pi-code 0.1.0 → 0.2.1

package/extensions/todo.ts

@@ -134,7 +134,7 @@ class TodoOverlay {
   private uiCtx?: ExtensionUIContext
   private widgetRegistered = false
   private tui?: TUI
-  private getTodos: () => Todo[]
+  private readonly getTodos: () => Todo[]
 
   constructor(getTodos: () => Todo[]) {
     this.getTodos = getTodos
@@ -225,9 +225,9 @@ class TodoOverlay {
  * UI component for the /todos command
  */
 class TodoListComponent {
-  private todos: Todo[]
-  private theme: Theme
-  private onClose: () => void
+  private readonly todos: Todo[]
+  private readonly theme: Theme
+  private readonly onClose: () => void
   private cachedWidth?: number
   private cachedLines?: string[]
 
@@ -254,15 +254,14 @@ class TodoListComponent {
     lines.push('')
     const title = th.fg('accent', ' Todos ')
     const headerLine = th.fg('borderMuted', '─'.repeat(3)) + title + th.fg('borderMuted', '─'.repeat(Math.max(0, width - 10)))
-    lines.push(truncateToWidth(headerLine, width))
-    lines.push('')
+    lines.push(truncateToWidth(headerLine, width), '')
 
     if (this.todos.length === 0) {
       lines.push(truncateToWidth(`  ${th.fg('dim', 'No todos yet. Ask the agent to add some!')}`, width))
     } else {
       const completed = this.todos.filter((t) => t.status === 'completed').length
-      lines.push(truncateToWidth(`  ${th.fg('muted', `${completed}/${this.todos.length} completed`)}`, width))
-      lines.push('')
+      const completedLabel = `${completed}/${this.todos.length} completed`
+      lines.push(truncateToWidth(`  ${th.fg('muted', completedLabel)}`, width), '')
 
       for (const todo of this.todos) {
         const glyph = statusGlyph(todo.status, th)
@@ -270,15 +269,14 @@ class TodoListComponent {
         const text = todo.status === 'completed' ? th.fg('dim', todo.text) : th.fg('text', todo.text)
         let line = `  ${glyph} ${id} ${text}`
         if (todo.status === 'in_progress' && todo.activeForm) {
-          line += ` ${th.fg('dim', `(${todo.activeForm})`)}`
+          const activeFormLabel = `(${todo.activeForm})`
+          line += ` ${th.fg('dim', activeFormLabel)}`
         }
         lines.push(truncateToWidth(line, width))
       }
     }
 
-    lines.push('')
-    lines.push(truncateToWidth(`  ${th.fg('dim', 'Press Escape to close')}`, width))
-    lines.push('')
+    lines.push('', truncateToWidth(`  ${th.fg('dim', 'Press Escape to close')}`, width), '')
 
     this.cachedWidth = width
     this.cachedLines = lines
@@ -296,7 +294,27 @@ class TodoListComponent {
 // genuine replay bugs still propagate instead of being silently swallowed.
 const isStaleCtxError = (e: unknown): boolean => /stale after session replacement/.test(String(e))
 
-export default function (pi: ExtensionAPI) {
+const LIST_RESULT_PREVIEW = 5
+
+const renderTodoListResult = (todoList: Todo[], expanded: boolean, theme: Theme): Text => {
+  if (todoList.length === 0) {
+    return new Text(theme.fg('dim', 'No todos'), 0, 0)
+  }
+  let listText = theme.fg('muted', `${todoList.length} todo(s):`)
+  const display = expanded ? todoList : todoList.slice(0, LIST_RESULT_PREVIEW)
+  for (const t of display) {
+    const idLabel = `#${t.id}`
+    const itemText = t.status === 'completed' ? theme.fg('dim', t.text) : theme.fg('muted', t.text)
+    listText += `\n${statusGlyph(t.status, theme)} ${theme.fg('accent', idLabel)} ${itemText}`
+  }
+  if (!expanded && todoList.length > LIST_RESULT_PREVIEW) {
+    const moreLabel = `... ${todoList.length - LIST_RESULT_PREVIEW} more`
+    listText += `\n${theme.fg('dim', moreLabel)}`
+  }
+  return new Text(listText, 0, 0)
+}
+
+export default function todoExtension(pi: ExtensionAPI) {
   // In-memory state (reconstructed from session on load)
   let todos: Todo[] = []
   let nextId = 1
@@ -382,7 +400,10 @@ export default function (pi: ExtensionAPI) {
     todo.status = 'in_progress'
     if (params.activeForm) todo.activeForm = params.activeForm
     let text = `Started #${todo.id}: ${todo.text}`
-    if (demoted.length > 0) text += ` (moved ${demoted.map((t) => `#${t.id}`).join(', ')} back to pending)`
+    if (demoted.length > 0) {
+      const movedIds = demoted.map((t) => `#${t.id}`).join(', ')
+      text += ` (moved ${movedIds} back to pending)`
+    }
     return ok('start', text)
   }
 
@@ -446,9 +467,18 @@ export default function (pi: ExtensionAPI) {
 
     renderCall(args, theme, _context) {
       let text = theme.fg('toolTitle', theme.bold('todo ')) + theme.fg('muted', args.action)
-      if (args.id !== undefined) text += ` ${theme.fg('accent', `#${args.id}`)}`
-      if (args.text) text += ` ${theme.fg('dim', `"${args.text}"`)}`
-      if (args.activeForm) text += ` ${theme.fg('dim', `(${args.activeForm})`)}`
+      if (args.id !== undefined) {
+        const idLabel = `#${args.id}`
+        text += ` ${theme.fg('accent', idLabel)}`
+      }
+      if (args.text) {
+        const textLabel = `"${args.text}"`
+        text += ` ${theme.fg('dim', textLabel)}`
+      }
+      if (args.activeForm) {
+        const activeFormLabel = `(${args.activeForm})`
+        text += ` ${theme.fg('dim', activeFormLabel)}`
+      }
       return new Text(text, 0, 0)
     },
 
@@ -464,20 +494,7 @@ export default function (pi: ExtensionAPI) {
       }
 
       if (details.action === 'list') {
-        const todoList = details.todos
-        if (todoList.length === 0) {
-          return new Text(theme.fg('dim', 'No todos'), 0, 0)
-        }
-        let listText = theme.fg('muted', `${todoList.length} todo(s):`)
-        const display = expanded ? todoList : todoList.slice(0, 5)
-        for (const t of display) {
-          const itemText = t.status === 'completed' ? theme.fg('dim', t.text) : theme.fg('muted', t.text)
-          listText += `\n${statusGlyph(t.status, theme)} ${theme.fg('accent', `#${t.id}`)} ${itemText}`
-        }
-        if (!expanded && todoList.length > 5) {
-          listText += `\n${theme.fg('dim', `... ${todoList.length - 5} more`)}`
-        }
-        return new Text(listText, 0, 0)
+        return renderTodoListResult(details.todos, expanded, theme)
       }
 
       const text = result.content[0]

package/extensions/web.ts

@@ -32,14 +32,16 @@ export function decodeEntities(text: string): string {
 }
 
 export function stripTags(html: string): string {
-  return decodeEntities(html.replace(/<[^>]*>/g, ''))
+  // [^<>] rather than [^>]: excluding `<` bounds a failed match at the next tag start
+  // instead of rescanning to end of input, which is what makes the strip linear.
+  return decodeEntities(html.replace(/<[^<>]*>/g, ''))
     .replace(/\s+/g, ' ')
     .trim()
 }
 
 /** Resolve DuckDuckGo's redirect links (/l/?uddg=<encoded>) to the target URL. */
 export function resolveResultUrl(href: string): string {
-  const match = href.match(/[?&]uddg=([^&]+)/)
+  const match = /[?&]uddg=([^&]+)/.exec(href)
   if (match) {
     try {
       return decodeURIComponent(match[1])
@@ -72,35 +74,38 @@ export function htmlToText(html: string): string {
     .replace(/<script[\s\S]*?<\/script>/gi, ' ')
     .replace(/<style[\s\S]*?<\/style>/gi, ' ')
     .replace(/<(br|\/p|\/div|\/h[1-6]|\/li|\/tr)[^>]*>/gi, '\n')
-  const text = decodeEntities(withoutBlocks.replace(/<[^>]*>/g, ' '))
+  const text = decodeEntities(withoutBlocks.replace(/<[^<>]*>/g, ' '))
     .replace(/[ \t]+/g, ' ')
     .replace(/\n\s+/g, '\n')
     .trim()
   return text.length > MAX_FETCH_CHARS ? `${text.slice(0, MAX_FETCH_CHARS)}\n[truncated ${text.length - MAX_FETCH_CHARS} chars]` : text
 }
 
-/** SSRF guard: true for loopback, RFC1918, link-local, CGNAT, and private IPv6 ranges. Fails closed on unparseable input. */
-export function isPrivateAddress(ip: string): boolean {
-  const addr = ip
-    .toLowerCase()
-    .replace(/^\[|\]$/g, '')
-    .split('%')[0]
-  if (addr.includes(':')) {
-    // IPv4-mapped (::ffff:...) and NAT64 (64:ff9b::...) forms embed an IPv4 in the low 32 bits,
-    // in either dotted-decimal or hex; the WHATWG URL parser normalizes literals to the hex form.
-    const dotted = addr.match(/^(?:::ffff:|64:ff9b::)(\d+\.\d+\.\d+\.\d+)$/)
-    if (dotted) return isPrivateAddress(dotted[1])
-    const hex = addr.match(/^(?:::ffff:|64:ff9b::)([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)
-    if (hex) {
-      const hi = Number.parseInt(hex[1], 16)
-      const lo = Number.parseInt(hex[2], 16)
-      return isPrivateAddress(`${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`)
-    }
-    if (addr === '::1' || addr === '::') return true
-    if (/^fe[89ab]/.test(addr)) return true // link-local fe80::/10
-    if (/^f[cd]/.test(addr)) return true // unique local fc00::/7
-    return false
-  }
+/**
+ * IPv4-mapped (::ffff:...) and NAT64 (64:ff9b::...) forms embed an IPv4 in the low 32 bits,
+ * in either dotted-decimal or hex; the WHATWG URL parser normalizes literals to the hex form.
+ */
+function embeddedIpv4(addr: string): string | null {
+  const dotted = /^(?:::ffff:|64:ff9b::)(\d+\.\d+\.\d+\.\d+)$/.exec(addr)
+  if (dotted) return dotted[1]
+  const hex = /^(?:::ffff:|64:ff9b::)([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(addr)
+  if (!hex) return null
+  const hi = Number.parseInt(hex[1], 16)
+  const lo = Number.parseInt(hex[2], 16)
+  return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`
+}
+
+function isPrivateIpv6(addr: string): boolean {
+  const embedded = embeddedIpv4(addr)
+  if (embedded) return isPrivateAddress(embedded)
+  if (addr === '::1' || addr === '::') return true
+  if (/^fe[89ab]/.test(addr)) return true // link-local fe80::/10
+  if (/^fe[cdef]/.test(addr)) return true // site-local fec0::/10, deprecated but still routed
+  if (addr.startsWith('ff')) return true // multicast ff00::/8
+  return /^f[cd]/.test(addr) // unique local fc00::/7
+}
+
+function isPrivateIpv4(addr: string): boolean {
   const parts = addr.split('.').map(Number)
   if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)) return true
   const [a, b] = parts
@@ -108,13 +113,27 @@ export function isPrivateAddress(ip: string): boolean {
   if (a === 169 && b === 254) return true
   if (a === 172 && b >= 16 && b <= 31) return true
   if (a === 192 && b === 168) return true
-  if (a === 100 && b >= 64 && b <= 127) return true
-  return false
+  if (a === 192 && b === 0 && parts[2] === 0) return true // protocol assignments 192.0.0/24
+  if (a === 198 && (b === 18 || b === 19)) return true // benchmarking 198.18/15
+  if (a >= 224) return true // multicast 224/4, reserved 240/4, broadcast 255.255.255.255
+  return a === 100 && b >= 64 && b <= 127
+}
+
+/** SSRF guard: true for loopback, RFC1918, link-local, CGNAT, and private IPv6 ranges. Fails closed on unparseable input. */
+export function isPrivateAddress(ip: string): boolean {
+  const addr = ip
+    .toLowerCase()
+    .replace(/^\[|\]$/g, '')
+    .split('%')[0]
+  return addr.includes(':') ? isPrivateIpv6(addr) : isPrivateIpv4(addr)
 }
 
 async function assertPublicHost(url: URL): Promise<void> {
   const host = url.hostname.replace(/^\[|\]$/g, '')
   const addresses = await lookup(host, { all: true, verbatim: true })
+  // An empty list would leave nothing for the loop to reject, so the guard would pass
+  // vacuously. Schemes without a host (data:, file:) reach here the same way.
+  if (addresses.length === 0) throw new Error(`${url.hostname || url.protocol} did not resolve to any address`)
   for (const { address } of addresses) {
     if (isPrivateAddress(address)) throw new Error(`refusing to fetch private/internal address for ${url.hostname} (${address})`)
   }
@@ -150,6 +169,9 @@ async function fetchText(rawUrl: string): Promise<{ text: string; contentType: s
       const location = response.headers.get('location')
       if (!location) throw new Error(`redirect without location from ${url.hostname}`)
       url = new URL(location, url)
+      // Only the caller's URL was scheme-checked; a redirect could hand back data: or
+      // file:, which carry no host for the address guard to inspect.
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') throw new Error(`unsupported redirect scheme ${url.protocol} from ${rawUrl}`)
       continue
     }
     if (!response.ok) throw new Error(`HTTP ${response.status} for ${url}`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi-package"