@agent-native/core 0.15.10 → 0.15.11

package/dist/client/tools/ToolsListPage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolsListPage.js","sourceRoot":"","sources":["../../../src/client/tools/ToolsListPage.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,OAAO,EACP,cAAc,EACd,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AASzB,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,eAAe,CAAC;QACd,OAAO,EAAE,kBAAkB,OAAO,EAAE;QACpC,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,EAAE,SAAS,EAA0B;IAC5D,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,qBAAqB,EAAE,SAAS,CAAC,aAClD,YAAG,SAAS,EAAC,uCAAuC,yBAAa,EACjE,KAAC,cAAc,IACb,SAAS,QACT,WAAW,EAAC,kFAAkF,EAC9F,UAAU,EAAC,cAAc,EACzB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAC1C,IACE,CACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAW,GAAG,EAAE,CAClE,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CACrD,CAAC;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,CAAC,eAAe,CAAC,6CAA6C,CAAC,EAAE;YACpE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;SACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAC1C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,GAAG,EAAE;YACV,MAAM,CAAC,mBAAmB,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YAChE,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAS;QAClD,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GACZ,cAAc,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,EAAE,cAAc,CAAC;QAC9C,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAEpB,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE;QACpC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvB,aAAa,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO,CACL,eAAK,SAAS,EAAC,6BAA6B,aAC1C,kBAAQ,SAAS,EAAC,+DAA+D,aAC/E,aAAI,SAAS,EAAC,uBAAuB,sBAAW,EAChD,eAAK,SAAS,EAAC,yBAAyB,aACtC,MAAC,OAAO,IAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,aACpD,KAAC,cAAc,IAAC,OAAO,kBACrB,kBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,kKAAkK,aAE5K,KAAC,QAAQ,IAAC,SAAS,EAAC,SAAS,GAAG,gBAEzB,GACM,EACjB,MAAC,cAAc,IACb,KAAK,EAAC,KAAK,EACX,UAAU,EAAE,CAAC,EACb,SAAS,EAAC,eAAe,aAEzB,YAAG,SAAS,EAAC,iDAAiD,yBAE1D,EACJ,KAAC,cAAc,IACb,SAAS,QACT,WAAW,EAAC,sCAAsC,EAClD,UAAU,EAAC,sBAAsB,EACjC,QAAQ,EAAE,YAAY,GACtB,IACa,IACT,EACV,KAAC,iBAAiB,KAAG,EACrB,KAAC,iBAAiB,IAAC,SAAS,EAAC,oCAAoC,GAAG,IAChE,IACC,EAET,cAAK,SAAS,EAAC,0BAA0B,YACtC,SAAS,CAAC,CAAC,CAAC,CACX,cAAK,SAAS,EAAC,sDAAsD,YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CACvC,eAEE,SAAS,EAAC,6CAA6C,aAEvD,cAAK,SAAS,EAAC,kDAAkD,GAAG,EACpE,cAAK,SAAS,EAAC,+CAA+C,GAAG,EACjE,cAAK,SAAS,EAAC,0CAA0C,GAAG,KALvD,CAAC,CAMF,CACP,CAAC,GACE,CACP,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC1B,eAAK,SAAS,EAAC,mEAAmE,aAChF,KAAC,QAAQ,IAAC,SAAS,EAAC,oCAAoC,GAAG,EAC3D,0BACE,YAAG,SAAS,EAAC,qBAAqB,6BAAiB,EACnD,YAAG,SAAS,EAAC,oCAAoC,kDAE7C,IACA,EACN,KAAC,eAAe,IAAC,SAAS,EAAC,iBAAiB,GAAG,IAC3C,CACP,CAAC,CAAC,CAAC,CACF,cAAK,SAAS,EAAC,sDAAsD,YAClE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACtB,MAAC,IAAI,IAEH,EAAE,EAAE,UAAU,IAAI,CAAC,EAAE,EAAE,EACvB,SAAS,EAAE,EAAE,CACX,kEAAkE,EAClE,yCAAyC,CAC1C,aAED,cAAK,SAAS,EAAC,8IAA8I,YAC3J,KAAC,QAAQ,IAAC,SAAS,EAAC,SAAS,GAAG,GAC5B,EACN,aAAI,SAAS,EAAC,4CAA4C,YACvD,IAAI,CAAC,IAAI,GACP,EACJ,IAAI,CAAC,WAAW,IAAI,CACnB,YAAG,SAAS,EAAC,4CAA4C,YACtD,IAAI,CAAC,WAAW,GACf,CACL,KAjBI,IAAI,CAAC,EAAE,CAkBP,CACR,CAAC,GACE,CACP,GACG,IACF,CACP,CAAC;AACJ,CAAC","sourcesContent":["import { agentNativePath } from \"../api-path.js\";\nimport { useState, useEffect } from \"react\";\nimport { useQuery } from \"@tanstack/react-query\";\nimport { Link } from \"react-router\";\nimport { IconPlus, IconTool } from \"@tabler/icons-react\";\nimport { cn } from \"../utils.js\";\nimport { AgentToggleButton } from \"../AgentPanel.js\";\nimport { NotificationsBell } from \"../notifications/NotificationsBell.js\";\nimport { sendToAgentChat } from \"../agent-chat.js\";\nimport { PromptComposer } from \"../composer/PromptComposer.js\";\nimport {\n  Popover,\n  PopoverContent,\n  PopoverTrigger,\n} from \"../components/ui/popover.js\";\nimport {\n  TOOLS_ORDER_CHANGE_EVENT,\n  applyToolsOrder,\n  getToolsOrder,\n} from \"./tool-order.js\";\n\ninterface Tool {\n  id: string;\n  name: string;\n  description?: string;\n  icon?: string;\n}\n\nfunction submitCreateTool(prompt: string) {\n  const trimmed = prompt.trim();\n  if (!trimmed) return;\n  sendToAgentChat({\n    message: `Create a tool: ${trimmed}`,\n    submit: true,\n    openSidebar: true,\n    newTab: true,\n  });\n}\n\nfunction CreateToolInput({ className }: { className?: string }) {\n  return (\n    <div className={cn(\"flex flex-col gap-2\", className)}>\n      <p className=\"text-sm font-semibold text-foreground\">New tool</p>\n      <PromptComposer\n        autoFocus\n        placeholder=\"Describe what you'd like to build... e.g. a todo list, API dashboard, calculator\"\n        draftScope=\"tools:create\"\n        onSubmit={(text) => submitCreateTool(text)}\n      />\n    </div>\n  );\n}\n\nexport function ToolsListPage() {\n  const [showCreate, setShowCreate] = useState(false);\n  const [toolOrderState, setToolOrderState] = useState<string[]>(() =>\n    typeof window !== \"undefined\" ? getToolsOrder() : [],\n  );\n\n  useEffect(() => {\n    fetch(agentNativePath(\"/_agent-native/application-state/navigation\"), {\n      method: \"PUT\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ value: { view: \"tools\" } }),\n    }).catch(() => {});\n  }, []);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n    const syncOrder = () => setToolOrderState(getToolsOrder());\n    window.addEventListener(TOOLS_ORDER_CHANGE_EVENT, syncOrder);\n    window.addEventListener(\"storage\", syncOrder);\n    return () => {\n      window.removeEventListener(TOOLS_ORDER_CHANGE_EVENT, syncOrder);\n      window.removeEventListener(\"storage\", syncOrder);\n    };\n  }, []);\n\n  const { data: tools, isLoading } = useQuery<Tool[]>({\n    queryKey: [\"tools\"],\n    queryFn: async () => {\n      const res = await fetch(agentNativePath(\"/_agent-native/tools\"));\n      if (!res.ok) return [];\n      return res.json();\n    },\n  });\n\n  const toolList =\n    toolOrderState.length > 0\n      ? applyToolsOrder(tools ?? [], toolOrderState)\n      : (tools ?? []);\n\n  const handleCreate = (text: string) => {\n    submitCreateTool(text);\n    setShowCreate(false);\n  };\n\n  return (\n    <div className=\"flex h-full w-full flex-col\">\n      <header className=\"flex h-12 items-center justify-between border-b px-4 shrink-0\">\n        <h1 className=\"text-sm font-semibold\">Tools</h1>\n        <div className=\"flex items-center gap-2\">\n          <Popover open={showCreate} onOpenChange={setShowCreate}>\n            <PopoverTrigger asChild>\n              <button\n                type=\"button\"\n                className=\"inline-flex cursor-pointer items-center justify-center gap-1.5 rounded-md bg-primary px-3 py-1.5 text-sm font-medium text-primary-foreground hover:bg-primary/90\"\n              >\n                <IconPlus className=\"h-4 w-4\" />\n                New Tool\n              </button>\n            </PopoverTrigger>\n            <PopoverContent\n              align=\"end\"\n              sideOffset={6}\n              className=\"w-[420px] p-3\"\n            >\n              <p className=\"px-1 pb-2 text-sm font-semibold text-foreground\">\n                New tool\n              </p>\n              <PromptComposer\n                autoFocus\n                placeholder=\"Describe what you'd like to build...\"\n                draftScope=\"tools:create-popover\"\n                onSubmit={handleCreate}\n              />\n            </PopoverContent>\n          </Popover>\n          <NotificationsBell />\n          <AgentToggleButton className=\"h-8 w-8 rounded-md hover:bg-accent\" />\n        </div>\n      </header>\n\n      <div className=\"flex-1 overflow-auto p-6\">\n        {isLoading ? (\n          <div className=\"grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3\">\n            {Array.from({ length: 6 }).map((_, i) => (\n              <div\n                key={i}\n                className=\"rounded-lg border border-border bg-card p-5\"\n              >\n                <div className=\"mb-3 h-10 w-10 rounded-lg bg-muted animate-pulse\" />\n                <div className=\"mb-2 h-4 w-2/3 rounded bg-muted animate-pulse\" />\n                <div className=\"h-3 w-4/5 rounded bg-muted animate-pulse\" />\n              </div>\n            ))}\n          </div>\n        ) : toolList.length === 0 ? (\n          <div className=\"flex flex-col items-center justify-center gap-4 py-16 text-center\">\n            <IconTool className=\"h-10 w-10 text-muted-foreground/40\" />\n            <div>\n              <p className=\"text-sm font-medium\">No tools yet</p>\n              <p className=\"text-xs text-muted-foreground mt-1\">\n                Describe what you'd like to build\n              </p>\n            </div>\n            <CreateToolInput className=\"w-full max-w-sm\" />\n          </div>\n        ) : (\n          <div className=\"grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3\">\n            {toolList.map((tool) => (\n              <Link\n                key={tool.id}\n                to={`/tools/${tool.id}`}\n                className={cn(\n                  \"group cursor-pointer rounded-lg border border-border bg-card p-5\",\n                  \"hover:border-primary/30 hover:shadow-sm\",\n                )}\n              >\n                <div className=\"mb-3 flex h-10 w-10 items-center justify-center rounded-lg bg-muted text-muted-foreground group-hover:bg-primary/10 group-hover:text-primary\">\n                  <IconTool className=\"h-5 w-5\" />\n                </div>\n                <h3 className=\"mb-1 text-sm font-semibold text-foreground\">\n                  {tool.name}\n                </h3>\n                {tool.description && (\n                  <p className=\"line-clamp-2 text-xs text-muted-foreground\">\n                    {tool.description}\n                  </p>\n                )}\n              </Link>\n            ))}\n          </div>\n        )}\n      </div>\n    </div>\n  );\n}\n"]}

package/dist/client/tools/ToolsSidebarSection.d.ts

@@ -0,0 +1,2 @@
+export declare function ToolsSidebarSection(): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=ToolsSidebarSection.d.ts.map

package/dist/client/tools/ToolsSidebarSection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolsSidebarSection.d.ts","sourceRoot":"","sources":["../../../src/client/tools/ToolsSidebarSection.tsx"],"names":[],"mappings":"AAqDA,wBAAgB,mBAAmB,4CAkYlC"}

package/dist/client/tools/ToolsSidebarSection.js

@@ -0,0 +1,236 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { agentNativePath } from "../api-path.js";
+import { useState, useCallback, useMemo, useEffect } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { Link, useLocation, useNavigate } from "react-router";
+import { IconTool, IconPlus, IconStar, IconStarFilled, IconTrash, IconDots, IconHelpCircle, IconPencil, IconGripVertical, } from "@tabler/icons-react";
+import { cn } from "../utils.js";
+import { sendToAgentChat } from "../agent-chat.js";
+import { PromptComposer } from "../composer/PromptComposer.js";
+import { Popover, PopoverContent, PopoverTrigger, } from "../components/ui/popover.js";
+import { applyToolsOrder, getToolsOrder, setToolsOrder } from "./tool-order.js";
+const FAVORITES_KEY = "tools-favorites";
+function getFavorites() {
+    try {
+        const raw = localStorage.getItem(FAVORITES_KEY);
+        if (!raw)
+            return new Set();
+        const parsed = JSON.parse(raw);
+        return new Set(Array.isArray(parsed) ? parsed : []);
+    }
+    catch {
+        return new Set();
+    }
+}
+function saveFavorites(ids) {
+    try {
+        localStorage.setItem(FAVORITES_KEY, JSON.stringify(Array.from(ids)));
+    }
+    catch {
+        // localStorage unavailable — ignore
+    }
+}
+export function ToolsSidebarSection() {
+    const location = useLocation();
+    const navigate = useNavigate();
+    const queryClient = useQueryClient();
+    const [favoriteIds, setFavoriteIds] = useState(() => typeof window !== "undefined" ? getFavorites() : new Set());
+    const [menuOpenId, setMenuOpenId] = useState(null);
+    const [renamingId, setRenamingId] = useState(null);
+    const [renameValue, setRenameValue] = useState("");
+    const [showCreate, setShowCreate] = useState(false);
+    const [toolOrderState, setToolOrderState] = useState(() => typeof window !== "undefined" ? getToolsOrder() : []);
+    const [draggingId, setDraggingId] = useState(null);
+    const [dragOverId, setDragOverId] = useState(null);
+    const { data: tools, isLoading } = useQuery({
+        queryKey: ["tools"],
+        queryFn: async () => {
+            const res = await fetch(agentNativePath("/_agent-native/tools"));
+            if (!res.ok)
+                return [];
+            return res.json();
+        },
+    });
+    const toggleFavorite = useCallback((id) => {
+        setFavoriteIds((prev) => {
+            const next = new Set(prev);
+            if (next.has(id)) {
+                next.delete(id);
+            }
+            else {
+                next.add(id);
+            }
+            saveFavorites(next);
+            return next;
+        });
+    }, []);
+    const handleDelete = useCallback(async (toolId) => {
+        setMenuOpenId(null);
+        const prev = queryClient.getQueryData(["tools"]);
+        queryClient.setQueryData(["tools"], (old) => (old ?? []).filter((t) => t.id !== toolId));
+        try {
+            const res = await fetch(agentNativePath(`/_agent-native/tools/${toolId}`), {
+                method: "DELETE",
+            });
+            if (!res.ok)
+                throw new Error("Delete failed");
+            queryClient.removeQueries({ queryKey: ["tool", toolId] });
+            queryClient.invalidateQueries({ queryKey: ["tools"] });
+            setFavoriteIds((prev) => {
+                const next = new Set(prev);
+                next.delete(toolId);
+                saveFavorites(next);
+                return next;
+            });
+            setToolOrderState((prev) => {
+                const next = prev.filter((id) => id !== toolId);
+                if (next.length !== prev.length)
+                    setToolsOrder(next);
+                return next;
+            });
+            if (location.pathname === `/tools/${toolId}` ||
+                location.pathname === `/tools/${toolId}/edit`) {
+                navigate("/tools");
+            }
+        }
+        catch {
+            if (prev)
+                queryClient.setQueryData(["tools"], prev);
+        }
+    }, [location.pathname, navigate, queryClient]);
+    const startRename = useCallback((tool) => {
+        setMenuOpenId(null);
+        setRenameValue(tool.name);
+        setRenamingId(tool.id);
+    }, []);
+    const submitRename = useCallback(async (toolId) => {
+        const trimmed = renameValue.trim();
+        setRenamingId(null);
+        if (!trimmed)
+            return;
+        const prev = queryClient.getQueryData(["tools"]);
+        const existing = prev?.find((t) => t.id === toolId);
+        if (!existing || trimmed === existing.name)
+            return;
+        queryClient.setQueryData(["tools"], (old) => (old ?? []).map((t) => (t.id === toolId ? { ...t, name: trimmed } : t)));
+        queryClient.setQueryData(["tool", toolId], (old) => old ? { ...old, name: trimmed } : old);
+        try {
+            await fetch(agentNativePath(`/_agent-native/tools/${toolId}`), {
+                method: "PUT",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ name: trimmed }),
+            });
+            queryClient.invalidateQueries({ queryKey: ["tools"] });
+            queryClient.invalidateQueries({ queryKey: ["tool", toolId] });
+        }
+        catch {
+            if (prev)
+                queryClient.setQueryData(["tools"], prev);
+            queryClient.invalidateQueries({ queryKey: ["tool", toolId] });
+        }
+    }, [renameValue, queryClient]);
+    // Close menu on click outside
+    useEffect(() => {
+        if (!menuOpenId)
+            return;
+        const handler = () => setMenuOpenId(null);
+        document.addEventListener("click", handler);
+        return () => document.removeEventListener("click", handler);
+    }, [menuOpenId]);
+    const sortedTools = useMemo(() => {
+        if (!tools)
+            return [];
+        const defaultSorted = [...tools].sort((a, b) => {
+            const aFav = favoriteIds.has(a.id) ? 0 : 1;
+            const bFav = favoriteIds.has(b.id) ? 0 : 1;
+            if (aFav !== bFav)
+                return aFav - bFav;
+            return a.name.localeCompare(b.name);
+        });
+        return toolOrderState.length > 0
+            ? applyToolsOrder(defaultSorted, toolOrderState)
+            : defaultSorted;
+    }, [tools, favoriteIds, toolOrderState]);
+    const reorderTool = useCallback((activeId, overId) => {
+        if (activeId === overId)
+            return;
+        const ids = sortedTools.map((tool) => tool.id);
+        const oldIndex = ids.indexOf(activeId);
+        const newIndex = ids.indexOf(overId);
+        if (oldIndex === -1 || newIndex === -1)
+            return;
+        const next = [...ids];
+        const [moved] = next.splice(oldIndex, 1);
+        if (!moved)
+            return;
+        next.splice(newIndex, 0, moved);
+        setToolsOrder(next);
+        setToolOrderState(next);
+    }, [sortedTools]);
+    const handleCreate = (text) => {
+        const trimmed = text.trim();
+        if (!trimmed)
+            return;
+        sendToAgentChat({
+            message: `Create a tool: ${trimmed}`,
+            submit: true,
+            openSidebar: true,
+            newTab: true,
+        });
+        setShowCreate(false);
+    };
+    return (_jsxs("div", { className: "group/help relative min-w-0 py-2", children: [_jsxs("div", { className: cn("flex items-center justify-between px-3", sortedTools.length > 0 && "mb-1"), children: [_jsxs("span", { className: "inline-flex items-center gap-1.5 text-xs font-semibold uppercase tracking-wider text-muted-foreground", children: [_jsx(IconTool, { className: "h-3.5 w-3.5 shrink-0" }), "Tools", _jsx("a", { href: "https://agent-native.com/docs/tools", target: "_blank", rel: "noopener noreferrer", className: "opacity-0 group-hover/help:opacity-100 transition-opacity text-muted-foreground/50 hover:text-muted-foreground", "aria-label": "Tools documentation", children: _jsx(IconHelpCircle, { className: "h-3 w-3" }) })] }), _jsxs(Popover, { open: showCreate, onOpenChange: setShowCreate, children: [_jsx(PopoverTrigger, { asChild: true, children: _jsx("button", { type: "button", className: "inline-flex h-5 w-5 cursor-pointer items-center justify-center rounded text-muted-foreground hover:bg-accent hover:text-accent-foreground", "aria-label": "New tool", children: _jsx(IconPlus, { className: "h-3.5 w-3.5" }) }) }), _jsxs(PopoverContent, { side: "right", align: "start", className: "w-[420px] p-3", children: [_jsx("p", { className: "px-1 pb-2 text-sm font-semibold text-foreground", children: "New tool" }), _jsx(PromptComposer, { autoFocus: true, placeholder: "Describe what you'd like to build...", draftScope: "tools:sidebar-create", onSubmit: handleCreate })] })] })] }), isLoading ? (_jsx("div", { className: "min-w-0 space-y-0.5 px-1", children: [1, 2, 3].map((i) => (_jsx("div", { className: "flex items-center rounded-md px-2 py-1.5", children: _jsx("div", { className: "h-3 rounded bg-muted animate-pulse", style: { width: `${60 + i * 20}px` } }) }, i))) })) : sortedTools.length === 0 ? null : (_jsx("div", { className: "min-w-0 space-y-0.5 px-1", children: sortedTools.map((tool) => {
+                    const isActive = location.pathname === `/tools/${tool.id}` ||
+                        location.pathname === `/tools/${tool.id}/edit`;
+                    const isFav = favoriteIds.has(tool.id);
+                    const isRenamingThis = renamingId === tool.id;
+                    const actionsVisible = menuOpenId === tool.id || isRenamingThis;
+                    return (_jsxs("div", { onDragOver: (e) => {
+                            if (!draggingId || draggingId === tool.id)
+                                return;
+                            e.preventDefault();
+                            e.dataTransfer.dropEffect = "move";
+                            setDragOverId(tool.id);
+                        }, onDragLeave: () => {
+                            setDragOverId((current) => current === tool.id ? null : current);
+                        }, onDrop: (e) => {
+                            e.preventDefault();
+                            const activeId = draggingId || e.dataTransfer.getData("text/plain");
+                            setDraggingId(null);
+                            setDragOverId(null);
+                            if (activeId)
+                                reorderTool(activeId, tool.id);
+                        }, className: cn("group/tool relative flex items-center min-w-0 rounded-md", draggingId === tool.id && "opacity-50", dragOverId === tool.id &&
+                            draggingId !== tool.id &&
+                            "bg-accent/60"), children: [_jsx("button", { type: "button", draggable: true, onDragStart: (e) => {
+                                    setDraggingId(tool.id);
+                                    setDragOverId(null);
+                                    e.dataTransfer.effectAllowed = "move";
+                                    e.dataTransfer.setData("text/plain", tool.id);
+                                }, onDragEnd: () => {
+                                    setDraggingId(null);
+                                    setDragOverId(null);
+                                }, className: "-ml-2 cursor-grab rounded p-0.5 text-muted-foreground/30 opacity-0 transition-colors hover:text-muted-foreground/70 active:cursor-grabbing group-hover/tool:opacity-100 group-focus-within/tool:opacity-100", "aria-label": `Reorder ${tool.name}`, title: "Drag to reorder", children: _jsx(IconGripVertical, { className: "h-3 w-3" }) }), _jsx(Link, { to: `/tools/${tool.id}`, className: cn("flex min-w-0 flex-1 items-center rounded-md px-2 py-1.5 pr-12 text-xs transition-[padding,color,background-color] md:pr-2 md:group-hover/tool:pr-12 md:group-focus-within/tool:pr-12", actionsVisible && "md:pr-12", isActive
+                                    ? "bg-accent text-accent-foreground font-medium"
+                                    : "text-muted-foreground hover:bg-accent/50 hover:text-accent-foreground"), children: isRenamingThis ? (_jsx("input", { autoFocus: true, value: renameValue, onChange: (e) => setRenameValue(e.target.value), onBlur: () => submitRename(tool.id), onKeyDown: (e) => {
+                                        if (e.key === "Enter")
+                                            submitRename(tool.id);
+                                        if (e.key === "Escape")
+                                            setRenamingId(null);
+                                    }, onClick: (e) => {
+                                        e.preventDefault();
+                                        e.stopPropagation();
+                                    }, className: "min-w-0 flex-1 truncate border-b border-primary bg-transparent px-0 py-0 text-xs outline-none" })) : (_jsx("span", { className: "block truncate", children: tool.name })) }), _jsxs("div", { className: cn("pointer-events-none absolute right-1 top-1/2 flex -translate-y-1/2 items-center gap-0.5 opacity-100 transition-opacity md:opacity-0 md:group-hover/tool:opacity-100 md:group-focus-within/tool:opacity-100", actionsVisible && "md:opacity-100"), children: [_jsx("button", { type: "button", onClick: (e) => {
+                                            e.preventDefault();
+                                            e.stopPropagation();
+                                            toggleFavorite(tool.id);
+                                        }, className: cn("pointer-events-auto cursor-pointer rounded p-0.5 transition-colors", isFav
+                                            ? "text-yellow-500"
+                                            : "text-muted-foreground/40 hover:text-yellow-500"), "aria-label": isFav ? "Unfavorite" : "Favorite", children: isFav ? (_jsx(IconStarFilled, { className: "h-3 w-3" })) : (_jsx(IconStar, { className: "h-3 w-3" })) }), _jsxs("div", { className: "relative", children: [_jsx("button", { type: "button", onClick: (e) => {
+                                                    e.preventDefault();
+                                                    e.stopPropagation();
+                                                    setMenuOpenId(menuOpenId === tool.id ? null : tool.id);
+                                                }, className: "pointer-events-auto cursor-pointer rounded p-0.5 text-muted-foreground/40 transition-colors hover:text-foreground", "aria-label": "Tool actions", children: _jsx(IconDots, { className: "h-3 w-3" }) }), menuOpenId === tool.id && (_jsxs("div", { className: "absolute right-0 top-full z-50 mt-1 min-w-[120px] rounded-md border border-border bg-popover p-1 text-popover-foreground shadow-md", onClick: (e) => e.stopPropagation(), children: [_jsxs("button", { type: "button", onClick: () => startRename(tool), className: "flex w-full cursor-pointer items-center gap-2 rounded-sm px-2 py-1.5 text-sm hover:bg-accent", children: [_jsx(IconPencil, { className: "h-3.5 w-3.5" }), "Rename"] }), _jsxs("button", { type: "button", onClick: () => handleDelete(tool.id), className: "flex w-full cursor-pointer items-center gap-2 rounded-sm px-2 py-1.5 text-sm text-destructive hover:bg-accent", children: [_jsx(IconTrash, { className: "h-3.5 w-3.5" }), "Delete"] })] }))] })] })] }, tool.id));
+                }) }))] }));
+}
+//# sourceMappingURL=ToolsSidebarSection.js.map

package/dist/client/tools/ToolsSidebarSection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolsSidebarSection.js","sourceRoot":"","sources":["../../../src/client/tools/ToolsSidebarSection.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,SAAS,EACT,QAAQ,EACR,cAAc,EACd,UAAU,EACV,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,OAAO,EACP,cAAc,EACd,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAShF,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAc,GAAG,EAAE,CAC/D,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAC3D,CAAC;IACF,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAW,GAAG,EAAE,CAClE,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CACrD,CAAC;IACF,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAClE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAElE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAS;QAClD,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,EAAU,EAAE,EAAE;QAChD,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,MAAc,EAAE,EAAE;QACvB,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,WAAW,CAAC,YAAY,CAAS,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAC3C,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,eAAe,CAAC,wBAAwB,MAAM,EAAE,CAAC,EACjD;gBACE,MAAM,EAAE,QAAQ;aACjB,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC9C,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1D,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvD,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpB,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;gBAChD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;oBAAE,aAAa,CAAC,IAAI,CAAC,CAAC;gBACrD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,IACE,QAAQ,CAAC,QAAQ,KAAK,UAAU,MAAM,EAAE;gBACxC,QAAQ,CAAC,QAAQ,KAAK,UAAU,MAAM,OAAO,EAC7C,CAAC;gBACD,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI;gBAAE,WAAW,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,EACD,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAC3C,CAAC;IAEF,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,IAAU,EAAE,EAAE;QAC7C,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,MAAc,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QACnC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI;YAAE,OAAO;QACnD,WAAW,CAAC,YAAY,CAAS,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAClD,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;QACF,WAAW,CAAC,YAAY,CAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CACvD,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CACtC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,eAAe,CAAC,wBAAwB,MAAM,EAAE,CAAC,EAAE;gBAC7D,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvD,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI;gBAAE,WAAW,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;YACpD,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,EACD,CAAC,WAAW,EAAE,WAAW,CAAC,CAC3B,CAAC;IAEF,8BAA8B;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;QAC/B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAC,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC;YAChD,CAAC,CAAC,aAAa,CAAC;IACpB,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAEzC,MAAM,WAAW,GAAG,WAAW,CAC7B,CAAC,QAAgB,EAAE,MAAc,EAAE,EAAE;QACnC,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO;QAChC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC;YAAE,OAAO;QAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,eAAe,CAAC;YACd,OAAO,EAAE,kBAAkB,OAAO,EAAE;YACpC,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,aAAa,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO,CACL,eAAK,SAAS,EAAC,kCAAkC,aAC/C,eACE,SAAS,EAAE,EAAE,CACX,wCAAwC,EACxC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CACjC,aAED,gBAAM,SAAS,EAAC,uGAAuG,aACrH,KAAC,QAAQ,IAAC,SAAS,EAAC,sBAAsB,GAAG,WAE7C,YACE,IAAI,EAAC,qCAAqC,EAC1C,MAAM,EAAC,QAAQ,EACf,GAAG,EAAC,qBAAqB,EACzB,SAAS,EAAC,gHAAgH,gBAC/G,qBAAqB,YAEhC,KAAC,cAAc,IAAC,SAAS,EAAC,SAAS,GAAG,GACpC,IACC,EACP,MAAC,OAAO,IAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,aACpD,KAAC,cAAc,IAAC,OAAO,kBACrB,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,2IAA2I,gBAC1I,UAAU,YAErB,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,GAAG,GAC7B,GACM,EACjB,MAAC,cAAc,IAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,OAAO,EAAC,SAAS,EAAC,eAAe,aAClE,YAAG,SAAS,EAAC,iDAAiD,yBAE1D,EACJ,KAAC,cAAc,IACb,SAAS,QACT,WAAW,EAAC,sCAAsC,EAClD,UAAU,EAAC,sBAAsB,EACjC,QAAQ,EAAE,YAAY,GACtB,IACa,IACT,IACN,EAEL,SAAS,CAAC,CAAC,CAAC,CACX,cAAK,SAAS,EAAC,0BAA0B,YACtC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACpB,cAAa,SAAS,EAAC,0CAA0C,YAC/D,cACE,SAAS,EAAC,oCAAoC,EAC9C,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GACpC,IAJM,CAAC,CAKL,CACP,CAAC,GACE,CACP,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACpC,cAAK,SAAS,EAAC,0BAA0B,YACtC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;oBACxB,MAAM,QAAQ,GACZ,QAAQ,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,EAAE,EAAE;wBACzC,QAAQ,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,EAAE,OAAO,CAAC;oBACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACvC,MAAM,cAAc,GAAG,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;oBAC9C,MAAM,cAAc,GAAG,UAAU,KAAK,IAAI,CAAC,EAAE,IAAI,cAAc,CAAC;oBAEhE,OAAO,CACL,eAEE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;4BAChB,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,IAAI,CAAC,EAAE;gCAAE,OAAO;4BAClD,CAAC,CAAC,cAAc,EAAE,CAAC;4BACnB,CAAC,CAAC,YAAY,CAAC,UAAU,GAAG,MAAM,CAAC;4BACnC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACzB,CAAC,EACD,WAAW,EAAE,GAAG,EAAE;4BAChB,aAAa,CAAC,CAAC,OAAO,EAAE,EAAE,CACxB,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CACrC,CAAC;wBACJ,CAAC,EACD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;4BACZ,CAAC,CAAC,cAAc,EAAE,CAAC;4BACnB,MAAM,QAAQ,GACZ,UAAU,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;4BACrD,aAAa,CAAC,IAAI,CAAC,CAAC;4BACpB,aAAa,CAAC,IAAI,CAAC,CAAC;4BACpB,IAAI,QAAQ;gCAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;wBAC/C,CAAC,EACD,SAAS,EAAE,EAAE,CACX,0DAA0D,EAC1D,UAAU,KAAK,IAAI,CAAC,EAAE,IAAI,YAAY,EACtC,UAAU,KAAK,IAAI,CAAC,EAAE;4BACpB,UAAU,KAAK,IAAI,CAAC,EAAE;4BACtB,cAAc,CACjB,aAED,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,QACT,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;oCACjB,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oCACvB,aAAa,CAAC,IAAI,CAAC,CAAC;oCACpB,CAAC,CAAC,YAAY,CAAC,aAAa,GAAG,MAAM,CAAC;oCACtC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gCAChD,CAAC,EACD,SAAS,EAAE,GAAG,EAAE;oCACd,aAAa,CAAC,IAAI,CAAC,CAAC;oCACpB,aAAa,CAAC,IAAI,CAAC,CAAC;gCACtB,CAAC,EACD,SAAS,EAAC,6MAA6M,gBAC3M,WAAW,IAAI,CAAC,IAAI,EAAE,EAClC,KAAK,EAAC,iBAAiB,YAEvB,KAAC,gBAAgB,IAAC,SAAS,EAAC,SAAS,GAAG,GACjC,EACT,KAAC,IAAI,IACH,EAAE,EAAE,UAAU,IAAI,CAAC,EAAE,EAAE,EACvB,SAAS,EAAE,EAAE,CACX,sLAAsL,EACtL,cAAc,IAAI,UAAU,EAC5B,QAAQ;oCACN,CAAC,CAAC,8CAA8C;oCAChD,CAAC,CAAC,uEAAuE,CAC5E,YAEA,cAAc,CAAC,CAAC,CAAC,CAChB,gBACE,SAAS,QACT,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/C,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EACnC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;wCACf,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;4CAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wCAC7C,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ;4CAAE,aAAa,CAAC,IAAI,CAAC,CAAC;oCAC9C,CAAC,EACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;wCACb,CAAC,CAAC,cAAc,EAAE,CAAC;wCACnB,CAAC,CAAC,eAAe,EAAE,CAAC;oCACtB,CAAC,EACD,SAAS,EAAC,+FAA+F,GACzG,CACH,CAAC,CAAC,CAAC,CACF,eAAM,SAAS,EAAC,gBAAgB,YAAE,IAAI,CAAC,IAAI,GAAQ,CACpD,GACI,EAEP,eACE,SAAS,EAAE,EAAE,CACX,4MAA4M,EAC5M,cAAc,IAAI,gBAAgB,CACnC,aAED,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;4CACb,CAAC,CAAC,cAAc,EAAE,CAAC;4CACnB,CAAC,CAAC,eAAe,EAAE,CAAC;4CACpB,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wCAC1B,CAAC,EACD,SAAS,EAAE,EAAE,CACX,oEAAoE,EACpE,KAAK;4CACH,CAAC,CAAC,iBAAiB;4CACnB,CAAC,CAAC,gDAAgD,CACrD,gBACW,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,YAE5C,KAAK,CAAC,CAAC,CAAC,CACP,KAAC,cAAc,IAAC,SAAS,EAAC,SAAS,GAAG,CACvC,CAAC,CAAC,CAAC,CACF,KAAC,QAAQ,IAAC,SAAS,EAAC,SAAS,GAAG,CACjC,GACM,EAET,eAAK,SAAS,EAAC,UAAU,aACvB,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;oDACb,CAAC,CAAC,cAAc,EAAE,CAAC;oDACnB,CAAC,CAAC,eAAe,EAAE,CAAC;oDACpB,aAAa,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gDACzD,CAAC,EACD,SAAS,EAAC,mHAAmH,gBAClH,cAAc,YAEzB,KAAC,QAAQ,IAAC,SAAS,EAAC,SAAS,GAAG,GACzB,EAER,UAAU,KAAK,IAAI,CAAC,EAAE,IAAI,CACzB,eACE,SAAS,EAAC,oIAAoI,EAC9I,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,aAEnC,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAChC,SAAS,EAAC,8FAA8F,aAExG,KAAC,UAAU,IAAC,SAAS,EAAC,aAAa,GAAG,cAE/B,EACT,kBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,EACpC,SAAS,EAAC,+GAA+G,aAEzH,KAAC,SAAS,IAAC,SAAS,EAAC,aAAa,GAAG,cAE9B,IACL,CACP,IACG,IACF,KAhJD,IAAI,CAAC,EAAE,CAiJR,CACP,CAAC;gBACJ,CAAC,CAAC,GACE,CACP,IACG,CACP,CAAC;AACJ,CAAC","sourcesContent":["import { agentNativePath } from \"../api-path.js\";\nimport { useState, useCallback, useMemo, useEffect } from \"react\";\nimport { useQuery, useQueryClient } from \"@tanstack/react-query\";\nimport { Link, useLocation, useNavigate } from \"react-router\";\nimport {\n  IconTool,\n  IconPlus,\n  IconStar,\n  IconStarFilled,\n  IconTrash,\n  IconDots,\n  IconHelpCircle,\n  IconPencil,\n  IconGripVertical,\n} from \"@tabler/icons-react\";\nimport { cn } from \"../utils.js\";\nimport { sendToAgentChat } from \"../agent-chat.js\";\nimport { PromptComposer } from \"../composer/PromptComposer.js\";\nimport {\n  Popover,\n  PopoverContent,\n  PopoverTrigger,\n} from \"../components/ui/popover.js\";\nimport { applyToolsOrder, getToolsOrder, setToolsOrder } from \"./tool-order.js\";\n\ninterface Tool {\n  id: string;\n  name: string;\n  description?: string;\n  icon?: string;\n}\n\nconst FAVORITES_KEY = \"tools-favorites\";\n\nfunction getFavorites(): Set<string> {\n  try {\n    const raw = localStorage.getItem(FAVORITES_KEY);\n    if (!raw) return new Set();\n    const parsed = JSON.parse(raw);\n    return new Set(Array.isArray(parsed) ? parsed : []);\n  } catch {\n    return new Set();\n  }\n}\n\nfunction saveFavorites(ids: Set<string>) {\n  try {\n    localStorage.setItem(FAVORITES_KEY, JSON.stringify(Array.from(ids)));\n  } catch {\n    // localStorage unavailable — ignore\n  }\n}\n\nexport function ToolsSidebarSection() {\n  const location = useLocation();\n  const navigate = useNavigate();\n  const queryClient = useQueryClient();\n  const [favoriteIds, setFavoriteIds] = useState<Set<string>>(() =>\n    typeof window !== \"undefined\" ? getFavorites() : new Set(),\n  );\n  const [menuOpenId, setMenuOpenId] = useState<string | null>(null);\n  const [renamingId, setRenamingId] = useState<string | null>(null);\n  const [renameValue, setRenameValue] = useState(\"\");\n  const [showCreate, setShowCreate] = useState(false);\n  const [toolOrderState, setToolOrderState] = useState<string[]>(() =>\n    typeof window !== \"undefined\" ? getToolsOrder() : [],\n  );\n  const [draggingId, setDraggingId] = useState<string | null>(null);\n  const [dragOverId, setDragOverId] = useState<string | null>(null);\n\n  const { data: tools, isLoading } = useQuery<Tool[]>({\n    queryKey: [\"tools\"],\n    queryFn: async () => {\n      const res = await fetch(agentNativePath(\"/_agent-native/tools\"));\n      if (!res.ok) return [];\n      return res.json();\n    },\n  });\n\n  const toggleFavorite = useCallback((id: string) => {\n    setFavoriteIds((prev) => {\n      const next = new Set(prev);\n      if (next.has(id)) {\n        next.delete(id);\n      } else {\n        next.add(id);\n      }\n      saveFavorites(next);\n      return next;\n    });\n  }, []);\n\n  const handleDelete = useCallback(\n    async (toolId: string) => {\n      setMenuOpenId(null);\n      const prev = queryClient.getQueryData<Tool[]>([\"tools\"]);\n      queryClient.setQueryData<Tool[]>([\"tools\"], (old) =>\n        (old ?? []).filter((t) => t.id !== toolId),\n      );\n      try {\n        const res = await fetch(\n          agentNativePath(`/_agent-native/tools/${toolId}`),\n          {\n            method: \"DELETE\",\n          },\n        );\n        if (!res.ok) throw new Error(\"Delete failed\");\n        queryClient.removeQueries({ queryKey: [\"tool\", toolId] });\n        queryClient.invalidateQueries({ queryKey: [\"tools\"] });\n        setFavoriteIds((prev) => {\n          const next = new Set(prev);\n          next.delete(toolId);\n          saveFavorites(next);\n          return next;\n        });\n        setToolOrderState((prev) => {\n          const next = prev.filter((id) => id !== toolId);\n          if (next.length !== prev.length) setToolsOrder(next);\n          return next;\n        });\n        if (\n          location.pathname === `/tools/${toolId}` ||\n          location.pathname === `/tools/${toolId}/edit`\n        ) {\n          navigate(\"/tools\");\n        }\n      } catch {\n        if (prev) queryClient.setQueryData([\"tools\"], prev);\n      }\n    },\n    [location.pathname, navigate, queryClient],\n  );\n\n  const startRename = useCallback((tool: Tool) => {\n    setMenuOpenId(null);\n    setRenameValue(tool.name);\n    setRenamingId(tool.id);\n  }, []);\n\n  const submitRename = useCallback(\n    async (toolId: string) => {\n      const trimmed = renameValue.trim();\n      setRenamingId(null);\n      if (!trimmed) return;\n      const prev = queryClient.getQueryData<Tool[]>([\"tools\"]);\n      const existing = prev?.find((t) => t.id === toolId);\n      if (!existing || trimmed === existing.name) return;\n      queryClient.setQueryData<Tool[]>([\"tools\"], (old) =>\n        (old ?? []).map((t) => (t.id === toolId ? { ...t, name: trimmed } : t)),\n      );\n      queryClient.setQueryData<Tool>([\"tool\", toolId], (old) =>\n        old ? { ...old, name: trimmed } : old,\n      );\n      try {\n        await fetch(agentNativePath(`/_agent-native/tools/${toolId}`), {\n          method: \"PUT\",\n          headers: { \"Content-Type\": \"application/json\" },\n          body: JSON.stringify({ name: trimmed }),\n        });\n        queryClient.invalidateQueries({ queryKey: [\"tools\"] });\n        queryClient.invalidateQueries({ queryKey: [\"tool\", toolId] });\n      } catch {\n        if (prev) queryClient.setQueryData([\"tools\"], prev);\n        queryClient.invalidateQueries({ queryKey: [\"tool\", toolId] });\n      }\n    },\n    [renameValue, queryClient],\n  );\n\n  // Close menu on click outside\n  useEffect(() => {\n    if (!menuOpenId) return;\n    const handler = () => setMenuOpenId(null);\n    document.addEventListener(\"click\", handler);\n    return () => document.removeEventListener(\"click\", handler);\n  }, [menuOpenId]);\n\n  const sortedTools = useMemo(() => {\n    if (!tools) return [];\n    const defaultSorted = [...tools].sort((a, b) => {\n      const aFav = favoriteIds.has(a.id) ? 0 : 1;\n      const bFav = favoriteIds.has(b.id) ? 0 : 1;\n      if (aFav !== bFav) return aFav - bFav;\n      return a.name.localeCompare(b.name);\n    });\n    return toolOrderState.length > 0\n      ? applyToolsOrder(defaultSorted, toolOrderState)\n      : defaultSorted;\n  }, [tools, favoriteIds, toolOrderState]);\n\n  const reorderTool = useCallback(\n    (activeId: string, overId: string) => {\n      if (activeId === overId) return;\n      const ids = sortedTools.map((tool) => tool.id);\n      const oldIndex = ids.indexOf(activeId);\n      const newIndex = ids.indexOf(overId);\n      if (oldIndex === -1 || newIndex === -1) return;\n      const next = [...ids];\n      const [moved] = next.splice(oldIndex, 1);\n      if (!moved) return;\n      next.splice(newIndex, 0, moved);\n      setToolsOrder(next);\n      setToolOrderState(next);\n    },\n    [sortedTools],\n  );\n\n  const handleCreate = (text: string) => {\n    const trimmed = text.trim();\n    if (!trimmed) return;\n    sendToAgentChat({\n      message: `Create a tool: ${trimmed}`,\n      submit: true,\n      openSidebar: true,\n      newTab: true,\n    });\n    setShowCreate(false);\n  };\n\n  return (\n    <div className=\"group/help relative min-w-0 py-2\">\n      <div\n        className={cn(\n          \"flex items-center justify-between px-3\",\n          sortedTools.length > 0 && \"mb-1\",\n        )}\n      >\n        <span className=\"inline-flex items-center gap-1.5 text-xs font-semibold uppercase tracking-wider text-muted-foreground\">\n          <IconTool className=\"h-3.5 w-3.5 shrink-0\" />\n          Tools\n          <a\n            href=\"https://agent-native.com/docs/tools\"\n            target=\"_blank\"\n            rel=\"noopener noreferrer\"\n            className=\"opacity-0 group-hover/help:opacity-100 transition-opacity text-muted-foreground/50 hover:text-muted-foreground\"\n            aria-label=\"Tools documentation\"\n          >\n            <IconHelpCircle className=\"h-3 w-3\" />\n          </a>\n        </span>\n        <Popover open={showCreate} onOpenChange={setShowCreate}>\n          <PopoverTrigger asChild>\n            <button\n              type=\"button\"\n              className=\"inline-flex h-5 w-5 cursor-pointer items-center justify-center rounded text-muted-foreground hover:bg-accent hover:text-accent-foreground\"\n              aria-label=\"New tool\"\n            >\n              <IconPlus className=\"h-3.5 w-3.5\" />\n            </button>\n          </PopoverTrigger>\n          <PopoverContent side=\"right\" align=\"start\" className=\"w-[420px] p-3\">\n            <p className=\"px-1 pb-2 text-sm font-semibold text-foreground\">\n              New tool\n            </p>\n            <PromptComposer\n              autoFocus\n              placeholder=\"Describe what you'd like to build...\"\n              draftScope=\"tools:sidebar-create\"\n              onSubmit={handleCreate}\n            />\n          </PopoverContent>\n        </Popover>\n      </div>\n\n      {isLoading ? (\n        <div className=\"min-w-0 space-y-0.5 px-1\">\n          {[1, 2, 3].map((i) => (\n            <div key={i} className=\"flex items-center rounded-md px-2 py-1.5\">\n              <div\n                className=\"h-3 rounded bg-muted animate-pulse\"\n                style={{ width: `${60 + i * 20}px` }}\n              />\n            </div>\n          ))}\n        </div>\n      ) : sortedTools.length === 0 ? null : (\n        <div className=\"min-w-0 space-y-0.5 px-1\">\n          {sortedTools.map((tool) => {\n            const isActive =\n              location.pathname === `/tools/${tool.id}` ||\n              location.pathname === `/tools/${tool.id}/edit`;\n            const isFav = favoriteIds.has(tool.id);\n            const isRenamingThis = renamingId === tool.id;\n            const actionsVisible = menuOpenId === tool.id || isRenamingThis;\n\n            return (\n              <div\n                key={tool.id}\n                onDragOver={(e) => {\n                  if (!draggingId || draggingId === tool.id) return;\n                  e.preventDefault();\n                  e.dataTransfer.dropEffect = \"move\";\n                  setDragOverId(tool.id);\n                }}\n                onDragLeave={() => {\n                  setDragOverId((current) =>\n                    current === tool.id ? null : current,\n                  );\n                }}\n                onDrop={(e) => {\n                  e.preventDefault();\n                  const activeId =\n                    draggingId || e.dataTransfer.getData(\"text/plain\");\n                  setDraggingId(null);\n                  setDragOverId(null);\n                  if (activeId) reorderTool(activeId, tool.id);\n                }}\n                className={cn(\n                  \"group/tool relative flex items-center min-w-0 rounded-md\",\n                  draggingId === tool.id && \"opacity-50\",\n                  dragOverId === tool.id &&\n                    draggingId !== tool.id &&\n                    \"bg-accent/60\",\n                )}\n              >\n                <button\n                  type=\"button\"\n                  draggable\n                  onDragStart={(e) => {\n                    setDraggingId(tool.id);\n                    setDragOverId(null);\n                    e.dataTransfer.effectAllowed = \"move\";\n                    e.dataTransfer.setData(\"text/plain\", tool.id);\n                  }}\n                  onDragEnd={() => {\n                    setDraggingId(null);\n                    setDragOverId(null);\n                  }}\n                  className=\"-ml-2 cursor-grab rounded p-0.5 text-muted-foreground/30 opacity-0 transition-colors hover:text-muted-foreground/70 active:cursor-grabbing group-hover/tool:opacity-100 group-focus-within/tool:opacity-100\"\n                  aria-label={`Reorder ${tool.name}`}\n                  title=\"Drag to reorder\"\n                >\n                  <IconGripVertical className=\"h-3 w-3\" />\n                </button>\n                <Link\n                  to={`/tools/${tool.id}`}\n                  className={cn(\n                    \"flex min-w-0 flex-1 items-center rounded-md px-2 py-1.5 pr-12 text-xs transition-[padding,color,background-color] md:pr-2 md:group-hover/tool:pr-12 md:group-focus-within/tool:pr-12\",\n                    actionsVisible && \"md:pr-12\",\n                    isActive\n                      ? \"bg-accent text-accent-foreground font-medium\"\n                      : \"text-muted-foreground hover:bg-accent/50 hover:text-accent-foreground\",\n                  )}\n                >\n                  {isRenamingThis ? (\n                    <input\n                      autoFocus\n                      value={renameValue}\n                      onChange={(e) => setRenameValue(e.target.value)}\n                      onBlur={() => submitRename(tool.id)}\n                      onKeyDown={(e) => {\n                        if (e.key === \"Enter\") submitRename(tool.id);\n                        if (e.key === \"Escape\") setRenamingId(null);\n                      }}\n                      onClick={(e) => {\n                        e.preventDefault();\n                        e.stopPropagation();\n                      }}\n                      className=\"min-w-0 flex-1 truncate border-b border-primary bg-transparent px-0 py-0 text-xs outline-none\"\n                    />\n                  ) : (\n                    <span className=\"block truncate\">{tool.name}</span>\n                  )}\n                </Link>\n\n                <div\n                  className={cn(\n                    \"pointer-events-none absolute right-1 top-1/2 flex -translate-y-1/2 items-center gap-0.5 opacity-100 transition-opacity md:opacity-0 md:group-hover/tool:opacity-100 md:group-focus-within/tool:opacity-100\",\n                    actionsVisible && \"md:opacity-100\",\n                  )}\n                >\n                  <button\n                    type=\"button\"\n                    onClick={(e) => {\n                      e.preventDefault();\n                      e.stopPropagation();\n                      toggleFavorite(tool.id);\n                    }}\n                    className={cn(\n                      \"pointer-events-auto cursor-pointer rounded p-0.5 transition-colors\",\n                      isFav\n                        ? \"text-yellow-500\"\n                        : \"text-muted-foreground/40 hover:text-yellow-500\",\n                    )}\n                    aria-label={isFav ? \"Unfavorite\" : \"Favorite\"}\n                  >\n                    {isFav ? (\n                      <IconStarFilled className=\"h-3 w-3\" />\n                    ) : (\n                      <IconStar className=\"h-3 w-3\" />\n                    )}\n                  </button>\n\n                  <div className=\"relative\">\n                    <button\n                      type=\"button\"\n                      onClick={(e) => {\n                        e.preventDefault();\n                        e.stopPropagation();\n                        setMenuOpenId(menuOpenId === tool.id ? null : tool.id);\n                      }}\n                      className=\"pointer-events-auto cursor-pointer rounded p-0.5 text-muted-foreground/40 transition-colors hover:text-foreground\"\n                      aria-label=\"Tool actions\"\n                    >\n                      <IconDots className=\"h-3 w-3\" />\n                    </button>\n\n                    {menuOpenId === tool.id && (\n                      <div\n                        className=\"absolute right-0 top-full z-50 mt-1 min-w-[120px] rounded-md border border-border bg-popover p-1 text-popover-foreground shadow-md\"\n                        onClick={(e) => e.stopPropagation()}\n                      >\n                        <button\n                          type=\"button\"\n                          onClick={() => startRename(tool)}\n                          className=\"flex w-full cursor-pointer items-center gap-2 rounded-sm px-2 py-1.5 text-sm hover:bg-accent\"\n                        >\n                          <IconPencil className=\"h-3.5 w-3.5\" />\n                          Rename\n                        </button>\n                        <button\n                          type=\"button\"\n                          onClick={() => handleDelete(tool.id)}\n                          className=\"flex w-full cursor-pointer items-center gap-2 rounded-sm px-2 py-1.5 text-sm text-destructive hover:bg-accent\"\n                        >\n                          <IconTrash className=\"h-3.5 w-3.5\" />\n                          Delete\n                        </button>\n                      </div>\n                    )}\n                  </div>\n                </div>\n              </div>\n            );\n          })}\n        </div>\n      )}\n    </div>\n  );\n}\n"]}

package/dist/client/tools/iframe-bridge.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Path allowlist for the tool postMessage bridge.
+ *
+ * Tools can only call paths under `/_agent-native/*` (the framework's own
+ * namespace). Template-defined `/api/*` routes are intentionally rejected:
+ * those routes are written by app authors who may not consistently apply the
+ * `accessFilter`/`assertAccess` access scoping helpers. A shared/org tool
+ * running with the viewer's session should not be able to reach surfaces
+ * outside the framework's own well-audited namespace.
+ *
+ * If a template needs a tool to reach a custom route, expose it via an
+ * action (`defineAction` auto-mounts under `/_agent-native/actions/<name>`).
+ */
+export declare function isAllowedToolPath(path: string, toolId: string): boolean;
+export declare function sanitizeToolRequestOptions(value: unknown): RequestInit;
+export type ToolBridgeRole = "owner" | "admin" | "editor" | "viewer";
+export interface BridgePolicyContext {
+    /** Resolved role of the viewer on this tool. */
+    role: ToolBridgeRole;
+    /** True when viewer is the tool's owner_email — equivalent to role "owner"
+     *  but cheaper to plumb through from the render binding. */
+    isAuthor: boolean;
+}
+export interface BridgePolicyResult {
+    ok: boolean;
+    /** Human-readable error to send back to the iframe when ok=false. */
+    error?: string;
+}
+/**
+ * Decide whether the iframe is allowed to proxy this request given the
+ * viewer's role on the tool. Authors (and owner/admin/editor in general)
+ * keep the full bridge surface; viewers get a strictly read-only subset.
+ *
+ * Called BEFORE the request leaves the parent — so a denial is local-only
+ * and never reveals server state to the iframe.
+ */
+export declare function checkBridgePolicy(path: string, method: string, ctx: BridgePolicyContext): BridgePolicyResult;
+//# sourceMappingURL=iframe-bridge.d.ts.map

package/dist/client/tools/iframe-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframe-bridge.d.ts","sourceRoot":"","sources":["../../../src/client/tools/iframe-bridge.ts"],"names":[],"mappings":"AAgCA;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAuCvE;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAiCtE;AAuCD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAIrE,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,IAAI,EAAE,cAAc,CAAC;IACrB;gEAC4D;IAC5D,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,mBAAmB,GACvB,kBAAkB,CAiFpB"}

package/dist/client/tools/iframe-bridge.js

@@ -0,0 +1,207 @@
+const ALLOWED_METHODS = new Set([
+    "GET",
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+    "HEAD",
+]);
+const BLOCKED_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "cookie",
+    "forwarded",
+    "host",
+    "keep-alive",
+    "origin",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "referer",
+    "set-cookie",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "x-forwarded-for",
+    "x-forwarded-host",
+    "x-forwarded-proto",
+]);
+const HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+/**
+ * Path allowlist for the tool postMessage bridge.
+ *
+ * Tools can only call paths under `/_agent-native/*` (the framework's own
+ * namespace). Template-defined `/api/*` routes are intentionally rejected:
+ * those routes are written by app authors who may not consistently apply the
+ * `accessFilter`/`assertAccess` access scoping helpers. A shared/org tool
+ * running with the viewer's session should not be able to reach surfaces
+ * outside the framework's own well-audited namespace.
+ *
+ * If a template needs a tool to reach a custom route, expose it via an
+ * action (`defineAction` auto-mounts under `/_agent-native/actions/<name>`).
+ */
+export function isAllowedToolPath(path, toolId) {
+    if (!path.startsWith("/") || path.startsWith("//"))
+        return false;
+    if (path.includes("\\") || path.includes("\0"))
+        return false;
+    let pathname;
+    try {
+        const parsed = new URL(path, "http://agent-native.local");
+        if (parsed.origin !== "http://agent-native.local")
+            return false;
+        pathname = parsed.pathname;
+    }
+    catch {
+        return false;
+    }
+    const rawPathname = path.split("?")[0].split("#")[0];
+    if (pathname !== rawPathname || pathname.includes(".."))
+        return false;
+    if (pathname.startsWith("/_agent-native/actions/"))
+        return true;
+    if (pathname.startsWith("/_agent-native/application-state/"))
+        return true;
+    if (pathname === "/_agent-native/tools/proxy")
+        return true;
+    if (pathname === "/_agent-native/tools/sql/query")
+        return true;
+    if (pathname === "/_agent-native/tools/sql/exec")
+        return true;
+    const parts = pathname.split("/");
+    if (parts.length >= 6 &&
+        parts.length <= 7 &&
+        parts[1] === "_agent-native" &&
+        parts[2] === "tools" &&
+        parts[3] === "data") {
+        try {
+            return decodeURIComponent(parts[4]) === toolId;
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+export function sanitizeToolRequestOptions(value) {
+    if (!value || typeof value !== "object")
+        return {};
+    const raw = value;
+    const method = typeof raw.method === "string" && raw.method.trim()
+        ? raw.method.toUpperCase()
+        : "GET";
+    if (!ALLOWED_METHODS.has(method)) {
+        throw new Error("Tool request method is not allowed");
+    }
+    const headers = raw.headers && typeof raw.headers === "object"
+        ? Object.fromEntries(Object.entries(raw.headers)
+            .filter(([key, val]) => isAllowedHeader(key) && val !== undefined)
+            .map(([key, val]) => [key, String(val)]))
+        : undefined;
+    const body = typeof raw.body === "string" ||
+        raw.body instanceof Blob ||
+        raw.body instanceof FormData
+        ? raw.body
+        : raw.body === undefined
+            ? undefined
+            : JSON.stringify(raw.body);
+    return {
+        method,
+        headers,
+        body: method === "GET" || method === "HEAD" ? undefined : body,
+    };
+}
+function isAllowedHeader(name) {
+    const lower = name.toLowerCase();
+    return HEADER_NAME_RE.test(name) && !BLOCKED_HEADERS.has(lower);
+}
+const READ_METHODS = new Set(["GET", "HEAD"]);
+/**
+ * Decide whether the iframe is allowed to proxy this request given the
+ * viewer's role on the tool. Authors (and owner/admin/editor in general)
+ * keep the full bridge surface; viewers get a strictly read-only subset.
+ *
+ * Called BEFORE the request leaves the parent — so a denial is local-only
+ * and never reveals server state to the iframe.
+ */
+export function checkBridgePolicy(path, method, ctx) {
+    // Authors and the highest non-owner roles get the unrestricted bridge.
+    if (ctx.isAuthor || ctx.role === "owner" || ctx.role === "admin") {
+        return { ok: true };
+    }
+    // Editors get write access EXCEPT for the helper-specific destructive
+    // operations the server still gates (the SQL blocklist + per-action
+    // toolCallable flag, see audit H5).
+    if (ctx.role === "editor") {
+        return { ok: true };
+    }
+    // From here on: role === "viewer". Lock down everything beyond reads.
+    const upperMethod = method.toUpperCase();
+    // SQL is denied for viewers entirely (defense-in-depth: dev mode bypasses
+    // the production scoping shim).
+    if (path === "/_agent-native/tools/sql/query") {
+        return {
+            ok: false,
+            error: deniedMessage("dbQuery", ctx.role),
+        };
+    }
+    if (path === "/_agent-native/tools/sql/exec") {
+        return {
+            ok: false,
+            error: deniedMessage("dbExec", ctx.role),
+        };
+    }
+    // Actions are denied entirely for viewers — even GET actions can mutate
+    // implicitly (e.g. "view" actions that create rows for analytics).
+    // toolCallable opt-in (audit H5) is enforced server-side as a second
+    // layer.
+    if (path.startsWith("/_agent-native/actions/")) {
+        return {
+            ok: false,
+            error: deniedMessage("appAction", ctx.role),
+        };
+    }
+    // Tool-data writes/deletes are denied; reads (GET/HEAD) are allowed.
+    // Match /_agent-native/tools/data/<toolId>/<collection>[/<itemId>].
+    if (path.startsWith("/_agent-native/tools/data/")) {
+        if (READ_METHODS.has(upperMethod))
+            return { ok: true };
+        return {
+            ok: false,
+            error: deniedMessage("toolData.set/remove", ctx.role),
+        };
+    }
+    // toolFetch — outbound proxy. POSTed JSON body carries the upstream method.
+    // The bridge can only see the path here, not the upstream method, so we
+    // restrict by REQUEST method (POST to /proxy carries the actual upstream
+    // method as { method: 'GET' | ... } in body). For viewers we pre-flight-
+    // deny the proxy unless a future code path emits a GET to /proxy/preview.
+    // In practice, toolFetch always POSTs to /proxy, so a viewer's toolFetch
+    // is denied entirely. Adapt this if /proxy gains a GET preview surface.
+    if (path === "/_agent-native/tools/proxy") {
+        return {
+            ok: false,
+            error: deniedMessage("toolFetch", ctx.role),
+        };
+    }
+    // application-state — viewers can read but not write.
+    if (path.startsWith("/_agent-native/application-state/")) {
+        if (READ_METHODS.has(upperMethod))
+            return { ok: true };
+        return {
+            ok: false,
+            error: deniedMessage("appFetch (mutation)", ctx.role),
+        };
+    }
+    // Generic appFetch — reads only for viewers.
+    if (READ_METHODS.has(upperMethod))
+        return { ok: true };
+    return {
+        ok: false,
+        error: deniedMessage("appFetch", ctx.role),
+    };
+}
+function deniedMessage(helper, role) {
+    return `Helper '${helper}' is not allowed for role '${role}' on this tool`;
+}
+//# sourceMappingURL=iframe-bridge.js.map

package/dist/client/tools/iframe-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframe-bridge.js","sourceRoot":"","sources":["../../../src/client/tools/iframe-bridge.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,WAAW;IACX,MAAM;IACN,YAAY;IACZ,QAAQ;IACR,oBAAoB;IACpB,qBAAqB;IACrB,SAAS;IACT,YAAY;IACZ,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,MAAc;IAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE7D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,2BAA2B;YAAE,OAAO,KAAK,CAAC;QAChE,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,IAAI,QAAQ,CAAC,UAAU,CAAC,yBAAyB,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,QAAQ,CAAC,UAAU,CAAC,mCAAmC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1E,IAAI,QAAQ,KAAK,4BAA4B;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,QAAQ,KAAK,gCAAgC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,QAAQ,KAAK,+BAA+B;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IACE,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe;QAC5B,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QACpB,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;QACjD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,CAAC,CAAC,KAAK,CAAC;IACZ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GACX,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC5C,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAkC,CAAC;aACnD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,SAAS,CAAC;aACjE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC3C;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,GAAG,CAAC,IAAI,YAAY,IAAI;QACxB,GAAG,CAAC,IAAI,YAAY,QAAQ;QAC1B,CAAC,CAAC,GAAG,CAAC,IAAI;QACV,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS;YACtB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEjC,OAAO;QACL,MAAM;QACN,OAAO;QACP,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAoCD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAgB9C;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAAc,EACd,GAAwB;IAExB,uEAAuE;IACvE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,oCAAoC;IACpC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,sEAAsE;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAEzC,0EAA0E;IAC1E,gCAAgC;IAChC,IAAI,IAAI,KAAK,gCAAgC,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;SAC1C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,+BAA+B,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,SAAS;IACT,IAAI,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAClD,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,CAAC,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,IAAI,IAAI,CAAC,UAAU,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACzD,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,CAAC,qBAAqB,EAAE,GAAG,CAAC,IAAI,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACvD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,IAAoB;IACzD,OAAO,WAAW,MAAM,8BAA8B,IAAI,gBAAgB,CAAC;AAC7E,CAAC","sourcesContent":["const ALLOWED_METHODS = new Set([\n  \"GET\",\n  \"POST\",\n  \"PUT\",\n  \"PATCH\",\n  \"DELETE\",\n  \"HEAD\",\n]);\n\nconst BLOCKED_HEADERS = new Set([\n  \"connection\",\n  \"content-length\",\n  \"cookie\",\n  \"forwarded\",\n  \"host\",\n  \"keep-alive\",\n  \"origin\",\n  \"proxy-authenticate\",\n  \"proxy-authorization\",\n  \"referer\",\n  \"set-cookie\",\n  \"te\",\n  \"trailer\",\n  \"transfer-encoding\",\n  \"upgrade\",\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n]);\n\nconst HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;\n\n/**\n * Path allowlist for the tool postMessage bridge.\n *\n * Tools can only call paths under `/_agent-native/*` (the framework's own\n * namespace). Template-defined `/api/*` routes are intentionally rejected:\n * those routes are written by app authors who may not consistently apply the\n * `accessFilter`/`assertAccess` access scoping helpers. A shared/org tool\n * running with the viewer's session should not be able to reach surfaces\n * outside the framework's own well-audited namespace.\n *\n * If a template needs a tool to reach a custom route, expose it via an\n * action (`defineAction` auto-mounts under `/_agent-native/actions/<name>`).\n */\nexport function isAllowedToolPath(path: string, toolId: string): boolean {\n  if (!path.startsWith(\"/\") || path.startsWith(\"//\")) return false;\n  if (path.includes(\"\\\\\") || path.includes(\"\\0\")) return false;\n\n  let pathname: string;\n  try {\n    const parsed = new URL(path, \"http://agent-native.local\");\n    if (parsed.origin !== \"http://agent-native.local\") return false;\n    pathname = parsed.pathname;\n  } catch {\n    return false;\n  }\n\n  const rawPathname = path.split(\"?\")[0].split(\"#\")[0];\n  if (pathname !== rawPathname || pathname.includes(\"..\")) return false;\n\n  if (pathname.startsWith(\"/_agent-native/actions/\")) return true;\n  if (pathname.startsWith(\"/_agent-native/application-state/\")) return true;\n\n  if (pathname === \"/_agent-native/tools/proxy\") return true;\n  if (pathname === \"/_agent-native/tools/sql/query\") return true;\n  if (pathname === \"/_agent-native/tools/sql/exec\") return true;\n\n  const parts = pathname.split(\"/\");\n  if (\n    parts.length >= 6 &&\n    parts.length <= 7 &&\n    parts[1] === \"_agent-native\" &&\n    parts[2] === \"tools\" &&\n    parts[3] === \"data\"\n  ) {\n    try {\n      return decodeURIComponent(parts[4]) === toolId;\n    } catch {\n      return false;\n    }\n  }\n\n  return false;\n}\n\nexport function sanitizeToolRequestOptions(value: unknown): RequestInit {\n  if (!value || typeof value !== \"object\") return {};\n  const raw = value as Record<string, unknown>;\n  const method =\n    typeof raw.method === \"string\" && raw.method.trim()\n      ? raw.method.toUpperCase()\n      : \"GET\";\n  if (!ALLOWED_METHODS.has(method)) {\n    throw new Error(\"Tool request method is not allowed\");\n  }\n\n  const headers =\n    raw.headers && typeof raw.headers === \"object\"\n      ? Object.fromEntries(\n          Object.entries(raw.headers as Record<string, unknown>)\n            .filter(([key, val]) => isAllowedHeader(key) && val !== undefined)\n            .map(([key, val]) => [key, String(val)]),\n        )\n      : undefined;\n  const body =\n    typeof raw.body === \"string\" ||\n    raw.body instanceof Blob ||\n    raw.body instanceof FormData\n      ? raw.body\n      : raw.body === undefined\n        ? undefined\n        : JSON.stringify(raw.body);\n\n  return {\n    method,\n    headers,\n    body: method === \"GET\" || method === \"HEAD\" ? undefined : body,\n  };\n}\n\nfunction isAllowedHeader(name: string): boolean {\n  const lower = name.toLowerCase();\n  return HEADER_NAME_RE.test(name) && !BLOCKED_HEADERS.has(lower);\n}\n\n// ---------------------------------------------------------------------------\n// Role-aware bridge gating (audit H4)\n// ---------------------------------------------------------------------------\n//\n// The host bridge dispatches every iframe postMessage request with the\n// viewer's session cookie. That means a non-author viewer's session can be\n// used to call mutating actions, write SQL, and resolve secret references —\n// the very capabilities that motivate the C1 consent step. After consent has\n// been granted, we still want defense-in-depth: a viewer whose role is\n// \"viewer\" should not be able to (e.g.) chain `appAction('share-resource')`\n// or run `dbExec` writes against their own data through someone else's tool.\n//\n// Role table (lowest tier first):\n//\n//   role     | appFetch        | toolFetch       | toolData       | dbQuery | dbExec | appAction\n//   ---------|-----------------|-----------------|----------------|---------|--------|----------\n//   viewer   | GET only        | GET only        | get/list only  |  deny   |  deny  |  deny\n//   editor   | all methods     | all methods     | get/list/set/  |  allow  | allow* |  allow\n//            |                 |                 | remove         |         |        |\n//   admin    | all methods     | all methods     | all            |  allow  | allow* |  allow\n//   owner    | all methods     | all methods     | all            |  allow  | allow* |  allow\n//\n//   * dbExec destructive operations are independently blocked by the SQL\n//     blocklist on the server (DROP / TRUNCATE / DELETE without WHERE etc).\n//     The role gate sits in front of that — viewers can't reach the SQL\n//     surface at all; editors and above hit the SQL gate as well.\n//\n// The SQL helpers are denied entirely for viewers (not just dbExec) because\n// the dbQuery surface in dev mode bypasses the production scoping shim and\n// can leak other users' rows in template tables that aren't in\n// SENSITIVE_SQL_RE.\n\nexport type ToolBridgeRole = \"owner\" | \"admin\" | \"editor\" | \"viewer\";\n\nconst READ_METHODS = new Set([\"GET\", \"HEAD\"]);\n\nexport interface BridgePolicyContext {\n  /** Resolved role of the viewer on this tool. */\n  role: ToolBridgeRole;\n  /** True when viewer is the tool's owner_email — equivalent to role \"owner\"\n   *  but cheaper to plumb through from the render binding. */\n  isAuthor: boolean;\n}\n\nexport interface BridgePolicyResult {\n  ok: boolean;\n  /** Human-readable error to send back to the iframe when ok=false. */\n  error?: string;\n}\n\n/**\n * Decide whether the iframe is allowed to proxy this request given the\n * viewer's role on the tool. Authors (and owner/admin/editor in general)\n * keep the full bridge surface; viewers get a strictly read-only subset.\n *\n * Called BEFORE the request leaves the parent — so a denial is local-only\n * and never reveals server state to the iframe.\n */\nexport function checkBridgePolicy(\n  path: string,\n  method: string,\n  ctx: BridgePolicyContext,\n): BridgePolicyResult {\n  // Authors and the highest non-owner roles get the unrestricted bridge.\n  if (ctx.isAuthor || ctx.role === \"owner\" || ctx.role === \"admin\") {\n    return { ok: true };\n  }\n\n  // Editors get write access EXCEPT for the helper-specific destructive\n  // operations the server still gates (the SQL blocklist + per-action\n  // toolCallable flag, see audit H5).\n  if (ctx.role === \"editor\") {\n    return { ok: true };\n  }\n\n  // From here on: role === \"viewer\". Lock down everything beyond reads.\n  const upperMethod = method.toUpperCase();\n\n  // SQL is denied for viewers entirely (defense-in-depth: dev mode bypasses\n  // the production scoping shim).\n  if (path === \"/_agent-native/tools/sql/query\") {\n    return {\n      ok: false,\n      error: deniedMessage(\"dbQuery\", ctx.role),\n    };\n  }\n  if (path === \"/_agent-native/tools/sql/exec\") {\n    return {\n      ok: false,\n      error: deniedMessage(\"dbExec\", ctx.role),\n    };\n  }\n\n  // Actions are denied entirely for viewers — even GET actions can mutate\n  // implicitly (e.g. \"view\" actions that create rows for analytics).\n  // toolCallable opt-in (audit H5) is enforced server-side as a second\n  // layer.\n  if (path.startsWith(\"/_agent-native/actions/\")) {\n    return {\n      ok: false,\n      error: deniedMessage(\"appAction\", ctx.role),\n    };\n  }\n\n  // Tool-data writes/deletes are denied; reads (GET/HEAD) are allowed.\n  // Match /_agent-native/tools/data/<toolId>/<collection>[/<itemId>].\n  if (path.startsWith(\"/_agent-native/tools/data/\")) {\n    if (READ_METHODS.has(upperMethod)) return { ok: true };\n    return {\n      ok: false,\n      error: deniedMessage(\"toolData.set/remove\", ctx.role),\n    };\n  }\n\n  // toolFetch — outbound proxy. POSTed JSON body carries the upstream method.\n  // The bridge can only see the path here, not the upstream method, so we\n  // restrict by REQUEST method (POST to /proxy carries the actual upstream\n  // method as { method: 'GET' | ... } in body). For viewers we pre-flight-\n  // deny the proxy unless a future code path emits a GET to /proxy/preview.\n  // In practice, toolFetch always POSTs to /proxy, so a viewer's toolFetch\n  // is denied entirely. Adapt this if /proxy gains a GET preview surface.\n  if (path === \"/_agent-native/tools/proxy\") {\n    return {\n      ok: false,\n      error: deniedMessage(\"toolFetch\", ctx.role),\n    };\n  }\n\n  // application-state — viewers can read but not write.\n  if (path.startsWith(\"/_agent-native/application-state/\")) {\n    if (READ_METHODS.has(upperMethod)) return { ok: true };\n    return {\n      ok: false,\n      error: deniedMessage(\"appFetch (mutation)\", ctx.role),\n    };\n  }\n\n  // Generic appFetch — reads only for viewers.\n  if (READ_METHODS.has(upperMethod)) return { ok: true };\n  return {\n    ok: false,\n    error: deniedMessage(\"appFetch\", ctx.role),\n  };\n}\n\nfunction deniedMessage(helper: string, role: ToolBridgeRole): string {\n  return `Helper '${helper}' is not allowed for role '${role}' on this tool`;\n}\n"]}