kiku-agent 1.3.1 → 1.3.3

package/server/agent/websearch/orchestrator.js

@@ -109,7 +109,7 @@ export class MetaSearchOrchestrator {
     const isNews = options.isNews === true;
 
    
-    const cacheKey = computeSearchCacheKey('meta', query, limit);
+    const cacheKey = computeSearchCacheKey('meta', query, limit, options);
     const cached = this.cache.get(cacheKey);
     if (cached && !options.noCache) {
       return { ...cached, fromCache: true };
@@ -144,8 +144,18 @@ export class MetaSearchOrchestrator {
     fallbackTriggered = engineChain.length > 1 && firstEngineResults.length < Math.ceil(limit / 2);
     successfulEngine = engineChain.find((engine, index) => engineLists[index].length > 0) || null;
 
+    const uniqueHosts = new Set();
+    for (const list of collectedLists) {
+      for (const item of list) {
+        try {
+          const host = new URL(item.link || item.url).hostname;
+          if (host) uniqueHosts.add(host);
+        } catch {}
+      }
+    }
     let fusedInputCount = collectedLists.reduce((sum, list) => sum + list.length, 0);
-    if (fusedInputCount < 3 && options.fanOut !== false) {
+    const isThin = fusedInputCount < Math.max(5, limit) || uniqueHosts.size < 3;
+    if (isThin && options.fanOut !== false) {
       const expansions = this.expandQuery(query).slice(1);
       const fanSettled = await Promise.allSettled(
         expansions.map(expQuery => this._searchSingleEngine('duckduckgo', expQuery, options))
@@ -159,10 +169,8 @@ export class MetaSearchOrchestrator {
       }
     }
 
-   
     const fused = fuseSearchResults(collectedLists, { limit, k: options.k || 60 });
 
-    
     const filtered = fused.filter(item => {
       try {
         const host = new URL(item.link).hostname;
@@ -191,7 +199,9 @@ export class MetaSearchOrchestrator {
       results: filtered
     };
 
-    this.cache.set(cacheKey, response, zeroResult ? 30_000 : (isNews ? TTL_NEWS_MS : TTL_GENERAL_MS));
+    if (!zeroResult) {
+      this.cache.set(cacheKey, response, isNews ? TTL_NEWS_MS : TTL_GENERAL_MS);
+    }
 
     return response;
   }

package/server/agent/websearch/resilience/cache.js

@@ -3,8 +3,15 @@ import crypto from 'node:crypto';
 export const TTL_GENERAL_MS = 10 * 60 * 1000;
 export const TTL_NEWS_MS = 2 * 60 * 1000;     
 
-export function computeSearchCacheKey(engine, query, count = 10) {
-  const normalized = `${String(engine || '').toLowerCase()}:${String(query || '').toLowerCase().trim()}:${count}`;
+export function computeSearchCacheKey(engine, query, count = 10, options = {}) {
+  const relevantOptions = {
+    language: options.language || 'en',
+    isNews: options.isNews === true,
+    fanOut: options.fanOut !== false,
+    searxngUrl: options.searxngUrl || process.env.SEARXNG_URL || '',
+    k: Number(options.k) || 60
+  };
+  const normalized = `${String(engine || '').toLowerCase()}:${String(query || '').toLowerCase().trim()}:${count}:${JSON.stringify(relevantOptions)}`;
   return crypto.createHash('sha256').update(normalized).digest('hex');
 }
 

package/server/agent/websearch/security/ssrf.js

@@ -1,5 +1,6 @@
 import http from 'node:http';
 import https from 'node:https';
+import { isIP } from 'node:net';
 import { lookup as dnsLookup } from 'node:dns/promises';
 
 export function parseIPv4(host) {
@@ -76,16 +77,46 @@ export function isPrivateIPv4(ip) {
 }
 
 export function isPrivateIPv6(ip) {
-  const clean = ip.toLowerCase().trim();
-  
-  if (clean === '::1' || clean === '0:0:0:0:0:0:0:1' || clean === '::') return true;
-  
-  if (/^fe[89ab]/i.test(clean)) return true;
-  
-  if (/^f[cd]/i.test(clean)) return true;
-
-  const mapped = clean.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-  if (mapped && isPrivateIPv4(mapped[1])) return true;
+  const clean = String(ip || '').toLowerCase().trim();
+  if (isIP(clean) !== 6) return false;
+
+  const halves = clean.split('::');
+  if (halves.length > 2) return false;
+  const left = halves[0] ? halves[0].split(':').filter(Boolean) : [];
+  const right = halves[1] ? halves[1].split(':').filter(Boolean) : [];
+  const embeddedIpv4 = right.length > 0 && right[right.length - 1].includes('.');
+  if (embeddedIpv4) {
+    const parsed = parseIPv4(right.pop());
+    if (!parsed) return false;
+    const value = parsed.split('.').map(Number);
+    right.push(((value[0] << 8) | value[1]).toString(16));
+    right.push(((value[2] << 8) | value[3]).toString(16));
+  }
+
+  const missing = 8 - left.length - right.length;
+  if (missing < 0) return false;
+  const groups = [
+    ...left.map(group => parseInt(group, 16)),
+    ...Array(missing).fill(0),
+    ...right.map(group => parseInt(group, 16))
+  ];
+  if (groups.length !== 8 || groups.some(group => !Number.isInteger(group) || group < 0 || group > 0xffff)) return false;
+
+  if (groups[0] === 0 && groups.slice(1).every(group => group === 0)) return true;
+  if ((groups[0] & 0xfe00) === 0xfc00) return true;
+  if ((groups[0] & 0xffc0) === 0xfe80) return true;
+
+  const isIpv4MappedOrCompatible = groups.slice(0, 6).every(group => group === 0) ||
+    (groups.slice(0, 5).every(group => group === 0) && groups[5] === 0xffff);
+  if (isIpv4MappedOrCompatible) {
+    const ipv4 = [
+      groups[6] >>> 8,
+      groups[6] & 255,
+      groups[7] >>> 8,
+      groups[7] & 255
+    ].join('.');
+    return isPrivateIPv4(ipv4);
+  }
 
   return false;
 }

package/server/agent/youtubeAuth.js

@@ -3,7 +3,7 @@ import path from 'path';
 import { spawn, execFile } from 'child_process';
 import { promisify } from 'util';
 import { fileURLToPath } from 'url';
-import { KIKU_DATA_DIR } from './appPaths.js';
+import { KIKU_DATA_DIR, resolveDynamicWindowsAppPaths } from './appPaths.js';
 import { PACKAGE_ENV_PATH, USER_ENV_PATH, upsertEnvKey } from './envManager.js';
 import { bootstrapEnv } from './envBootstrap.js';
 
@@ -27,34 +27,19 @@ async function findBrowserExeAsync(browser, { execImpl = execFileAsync } = {}) {
   const probes = {
     firefox: {
       cmd: 'firefox',
-      paths: [
-        'C:\\Program Files\\Mozilla Firefox\\firefox.exe',
-        'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe',
-        (process.env.LOCALAPPDATA || '') + '\\Mozilla Firefox\\firefox.exe'
-      ]
+      paths: isWin ? resolveDynamicWindowsAppPaths('Mozilla Firefox', 'firefox.exe') : []
     },
     chrome: {
       cmd: isWin ? 'chrome' : 'google-chrome',
-      paths: [
-        'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
-        (process.env.LOCALAPPDATA || '') + '\\Google\\Chrome\\Application\\chrome.exe',
-        'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe'
-      ]
+      paths: isWin ? resolveDynamicWindowsAppPaths('Google', 'Chrome', 'Application', 'chrome.exe') : []
     },
     edge: {
       cmd: isWin ? 'msedge' : 'microsoft-edge',
-      paths: [
-        'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe',
-        'C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe',
-        (process.env.LOCALAPPDATA || '') + '\\Microsoft\\Edge\\Application\\msedge.exe'
-      ]
+      paths: isWin ? resolveDynamicWindowsAppPaths('Microsoft', 'Edge', 'Application', 'msedge.exe') : []
     },
     brave: {
       cmd: isWin ? 'brave' : 'brave-browser',
-      paths: [
-        'C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe',
-        (process.env.LOCALAPPDATA || '') + '\\BraveSoftware\\Brave-Browser\\Application\\brave.exe'
-      ]
+      paths: isWin ? resolveDynamicWindowsAppPaths('BraveSoftware', 'Brave-Browser', 'Application', 'brave.exe') : []
     }
   };