termux-dev 1.6.0 → 1.8.1

package/dist/tools/questions.js

@@ -1,5 +1,8 @@
-import { select, input } from '@inquirer/prompts';
-import pc from 'picocolors';
+import { input } from '@inquirer/prompts';
+import { runPicker } from '../cli/picker.js';
+import { palette } from '../cli/ui.js';
+import { wrapWords } from '../cli/width.js';
+import { t } from '../core/i18n.js';
 export const askQuestionsTool = {
     name: 'ask_questions',
     definition: {
@@ -44,75 +47,68 @@ export const askQuestionsTool = {
         }
         const results = [];
         const total = args.questions.length;
+        const cols = process.stdout.columns || 80;
         console.log();
-        // Pause raw mode for interactive prompt
+        // Pause raw mode for the typed answer (the picker handles its own keys)
         const wasRaw = process.stdin.isTTY && process.stdin.isRaw;
-        if (wasRaw) {
-            process.stdin.setRawMode(false);
-        }
         try {
             for (let i = 0; i < total; i++) {
                 const q = args.questions[i];
-                const stepHeader = pc.cyan(`‹ ${i + 1} of ${total} ›`);
-                const messageTitle = `${pc.bold(q.question)}  ${stepHeader}`;
-                const choices = q.options.map((opt, idx) => ({
-                    name: `${pc.cyan(String(idx + 1))}  ${opt}`,
-                    value: opt
-                }));
-                if (q.allowCustom !== false) {
-                    choices.push({
-                        name: `${pc.dim('✏️  Type custom answer...')}`,
-                        value: '__custom__'
-                    });
-                }
-                choices.push({
-                    name: `${pc.dim('⏭️  Skip')}`,
-                    value: '__skip__'
+                // The question stays on screen as plain text, the card under it holds the choices.
+                for (const line of wrapWords(q.question, Math.max(20, cols - 8)))
+                    console.log('  ' + palette.bold(palette.text(line)));
+                const items = q.options.map((opt, idx) => ({ value: opt, label: `${idx + 1}  ${opt}` }));
+                if (q.allowCustom !== false)
+                    items.push({ value: '__custom__', label: t('questions.custom') });
+                items.push({ value: '__skip__', label: t('questions.skip') });
+                let answer = await runPicker({
+                    title: q.id && q.id.length <= 24 ? q.id : t('questions.title'),
+                    subtitle: total > 1 ? `${i + 1} / ${total}` : undefined,
+                    items,
                 });
-                try {
-                    let answer = await select({
-                        message: messageTitle,
-                        choices,
-                        pageSize: Math.min(8, choices.length)
-                    });
-                    if (answer === '__custom__') {
-                        const customAns = await input({
-                            message: pc.cyan('Your custom answer:'),
-                            validate: (v) => v.trim().length > 0 || 'Answer cannot be empty'
-                        });
-                        answer = customAns.trim();
+                if (answer === '__custom__') {
+                    if (wasRaw)
+                        process.stdin.setRawMode(false);
+                    try {
+                        answer = (await input({
+                            message: palette.accent(t('questions.yourAnswer')),
+                            validate: (v) => v.trim().length > 0 || t('questions.empty'),
+                        })).trim();
                     }
-                    else if (answer === '__skip__') {
-                        answer = '(Skipped)';
+                    catch {
+                        answer = undefined;
+                    }
+                    finally {
+                        if (wasRaw)
+                            process.stdin.setRawMode(true);
+                        process.stdin.resume();
                     }
-                    results.push({
-                        question: q.question,
-                        answer
-                    });
                 }
-                catch {
-                    results.push({
-                        question: q.question,
-                        answer: '(Skipped)'
-                    });
+                else if (answer === '__skip__') {
+                    answer = undefined;
                 }
+                const given = answer ?? t('questions.skipped');
+                results.push({ question: q.question, answer: given });
+                // What was asked and what was answered stays in the conversation, quietly.
+                console.log(renderAnswerRow(q.question, given, answer === undefined, cols));
             }
         }
         finally {
-            // Restore raw mode
             if (wasRaw && process.stdin.isTTY) {
                 process.stdin.setRawMode(true);
                 process.stdin.resume();
             }
         }
-        // Print styled Q&A block in console
-        console.log('\n' + pc.cyan('────────────────────────────────────────────'));
-        const formattedBlocks = results.map(r => {
-            console.log(pc.bold(pc.white(`Q: ${r.question}`)));
-            console.log(pc.green(`A: ${r.answer}\n`));
-            return `Q: ${r.question}\n\nA: ${r.answer}`;
-        });
-        console.log(pc.cyan('────────────────────────────────────────────\n'));
-        return formattedBlocks.join('\n\n');
+        console.log();
+        return results.map((r) => `Q: ${r.question}\n\nA: ${r.answer}`).join('\n\n');
     }
 };
+/** `  ✓ question` and the answer under it; a skipped one is muted. */
+export function renderAnswerRow(question, answer, skipped, cols) {
+    const room = Math.max(10, cols - 8);
+    const q = wrapWords(question.replace(/\s+/g, ' ').trim(), room);
+    const a = wrapWords(answer.replace(/\s+/g, ' ').trim(), room - 2);
+    const head = q.map((line, i) => (i === 0 ? `  ${skipped ? palette.faint('-') : palette.ok('✓')} ${palette.muted(line)}` : `    ${palette.muted(line)}`));
+    const body = a.map((line, i) => `    ${i === 0 ? palette.accent('›') : ' '} ${skipped ? palette.faint(line) : palette.text(line)}`);
+    return [...head, ...body].join('\n');
+}

package/dist/tools/server.js

@@ -24,6 +24,12 @@ export const servePreviewTool = {
         if (!args || !args.action) {
             throw new Error('action is required');
         }
+        if (!['start', 'stop', 'status'].includes(args.action)) {
+            throw new Error('action must be one of: start, stop, status');
+        }
+        if (args.port !== undefined && (!Number.isInteger(args.port) || args.port < 1024 || args.port > 65535)) {
+            throw new Error('port must be an integer between 1024 and 65535');
+        }
     },
     execute: async (args) => {
         if (args.action === 'stop') {

package/dist/tools/todo.js

@@ -1,31 +1,33 @@
 import pc from 'picocolors';
+import { displayWidth, padEndWidth, truncateWidth } from '../cli/width.js';
 export let currentTodoList = [];
 export function resetTodoList() {
     currentTodoList = [];
 }
+/**
+ * The plan as a closed box (classic layout; the clean layout draws it with the theme, see
+ * `renderTaskCard`). Every row has the same width, so both borders line up.
+ */
 export function formatTodoListCard(tasks) {
     if (!tasks || tasks.length === 0)
         return '';
-    const cols = Math.min(process.stdout.columns || 80, 80);
-    const boxWidth = Math.max(30, Math.min(cols - 4, 65));
-    const borderChar = '─';
-    const lines = [];
-    lines.push('\n' + pc.bold(pc.cyan('┌─ 📋 Plan & Tasks ' + borderChar.repeat(Math.max(2, boxWidth - 19)) + '┐')));
+    const cols = process.stdout.columns || 80;
+    const width = Math.max(30, Math.min(cols - 4, 65));
+    const inner = width - 4;
+    const title = ' Plan & Tasks ';
+    const top = '┌─' + title + '─'.repeat(Math.max(1, width - 3 - displayWidth(title))) + '┐';
+    const lines = [pc.bold(pc.cyan(top))];
     for (const task of tasks) {
-        let taskLine = '';
-        if (task.status === 'completed') {
-            taskLine = pc.green('[✓] ') + pc.dim(task.text);
-        }
-        else if (task.status === 'in_progress') {
-            taskLine = pc.bold(pc.green('[ ] ' + task.text));
-        }
-        else {
-            taskLine = pc.dim('[ ] ') + pc.white(task.text);
-        }
-        lines.push(pc.cyan('│ ') + taskLine);
+        const marker = task.status === 'completed' ? '[✓]' : task.status === 'in_progress' ? '[•]' : '[ ]';
+        const text = truncateWidth(String(task.text ?? '').replace(/\s+/g, ' ').trim(), inner - 4);
+        const plain = padEndWidth(`${marker} ${text}`, inner);
+        const body = task.status === 'completed' ? pc.green(plain)
+            : task.status === 'in_progress' ? pc.bold(pc.cyan(plain))
+                : plain;
+        lines.push(pc.cyan('│ ') + body + pc.cyan(' │'));
     }
-    lines.push(pc.cyan('└' + borderChar.repeat(boxWidth) + '┘\n'));
-    return lines.join('\n');
+    lines.push(pc.cyan('└' + '─'.repeat(width - 2) + '┘'));
+    return lines.join('\n') + '\n';
 }
 export const todoListTool = {
     name: 'todo_list',

package/dist/tools/web.js

@@ -1,3 +1,5 @@
+import dns from 'dns/promises';
+import net from 'net';
 function stripHtml(html) {
     return html
         .replace(/<script\b[\s\S]*?<\/script>/gi, '')
@@ -5,14 +7,150 @@ function stripHtml(html) {
         .replace(/<svg\b[\s\S]*?<\/svg>/gi, '')
         .replace(/<[^>]+>/g, ' ')
         .replace(/&quot;/g, '"')
-        .replace(/&amp;/g, '&')
         .replace(/&lt;/g, '<')
         .replace(/&gt;/g, '>')
         .replace(/&#39;/g, "'")
         .replace(/&nbsp;/g, ' ')
+        // &amp; last, otherwise "&amp;lt;" would be decoded twice into "<"
+        .replace(/&amp;/g, '&')
         .replace(/\s+/g, ' ')
         .trim();
 }
+// ───────────── SSRF protection for fetch_url ─────────────
+// A prompt-injected page must not be able to make the agent talk to localhost,
+// the LAN or cloud metadata endpoints (169.254.169.254). Set
+// DEVX_ALLOW_PRIVATE_NETWORK=1 to fetch from local servers on purpose.
+function isPrivateIPv4(ip) {
+    const [a, b, c] = ip.split('.').map(Number);
+    return (a === 0 || a === 10 || a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) || // carrier-grade NAT
+        (a === 169 && b === 254) || // link-local + cloud metadata
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0 && c === 0) ||
+        (a === 192 && b === 168) ||
+        (a === 198 && (b === 18 || b === 19)) ||
+        a >= 224 // multicast / reserved / broadcast
+    );
+}
+function parseIPv6(ip) {
+    let s = ip.split('%')[0].toLowerCase();
+    const embedded = s.match(/(\d+\.\d+\.\d+\.\d+)$/);
+    if (embedded) {
+        const o = embedded[1].split('.').map(Number);
+        s = s.slice(0, -embedded[1].length) + ((o[0] << 8) | o[1]).toString(16) + ':' + ((o[2] << 8) | o[3]).toString(16);
+    }
+    const parts = s.split('::');
+    if (parts.length > 2)
+        return null;
+    const head = parts[0] ? parts[0].split(':') : [];
+    const tail = parts.length === 2 && parts[1] ? parts[1].split(':') : [];
+    let groups;
+    if (parts.length === 1) {
+        groups = head;
+    }
+    else {
+        const missing = 8 - head.length - tail.length;
+        if (missing < 0)
+            return null;
+        groups = [...head, ...Array(missing).fill('0'), ...tail];
+    }
+    if (groups.length !== 8)
+        return null;
+    const nums = groups.map(g => parseInt(g, 16));
+    return nums.some(n => Number.isNaN(n)) ? null : nums;
+}
+function isPrivateIPv6(ip) {
+    const g = parseIPv6(ip);
+    if (!g)
+        return true;
+    const v4 = (hi, lo) => isPrivateIPv4(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+    if (g.slice(0, 7).every(n => n === 0) && g[7] <= 1)
+        return true; // :: and ::1
+    if ((g[0] & 0xffc0) === 0xfe80)
+        return true; // fe80::/10 link-local
+    if ((g[0] & 0xfe00) === 0xfc00)
+        return true; // fc00::/7 unique local
+    if ((g[0] & 0xff00) === 0xff00)
+        return true; // multicast
+    if (g.slice(0, 5).every(n => n === 0) && g[5] === 0xffff)
+        return v4(g[6], g[7]); // ::ffff:a.b.c.d
+    if (g[0] === 0x64 && g[1] === 0xff9b)
+        return v4(g[6], g[7]); // NAT64
+    if (g[0] === 0x2002)
+        return v4(g[1], g[2]); // 6to4
+    return false;
+}
+export function isPrivateAddress(ip) {
+    if (net.isIPv4(ip))
+        return isPrivateIPv4(ip);
+    if (net.isIPv6(ip))
+        return isPrivateIPv6(ip);
+    return true; // not an address we understand: refuse
+}
+async function assertPublicHost(rawHostname) {
+    if (process.env.DEVX_ALLOW_PRIVATE_NETWORK === '1')
+        return;
+    const host = rawHostname.replace(/^\[|\]$/g, '').replace(/\.$/, '').toLowerCase();
+    const blocked = () => new Error(`Blocked: ${rawHostname} points to a local or private network address (set DEVX_ALLOW_PRIVATE_NETWORK=1 to allow).`);
+    if (net.isIP(host)) {
+        if (isPrivateAddress(host))
+            throw blocked();
+        return;
+    }
+    if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local') || host.endsWith('.internal')) {
+        throw blocked();
+    }
+    const addresses = await dns.lookup(host, { all: true });
+    if (addresses.length === 0 || addresses.some(a => isPrivateAddress(a.address)))
+        throw blocked();
+}
+const MAX_REDIRECTS = 5;
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+/** fetch() that validates the target and every redirect hop against private networks. */
+export async function fetchPublic(startUrl, headers, timeoutMs) {
+    const signal = AbortSignal.timeout(timeoutMs);
+    let current = new URL(startUrl);
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+        if (current.protocol !== 'http:' && current.protocol !== 'https:') {
+            throw new Error(`Unsupported protocol: ${current.protocol}`);
+        }
+        await assertPublicHost(current.hostname);
+        const res = await fetch(current, { headers, signal, redirect: 'manual' });
+        const location = res.headers.get('location');
+        if (res.status >= 300 && res.status < 400 && location) {
+            try {
+                await res.body?.cancel();
+            }
+            catch { }
+            current = new URL(location, current);
+            continue;
+        }
+        return res;
+    }
+    throw new Error('Too many redirects');
+}
+async function readTextLimited(res, maxBytes) {
+    const reader = res.body?.getReader();
+    if (!reader)
+        return (await res.text()).slice(0, maxBytes);
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        chunks.push(Buffer.from(value));
+        total += value.byteLength;
+        if (total >= maxBytes) {
+            try {
+                await reader.cancel();
+            }
+            catch { }
+            break;
+        }
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
 export const webSearchTool = {
     name: 'web_search',
     definition: {
@@ -128,16 +266,13 @@ export const fetchUrlTool = {
             if (!targetUrl.startsWith('http://') && !targetUrl.startsWith('https://')) {
                 targetUrl = `https://${targetUrl}`;
             }
-            const res = await fetch(targetUrl, {
-                headers: {
-                    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
-                },
-                signal: AbortSignal.timeout(12000)
-            });
+            const res = await fetchPublic(targetUrl, {
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
+            }, 12000);
             if (!res.ok) {
                 throw new Error(`HTTP Error ${res.status}: ${res.statusText}`);
             }
-            const html = await res.text();
+            const html = await readTextLimited(res, MAX_RESPONSE_BYTES);
             const cleanText = stripHtml(html);
             if (!cleanText) {
                 return 'Webpage returned empty text content.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termux-dev",
-  "version": "1.6.0",
+  "version": "1.8.1",
   "description": "Ultra-fast, terminal-native AI coding assistant and agent built for Android Termux, Windows, macOS, and Linux.",
   "main": "dist/cli/index.js",
   "type": "module",