thincoder 0.12.20 → 0.12.22

package/README.md

@@ -152,6 +152,12 @@ Environment variables: `THINCODER_API_KEY` (or `DEEPSEEK_API_KEY` / `OPENAI_API_
       },
     ],
   },
+  "websearch": {
+    // optional: Tavily structured search (stable JSON API, no HTML scraping).
+    // Empty apiKey → silently falls back to Bing HTML extraction (zero-config).
+    "provider": "tavily",
+    "apiKey": "tvly-...", // https://tavily.com — has a free monthly tier
+  },
 }
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.20",
+  "version": "0.12.22",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/config.mjs

@@ -66,6 +66,10 @@ const DEFAULTS = {
   mcp: {
     servers: [],
   },
+  websearch: {
+    provider: "tavily",  // structured search API; empty apiKey → fall back to Bing HTML scraping
+    apiKey: "",          // Tavily key (tvly-...) — optional
+  },
 }
 
 /**

package/src/provider/sse.mjs

@@ -2,6 +2,24 @@
  * provider/sse.mjs — SSE stream reader
  * Extracted from core.mjs. Parses Server-Sent Events for LLM chat responses.
  */
+
+/**
+ * Normalize provider cache fields into DeepSeek-style prompt_cache_hit/miss_tokens.
+ * DeepSeek already returns these; OpenAI/Kimi report the cache hit as
+ * prompt_tokens_details.cached_tokens; a few providers put cached_tokens at the
+ * usage top level. Miss is derived as prompt_tokens - hit when not reported.
+ */
+export function normalizeUsageCache(u) {
+  if (!u || u.prompt_cache_hit_tokens !== undefined) return u
+  const cached = u.prompt_tokens_details?.cached_tokens ?? u.cached_tokens
+  if (cached === undefined) return u
+  u.prompt_cache_hit_tokens = cached
+  if (u.prompt_cache_miss_tokens === undefined && typeof u.prompt_tokens === "number") {
+    u.prompt_cache_miss_tokens = Math.max(0, u.prompt_tokens - cached)
+  }
+  return u
+}
+
 export async function readSSE(response, { onToken, onReasoning, rules, signal, firedPatterns: sharedFired }) {
   // Early intercept: non-SSE responses — either error bodies (HTTP >= 400) or
   // valid single-chunk JSON completions (some APIs return JSON despite stream:true).
@@ -28,7 +46,7 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
       const parsed = JSON.parse(body)
       const choice = parsed.choices?.[0]
       if (choice) {
-        const result = { content: "", reasoning: "", toolCalls: [], usage: parsed.usage ?? null, finishReason: null }
+        const result = { content: "", reasoning: "", toolCalls: [], usage: normalizeUsageCache(parsed.usage ?? null), finishReason: null }
         const delta = choice.delta ?? {}
         result.content = delta.content ?? ""
         result.reasoning = delta.reasoning_content ?? ""
@@ -63,7 +81,7 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
       let json
       try { json = JSON.parse(data) } catch { continue }
 
-      if (json.usage) result.usage = json.usage
+      if (json.usage) result.usage = normalizeUsageCache(json.usage)
       const choice = json.choices?.[0]
       if (!choice) continue
       hasChoices = true

package/src/tools/web.mjs

@@ -40,6 +40,30 @@ function bingUrl(query, page) {
 const ENGINES = [{ name: "bing", label: "Bing", url: bingUrl, extract: extractBing, ua: UA }]
 const ENGINE_NAMES = ENGINES.map(e => e.name)
 
+/** Structured search via Tavily (optional — config.websearch.apiKey). Returns
+ *  { engine, results } or null to fall back to Bing HTML scraping. */
+async function fetchTavily(query, limit, ctx) {
+  const apiKey = ctx?.agent?.config?.websearch?.apiKey
+  if (!apiKey) return null
+  const ctrl = new AbortController()
+  const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT)
+  try {
+    const response = await proxyFetch("https://api.tavily.com/search", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}` },
+      body: JSON.stringify({ query, search_depth: "basic", max_results: limit, include_answer: false, include_raw_content: false }),
+      signal: ctrl.signal,
+    }, resolveWebProxy(ctx))
+    if (!response.ok) return null
+    const data = await response.json()
+    const results = (Array.isArray(data.results) ? data.results : []).map((r) => ({
+      href: r.url, title: r.title ?? "", snippet: r.content ?? "", _engine: "tavily",
+    }))
+    return { engine: "tavily", results }
+  } catch { return null }
+  finally { clearTimeout(timer) }
+}
+
 async function fetchEngine(engine, query, page, ctx) {
   const ctrl = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT)
@@ -73,6 +97,12 @@ export const websearchTool = {
   async execute(args, ctx) {
     const limit = Math.min(args.limit ?? 8, 20)
     const page = Math.max(1, args.page ?? 1)
+    // Structured search first when a Tavily key is configured — stable, dated,
+    // no HTML scraping. Falls back to Bing silently.
+    const tavily = await fetchTavily(args.query, limit, ctx)
+    if (tavily && tavily.results.length > 0) {
+      return truncate(tavily.results.slice(0, limit).map((r, i) => `${i + 1}. [tavily] ${r.title}\n   ${r.href}\n   ${r.snippet}`).join("\n\n"))
+    }
     if (args.engine) {
       const engine = ENGINES.find(e => e.name === args.engine)
       if (!engine) return `Unknown engine '${args.engine}'. Available: ${ENGINE_NAMES.join(", ")}`
@@ -115,6 +145,17 @@ function headerOf(res, name) {
   return h[name.toLowerCase()] ?? null
 }
 
+/** Validate a redirect target: resolve relative → absolute, http/https only, and
+ *  SSRF-checked. Returns { target } on success or { error } (never follows into a
+ *  private host — the redirect SSRF bypass). */
+export function resolveRedirectTarget(loc, baseUrl) {
+  let target
+  try { target = new URL(loc, baseUrl).toString() } catch { return { error: "invalid redirect location" } }
+  if (!/^https?:\/\//.test(target)) return { error: "redirect target must be http/https" }
+  if (isPrivateUrl(target)) return { error: "redirect target is internal/private/metadata" }
+  return { target }
+}
+
 export const fetchTool = {
   name: "fetch",
   description: DESC("fetch"),
@@ -130,7 +171,11 @@ export const fetchTool = {
         if ([301, 302, 307, 308].includes(response.status)) {
           const loc = headerOf(response, "location")
           if (loc) {
-            const r2 = await proxyFetch(loc, { headers: { "User-Agent": UA } }, proxyUri)
+            // SSRF-check the redirect target (resolve relative → absolute) before
+            // following — a 3xx must not bounce a public URL into a private host.
+            const r = resolveRedirectTarget(loc, args.url)
+            if (r.error) throw new Error(`fetch failed: ${r.error}`)
+            const r2 = await proxyFetch(r.target, { headers: { "User-Agent": UA } }, proxyUri)
             if (!r2.ok) throw new Error(`fetch failed: HTTP ${r2.status}`)
             const ct2 = headerOf(r2, "content-type") ?? ""
             const b2 = await r2.text()

package/src/tui/startup.mjs

@@ -1,5 +1,4 @@
 import { listSlots } from "../session.mjs"
-import { sliceByWidth } from "./render.mjs"
 import { ansi, C } from "./ansi.mjs"
 
 /** Lazy history window (parity with VS Code HISTORY_PAGE_SIZE): first paint loads
@@ -15,6 +14,16 @@ export const HISTORY_PAGE_MESSAGES = 50
  */
 export function historyToLines(history, startIdx, endIdx) {
   const lines = []
+  // Cross-page turn state: if the message BEFORE this page is a tool/assistant,
+  // the page starts mid-turn and must NOT emit a fresh "❯ ThinCoder:" label
+  // (a turn gets ONE label in the live run; history stores one assistant
+  // message per LLM call, so a multi-call turn would otherwise paint a label
+  // on every segment — the reported "why so many ❯ ThinCoder:" bug).
+  let inTurn = false
+  if (startIdx > 0) {
+    const prev = history[startIdx - 1]
+    inTurn = prev?.role === "assistant" || prev?.role === "tool"
+  }
   for (let i = startIdx; i < endIdx; i++) {
     const m = history[i]
     if (m.role === "user") {
@@ -22,15 +31,30 @@ export function historyToLines(history, startIdx, endIdx) {
       if (lines.length > 0) lines.push({ text: "", color: C.dim })
       lines.push({ text: "❯ You:", color: ansi.bold + C.user })
       if (typeof m.content === "string" && m.content) lines.push({ text: m.content, color: C.text })
+      inTurn = false
     } else if (m.role === "assistant") {
-      if (lines.length > 0) lines.push({ text: "", color: C.dim })
-      lines.push({ text: "❯ ThinCoder:", color: ansi.bold + C.assistant })
+      if (!inTurn) {
+        // Turn start — the only place the assistant label is emitted.
+        if (lines.length > 0) lines.push({ text: "", color: C.dim })
+        lines.push({ text: "❯ ThinCoder:", color: ansi.bold + C.assistant })
+      }
+      inTurn = true
+      // Reasoning restored as dim lines (folded by the consecutive-dim rule when
+      // long) — matches the live thinking stream instead of vanishing on restore.
+      const reasoning = m.reasoning_content ?? m.reasoning
+      if (typeof reasoning === "string" && reasoning.trim()) {
+        for (const line of reasoning.split("\n")) lines.push({ text: "  " + line, color: C.dim })
+      }
       if (typeof m.content === "string" && m.content) lines.push({ text: m.content, color: C.text })
       for (const tc of m.tool_calls ?? []) {
         const toolResult = history[i + 1]
         const hasResult = toolResult?.role === "tool" && toolResult?.tool_call_id === tc.id
-        const summary = hasResult ? " → " + sliceByWidth(String(toolResult.content).split("\n")[0], 80) : ""
-        lines.push({ text: `  [tool] ${tc.function?.name ?? "?"}${summary}`, color: C.tool })
+        lines.push({ text: `  [tool] ${tc.function?.name ?? "?"}`, color: C.tool })
+        if (hasResult && String(toolResult.content).trim()) {
+          // FULL tool result as dim lines (auto-folded when > 8) — the old
+          // first-line-only summary made restore feel nothing like the live run.
+          for (const line of String(toolResult.content).split("\n")) lines.push({ text: "  " + line, color: C.dim })
+        }
       }
     }
   }