kritya 0.8.2-beta

package/dist/tools/fetchUrl.js

@@ -0,0 +1,218 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { truncateResult } from "./common.js";
+import { isPrivateOrLoopbackHost } from "../net/urlSafety.js";
+/** Cap on how much text a single fetch returns, unless the caller asks for less. */
+const DEFAULT_MAX_CHARS = 20_000;
+/** Give up on a slow or hanging server rather than blocking the whole turn. */
+const FETCH_TIMEOUT_MS = 20_000;
+/**
+ * Hard cap on raw response bytes read off the wire, independent of max_chars.
+ * Enforced while streaming (not after buffering the full body) so a server
+ * that lies about content-length or sends gigabytes of text can't blow up
+ * process memory before truncation ever gets a chance to run.
+ */
+export const MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
+/**
+ * Reject URLs that point at the local machine or a private/internal network.
+ * fetch_url can reach any host the process can, so without this guard a prompt
+ * injection could aim it at localhost services or a cloud metadata endpoint
+ * (169.254.169.254) to read credentials. This is a literal-host/IP check, not
+ * DNS-rebinding-proof, but it blocks the obvious SSRF targets.
+ */
+function assertPublicUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`Not a valid URL: ${raw}`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`Only http and https URLs are allowed (got ${url.protocol})`);
+    }
+    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost" ||
+        host.endsWith(".localhost") ||
+        host === "0.0.0.0" ||
+        host === "::1" ||
+        host === "::") {
+        throw new Error(`Refusing to fetch a local address: ${host}`);
+    }
+    if (isPrivateOrLoopbackHost(host)) {
+        throw new Error(`Refusing to fetch a private/internal address: ${host}`);
+    }
+    return url;
+}
+/**
+ * Resolve `hostname` and check whether any answer is private/loopback.
+ * assertPublicUrl only checks the literal hostname string, so a
+ * public-looking name that resolves (now, or on a later request) to an
+ * internal IP — DNS rebinding, or simply attacker-controlled DNS — slips
+ * past it. This closes that gap for the initial request; lookupFn is
+ * injectable for tests, and defaults to a real DNS resolution.
+ */
+export async function hostResolvesToPrivateAddress(hostname, lookupFn = dnsLookup) {
+    try {
+        const addresses = await lookupFn(hostname, { all: true });
+        return addresses.some((a) => isPrivateOrLoopbackHost(a.address));
+    }
+    catch {
+        // Unresolvable host — let the actual fetch fail naturally with its own error.
+        return false;
+    }
+}
+/** Refuse to keep chasing redirects forever. */
+const MAX_REDIRECTS = 5;
+/**
+ * Fetch `url`, following redirects manually so every hop — not just the
+ * original URL — is checked against assertPublicUrl. A public URL that
+ * 302s to 169.254.169.254 or localhost would otherwise sail straight past
+ * the initial check, since `redirect: "follow"` never re-validates.
+ */
+async function assertNotDnsRebound(url) {
+    if (await hostResolvesToPrivateAddress(url.hostname)) {
+        throw new Error(`Refusing to fetch ${url.hostname}: resolves to a private/internal address`);
+    }
+}
+async function fetchFollowingRedirects(url, signal, headers) {
+    let current = url;
+    await assertNotDnsRebound(current);
+    for (let hop = 0;; hop++) {
+        const res = await fetch(current, { redirect: "manual", signal, headers });
+        const isRedirect = res.status >= 300 && res.status < 400;
+        const location = res.headers.get("location");
+        if (!isRedirect || !location) {
+            return { res, finalUrl: current };
+        }
+        if (hop >= MAX_REDIRECTS) {
+            throw new Error(`Too many redirects fetching ${url.href} (stopped at ${current.href})`);
+        }
+        current = assertPublicUrl(new URL(location, current).href);
+        await assertNotDnsRebound(current);
+    }
+}
+/**
+ * Read a response body up to `maxBytes`, stopping the underlying stream as
+ * soon as the cap is hit instead of buffering the whole thing first. A
+ * server that ignores Content-Length (or lies about it) can otherwise be
+ * used to exhaust process memory before `truncateResult` ever runs.
+ */
+async function readBodyCapped(res, maxBytes) {
+    if (!res.body)
+        return res.text();
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (!value)
+            continue;
+        total += value.length;
+        if (total > maxBytes) {
+            const keep = value.length - (total - maxBytes);
+            if (keep > 0)
+                chunks.push(value.subarray(0, keep));
+            await reader.cancel();
+            break;
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString("utf-8");
+}
+/** Collapse an HTML document down to readable plain text (best-effort, no deps). */
+function htmlToText(html) {
+    return html
+        .replace(/<script[\s\S]*?<\/script>/gi, " ")
+        .replace(/<style[\s\S]*?<\/style>/gi, " ")
+        .replace(/<noscript[\s\S]*?<\/noscript>/gi, " ")
+        .replace(/<!--[\s\S]*?-->/g, " ")
+        .replace(/<\/(p|div|li|tr|h[1-6]|section|article|br)>/gi, "\n")
+        .replace(/<br\s*\/?>/gi, "\n")
+        .replace(/<[^>]+>/g, " ")
+        .replace(/&nbsp;/gi, " ")
+        .replace(/&amp;/gi, "&")
+        .replace(/&lt;/gi, "<")
+        .replace(/&gt;/gi, ">")
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;/gi, "'")
+        .replace(/[ \t]+/g, " ")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+}
+/**
+ * Fetch one URL and return its text content. HTML is reduced to plain text;
+ * JSON and plain-text responses are returned as-is. Used by both the fetch_url
+ * tool and deep_research. The result is untrusted web content — callers that
+ * feed it to the model must fence it (the agent loop does this for tools with
+ * `external: true`).
+ */
+export async function fetchUrlText(raw, maxChars = DEFAULT_MAX_CHARS) {
+    const url = assertPublicUrl(raw);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    let res;
+    let finalUrl;
+    try {
+        ({ res, finalUrl } = await fetchFollowingRedirects(url, controller.signal, {
+            // Some servers 403 an unknown agent; identify honestly.
+            "User-Agent": "kritya-agent/1.0 (+https://github.com/) fetch_url",
+            Accept: "text/html,application/xhtml+xml,application/json,text/plain,*/*",
+        }));
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === "AbortError") {
+            throw new Error(`Timed out after ${FETCH_TIMEOUT_MS / 1000}s fetching ${url.href}`, {
+                cause: err,
+            });
+        }
+        throw new Error(`Could not fetch ${url.href}: ${err instanceof Error ? err.message : err}`, {
+            cause: err,
+        });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!res.ok) {
+        throw new Error(`HTTP ${res.status} ${res.statusText} for ${finalUrl.href}`);
+    }
+    const contentType = res.headers.get("content-type") ?? "";
+    if (!/text\/|application\/(json|xml|xhtml)|\+xml|\+json/i.test(contentType) && contentType) {
+        throw new Error(`Refusing to fetch non-text content (${contentType}) from ${finalUrl.href}. ` +
+            `fetch_url only reads web pages, docs, and APIs — not binaries.`);
+    }
+    const body = await readBodyCapped(res, MAX_RESPONSE_BYTES);
+    const text = /html/i.test(contentType) ? htmlToText(body) : body.trim();
+    const header = `URL: ${finalUrl.href}\nContent-Type: ${contentType || "unknown"}\n\n`;
+    return truncateResult(header + (text || "(empty response body)"), maxChars);
+}
+export const fetchUrlTool = {
+    name: "fetch_url",
+    description: "Fetch the full text of a single known web page, documentation URL, raw file, or JSON/API " +
+        "endpoint. Use this when you already have a specific URL to read — it complements web_search, " +
+        "which only returns short result snippets. HTML is reduced to readable text. Local and " +
+        "private-network addresses are refused.",
+    parameters: {
+        type: "object",
+        properties: {
+            url: { type: "string", description: "The http(s) URL to fetch" },
+            max_chars: {
+                type: "number",
+                description: `Max characters to return (default ${DEFAULT_MAX_CHARS})`,
+            },
+        },
+        required: ["url"],
+    },
+    // Prompts before reaching out: the URL is visible so an injected exfiltration
+    // target (data smuggled into a query string) can be caught before it's sent.
+    requiresPermission: true,
+    external: true,
+    summarize: (args) => `Fetch URL: ${args.url}`,
+    async execute(args) {
+        const maxChars = args.max_chars === undefined || args.max_chars === null
+            ? DEFAULT_MAX_CHARS
+            : Math.min(Math.max(Number(args.max_chars), 500), 50_000);
+        return fetchUrlText(String(args.url), maxChars);
+    },
+};

package/dist/tools/fuzzyMatch.js

@@ -0,0 +1,74 @@
+/**
+ * Edit matching for edit_file. Weaker models frequently reproduce a target
+ * snippet with slightly different indentation or trailing whitespace, which
+ * makes strict exact-string matching fail a lot. applyEdit tries an exact
+ * match first, then a line-trimmed fallback that ignores per-line leading and
+ * trailing whitespace while still requiring the lines to be contiguous and to
+ * match in order — enough tolerance to be useful without matching the wrong code.
+ */
+function countOccurrences(haystack, needle) {
+    if (!needle)
+        return 0;
+    return haystack.split(needle).length - 1;
+}
+/** Drop a single trailing empty line produced by a trailing newline in `s`. */
+function toLines(s) {
+    const lines = s.split("\n");
+    if (lines.length > 1 && lines[lines.length - 1] === "")
+        lines.pop();
+    return lines;
+}
+function lineTrimmedMatch(content, oldStr, newStr, replaceAll) {
+    const contentLines = content.split("\n");
+    const oldLines = toLines(oldStr);
+    if (oldLines.length === 0)
+        return null;
+    const trimmedOld = oldLines.map((l) => l.trim());
+    const starts = [];
+    for (let i = 0; i + oldLines.length <= contentLines.length; i++) {
+        let ok = true;
+        for (let j = 0; j < oldLines.length; j++) {
+            if (contentLines[i + j].trim() !== trimmedOld[j]) {
+                ok = false;
+                break;
+            }
+        }
+        if (ok) {
+            starts.push(i);
+            i += oldLines.length - 1;
+        }
+    }
+    if (starts.length === 0)
+        return null;
+    if (starts.length > 1 && !replaceAll) {
+        return { matched: true, count: starts.length, strategy: "line-trimmed" };
+    }
+    const newLines = toLines(newStr);
+    const targets = replaceAll ? [...starts].reverse() : [starts[0]];
+    for (const s of targets) {
+        contentLines.splice(s, oldLines.length, ...newLines);
+    }
+    return {
+        matched: true,
+        count: starts.length,
+        result: contentLines.join("\n"),
+        strategy: "line-trimmed",
+    };
+}
+export function applyEdit(content, oldStr, newStr, replaceAll) {
+    const exactCount = countOccurrences(content, oldStr);
+    if (exactCount > 0) {
+        if (exactCount > 1 && !replaceAll) {
+            return { matched: true, count: exactCount, strategy: "exact" };
+        }
+        const result = replaceAll
+            ? content.split(oldStr).join(newStr)
+            : content.replace(oldStr, newStr);
+        return { matched: true, count: exactCount, result, strategy: "exact" };
+    }
+    return (lineTrimmedMatch(content, oldStr, newStr, replaceAll) ?? {
+        matched: false,
+        count: 0,
+        strategy: "none",
+    });
+}

package/dist/tools/glob.js

@@ -0,0 +1,34 @@
+import path from "node:path";
+import fg from "fast-glob";
+import { isPathSafe, truncateResult, countLines } from "./common.js";
+import { loadIgnorePatterns } from "./ignore.js";
+export const globTool = {
+    name: "glob",
+    description: "Find files matching a glob pattern (e.g. 'src/**/*.ts'). Ignores node_modules, .git, " +
+        "and anything matched by a .krityaignore file in the workspace root.",
+    parameters: {
+        type: "object",
+        properties: {
+            pattern: { type: "string", description: "Glob pattern relative to the workspace root" },
+        },
+        required: ["pattern"],
+    },
+    requiresPermission: false,
+    summarize: (args) => `Glob ${args.pattern}`,
+    resultSummary: (output) => countLines(output, "match", "matches"),
+    async execute(args, ctx) {
+        // Models on Windows sometimes emit backslash paths; fast-glob needs forward slashes.
+        const files = await fg(String(args.pattern).replaceAll("\\", "/"), {
+            cwd: ctx.workspace,
+            dot: false,
+            onlyFiles: true,
+            followSymbolicLinks: false,
+            ignore: ["**/node_modules/**", "**/.git/**", ...loadIgnorePatterns(ctx.workspace)],
+            suppressErrors: true,
+        });
+        const safeFiles = files.filter((f) => isPathSafe(ctx.workspace, path.join(ctx.workspace, f)));
+        const capped = safeFiles.sort().slice(0, 200);
+        const suffix = safeFiles.length > 200 ? `\n... [${safeFiles.length - 200} more]` : "";
+        return truncateResult(capped.join("\n") + suffix || "(no matches)");
+    },
+};

package/dist/tools/grep.js

@@ -0,0 +1,85 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import fg from "fast-glob";
+import { isPathSafe, resolveSafe, safeCompileRegex, truncateResult, meaningfulLines, } from "./common.js";
+import { loadIgnorePatterns } from "./ignore.js";
+const MAX_MATCHES = 200;
+const MAX_FILE_BYTES = 1024 * 1024;
+export const grepTool = {
+    name: "grep",
+    description: "Search file contents with a regular expression. Returns 'file:line: text' matches. " +
+        "Ignores node_modules, .git, binary files, and anything matched by a .krityaignore " +
+        "file in the workspace root.",
+    parameters: {
+        type: "object",
+        properties: {
+            pattern: { type: "string", description: "JavaScript regular expression to search for" },
+            path: { type: "string", description: "Directory to search in (default: workspace root)" },
+            include: {
+                type: "string",
+                description: "Glob filter for files to search, e.g. '**/*.ts' (default: all files)",
+            },
+        },
+        required: ["pattern"],
+    },
+    requiresPermission: false,
+    summarize: (args) => `Grep /${args.pattern}/ in ${args.path ?? "."}`,
+    resultSummary(output) {
+        const lines = meaningfulLines(output);
+        if (!lines)
+            return "no matches";
+        const files = new Set(lines.map((l) => l.split(":")[0])).size;
+        return `${lines.length} match${lines.length === 1 ? "" : "es"} in ${files} file${files === 1 ? "" : "s"}`;
+    },
+    async execute(args, ctx) {
+        const regex = safeCompileRegex(String(args.pattern));
+        const searchRoot = resolveSafe(ctx.workspace, String(args.path ?? "."));
+        // Models on Windows sometimes emit backslash paths; fast-glob needs forward slashes.
+        const files = await fg(String(args.include ?? "**/*").replaceAll("\\", "/"), {
+            cwd: searchRoot,
+            dot: false,
+            onlyFiles: true,
+            followSymbolicLinks: false,
+            ignore: ["**/node_modules/**", "**/.git/**", ...loadIgnorePatterns(ctx.workspace)],
+            suppressErrors: true,
+        });
+        const matches = [];
+        for (const file of files) {
+            if (matches.length >= MAX_MATCHES)
+                break;
+            const abs = path.join(searchRoot, file);
+            // Same secret-file and symlink-escape guard as read_file, applied per
+            // matched file (the root-only check above isn't enough for a recursive
+            // glob that can traverse into a sensitive path or a symlink).
+            if (!isPathSafe(ctx.workspace, abs))
+                continue;
+            let stat;
+            try {
+                stat = await fs.stat(abs);
+            }
+            catch {
+                continue;
+            }
+            if (stat.size > MAX_FILE_BYTES)
+                continue;
+            let content;
+            try {
+                content = await fs.readFile(abs, "utf8");
+            }
+            catch {
+                continue;
+            }
+            if (content.slice(0, 8000).includes("\0"))
+                continue;
+            const rel = path.relative(ctx.workspace, abs);
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length && matches.length < MAX_MATCHES; i++) {
+                if (regex.test(lines[i])) {
+                    matches.push(`${rel}:${i + 1}: ${lines[i].slice(0, 250)}`);
+                }
+            }
+        }
+        const suffix = matches.length >= MAX_MATCHES ? `\n... [match limit reached]` : "";
+        return truncateResult(matches.join("\n") + suffix || "(no matches)");
+    },
+};

package/dist/tools/ignore.js

@@ -0,0 +1,28 @@
+import fs from "node:fs";
+import path from "node:path";
+const IGNORE_FILE = ".krityaignore";
+/** Converts one gitignore-style line into fast-glob ignore pattern(s). */
+function toGlobPatterns(line) {
+    let pattern = line.trim();
+    if (!pattern || pattern.startsWith("#") || pattern.startsWith("!"))
+        return [];
+    const isDir = pattern.endsWith("/");
+    if (isDir)
+        pattern = pattern.slice(0, -1);
+    const anchored = pattern.startsWith("/");
+    if (anchored)
+        pattern = pattern.slice(1);
+    const base = anchored ? pattern : `**/${pattern}`;
+    return isDir ? [`${base}/**`] : [base, `${base}/**`];
+}
+/** Reads `<workspace>/.krityaignore` (gitignore-style, one pattern per line) as fast-glob ignore patterns. */
+export function loadIgnorePatterns(workspace) {
+    let raw;
+    try {
+        raw = fs.readFileSync(path.join(workspace, IGNORE_FILE), "utf8");
+    }
+    catch {
+        return [];
+    }
+    return raw.split("\n").flatMap(toGlobPatterns);
+}

package/dist/tools/index.js

@@ -0,0 +1,66 @@
+import { readFileTool } from "./read.js";
+import { writeFileTool } from "./write.js";
+import { editFileTool } from "./edit.js";
+import { shellTool } from "./shell.js";
+import { listDirTool } from "./ls.js";
+import { globTool } from "./glob.js";
+import { grepTool } from "./grep.js";
+import { updateTasksTool } from "./tasks.js";
+import { webSearchTool } from "./webSearch.js";
+import { fetchUrlTool } from "./fetchUrl.js";
+import { deepResearchTool } from "./deepResearch.js";
+import { bgOutputTool, bgKillTool } from "./bg.js";
+import { spawnAgentTool } from "./subagent.js";
+import { spawnWriteAgentTool } from "./writeAgent.js";
+import { readDocumentTool, writeDocumentTool, editSpreadsheetTool, editPdfTool, } from "./document.js";
+import { readNotebookTool, editNotebookTool } from "./notebook.js";
+import { lspDefinitionTool, lspReferencesTool, lspDiagnosticsTool, lspHoverTool, lspRenameTool, } from "./lsp.js";
+import { repoMapTool } from "./repoMap.js";
+import { loadSkillTool } from "./skills.js";
+import { askUserTool } from "./askUser.js";
+export const ALL_TOOLS = [
+    readFileTool,
+    writeFileTool,
+    editFileTool,
+    shellTool,
+    bgOutputTool,
+    bgKillTool,
+    listDirTool,
+    globTool,
+    grepTool,
+    repoMapTool,
+    lspDefinitionTool,
+    lspReferencesTool,
+    lspDiagnosticsTool,
+    lspHoverTool,
+    lspRenameTool,
+    updateTasksTool,
+    webSearchTool,
+    fetchUrlTool,
+    deepResearchTool,
+    spawnAgentTool,
+    spawnWriteAgentTool,
+    readDocumentTool,
+    writeDocumentTool,
+    editSpreadsheetTool,
+    editPdfTool,
+    readNotebookTool,
+    editNotebookTool,
+    loadSkillTool,
+    askUserTool,
+];
+/** Read-only tools a subagent is allowed to use (no writes, edits, or shell). */
+export const READONLY_TOOLS = [
+    readFileTool,
+    listDirTool,
+    globTool,
+    grepTool,
+    repoMapTool,
+    lspDefinitionTool,
+    lspReferencesTool,
+    lspDiagnosticsTool,
+    lspHoverTool,
+    readDocumentTool,
+    readNotebookTool,
+    loadSkillTool,
+];

package/dist/tools/ls.js

@@ -0,0 +1,27 @@
+import fs from "node:fs/promises";
+import { resolveSafe, truncateResult, countLines } from "./common.js";
+export const listDirTool = {
+    name: "list_dir",
+    description: "List the entries of a directory in the workspace. Directories end with '/'.",
+    parameters: {
+        type: "object",
+        properties: {
+            path: {
+                type: "string",
+                description: "Directory path relative to the workspace root (default: '.')",
+            },
+        },
+    },
+    requiresPermission: false,
+    summarize: (args) => `List ${args.path ?? "."}`,
+    resultSummary: (output) => countLines(output, "entry", "entries"),
+    async execute(args, ctx) {
+        const abs = resolveSafe(ctx.workspace, String(args.path ?? "."));
+        const entries = await fs.readdir(abs, { withFileTypes: true });
+        const names = entries
+            .map((e) => (e.isDirectory() ? `${e.name}/` : e.name))
+            .sort()
+            .slice(0, 500);
+        return truncateResult(names.join("\n") || "(empty)");
+    },
+};