clawfast 2.1.0 → 2.1.1

package/dist/clawfast.cjs

@@ -662,7 +662,7 @@ var clawfastVersion, isDevVersion, isNewerVersion;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    clawfastVersion = () => true ? "2.1.0" : "0.0.0-dev";
+    clawfastVersion = () => true ? "2.1.1" : "0.0.0-dev";
     isDevVersion = () => clawfastVersion().includes("-dev");
     isNewerVersion = (a, b) => {
       const parse3 = (v) => v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10) || 0);
@@ -715,7 +715,7 @@ var init_update = __esm({
       if (isDevVersion()) return null;
       const cache = readCache();
       if (cache && isNewerVersion(cache.latest, current)) {
-        return `nova versao ${cache.latest} disponivel (voce tem ${current}) \u2014 rode: clawfast update`;
+        return `nova versao ${cache.latest} disponivel (voce tem ${current}) \u2014 rode: clawfast update e depois clawfast para usar a nova versao`;
       }
       return null;
     };
@@ -71335,12 +71335,23 @@ function balancedSpan(text2, open, close) {
 function entryToBridgedCall(entry) {
   if (!entry || typeof entry !== "object") return null;
   const e = entry;
+  const brief = typeof e.brief === "string" ? e.brief : "";
+  const explicit = typeof e.tool === "string" ? e.tool : typeof e.tool_name === "string" ? e.tool_name : null;
+  if (explicit && BRIDGEABLE_TOOLS.has(explicit)) {
+    const nested = [e.input, e.args, e.parameters].find(
+      (v) => v && typeof v === "object" && !Array.isArray(v)
+    );
+    const input = { brief, ...nested ?? e };
+    delete input.tool;
+    delete input.tool_name;
+    return { toolName: explicit, input };
+  }
   if (typeof e.command === "string" && e.command.trim()) {
     return {
       toolName: "run_terminal_cmd",
       input: {
         command: e.command,
-        brief: typeof e.brief === "string" ? e.brief : "",
+        brief,
         is_background: e.is_background === true,
         interactive: e.interactive === true,
         timeout: typeof e.timeout === "number" ? e.timeout : 60
@@ -71353,13 +71364,25 @@ function entryToBridgedCall(entry) {
       input: {
         action: e.action,
         path: e.path,
-        brief: typeof e.brief === "string" ? e.brief : "",
+        brief,
         ...typeof e.text === "string" ? { text: e.text } : {},
         ...Array.isArray(e.range) ? { range: e.range } : {},
         ...Array.isArray(e.edits) ? { edits: e.edits } : {}
       }
     };
   }
+  if (typeof e.action === "string" && FINDINGS_ACTIONS.has(e.action)) {
+    return { toolName: "findings", input: { ...e, brief } };
+  }
+  if (typeof e.url === "string" && e.url.trim()) {
+    return { toolName: "http_request", input: { ...e, brief } };
+  }
+  if (Array.isArray(e.todos)) {
+    return {
+      toolName: "todo_write",
+      input: { merge: e.merge === true, todos: e.todos }
+    };
+  }
   return null;
 }
 function validateBatch(raw) {
@@ -71396,12 +71419,27 @@ function parseProxyToolCalls(text2) {
 }
 function summarizeBridgedCalls(calls) {
   return calls.map((call) => {
-    if (call.toolName === "run_terminal_cmd") {
-      return `$ ${truncateBridgeSummary(String(call.input.command ?? ""))}`;
+    const i = call.input;
+    switch (call.toolName) {
+      case "run_terminal_cmd":
+        return `$ ${truncateBridgeSummary(String(i.command ?? ""))}`;
+      case "file":
+        return `${String(i.action ?? "file")} ${truncateBridgeSummary(
+          String(i.path ?? ""),
+          120
+        )}`.trim();
+      case "http_request":
+        return `${String(i.method ?? "GET")} ${truncateBridgeSummary(
+          String(i.url ?? ""),
+          120
+        )}`.trim();
+      case "findings":
+        return `findings ${String(i.action ?? "")}`.trim();
+      case "todo_write":
+        return `todo_write (${Array.isArray(i.todos) ? i.todos.length : 0} itens)`;
+      default:
+        return call.toolName;
     }
-    const action = String(call.input.action ?? "file");
-    const target = String(call.input.path ?? "");
-    return `${action} ${truncateBridgeSummary(target, 120)}`.trim();
   }).join("; ");
 }
 async function createAgent() {
@@ -71724,6 +71762,31 @@ ${seen}`);
       }
       let streamError = null;
       let stalled = false;
+      let turnText = "";
+      const turnToolSummaries = [];
+      const preservePartialWork = () => {
+        const segs = [];
+        const text2 = turnText.trim();
+        if (text2) {
+          segs.push(text2.length > 4e3 ? `...${text2.slice(-4e3)}` : text2);
+        }
+        if (turnToolSummaries.length) {
+          segs.push(
+            "A\xE7\xF5es j\xE1 executadas neste turno:\n" + turnToolSummaries.map((s) => `- ${s}`).join("\n")
+          );
+        }
+        if (!segs.length) return;
+        history.push({
+          role: "assistant",
+          content: `[Trabalho parcial de ${labelFor(
+            modelKey
+          )} antes de falhar \u2014 N\xC3O recomece do zero; continue exatamente a partir daqui:]
+
+${segs.join(
+            "\n\n"
+          )}`
+        });
+      };
       const stallController = new AbortController();
       const onUserAbort = () => stallController.abort();
       if (signal) {
@@ -71758,9 +71821,8 @@ ${seen}`);
           }
         });
         let lastStepText = "";
-        let bufferedProxyText = "";
         let turnToolCalls = 0;
-        const shouldBufferProxyText = isWebSessionProxyModel(modelKey);
+        const isProxyModel = isWebSessionProxyModel(modelKey);
         let pendingTools = 0;
         const noteActivity = () => {
           if (pendingTools === 0) armStallTimer();
@@ -71772,11 +71834,8 @@ ${seen}`);
               case "text-delta": {
                 const delta = part.text ?? part.delta ?? "";
                 lastStepText += delta;
-                if (shouldBufferProxyText) {
-                  bufferedProxyText += delta;
-                } else {
-                  render.text(delta);
-                }
+                turnText += delta;
+                render.text(delta);
                 noteActivity();
                 break;
               }
@@ -71784,12 +71843,16 @@ ${seen}`);
                 render.reasoning(part.text ?? part.delta ?? "");
                 noteActivity();
                 break;
-              case "tool-call":
+              case "tool-call": {
                 turnToolCalls++;
                 pendingTools++;
                 clearStallTimer();
-                render.toolCall(part.toolName, part.input ?? part.args);
+                const input = part.input ?? part.args ?? {};
+                const brief = typeof input.command === "string" ? `$ ${input.command}` : typeof input.path === "string" ? `${String(input.action ?? "file")} ${input.path}` : String(part.toolName);
+                turnToolSummaries.push(truncateBridgeSummary(brief, 160));
+                render.toolCall(part.toolName, input);
                 break;
+              }
               case "tool-result":
                 if (pendingTools > 0) pendingTools--;
                 render.toolResult(part.toolName, part.output ?? part.result);
@@ -71801,7 +71864,6 @@ ${seen}`);
                 break;
               case "start-step":
                 lastStepText = "";
-                bufferedProxyText = "";
                 noteActivity();
                 break;
               case "error":
@@ -71834,8 +71896,8 @@ ${seen}`);
         const finishReason = String(
           await result.finishReason.catch(() => "unknown")
         );
-        const leakedCall = !shouldBufferProxyText && hasLeakedToolCallMarker(lastStepText);
-        if (finishReason === "stop" && turnToolCalls === 0 && bridgeSteps < MAX_BRIDGE_STEPS && (shouldBufferProxyText || leakedCall)) {
+        const leakedCall = !isProxyModel && hasLeakedToolCallMarker(lastStepText);
+        if (finishReason === "stop" && turnToolCalls === 0 && bridgeSteps < MAX_BRIDGE_STEPS && (isProxyModel || leakedCall)) {
           const bridged = parseProxyToolCalls(lastStepText);
           if (bridged) {
             bridgeSteps++;
@@ -71877,9 +71939,6 @@ ${resultText}`
           idx--;
           continue;
         }
-        if (shouldBufferProxyText && bufferedProxyText) {
-          render.text(bufferedProxyText);
-        }
         if (finishReason !== "stop") {
           render.info(
             `\u25B8 fim do turno: ${finishReason}` + (autoContinues >= MAX_AUTO_CONTINUES ? " (limite de retomadas autom\xE1ticas atingido)" : "")
@@ -71902,6 +71961,7 @@ ${resultText}`
           while (history.length && history[history.length - 1]?.role !== "user") {
             history.pop();
           }
+          preservePartialWork();
           const secs = Math.round(STREAM_STALL_TIMEOUT_MS / 1e3);
           lastError = new Error(
             `stream travou (${secs}s sem dados) em ${labelFor(modelKey)}`
@@ -71945,6 +72005,7 @@ ${resultText}`
         while (history.length && history[history.length - 1]?.role !== "user") {
           history.pop();
         }
+        preservePartialWork();
         if (rateLimited && rateLimitWaits < MAX_RATE_LIMIT_WAITS) {
           const waitMs = Math.min(3e3 * 2 ** rateLimitWaits, 15e3);
           rateLimitWaits++;
@@ -71998,7 +72059,7 @@ ${resultText}`
     close
   };
 }
-var import_promises2, import_node_path10, MAX_STEPS, MAX_OUTPUT_TOKENS, MAX_AUTO_CONTINUES, MAX_RATE_LIMIT_WAITS, STREAM_STALL_TIMEOUT_MS, MAX_STALL_RETRIES, isRateLimitError, sleep4, LEAKED_TOOL_CALL_RE, DANGLING_TAIL_RE, ACTION_ANNOUNCE_RE, BENIGN_CLOSER_RE, TOOL_CALL_NUDGE, MAX_BRIDGE_STEPS, BRIDGE_RESULT_PREAMBLE, LEAKED_CALL_RESULT_PREAMBLE, truncateBridgeSummary, isWebSessionProxyModel, proxyToolProtocolPolicy, SYSTEM_PROMPT_SOURCE, REQUIRED_SYSTEM_PROMPT_MARKERS, MODEL_LABELS, labelFor, loginRequiredHint, CLI_PYTHON_ONLY_POLICY, pythonOnlyPolicy, scriptFilePolicy, deepReconPolicy, httpAndFindingsPolicy, reconPhasesPolicy, skillsScopePolicy, hasEnvValue2, envFlagEnabled, CLI_PERSONALITIES, buildCliUserCustomization, buildCliNotesSection, cliGuardrailsConfig, maybeDumpSystemPrompt, auditSystemPrompt, assertFullSystemPrompt;
+var import_promises2, import_node_path10, MAX_STEPS, MAX_OUTPUT_TOKENS, MAX_AUTO_CONTINUES, MAX_RATE_LIMIT_WAITS, STREAM_STALL_TIMEOUT_MS, MAX_STALL_RETRIES, isRateLimitError, sleep4, LEAKED_TOOL_CALL_RE, DANGLING_TAIL_RE, ACTION_ANNOUNCE_RE, BENIGN_CLOSER_RE, TOOL_CALL_NUDGE, MAX_BRIDGE_STEPS, BRIDGE_RESULT_PREAMBLE, LEAKED_CALL_RESULT_PREAMBLE, BRIDGEABLE_TOOLS, FINDINGS_ACTIONS, truncateBridgeSummary, isWebSessionProxyModel, proxyToolProtocolPolicy, SYSTEM_PROMPT_SOURCE, REQUIRED_SYSTEM_PROMPT_MARKERS, MODEL_LABELS, labelFor, loginRequiredHint, CLI_PYTHON_ONLY_POLICY, pythonOnlyPolicy, scriptFilePolicy, deepReconPolicy, httpAndFindingsPolicy, reconPhasesPolicy, skillsScopePolicy, hasEnvValue2, envFlagEnabled, CLI_PERSONALITIES, buildCliUserCustomization, buildCliNotesSection, cliGuardrailsConfig, maybeDumpSystemPrompt, auditSystemPrompt, assertFullSystemPrompt;
 var init_agent = __esm({
   "src/agent.ts"() {
     "use strict";
@@ -72060,6 +72121,14 @@ var init_agent = __esm({
     MAX_BRIDGE_STEPS = 50;
     BRIDGE_RESULT_PREAMBLE = "Voc\xEA roda via proxy de sess\xE3o web (sem function-calling nativo), ent\xE3o o runtime do CLI consumiu o bloco JSON anterior como chamada interna e EXECUTOU de verdade. N\xE3o repita o bloco nem o texto anterior. Os resultados REAIS est\xE3o abaixo. Continue a tarefa: se precisar de mais a\xE7\xF5es, emita SOMENTE o PR\xD3XIMO bloco ```json (um array de {brief, command, timeout} para terminal, ou {action, path, text} para arquivo). Um bloco por vez. Quando a tarefa terminar, responda em texto normal SEM bloco json.";
     LEAKED_CALL_RESULT_PREAMBLE = "Sua chamada de ferramenta anterior chegou como TEXTO (n\xE3o como function call nativo), ent\xE3o o runtime do CLI a executou mesmo assim. Os resultados REAIS est\xE3o abaixo. Continue a tarefa chamando as ferramentas NORMALMENTE (run_terminal_cmd, file, todo_write) como function calls de verdade \u2014 N\xC3O cole markup de tool call (`call_tool_function`, `<tool_call>`, etc.) nem JSON de chamada como texto na resposta.";
+    BRIDGEABLE_TOOLS = /* @__PURE__ */ new Set([
+      "run_terminal_cmd",
+      "file",
+      "findings",
+      "http_request",
+      "todo_write"
+    ]);
+    FINDINGS_ACTIONS = /* @__PURE__ */ new Set(["add", "update", "list", "report"]);
     truncateBridgeSummary = (value, max = 180) => value.length > max ? `${value.slice(0, max)}...` : value;
     isWebSessionProxyModel = (modelName) => modelName === "model-deepseek-proxy" || modelName === "model-kimi-proxy";
     proxyToolProtocolPolicy = () => `
@@ -72067,14 +72136,17 @@ var init_agent = __esm({
 <web_session_tool_protocol>
 ATIVO NESTA SESS\xC3O: o modelo atual roda por um proxy de sess\xE3o web e N\xC3O tem function-calling nativo. Para EXECUTAR qualquer a\xE7\xE3o voc\xEA n\xE3o chama ferramentas de fun\xE7\xE3o \u2014 voc\xEA EMITE um \xFAnico bloco de c\xF3digo \`\`\`json com um array de chamadas, e o runtime do CLI executa de verdade e te devolve os resultados como uma mensagem do usu\xE1rio. Repita o ciclo at\xE9 concluir.
 
-Formato EXATO (sempre um array, mesmo para uma \xFAnica a\xE7\xE3o):
+Formato EXATO (sempre um array, mesmo para uma \xFAnica a\xE7\xE3o). Voc\xEA pode SEMPRE incluir "tool": "<nome>" para deixar expl\xEDcito qual ferramenta chamar (recomendado para findings/http_request/todo_write):
 - Terminal: {"brief": "uma frase", "command": "<comando shell>", "timeout": 60, "is_background": false}
 - Arquivo:  {"action": "write"|"edit"|"append"|"read", "path": "<caminho absoluto>", "brief": "uma frase", "text": "<conte\xFAdo completo para write/append>"}
+- HTTP (Repeater/Intruder): {"tool": "http_request", "brief": "uma frase", "url": "https://alvo/...", "method": "GET", "headers": {"X":"y"}, "body": "...", "fuzz": ["a","b"]}
+- Findings (mem\xF3ria estruturada de vulns): {"tool": "findings", "action": "add"|"update"|"list"|"report", "brief": "uma frase", "title": "...", "severity": "critical"|"high"|"medium"|"low"|"info", "evidence": "...", "id": "F-001"}
+- Tarefas (todo): {"tool": "todo_write", "merge": true, "todos": [{"id": "1", "content": "...", "status": "pending"|"in_progress"|"completed"}]}
 
 Regras:
 1. Para agir, a resposta DEVE conter um bloco \`\`\`json com o array. Esse bloco ser\xE1 consumido pelo CLI como chamada interna e n\xE3o deve ser tratado como texto de terminal.
 2. UM bloco por turno; aguarde os resultados antes de emitir o pr\xF3ximo.
-3. Cada entrada do array deve mapear para uma a\xE7\xE3o (tem "command", ou tem "action"+"path"). N\xE3o misture com dados que n\xE3o s\xE3o a\xE7\xF5es.
+3. Cada entrada do array deve mapear para uma a\xE7\xE3o: terminal ("command"), arquivo ("action"+"path"), ou outra ferramenta via "tool" ("http_request" com "url", "findings" com "action" add/update/list/report, "todo_write" com "todos"). N\xE3o misture com dados que n\xE3o s\xE3o a\xE7\xF5es.
 4. Crie/edite scripts e c\xF3digo-fonte SOMENTE via {"action":"write"} / {"action":"edit"} \u2014 nunca por redirecionamento de shell (echo >, cat <<EOF, tee, Out-File...).
 5. Durante a\xE7\xF5es, coloque o conte\xFAdo operacional apenas dentro do JSON. Fora do JSON use no m\xE1ximo uma frase curta.
 6. Quando a tarefa estiver conclu\xEDda, responda em texto normal SEM bloco json.
@@ -72435,10 +72507,14 @@ var init_interactive_input = __esm({
        * forwarded to an interactive command's stdin. No box/dropdown — just echoes
        * and collects until Enter. Ctrl+C invokes `onSigint`.
        */
-      beginTurn(onLine, onSigint) {
+      beginTurn(onLine, onSigint, isActive) {
         let buf = "";
         this.onKey = (str, key) => {
           if (key.ctrl && key.name === "c") return onSigint();
+          if (!isActive()) {
+            buf = "";
+            return;
+          }
           if (key.name === "return") {
             out2("\r\n");
             const line = this.paste.expand(buf);
@@ -73218,7 +73294,10 @@ ${C5.dim}interrompido \u2014 Ctrl+C de novo para fechar${C5.reset}
           );
         }
         armExit();
-      }
+      },
+      // Only echo/forward typed input while a foreground command is waiting on
+      // stdin; otherwise type-ahead during the model's reply is dropped silently.
+      () => agent.isRunningCommand()
     );
     try {
       await agent.send(input, activeAbort.signal);
@@ -73337,6 +73416,7 @@ async function handleSubcommand() {
       process.stdout.write(
         `
 \x1B[92m\x1B[1mSeja bem vindo ao submundo.\x1B[0m
+\x1B[2mRode \x1B[0m\x1B[36mclawfast\x1B[0m\x1B[2m para usar a nova versao.\x1B[0m
 `
       );
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawfast",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "CLAWFAST — agente de pentest no terminal. Com o clawfast você faz tudo.",
   "bin": {
     "clawfast": "dist/clawfast.cjs"