termux-dev 1.4.19 → 1.6.0

package/dist/permissions/guard.js

@@ -25,14 +25,19 @@ function isDangerousBashCommand(commandStr) {
         return false;
     // Normalize whitespace: collapse multiple spaces/tabs into single space
     const norm = commandStr.toLowerCase().replace(/\s+/g, ' ').trim();
-    // Pattern matching rm with combined flags (-rf, -fr, -r -f, etc.) targeting root, home, termux prefix, or glob
-    const isDangerousRm = /rm\s+-(?:[a-z]*r[a-z]*f|[a-z]*f[a-z]*r)\s+(?:\/|\/\*|~|~\/|\*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm) ||
-        /rm\s+-[a-z]*r[a-z]*\s+-[a-z]*f[a-z]*\s+(?:\/|\/\*|~|~\/|\*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm) ||
-        /rm\s+-[a-z]*f[a-z]*\s+-[a-z]*r[a-z]*\s+(?:\/|\/\*|~|~\/|\*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm);
+    // Pattern matching rm with combined flags (-rf, -fr, -r -f, etc.) targeting root, home, termux prefix, glob, or current/parent dir
+    const isDangerousRm = /rm\s+-(?:[a-z]*r[a-z]*f|[a-z]*f[a-z]*r)\s+(?:\/|\/\*|~|~\/|\*|\.|\.\/|\.\.\/?.*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm) ||
+        /rm\s+-[a-z]*r[a-z]*\s+-[a-z]*f[a-z]*\s+(?:\/|\/\*|~|~\/|\*|\.|\.\/|\.\.\/?.*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm) ||
+        /rm\s+-[a-z]*f[a-z]*\s+-[a-z]*r[a-z]*\s+(?:\/|\/\*|~|~\/|\*|\.|\.\/|\.\.\/?.*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm);
     return (isDangerousRm ||
         norm.includes('rm -rf /') ||
         norm.includes('rm -rf ~') ||
         norm.includes('rm -rf *') ||
+        norm.includes('rm -rf .') ||
+        norm.includes('rm -rf ./') ||
+        norm.includes('rm -rf ..') ||
+        norm.includes('rm -fr .') ||
+        norm.includes('rm -fr ./') ||
         norm.includes('rm -rf $prefix') ||
         norm.includes('rm -rf $home') ||
         norm.includes('rm -rf /data/data/com.termux') ||

package/dist/providers/openai.js

@@ -220,11 +220,12 @@ export class OpenAIProvider {
                     const trimmed = line.trim();
                     if (!trimmed || trimmed.startsWith(':'))
                         continue;
-                    if (trimmed === 'data: [DONE]')
-                        continue;
-                    if (trimmed.startsWith('data: ')) {
+                    if (trimmed.startsWith('data:')) {
+                        const dataPayload = trimmed.replace(/^data:\s*/, '');
+                        if (dataPayload === '[DONE]')
+                            continue;
                         try {
-                            const json = JSON.parse(trimmed.slice(6));
+                            const json = JSON.parse(dataPayload);
                             if (json.error) {
                                 const errMsg = json.error.message || json.error.code || JSON.stringify(json.error);
                                 throw new Error(`Provider Stream Error: ${errMsg}`);

package/dist/tools/fs.js

@@ -108,7 +108,8 @@ export const editFileTool = {
             properties: {
                 path: { type: 'string', description: 'Path to the file to edit' },
                 target: { type: 'string', description: 'Exact string or block of code to replace' },
-                replacement: { type: 'string', description: 'New string or block of code to replace with' }
+                replacement: { type: 'string', description: 'New string or block of code to replace with' },
+                replaceAll: { type: 'boolean', description: 'If true, replaces all occurrences of target in the file. Default is false.' }
             },
             required: ['path', 'target', 'replacement']
         }
@@ -138,14 +139,48 @@ export const editFileTool = {
                     throw new Error(`Target text to replace was not found in ${args.path}. Ensure exact indentation and characters match.`);
                 }
             }
-            const targetIndex = content.indexOf(target);
-            const allLines = content.split('\n');
-            const startLine = content.slice(0, targetIndex).split('\n').length;
-            const removedArr = target.split('\n');
+            // Find all matching occurrences
+            const matches = [];
+            let searchPos = 0;
+            while (searchPos < content.length) {
+                const idx = content.indexOf(target, searchPos);
+                if (idx === -1)
+                    break;
+                matches.push(idx);
+                searchPos = idx + Math.max(1, target.length);
+            }
+            const isReplaceAll = args.replaceAll === true || args.replaceAll === 'true';
+            if (matches.length > 1 && !isReplaceAll) {
+                const lineNumbers = matches.map(idx => content.slice(0, idx).split(/\r?\n/).length);
+                throw new Error(`Target text matches ${matches.length} occurrences in ${args.path} at lines: [${lineNumbers.join(', ')}]. ` +
+                    `Please provide more surrounding lines/context to make the target block unique, or set replaceAll: true to replace all instances.`);
+            }
+            const hasCRLF = oldContent.includes('\r\n');
+            const removedArr = target.split(/\r?\n/);
+            const addedArr = args.replacement.split(/\r?\n/);
+            if (isReplaceAll && matches.length > 1) {
+                let newContent = content.split(target).join(args.replacement);
+                if (hasCRLF) {
+                    newContent = newContent.replace(/\r?\n/g, '\r\n');
+                }
+                else {
+                    newContent = newContent.replace(/\r\n/g, '\n');
+                }
+                await fs.writeFile(args.path, newContent, 'utf8');
+                return JSON.stringify({
+                    status: 'success',
+                    action: 'edit',
+                    path: args.path,
+                    occurrencesReplaced: matches.length,
+                    summary: `Successfully replaced all ${matches.length} occurrences in ${args.path}`
+                });
+            }
+            const targetIndex = matches[0];
+            const allLines = content.split(/\r?\n/);
+            const startLine = content.slice(0, targetIndex).split(/\r?\n/).length;
             const endLine = startLine + removedArr.length - 1;
             const contextBefore = allLines.slice(Math.max(0, startLine - 3), startLine - 1);
             const contextAfter = allLines.slice(endLine, Math.min(allLines.length, endLine + 2));
-            const addedArr = args.replacement.split('\n');
             const diffLines = [];
             let lineCounter = startLine - contextBefore.length;
             contextBefore.forEach((l) => diffLines.push(`${lineCounter++}    ${l}`));
@@ -153,7 +188,6 @@ export const editFileTool = {
             let addCounter = startLine;
             addedArr.forEach((l) => diffLines.push(`${addCounter++} +  ${l}`));
             contextAfter.forEach((l) => diffLines.push(`${addCounter++}    ${l}`));
-            const hasCRLF = oldContent.includes('\r\n');
             let newContent = content.slice(0, targetIndex) + args.replacement + content.slice(targetIndex + target.length);
             if (hasCRLF) {
                 newContent = newContent.replace(/\r?\n/g, '\r\n');

package/dist/tools/packages.js

@@ -18,6 +18,10 @@ export const installPackageTool = {
     validateArgs(args) {
         if (!args.package || typeof args.package !== 'string')
             throw new Error('package is required');
+        const sanitized = args.package.trim();
+        if (!/^[@a-zA-Z0-9_\-./=><^~+:[\] ]+$/.test(sanitized) || /[;&|`$\n\r()]/.test(sanitized)) {
+            throw new Error(`Invalid package name: "${args.package}". Invalid characters or potential command injection detected.`);
+        }
     },
     async execute(args) {
         let pkgManager = args.manager;
@@ -40,29 +44,49 @@ export const installPackageTool = {
                 pkgManager = 'npm';
             }
         }
-        let cmd = '';
+        let executable = 'npm';
+        let cmdArgs = [];
+        const pkgs = args.package.trim().split(/\s+/);
         if (pkgManager === 'npm') {
-            cmd = `npm install ${args.dev ? '-D ' : ''}${args.package}`;
+            executable = 'npm';
+            cmdArgs = ['install'];
+            if (args.dev)
+                cmdArgs.push('-D');
+            cmdArgs.push(...pkgs);
         }
         else if (pkgManager === 'yarn') {
-            cmd = `yarn add ${args.dev ? '-D ' : ''}${args.package}`;
+            executable = 'yarn';
+            cmdArgs = ['add'];
+            if (args.dev)
+                cmdArgs.push('-D');
+            cmdArgs.push(...pkgs);
         }
         else if (pkgManager === 'pnpm') {
-            cmd = `pnpm add ${args.dev ? '-D ' : ''}${args.package}`;
+            executable = 'pnpm';
+            cmdArgs = ['add'];
+            if (args.dev)
+                cmdArgs.push('-D');
+            cmdArgs.push(...pkgs);
         }
         else if (pkgManager === 'pip') {
-            const isUnix = process.platform !== 'win32';
-            const extraFlag = isUnix ? ' --break-system-packages' : '';
-            cmd = `pip install ${args.package}${extraFlag}`;
+            executable = 'pip';
+            cmdArgs = ['install'];
+            if (process.platform !== 'win32') {
+                cmdArgs.push('--break-system-packages');
+            }
+            cmdArgs.push(...pkgs);
         }
         else if (pkgManager === 'cargo') {
-            cmd = `cargo add ${args.package}`;
+            executable = 'cargo';
+            cmdArgs = ['add', ...pkgs];
         }
         else {
-            cmd = `npm install ${args.package}`;
+            executable = 'npm';
+            cmdArgs = ['install', ...pkgs];
         }
+        const isWin = process.platform === 'win32';
         return new Promise((resolve) => {
-            const proc = spawn(cmd, { shell: true });
+            const proc = spawn(executable, cmdArgs, { shell: isWin });
             let output = '';
             proc.stdout.on('data', (d) => { output += d.toString(); });
             proc.stderr.on('data', (d) => { output += d.toString(); });
@@ -75,7 +99,7 @@ export const installPackageTool = {
                 }
             });
             proc.on('error', (err) => {
-                resolve(`Failed to run ${cmd}: ${err.message}`);
+                resolve(`Failed to run ${executable} ${cmdArgs.join(' ')}: ${err.message}`);
             });
         });
     }

package/dist/tools/search.js

@@ -11,9 +11,20 @@ const IGNORED_DIRS = new Set([
     '.cache',
     'vendor'
 ]);
-async function searchFiles(dir, query, results, maxResults = 50) {
-    if (results.length >= maxResults)
+const MAX_FILE_SIZE = 512 * 1024; // 512 KB
+async function searchFiles(dir, query, results, maxResults = 50, visitedDirs = new Set(), depth = 0) {
+    if (results.length >= maxResults || depth > 15)
         return;
+    let realDir;
+    try {
+        realDir = await fs.realpath(dir);
+        if (visitedDirs.has(realDir))
+            return;
+        visitedDirs.add(realDir);
+    }
+    catch {
+        return;
+    }
     let entries;
     try {
         entries = await fs.readdir(dir, { withFileTypes: true });
@@ -28,19 +39,27 @@ async function searchFiles(dir, query, results, maxResults = 50) {
         const relPath = path.relative(process.cwd(), fullPath) || fullPath;
         if (entry.isDirectory()) {
             if (!IGNORED_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
-                await searchFiles(fullPath, query, results, maxResults);
+                await searchFiles(fullPath, query, results, maxResults, visitedDirs, depth + 1);
             }
         }
         else if (entry.isFile()) {
             // Skip large binary extensions
             const ext = path.extname(entry.name).toLowerCase();
-            if (['.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.tar', '.gz', '.exe', '.dll', '.so', '.wasm'].includes(ext)) {
+            if (['.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.tar', '.gz', '.exe', '.dll', '.so', '.wasm', '.bin', '.db', '.sqlite'].includes(ext)) {
                 continue;
             }
             try {
+                const stat = await fs.stat(fullPath);
+                if (stat.size > MAX_FILE_SIZE) {
+                    continue;
+                }
                 const content = await fs.readFile(fullPath, 'utf8');
+                // Skip binary files (e.g. compiled executables without extension) containing null bytes
+                if (content.includes('\0')) {
+                    continue;
+                }
                 if (content.toLowerCase().includes(query.toLowerCase())) {
-                    const lines = content.split('\n');
+                    const lines = content.split(/\r?\n/);
                     for (let i = 0; i < lines.length; i++) {
                         if (results.length >= maxResults)
                             break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termux-dev",
-  "version": "1.4.19",
+  "version": "1.6.0",
   "description": "Ultra-fast, terminal-native AI coding assistant and agent built for Android Termux, Windows, macOS, and Linux.",
   "main": "dist/cli/index.js",
   "type": "module",
@@ -15,12 +15,16 @@
   "files": [
     "bin",
     "dist",
-    "assets"
+    "assets/banner.svg",
+    "assets/preview.svg",
+    "assets/preview.png"
   ],
   "scripts": {
     "build": "tsc && node ./scripts/copy-assets.js",
     "start": "node ./bin/devx.js",
     "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "prepublishOnly": "npm run build"
   },
   "engines": {
@@ -61,6 +65,7 @@
     "@types/marked-terminal": "^6.1.1",
     "@types/node": "^20.0.0",
     "@types/qrcode-terminal": "^0.12.2",
-    "typescript": "^5.4.0"
+    "typescript": "^5.4.0",
+    "vitest": "^4.1.11"
   }
 }