thincoder 0.11.0 → 0.12.0

package/src/tools/shared.mjs

@@ -20,6 +20,22 @@ export const BASH_TIMEOUT_MS = 120_000
 export const MAX_RESPONSE_BODY_BYTES = 5_000_000
 export const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", ".turbo", "coverage"])
 
+/** SSRF guard: check if a hostname is private/internal. Shared by web.mjs and codemode.mjs. */
+export function isPrivateHost(hostname) {
+  const h = hostname.toLowerCase()
+  if (h === "localhost" || h === "0.0.0.0" || h.endsWith(".localhost")) return false
+  if (h === "127.0.0.1" || h.startsWith("127.")) return false
+  if (h === "169.254.169.254" || h === "metadata.google.internal") return true
+  // IPv6 private ranges — only check if host contains ":"
+  if (h.includes(":") && (h === "::1" || h === "fe80::1" || h.startsWith("fc") || h.startsWith("fd"))) return true
+  const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
+  if (m) {
+    const [a, b] = [Number(m[1]), Number(m[2])]
+    if (a === 10 || (a === 172 && b >= 16 && b <= 31) || a === 192 && b === 168 || a === 169 && b === 254 || a === 0) return true
+  }
+  return false
+}
+
 /** Normalize Windows line endings to Unix: \r\n → \n.
  *  Applied on every text-file read so that edit/hash matching
  *  and hash computation are platform-consistent. */
@@ -187,9 +203,34 @@ export function shellSegments(command) {
   return command.split(/&&|\|\||>>|\$\(|[;|\n<>]|`|[(]/)
 }
 
-/** Detect shell output/input redirection (> >> < followed by filename) — not excluded inside quotes, conservative block */
+/**
+ * Blank out quoted regions (single/double/backtick) with spaces, preserving length.
+ * Lets safety checks ignore shell metacharacters inside quoted script bodies —
+ * e.g. `node -e "if (a > b) …"` comparisons are not redirections.
+ */
+function blankQuoted(command) {
+  let out = ""
+  let quote = null
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i]
+    if (quote) {
+      if (ch === "\\" && quote !== "'") { out += " "; i++; out += " "; continue }
+      if (ch === quote) quote = null
+      out += " "
+    } else if (ch === "'" || ch === '"' || ch === "`") {
+      quote = ch
+      out += " "
+    } else {
+      out += ch
+    }
+  }
+  return out
+}
+
+/** Detect shell output/input redirection (> >> < followed by filename) outside quoted regions */
 export function hasFileRedirection(command) {
-  return /(^|[\s;&|])>{1,2}\s*\S/.test(command) || /(^|[\s;&|])<\s*\S/.test(command)
+  const bare = blankQuoted(command)
+  return /(^|[\s;&|])>{1,2}\s*\S/.test(bare) || /(^|[\s;&|])<\s*\S/.test(bare)
 }
 
 /** Whether a single command segment is a destructive non-git command (conservative: prefer false positives) */

package/src/tools/system.mjs

@@ -119,16 +119,15 @@ function runBash(command, cwd, { timeout, signal, onOutput }) {
 
     child.stdout.on("data", (d) => {
       const s = sanitizeOutput(outDecoder(d))
-      if (s) {
-        onOutput?.(s)
-        if (outBuf.length < MAX_STREAM_BUF) outBuf += s
-        else if (!truncatedNote) truncatedNote =
-          "\n[... output exceeded 2MB, remainder discarded — redirect to a file if you need the full output]"
-      }
+      if (s) onOutput?.(s)
+      if (outBuf.length < MAX_STREAM_BUF) outBuf += s
+      else if (!truncatedNote) truncatedNote =
+        "\n[... output exceeded 2MB, remainder discarded — redirect to a file if you need the full output]"
     })
 
     child.stderr.on("data", (d) => {
       const s = sanitizeOutput(errDecoder(d))
+      if (s) onOutput?.(s)
       if (errBuf.length < MAX_STREAM_BUF) errBuf += s
     })
 
@@ -142,11 +141,16 @@ function runBash(command, cwd, { timeout, signal, onOutput }) {
 
     child.on("close", (code, exitSignal) => {
       clearTimeout(timer)
-      // Flush decoder tails (trailing multi-byte sequences that incomplete buffers left pending)
-      outBuf += sanitizeOutput(outDecoder(Buffer.alloc(0), true))
-      errBuf += sanitizeOutput(errDecoder(Buffer.alloc(0), true))
+      // Flush decoder tails — also push final bytes to panel
+      const outFlush = sanitizeOutput(outDecoder(Buffer.alloc(0), true))
+      const errFlush = sanitizeOutput(errDecoder(Buffer.alloc(0), true))
+      outBuf += outFlush
+      errBuf += errFlush
+      if (outFlush) onOutput?.(outFlush)
+      if (errFlush) onOutput?.(errFlush)
 
-      const status = exitSignal
+      // Windows has no POSIX signals — check signal.aborted for user interrupts
+      const status = (exitSignal || signal?.aborted)
         ? `killed: ${signal?.aborted ? "user interrupted" : "timeout"}`
         : `exit code ${code}`
 

package/src/tools/web.mjs

@@ -1,4 +1,4 @@
-import { DESC, truncate, stripTags, htmlToText } from "./shared.mjs";
+import { DESC, truncate, stripTags, htmlToText, isPrivateHost } from "./shared.mjs";
 import { URL } from "node:url";
 import { resolveWebProxy, proxyFetch } from "../proxy.mjs";
 
@@ -9,18 +9,30 @@ const FETCH_TIMEOUT = 15_000
 
 function extractBing(html) {
   const results = []
-  const blocks = html.split('<li class="b_algo"').slice(1)
-  for (const block of blocks) {
-    const link = block.match(/<h2[^>]*><a[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/)
-    if (!link) continue
-    const snippet = block.match(/<p[^>]*>([\s\S]*?)<\/p>/)
-    results.push({ href: link[1], title: stripTags(link[2]), snippet: snippet ? stripTags(snippet[1]) : "" })
+  // RSS format: <item><title>..</title><link>..</link><description>..</description></item>
+  for (const m of html.matchAll(/<item>([\s\S]*?)<\/item>/gi)) {
+    const block = m[1]
+    const title = block.match(/<title>([\s\S]*?)<\/title>/)?.[1] ?? ""
+    const href = block.match(/<link>([\s\S]*?)<\/link>/)?.[1] ?? ""
+    const snippet = block.match(/<description>([\s\S]*?)<\/description>/)?.[1] ?? ""
+    if (!href) continue
+    results.push({ href, title: stripTags(title), snippet: stripTags(snippet) })
+  }
+  // Fallback: HTML b_algo blocks (older server-rendered pages)
+  if (results.length === 0) {
+    const blocks = html.split('<li class="b_algo"').slice(1)
+    for (const block of blocks) {
+      const link = block.match(/<h2[^>]*><a[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/)
+      if (!link) continue
+      const snippet = block.match(/<p[^>]*>([\s\S]*?)<\/p>/)
+      results.push({ href: link[1], title: stripTags(link[2]), snippet: snippet ? stripTags(snippet[1]) : "" })
+    }
   }
   return results
 }
 
 function bingUrl(query, page) {
-  let u = `https://www.bing.com/search?q=${encodeURIComponent(query)}&setlang=en&setmkt=en-US`
+  let u = `https://www.bing.com/search?q=${encodeURIComponent(query)}&format=rss&setlang=en`
   if (page > 1) u += `&first=${(page - 1) * 10 + 1}`
   return u
 }
@@ -91,14 +103,7 @@ export const websearchTool = {
 
 function isPrivateUrl(urlStr) {
   let u; try { u = new URL(urlStr) } catch { return true }
-  const host = u.hostname.toLowerCase()
-  if (host === "localhost" || host === "0.0.0.0" || host.endsWith(".localhost")) return false
-  if (host === "127.0.0.1" || host.startsWith("127.")) return false
-  if (host === "169.254.169.254" || host === "metadata.google.internal") return true
-  const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
-  if (m) { const [a, b] = [Number(m[1]), Number(m[2])]; if (a === 10||a === 172&&b>=16&&b<=31||a === 192&&b===168||a === 169&&b===254||a===0) return true }
-  if (host === "::1" || host === "fe80::1" || host.startsWith("fc") || host.startsWith("fd")) return true
-  return false
+  return isPrivateHost(u.hostname)
 }
 
 // proxyFetch returns a native Response (Headers object, needs .get()) without proxy,

package/src/tui/agent-turn.mjs

@@ -105,7 +105,11 @@ export async function runAgentTurn(ctx, text) {
       flushStream()
       ensureAssistantLabel()
       state.currentTool = name
-      pushLine(`  [tool] ${name} ${summarize(args)}`, C.tool)
+      // Advisor: tag the round in the tool title — the model's own "第N轮" narration
+      // is unreliable (it glues onto the previous line), so the round belongs here.
+      const roundTag = name === "advisor" ? ` (round ${(agent._advisorRound || 0) + 1})` : ""
+      const argSummary = summarize(args)
+      pushLine(`  [tool] ${name}${roundTag}${argSummary ? ` ${argSummary}` : ""}`, C.tool)
     },
     onToolResult: (name, result) => {
       state.currentTool = null
@@ -136,16 +140,27 @@ export async function runAgentTurn(ctx, text) {
       const stream = state.toolStreams[name]
       const panel = state.outputPanels[name]
       if (panel) {
-        // Tool with output panel: mark panel as done, conversation gets only summary
-        panel.done = true
         delete state.toolStreams[name]
-        const summary = formatPanelSummary(name, result)
-        if (summary) pushLine(`  ${summary}`, C.dim)
-        // Clear panel after 3 seconds
-        setTimeout(() => {
-          delete state.outputPanels[name]
-          if (state.processing) render()
-        }, 3000)
+        // Keep the panel visible for a 3s grace period (layout filters by closeAt);
+        // the render loop prunes it once expired. No defer hacks needed — row-diff
+        // repaints whatever should be on screen.
+        panel.done = true
+        panel.closeAt = Date.now() + 3000
+        scheduleRender()
+        if (name === "advisor") {
+          const text = String(result ?? "")
+          const lines = text.split("\n")
+          const maxShow = Math.min(60, lines.length)
+          // Push as single multiline block so formatTables aligns MD table columns
+          const shown = lines.slice(0, maxShow).map((l) => `  ${l.slice(0, 200)}`).join("\n")
+          pushLine(shown, C.advisor)
+          if (lines.length > maxShow) pushLine(`  ... (${lines.length - maxShow} more lines — call advisor again or scroll through the tool result for full output)`, C.dim)
+        } else {
+          const summary = formatPanelSummary(name, result)
+          if (summary) pushLine(`  ${summary}`, C.dim)
+        }
+        // Trigger a repaint after the grace period so the pruned panel disappears
+        setTimeout(() => render(), 3000)
       } else if (stream) {
         const tail = stream.trimEnd().slice(-4000)
         if (tail) pushLine(tail, C.dim)
@@ -158,21 +173,45 @@ export async function runAgentTurn(ctx, text) {
     },
     onToolOutput: (name, chunk) => {
       // Route streaming output to a panel if one exists or was requested via outputPanel flag.
+      // Chunk may be a string or { kind, text } — kind ("think" | "text" | "tool") drives
+      // per-kind coloring in renderOutput so reasoning / answer / tool progress are distinct.
       let panel = state.outputPanels[name]
       if (!panel) {
         // Lazy-create panel: defensive against race conditions where setupOutputPanel
         // hasn't fired yet or the callbacks chain dropped it (subagent relay, reconnect, etc.)
-        state.outputPanels[name] = { text: "", done: false }
+        state.outputPanels[name] = { parts: [], len: 0, done: false }
         panel = state.outputPanels[name]
       }
-      panel.text = (panel.text ?? "") + chunk
-      if (panel.text.length > 4000) panel.text = panel.text.slice(-4000)
+      const part = typeof chunk === "string"
+        ? { kind: "text", text: chunk }
+        : { kind: chunk?.kind ?? "text", text: String(chunk?.text ?? "") }
+      if (!part.text) return
+      // Separate phase transitions with a newline — think → answer → tool progress
+      // would otherwise glue onto each other mid-line.
+      const last = panel.parts[panel.parts.length - 1]
+      if (last && last.kind !== part.kind && !last.text.endsWith("\n") && !part.text.startsWith("\n")) {
+        part.text = "\n" + part.text
+      }
+      panel.parts.push(part)
+      panel.len += part.text.length
+      // Cap at 4000 chars, trimming oldest parts first
+      while (panel.len > 4000 && panel.parts.length > 1) {
+        const first = panel.parts[0]
+        const excess = panel.len - 4000
+        if (first.text.length <= excess) {
+          panel.len -= first.text.length
+          panel.parts.shift()
+        } else {
+          first.text = first.text.slice(excess)
+          panel.len -= excess
+        }
+      }
       scheduleRender()
     },
     onPermissionRequest: (name, args) => askPermission(name, args),
     onQuestion: (text, options) => askQuestion(text, options),
     setupOutputPanel: (name) => {
-      state.outputPanels[name] = { text: "", done: false }
+      state.outputPanels[name] = { parts: [], len: 0, done: false }
       scheduleRender()
     },
     onCompress: () => {
@@ -200,9 +239,6 @@ export async function runAgentTurn(ctx, text) {
       pushLine(`  [task] ${done}/${items.length}${current ? ` ▶ ${current.title}` : ""}`, C.dim)
       render()
     },
-    onAdvisor: (note) => {
-      pushLine(`  [advisor] ${note.replace(/\n/g, "\n  ")}`, C.advisor)
-    },
     // Incremental save: flush to disk every 5 tool turns — mid-crash loss window shrinks from an entire round to a few turns
     onTurnEnd: (() => {
       let n = 0
@@ -213,70 +249,75 @@ export async function runAgentTurn(ctx, text) {
     })(),
   }
 
-  for (let resume = false; ; resume = true) {
-    try {
-      await runAgentImpl(agent, text, callbacks, { signal: state.controller.signal, resume })
-      flushStream()
-      break // Normal completion, exit loop
-    } catch (error) {
-      flushStream()
-      if (error.name === "AbortError" || state.controller?.signal.aborted) {
-        // Ctrl+I inject: the signal was aborted with an interrupt message — the agent loop
-        // may have already injected it into history, but the aborted signal prevents retry.
-        // Recreate the controller and resume from the same context.
-        if (state.controller?.signal?.reason?.interrupt) {
+  // try/finally: every exit path — including an unexpected throw inside the catch
+  // block (e.g. the continue-permission UI) — must stop the ticker and reset state,
+  // otherwise the 1s render interval leaks and keeps firing forever.
+  try {
+    for (let resume = false; ; resume = true) {
+      try {
+        await runAgentImpl(agent, text, callbacks, { signal: state.controller.signal, resume })
+        flushStream()
+        break // Normal completion, exit loop
+      } catch (error) {
+        flushStream()
+        if (error.name === "AbortError" || state.controller?.signal.aborted) {
+          // Ctrl+I inject: the signal was aborted with an interrupt message — the agent loop
+          // may have already injected it into history, but the aborted signal prevents retry.
+          // Recreate the controller and resume from the same context.
+          if (state.controller?.signal?.reason?.interrupt) {
+            state.controller = new AbortController()
+            resume = true
+            continue
+          }
+          pushLine("[stopped]", C.warn)
+          break
+        }
+        if (error instanceof ContinueError) {
+          pushLabel(`❯ Continue`, ansi.bold + C.warn)
+          pushLine(`Ran ${error.turn} turns (limit ${error.turn}). Continue?`, C.warn)
+          // Pause to ask: reuse permission mechanism
+          const willContinue = await new Promise((resolve) => {
+            state.permission = {
+              name: "continue",
+              args: { turns: error.turn },
+              resolve,
+            }
+            state.status = `Continue after ${error.turn} turns?`
+            render()
+          })
+          state.permission = null
+          if (!willContinue) {
+            pushLine("[continue cancelled]", C.warn)
+            break
+          }
+          pushLine("[continuing…]", C.tool)
+          // Recreate AbortController: once aborted, resume immediately fails (defensive; current path unreachable but tightly coupled)
           state.controller = new AbortController()
-          resume = true
           continue
         }
-        pushLine("[stopped]", C.warn)
+        pushLine(`[error] ${error.message}`, C.error)
         break
       }
-      if (error instanceof ContinueError) {
-        pushLabel(`❯ Continue`, ansi.bold + C.warn)
-        pushLine(`Ran ${error.turn} turns (limit ${error.turn}). Continue?`, C.warn)
-        // Pause to ask: reuse permission mechanism
-        const willContinue = await new Promise((resolve) => {
-          state.permission = {
-            name: "continue",
-            args: { turns: error.turn },
-            resolve,
-          }
-          state.status = `Continue after ${error.turn} turns?`
-          render()
-        })
-        state.permission = null
-        if (!willContinue) {
-          pushLine("[continue cancelled]", C.warn)
-          break
-        }
-        pushLine("[continuing…]", C.tool)
-        // Recreate AbortController: once aborted, resume immediately fails (defensive; current path unreachable but tightly coupled)
-        state.controller = new AbortController()
-        continue
-      }
-      pushLine(`[error] ${error.message}`, C.error)
-      break
     }
+  } finally {
+    clearInterval(ticker)
+    state.processing = false
+    state.subTasks = {}
+    state.controller = null
+    state.status = "Ready"
+    // Auto-collapse todo panel when all tasks done (matching kimi-code TUI; agent.tasks are preserved)
+    if (state.tasks.length > 0 && state.tasks.every((t) => t.status === "done")) {
+      state.tasks = []
+    }
+    // Save session after every turn (survives crashes)
+    try {
+      saveSessionImpl(agent, state.lines)
+    } catch {
+      // Save failure doesn't interrupt usage
+    }
+    render()
   }
 
-  clearInterval(ticker)
-  state.processing = false
-  state.subTasks = {}
-  state.controller = null
-  state.status = "Ready"
-  // Auto-collapse todo panel when all tasks done (matching kimi-code TUI; agent.tasks are preserved)
-  if (state.tasks.length > 0 && state.tasks.every((t) => t.status === "done")) {
-    state.tasks = []
-  }
-  // Save session after every turn (survives crashes)
-  try {
-    saveSessionImpl(agent, state.lines)
-  } catch {
-    // Save failure doesn't interrupt usage
-  }
-  render()
-
   // Queued messages: auto-process next one
   while (state.queue.length > 0 && !state.processing) {
     const next = state.queue.shift()
@@ -295,11 +336,27 @@ export async function runAgentTurn(ctx, text) {
 /** Extract a one-line summary from a panel tool's output */
 function formatPanelSummary(name, result) {
   if (name === "verify") return _verifySummary(result)
+  if (name === "bash") return _bashSummary(result)
   // Default: first non-empty line
   const first = result.split("\n").find((l) => l.trim())
   return first ? `${name}: ${first.slice(0, 100)}` : null
 }
 
+/**
+ * bash result format: "[stdout]:\n<out>\n\n[stderr]:\n<err>\n\n(exit code 0)".
+ * The first non-empty line is always the "[stdout]:" marker — useless as a summary.
+ * Show the LAST output line (usually the meaningful tail) plus the exit status.
+ */
+function _bashSummary(result) {
+  const isMarker = (l) => /^\[(stdout|stderr)\]:$/.test(l) || /^\((exit code|killed)/.test(l)
+  const lines = result.split("\n").map((l) => l.trim()).filter((l) => l && !isMarker(l))
+  const status = result.match(/\((?:exit code|killed)[^)]*\)/)?.[0]
+  const parts = []
+  if (lines.length > 0) parts.push(lines[lines.length - 1].slice(0, 100))
+  if (status) parts.push(status)
+  return parts.length > 0 ? `bash: ${parts.join(" ")}` : null
+}
+
 function _verifySummary(result) {
   const lines = result.split("\n")
   const summary = []