s-app-scoder-agent 0.3.0 → 0.5.0

package/dist/tools.js

@@ -3,6 +3,7 @@ import { spawn } from "node:child_process";
 import { resolve, dirname, basename, join, relative, isAbsolute } from "node:path";
 import { unifiedDiff } from "./diff.js";
 import * as ui from "./ui.js";
+import { toolWebFetch } from "./webfetch.js";
 const MAX_OUTPUT_CHARS = 20_000;
 const MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // refuse to read files > 2MB
 function clamp(s, max = MAX_OUTPUT_CHARS) {
@@ -25,8 +26,13 @@ function safePath(workdir, p) {
     try {
         realWorkdir = realpathSync(workdir);
     }
-    catch {
-        // workdir must exist; keep lexical fallback
+    catch (err) {
+        // workdir must exist; keep lexical fallback for a transient ENOENT,
+        // but surface unexpected failures instead of silently swallowing them.
+        const code = err.code;
+        if (code !== "ENOENT") {
+            throw new Error(`Cannot resolve working directory "${workdir}": ${err.message}`, { cause: err });
+        }
     }
     // Walk up to the nearest existing ancestor, then verify containment.
     let probe = abs;
@@ -206,8 +212,10 @@ function toolListFiles(workdir, args) {
  * Run a shell command asynchronously (async spawn keeps the event loop free,
  * so streaming output renders and SIGINT is handled promptly).
  * Kills the child on timeout or external abort (SIGINT via ctx.signal).
+ * When `onOutput` is provided, stdout/stderr chunks are forwarded live as they
+ * arrive (in addition to being collected into the final ToolResult).
  */
-export async function toolRunCommand(workdir, args, signal) {
+export async function toolRunCommand(workdir, args, signal, onOutput) {
     const timeoutMs = Math.min(Math.max(args.timeout_secs ?? 120, 1), 600) * 1000;
     return new Promise((resolve) => {
         let settled = false;
@@ -247,8 +255,16 @@ export async function toolRunCommand(workdir, args, signal) {
             onAbort();
         else
             signal?.addEventListener("abort", onAbort, { once: true });
-        child.stdout?.on("data", (c) => { stdout += c.toString("utf8"); });
-        child.stderr?.on("data", (c) => { stderr += c.toString("utf8"); });
+        child.stdout?.on("data", (c) => {
+            const s = c.toString("utf8");
+            stdout += s;
+            onOutput?.("stdout", s);
+        });
+        child.stderr?.on("data", (c) => {
+            const s = c.toString("utf8");
+            stderr += s;
+            onOutput?.("stderr", s);
+        });
         child.on("error", (err) => {
             finish({ ok: false, output: clamp(`$ ${args.command}\n(spawn error) ${err.message}`) });
         });
@@ -348,7 +364,28 @@ export const AGENT_TOOLS = [
                 }, ["command"]),
             },
         },
-        run: (ctx, args) => toolRunCommand(ctx.workdir, args, ctx.signal),
+        run: (ctx, args) => toolRunCommand(ctx.workdir, args, ctx.signal, ctx.onToolOutput ? (stream, delta) => ctx.onToolOutput?.("run_command", stream, delta) : undefined),
+    },
+    {
+        spec: {
+            type: "function",
+            function: {
+                name: "web_fetch",
+                description: "Fetch a public HTTP(S) URL and return its content as readable plain text " +
+                    "(HTML converted to text, JSON pretty-printed). WHEN TO USE: the task depends on external, " +
+                    "possibly outdated knowledge — library/API documentation, an error message or comment " +
+                    "containing a URL, current package versions or changelogs, standards/specs. " +
+                    "WHEN NOT TO: the answer is already in the working directory or in the user's request; " +
+                    "you need a search engine (this tool fetches exact URLs only, it cannot search); " +
+                    "the content is a binary file (images, archives, PDFs are refused). " +
+                    "Private/internal addresses (localhost, 10.x, 192.168.x, 127.x) are blocked.",
+                parameters: obj({
+                    url: str("Absolute http(s) URL to fetch"),
+                    max_chars: str("Max characters of extracted content to return (default 20000, max 100000)"),
+                }, ["url"]),
+            },
+        },
+        run: (ctx, args) => toolWebFetch(ctx, args),
     },
 ];
 export function getTool(name) {

package/dist/ui.js

@@ -1,12 +1,14 @@
 import process from "node:process";
-const RESET = "\x1b[0m";
-const BOLD = "\x1b[1m";
-const DIM = "\x1b[2m";
-const GREEN = "\x1b[32m";
-const YELLOW = "\x1b[33m";
-const RED = "\x1b[31m";
-const CYAN = "\x1b[36m";
-const BLUE = "\x1b[34m";
+// Honor NO_COLOR and non-TTY output: drop ANSI codes so logs/CI stay clean.
+const COLOR = process.env.NO_COLOR === undefined && process.stdout.isTTY === true;
+const RESET = COLOR ? "\x1b[0m" : "";
+const BOLD = COLOR ? "\x1b[1m" : "";
+const DIM = COLOR ? "\x1b[2m" : "";
+const GREEN = COLOR ? "\x1b[32m" : "";
+const YELLOW = COLOR ? "\x1b[33m" : "";
+const RED = COLOR ? "\x1b[31m" : "";
+const CYAN = COLOR ? "\x1b[36m" : "";
+const BLUE = COLOR ? "\x1b[34m" : "";
 function ts() {
     return new Date().toISOString().slice(11, 23);
 }
@@ -14,7 +16,7 @@ export function info(msg) {
     console.log(`${DIM}[${ts()}]${RESET} ${msg}`);
 }
 export function step(stepNum, total, msg) {
-    console.log(`${BLUE}[${stepNum}/${total}]${RESET} ${BOLD}${msg}${RESET}`);
+    console.log(`${BLUE}[${String(stepNum).padStart(2)}/${total}]${RESET} ${BOLD}▸ ${msg}${RESET}`);
 }
 export function success(msg) {
     console.log(`${GREEN}✓${RESET} ${GREEN}${msg}${RESET}`);
@@ -37,7 +39,7 @@ export function toolCall(name, args) {
 export function toolResult(name, ok, output) {
     const preview = output.split("\n")[0]?.slice(0, 120) ?? "";
     const icon = ok ? `${GREEN}✓${RESET}` : `${RED}✗${RESET}`;
-    console.log(`${icon} ${CYAN}${name}${RESET} → ${preview}`);
+    console.log(`${icon} ${CYAN}${name}${RESET} ${DIM}→${RESET} ${preview}`);
 }
 export function buildStatus(success, output) {
     const icon = success ? `${GREEN}✓ BUILD SUCCESS` : `${RED}✗ BUILD FAILED`;
@@ -46,6 +48,25 @@ export function buildStatus(success, output) {
 export function header(msg) {
     console.log(`\n${BOLD}${CYAN}── ${msg} ${"─".repeat(Math.max(2, 60 - msg.length))}${RESET}`);
 }
+/** Startup banner: a clean key/value box (plain-text fallback when piped). */
+export function banner(title, rows) {
+    const keyWidth = Math.max(8, ...rows.map(([k]) => k.length));
+    const inner = Math.max(title.length + 4, ...rows.map(([, v]) => keyWidth + Math.max(...String(v).split("\n").map((l) => l.length)) + 1));
+    console.log(`${BOLD}${CYAN}╭─ ${title} ${"─".repeat(Math.max(1, inner - title.length - 3))}╮${RESET}`);
+    for (const [key, value] of rows) {
+        const lines = String(value).split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const k = (i === 0 ? key : "").padEnd(keyWidth);
+            let v = lines[i];
+            const maxV = inner - keyWidth - 1;
+            if (v.length > maxV)
+                v = v.slice(0, maxV - 1) + "…";
+            const pad = Math.max(0, inner - 1 - keyWidth - v.length);
+            console.log(`${BOLD}${CYAN}│${RESET} ${DIM}${k}${RESET}${v}${" ".repeat(pad)}${BOLD}${CYAN}│${RESET}`);
+        }
+    }
+    console.log(`${BOLD}${CYAN}╰${"─".repeat(inner)}╯${RESET}`);
+}
 // ── Streaming helpers ────────────────────────────────────────────────────────
 let _streamLine = "";
 let _streamColor = CYAN;
@@ -69,6 +90,51 @@ export function llmStreamEnd(suffix = "") {
     process.stdout.write(`${suffix}\n`);
     return line;
 }
+// ── Tool output streaming (live run_command output) ─────────────────────────
+const TOOL_STREAM_MAX_CHARS = 20_000;
+let _toolStreamOpen = false;
+let _toolStreamLineOpen = false; // last chunk did not end with "\n"
+let _toolStreamChars = 0;
+/** Begin a live tool-output block. Output is printed dimmed, capped at 20k chars. */
+export function toolStreamStart() {
+    if (_toolStreamOpen)
+        return;
+    _toolStreamOpen = true;
+    _toolStreamLineOpen = false;
+    _toolStreamChars = 0;
+    process.stdout.write(`${DIM}┌ output${RESET}`);
+}
+/** Append a tool-output delta to the live block. */
+export function toolStreamChunk(delta) {
+    if (!_toolStreamOpen)
+        return;
+    if (_toolStreamChars >= TOOL_STREAM_MAX_CHARS)
+        return;
+    _toolStreamChars += delta.length;
+    if (_toolStreamChars >= TOOL_STREAM_MAX_CHARS) {
+        // Include the tail of this chunk up to the cap, then stop rendering live.
+        const keep = delta.slice(0, Math.max(0, delta.length - (_toolStreamChars - TOOL_STREAM_MAX_CHARS)));
+        if (keep.length > 0) {
+            process.stdout.write(`${DIM}${keep}${RESET}`);
+            _toolStreamLineOpen = !keep.endsWith("\n");
+        }
+        process.stdout.write(`\n${DIM}│ (live output truncated at ${TOOL_STREAM_MAX_CHARS} chars — full output in the result)${RESET}`);
+        return;
+    }
+    process.stdout.write(`\n${DIM}│ ${delta.replace(/\n/g, `\n${DIM}│ ${RESET}`)}${RESET}`);
+    _toolStreamLineOpen = !delta.endsWith("\n");
+}
+/** Finish the live tool-output block (closes the partial last line). */
+export function toolStreamEnd() {
+    if (!_toolStreamOpen)
+        return;
+    _toolStreamOpen = false;
+    process.stdout.write(_toolStreamLineOpen ? `\n${DIM}└${RESET}\n` : `${DIM}└${RESET}\n`);
+}
+/** True while a live tool-output block is open. */
+export function isToolStreamOpen() {
+    return _toolStreamOpen;
+}
 // ── Diff rendering ───────────────────────────────────────────────────────────
 /** Print a unified diff with colors (+ green, - red, @@ cyan). */
 export function printDiff(diffText) {

package/dist/webfetch.js

@@ -0,0 +1,251 @@
+import { isIP } from "node:net";
+import { lookup } from "node:dns/promises";
+/**
+ * web_fetch — read-only HTTP(S) fetch with SSRF protection.
+ *
+ * - Only http/https; follows up to 5 redirects, validating every hop.
+ * - Private/loopback/link-local addresses are blocked by default
+ *   (env SCODER_WEB_ALLOW_PRIVATE=1 lifts the block for local dev/testing).
+ * - HTML is converted to plain text; JSON is pretty-printed; binary is refused.
+ * - Output is capped so a huge page cannot flood the LLM context.
+ */
+const FETCH_TIMEOUT_MS = 30_000;
+const MAX_BODY_BYTES = 512 * 1024;
+const MAX_REDIRECTS = 5;
+const DEFAULT_MAX_CHARS = 20_000;
+function allowPrivate() {
+    return process.env.SCODER_WEB_ALLOW_PRIVATE === "1";
+}
+/** True if the address is private/loopback/link-local (IPv4 + IPv6). */
+function isPrivateAddress(ip) {
+    const v = isIP(ip);
+    if (v === 4) {
+        const parts = ip.split(".").map(Number);
+        const a = parts[0];
+        const b = parts[1];
+        if (a === 10 || a === 127 || a === 0)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT
+        return false;
+    }
+    if (v === 6) {
+        const lower = ip.toLowerCase();
+        if (lower === "::1" || lower === "::")
+            return true;
+        if (lower.startsWith("fe80"))
+            return true; // link-local
+        if (/^f[cd][0-9a-f]{2}:/.test(lower))
+            return true; // unique local fc00::/7
+        // IPv4-mapped ::ffff:10.0.0.1
+        const mapped = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+        if (mapped)
+            return isPrivateAddress(mapped[1]);
+        return false;
+    }
+    return true; // not parseable -> treat as private (fail closed)
+}
+/** Resolve hostname and refuse private addresses (unless explicitly allowed). */
+async function assertPublicHost(hostname) {
+    if (allowPrivate())
+        return;
+    let addresses;
+    try {
+        addresses = await lookup(hostname, { all: true, verbatim: true });
+    }
+    catch (err) {
+        throw new Error(`DNS lookup failed for "${hostname}": ${err.message}`, { cause: err });
+    }
+    if (addresses.length === 0) {
+        throw new Error(`DNS lookup returned no addresses for "${hostname}"`);
+    }
+    for (const addr of addresses) {
+        if (isPrivateAddress(addr.address)) {
+            throw new Error(`Blocked: "${hostname}" resolves to a private/loopback address (${addr.address}). ` +
+                `web_fetch only reaches public hosts (set SCODER_WEB_ALLOW_PRIVATE=1 to allow local testing).`);
+        }
+    }
+}
+/** Decode the HTML entities that actually appear in practice. */
+function decodeEntities(s) {
+    const named = {
+        amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", ndash: "–", mdash: "—",
+        hellip: "…", rsquo: "’", lsquo: "‘", rdquo: "”", ldquo: "“", copy: "©", reg: "®",
+    };
+    return s.replace(/&(#x?[0-9a-fA-F]+|[a-zA-Z]+);/g, (whole, body) => {
+        if (body.startsWith("#x") || body.startsWith("#X")) {
+            const code = parseInt(body.slice(2), 16);
+            return Number.isFinite(code) ? String.fromCodePoint(code) : whole;
+        }
+        if (body.startsWith("#")) {
+            const code = parseInt(body.slice(1), 10);
+            return Number.isFinite(code) ? String.fromCodePoint(code) : whole;
+        }
+        return named[body.toLowerCase()] ?? whole;
+    });
+}
+/** Convert HTML to readable plain text (scripts/styles stripped, block tags → newlines). */
+export function htmlToText(html) {
+    const out = html
+        .replace(/<script[\s\S]*?<\/script\s*>/gi, " ")
+        .replace(/<style[\s\S]*?<\/style\s*>/gi, " ")
+        .replace(/<noscript[\s\S]*?<\/noscript\s*>/gi, " ")
+        .replace(/<!--[\s\S]*?-->/g, " ")
+        .replace(/<(br|\/p|\/div|\/section|\/article|\/header|\/footer|\/h[1-6]|\/li|\/tr|\/pre|\/blockquote)[^>]*>/gi, "\n")
+        .replace(/<[^>]+>/g, " ")
+        .replace(/[ \t]+/g, " ")
+        .replace(/ *\n */g, "\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+    return decodeEntities(out);
+}
+/** Extract the <title> of an HTML document, if present. */
+function extractTitle(html) {
+    const m = html.match(/<title[^>]*>([\s\S]*?)<\/title\s*>/i);
+    if (!m)
+        return null;
+    const t = decodeEntities(m[1]).replace(/\s+/g, " ").trim();
+    return t ? t.slice(0, 200) : null;
+}
+/** Read the response body as text, capped at MAX_BODY_BYTES, then cancel the stream. */
+async function readBodyCapped(res) {
+    const reader = res.body?.getReader();
+    if (!reader)
+        return { text: "", truncated: false };
+    const decoder = new TextDecoder("utf-8");
+    let text = "";
+    let received = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        received += value.byteLength;
+        text += decoder.decode(value, { stream: true });
+        if (received >= MAX_BODY_BYTES) {
+            try {
+                await reader.cancel();
+            }
+            catch { /* already closed */ }
+            return { text: text + decoder.decode(), truncated: true };
+        }
+    }
+    return { text: text + decoder.decode(), truncated: false };
+}
+/** Implementation of the web_fetch tool. Also used by tests via the registry. */
+export async function toolWebFetch(ctx, args) {
+    const maxChars = Math.min(Math.max(args.max_chars ?? DEFAULT_MAX_CHARS, 500), 100_000);
+    let url;
+    try {
+        url = new URL(args.url);
+    }
+    catch {
+        return { ok: false, output: `ERROR: invalid URL: ${args.url}` };
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return { ok: false, output: `ERROR: only http/https URLs are supported (got ${url.protocol})` };
+    }
+    // Combined timeout + external abort (SIGINT) — manual composition for Node 18 compat
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`timeout after ${FETCH_TIMEOUT_MS / 1000}s`)), FETCH_TIMEOUT_MS);
+    const onExternalAbort = () => controller.abort(new Error("interrupted by user"));
+    if (ctx.signal?.aborted)
+        onExternalAbort();
+    else
+        ctx.signal?.addEventListener("abort", onExternalAbort, { once: true });
+    const signal = controller.signal;
+    let current = url;
+    try {
+        // Redirect loop with per-hop SSRF validation
+        for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+            if (signal.aborted) {
+                return { ok: false, output: `ERROR: fetch aborted (${signal.reason?.message ?? "aborted"})` };
+            }
+            await assertPublicHost(current.hostname);
+            const res = await fetch(current, {
+                method: "GET",
+                redirect: "manual",
+                headers: {
+                    "User-Agent": "scoder-agent (+https://github.com/nbhson/app-scoder-agent)",
+                    Accept: "text/html, application/json, text/plain;q=0.9, */*;q=0.1",
+                },
+                signal,
+            });
+            // Follow redirects manually so every hop is validated against SSRF
+            if (res.status >= 300 && res.status < 400) {
+                const loc = res.headers.get("location");
+                try {
+                    await res.body?.cancel();
+                }
+                catch { /* ignore */ }
+                if (!loc) {
+                    return { ok: false, output: `ERROR: ${res.status} redirect without Location header at ${current.href}` };
+                }
+                if (hop === MAX_REDIRECTS) {
+                    return { ok: false, output: `ERROR: too many redirects (>${MAX_REDIRECTS}) fetching ${args.url}` };
+                }
+                current = new URL(loc, current);
+                continue;
+            }
+            if (!res.ok) {
+                try {
+                    await res.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return { ok: false, output: `ERROR: HTTP ${res.status} ${res.statusText} for ${current.href}` };
+            }
+            const contentType = res.headers.get("content-type") ?? "";
+            if (/^(image|audio|video|font|application\/(octet-stream|zip|gzip|pdf|wasm))/i.test(contentType)) {
+                try {
+                    await res.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return { ok: false, output: `ERROR: unsupported content-type "${contentType}" — web_fetch returns text only (html/json/plain).` };
+            }
+            const { text: body, truncated } = await readBodyCapped(res);
+            let text;
+            if (/json/i.test(contentType)) {
+                text = prettyJson(body) ?? body;
+            }
+            else if (/html/i.test(contentType) || /^\s*</.test(body)) {
+                text = htmlToText(body);
+            }
+            else {
+                text = body;
+            }
+            const title = /text\/html/i.test(contentType) ? extractTitle(body) : null;
+            const meta = [
+                `HTTP ${res.status} ${res.statusText || ""}`.trimEnd(),
+                contentType || "unknown content-type",
+                truncated ? `body truncated at ${MAX_BODY_BYTES / 1024}KB` : null,
+            ].filter(Boolean).join(", ");
+            const out = `${text.slice(0, maxChars)}${text.length > maxChars ? `\n... [truncated, ${text.length - maxChars} more chars]` : ""}`;
+            return {
+                ok: true,
+                output: `${title ? `Title: ${title}\n` : ""}${current.href}\n(${meta})\n\n${out}`,
+            };
+        }
+        // unreachable
+        return { ok: false, output: "ERROR: redirect loop" };
+    }
+    catch (err) {
+        return { ok: false, output: `ERROR: fetch failed for ${current.href}: ${err.message}` };
+    }
+    finally {
+        clearTimeout(timer);
+        ctx.signal?.removeEventListener("abort", onExternalAbort);
+    }
+}
+function prettyJson(body) {
+    try {
+        return JSON.stringify(JSON.parse(body), null, 2);
+    }
+    catch {
+        return undefined;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "s-app-scoder-agent",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Autonomous coding agent CLI - similar to opencode/cline/claude. Runs tasks until build succeeds.",
   "type": "module",
   "main": "dist/index.js",
@@ -9,6 +9,8 @@
   },
   "scripts": {
     "build": "tsc",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run lint && npm run typecheck && npm test",
     "start": "node dist/index.js",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
@@ -48,4 +50,4 @@
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.72.1"
   }
-}
+}