min-agent 0.2.0 → 0.3.0

package/dist/http.js

@@ -0,0 +1,119 @@
+import { lookup } from "dns/promises";
+import { isIP } from "net";
+function isPrivateIpv4(parts) {
+    if (parts.length !== 4 || parts.some((p) => Number.isNaN(p)))
+        return true;
+    const [a, b] = parts;
+    if (a === 0 || a === 10 || a === 127)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    if (a === 198 && (b === 18 || b === 19))
+        return true;
+    return false;
+}
+/**
+ * Decode the tail of an IPv4-mapped IPv6 address (`::ffff:7f00:1` or
+ * `::ffff:127.0.0.1`) into IPv4 octets, or return null.
+ */
+function mappedIpv4Bytes(ip) {
+    const tail = ip.slice(7);
+    if (tail.includes(".")) {
+        return tail.split(".").map(Number);
+    }
+    const groups = tail.split(":");
+    if (groups.length !== 2)
+        return null;
+    const hi = parseInt(groups[0], 16);
+    const lo = parseInt(groups[1], 16);
+    if (Number.isNaN(hi) || Number.isNaN(lo))
+        return null;
+    return [hi >> 8, hi & 0xff, lo >> 8, lo & 0xff];
+}
+/** Check whether an IP address belongs to a private / reserved / loopback range. */
+export function isPrivateAddress(ip) {
+    if (ip.startsWith("::ffff:")) {
+        const bytes = mappedIpv4Bytes(ip);
+        if (bytes)
+            return isPrivateIpv4(bytes);
+        return true;
+    }
+    if (isIP(ip) === 6) {
+        const lower = ip.toLowerCase();
+        if (lower === "::1" || lower.startsWith("::"))
+            return true;
+        if (lower.startsWith("fc") || lower.startsWith("fd"))
+            return true;
+        if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb"))
+            return true;
+        if (lower.startsWith("2001:db8"))
+            return true;
+        return false;
+    }
+    return isPrivateIpv4(ip.split(".").map(Number));
+}
+/** Returns an error message if the URL is unsafe to fetch (SSRF protection), or null if safe. */
+export async function assertSafeUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return "Invalid URL";
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return "Only http/https URLs are allowed";
+    }
+    const host = parsed.hostname;
+    if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) {
+        return `Blocked: local hostname "${host}"`;
+    }
+    if (isIP(host)) {
+        return isPrivateAddress(host) ? `Blocked: private/internal IP "${host}"` : null;
+    }
+    try {
+        const addresses = await lookup(host, { all: true });
+        for (const addr of addresses) {
+            if (isPrivateAddress(addr.address)) {
+                return `Blocked: "${host}" resolves to private address "${addr.address}"`;
+            }
+        }
+    }
+    catch {
+        // DNS failure — let fetch surface the real error
+    }
+    return null;
+}
+/**
+ * Read a response body up to maxBytes. Bytes beyond the limit are dropped and
+ * the read is cancelled early so huge responses never fill memory.
+ */
+export async function readBodyLimited(response, maxBytes) {
+    if (!response.body) {
+        return { text: "", truncated: false };
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    let truncated = false;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            chunks.push(Buffer.from(value.subarray(0, value.byteLength - (total - maxBytes))));
+            truncated = true;
+            await reader.cancel();
+            break;
+        }
+        chunks.push(Buffer.from(value));
+    }
+    return { text: Buffer.concat(chunks).toString("utf-8"), truncated };
+}

package/dist/instructions.js

@@ -16,6 +16,21 @@ import { getRulesFile, loadConfig } from "./config.js";
  *   When the agent reads a file, nearby AGENTS.md/RULES.md are auto-loaded.
  */
 const PROJECT_FILES = ["AGENTS.md", "RULES.md", "CLAUDE.md"];
+function isWithinDir(root, p) {
+    const rel = path.relative(root, p);
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+function walkUpDirs(startDir, minDir) {
+    const dirs = [];
+    let current = path.resolve(startDir);
+    while (current !== path.dirname(minDir) && isWithinDir(minDir, current)) {
+        dirs.push(current);
+        if (current === minDir)
+            break;
+        current = path.dirname(current);
+    }
+    return dirs;
+}
 /** Tracks which instruction files have already been loaded to avoid duplicates */
 export class InstructionTracker {
     loaded = new Set();
@@ -33,10 +48,9 @@ export class InstructionTracker {
     resolveForFile(filepath) {
         const results = [];
         const root = process.cwd();
-        let current = path.dirname(path.resolve(filepath));
-        while (current.startsWith(root) && current !== path.dirname(root)) {
+        for (const dir of walkUpDirs(path.dirname(path.resolve(filepath)), root)) {
             for (const file of PROJECT_FILES) {
-                const candidate = path.join(current, file);
+                const candidate = path.join(dir, file);
                 if (existsSync(candidate) && !this.isLoaded(candidate)) {
                     try {
                         const content = readFileSync(candidate, "utf-8").trim();
@@ -50,32 +64,24 @@ export class InstructionTracker {
             }
             if (results.length > 0)
                 break;
-            current = path.dirname(current);
         }
         return results;
     }
 }
-function findProjectInstructions() {
+export function findProjectInstructions() {
     const results = [];
-    let current = process.cwd();
-    const root = path.parse(current).root;
-    while (current !== root) {
-        // Check .min-agent/AGENTS.md in project
-        const dotDir = path.join(current, ".min-agent", "AGENTS.md");
+    const root = path.parse(process.cwd()).root;
+    for (const dir of walkUpDirs(process.cwd(), root)) {
+        const dotDir = path.join(dir, ".min-agent", "AGENTS.md");
         if (existsSync(dotDir)) {
             results.push(dotDir);
             break;
         }
-        for (const file of PROJECT_FILES) {
-            const filepath = path.join(current, file);
-            if (existsSync(filepath)) {
-                results.push(filepath);
-                break;
-            }
-        }
-        if (results.length > 0)
+        const found = PROJECT_FILES.find((file) => existsSync(path.join(dir, file)));
+        if (found) {
+            results.push(path.join(dir, found));
             break;
-        current = path.dirname(current);
+        }
     }
     return results;
 }
@@ -103,23 +109,35 @@ function resolveConfigInstructions() {
     }
     return results;
 }
-async function fetchRemoteInstructions() {
-    const config = loadConfig();
-    const instructions = config.instructions ?? [];
-    const results = [];
-    const urls = instructions.filter((i) => i.startsWith("http://") || i.startsWith("https://"));
-    for (const url of urls) {
-        try {
-            const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
-            if (response.ok) {
-                const text = await response.text();
-                if (text.trim())
-                    results.push(`Instructions from: ${url}\n${text}`);
+const REMOTE_CACHE_TTL_MS = 60_000;
+const remoteCache = new Map();
+async function fetchRemoteInstruction(url) {
+    const cached = remoteCache.get(url);
+    if (cached && Date.now() - cached.fetchedAt < REMOTE_CACHE_TTL_MS)
+        return cached.text;
+    try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
+        if (response.ok) {
+            const text = await response.text();
+            if (text.trim()) {
+                remoteCache.set(url, { fetchedAt: Date.now(), text });
+                return text;
             }
         }
-        catch { }
     }
-    return results;
+    catch { }
+    return null;
+}
+export async function fetchRemoteInstructions(urls) {
+    const config = loadConfig();
+    const instructions = urls ?? config.instructions ?? [];
+    const results = await Promise.all(instructions
+        .filter((i) => i.startsWith("http://") || i.startsWith("https://"))
+        .map(async (url) => {
+        const text = await fetchRemoteInstruction(url);
+        return text ? `Instructions from: ${url}\n${text}` : "";
+    }));
+    return results.filter(Boolean);
 }
 export async function loadInstructions() {
     const parts = [];

package/dist/logger.js

@@ -0,0 +1,66 @@
+import { mkdirSync, readdirSync, unlinkSync, writeFileSync } from "fs";
+import path from "path";
+import { getConfigDir } from "./config.js";
+const KEEP_DAYS = 7;
+function logsDir() {
+    return path.join(getConfigDir(), "logs");
+}
+function logFilePath(date) {
+    const y = date.getFullYear();
+    const m = String(date.getMonth() + 1).padStart(2, "0");
+    const d = String(date.getDate()).padStart(2, "0");
+    return path.join(logsDir(), `min-agent.${y}-${m}-${d}.log`);
+}
+export function initLogger() {
+    try {
+        mkdirSync(logsDir(), { recursive: true });
+        const cutoff = Date.now() - KEEP_DAYS * 24 * 60 * 60 * 1000;
+        for (const f of readdirSync(logsDir())) {
+            const m = f.match(/^min-agent\.(\d{4})-(\d{2})-(\d{2})\.log$/);
+            if (!m)
+                continue;
+            const ts = new Date(`${m[1]}-${m[2]}-${m[3]}T00:00:00`).getTime();
+            if (ts < cutoff) {
+                try {
+                    unlinkSync(path.join(logsDir(), f));
+                }
+                catch { }
+            }
+        }
+    }
+    catch { }
+}
+function writeLog(level, msg) {
+    try {
+        const now = new Date();
+        const time = `${String(now.getHours()).padStart(2, "0")}:${String(now.getMinutes()).padStart(2, "0")}:${String(now.getSeconds()).padStart(2, "0")}`;
+        writeFileSync(logFilePath(now), `[${time}] [${level}] ${scrubSecrets(msg)}\n`, { flag: "a" });
+    }
+    catch { }
+}
+const SECRET_PATTERNS = [
+    /\b(Bearer\s+)[A-Za-z0-9._~+/\-]{8,}/g,
+    /\b(api[_-]?key|apikey|token|secret|password|passwd)\s*[:=]\s*["']?[A-Za-z0-9._~+/\-]{6,}["']?/gi,
+    /\b(sk-[A-Za-z0-9_-]{6,})/g,
+    /\b(gh[pousr]_[A-Za-z0-9]{20,})/g,
+];
+/** Mask obvious secrets before anything hits the log file. */
+function scrubSecrets(msg) {
+    let out = msg;
+    for (const re of SECRET_PATTERNS)
+        out = out.replace(re, "$1***");
+    return out;
+}
+export function log(level, msg) {
+    writeLog(level, msg);
+}
+function summarize(v, max = 200) {
+    const s = typeof v === "string" ? v : JSON.stringify(v) ?? String(v);
+    return s.length > max ? s.slice(0, max) + "…" : s;
+}
+export function logToolCall(name, input) {
+    writeLog("info", `tool_call ${name} ${summarize(input)}`);
+}
+export function logToolResult(name, output) {
+    writeLog("info", `tool_result ${name} ${summarize(output)}`);
+}

package/dist/markdown.js

@@ -2,6 +2,7 @@
  * Lightweight streaming markdown renderer for terminal.
  * Tracks state across text deltas to apply ANSI formatting.
  */
+import { displayWidth } from "./tui/text-width.js";
 function useColor() {
     if ("NO_COLOR" in process.env)
         return false;
@@ -128,51 +129,9 @@ export class MarkdownRenderer {
     parseTableRow(line) {
         return line.trim().slice(1, -1).split("|").map((cell) => cell.trim());
     }
-    /** Get display width of a string (CJK/emoji chars = 2, others = 1) */
-    displayWidth(str) {
-        let width = 0;
-        for (const ch of str) {
-            const code = ch.codePointAt(0) ?? 0;
-            if (
-            // CJK
-            (code >= 0x1100 && code <= 0x115f) ||
-                (code >= 0x2e80 && code <= 0x303e) ||
-                (code >= 0x3040 && code <= 0x33bf) ||
-                (code >= 0x3400 && code <= 0x4dbf) ||
-                (code >= 0x4e00 && code <= 0x9fff) ||
-                (code >= 0xa000 && code <= 0xa4cf) ||
-                (code >= 0xac00 && code <= 0xd7af) ||
-                (code >= 0xf900 && code <= 0xfaff) ||
-                (code >= 0xfe30 && code <= 0xfe6f) ||
-                (code >= 0xff01 && code <= 0xff60) ||
-                (code >= 0xffe0 && code <= 0xffe6) ||
-                (code >= 0x20000 && code <= 0x2fffd) ||
-                (code >= 0x30000 && code <= 0x3fffd) ||
-                // Emoji
-                (code >= 0x1f300 && code <= 0x1f9ff) || // Misc Symbols, Emoticons, Dingbats, etc.
-                (code >= 0x1fa00 && code <= 0x1faff) || // Chess, Extended-A
-                (code >= 0x2600 && code <= 0x27bf) || // Misc Symbols, Dingbats
-                (code >= 0xfe00 && code <= 0xfe0f) || // Variation Selectors (skip width)
-                (code >= 0x200d && code <= 0x200d) || // ZWJ (skip width)
-                (code >= 0x1f1e0 && code <= 0x1f1ff) // Regional Indicators (flags)
-            ) {
-                // Variation selectors and ZWJ are zero-width joiners
-                if ((code >= 0xfe00 && code <= 0xfe0f) || code === 0x200d) {
-                    width += 0;
-                }
-                else {
-                    width += 2;
-                }
-            }
-            else {
-                width += 1;
-            }
-        }
-        return width;
-    }
     /** Pad string to target display width */
     padToWidth(str, targetWidth) {
-        const currentWidth = this.displayWidth(str);
+        const currentWidth = displayWidth(str);
         const padding = targetWidth - currentWidth;
         return padding > 0 ? str + " ".repeat(padding) : str;
     }
@@ -184,7 +143,7 @@ export class MarkdownRenderer {
         const widths = Array(colCount).fill(0);
         for (const row of this.tableRows) {
             for (let i = 0; i < row.length; i++) {
-                widths[i] = Math.max(widths[i], this.displayWidth(row[i] ?? ""));
+                widths[i] = Math.max(widths[i], displayWidth(row[i] ?? ""));
             }
         }
         const lines = [];