gencode-ai 0.1.0 → 0.1.1

package/dist/tools/utils/ssrf.js

@@ -0,0 +1,70 @@
+/**
+ * SSRF Protection Utilities
+ * Prevents Server-Side Request Forgery by blocking internal/private addresses
+ */
+// Private IP ranges (RFC 1918 + loopback + link-local + cloud metadata)
+const PRIVATE_IP_PATTERNS = [
+    /^127\./, // Loopback (127.0.0.0/8)
+    /^10\./, // Class A private (10.0.0.0/8)
+    /^172\.(1[6-9]|2[0-9]|3[01])\./, // Class B private (172.16.0.0/12)
+    /^192\.168\./, // Class C private (192.168.0.0/16)
+    /^169\.254\./, // Link-local (169.254.0.0/16)
+    /^0\./, // "This" network
+    /^::1$/, // IPv6 loopback
+    /^fe80:/i, // IPv6 link-local
+    /^fc00:/i, // IPv6 unique local
+    /^fd[0-9a-f]{2}:/i, // IPv6 unique local
+];
+const BLOCKED_HOSTNAMES = [
+    'localhost',
+    'localhost.localdomain',
+    'metadata.google.internal', // GCP metadata
+    '169.254.169.254', // AWS/GCP/Azure metadata
+];
+/**
+ * Check if an IP address is in a private range
+ */
+export function isPrivateIP(ip) {
+    return PRIVATE_IP_PATTERNS.some((pattern) => pattern.test(ip));
+}
+/**
+ * Check if a hostname is blocked
+ */
+export function isBlockedHostname(hostname) {
+    const lower = hostname.toLowerCase();
+    // Direct match
+    if (BLOCKED_HOSTNAMES.includes(lower)) {
+        return true;
+    }
+    // Check .local suffix
+    if (lower.endsWith('.local')) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Validate a URL for SSRF protection
+ * Throws an error if the URL is not allowed
+ */
+export function validateUrl(urlString) {
+    let parsed;
+    try {
+        parsed = new URL(urlString);
+    }
+    catch {
+        throw new Error('Invalid URL format');
+    }
+    // Only allow http/https protocols
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+        throw new Error('Only http:// and https:// URLs are supported');
+    }
+    // Check hostname blocklist
+    if (isBlockedHostname(parsed.hostname)) {
+        throw new Error('Access to internal/local addresses is not allowed');
+    }
+    // Check if hostname is a private IP
+    if (isPrivateIP(parsed.hostname)) {
+        throw new Error('Access to private IP addresses is not allowed');
+    }
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/tools/utils/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../src/tools/utils/ssrf.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAA6B,yBAAyB;IAC9D,OAAO,EAA8B,+BAA+B;IACpE,+BAA+B,EAAK,kCAAkC;IACtE,aAAa,EAAwB,mCAAmC;IACxE,aAAa,EAAwB,8BAA8B;IACnE,MAAM,EAA+B,iBAAiB;IACtD,OAAO,EAA8B,gBAAgB;IACrD,SAAS,EAA4B,kBAAkB;IACvD,SAAS,EAA4B,oBAAoB;IACzD,kBAAkB,EAAmB,oBAAoB;CAC1D,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,WAAW;IACX,uBAAuB;IACvB,0BAA0B,EAAI,eAAe;IAC7C,iBAAiB,EAAa,yBAAyB;CACxD,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAErC,eAAe;IACf,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sBAAsB;IACtB,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,2BAA2B;IAC3B,IAAI,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,oCAAoC;IACpC,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/docs/README.md

@@ -1,14 +1,15 @@
-# mycode Documentation
+# GenCode Documentation
 
-This directory contains documentation for the mycode project.
+This directory contains documentation for the GenCode project.
 
 ## Contents
 
+- [**providers-and-models.md**](./providers-and-models.md) - Provider management and model selection
 - [**proposals/**](./proposals/) - Enhancement proposals for new features
 
-## About mycode
+## About GenCode
 
-mycode is an open-source, provider-agnostic alternative to Claude Code. It brings Claude Code's excellent interactive CLI experience while allowing flexible switching between different LLM providers (OpenAI, Anthropic, Google Gemini).
+GenCode is an open-source, provider-agnostic AI coding assistant. It brings Claude Code's excellent interactive CLI experience while allowing flexible switching between different LLM providers (OpenAI, Anthropic, Google Gemini, Vertex AI).
 
 ## Quick Links
 

package/docs/proposals/0001-web-fetch-tool.md

@@ -1,10 +1,11 @@
 # Proposal: WebFetch Tool
 
 - **Proposal ID**: 0001
-- **Author**: mycode team
-- **Status**: Draft
+- **Author**: Meng Yan
+- **Status**: Implemented
 - **Created**: 2025-01-15
 - **Updated**: 2025-01-15
+- **Implemented**: 2025-01-15
 
 ## Summary
 
@@ -286,6 +287,35 @@ const BLOCKED_HOSTS = [
 
 No breaking changes to existing functionality.
 
+## Implementation Notes
+
+### Files Created/Modified
+
+| File | Action | Description |
+|------|--------|-------------|
+| `src/tools/utils/ssrf.ts` | Created | SSRF protection utilities |
+| `src/tools/builtin/webfetch.ts` | Created | WebFetch tool implementation |
+| `src/tools/types.ts` | Modified | Added ToolResultMetadata interface |
+| `src/tools/index.ts` | Modified | Registered webfetchTool |
+| `src/cli/components/Messages.tsx` | Modified | Improved tool display (Claude Code style) |
+| `src/cli/components/theme.ts` | Modified | Added fetch icon |
+| `package.json` | Modified | Added turndown dependency |
+
+### Key Implementation Details
+
+1. **HTML to Markdown**: Uses `turndown` library for conversion
+2. **SSRF Protection**: Blocks localhost, private IPs (10.x, 172.16-31.x, 192.168.x), cloud metadata (169.254.169.254)
+3. **Size Limits**: 5MB max response size
+4. **Timeout**: 30s default, 120s max
+5. **Display**: Claude Code style (`● Fetch(url)` with `└ Received 540.3KB (200 OK)`)
+
+### Display Example
+
+```
+● Fetch(https://example.com/docs)
+  └ Received 540.3KB (200 OK)
+```
+
 ## References
 
 - [Claude Code WebFetch Documentation](https://code.claude.com/docs/en/tools)

package/docs/proposals/0002-web-search-tool.md

@@ -1,10 +1,11 @@
 # Proposal: WebSearch Tool
 
 - **Proposal ID**: 0002
-- **Author**: mycode team
-- **Status**: Draft
+- **Author**: Meng Yan
+- **Status**: Implemented
 - **Created**: 2025-01-15
 - **Updated**: 2025-01-15
+- **Implemented**: 2025-01-15
 
 ## Summary
 
@@ -304,3 +305,59 @@ Configuration required: User must provide search API key.
 - [Serper API](https://serper.dev/)
 - [Google Custom Search API](https://developers.google.com/custom-search)
 - [Bing Web Search API](https://www.microsoft.com/en-us/bing/apis/bing-web-search-api)
+
+## Implementation Notes
+
+### Files Created/Modified
+
+| File | Action | Description |
+|------|--------|-------------|
+| `src/providers/search/types.ts` | Created | Search provider interface and types |
+| `src/providers/search/exa.ts` | Created | Exa AI provider (default, no API key required) |
+| `src/providers/search/serper.ts` | Created | Serper.dev provider |
+| `src/providers/search/brave.ts` | Created | Brave Search provider |
+| `src/providers/search/index.ts` | Created | Factory function and exports |
+| `src/providers/registry.ts` | Modified | Added SEARCH_PROVIDERS definitions |
+| `src/providers/store.ts` | Modified | Added search provider selection methods |
+| `src/tools/builtin/websearch.ts` | Created | WebSearch tool implementation |
+| `src/tools/index.ts` | Modified | Registered websearchTool |
+| `src/cli/components/ProviderManager.tsx` | Modified | Added Search Providers tab to `/provider` command |
+
+### Key Implementation Details
+
+1. **Multi-Provider Support**: Integrated into the existing provider system (`src/providers/`)
+2. **Default Provider**: Exa AI - no API key required, works out of the box (like OpenCode)
+3. **Optional Providers**: Serper.dev and Brave Search (require API keys)
+4. **Provider Priority**: Configured in store > Environment variables > Default (Exa)
+5. **Domain Filtering**: Supports `allowed_domains` and `blocked_domains` parameters
+6. **Display**: Claude Code style with metadata (`Search("query")`, `Found N results via provider`)
+7. **CLI Configuration**: Search providers can be configured via `/provider` command
+
+### Configuration
+
+**Method 1: Via `/provider` Command (Recommended)**
+
+```
+/provider
+```
+
+The Provider Management UI now has two tabs:
+- `[L] LLM Providers` - Configure LLM providers (Anthropic, OpenAI, Gemini, etc.)
+- `[S] Search Providers` - Configure search providers (Exa, Serper, Brave)
+
+Use `Tab` or `S` to switch to Search Providers tab, then use arrow keys to select and `Enter` to confirm.
+
+**Method 2: Via Environment Variables**
+
+| Variable | Provider | Notes |
+|----------|----------|-------|
+| (none) | Exa AI | Default, no config needed |
+| `SERPER_API_KEY` | Serper.dev | 2,500 free queries |
+| `BRAVE_API_KEY` | Brave Search | 2,000 free/month |
+
+### Display Example
+
+```
+● Search("TypeScript 5.4 features")
+  └ Found 10 results via exa
+```