@agentdocumentformat/cli 0.7.8 → 0.8.0

package/dist/chunks/chunk-HBOFZRUS.mjs

@@ -0,0 +1,738 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  external_exports
+} from "./chunk-ZJKXHM4Q.mjs";
+import {
+  __export
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/main/utils/ssrf-guard.ts
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { networkInterfaces } from "node:os";
+function embeddedIPv4s(raw) {
+  let addr = raw.replace(/^\[|\]$/g, "").split("%")[0].toLowerCase(), tail = /^(.*:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(addr);
+  if (tail) {
+    let o = tail.slice(2, 6).map(Number);
+    if (o.some((n) => n > 255)) return [];
+    addr = `${tail[1]}${(o[0] << 8 | o[1]).toString(16)}:${(o[2] << 8 | o[3]).toString(16)}`;
+  }
+  if (isIP(addr) !== 6) return [];
+  let g = expandIPv6(addr).split(":").map((x) => parseInt(x, 16)), hi = (x) => x >> 8, lo = (x) => x & 255, quad = (a, b, c, d) => `${a}.${b}.${c}.${d}`, fromGroups = (x, y) => quad(hi(x), lo(x), hi(y), lo(y)), out = [], zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 4) && (g[4] === 0 && (g[5] === 0 && g[6] !== 0 || g[5] === 65535) || g[4] === 65535 && g[5] === 0) && out.push(fromGroups(g[6], g[7])), g[0] === 100 && g[1] === 65435 && zero(2, 6) && out.push(fromGroups(g[6], g[7])), g[0] === 100 && g[1] === 65435 && g[2] === 1) {
+    let local = [];
+    hi(g[4]) === 0 && (lo(g[5]) === 0 && zero(6, 8) && local.push(quad(hi(g[3]), lo(g[3]), lo(g[4]), hi(g[5]))), zero(6, 8) && local.push(quad(lo(g[3]), lo(g[4]), hi(g[5]), lo(g[5]))), lo(g[6]) === 0 && g[7] === 0 && local.push(quad(lo(g[4]), hi(g[5]), lo(g[5]), hi(g[6]))), g[6] === 0 && g[7] === 0 && local.length > 0 || local.push(fromGroups(g[6], g[7]))), out.push(...local);
+  }
+  return g[0] === 8194 && out.push(fromGroups(g[1], g[2])), g[0] === 8193 && g[1] === 0 && out.push(fromGroups(g[6] ^ 65535, g[7] ^ 65535)), (g[4] === 0 || g[4] === 512) && g[5] === 24318 && out.push(fromGroups(g[6], g[7])), [...new Set(out)];
+}
+var ALLOWED_FETCH_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]), ALLOWED_CONNECT_PROTOCOLS = /* @__PURE__ */ new Set(["ws:", "wss:", "http:", "https:"]), METADATA_IPV4 = /* @__PURE__ */ new Set([
+  "169.254.169.254",
+  // AWS, GCP, Azure IMDS, OCI, DigitalOcean, …
+  "169.254.170.2",
+  // AWS ECS task credentials
+  "169.254.170.23",
+  // AWS EKS Pod Identity agent
+  "100.100.100.200",
+  // Alibaba Cloud metadata
+  "168.63.129.16",
+  // Azure WireServer (host agent, platform keys)
+  "192.0.0.192"
+  // Oracle Cloud (OCI) metadata
+]), METADATA_IPV6 = /* @__PURE__ */ new Set(["fd00:0ec2:0000:0000:0000:0000:0000:0254", "fd00:0ec2:0000:0000:0000:0000:0000:0023"]);
+function isCloudMetadataIp(ip) {
+  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0].toLowerCase(), version = isIP(bare);
+  return version === 4 ? METADATA_IPV4.has(bare) : version === 6 ? embeddedIPv4s(bare).some((v4) => METADATA_IPV4.has(v4)) ? !0 : METADATA_IPV6.has(expandIPv6(bare)) : !1;
+}
+function expandIPv6(addr) {
+  let [head, tail] = addr.includes("::") ? addr.split("::") : [addr, ""], left = head ? head.split(":") : [], right = tail ? tail.split(":") : [], fill = addr.includes("::") ? Array(Math.max(0, 8 - left.length - right.length)).fill("0") : [];
+  return [...left, ...fill, ...right].map((g) => g.padStart(4, "0")).join(":");
+}
+function parseLooseIPv4(host) {
+  let parts = host.split(".");
+  if (parts.length < 1 || parts.length > 4) return null;
+  let nums = [];
+  for (let part of parts) {
+    if (part === "") return null;
+    let n;
+    if (/^0[xX][0-9a-fA-F]+$/.test(part)) n = parseInt(part.slice(2), 16);
+    else if (/^0[0-7]+$/.test(part)) n = parseInt(part.slice(1), 8);
+    else if (/^[0-9]+$/.test(part)) n = parseInt(part, 10);
+    else return null;
+    if (!Number.isFinite(n) || n < 0) return null;
+    nums.push(n);
+  }
+  for (let i = 0; i < nums.length - 1; i++) if (nums[i] > 255) return null;
+  let last = nums[nums.length - 1];
+  if (last >= Math.pow(256, 4 - nums.length + 1)) return null;
+  let value = last;
+  for (let i = 0; i < nums.length - 1; i++) value += nums[i] * Math.pow(256, 3 - i);
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function isBlockedIPv4(ip) {
+  let o = ip.split(".").map(Number);
+  if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return !1;
+  let [a, b, c] = o;
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 && c === 0 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a >= 224;
+}
+function isBlockedIPv6(raw) {
+  let addr = raw.toLowerCase().replace(/^\[|\]$/g, "").split("%")[0];
+  if (addr === "::" || addr === "::1" || /^(0:){7}[01]$/.test(addr) || embeddedIPv4s(addr).some(isBlockedIPv4)) return !0;
+  let head = addr.split(":")[0];
+  if (!head) return !1;
+  let h = parseInt(head, 16);
+  return Number.isNaN(h) ? !1 : (h & 65472) === 65152 || (h & 65024) === 64512 || (h & 65280) === 65280;
+}
+function isBlockedIpAddress(ip) {
+  let version = isIP(ip.replace(/^\[|\]$/g, ""));
+  return version === 4 ? isBlockedIPv4(ip) : version === 6 ? isBlockedIPv6(ip) : !1;
+}
+function isLinkLocalIp(ip) {
+  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0], version = isIP(bare);
+  if (version === 4) {
+    let o = bare.split(".").map(Number);
+    return o[0] === 169 && o[1] === 254;
+  }
+  if (version === 6) {
+    let addr = bare.toLowerCase();
+    if (embeddedIPv4s(addr).some((v4) => v4.startsWith("169.254."))) return !0;
+    let head = addr.split(":")[0], h = parseInt(head, 16);
+    return Number.isNaN(h) ? !1 : (h & 65472) === 65152;
+  }
+  return !1;
+}
+function isLoopbackIp(ip) {
+  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0], version = isIP(bare);
+  if (version === 4) return bare.split(".").map(Number)[0] === 127;
+  if (version === 6) {
+    let addr = bare.toLowerCase();
+    return addr === "::1" || /^(0:){7}1$/.test(addr) ? !0 : embeddedIPv4s(addr).some((v4) => v4.startsWith("127."));
+  }
+  return !1;
+}
+function isLoopbackHostname(host) {
+  let h = host.toLowerCase().replace(/\.$/, "");
+  return h === "localhost" || h === "localhost.localdomain" || h.endsWith(".localhost");
+}
+function isUnspecifiedIp(ip) {
+  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0].toLowerCase();
+  return bare === "0.0.0.0" || bare === "::" || /^(0{1,4}:){7}0{1,4}$/.test(bare) ? !0 : embeddedIPv4s(bare).includes("0.0.0.0");
+}
+function blockedMessage(target) {
+  return `Blocked by the sys_fetch SSRF guard: "${target}" is a private-network address (loopback is allowed by default). Set security.allow_local_fetch: true in your config to permit private/LAN fetches \u2014 an agent-initiated write to that setting raises an owner approval request.`;
+}
+function connectBlockedMessage(target) {
+  return `Blocked by the ws_connect SSRF guard: "${target}" is a private-network address (loopback is allowed by default). Set security.allow_local_fetch: true in your config to permit private/LAN connections \u2014 an agent-initiated write to that setting raises an owner approval request.`;
+}
+function comparableIps(ip) {
+  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0].toLowerCase(), version = isIP(bare);
+  if (version === 4) return [bare];
+  if (version !== 6) return [];
+  let v4s = embeddedIPv4s(bare);
+  return bare.includes(".") ? v4s : [expandIPv6(bare), ...v4s];
+}
+var OWN_ADDRESSES_TTL_MS = 3e4, ownAddressCache = null;
+function isOwnInterfaceIp(ip, now = Date.now()) {
+  if (!ownAddressCache || now - ownAddressCache.at > OWN_ADDRESSES_TTL_MS) {
+    let set = /* @__PURE__ */ new Set();
+    try {
+      for (let list of Object.values(networkInterfaces()))
+        for (let entry of list ?? [])
+          for (let c of comparableIps(entry.address)) set.add(c);
+    } catch {
+    }
+    ownAddressCache = { at: now, set };
+  }
+  return comparableIps(ip).some((c) => ownAddressCache.set.has(c));
+}
+function envProxyEnabled(env = process.env, execArgv = process.execArgv) {
+  return env.NODE_USE_ENV_PROXY === "1" || execArgv.includes("--use-env-proxy") ? !0 : (env.NODE_OPTIONS ?? "").split(/\s+/).includes("--use-env-proxy");
+}
+function envProxyFor(target, env = process.env, execArgv = process.execArgv) {
+  if (!envProxyEnabled(env, execArgv)) return null;
+  let url;
+  try {
+    url = typeof target == "string" ? new URL(target) : target;
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  let httpProxy = env.http_proxy || env.HTTP_PROXY || "", proxy = url.protocol === "https:" && (env.https_proxy || env.HTTPS_PROXY) || httpProxy;
+  if (!proxy) return null;
+  let noProxy = (env.no_proxy ?? env.NO_PROXY ?? "").trim();
+  if (noProxy === "*") return null;
+  let host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase(), port = url.port || (url.protocol === "https:" ? "443" : "80");
+  for (let raw of noProxy.split(/[,\s]+/)) {
+    if (!raw) continue;
+    let m = /^(.*?)(?::(\d+))?$/.exec(raw.toLowerCase()), entryHost = m[1].replace(/^\[|\]$/g, "");
+    if (!(m[2] && m[2] !== port)) {
+      if (/^[.*]/.test(entryHost)) {
+        if (host.endsWith(entryHost.replace(/^\*/, "")))
+          return null;
+      } else if (host === entryHost) return null;
+    }
+  }
+  return proxy;
+}
+var proxySkipLogged = !1, PROXY_RESOLVES = /* @__PURE__ */ new Set(["ENOTFOUND", "EAI_AGAIN"]);
+function proxiedHostName(url, host) {
+  if (isIP(host) || isLoopbackHostname(host) || parseLooseIPv4(host)) return !1;
+  let proxy = envProxyFor(url);
+  if (!proxy) return !1;
+  if (!proxySkipLogged) {
+    proxySkipLogged = !0;
+    let via = proxy;
+    try {
+      via = new URL(proxy).host;
+    } catch {
+    }
+    console.log(`[Egress] The env proxy is on and this machine cannot look up ${url.hostname}: it is left to the proxy (${via}) to resolve, unchecked (logged once)`);
+  }
+  return !0;
+}
+function unresolvedMessage(target, reason) {
+  return `Blocked: the address of "${target}" could not be looked up (${reason}), so the egress guard could not check it. Check the host name and the network.`;
+}
+async function classifyHost(host) {
+  let literal = classifyLiteralHost(host);
+  if (literal) return literal;
+  let candidates;
+  try {
+    candidates = (await lookup(host, { all: !0, verbatim: !0 })).map((a) => a.address);
+  } catch (err) {
+    return { unresolved: err?.code ?? (err instanceof Error ? err.message : String(err)) };
+  }
+  return candidates.length === 0 ? { unresolved: "no addresses" } : classifyCandidates(candidates, !1);
+}
+function classifyLiteralHost(host) {
+  if (isIP(host)) return classifyCandidates([host], !1);
+  if (isLoopbackHostname(host)) return classifyCandidates([], !0);
+  let loose = parseLooseIPv4(host);
+  return loose ? classifyCandidates([loose], !1) : null;
+}
+function classifyCandidates(candidates, loopbackHost) {
+  return {
+    anyMetadata: candidates.some(isCloudMetadataIp),
+    anyLinkLocal: candidates.some(isLinkLocalIp),
+    anyLoopback: loopbackHost || candidates.some(isLoopbackIp),
+    anyUnspecified: candidates.some(isUnspecifiedIp),
+    anyOwnAddress: candidates.some((ip) => isOwnInterfaceIp(ip)),
+    // Blocked classes minus loopback (private, CGNAT, unspecified, multicast, …)
+    // — loopback itself is allowed by default and only tier-gated per-port.
+    // Each IPv4 reading of an address counts on its own: one reading being
+    // loopback must not let another, private one through.
+    anyNonLoopbackBlocked: candidates.flatMap((ip) => [ip, ...embeddedIPv4s(ip)]).some((ip) => isBlockedIpAddress(ip) && !isLoopbackIp(ip))
+  };
+}
+function applyPolicy(target, port, path, cls, opts, overridableMessage) {
+  return cls.anyMetadata ? `Blocked: "${target}" is a link-local / cloud-metadata address, which is never fetchable (even with allow_local_fetch).` : cls.anyLinkLocal && !opts.allowLinkLocal ? `Blocked: "${target}" is a link-local / cloud-metadata address, which is never fetchable (even with allow_local_fetch).` : (cls.anyLoopback || cls.anyUnspecified || cls.anyOwnAddress) && opts.daemonPort && port === opts.daemonPort ? `Blocked: "${target}" (port ${port}) is the local ADF daemon control API, which is never fetchable, even with allow_local_fetch.` : opts.ownOrigin && cls.anyLoopback && port === opts.ownOrigin.port && path.startsWith(opts.ownOrigin.pathPrefix) || opts.allowLocal ? null : cls.anyNonLoopbackBlocked ? overridableMessage(target) : null;
+}
+async function checkFetchTarget(rawUrl, opts = { allowLocal: !1 }) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return `Invalid URL: ${rawUrl}`;
+  }
+  if (!ALLOWED_FETCH_PROTOCOLS.has(url.protocol))
+    return `Blocked by the sys_fetch guard: only http and https URLs may be fetched (got "${url.protocol}").`;
+  let host = url.hostname.replace(/^\[|\]$/g, "");
+  if (!host) return `Invalid URL: ${rawUrl}`;
+  let port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80, cls = await classifyHost(host);
+  return "unresolved" in cls ? PROXY_RESOLVES.has(cls.unresolved) && proxiedHostName(url, host) ? null : unresolvedMessage(url.hostname, cls.unresolved) : applyPolicy(url.hostname, port, url.pathname, cls, opts, blockedMessage);
+}
+function checkLiteralConnectTarget(rawUrl, opts = { allowLocal: !1 }) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return `Invalid URL: ${rawUrl}`;
+  }
+  if (!ALLOWED_CONNECT_PROTOCOLS.has(url.protocol))
+    return `Blocked by the ws_connect guard: only ws, wss, http and https URLs may be connected (got "${url.protocol}").`;
+  let host = url.hostname.replace(/^\[|\]$/g, "");
+  if (!host) return `Invalid URL: ${rawUrl}`;
+  let cls = classifyLiteralHost(host);
+  if (!cls) return;
+  let secure = url.protocol === "wss:" || url.protocol === "https:", port = url.port ? Number(url.port) : secure ? 443 : 80;
+  return applyPolicy(url.hostname, port, url.pathname, cls, opts, connectBlockedMessage);
+}
+async function checkConnectTarget(rawUrl, opts = { allowLocal: !1 }) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return `Invalid URL: ${rawUrl}`;
+  }
+  if (!ALLOWED_CONNECT_PROTOCOLS.has(url.protocol))
+    return `Blocked by the ws_connect guard: only ws, wss, http and https URLs may be connected (got "${url.protocol}").`;
+  let host = url.hostname.replace(/^\[|\]$/g, "");
+  if (!host) return `Invalid URL: ${rawUrl}`;
+  let secure = url.protocol === "wss:" || url.protocol === "https:", port = url.port ? Number(url.port) : secure ? 443 : 80, cls = await classifyHost(host);
+  return "unresolved" in cls ? unresolvedMessage(url.hostname, cls.unresolved) : applyPolicy(url.hostname, port, url.pathname, cls, opts, connectBlockedMessage);
+}
+
+// src/main/utils/guarded-fetch.ts
+var guarded_fetch_exports = {};
+__export(guarded_fetch_exports, {
+  DEFAULT_DAEMON_PORT: () => DEFAULT_DAEMON_PORT,
+  MAX_FETCH_REDIRECTS: () => MAX_FETCH_REDIRECTS,
+  MCP_HTTP_EGRESS: () => MCP_HTTP_EGRESS,
+  addressCheck: () => addressCheck,
+  daemonGuardPort: () => daemonGuardPort,
+  egressFetch: () => egressFetch,
+  guardedFetch: () => guardedFetch,
+  guardedLookup: () => guardedLookup,
+  isFetchFailure: () => isFetchFailure,
+  pinnedFetch: () => pinnedFetch
+});
+import { lookup as dnsLookup } from "node:dns/promises";
+import { Agent as HttpAgent, request as httpRequest } from "node:http";
+import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
+import { pipeline, Readable } from "node:stream";
+import { constants as zlibConstants, createBrotliDecompress, createGunzip, createInflate } from "node:zlib";
+var NATIVE_FETCH = globalThis.fetch;
+function guardedLookup(check) {
+  return ((hostname, options, callback) => {
+    (async () => {
+      let addresses = await dnsLookup(hostname, { all: !0, verbatim: !0 });
+      if (addresses.length === 0) throw Object.assign(new Error(`No address for ${hostname}`), { code: "ENOTFOUND" });
+      for (let entry of addresses) {
+        let refusal = await check(entry.address);
+        if (refusal) throw Object.assign(new Error(refusal), { code: "EGUARD" });
+      }
+      return addresses;
+    })().then((addresses) => {
+      options?.all ? callback(null, addresses) : callback(null, addresses[0].address, addresses[0].family);
+    }, (err) => callback(err));
+  });
+}
+var NULL_BODY = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function addressCheck(target, guard, kind = "fetch") {
+  let secure = target.protocol === "https:" || target.protocol === "wss:", port = target.port || (secure ? "443" : "80"), check = kind === "connect" ? checkConnectTarget : checkFetchTarget;
+  return (address) => {
+    let literal = address.includes(":") ? `[${address}]` : address;
+    return check(`${target.protocol}//${literal}:${port}${target.pathname}`, guard);
+  };
+}
+function pinnedGet(url, signal, guard) {
+  let target = new URL(url), check = addressCheck(target, guard), send = target.protocol === "https:" ? httpsRequest : httpRequest;
+  return new Promise((resolve, reject) => {
+    let req = send(target, { method: "GET", signal, lookup: guardedLookup(check) }, (res) => {
+      let headers = new Headers();
+      for (let [name, value] of Object.entries(res.headers))
+        if (value !== void 0)
+          for (let one of Array.isArray(value) ? value : [value]) headers.append(name, one);
+      let status = res.statusCode ?? 502;
+      NULL_BODY.has(status) && res.resume(), resolve(new Response(NULL_BODY.has(status) ? null : Readable.toWeb(res), { status, headers }));
+    });
+    req.on("error", reject), req.end();
+  });
+}
+var REDIRECTS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]), MAX_FOLLOWED_REDIRECTS = 20, pinnedAgents = /* @__PURE__ */ new Map();
+function pinnedAgent(protocol, guard) {
+  let key = `${protocol}|${JSON.stringify(guard, Object.keys(guard).sort())}|${JSON.stringify(guard.ownOrigin ?? null)}`, agent = pinnedAgents.get(key);
+  return agent || (agent = protocol === "https:" ? new HttpsAgent({ keepAlive: !0 }) : new HttpAgent({ keepAlive: !0 }), pinnedAgents.set(key, agent)), agent;
+}
+function decodedBody(res) {
+  let encodings = String(res.headers["content-encoding"] ?? "").toLowerCase().split(",").map((e) => e.trim()).filter(Boolean), decoders = [];
+  for (let encoding of encodings.reverse())
+    if (encoding === "gzip" || encoding === "x-gzip") decoders.push(createGunzip({ flush: zlibConstants.Z_SYNC_FLUSH, finishFlush: zlibConstants.Z_SYNC_FLUSH }));
+    else if (encoding === "deflate") decoders.push(createInflate({ flush: zlibConstants.Z_SYNC_FLUSH, finishFlush: zlibConstants.Z_SYNC_FLUSH }));
+    else if (encoding === "br") decoders.push(createBrotliDecompress({ flush: zlibConstants.BROTLI_OPERATION_FLUSH, finishFlush: zlibConstants.BROTLI_OPERATION_FLUSH }));
+    else if (encoding !== "identity") return res;
+  return decoders.length === 0 ? res : pipeline([res, ...decoders], () => {
+  });
+}
+function abortReason(signal) {
+  return signal.reason ?? new DOMException("This operation was aborted", "AbortError");
+}
+function pinnedRequest(url, method, headers, body, signal, guard) {
+  let sent = {};
+  headers.forEach((value, name) => {
+    sent[name] = value;
+  }), sent.accept ??= "*/*", sent["user-agent"] ??= "node", sent["accept-encoding"] ??= "gzip, deflate, br", body && (sent["content-length"] = String(body.length));
+  let send = url.protocol === "https:" ? httpsRequest : httpRequest;
+  return new Promise((resolve, reject) => {
+    let res = null, onAbort = () => {
+      let reason = abortReason(signal);
+      res && res.destroy(reason), req.destroy(reason);
+    }, req = send(url, {
+      method,
+      headers: sent,
+      agent: pinnedAgent(url.protocol, guard),
+      lookup: guardedLookup(addressCheck(url, guard))
+    }, (incoming) => {
+      res = incoming, res.once("close", () => signal.removeEventListener("abort", onAbort));
+      let responseHeaders = new Headers();
+      for (let [name, value] of Object.entries(res.headers))
+        if (value !== void 0)
+          for (let one of Array.isArray(value) ? value : [value]) responseHeaders.append(name, one);
+      let status = res.statusCode ?? 502, empty = NULL_BODY.has(status) || method === "HEAD";
+      empty && res.resume();
+      let response = new Response(empty ? null : Readable.toWeb(decodedBody(res)), {
+        status,
+        statusText: res.statusMessage ?? "",
+        headers: responseHeaders
+      });
+      Object.defineProperty(response, "url", { value: url.toString() }), resolve(response);
+    });
+    signal.addEventListener("abort", onAbort, { once: !0 }), req.on("error", (err) => {
+      res || signal.removeEventListener("abort", onAbort), signal.aborted ? reject(abortReason(signal)) : err.code === "EGUARD" ? reject(new Error(err.message)) : reject(new TypeError("fetch failed", { cause: err }));
+    }), req.end(body ?? void 0);
+  });
+}
+function pinnedFetch(guard, opts = {}) {
+  return (async (input, init) => {
+    let policy = typeof guard == "function" ? guard() : guard, request = new Request(input, init?.body != null ? { ...init, duplex: "half" } : init), signal = request.signal, stopIfAborted = () => {
+      if (signal.aborted) throw abortReason(signal);
+    };
+    stopIfAborted();
+    let url = new URL(request.url), method = request.method, headers = new Headers(request.headers), body = request.body ? Buffer.from(await request.arrayBuffer()) : null;
+    for (let hop = 0; ; hop++) {
+      stopIfAborted();
+      let refusal = await checkFetchTarget(url.toString(), policy);
+      if (stopIfAborted(), refusal) throw new Error(refusal);
+      let viaFetch = (opts.useReplacedFetch && globalThis.fetch !== NATIVE_FETCH ? globalThis.fetch : null) ?? (envProxyFor(url) ? NATIVE_FETCH : null), response = viaFetch ? await viaFetch(url, { method, headers, ...body ? { body } : {}, signal, redirect: "manual" }) : await pinnedRequest(url, method, headers, body, signal, policy);
+      if (signal.aborted) {
+        try {
+          await response.body?.cancel();
+        } catch {
+        }
+        throw abortReason(signal);
+      }
+      let location = response.headers.get("location");
+      if (!REDIRECTS.has(response.status) || !location || request.redirect === "manual") return response;
+      try {
+        await response.body?.cancel();
+      } catch {
+      }
+      if (stopIfAborted(), request.redirect === "error") throw new TypeError("fetch failed", { cause: new Error(`unexpected redirect to ${location}`) });
+      if (hop >= MAX_FOLLOWED_REDIRECTS) throw new TypeError("fetch failed", { cause: new Error("redirect count exceeded") });
+      let next = new URL(location, url);
+      if (response.status === 303 ? method !== "GET" && method !== "HEAD" : (response.status === 301 || response.status === 302) && method === "POST") {
+        method = "GET", body = null;
+        for (let name of ["content-type", "content-length", "content-encoding", "content-language", "content-location"]) headers.delete(name);
+      }
+      if (next.origin !== url.origin) for (let name of ["authorization", "proxy-authorization", "cookie"]) headers.delete(name);
+      url = next;
+    }
+  });
+}
+function egressFetch(guard) {
+  return pinnedFetch(guard, { useReplacedFetch: !0 });
+}
+var DEFAULT_DAEMON_PORT = 7385, MAX_FETCH_REDIRECTS = 3;
+function daemonGuardPort() {
+  return Number(process.env.ADF_DAEMON_PORT) || DEFAULT_DAEMON_PORT;
+}
+var MCP_HTTP_EGRESS = () => ({ allowLocal: !0, allowLinkLocal: !0, daemonPort: daemonGuardPort() });
+function isFetchFailure(result) {
+  return "error" in result;
+}
+async function readCapped(response, maxBytes) {
+  let body = response.body;
+  if (!body) return Buffer.alloc(0);
+  if (typeof body.getReader != "function") {
+    let bytes = Buffer.from(new Uint8Array(await response.arrayBuffer()));
+    return bytes.length > maxBytes ? { error: `exceeds ${maxBytes} bytes` } : bytes;
+  }
+  let reader = body.getReader(), chunks = [], total = 0;
+  for (; ; ) {
+    let { done, value } = await reader.read();
+    if (done) break;
+    if (value) {
+      if (total += value.byteLength, total > maxBytes) {
+        try {
+          await reader.cancel();
+        } catch {
+        }
+        return { error: `exceeds ${maxBytes} bytes` };
+      }
+      chunks.push(Buffer.from(value));
+    }
+  }
+  return Buffer.concat(chunks);
+}
+async function guardedFetch(url, options) {
+  let { maxBytes, timeoutMs } = options, maxRedirects = options.maxRedirects ?? MAX_FETCH_REDIRECTS, daemonPort = daemonGuardPort(), current;
+  try {
+    current = new URL(url).toString();
+  } catch {
+    return { error: `invalid URL: ${String(url).slice(0, 200)}` };
+  }
+  let controller = new AbortController(), timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    for (let hop = 0; ; hop++) {
+      let protocol = new URL(current).protocol;
+      if (protocol !== "https:" && !(options.allowHttp && protocol === "http:"))
+        return { error: `only ${options.allowHttp ? "http(s)" : "https"} URLs may be fetched (got "${protocol}")` };
+      let guard = { allowLocal: options.allowLocal === !0, daemonPort, ...options.allowLinkLocal ? { allowLinkLocal: !0 } : {} }, blocked = await checkFetchTarget(current, guard);
+      if (blocked) return { error: blocked };
+      let response = globalThis.fetch === NATIVE_FETCH && !envProxyFor(current) ? await pinnedGet(current, controller.signal, guard) : await fetch(current, { signal: controller.signal, redirect: "manual" });
+      if (response.status >= 300 && response.status <= 399) {
+        let location = response.headers.get("location");
+        if (!location) return { error: `redirect without a location header (HTTP ${response.status})` };
+        if (hop >= maxRedirects) return { error: `too many redirects (>${maxRedirects})` };
+        try {
+          await response.body?.cancel();
+        } catch {
+        }
+        try {
+          current = new URL(location, current).toString();
+        } catch {
+          return { error: `redirect to an unusable location: ${location.slice(0, 200)}` };
+        }
+        continue;
+      }
+      if (!response.ok) return { error: `HTTP ${response.status} ${response.statusText}`.trim() };
+      let lengthHeader = response.headers.get("content-length"), declared = lengthHeader === null ? NaN : Number(lengthHeader);
+      if (Number.isFinite(declared) && declared > maxBytes) {
+        try {
+          await response.body?.cancel();
+        } catch {
+        }
+        return { error: `exceeds ${maxBytes} bytes` };
+      }
+      let bytes = await readCapped(response, maxBytes);
+      return Buffer.isBuffer(bytes) ? { bytes, contentType: response.headers.get("content-type") ?? "" } : bytes;
+    }
+  } catch (err) {
+    let message = err instanceof Error ? err.message : String(err);
+    return { error: err instanceof Error && err.name === "AbortError" ? `request timed out after ${timeoutMs}ms` : message };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/shared/utils/context-breakdown.ts
+var context_breakdown_exports = {};
+__export(context_breakdown_exports, {
+  DEFAULT_COMPACT_THRESHOLD: () => DEFAULT_COMPACT_THRESHOLD,
+  breakdownTags: () => breakdownTags,
+  calibrationNote: () => calibrationNote,
+  contextCategories: () => contextCategories,
+  contextTotal: () => contextTotal,
+  estimatedSinceTokens: () => estimatedSinceTokens,
+  resolveCompactThreshold: () => resolveCompactThreshold,
+  resolveHostThreshold: () => resolveHostThreshold,
+  resolveLoopThreshold: () => resolveLoopThreshold
+});
+var DEFAULT_COMPACT_THRESHOLD = 1e5;
+function hostThreshold(config, model) {
+  let context = config?.context?.compact_threshold;
+  if (context != null) return { value: context, source: "agent" };
+  let fromModel = model?.compact_threshold;
+  return fromModel != null ? { value: fromModel, source: "model" } : { value: 1e5, source: "default" };
+}
+function resolveCompactThreshold(config, loop) {
+  if (!loop || loop === "main") return hostThreshold(config, config?.model);
+  let declared = config?.loops?.find((l) => l.name === loop);
+  return declared ? declared.compact_threshold != null ? { value: declared.compact_threshold, source: "loop" } : hostThreshold(config, declared.model ?? config?.model) : hostThreshold(config, config?.model);
+}
+function resolveHostThreshold(config) {
+  return resolveCompactThreshold(config).value;
+}
+function resolveLoopThreshold(config, loop) {
+  return resolveCompactThreshold(config, loop).value;
+}
+function contextTotal(b) {
+  return b.system_prompt_tokens + b.tools_total_tokens + b.messages_tokens + b.dynamic_instructions_tokens;
+}
+function estimatedSinceTokens(cal) {
+  return Math.max(0, cal.since_last_call_tokens - cal.reply_tokens);
+}
+function breakdownTags(cal) {
+  if (!cal) return { part: "\u2248 estimate", recent: "\u2248 estimate", total: "\u2248 estimate" };
+  let newer = estimatedSinceTokens(cal) > 0 ? "\u2248 estimate" : "measured";
+  return { part: "\u2248 scaled", recent: newer, total: newer };
+}
+function calibrationNote(cal, fmt, approx = "\u2248") {
+  if (!cal) return `${approx} estimate: no call to calibrate to (none recorded yet, or the prompt, tools or model changed since).`;
+  let head = `Calibrated to the last call: ${fmt(cal.last_call_tokens)} prompt + ${fmt(cal.reply_tokens)} reply, as the gauge shows`, newer = estimatedSinceTokens(cal);
+  return newer > 0 ? `${head}; ${approx}${fmt(newer)} added since is an estimate the gauge counts after the next call.` : `${head}.`;
+}
+var byTokens = (list) => [...list].sort((a, b) => b.tokens - a.tokens);
+function contextCategories(b, maxItems = 12) {
+  let fileTokens = b.injected_files.reduce((sum, f) => sum + f.tokens, 0), parts = b.system_prompt_parts, cal = b.calibration, basis = cal ? "calibrated" : "estimate", out = [
+    {
+      id: "system",
+      key: "system",
+      label: "System prompt",
+      tokens: Math.max(0, b.system_prompt_tokens - fileTokens),
+      items: parts ? byTokens([
+        { name: "Base prompt and capability sections", tokens: parts.base_and_sections },
+        { name: "Agent instructions", tokens: parts.instructions },
+        { name: "Identity, loop roster, runtime blocks", tokens: parts.runtime_blocks }
+      ]).filter((i) => i.tokens > 0) : [],
+      note: "Base prompt, instructions and runtime blocks: sent with every request."
+    }
+  ];
+  b.injected_files.length > 0 && out.push({
+    id: "files",
+    key: "files",
+    label: "Injected files",
+    tokens: fileTokens,
+    count: b.injected_files.length,
+    items: byTokens(b.injected_files.map((f) => ({ name: f.path, tokens: f.tokens }))).slice(0, maxItems),
+    note: "{{path}} files rendered into the system prompt."
+  });
+  let builtIn = b.tool_groups.filter((g) => g.source === "built-in"), builtInTools = builtIn.flatMap((g) => g.tools);
+  out.push({
+    id: "tools",
+    key: "tools",
+    label: "Tools",
+    tokens: builtIn.reduce((sum, g) => sum + g.tokens, 0),
+    count: builtInTools.length,
+    items: byTokens(builtInTools).slice(0, maxItems),
+    note: "Built-in tool schemas: sent with every request."
+  });
+  for (let group of b.tool_groups)
+    group.source !== "built-in" && out.push({
+      id: `mcp:${group.source}`,
+      key: "mcp",
+      label: `MCP ${group.source}`,
+      tokens: group.tokens,
+      count: group.tools.length,
+      items: byTokens(group.tools).slice(0, maxItems),
+      note: `Tool schemas from the ${group.source} MCP server.`
+    });
+  out.push({
+    id: "dynamic",
+    key: "dynamic",
+    label: "Dynamic instructions",
+    tokens: b.dynamic_instructions_tokens,
+    items: [],
+    note: "Per-turn runtime notes (context pressure, reminders)."
+  }), out.push({
+    id: "messages",
+    key: "messages",
+    label: "Conversation",
+    tokens: b.messages_tokens - (cal?.since_last_call_tokens ?? 0),
+    items: [],
+    note: "This loop\u2019s history, compaction summary included."
+  });
+  let categories = out.map((c) => ({ ...c, basis }));
+  return cal && categories.push({
+    id: "recent",
+    key: "recent",
+    label: "Since last call",
+    tokens: cal.since_last_call_tokens,
+    items: [],
+    note: "The last call\u2019s reply (its reported output) plus anything added after it (estimated).",
+    basis: estimatedSinceTokens(cal) > 0 ? "estimate" : "measured"
+  }), byTokens(categories);
+}
+
+// src/shared/schemas/skills-catalog.schema.ts
+var skills_catalog_schema_exports = {};
+__export(skills_catalog_schema_exports, {
+  MAX_CATALOG_BYTES: () => MAX_CATALOG_BYTES,
+  MAX_PACKAGE_FILES: () => MAX_PACKAGE_FILES,
+  MAX_SKILL_PACKAGE_BYTES: () => MAX_SKILL_PACKAGE_BYTES,
+  SKILL_NAME: () => SKILL_NAME,
+  SkillCatalogEntrySchema: () => SkillCatalogEntrySchema,
+  parseSkillsCatalogDocument: () => parseSkillsCatalogDocument,
+  resolvePackageFilePath: () => resolvePackageFilePath
+});
+var SKILL_NAME = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/, PATH_SEGMENT = /^[A-Za-z0-9._-]+$/, MAX_PACKAGE_FILES = 32, MAX_CATALOG_BYTES = 512 * 1024, MAX_SKILL_PACKAGE_BYTES = 256 * 1024, UNSAFE_TEXT = /[\u0000-\u001F\u007F-\u009F\u061C\u200E\u200F\u202A-\u202E\u2066-\u2069]/, safeText = (value) => !UNSAFE_TEXT.test(value), UNSAFE_TEXT_MESSAGE = "must not contain control or bidirectional-override characters";
+function resolvePackageFilePath(name, raw) {
+  if (typeof raw != "string") return null;
+  let directory = `skills/${name}/`, candidate = raw.trim().replace(/\\/g, "/");
+  if (!candidate) return null;
+  for (; candidate.startsWith("./"); ) candidate = candidate.slice(2);
+  if (candidate.startsWith("/")) return null;
+  let relative = candidate.startsWith(directory) ? candidate.slice(directory.length) : candidate;
+  return !relative || relative.split("/").some((segment) => segment === "." || segment === ".." || !PATH_SEGMENT.test(segment)) || relative === "SKILL.md" ? null : relative;
+}
+var SkillPackageFileSchema = external_exports.object({
+  path: external_exports.string().min(1).refine(safeText, UNSAFE_TEXT_MESSAGE),
+  raw_url: external_exports.string().url()
+}), SkillCatalogEntrySchema = external_exports.object({
+  name: external_exports.string().regex(SKILL_NAME),
+  description: external_exports.string().min(1).max(500).refine(safeText, UNSAFE_TEXT_MESSAGE),
+  /** Path inside the publishing repo — display only. */
+  path: external_exports.string().min(1).refine(safeText, UNSAFE_TEXT_MESSAGE).optional(),
+  /** Where the SKILL.md body is fetched from on install. */
+  raw_url: external_exports.string().url(),
+  /** Resources installed beside SKILL.md, package-relative after parsing. */
+  files: external_exports.array(SkillPackageFileSchema).max(MAX_PACKAGE_FILES).optional()
+}).superRefine((entry, ctx) => {
+  if (!entry.files) return;
+  let seen = /* @__PURE__ */ new Set();
+  entry.files.forEach((file, index) => {
+    let relative = resolvePackageFilePath(entry.name, file.path);
+    if (!relative) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["files", index, "path"],
+        message: `must stay inside skills/${entry.name}/ and cannot be SKILL.md`
+      });
+      return;
+    }
+    if (seen.has(relative)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["files", index, "path"],
+        message: "duplicate package path"
+      });
+      return;
+    }
+    seen.add(relative);
+  });
+}).transform((entry) => entry.files ? {
+  ...entry,
+  files: entry.files.map((file) => ({
+    ...file,
+    path: resolvePackageFilePath(entry.name, file.path)
+  }))
+} : entry);
+function parseSkillsCatalogDocument(json) {
+  if (typeof json != "object" || json === null || Array.isArray(json)) return null;
+  let doc = json;
+  if (doc.schema !== void 0 && doc.schema !== 1 || !Array.isArray(doc.skills)) return null;
+  let entries = [], seen = /* @__PURE__ */ new Set(), dropped = 0;
+  for (let raw of doc.skills) {
+    let result = SkillCatalogEntrySchema.safeParse(raw);
+    if (!result.success || seen.has(result.data.name)) {
+      dropped++;
+      continue;
+    }
+    seen.add(result.data.name), entries.push(result.data);
+  }
+  return {
+    entries,
+    publisher: typeof doc.publisher == "string" ? doc.publisher : void 0,
+    repository: typeof doc.repository == "string" ? doc.repository : void 0,
+    dropped
+  };
+}
+
+export {
+  isLoopbackIp,
+  isLoopbackHostname,
+  checkFetchTarget,
+  checkLiteralConnectTarget,
+  checkConnectTarget,
+  guardedLookup,
+  addressCheck,
+  egressFetch,
+  daemonGuardPort,
+  MCP_HTTP_EGRESS,
+  isFetchFailure,
+  guardedFetch,
+  guarded_fetch_exports,
+  resolveCompactThreshold,
+  resolveLoopThreshold,
+  contextTotal,
+  contextCategories,
+  context_breakdown_exports,
+  MAX_CATALOG_BYTES,
+  MAX_SKILL_PACKAGE_BYTES,
+  parseSkillsCatalogDocument,
+  skills_catalog_schema_exports
+};