s-app-scoder-agent 0.4.0 → 0.6.0

package/dist/ui.js

@@ -1,57 +1,110 @@
 import process from "node:process";
-const RESET = "\x1b[0m";
-const BOLD = "\x1b[1m";
-const DIM = "\x1b[2m";
-const GREEN = "\x1b[32m";
-const YELLOW = "\x1b[33m";
-const RED = "\x1b[31m";
-const CYAN = "\x1b[36m";
-const BLUE = "\x1b[34m";
+// Honor NO_COLOR and non-TTY output: drop ANSI codes so logs/CI stay clean.
+const COLOR = process.env.NO_COLOR === undefined && process.stdout.isTTY === true;
+// When a full-screen TUI is active (scoder tui), the Agent's console output
+// would corrupt Ink's alt-screen rendering. The TUI renders from AgentEvents
+// instead; setting QUIET suppresses every direct ui.* write.
+let QUIET = false;
+/** Suppress all direct console writes from ui.* (used by the Ink TUI frontend). */
+export function setQuiet(quiet) {
+    QUIET = quiet;
+}
+const RESET = COLOR ? "\x1b[0m" : "";
+const BOLD = COLOR ? "\x1b[1m" : "";
+const DIM = COLOR ? "\x1b[2m" : "";
+const GREEN = COLOR ? "\x1b[32m" : "";
+const YELLOW = COLOR ? "\x1b[33m" : "";
+const RED = COLOR ? "\x1b[31m" : "";
+const CYAN = COLOR ? "\x1b[36m" : "";
+const BLUE = COLOR ? "\x1b[34m" : "";
 function ts() {
     return new Date().toISOString().slice(11, 23);
 }
 export function info(msg) {
+    if (QUIET)
+        return;
     console.log(`${DIM}[${ts()}]${RESET} ${msg}`);
 }
 export function step(stepNum, total, msg) {
-    console.log(`${BLUE}[${stepNum}/${total}]${RESET} ${BOLD}${msg}${RESET}`);
+    if (QUIET)
+        return;
+    console.log(`${BLUE}[${String(stepNum).padStart(2)}/${total}]${RESET} ${BOLD}▸ ${msg}${RESET}`);
 }
 export function success(msg) {
+    if (QUIET)
+        return;
     console.log(`${GREEN}✓${RESET} ${GREEN}${msg}${RESET}`);
 }
 export function warn(msg) {
+    if (QUIET)
+        return;
     console.log(`${YELLOW}⚠${RESET} ${YELLOW}${msg}${RESET}`);
 }
 export function error(msg) {
+    if (QUIET)
+        return;
     console.error(`${RED}✗${RESET} ${RED}${msg}${RESET}`);
 }
 export function llm(prefix, content) {
+    if (QUIET)
+        return;
     console.log(`${CYAN}${prefix}:${RESET} ${content.slice(0, 300)}${content.length > 300 ? " ..." : ""}`);
 }
 export function toolCall(name, args) {
+    if (QUIET)
+        return;
     const a = Object.entries(args)
         .map(([k, v]) => `${k}=${JSON.stringify(v)?.slice(0, 80)}`)
         .join(" ");
     console.log(`${CYAN}→ ${name}(${a})${RESET}`);
 }
 export function toolResult(name, ok, output) {
+    if (QUIET)
+        return;
     const preview = output.split("\n")[0]?.slice(0, 120) ?? "";
     const icon = ok ? `${GREEN}✓${RESET}` : `${RED}✗${RESET}`;
-    console.log(`${icon} ${CYAN}${name}${RESET} → ${preview}`);
+    console.log(`${icon} ${CYAN}${name}${RESET} ${DIM}→${RESET} ${preview}`);
 }
 export function buildStatus(success, output) {
+    if (QUIET)
+        return;
     const icon = success ? `${GREEN}✓ BUILD SUCCESS` : `${RED}✗ BUILD FAILED`;
     console.log(`\n${icon}${RESET}\n${output.split("\n").slice(-10).join("\n")}\n`);
 }
 export function header(msg) {
+    if (QUIET)
+        return;
     console.log(`\n${BOLD}${CYAN}── ${msg} ${"─".repeat(Math.max(2, 60 - msg.length))}${RESET}`);
 }
+/** Startup banner: a clean key/value box (plain-text fallback when piped). */
+export function banner(title, rows) {
+    if (QUIET)
+        return;
+    const keyWidth = Math.max(8, ...rows.map(([k]) => k.length));
+    const inner = Math.max(title.length + 4, ...rows.map(([, v]) => keyWidth + Math.max(...String(v).split("\n").map((l) => l.length)) + 1));
+    console.log(`${BOLD}${CYAN}╭─ ${title} ${"─".repeat(Math.max(1, inner - title.length - 3))}╮${RESET}`);
+    for (const [key, value] of rows) {
+        const lines = String(value).split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const k = (i === 0 ? key : "").padEnd(keyWidth);
+            let v = lines[i];
+            const maxV = inner - keyWidth - 1;
+            if (v.length > maxV)
+                v = v.slice(0, maxV - 1) + "…";
+            const pad = Math.max(0, inner - 1 - keyWidth - v.length);
+            console.log(`${BOLD}${CYAN}│${RESET} ${DIM}${k}${RESET}${v}${" ".repeat(pad)}${BOLD}${CYAN}│${RESET}`);
+        }
+    }
+    console.log(`${BOLD}${CYAN}╰${"─".repeat(inner)}╯${RESET}`);
+}
 // ── Streaming helpers ────────────────────────────────────────────────────────
 let _streamLine = "";
 let _streamColor = CYAN;
 let _streamPrefix = "";
 /** Start a streaming line. Call llmStreamChunk() for each delta, then llmStreamEnd(). */
 export function llmStreamStart(prefix = "assistant", color = CYAN) {
+    if (QUIET)
+        return;
     _streamLine = "";
     _streamColor = color;
     _streamPrefix = prefix;
@@ -59,19 +112,70 @@ export function llmStreamStart(prefix = "assistant", color = CYAN) {
 }
 /** Append a text delta to the current streaming line. */
 export function llmStreamChunk(delta) {
+    if (QUIET)
+        return;
     _streamLine += delta;
     process.stdout.write(delta);
 }
 /** Finish the streaming line (append suffix + newline). */
 export function llmStreamEnd(suffix = "") {
+    if (QUIET)
+        return "";
     const line = _streamLine;
     _streamLine = "";
     process.stdout.write(`${suffix}\n`);
     return line;
 }
+// ── Tool output streaming (live run_command output) ─────────────────────────
+const TOOL_STREAM_MAX_CHARS = 20_000;
+let _toolStreamOpen = false;
+let _toolStreamLineOpen = false; // last chunk did not end with "\n"
+let _toolStreamChars = 0;
+/** Begin a live tool-output block. Output is printed dimmed, capped at 20k chars. */
+export function toolStreamStart() {
+    if (QUIET || _toolStreamOpen)
+        return;
+    _toolStreamOpen = true;
+    _toolStreamLineOpen = false;
+    _toolStreamChars = 0;
+    process.stdout.write(`${DIM}┌ output${RESET}`);
+}
+/** Append a tool-output delta to the live block. */
+export function toolStreamChunk(delta) {
+    if (QUIET || !_toolStreamOpen)
+        return;
+    if (_toolStreamChars >= TOOL_STREAM_MAX_CHARS)
+        return;
+    _toolStreamChars += delta.length;
+    if (_toolStreamChars >= TOOL_STREAM_MAX_CHARS) {
+        // Include the tail of this chunk up to the cap, then stop rendering live.
+        const keep = delta.slice(0, Math.max(0, delta.length - (_toolStreamChars - TOOL_STREAM_MAX_CHARS)));
+        if (keep.length > 0) {
+            process.stdout.write(`${DIM}${keep}${RESET}`);
+            _toolStreamLineOpen = !keep.endsWith("\n");
+        }
+        process.stdout.write(`\n${DIM}│ (live output truncated at ${TOOL_STREAM_MAX_CHARS} chars — full output in the result)${RESET}`);
+        return;
+    }
+    process.stdout.write(`\n${DIM}│ ${delta.replace(/\n/g, `\n${DIM}│ ${RESET}`)}${RESET}`);
+    _toolStreamLineOpen = !delta.endsWith("\n");
+}
+/** Finish the live tool-output block (closes the partial last line). */
+export function toolStreamEnd() {
+    if (QUIET || !_toolStreamOpen)
+        return;
+    _toolStreamOpen = false;
+    process.stdout.write(_toolStreamLineOpen ? `\n${DIM}└${RESET}\n` : `${DIM}└${RESET}\n`);
+}
+/** True while a live tool-output block is open. */
+export function isToolStreamOpen() {
+    return _toolStreamOpen;
+}
 // ── Diff rendering ───────────────────────────────────────────────────────────
 /** Print a unified diff with colors (+ green, - red, @@ cyan). */
 export function printDiff(diffText) {
+    if (QUIET)
+        return;
     for (const line of diffText.split("\n")) {
         if (line.startsWith("+++") || line.startsWith("---")) {
             console.log(`${BOLD}${line}${RESET}`);
@@ -92,5 +196,7 @@ export function printDiff(diffText) {
 }
 /** Print a one-line diff summary: "✎ +12 -3 lines → src/foo.ts". */
 export function diffSummary(path, added, removed) {
+    if (QUIET)
+        return;
     console.log(`${CYAN}✎${RESET} ${BOLD}${path}${RESET} ${GREEN}+${added}${RESET} ${RED}-${removed}${RESET} lines`);
 }

package/dist/webfetch.js

@@ -0,0 +1,251 @@
+import { isIP } from "node:net";
+import { lookup } from "node:dns/promises";
+/**
+ * web_fetch — read-only HTTP(S) fetch with SSRF protection.
+ *
+ * - Only http/https; follows up to 5 redirects, validating every hop.
+ * - Private/loopback/link-local addresses are blocked by default
+ *   (env SCODER_WEB_ALLOW_PRIVATE=1 lifts the block for local dev/testing).
+ * - HTML is converted to plain text; JSON is pretty-printed; binary is refused.
+ * - Output is capped so a huge page cannot flood the LLM context.
+ */
+const FETCH_TIMEOUT_MS = 30_000;
+const MAX_BODY_BYTES = 512 * 1024;
+const MAX_REDIRECTS = 5;
+const DEFAULT_MAX_CHARS = 20_000;
+function allowPrivate() {
+    return process.env.SCODER_WEB_ALLOW_PRIVATE === "1";
+}
+/** True if the address is private/loopback/link-local (IPv4 + IPv6). */
+function isPrivateAddress(ip) {
+    const v = isIP(ip);
+    if (v === 4) {
+        const parts = ip.split(".").map(Number);
+        const a = parts[0];
+        const b = parts[1];
+        if (a === 10 || a === 127 || a === 0)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT
+        return false;
+    }
+    if (v === 6) {
+        const lower = ip.toLowerCase();
+        if (lower === "::1" || lower === "::")
+            return true;
+        if (lower.startsWith("fe80"))
+            return true; // link-local
+        if (/^f[cd][0-9a-f]{2}:/.test(lower))
+            return true; // unique local fc00::/7
+        // IPv4-mapped ::ffff:10.0.0.1
+        const mapped = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+        if (mapped)
+            return isPrivateAddress(mapped[1]);
+        return false;
+    }
+    return true; // not parseable -> treat as private (fail closed)
+}
+/** Resolve hostname and refuse private addresses (unless explicitly allowed). */
+async function assertPublicHost(hostname) {
+    if (allowPrivate())
+        return;
+    let addresses;
+    try {
+        addresses = await lookup(hostname, { all: true, verbatim: true });
+    }
+    catch (err) {
+        throw new Error(`DNS lookup failed for "${hostname}": ${err.message}`, { cause: err });
+    }
+    if (addresses.length === 0) {
+        throw new Error(`DNS lookup returned no addresses for "${hostname}"`);
+    }
+    for (const addr of addresses) {
+        if (isPrivateAddress(addr.address)) {
+            throw new Error(`Blocked: "${hostname}" resolves to a private/loopback address (${addr.address}). ` +
+                `web_fetch only reaches public hosts (set SCODER_WEB_ALLOW_PRIVATE=1 to allow local testing).`);
+        }
+    }
+}
+/** Decode the HTML entities that actually appear in practice. */
+function decodeEntities(s) {
+    const named = {
+        amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", ndash: "–", mdash: "—",
+        hellip: "…", rsquo: "’", lsquo: "‘", rdquo: "”", ldquo: "“", copy: "©", reg: "®",
+    };
+    return s.replace(/&(#x?[0-9a-fA-F]+|[a-zA-Z]+);/g, (whole, body) => {
+        if (body.startsWith("#x") || body.startsWith("#X")) {
+            const code = parseInt(body.slice(2), 16);
+            return Number.isFinite(code) ? String.fromCodePoint(code) : whole;
+        }
+        if (body.startsWith("#")) {
+            const code = parseInt(body.slice(1), 10);
+            return Number.isFinite(code) ? String.fromCodePoint(code) : whole;
+        }
+        return named[body.toLowerCase()] ?? whole;
+    });
+}
+/** Convert HTML to readable plain text (scripts/styles stripped, block tags → newlines). */
+export function htmlToText(html) {
+    const out = html
+        .replace(/<script[\s\S]*?<\/script\s*>/gi, " ")
+        .replace(/<style[\s\S]*?<\/style\s*>/gi, " ")
+        .replace(/<noscript[\s\S]*?<\/noscript\s*>/gi, " ")
+        .replace(/<!--[\s\S]*?-->/g, " ")
+        .replace(/<(br|\/p|\/div|\/section|\/article|\/header|\/footer|\/h[1-6]|\/li|\/tr|\/pre|\/blockquote)[^>]*>/gi, "\n")
+        .replace(/<[^>]+>/g, " ")
+        .replace(/[ \t]+/g, " ")
+        .replace(/ *\n */g, "\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+    return decodeEntities(out);
+}
+/** Extract the <title> of an HTML document, if present. */
+function extractTitle(html) {
+    const m = html.match(/<title[^>]*>([\s\S]*?)<\/title\s*>/i);
+    if (!m)
+        return null;
+    const t = decodeEntities(m[1]).replace(/\s+/g, " ").trim();
+    return t ? t.slice(0, 200) : null;
+}
+/** Read the response body as text, capped at MAX_BODY_BYTES, then cancel the stream. */
+async function readBodyCapped(res) {
+    const reader = res.body?.getReader();
+    if (!reader)
+        return { text: "", truncated: false };
+    const decoder = new TextDecoder("utf-8");
+    let text = "";
+    let received = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        received += value.byteLength;
+        text += decoder.decode(value, { stream: true });
+        if (received >= MAX_BODY_BYTES) {
+            try {
+                await reader.cancel();
+            }
+            catch { /* already closed */ }
+            return { text: text + decoder.decode(), truncated: true };
+        }
+    }
+    return { text: text + decoder.decode(), truncated: false };
+}
+/** Implementation of the web_fetch tool. Also used by tests via the registry. */
+export async function toolWebFetch(ctx, args) {
+    const maxChars = Math.min(Math.max(args.max_chars ?? DEFAULT_MAX_CHARS, 500), 100_000);
+    let url;
+    try {
+        url = new URL(args.url);
+    }
+    catch {
+        return { ok: false, output: `ERROR: invalid URL: ${args.url}` };
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return { ok: false, output: `ERROR: only http/https URLs are supported (got ${url.protocol})` };
+    }
+    // Combined timeout + external abort (SIGINT) — manual composition for Node 18 compat
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`timeout after ${FETCH_TIMEOUT_MS / 1000}s`)), FETCH_TIMEOUT_MS);
+    const onExternalAbort = () => controller.abort(new Error("interrupted by user"));
+    if (ctx.signal?.aborted)
+        onExternalAbort();
+    else
+        ctx.signal?.addEventListener("abort", onExternalAbort, { once: true });
+    const signal = controller.signal;
+    let current = url;
+    try {
+        // Redirect loop with per-hop SSRF validation
+        for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+            if (signal.aborted) {
+                return { ok: false, output: `ERROR: fetch aborted (${signal.reason?.message ?? "aborted"})` };
+            }
+            await assertPublicHost(current.hostname);
+            const res = await fetch(current, {
+                method: "GET",
+                redirect: "manual",
+                headers: {
+                    "User-Agent": "scoder-agent (+https://github.com/nbhson/app-scoder-agent)",
+                    Accept: "text/html, application/json, text/plain;q=0.9, */*;q=0.1",
+                },
+                signal,
+            });
+            // Follow redirects manually so every hop is validated against SSRF
+            if (res.status >= 300 && res.status < 400) {
+                const loc = res.headers.get("location");
+                try {
+                    await res.body?.cancel();
+                }
+                catch { /* ignore */ }
+                if (!loc) {
+                    return { ok: false, output: `ERROR: ${res.status} redirect without Location header at ${current.href}` };
+                }
+                if (hop === MAX_REDIRECTS) {
+                    return { ok: false, output: `ERROR: too many redirects (>${MAX_REDIRECTS}) fetching ${args.url}` };
+                }
+                current = new URL(loc, current);
+                continue;
+            }
+            if (!res.ok) {
+                try {
+                    await res.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return { ok: false, output: `ERROR: HTTP ${res.status} ${res.statusText} for ${current.href}` };
+            }
+            const contentType = res.headers.get("content-type") ?? "";
+            if (/^(image|audio|video|font|application\/(octet-stream|zip|gzip|pdf|wasm))/i.test(contentType)) {
+                try {
+                    await res.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return { ok: false, output: `ERROR: unsupported content-type "${contentType}" — web_fetch returns text only (html/json/plain).` };
+            }
+            const { text: body, truncated } = await readBodyCapped(res);
+            let text;
+            if (/json/i.test(contentType)) {
+                text = prettyJson(body) ?? body;
+            }
+            else if (/html/i.test(contentType) || /^\s*</.test(body)) {
+                text = htmlToText(body);
+            }
+            else {
+                text = body;
+            }
+            const title = /text\/html/i.test(contentType) ? extractTitle(body) : null;
+            const meta = [
+                `HTTP ${res.status} ${res.statusText || ""}`.trimEnd(),
+                contentType || "unknown content-type",
+                truncated ? `body truncated at ${MAX_BODY_BYTES / 1024}KB` : null,
+            ].filter(Boolean).join(", ");
+            const out = `${text.slice(0, maxChars)}${text.length > maxChars ? `\n... [truncated, ${text.length - maxChars} more chars]` : ""}`;
+            return {
+                ok: true,
+                output: `${title ? `Title: ${title}\n` : ""}${current.href}\n(${meta})\n\n${out}`,
+            };
+        }
+        // unreachable
+        return { ok: false, output: "ERROR: redirect loop" };
+    }
+    catch (err) {
+        return { ok: false, output: `ERROR: fetch failed for ${current.href}: ${err.message}` };
+    }
+    finally {
+        clearTimeout(timer);
+        ctx.signal?.removeEventListener("abort", onExternalAbort);
+    }
+}
+function prettyJson(body) {
+    try {
+        return JSON.stringify(JSON.parse(body), null, 2);
+    }
+    catch {
+        return undefined;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "s-app-scoder-agent",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Autonomous coding agent CLI - similar to opencode/cline/claude. Runs tasks until build succeeds.",
   "type": "module",
   "main": "dist/index.js",
@@ -46,8 +46,13 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.0.0",
+    "@types/react": "^18.3.31",
     "eslint": "^10.13.0",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.72.1"
+  },
+  "dependencies": {
+    "ink": "^5.2.1",
+    "react": "^18.3.1"
   }
 }