factoryhub 0.1.0 → 0.1.1

package/packages/engine/src/run.mjs

@@ -9,9 +9,13 @@
 // Model: set ANTHROPIC_API_KEY, or OPENAI_API_KEY, or point at any
 // OpenAI-compatible server (Ollama, LM Studio, OpenRouter, vLLM):
 //   node run.mjs --base-url http://localhost:11434/v1 --model llama3.3
+// A key from the environment goes only to its own provider: OPENAI_API_KEY to
+// api.openai.com, OPENROUTER_API_KEY to openrouter.ai/api/v1. Any other
+// --base-url gets a key only from the variable named with --api-key-env.
 //
 // Options: --input name=value (repeatable)  --model NAME  --provider anthropic|openai
-//          --base-url URL  --out FILE
+//          --base-url URL  --api-key-env NAME (the variable holding the key
+//                  for --base-url)  --out FILE
 //          --yes   approve every decision step without asking. This is the
 //                  only way a run is approved with nobody at the keyboard.
 //          --validate  read the factory as the Hub does and list what is wrong
@@ -30,6 +34,8 @@ import { existsSync } from 'node:fs';
 import { join, relative, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createInterface } from 'node:readline/promises';
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
 import process from 'node:process';
 
 const enginePath = new URL('./factory-engine.mjs', import.meta.url);
@@ -109,7 +115,11 @@ target ||= existsSync('factory.yaml') ? '.' : dirname(fileURLToPath(import.meta.
 let files;
 let leftOut = [];
 if (/^https?:\/\//.test(target)) {
-  const read = await engine.fromEnvelope(await (await fetch(target)).json());
+  // A server that never answers, or stops in the middle, ends this after 30
+  // seconds instead of hanging it.
+  const timedOut = (error) => { if (error?.name === 'TimeoutError') die(`${target} did not answer within 30 seconds.`); throw error; };
+  const response = await fetch(target, { signal: AbortSignal.timeout(30000) }).catch(timedOut);
+  const read = await engine.fromEnvelope(await response.json().catch(timedOut));
   if (read.problems.length) die(`That bundle could not be read:\n${read.problems.map((problem) => `  - ${problem}`).join('\n')}`);
   ({ files, leftOut } = read);
 } else if (existsSync(target) && target.endsWith('.json')) {
@@ -129,9 +139,17 @@ const { factory } = parsed;
 
 const kind = options.provider || (options.baseUrl || process.env.OPENAI_BASE_URL ? 'openai' : process.env.ANTHROPIC_API_KEY ? 'anthropic' : process.env.OPENAI_API_KEY ? 'openai' : null);
 if (!kind) die('No model configured. Set ANTHROPIC_API_KEY or OPENAI_API_KEY, or pass --base-url and --model for a local model.');
+// A key from the environment goes only to its own provider's address, the
+// rule lib/providers.mjs keeps for the CLI and the MCP server. Any other
+// address, such as a local server, gets a key only from the variable the
+// person named with --api-key-env, so a changed address never carries a key away.
+const KEY_FOR_ADDRESS = { 'https://api.openai.com/v1': 'OPENAI_API_KEY', 'https://openrouter.ai/api/v1': 'OPENROUTER_API_KEY' };
+const baseUrl = String(options.baseUrl || process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1').replace(/\/+$/, '');
+if (options.apiKeyEnv && !process.env[options.apiKeyEnv]) die(`${options.apiKeyEnv} is not set.`);
+const keyName = options.apiKeyEnv || KEY_FOR_ADDRESS[baseUrl];
 const provider = kind === 'anthropic'
   ? engine.anthropicProvider({ apiKey: process.env.ANTHROPIC_API_KEY, model: options.model || process.env.FACTORY_MODEL || 'claude-sonnet-5-5' })
-  : engine.openaiProvider({ apiKey: process.env.OPENAI_API_KEY || process.env.OPENROUTER_API_KEY || '', baseUrl: options.baseUrl || process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1', model: options.model || process.env.FACTORY_MODEL || 'gpt-5' });
+  : engine.openaiProvider({ apiKey: keyName ? process.env[keyName] || '' : '', baseUrl, model: options.model || process.env.FACTORY_MODEL || 'gpt-5' });
 
 const terminal = createInterface({ input: process.stdin, output: process.stdout });
 console.log(`\n${bold(factory.title)}  ${dim(`v${factory.version}, ${provider.name}, ${provider.model}`)}\n${factory.description}\n`);
@@ -153,21 +171,79 @@ const tests = options.test ? await import(existsSync(testsPath) ? testsPath.href
 const definition = tests?.readAuthorTests(files);
 if (options.test && (!definition.declared || !definition.ok)) die(definition.errors.join('\n') || 'This factory has no mindburn.tests.yaml examples.');
 
+// True for loopback, private, link-local, shared, reserved and multicast
+// addresses. The same as isPrivateIp in lib/run.mjs.
+function isPrivateIp(ip) {
+  if (isIP(ip) === 4) {
+    const [a, b] = ip.split('.').map(Number);
+    return a === 0 || a === 10 || a === 127 || a >= 224 || (a === 100 && b >= 64 && b <= 127) || (a === 169 && b === 254)
+      || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 192 && b === 0) || (a === 198 && (b === 18 || b === 19));
+  }
+  const low = ip.toLowerCase();
+  const mapped = low.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (mapped) return isPrivateIp(mapped[1]);
+  return low === '::' || low === '::1' || /^f[cd]/.test(low) || /^fe[89ab]/.test(low) || /^ff/.test(low) || low.startsWith('64:ff9b:');
+}
+
+// A page is read up to 1,500,000 bytes, as on the factoryhub site, and only
+// if it is text, HTML, XML or JSON. A cut page says so, so the run records
+// that only part of it was read. The same as pageText in lib/run.mjs.
+const PAGE_BYTES = 1500000;
+async function pageText(response, url) {
+  const type = (response.headers.get('content-type') || '').toLowerCase();
+  if (type && !/text\/|json|xml/.test(type)) {
+    await response.body?.cancel().catch(() => {});
+    throw new Error(`the address is a ${type.split(';')[0].trim()} file, not a page`);
+  }
+  const reader = response.body?.getReader();
+  const chunks = [];
+  let total = 0;
+  let cut = false;
+  while (reader) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+    total += value.byteLength;
+    if (total >= PAGE_BYTES) {
+      // A page that ends exactly at the limit was not cut.
+      cut = total > PAGE_BYTES || !(await reader.read()).done;
+      await reader.cancel().catch(() => {});
+      break;
+    }
+  }
+  const bytes = new Uint8Array(Math.min(total, PAGE_BYTES));
+  let offset = 0;
+  for (const chunk of chunks) {
+    const part = chunk.subarray(0, bytes.length - offset);
+    bytes.set(part, offset);
+    offset += part.byteLength;
+  }
+  const page = engine.htmlToText(new TextDecoder('utf-8').decode(bytes), url);
+  const note = cut && !/\[Page cut here: [^\]]*\]$/.test(page) ? '[Page cut here: only the first 1,500,000 bytes of the page were read]' : '';
+  return `Address: ${url}\n\n${[page, note].filter(Boolean).join('\n\n')}`;
+}
+
 const titleOf = (id) => factory.steps.find((step) => step.id === id)?.title || id;
 const host = {
   provider,
   limits: engine.DEFAULT_LIMITS,
   now: () => Date.now(),
   // Agents read public web pages only: never this machine or its network,
-  // whatever a factory or a page asks for. Each redirect is checked too.
+  // whatever a factory or a page asks for. The address text is checked, and
+  // every address its host name resolves to, so a public-looking name that
+  // points at this machine or its network is refused. Each redirect is checked
+  // too. The same as nodeHost in lib/run.mjs.
   async fetchPage(address) {
     let url = address;
     for (let hop = 0; hop < 6; hop += 1) {
       if (!engine.isPublicAddress(url)) throw new Error('that is not a public web address');
+      let answers;
+      try { answers = await lookup(new URL(url).hostname, { all: true, verbatim: true }); } catch { throw new Error('the address could not be found'); }
+      if (!answers.length || answers.some((answer) => isPrivateIp(answer.address))) throw new Error('that address points at a private network');
       const response = await fetch(url, { redirect: 'manual', headers: { 'user-agent': 'Mozilla/5.0 (compatible; FactoryRunner/1.0)', accept: 'text/html,*/*;q=0.5' }, signal: AbortSignal.timeout(20000) });
       if (response.status >= 300 && response.status < 400) { url = new URL(response.headers.get('location') || '', url).href; continue; }
       if (!response.ok) throw new Error(`the site answered with status ${response.status}`);
-      return `Address: ${url}\n\n${engine.htmlToText(await response.text(), url)}`;
+      return pageText(response, url);
     }
     throw new Error('the page redirects too many times');
   },