smolcoder-plus 1.0.0

package/dist/providers/transport.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withDeadline = withDeadline;
+exports.responseLines = responseLines;
+exports.streamJson = streamJson;
+exports.abortableDelay = abortableDelay;
+/** Fail visibly when a local server accepts a request but stops producing data. */
+async function withDeadline(opts, run) {
+    const controller = new AbortController();
+    const cancel = () => controller.abort(opts.signal?.reason);
+    let idle;
+    const activity = () => {
+        clearTimeout(idle);
+        idle = setTimeout(() => controller.abort(new Error("Backend timed out waiting for data. Check the model server and available memory.")), opts.idleTimeoutMs ?? 180_000);
+    };
+    const total = setTimeout(() => controller.abort(new Error("Backend request timed out. The model did not finish within the request deadline.")), opts.timeoutMs ?? 900_000);
+    opts.signal?.addEventListener("abort", cancel, { once: true });
+    if (opts.signal?.aborted)
+        cancel();
+    activity();
+    try {
+        return await run(controller.signal, activity);
+    }
+    catch (error) {
+        if (controller.signal.aborted)
+            throw controller.signal.reason;
+        throw error;
+    }
+    finally {
+        clearTimeout(idle);
+        clearTimeout(total);
+        opts.signal?.removeEventListener("abort", cancel);
+    }
+}
+/** Cancel reads and release the connection even on malformed stream data. */
+async function* responseLines(res, activity) {
+    if (!res.body)
+        throw new Error("Backend returned an empty response body");
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            activity();
+            buffer += decoder.decode(value, { stream: true });
+            if (buffer.length > 4_000_000)
+                throw new Error("Backend stream frame exceeded 4 MB");
+            let nl;
+            while ((nl = buffer.indexOf("\n")) >= 0) {
+                yield buffer.slice(0, nl).trim();
+                buffer = buffer.slice(nl + 1);
+            }
+        }
+        buffer += decoder.decode();
+        if (buffer.trim())
+            yield buffer.trim();
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+}
+function streamJson(line) {
+    let data;
+    try {
+        data = JSON.parse(line);
+    }
+    catch {
+        throw new Error("Backend stream contained malformed JSON; the response was discarded");
+    }
+    if (data?.error)
+        throw new Error(`Backend stream error: ${typeof data.error === "string" ? data.error : data.error.message ?? JSON.stringify(data.error)}`);
+    return data;
+}
+function abortableDelay(ms, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => { clearTimeout(timer); signal.removeEventListener("abort", abort); reject(signal.reason); };
+        const timer = setTimeout(() => { signal.removeEventListener("abort", abort); resolve(); }, ms);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+            abort();
+    });
+}

package/dist/providers/types.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_OUTPUT_TOKENS = exports.EFFORT_RANK = void 0;
+exports.nextCallId = nextCallId;
+exports.parseArgs = parseArgs;
+exports.estimateReplayTokens = estimateReplayTokens;
+exports.lastUserIndex = lastUserIndex;
+// One internal message/tool shape; each provider adapts it to its wire format.
+const crypto_1 = require("crypto");
+/** Rank of every reasoning level any backend knows about, used to map a
+ * requested effort onto whatever a specific model actually supports. */
+exports.EFFORT_RANK = {
+    none: 0,
+    off: 0,
+    minimal: 1,
+    low: 2,
+    medium: 3,
+    high: 4,
+    xhigh: 5,
+    on: 3,
+};
+exports.MAX_OUTPUT_TOKENS = 2048;
+let callCounter = 0;
+const callPrefix = (0, crypto_1.randomBytes)(6).toString("hex");
+function nextCallId() {
+    return `call_${callPrefix}_${++callCounter}`;
+}
+function parseArgs(raw) {
+    if (raw && typeof raw === "object" && !Array.isArray(raw))
+        return { args: raw };
+    if (typeof raw === "string") {
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                return { args: parsed, rawArgs: raw };
+            return { args: {}, rawArgs: raw, parseError: "arguments were not a JSON object" };
+        }
+        catch (e) {
+            return { args: {}, rawArgs: raw, parseError: `invalid JSON: ${e.message}` };
+        }
+    }
+    return raw === undefined ? { args: {} } : { args: {}, parseError: "arguments were not a JSON object" };
+}
+/** Tokens the visible reply + tool-call JSON will occupy when replayed in the
+ * next prompt (~4 chars/token, corrected by real usage on the next response). */
+function estimateReplayTokens(content, toolCalls) {
+    let chars = (content ?? "").length;
+    for (const tc of toolCalls)
+        chars += tc.name.length + (tc.rawArgs ?? JSON.stringify(tc.args)).length + 12;
+    return Math.ceil(chars / 4);
+}
+/** Index of the most recent plain user message (the current turn's start).
+ * Reasoning traces from assistant messages BEFORE it are dropped from the
+ * wire — that is what the Qwen3-family chat templates do themselves, and it
+ * is the biggest single saving on a long tool loop with a thinking model. */
+function lastUserIndex(messages) {
+    for (let i = messages.length - 1; i >= 0; i--) {
+        if (messages[i].role === "user" && !messages[i].compactNote && !messages[i].historyNote)
+            return i;
+    }
+    return -1;
+}

package/dist/sandbox.js

@@ -0,0 +1,207 @@
+"use strict";
+// Workspace containment for file tools. Every path a tool touches must resolve
+// inside the workspace root — including through symlinks, which is why we
+// realpath the deepest EXISTING ancestor before comparing.
+//
+// Commands (run_command / task) cannot be contained this way. Edit mode scans
+// the command text instead (commandEscapesWorkspace, below) and asks the user
+// only when something reaches outside; bypass mode never asks.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SandboxError = void 0;
+exports.resolveInWorkspace = resolveInWorkspace;
+exports.relPath = relPath;
+exports.commandEscapesWorkspace = commandEscapesWorkspace;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class SandboxError extends Error {
+}
+exports.SandboxError = SandboxError;
+const isWin = process.platform === "win32";
+function normalizeForCompare(p) {
+    return isWin ? p.toLowerCase() : p;
+}
+/** The deepest ancestor of `abs` that exists (the path itself when it does).
+ * Throws when a path cannot be inspected for a reason other than not existing. */
+function deepestExisting(abs) {
+    let existing = abs;
+    for (;;) {
+        try {
+            fs.lstatSync(existing);
+            break;
+        }
+        catch (err) {
+            if (err?.code !== "ENOENT" && err?.code !== "ENOTDIR")
+                throw err;
+        }
+        const parent = path.dirname(existing);
+        if (parent === existing)
+            break;
+        existing = parent;
+    }
+    return existing;
+}
+function resolveInWorkspace(root, userPath) {
+    if (typeof userPath !== "string" || userPath.trim() === "") {
+        throw new SandboxError("path is required (relative to the workspace, e.g. \"src/app.js\").");
+    }
+    const abs = path.resolve(root, userPath);
+    // realpath the deepest existing ancestor to defeat symlink escapes
+    let existing;
+    try {
+        existing = deepestExisting(abs);
+    }
+    catch {
+        throw new SandboxError(`cannot inspect path "${userPath}".`);
+    }
+    let realExisting;
+    let realRoot;
+    try {
+        realExisting = fs.realpathSync(existing);
+        realRoot = fs.realpathSync(root);
+    }
+    catch {
+        throw new SandboxError(`cannot resolve path "${userPath}".`);
+    }
+    const rel = path.relative(normalizeForCompare(realRoot), normalizeForCompare(realExisting));
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new SandboxError(`"${userPath}" is outside the workspace. Only files inside ${root} can be accessed. Use a relative path like "src/app.js".`);
+    }
+    return abs;
+}
+function relPath(root, abs) {
+    return path.relative(root, abs).split(path.sep).join("/") || ".";
+}
+// ---------------------------------------------------------------------------
+// Command containment (edit mode). A shell command cannot be sandboxed the way
+// a file path can, so this is a best-effort scan of the command text for
+// anything that reaches outside the workspace: absolute paths that resolve
+// elsewhere, `..` climbing past the root, home-directory shortcuts, temp-dir
+// variables, and package-manager global installs. A clean in-tree command
+// (`npm install`, `node script.mjs`, `a && b`) runs without asking; a flagged
+// one goes to the y/n prompt with the reason shown. False positives cost one
+// prompt, false negatives are the accepted limit of a text scan.
+const HOME_TOKENS = /^(~|\$HOME|\$\{HOME\}|%USERPROFILE%|%HOMEPATH%)([\\/]|$)/i;
+const TEMP_TOKENS = /^(\$TMPDIR|\$\{TMPDIR\}|\$TEMP|\$TMP|%TEMP%|%TMP%|\$\{TEMP\}|\$\{TMP\})([\\/]|$)/i;
+const GLOBAL_INSTALL = /\b(npm|pnpm|yarn|bun)\b[^;&|]*\s(-g|--global|global)(\s|$)/;
+/** MSYS roots Git Bash maps to real places; any other one-segment `/word` on
+ * Windows is a command switch (`taskkill /pid`, `dir /s`), not a path. */
+const MSYS_ROOTS = /^\/(tmp|usr|etc|bin|home|mnt|dev|proc|var|opt|root)(\/|$)/i;
+/** Split a command into candidate path tokens: whitespace-separated words with
+ * quotes stripped, the value side of `--flag=value` and `VAR=value`, and the
+ * target of `>`/`<` redirections written without a space. */
+function pathCandidates(command) {
+    const out = [];
+    for (const raw of command.split(/\s+/)) {
+        if (!raw)
+            continue;
+        let tok = raw.replace(/^[<>]+|^[\d]?[<>]+&?/, "").replace(/^["'`]+|["'`,;)]+$/g, "");
+        if (!tok)
+            continue;
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(tok))
+            continue; // URLs
+        const eq = tok.indexOf("=");
+        if (eq > 0 && /^[-\w.]+$/.test(tok.slice(0, eq)))
+            tok = tok.slice(eq + 1);
+        if (tok)
+            out.push(tok);
+    }
+    return out;
+}
+/** Git Bash writes C:\x as /c/x; map that back so it compares like a Windows
+ * path. A bare `/f` with nothing after it is left alone — that is a command
+ * switch far more often than the root of drive F:. */
+function fromMsys(tok) {
+    const m = /^\/([a-zA-Z])(\/.*)$/.exec(tok);
+    if (m && isWin)
+        return `${m[1].toUpperCase()}:${m[2].replace(/\//g, "\\")}`;
+    return tok;
+}
+function isAbsoluteLike(tok) {
+    if (/^[a-zA-Z]:[\\/]/.test(tok))
+        return true; // C:\ or C:/
+    if (/^\\\\/.test(tok))
+        return true; // UNC
+    return tok.startsWith("/");
+}
+/** `abs` with symlinks resolved as far as the path exists; the part not
+ * written yet is kept as given. Falls back to the path itself. */
+function realPathOf(abs) {
+    try {
+        const existing = deepestExisting(abs);
+        return path.join(fs.realpathSync(existing), path.relative(existing, abs));
+    }
+    catch {
+        return abs;
+    }
+}
+/** Both sides are resolved the same way. Resolving only the root made every
+ * in-tree path look foreign when the workspace sits behind a symlink — macOS
+ * temp folders, or `smol /tmp/project` — and resolving the path also catches
+ * a link inside the workspace that leads out of it. */
+function insideWorkspace(root, abs) {
+    const rel = path.relative(normalizeForCompare(realPathOf(path.resolve(root))), normalizeForCompare(realPathOf(path.resolve(abs))));
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+}
+/**
+ * Why a command would reach outside the workspace, or null when every path it
+ * mentions stays inside it. Only the reason text is returned; the caller
+ * decides whether that means "ask" or "refuse".
+ */
+function commandEscapesWorkspace(command, root) {
+    if (GLOBAL_INSTALL.test(command))
+        return "installs a package globally, outside the workspace";
+    for (const tok of pathCandidates(command)) {
+        if (HOME_TOKENS.test(tok))
+            return `uses the home directory (${tok})`;
+        if (TEMP_TOKENS.test(tok))
+            return `uses the system temp directory (${tok})`;
+        const t = fromMsys(tok);
+        if (isAbsoluteLike(t)) {
+            // On Windows under Git Bash, a bare POSIX path like /tmp or /usr/bin is
+            // an MSYS path — never inside a Windows workspace.
+            const posixOnWin = isWin && t.startsWith("/");
+            if (posixOnWin && !MSYS_ROOTS.test(t))
+                continue; // a /switch, not a path
+            if (posixOnWin || !insideWorkspace(root, t))
+                return `reaches outside the workspace (${tok})`;
+            continue;
+        }
+        if (/(^|[\\/])\.\.([\\/]|$)/.test(t) && !insideWorkspace(root, path.resolve(root, t))) {
+            return `climbs above the workspace (${tok})`;
+        }
+    }
+    return null;
+}