pplx-zero 2.2.1 → 2.2.2

package/README.md

@@ -86,7 +86,6 @@ pplx --history
 |-------|-----|
 | `sonar` | Quick answers |
 | `sonar-pro` | Complex questions |
-| `sonar-reasoning` | Step-by-step |
 | `sonar-reasoning-pro` | Advanced reasoning |
 | `sonar-deep-research` | Research reports |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pplx-zero",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Minimal Perplexity AI CLI - search from terminal",
   "author": "kenzo",
   "license": "MIT",

package/src/api.ts

@@ -3,7 +3,7 @@ import type { FileAttachment } from './files';
 
 const API_URL = 'https://api.perplexity.ai/chat/completions';
 
-export const MODELS = ['sonar', 'sonar-pro', 'sonar-reasoning', 'sonar-reasoning-pro', 'sonar-deep-research'] as const;
+export const MODELS = ['sonar', 'sonar-pro', 'sonar-reasoning-pro', 'sonar-deep-research'] as const;
 export type Model = (typeof MODELS)[number];
 
 export interface SearchResult {
@@ -19,9 +19,10 @@ export interface StreamCallbacks {
 }
 
 interface MessageContent {
-  type: 'text' | 'file_url';
+  type: 'text' | 'file_url' | 'image_url';
   text?: string;
   file_url?: { url: string };
+  image_url?: { url: string };
   file_name?: string;
 }
 
@@ -32,12 +33,22 @@ function buildMessages(query: string, file?: FileAttachment): { role: string; co
 
   const content: MessageContent[] = [
     { type: 'text', text: query },
-    {
+  ];
+
+  if (file.type === 'image') {
+    // Images: use image_url with data URL prefix per Perplexity API spec
+    content.push({
+      type: 'image_url',
+      image_url: { url: `data:${file.mimeType};base64,${file.data}` },
+    });
+  } else {
+    // Documents: use file_url with raw base64
+    content.push({
       type: 'file_url',
       file_url: { url: file.data },
       file_name: file.filename,
-    },
-  ];
+    });
+  }
 
   return [{ role: 'user', content }];
 }

package/src/files.ts

@@ -1,5 +1,7 @@
-import { readFile } from 'node:fs/promises';
-import { extname } from 'node:path';
+import { readFile, stat } from 'node:fs/promises';
+import { extname, basename, resolve } from 'node:path';
+
+const MAX_FILE_SIZE = 50 * 1024 * 1024; // 50MB - Perplexity API limit
 
 const MIME_TYPES: Record<string, string> = {
   '.pdf': 'application/pdf',
@@ -20,14 +22,26 @@ export interface FileAttachment {
 }
 
 export async function encodeFile(path: string): Promise<FileAttachment> {
-  const ext = extname(path).toLowerCase();
+  // Security: prevent path traversal
+  if (path.includes('..')) {
+    throw new Error('Path traversal not allowed');
+  }
+  
+  const resolved = resolve(path);
+  const ext = extname(resolved).toLowerCase();
   const mimeType = MIME_TYPES[ext];
   
   if (!mimeType) {
     throw new Error(`Unsupported file type: ${ext}`);
   }
 
-  const buffer = await readFile(path);
+  // Security: check file size before reading into memory
+  const stats = await stat(resolved);
+  if (stats.size > MAX_FILE_SIZE) {
+    throw new Error(`File too large: ${(stats.size / 1024 / 1024).toFixed(1)}MB (max 50MB)`);
+  }
+
+  const buffer = await readFile(resolved);
   const data = buffer.toString('base64');
   const isImage = mimeType.startsWith('image/');
 
@@ -35,7 +49,7 @@ export async function encodeFile(path: string): Promise<FileAttachment> {
     type: isImage ? 'image' : 'file',
     data,
     mimeType,
-    filename: path.split('/').pop() || 'file',
+    filename: basename(resolved),
   };
 }
 

package/src/index.ts

@@ -72,8 +72,14 @@ if (positionals.length === 0 && !values.continue) {
   process.exit(2);
 }
 
+// Validate model before proceeding
+if (!MODELS.includes(values.model as Model)) {
+  console.error(fmt.error(`Invalid model: ${values.model}. Available: ${MODELS.join(', ')}`));
+  process.exit(2);
+}
+const model = values.model as Model;
+
 let query = positionals.join(' ');
-const model = (MODELS.includes(values.model as Model) ? values.model : 'sonar') as Model;
 
 if (values.continue) {
   const last = await getLastEntry();
@@ -90,7 +96,25 @@ if (values.continue) {
 }
 
 const filePath = values.file || values.image;
-const file = filePath ? await encodeFile(filePath) : undefined;
+let file;
+if (filePath) {
+  try {
+    file = await encodeFile(filePath);
+  } catch (err) {
+    let msg = err instanceof Error ? err.message : 'Unknown error reading file';
+    if (msg.includes('ENOENT')) {
+      msg = `File not found: ${filePath}`;
+    }
+    console.error(fmt.error(msg));
+    process.exit(2);
+  }
+}
+
+// Validate model supports image input
+if (file?.type === 'image' && model === 'sonar-deep-research') {
+  console.error(fmt.error('sonar-deep-research does not support image input. Use sonar or sonar-pro.'));
+  process.exit(2);
+}
 
 const startTime = Date.now();
 let fullContent = '';