thincoder 0.12.21 → 0.12.22

package/README.md

@@ -152,6 +152,12 @@ Environment variables: `THINCODER_API_KEY` (or `DEEPSEEK_API_KEY` / `OPENAI_API_
       },
     ],
   },
+  "websearch": {
+    // optional: Tavily structured search (stable JSON API, no HTML scraping).
+    // Empty apiKey → silently falls back to Bing HTML extraction (zero-config).
+    "provider": "tavily",
+    "apiKey": "tvly-...", // https://tavily.com — has a free monthly tier
+  },
 }
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.21",
+  "version": "0.12.22",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/config.mjs

@@ -66,6 +66,10 @@ const DEFAULTS = {
   mcp: {
     servers: [],
   },
+  websearch: {
+    provider: "tavily",  // structured search API; empty apiKey → fall back to Bing HTML scraping
+    apiKey: "",          // Tavily key (tvly-...) — optional
+  },
 }
 
 /**

package/src/provider/sse.mjs

@@ -2,6 +2,24 @@
  * provider/sse.mjs — SSE stream reader
  * Extracted from core.mjs. Parses Server-Sent Events for LLM chat responses.
  */
+
+/**
+ * Normalize provider cache fields into DeepSeek-style prompt_cache_hit/miss_tokens.
+ * DeepSeek already returns these; OpenAI/Kimi report the cache hit as
+ * prompt_tokens_details.cached_tokens; a few providers put cached_tokens at the
+ * usage top level. Miss is derived as prompt_tokens - hit when not reported.
+ */
+export function normalizeUsageCache(u) {
+  if (!u || u.prompt_cache_hit_tokens !== undefined) return u
+  const cached = u.prompt_tokens_details?.cached_tokens ?? u.cached_tokens
+  if (cached === undefined) return u
+  u.prompt_cache_hit_tokens = cached
+  if (u.prompt_cache_miss_tokens === undefined && typeof u.prompt_tokens === "number") {
+    u.prompt_cache_miss_tokens = Math.max(0, u.prompt_tokens - cached)
+  }
+  return u
+}
+
 export async function readSSE(response, { onToken, onReasoning, rules, signal, firedPatterns: sharedFired }) {
   // Early intercept: non-SSE responses — either error bodies (HTTP >= 400) or
   // valid single-chunk JSON completions (some APIs return JSON despite stream:true).
@@ -28,7 +46,7 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
       const parsed = JSON.parse(body)
       const choice = parsed.choices?.[0]
       if (choice) {
-        const result = { content: "", reasoning: "", toolCalls: [], usage: parsed.usage ?? null, finishReason: null }
+        const result = { content: "", reasoning: "", toolCalls: [], usage: normalizeUsageCache(parsed.usage ?? null), finishReason: null }
         const delta = choice.delta ?? {}
         result.content = delta.content ?? ""
         result.reasoning = delta.reasoning_content ?? ""
@@ -63,7 +81,7 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
       let json
       try { json = JSON.parse(data) } catch { continue }
 
-      if (json.usage) result.usage = json.usage
+      if (json.usage) result.usage = normalizeUsageCache(json.usage)
       const choice = json.choices?.[0]
       if (!choice) continue
       hasChoices = true

package/src/tools/web.mjs

@@ -40,6 +40,30 @@ function bingUrl(query, page) {
 const ENGINES = [{ name: "bing", label: "Bing", url: bingUrl, extract: extractBing, ua: UA }]
 const ENGINE_NAMES = ENGINES.map(e => e.name)
 
+/** Structured search via Tavily (optional — config.websearch.apiKey). Returns
+ *  { engine, results } or null to fall back to Bing HTML scraping. */
+async function fetchTavily(query, limit, ctx) {
+  const apiKey = ctx?.agent?.config?.websearch?.apiKey
+  if (!apiKey) return null
+  const ctrl = new AbortController()
+  const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT)
+  try {
+    const response = await proxyFetch("https://api.tavily.com/search", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}` },
+      body: JSON.stringify({ query, search_depth: "basic", max_results: limit, include_answer: false, include_raw_content: false }),
+      signal: ctrl.signal,
+    }, resolveWebProxy(ctx))
+    if (!response.ok) return null
+    const data = await response.json()
+    const results = (Array.isArray(data.results) ? data.results : []).map((r) => ({
+      href: r.url, title: r.title ?? "", snippet: r.content ?? "", _engine: "tavily",
+    }))
+    return { engine: "tavily", results }
+  } catch { return null }
+  finally { clearTimeout(timer) }
+}
+
 async function fetchEngine(engine, query, page, ctx) {
   const ctrl = new AbortController()
   const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT)
@@ -73,6 +97,12 @@ export const websearchTool = {
   async execute(args, ctx) {
     const limit = Math.min(args.limit ?? 8, 20)
     const page = Math.max(1, args.page ?? 1)
+    // Structured search first when a Tavily key is configured — stable, dated,
+    // no HTML scraping. Falls back to Bing silently.
+    const tavily = await fetchTavily(args.query, limit, ctx)
+    if (tavily && tavily.results.length > 0) {
+      return truncate(tavily.results.slice(0, limit).map((r, i) => `${i + 1}. [tavily] ${r.title}\n   ${r.href}\n   ${r.snippet}`).join("\n\n"))
+    }
     if (args.engine) {
       const engine = ENGINES.find(e => e.name === args.engine)
       if (!engine) return `Unknown engine '${args.engine}'. Available: ${ENGINE_NAMES.join(", ")}`
@@ -115,6 +145,17 @@ function headerOf(res, name) {
   return h[name.toLowerCase()] ?? null
 }
 
+/** Validate a redirect target: resolve relative → absolute, http/https only, and
+ *  SSRF-checked. Returns { target } on success or { error } (never follows into a
+ *  private host — the redirect SSRF bypass). */
+export function resolveRedirectTarget(loc, baseUrl) {
+  let target
+  try { target = new URL(loc, baseUrl).toString() } catch { return { error: "invalid redirect location" } }
+  if (!/^https?:\/\//.test(target)) return { error: "redirect target must be http/https" }
+  if (isPrivateUrl(target)) return { error: "redirect target is internal/private/metadata" }
+  return { target }
+}
+
 export const fetchTool = {
   name: "fetch",
   description: DESC("fetch"),
@@ -130,7 +171,11 @@ export const fetchTool = {
         if ([301, 302, 307, 308].includes(response.status)) {
           const loc = headerOf(response, "location")
           if (loc) {
-            const r2 = await proxyFetch(loc, { headers: { "User-Agent": UA } }, proxyUri)
+            // SSRF-check the redirect target (resolve relative → absolute) before
+            // following — a 3xx must not bounce a public URL into a private host.
+            const r = resolveRedirectTarget(loc, args.url)
+            if (r.error) throw new Error(`fetch failed: ${r.error}`)
+            const r2 = await proxyFetch(r.target, { headers: { "User-Agent": UA } }, proxyUri)
             if (!r2.ok) throw new Error(`fetch failed: HTTP ${r2.status}`)
             const ct2 = headerOf(r2, "content-type") ?? ""
             const b2 = await r2.text()