reasonix 0.4.14 → 0.4.16

package/dist/index.js

@@ -47,8 +47,8 @@ function computeWait(attempt, initial, cap, retryAfter) {
 }
 function sleep(ms, signal) {
   if (ms <= 0) return Promise.resolve();
-  return new Promise((resolve4, reject) => {
-    const timer = setTimeout(resolve4, ms);
+  return new Promise((resolve5, reject) => {
+    const timer = setTimeout(resolve5, ms);
     if (signal) {
       const onAbort = () => {
         clearTimeout(timer);
@@ -1488,8 +1488,8 @@ var CacheFirstLoop = class {
             }
           );
           for (let k = 0; k < budget; k++) {
-            const sample = queue.shift() ?? await new Promise((resolve4) => {
-              waiter = resolve4;
+            const sample = queue.shift() ?? await new Promise((resolve5) => {
+              waiter = resolve5;
             });
             yield {
               turn: this._turn,
@@ -2183,13 +2183,409 @@ function lineDiff(a, b) {
   return out;
 }
 
+// src/tools/shell.ts
+import { spawn } from "child_process";
+import * as pathMod2 from "path";
+var DEFAULT_TIMEOUT_SEC = 60;
+var DEFAULT_MAX_OUTPUT_CHARS = 32e3;
+var BUILTIN_ALLOWLIST = [
+  // Repo inspection
+  "git status",
+  "git diff",
+  "git log",
+  "git show",
+  "git blame",
+  "git branch",
+  "git remote",
+  "git rev-parse",
+  "git config --get",
+  // Filesystem inspection
+  "ls",
+  "pwd",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "file",
+  "tree",
+  "find",
+  "grep",
+  "rg",
+  // Language version probes
+  "node --version",
+  "node -v",
+  "npm --version",
+  "npx --version",
+  "python --version",
+  "python3 --version",
+  "cargo --version",
+  "go version",
+  "rustc --version",
+  "deno --version",
+  "bun --version",
+  // Test runners (non-destructive by convention)
+  "npm test",
+  "npm run test",
+  "npx vitest run",
+  "npx vitest",
+  "npx jest",
+  "pytest",
+  "python -m pytest",
+  "cargo test",
+  "cargo check",
+  "cargo clippy",
+  "go test",
+  "go vet",
+  "deno test",
+  "bun test",
+  // Linters / typecheckers (read-only by convention)
+  "npm run lint",
+  "npm run typecheck",
+  "npx tsc --noEmit",
+  "npx biome check",
+  "npx eslint",
+  "npx prettier --check",
+  "ruff",
+  "mypy"
+];
+function tokenizeCommand(cmd) {
+  const out = [];
+  let cur = "";
+  let quote = null;
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (quote) {
+      if (ch === quote) {
+        quote = null;
+      } else if (ch === "\\" && quote === '"' && i + 1 < cmd.length) {
+        cur += cmd[++i];
+      } else {
+        cur += ch;
+      }
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === " " || ch === "	") {
+      if (cur.length > 0) {
+        out.push(cur);
+        cur = "";
+      }
+      continue;
+    }
+    cur += ch;
+  }
+  if (quote) throw new Error(`unclosed ${quote} in command`);
+  if (cur.length > 0) out.push(cur);
+  return out;
+}
+function isAllowed(cmd, extra = []) {
+  const normalized = cmd.trim().replace(/\s+/g, " ");
+  const allowlist = [...BUILTIN_ALLOWLIST, ...extra];
+  for (const prefix of allowlist) {
+    if (normalized === prefix) return true;
+    if (normalized.startsWith(`${prefix} `)) return true;
+  }
+  return false;
+}
+async function runCommand(cmd, opts) {
+  const argv = tokenizeCommand(cmd);
+  if (argv.length === 0) throw new Error("run_command: empty command");
+  const timeoutMs = (opts.timeoutSec ?? DEFAULT_TIMEOUT_SEC) * 1e3;
+  const maxChars = opts.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+  const spawnOpts = {
+    cwd: opts.cwd,
+    shell: false,
+    // no shell-expansion — see header comment
+    windowsHide: true,
+    env: process.env
+  };
+  return await new Promise((resolve5, reject) => {
+    let child;
+    try {
+      child = spawn(argv[0], argv.slice(1), spawnOpts);
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    let buf = "";
+    let timedOut = false;
+    const killTimer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
+    const onAbort = () => child.kill("SIGKILL");
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    const onData = (chunk) => {
+      buf += chunk.toString();
+      if (buf.length > maxChars * 2) buf = `${buf.slice(0, maxChars * 2)}`;
+    };
+    child.stdout?.on("data", onData);
+    child.stderr?.on("data", onData);
+    child.on("error", (err) => {
+      clearTimeout(killTimer);
+      opts.signal?.removeEventListener("abort", onAbort);
+      reject(err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(killTimer);
+      opts.signal?.removeEventListener("abort", onAbort);
+      const output = buf.length > maxChars ? `${buf.slice(0, maxChars)}
+
+[\u2026 truncated ${buf.length - maxChars} chars \u2026]` : buf;
+      resolve5({ exitCode: code, output, timedOut });
+    });
+  });
+}
+var NeedsConfirmationError = class extends Error {
+  command;
+  constructor(command) {
+    super(
+      `run_command: "${command}" needs the user's approval before it runs. STOP calling tools now \u2014 the TUI has already prompted the user to press y (run) or n (deny). Wait for their next message; it will either be the command's output (if they approved) or an instruction to continue without it (if they denied). Don't retry the command or call other shell commands in the meantime.`
+    );
+    this.name = "NeedsConfirmationError";
+    this.command = command;
+  }
+};
+function registerShellTools(registry, opts) {
+  const rootDir = pathMod2.resolve(opts.rootDir);
+  const timeoutSec = opts.timeoutSec ?? DEFAULT_TIMEOUT_SEC;
+  const maxOutputChars = opts.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+  const extraAllowed = opts.extraAllowed ?? [];
+  const allowAll = opts.allowAll ?? false;
+  registry.register({
+    name: "run_command",
+    description: "Run a shell command in the project root and return its combined stdout+stderr. Read-only and test commands (git status, ls, npm test, pytest, cargo test, grep, etc.) run immediately. Anything that could mutate state (npm install, git commit, rm, chmod) is refused and the user has to confirm in the TUI. Prefer this over asking the user to run a command manually \u2014 after edits, run the project's tests to verify.",
+    parameters: {
+      type: "object",
+      properties: {
+        command: {
+          type: "string",
+          description: "Full command line, e.g. 'npm test' or 'git diff src/foo.ts'. Tokenized with POSIX-ish quoting; no shell expansion, no pipes, no redirects."
+        },
+        timeoutSec: {
+          type: "integer",
+          description: `Override the default ${timeoutSec}s timeout for a single command.`
+        }
+      },
+      required: ["command"]
+    },
+    fn: async (args, ctx) => {
+      const cmd = args.command.trim();
+      if (!cmd) throw new Error("run_command: empty command");
+      if (!allowAll && !isAllowed(cmd, extraAllowed)) {
+        throw new NeedsConfirmationError(cmd);
+      }
+      const effectiveTimeout = Math.max(1, Math.min(600, args.timeoutSec ?? timeoutSec));
+      const result = await runCommand(cmd, {
+        cwd: rootDir,
+        timeoutSec: effectiveTimeout,
+        maxOutputChars,
+        signal: ctx?.signal
+      });
+      return formatCommandResult(cmd, result);
+    }
+  });
+  return registry;
+}
+function formatCommandResult(cmd, r) {
+  const header = r.timedOut ? `$ ${cmd}
+[killed after timeout]` : `$ ${cmd}
+[exit ${r.exitCode ?? "?"}]`;
+  return r.output ? `${header}
+${r.output}` : header;
+}
+
+// src/tools/web.ts
+var DEFAULT_FETCH_MAX_CHARS = 32e3;
+var DEFAULT_FETCH_TIMEOUT_MS = 15e3;
+var DEFAULT_TOPK = 5;
+var USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";
+var MOJEEK_ENDPOINT = "https://www.mojeek.com/search";
+async function webSearch(query, opts = {}) {
+  const topK = Math.max(1, Math.min(10, opts.topK ?? DEFAULT_TOPK));
+  const resp = await fetch(`${MOJEEK_ENDPOINT}?q=${encodeURIComponent(query)}`, {
+    headers: {
+      "User-Agent": USER_AGENT,
+      Accept: "text/html,application/xhtml+xml,application/xml;q=0.9",
+      "Accept-Language": "en-US,en;q=0.9"
+    },
+    signal: opts.signal,
+    redirect: "follow"
+  });
+  if (!resp.ok) throw new Error(`web_search ${resp.status}`);
+  const html = await resp.text();
+  const results = parseMojeekResults(html).slice(0, topK);
+  if (results.length === 0) {
+    if (/no results found|did not match any documents/i.test(html)) return [];
+    if (/captcha|verify you are human|access denied|forbidden/i.test(html)) {
+      throw new Error("web_search: Mojeek anti-bot page \u2014 rate-limited or blocked");
+    }
+    throw new Error(
+      `web_search: 0 results but response doesn't look like a real empty page (${html.length} chars, first 120: ${html.slice(0, 120).replace(/\s+/g, " ")})`
+    );
+  }
+  return results;
+}
+function parseMojeekResults(html) {
+  const titles = [];
+  const titleAnchorRe = /<a\b[^>]*\bclass="title"[^>]*>[\s\S]*?<\/a>/g;
+  let m;
+  while (true) {
+    m = titleAnchorRe.exec(html);
+    if (m === null) break;
+    titles.push(m[0]);
+  }
+  const snippets = [];
+  const snippetRe = /<p\b[^>]*\bclass="s"[^>]*>([\s\S]*?)<\/p>/g;
+  while (true) {
+    m = snippetRe.exec(html);
+    if (m === null) break;
+    snippets.push(m[1] ?? "");
+  }
+  const hrefRe = /href="([^"]+)"/;
+  const innerRe = /<a\b[^>]*>([\s\S]*?)<\/a>/;
+  const results = [];
+  for (let i = 0; i < titles.length; i++) {
+    const anchor = titles[i];
+    const hrefMatch = anchor.match(hrefRe);
+    const innerMatch = anchor.match(innerRe);
+    if (!hrefMatch?.[1]) continue;
+    results.push({
+      title: decodeHtmlEntities(stripHtml(innerMatch?.[1] ?? "")).trim(),
+      url: hrefMatch[1],
+      snippet: decodeHtmlEntities(stripHtml(snippets[i] ?? "")).replace(/\s+/g, " ").trim()
+    });
+  }
+  return results;
+}
+async function webFetch(url, opts = {}) {
+  const maxChars = opts.maxChars ?? DEFAULT_FETCH_MAX_CHARS;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  const cancel = () => ctl.abort();
+  opts.signal?.addEventListener("abort", cancel, { once: true });
+  let resp;
+  try {
+    resp = await fetch(url, {
+      headers: { "User-Agent": USER_AGENT, Accept: "text/html,text/plain,*/*" },
+      signal: ctl.signal,
+      redirect: "follow"
+    });
+  } finally {
+    clearTimeout(timer);
+    opts.signal?.removeEventListener("abort", cancel);
+  }
+  if (!resp.ok) throw new Error(`web_fetch ${resp.status} for ${url}`);
+  const contentType = resp.headers.get("content-type") ?? "";
+  const raw = await resp.text();
+  const title = extractTitle(raw);
+  const text = contentType.includes("text/html") ? htmlToText(raw) : raw;
+  const truncated = text.length > maxChars;
+  const finalText = truncated ? `${text.slice(0, maxChars)}
+
+[\u2026 truncated ${text.length - maxChars} chars \u2026]` : text;
+  return { url, title, text: finalText, truncated };
+}
+function htmlToText(html) {
+  let s = html;
+  s = s.replace(/<script[\s\S]*?<\/script>/gi, "");
+  s = s.replace(/<style[\s\S]*?<\/style>/gi, "");
+  s = s.replace(/<noscript[\s\S]*?<\/noscript>/gi, "");
+  s = s.replace(/<nav[\s\S]*?<\/nav>/gi, "");
+  s = s.replace(/<footer[\s\S]*?<\/footer>/gi, "");
+  s = s.replace(/<aside[\s\S]*?<\/aside>/gi, "");
+  s = s.replace(/<svg[\s\S]*?<\/svg>/gi, "");
+  s = s.replace(/<\/?(p|div|br|h[1-6]|li|tr|section|article)\b[^>]*>/gi, "\n");
+  s = s.replace(/<[^>]+>/g, "");
+  s = decodeHtmlEntities(s);
+  s = s.replace(/[ \t]+/g, " ");
+  s = s.replace(/\n[ \t]+/g, "\n");
+  s = s.replace(/\n{3,}/g, "\n\n");
+  return s.trim();
+}
+function stripHtml(s) {
+  return s.replace(/<[^>]+>/g, "");
+}
+function decodeHtmlEntities(s) {
+  return s.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+}
+function extractTitle(html) {
+  const m = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+  if (!m?.[1]) return void 0;
+  return m[1].replace(/\s+/g, " ").trim() || void 0;
+}
+function registerWebTools(registry, opts = {}) {
+  const defaultTopK = opts.defaultTopK ?? DEFAULT_TOPK;
+  const maxFetchChars = opts.maxFetchChars ?? DEFAULT_FETCH_MAX_CHARS;
+  registry.register({
+    name: "web_search",
+    description: "Search the public web. Returns ranked results with title, url, and snippet. Use this when the question needs information more current than your training data, when you're unsure of a factual detail, or when the user asks about a specific webpage/library/release you haven't seen.",
+    parameters: {
+      type: "object",
+      properties: {
+        query: { type: "string", description: "Natural-language search query." },
+        topK: {
+          type: "integer",
+          description: `Number of results to return (1..10). Default ${defaultTopK}.`
+        }
+      },
+      required: ["query"]
+    },
+    fn: async (args, ctx) => {
+      const results = await webSearch(args.query, {
+        topK: args.topK ?? defaultTopK,
+        signal: ctx?.signal
+      });
+      return formatSearchResults(args.query, results);
+    }
+  });
+  registry.register({
+    name: "web_fetch",
+    description: "Download a URL and return its visible text content (HTML pages get scripts/styles/nav stripped). Truncated at the tool-result cap. Use after web_search when a snippet isn't enough.",
+    parameters: {
+      type: "object",
+      properties: {
+        url: { type: "string", description: "Absolute http:// or https:// URL." }
+      },
+      required: ["url"]
+    },
+    fn: async (args, ctx) => {
+      if (!/^https?:\/\//i.test(args.url)) {
+        throw new Error("web_fetch: url must start with http:// or https://");
+      }
+      const page = await webFetch(args.url, { maxChars: maxFetchChars, signal: ctx?.signal });
+      const header = page.title ? `${page.title}
+${page.url}` : page.url;
+      return `${header}
+
+${page.text}`;
+    }
+  });
+  return registry;
+}
+function formatSearchResults(query, results) {
+  const lines = [`query: ${query}`, `
+results (${results.length}):`];
+  results.forEach((r, i) => {
+    lines.push(`
+${i + 1}. ${r.title}`);
+    lines.push(`   ${r.url}`);
+    if (r.snippet) lines.push(`   ${r.snippet}`);
+  });
+  return lines.join("\n");
+}
+
 // src/env.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve3 } from "path";
 function loadDotenv(path = ".env") {
   let raw;
   try {
-    raw = readFileSync2(resolve2(process.cwd(), path), "utf8");
+    raw = readFileSync2(resolve3(process.cwd(), path), "utf8");
   } catch {
     return;
   }
@@ -2871,7 +3267,7 @@ var McpClient = class {
     const id = this.nextId++;
     const frame = { jsonrpc: "2.0", id, method, params };
     let abortHandler = null;
-    const promise = new Promise((resolve4, reject) => {
+    const promise = new Promise((resolve5, reject) => {
       const timeout = setTimeout(() => {
         this.pending.delete(id);
         if (abortHandler && signal) signal.removeEventListener("abort", abortHandler);
@@ -2880,7 +3276,7 @@ var McpClient = class {
         );
       }, this.requestTimeoutMs);
       this.pending.set(id, {
-        resolve: resolve4,
+        resolve: resolve5,
         reject,
         timeout
       });
@@ -2962,7 +3358,7 @@ var McpClient = class {
 };
 
 // src/mcp/stdio.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 var StdioTransport = class {
   child;
   queue = [];
@@ -2977,14 +3373,14 @@ var StdioTransport = class {
         opts.command,
         ...(opts.args ?? []).map((a) => quoteArg(a, process.platform === "win32"))
       ].join(" ");
-      this.child = spawn(line, [], {
+      this.child = spawn2(line, [], {
         env,
         cwd: opts.cwd,
         stdio: ["pipe", "pipe", "inherit"],
         shell: true
       });
     } else {
-      this.child = spawn(opts.command, opts.args ?? [], {
+      this.child = spawn2(opts.command, opts.args ?? [], {
         env,
         cwd: opts.cwd,
         stdio: ["pipe", "pipe", "inherit"]
@@ -3003,12 +3399,12 @@ var StdioTransport = class {
   }
   async send(message) {
     if (this.closed) throw new Error("MCP transport is closed");
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const line = `${JSON.stringify(message)}
 `;
       this.child.stdin.write(line, "utf8", (err) => {
         if (err) reject(err);
-        else resolve4();
+        else resolve5();
       });
     });
   }
@@ -3019,8 +3415,8 @@ var StdioTransport = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve4) => {
-        this.waiters.push(resolve4);
+      const next = await new Promise((resolve5) => {
+        this.waiters.push(resolve5);
       });
       if (next === null) return;
       yield next;
@@ -3086,8 +3482,8 @@ var SseTransport = class {
   constructor(opts) {
     this.url = opts.url;
     this.headers = opts.headers ?? {};
-    this.endpointReady = new Promise((resolve4, reject) => {
-      this.resolveEndpoint = resolve4;
+    this.endpointReady = new Promise((resolve5, reject) => {
+      this.resolveEndpoint = resolve5;
       this.rejectEndpoint = reject;
     });
     this.endpointReady.catch(() => void 0);
@@ -3114,8 +3510,8 @@ var SseTransport = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve4) => {
-        this.waiters.push(resolve4);
+      const next = await new Promise((resolve5) => {
+        this.waiters.push(resolve5);
       });
       if (next === null) return;
       yield next;
@@ -3315,7 +3711,7 @@ async function trySection(load) {
 
 // src/code/edit-blocks.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve3 } from "path";
+import { dirname as dirname3, resolve as resolve4 } from "path";
 var BLOCK_RE = /^(\S[^\n]*)\n<{7} SEARCH\n([\s\S]*?)\n?={7}\n([\s\S]*?)\n?>{7} REPLACE/gm;
 function parseEditBlocks(text) {
   const out = [];
@@ -3333,8 +3729,8 @@ function parseEditBlocks(text) {
   return out;
 }
 function applyEditBlock(block, rootDir) {
-  const absRoot = resolve3(rootDir);
-  const absTarget = resolve3(absRoot, block.path);
+  const absRoot = resolve4(rootDir);
+  const absTarget = resolve4(absRoot, block.path);
   if (absTarget !== absRoot && !absTarget.startsWith(`${absRoot}${sep()}`)) {
     return {
       path: block.path,
@@ -3384,13 +3780,13 @@ function applyEditBlocks(blocks, rootDir) {
   return blocks.map((b) => applyEditBlock(b, rootDir));
 }
 function snapshotBeforeEdits(blocks, rootDir) {
-  const absRoot = resolve3(rootDir);
+  const absRoot = resolve4(rootDir);
   const seen = /* @__PURE__ */ new Set();
   const snapshots = [];
   for (const b of blocks) {
     if (seen.has(b.path)) continue;
     seen.add(b.path);
-    const abs = resolve3(absRoot, b.path);
+    const abs = resolve4(absRoot, b.path);
     if (!existsSync2(abs)) {
       snapshots.push({ path: b.path, prevContent: null });
       continue;
@@ -3404,9 +3800,9 @@ function snapshotBeforeEdits(blocks, rootDir) {
   return snapshots;
 }
 function restoreSnapshots(snapshots, rootDir) {
-  const absRoot = resolve3(rootDir);
+  const absRoot = resolve4(rootDir);
   return snapshots.map((snap) => {
-    const abs = resolve3(absRoot, snap.path);
+    const abs = resolve4(absRoot, snap.path);
     if (abs !== absRoot && !abs.startsWith(`${absRoot}${sep()}`)) {
       return {
         path: snap.path,
@@ -3556,7 +3952,7 @@ function redactKey(key) {
 }
 
 // src/index.ts
-var VERSION = "0.4.14";
+var VERSION = "0.4.16";
 export {
   AppendOnlyLog,
   CODE_SYSTEM_PROMPT,
@@ -3566,6 +3962,7 @@ export {
   ImmutablePrefix,
   MCP_PROTOCOL_VERSION,
   McpClient,
+  NeedsConfirmationError,
   SessionStats,
   SseTransport,
   StdioTransport,
@@ -3593,11 +3990,15 @@ export {
   fetchWithRetry,
   flattenMcpResult,
   flattenSchema,
+  formatCommandResult,
   formatLoopError,
+  formatSearchResults,
   harvest,
   healLoadedMessages,
+  htmlToText,
   inputCostUsd,
   inspectMcpServer,
+  isAllowed,
   isJsonRpcError,
   isPlanStateEmpty,
   isPlausibleKey,
@@ -3610,18 +4011,22 @@ export {
   outputCostUsd,
   parseEditBlocks,
   parseMcpSpec,
+  parseMojeekResults,
   parseTranscript,
   readConfig,
   readTranscript,
   recordFromLoopEvent,
   redactKey,
   registerFilesystemTools,
+  registerShellTools,
+  registerWebTools,
   renderMarkdown as renderDiffMarkdown,
   renderSummaryTable as renderDiffSummary,
   repairTruncatedJson,
   replayFromFile,
   restoreSnapshots,
   runBranches,
+  runCommand,
   sanitizeName as sanitizeSessionName,
   saveApiKey,
   scavengeToolCalls,
@@ -3630,7 +4035,10 @@ export {
   similarity,
   snapshotBeforeEdits,
   stripHallucinatedToolMarkup,
+  tokenizeCommand,
   truncateForModel,
+  webFetch,
+  webSearch,
   writeConfig,
   writeMeta,
   writeRecord