vexi-cli 0.8.0 → 0.9.0

package/dist/providers/openai-compat.js

@@ -7,48 +7,218 @@
  * Vexi dependency-free (plain `fetch`, no SDKs).
  */
 import { ProviderError } from './types.js';
+/** Report OpenAI-style `usage` ({prompt_tokens, completion_tokens}) if present. */
+function reportUsage(json, onUsage) {
+    if (!onUsage)
+        return;
+    const u = json.usage;
+    if (u && (u.prompt_tokens || u.completion_tokens)) {
+        onUsage({ inputTokens: u.prompt_tokens ?? 0, outputTokens: u.completion_tokens ?? 0 });
+    }
+}
+/** Translate Vexi's neutral ChatMessage[] into OpenAI chat-completions format. */
+function toOpenAIMessages(messages) {
+    return messages.map((m) => {
+        if (m.role === 'assistant' && m.toolCalls?.length) {
+            return {
+                role: 'assistant',
+                content: m.content || null,
+                tool_calls: m.toolCalls.map((tc) => ({
+                    id: tc.id,
+                    type: 'function',
+                    function: { name: tc.name, arguments: JSON.stringify(tc.arguments) },
+                })),
+            };
+        }
+        if (m.role === 'tool') {
+            return { role: 'tool', tool_call_id: m.toolCallId ?? '', content: m.content };
+        }
+        return { role: m.role, content: m.content };
+    });
+}
 export function createOpenAICompatProvider(opts) {
     return {
         id: opts.id,
         model: opts.model,
-        async stream(messages, onText) {
-            const res = await fetch(`${opts.baseUrl}/chat/completions`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Authorization: `Bearer ${opts.apiKey}`,
-                    ...opts.extraHeaders,
-                },
-                body: JSON.stringify({
-                    model: opts.model,
-                    messages,
-                    stream: true,
-                    ...opts.extraBody,
-                }),
-            }).catch((err) => {
-                throw new ProviderError(`Network error: ${err.message}`);
-            });
-            if (!res.ok || !res.body) {
-                const body = await res.text().catch(() => '');
-                throw new ProviderError(`${opts.id} API error (HTTP ${res.status}): ${truncate(body, 300)}`, res.status);
+        supportsTools: opts.supportsTools ?? false,
+        async streamTools(messages, tools, onText, onUsage) {
+            const guard = createStreamTimeoutGuard(opts.id);
+            try {
+                const res = await fetch(`${opts.baseUrl}/chat/completions`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        Authorization: `Bearer ${opts.apiKey}`,
+                        ...opts.extraHeaders,
+                    },
+                    body: JSON.stringify({
+                        model: opts.model,
+                        messages: toOpenAIMessages(messages),
+                        tools: tools.map((t) => ({
+                            type: 'function',
+                            function: { name: t.name, description: t.description, parameters: t.inputSchema },
+                        })),
+                        stream: true,
+                        stream_options: { include_usage: true },
+                        ...opts.extraBody,
+                    }),
+                    signal: guard.signal,
+                }).catch((err) => {
+                    throw guard.wrapNetworkError(err);
+                });
+                if (!res.ok || !res.body) {
+                    const body = await res.text().catch(() => '');
+                    throw new ProviderError(`${opts.id} API error (HTTP ${res.status}): ${truncate(body, 300)}`, res.status);
+                }
+                let full = '';
+                // Streamed tool calls arrive as fragments keyed by their array index;
+                // accumulate id/name/arguments across deltas, then parse at the end.
+                const acc = new Map();
+                try {
+                    for await (const data of sseEvents(res.body)) {
+                        guard.resetIdleTimer();
+                        if (data === '[DONE]')
+                            break;
+                        try {
+                            const json = JSON.parse(data);
+                            const delta = json.choices?.[0]?.delta;
+                            if (delta?.content) {
+                                full += delta.content;
+                                onText(delta.content);
+                            }
+                            if (Array.isArray(delta?.tool_calls)) {
+                                for (const tc of delta.tool_calls) {
+                                    const idx = tc.index ?? 0;
+                                    const cur = acc.get(idx) ?? { id: '', name: '', args: '' };
+                                    if (tc.id)
+                                        cur.id = tc.id;
+                                    if (tc.function?.name)
+                                        cur.name = tc.function.name;
+                                    if (tc.function?.arguments)
+                                        cur.args += tc.function.arguments;
+                                    acc.set(idx, cur);
+                                }
+                            }
+                            reportUsage(json, onUsage);
+                        }
+                        catch {
+                            // Ignore malformed/keep-alive chunks
+                        }
+                    }
+                }
+                catch (e) {
+                    throw guard.wrapStreamError(e);
+                }
+                const toolCalls = [...acc.entries()]
+                    .sort((a, b) => a[0] - b[0])
+                    .map(([idx, c]) => {
+                    let args = {};
+                    try {
+                        args = c.args ? JSON.parse(c.args) : {};
+                    }
+                    catch {
+                        args = {};
+                    }
+                    return { id: c.id || `call_${idx}`, name: c.name, arguments: args };
+                })
+                    .filter((c) => c.name);
+                return { text: full, toolCalls };
+            }
+            finally {
+                guard.dispose();
             }
-            let full = '';
-            for await (const data of sseEvents(res.body)) {
-                if (data === '[DONE]')
-                    break;
+        },
+        async stream(messages, onText, onUsage) {
+            const guard = createStreamTimeoutGuard(opts.id);
+            try {
+                const res = await fetch(`${opts.baseUrl}/chat/completions`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        Authorization: `Bearer ${opts.apiKey}`,
+                        ...opts.extraHeaders,
+                    },
+                    body: JSON.stringify({
+                        model: opts.model,
+                        messages: toOpenAIMessages(messages),
+                        stream: true,
+                        stream_options: { include_usage: true },
+                        ...opts.extraBody,
+                    }),
+                    signal: guard.signal,
+                }).catch((err) => {
+                    throw guard.wrapNetworkError(err);
+                });
+                if (!res.ok || !res.body) {
+                    const body = await res.text().catch(() => '');
+                    throw new ProviderError(`${opts.id} API error (HTTP ${res.status}): ${truncate(body, 300)}`, res.status);
+                }
+                let full = '';
                 try {
-                    const json = JSON.parse(data);
-                    const text = json.choices?.[0]?.delta?.content;
-                    if (text) {
-                        full += text;
-                        onText(text);
+                    for await (const data of sseEvents(res.body)) {
+                        guard.resetIdleTimer();
+                        if (data === '[DONE]')
+                            break;
+                        try {
+                            const json = JSON.parse(data);
+                            const text = json.choices?.[0]?.delta?.content;
+                            if (text) {
+                                full += text;
+                                onText(text);
+                            }
+                            reportUsage(json, onUsage);
+                        }
+                        catch {
+                            // Ignore malformed/keep-alive chunks
+                        }
                     }
                 }
-                catch {
-                    // Ignore malformed/keep-alive chunks
+                catch (e) {
+                    throw guard.wrapStreamError(e);
                 }
+                return full;
             }
-            return full;
+            finally {
+                guard.dispose();
+            }
+        },
+    };
+}
+/** Abort the connection if the server goes silent for this long between chunks. */
+const IDLE_TIMEOUT_MS = 60_000;
+/** Hard ceiling on total stream duration, regardless of activity. */
+const MAX_STREAM_MS = 10 * 60 * 1000;
+/**
+ * Shared guard against hung provider connections: aborts the fetch if no
+ * bytes arrive for IDLE_TIMEOUT_MS, or if the whole stream runs past
+ * MAX_STREAM_MS, so a stalled provider can never freeze the chat loop.
+ */
+export function createStreamTimeoutGuard(providerId) {
+    const controller = new AbortController();
+    let idleTimer;
+    const hardTimer = setTimeout(() => controller.abort(), MAX_STREAM_MS);
+    const resetIdleTimer = () => {
+        clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => controller.abort(), IDLE_TIMEOUT_MS);
+    };
+    resetIdleTimer();
+    return {
+        signal: controller.signal,
+        resetIdleTimer,
+        wrapNetworkError(err) {
+            if (controller.signal.aborted)
+                return new ProviderError(`${providerId} request timed out (no response).`);
+            return new ProviderError(`Network error: ${err.message}`);
+        },
+        wrapStreamError(e) {
+            if (controller.signal.aborted) {
+                return new ProviderError(`${providerId} stream stalled or exceeded the time limit and was aborted.`);
+            }
+            return e;
+        },
+        dispose() {
+            clearTimeout(idleTimer);
+            clearTimeout(hardTimer);
         },
     };
 }

package/dist/providers/openai-compat.test.js

@@ -0,0 +1,66 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { createOpenAICompatProvider } from './openai-compat.js';
+/** Build a fake fetch Response whose body streams the given SSE lines. */
+function sseResponse(lines) {
+    const body = new ReadableStream({
+        start(controller) {
+            const enc = new TextEncoder();
+            for (const l of lines)
+                controller.enqueue(enc.encode(`data: ${l}\n`));
+            controller.close();
+        },
+    });
+    return { ok: true, status: 200, body };
+}
+afterEach(() => vi.restoreAllMocks());
+describe('openai-compat streamTools', () => {
+    it('reassembles a tool call split across streamed deltas', async () => {
+        const chunks = [
+            JSON.stringify({ choices: [{ delta: { content: 'let me edit' } }] }),
+            JSON.stringify({ choices: [{ delta: { tool_calls: [{ index: 0, id: 'call_1', function: { name: 'edit_file' } }] } }] }),
+            JSON.stringify({ choices: [{ delta: { tool_calls: [{ index: 0, function: { arguments: '{"path":"a.ts",' } }] } }] }),
+            JSON.stringify({ choices: [{ delta: { tool_calls: [{ index: 0, function: { arguments: '"old":"x","new":"y"}' } }] } }] }),
+            '[DONE]',
+        ];
+        vi.stubGlobal('fetch', vi.fn(async () => sseResponse(chunks)));
+        const provider = createOpenAICompatProvider({
+            id: 'openai', baseUrl: 'https://x/v1', apiKey: 'k', model: 'gpt', supportsTools: true,
+        });
+        let streamed = '';
+        const { text, toolCalls } = await provider.streamTools([{ role: 'user', content: 'go' }], [{ name: 'edit_file', description: 'd', inputSchema: { type: 'object' } }], (c) => { streamed += c; });
+        expect(streamed).toBe('let me edit');
+        expect(text).toBe('let me edit');
+        expect(toolCalls).toEqual([
+            { id: 'call_1', name: 'edit_file', arguments: { path: 'a.ts', old: 'x', new: 'y' } },
+        ]);
+    });
+    it('returns no tool calls for a plain text answer', async () => {
+        vi.stubGlobal('fetch', vi.fn(async () => sseResponse([
+            JSON.stringify({ choices: [{ delta: { content: 'hi' } }] }),
+            '[DONE]',
+        ])));
+        const provider = createOpenAICompatProvider({
+            id: 'openai', baseUrl: 'https://x/v1', apiKey: 'k', model: 'gpt', supportsTools: true,
+        });
+        const { text, toolCalls } = await provider.streamTools([{ role: 'user', content: 'hi' }], [], () => { });
+        expect(text).toBe('hi');
+        expect(toolCalls).toEqual([]);
+    });
+    it('reports token usage from the final include_usage chunk', async () => {
+        vi.stubGlobal('fetch', vi.fn(async () => sseResponse([
+            JSON.stringify({ choices: [{ delta: { content: 'hi' } }] }),
+            JSON.stringify({ choices: [], usage: { prompt_tokens: 42, completion_tokens: 7 } }),
+            '[DONE]',
+        ])));
+        const provider = createOpenAICompatProvider({ id: 'openai', baseUrl: 'x', apiKey: 'k', model: 'gpt' });
+        let usage = null;
+        await provider.stream([{ role: 'user', content: 'hi' }], () => { }, (u) => { usage = u; });
+        expect(usage).toEqual({ inputTokens: 42, outputTokens: 7 });
+    });
+    it('advertises native tool support via the flag', () => {
+        const p = createOpenAICompatProvider({ id: 'openai', baseUrl: 'x', apiKey: 'k', model: 'gpt', supportsTools: true });
+        expect(p.supportsTools).toBe(true);
+        const noTools = createOpenAICompatProvider({ id: 'minimax', baseUrl: 'x', apiKey: 'k', model: 'm' });
+        expect(noTools.supportsTools).toBe(false);
+    });
+});

package/dist/providers/types.js

@@ -17,7 +17,7 @@ export class ProviderError extends Error {
 /** Human-friendly provider metadata. */
 export const PROVIDER_INFO = {
     // ── International providers ───────────────────────────────────────────
-    anthropic: { label: 'Anthropic (Claude)', defaultModel: 'claude-sonnet-4-5' },
+    anthropic: { label: 'Anthropic (Claude)', defaultModel: 'claude-sonnet-5' },
     openai: { label: 'OpenAI (GPT)', defaultModel: 'gpt-4o-mini' },
     openrouter: { label: 'OpenRouter', defaultModel: 'openrouter/auto' },
     groq: { label: 'Groq (free tier)', defaultModel: 'llama-3.3-70b-versatile', free: true },

package/dist/replay/export.js

@@ -16,6 +16,7 @@
 import { promises as fs } from 'node:fs';
 import { join } from 'node:path';
 import { loadSession } from './recorder.js';
+import { escapeHtml } from '../utils/html.js';
 /** UI labels for the generated page, per export language. */
 const LABELS = {
     en: {
@@ -306,10 +307,3 @@ document.getElementById('record').onclick = async () => {
 </html>
 `;
 }
-function escapeHtml(text) {
-    return text
-        .replaceAll('&', '&amp;')
-        .replaceAll('<', '&lt;')
-        .replaceAll('>', '&gt;')
-        .replaceAll('"', '&quot;');
-}

package/dist/skills/index.js

@@ -50,7 +50,7 @@ export function skillsBlock(skills) {
  * Add a skill from a local file path or a URL (GitHub URLs are converted
  * to raw content automatically). Returns the saved skill name.
  */
-export async function addSkill(root, source) {
+export async function addSkill(root, source, opts = {}) {
     let content;
     let name;
     if (/^https?:\/\//i.test(source)) {
@@ -61,14 +61,22 @@ export async function addSkill(root, source) {
         }
         content = await res.text();
         name = skillNameFromUrl(source);
+        content = content.slice(0, MAX_SKILL_SIZE).trim();
+        if (!content)
+            throw new Error('Skill source is empty.');
+        if (opts.confirmRemoteContent) {
+            const proceed = await opts.confirmRemoteContent(content, sanitizeName(name), url);
+            if (!proceed)
+                throw new Error('Skill add cancelled.');
+        }
     }
     else {
         content = await fs.readFile(source, 'utf8');
         name = basename(source, extname(source));
+        content = content.slice(0, MAX_SKILL_SIZE).trim();
+        if (!content)
+            throw new Error('Skill source is empty.');
     }
-    content = content.slice(0, MAX_SKILL_SIZE).trim();
-    if (!content)
-        throw new Error('Skill source is empty.');
     name = sanitizeName(name);
     const dir = skillsDir(root);
     await fs.mkdir(dir, { recursive: true });

package/dist/snapshots/index.js

@@ -20,8 +20,21 @@
  */
 import { promises as fs } from 'node:fs';
 import { existsSync } from 'node:fs';
-import { join, isAbsolute, relative, dirname } from 'node:path';
+import { join, isAbsolute, relative, dirname, resolve, sep } from 'node:path';
 import { writeJsonAtomic, readJson } from '../utils/fs-atomic.js';
+/**
+ * Resolve `rel` against `root` and verify the result stays inside `root`.
+ * Blocks path traversal (e.g. a relative path containing `..` segments)
+ * from letting snapshot save/restore read or overwrite files outside the
+ * project — snapshots are only ever meant to cover project files.
+ */
+function resolveWithinRoot(root, rel) {
+    const absRoot = resolve(root);
+    const abs = isAbsolute(rel) ? resolve(rel) : resolve(absRoot, rel);
+    if (abs !== absRoot && !abs.startsWith(absRoot + sep))
+        return null;
+    return abs;
+}
 const MAX_SNAPSHOTS = 50;
 function makeId() {
     return Date.now().toString(36) + Math.random().toString(36).slice(2, 5);
@@ -79,8 +92,8 @@ export class SnapshotManager {
         await fs.mkdir(dir, { recursive: true });
         const saved = [];
         for (const rel of relPaths) {
-            const abs = isAbsolute(rel) ? rel : join(this.root, rel);
-            if (!existsSync(abs))
+            const abs = resolveWithinRoot(this.root, rel);
+            if (!abs || !existsSync(abs))
                 continue;
             await fs.copyFile(abs, join(dir, encodeRelPath(rel)));
             saved.push(rel);
@@ -90,7 +103,9 @@ export class SnapshotManager {
     async restoreFiles(id, relPaths) {
         const dir = join(this.sessionDir, id, 'files');
         for (const rel of relPaths) {
-            const dest = isAbsolute(rel) ? rel : join(this.root, rel);
+            const dest = resolveWithinRoot(this.root, rel);
+            if (!dest)
+                continue;
             try {
                 await fs.copyFile(join(dir, encodeRelPath(rel)), dest);
             }
@@ -215,6 +230,8 @@ export class SnapshotManager {
             if (!p || p.startsWith('-') || p.startsWith('http') || p === '/dev/null')
                 return;
             const abs = isAbsolute(p) ? p : join(cwd, p);
+            if (!resolveWithinRoot(cwd, abs))
+                return; // never track files outside the project root
             if (existsSync(abs)) {
                 found.add(relative(cwd, abs).replace(/\\/g, '/'));
             }