalized) continue
+      normalized[resolvedKey] = normalizeValue(value, childSchemaFor(resolvedKey))
+      continue
+    }
+    normalized[key] = value
+  }
+
+  // Recurse into combinator branches (allOf/anyOf/oneOf) so nested properties
+  // declared via composition are also normalized.
+  let result: Record<string, unknown> = normalized
+  for (const branch of combinedBranches) {
+    const next = normalizeInput(result, branch)
+    if (isRecord(next)) result = next
+  }
+
+  return result
+}
+
+export function parseToolInput(input: string): unknown {
+  if (input.trim() === "") return {}
+  try {
+    return JSON.parse(input) as unknown
+  } catch {
+    return input
+  }
+}
+
+export function stringifyToolInput(input: unknown): string {
+  return typeof input === "string" ? input : JSON.stringify(input)
+}
+
+export type RepairToolCallInput = {
+  toolName: string
+  input: string
+  toolNames: readonly string[]
+  getSchema: (toolName: string) => JSONSchema7 | PromiseLike<JSONSchema7>
+}
+
+export type RepairedToolCall = {
+  toolName: string
+  input: string
+}
+
+/** Repair tool name and/or argument keys so AI SDK validation can succeed. */
+export async function repairToolCall(input: RepairToolCallInput): Promise<RepairedToolCall | undefined> {
+  const resolvedName = resolveName(input.toolName, input.toolNames)
+  if (!resolvedName) return undefined
+
+  const schema = await Promise.resolve(input.getSchema(resolvedName))
+  const parsed = parseToolInput(input.input)
+  const normalized = normalizeInput(parsed, schema)
+  const repairedInput = stringifyToolInput(normalized)
+
+  if (resolvedName === input.toolName && repairedInput === input.input) return undefined
+
+  return {
+    toolName: resolvedName,
+    input: repairedInput,
+  }
+}

package/src/util/update-schema.ts

@@ -0,0 +1,13 @@
+import z from "zod"
+
+export function updateSchema<T extends z.ZodRawShape>(schema: z.ZodObject<T>) {
+  const next = {} as {
+    [K in keyof T]: z.ZodOptional<z.ZodNullable<T[K]>>
+  }
+
+  for (const [k, v] of Object.entries(schema.required().shape) as [keyof T & string, z.ZodTypeAny][]) {
+    next[k] = v.nullable() as unknown as (typeof next)[typeof k]
+  }
+
+  return z.object(next)
+}

package/src/util/which.ts

@@ -0,0 +1,14 @@
+import whichPkg from "which"
+import path from "path"
+import { Global } from "../global"
+
+export function which(cmd: string, env?: NodeJS.ProcessEnv) {
+  const base = env?.PATH ?? env?.Path ?? process.env.PATH ?? process.env.Path ?? ""
+  const full = base ? base + path.delimiter + Global.Path.bin : Global.Path.bin
+  const result = whichPkg.sync(cmd, {
+    nothrow: true,
+    path: full,
+    pathExt: env?.PATHEXT ?? env?.PathExt ?? process.env.PATHEXT ?? process.env.PathExt,
+  })
+  return typeof result === "string" ? result : null
+}

package/src/util/wildcard.ts

@@ -0,0 +1,57 @@
+import { sortBy, pipe } from "remeda"
+
+export function match(str: string, pattern: string) {
+  if (str) str = str.replaceAll("\\", "/")
+  if (pattern) pattern = pattern.replaceAll("\\", "/")
+  let escaped = pattern
+    .replace(/[.+^${}()|[\]\\]/g, "\\$&") // escape special regex chars
+    .replace(/\*/g, ".*") // * becomes .*
+    .replace(/\?/g, ".") // ? becomes .
+
+  // If pattern ends with " *" (space + wildcard), make the trailing part optional
+  // This allows "ls *" to match both "ls" and "ls -la"
+  if (escaped.endsWith(" .*")) {
+    escaped = escaped.slice(0, -3) + "( .*)?"
+  }
+
+  const flags = process.platform === "win32" ? "si" : "s"
+  return new RegExp("^" + escaped + "$", flags).test(str)
+}
+
+export function all(input: string, patterns: Record<string, any>) {
+  const sorted = pipe(patterns, Object.entries, sortBy([([key]) => key.length, "asc"], [([key]) => key, "asc"]))
+  let result = undefined
+  for (const [pattern, value] of sorted) {
+    if (match(input, pattern)) {
+      result = value
+      continue
+    }
+  }
+  return result
+}
+
+export function allStructured(input: { head: string; tail: string[] }, patterns: Record<string, any>) {
+  const sorted = pipe(patterns, Object.entries, sortBy([([key]) => key.length, "asc"], [([key]) => key, "asc"]))
+  let result = undefined
+  for (const [pattern, value] of sorted) {
+    const parts = pattern.split(/\s+/)
+    if (!match(input.head, parts[0])) continue
+    if (parts.length === 1 || matchSequence(input.tail, parts.slice(1))) {
+      result = value
+      continue
+    }
+  }
+  return result
+}
+
+function matchSequence(items: string[], patterns: string[]): boolean {
+  if (patterns.length === 0) return true
+  const [pattern, ...rest] = patterns
+  if (pattern === "*") return matchSequence(items, rest)
+  for (let i = 0; i < items.length; i++) {
+    if (match(items[i], pattern) && matchSequence(items.slice(i + 1), rest)) {
+      return true
+    }
+  }
+  return false
+}