@agentsky/sky 2.3.0 → 2.4.0

package/dist/{chunk-2KQLWHHC.js → chunk-FSAF6HIL.js}

@@ -18978,6 +18978,14 @@ var REASONING_EFFORT_VALUES = [
   "max",
   "ultra"
 ];
+var MODEL_REASONING_EFFORTS = {
+  "claude-haiku-4-5": [],
+  "gemini-3.8-flash": ["low", "medium", "high"],
+  "gemini-3.5-flash": ["low", "medium", "high"],
+  "glm-5.3": ["low", "high", "max"],
+  "glm-5.3-flash": ["low", "high", "max"],
+  "grok-4.6": ["low", "medium", "high"]
+};
 var REASONING_EFFORTS = {
   agoragentic_acp: null,
   amp_acp: null,
@@ -19032,15 +19040,20 @@ var REASONING_EFFORTS = {
 };
 function reasoningEffortsForModel(agentType, model) {
   const normalized = model?.split("/").at(-1);
+  const levels = REASONING_EFFORTS[agentType];
+  if (levels === null) return null;
   if (normalized === "gpt-6.1-sol" && (agentType === "codex" || agentType === "hermes")) return ["low", "medium", "high", "xhigh", "max"];
-  return REASONING_EFFORTS[agentType];
+  if (agentType === "opencode" && (normalized === "muse-spark-1.1" || normalized === "muse-spark-1.2")) return ["minimal", "low", "medium", "high", "xhigh"];
+  const modelLevels = normalized ? MODEL_REASONING_EFFORTS[normalized] : void 0;
+  return modelLevels ? levels.filter((level) => modelLevels.includes(level)) : levels;
 }
 function isModelEffortSupported(agentType, model, effort) {
-  const allowed = reasoningEffortsForModel(agentType, model);
-  return allowed !== null && allowed.includes(effort);
+  return reasoningEffortsForModel(agentType, model)?.includes(effort) ?? false;
 }
 function reasoningEffortDocLine() {
-  return Object.entries(REASONING_EFFORTS).map(([type, values]) => values ? `${type}: ${values.join("/")}` : `${type}: not supported`).join("; ") + "; codex/hermes + gpt-6.1-sol: low/medium/high/xhigh/max";
+  const harness = Object.entries(REASONING_EFFORTS).map(([type, values]) => values ? `${type}: ${values.join("/")}` : `${type}: not supported`).join("; ");
+  const models = Object.entries(MODEL_REASONING_EFFORTS).map(([model, values]) => `${model}: ${values.length ? values.join("/") : "not supported"}`).join("; ");
+  return `${harness}; models: ${models}; codex/hermes + gpt-6.1-sol: low/medium/high/xhigh/max`;
 }
 
 // ../../packages/spec/src/acp-catalog.ts
@@ -21080,6 +21093,8 @@ var podTurnBodySchema = external_exports.object({
 // ../../packages/spec/src/resources.ts
 var MAX_RESOURCES_PER_CREATE = 100;
 var MAX_REPOSITORY_TOKEN_CHARS = 1024;
+var MAX_SESSION_MEMORY_SNAPSHOT_BYTES = 8 * 1024 * 1024;
+var MAX_MEMORY_STORE_INSTRUCTIONS_CHARS = 4096;
 var mountPathSchema = external_exports.string().min(1).max(4096).nullish();
 var fileResourceParamSchema = external_exports.object({
   type: external_exports.literal("file"),
@@ -21097,14 +21112,28 @@ var githubRepositoryResourceParamSchema = external_exports.object({
   checkout: repositoryCheckoutSchema.nullish(),
   mount_path: mountPathSchema
 });
+var memoryStoreResourceParamSchema = external_exports.object({
+  type: external_exports.literal("memory_store"),
+  memory_store_id: external_exports.string().min(1).max(255),
+  /** Write access must be explicitly granted for this session. */
+  access: external_exports.enum(["read_only", "read_write"]),
+  /** Optional per-session instructions passed to the agent about this store (≤ 4096 chars). */
+  instructions: external_exports.string().max(MAX_MEMORY_STORE_INSTRUCTIONS_CHARS).optional(),
+  /** Where the store's memories land; defaults to /mnt/memory/<memory_store_id>. */
+  mount_path: external_exports.string().min(1).max(4096).nullish()
+});
 var sessionResourceParamSchema = external_exports.discriminatedUnion("type", [
   fileResourceParamSchema,
-  githubRepositoryResourceParamSchema
+  githubRepositoryResourceParamSchema,
+  memoryStoreResourceParamSchema
 ]);
 var sessionResourcesParamSchema = external_exports.array(sessionResourceParamSchema).max(MAX_RESOURCES_PER_CREATE);
 var updateSessionResourceSchema = external_exports.object({
   authorization_token: external_exports.string().min(1).max(MAX_REPOSITORY_TOKEN_CHARS)
 });
+var MAX_MEMORY_MOUNT_PATH_BYTES = 4095 - 1024 - 2 * 13;
+var MAX_FILESYSTEM_COMPONENT_BYTES = 255;
+var MAX_STAGED_COMPONENT_BYTES = MAX_FILESYSTEM_COMPONENT_BYTES - 13;
 
 // ../../packages/spec/src/usage.ts
 var usageReportSchema = external_exports.object({
@@ -21151,6 +21180,689 @@ var connectionSupportSchema = external_exports.object({
   connectors: external_exports.enum(["all", "none"])
 }).strict();
 
+// ../../packages/spec/src/question.ts
+var QUESTION_REQUEST_KINDS = ["connect_app"];
+var questionSchema = external_exports.object({
+  requestId: external_exports.string().min(1),
+  question: external_exports.string().trim().min(1),
+  options: external_exports.array(
+    external_exports.object({
+      id: external_exports.string().min(1),
+      label: external_exports.string().trim().min(1),
+      description: external_exports.string().optional()
+    })
+  ).default([]),
+  allowFreeText: external_exports.boolean().default(true),
+  allowMultiple: external_exports.boolean().optional(),
+  /** Authenticated platform user id; a share-link visitor cannot impersonate it. */
+  requiredUserId: external_exports.string().trim().min(1).optional(),
+  /** Holds the current Goal until an authenticated answer is admitted. */
+  blocksGoal: external_exports.boolean().optional(),
+  /** Informational deadline. Passing it never approves or answers the question. */
+  dueAt: external_exports.string().datetime({ offset: true }).optional(),
+  /** What the platform is asking for when the question is one of its own
+   *  requests rather than an agent's free question. Absent on an ordinary question. */
+  kind: external_exports.enum(QUESTION_REQUEST_KINDS).optional(),
+  /** What the request is about: the app to connect, for `connect_app`. */
+  subject: external_exports.string().trim().min(1).max(200).optional()
+}).superRefine((value, context) => {
+  if (new Set(value.options.map((option) => option.id)).size !== value.options.length) {
+    context.addIssue({ code: "custom", message: "Option identifiers must be unique." });
+  }
+  if (!value.options.length && !value.allowFreeText) {
+    context.addIssue({ code: "custom", message: "The question must allow an answer." });
+  }
+});
+var replySchema = external_exports.object({
+  question: questionSchema,
+  answer: external_exports.union([external_exports.object({ optionId: external_exports.string() }), external_exports.object({ optionIds: external_exports.array(external_exports.string()) }), external_exports.object({ text: external_exports.string() })])
+});
+
+// ../../packages/spec/src/import-base64.ts
+function isCanonicalBase64(value) {
+  if (value.length === 0 || value.length % 4 !== 0) return false;
+  const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+  for (let index = 0; index < value.length - padding; index += 1) {
+    const code = value.charCodeAt(index);
+    const alphabet = code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47;
+    if (!alphabet) return false;
+  }
+  return Buffer.from(value, "base64").toString("base64") === value;
+}
+
+// ../../packages/spec/src/import-redact.ts
+function ci(word) {
+  return word.split("").map((c) => /[a-z]/i.test(c) ? `[${c.toUpperCase()}${c.toLowerCase()}]` : c).join("");
+}
+var UnsafeImportError = class extends Error {
+};
+var TEXT_ATTACHMENT_MEDIA_TYPES = [
+  "application/json",
+  "application/xml",
+  "application/javascript",
+  "application/ecmascript",
+  "application/x-javascript",
+  "application/yaml",
+  "application/x-yaml",
+  "application/x-www-form-urlencoded",
+  "image/svg+xml",
+  "application/toml",
+  "application/x-toml",
+  "application/sql",
+  "application/x-sql",
+  "application/pem-certificate-chain",
+  "application/x-pem-file",
+  "application/x-pem-key",
+  "application/x-ndjson",
+  "application/ndjson"
+];
+var textAttachmentMediaTypes = new Set(TEXT_ATTACHMENT_MEDIA_TYPES);
+function isTextMediaType(value) {
+  const media = typeof value === "string" ? value.split(";", 1)[0].trim().toLowerCase() : "";
+  return media.startsWith("text/") || textAttachmentMediaTypes.has(media) || /\+(?:json|xml)$/.test(media);
+}
+var MASK = "\u25CF\u25CF\u25CF\u25CF\u25CF";
+var SECRET_PATTERNS = [
+  { name: "anthropic key", source: "(?<![A-Za-z0-9_])(sk-ant-)[A-Za-z0-9_-]{10,}", replacement: `\\1${MASK}` },
+  { name: "openai key", source: "(?<![A-Za-z0-9_])(sk-proj-|sk-)[A-Za-z0-9_-]{8,}", replacement: `\\1${MASK}` },
+  { name: "github token", source: "(?<![A-Za-z0-9_])(gh[pousr]_)[A-Za-z0-9]{16,}", replacement: `\\1${MASK}` },
+  { name: "github fine-grained token", source: "(?<![A-Za-z0-9_])(github_pat_)[A-Za-z0-9_]{20,}", replacement: `\\1${MASK}` },
+  { name: "slack token", source: "(?<![A-Za-z0-9_])(xox[abeprs]-|xapp-)[A-Za-z0-9-]{10,}", replacement: `\\1${MASK}` },
+  { name: "agentsky token", source: "(?<![A-Za-z0-9_])(ast_)[A-Za-z0-9_-]{10,}", replacement: `\\1${MASK}` },
+  { name: "guild broker token", source: "(?<![A-Za-z0-9_])(gbk_)[A-Za-z0-9_-]{10,}", replacement: `\\1${MASK}` },
+  { name: "jwt", source: "(?<![A-Za-z0-9_])eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]*", replacement: MASK },
+  { name: "private key", source: "-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\\s\\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)", replacement: MASK },
+  { name: "google oauth token", source: "(ya29\\.)[A-Za-z0-9_-]{20,}", replacement: `\\1${MASK}` },
+  { name: "google api key", source: "(?<![A-Za-z0-9_])(AIza)[A-Za-z0-9_-]{30,}", replacement: `\\1${MASK}` },
+  { name: "aws key id", source: "(?<![A-Za-z0-9_])(AKIA)[0-9A-Z]{16}(?![A-Za-z0-9_])", replacement: `\\1${MASK}` },
+  { name: "import key", source: "(agt_)[A-Za-z0-9_-]{20,}", replacement: `\\1${MASK}` },
+  {
+    name: "database url",
+    source: "(postgres://|postgresql://|mysql://|mongodb\\+srv://|mongodb://|redis://)([^:@/ ]+):[^@ ]+@",
+    replacement: `\\1\\2:${MASK}@`
+  },
+  { name: "bearer header", source: `(?<![A-Za-z0-9_])(${ci("bearer")}\\s+)[A-Za-z0-9._~+/=-]{16,}`, replacement: `\\1${MASK}` },
+  { name: "api key header", source: `(${ci("x-api-key")}: )[A-Za-z0-9_.=-]{16,}`, replacement: `\\1${MASK}` }
+];
+var compiled = SECRET_PATTERNS.map((p) => ({
+  name: p.name,
+  re: new RegExp(p.source, "g"),
+  replacement: p.replacement.replace(/\\(\d)/g, "$$$1")
+}));
+function asPlainDecimal(token) {
+  const m = /^([+-]?)(\d+)(?:\.(\d*))?(?:[eE]([+-]?\d+))?$/.exec(token);
+  if (!m) return null;
+  const [, sign, whole, fraction = "", exponent = "0"] = m;
+  const digits = whole + fraction;
+  if (Math.abs(Number(exponent)) > 400) return /[1-9]/.test(digits) ? null : "0";
+  let pointAt = whole.length + Number(exponent);
+  let padded = digits;
+  if (pointAt <= 0) {
+    padded = "0".repeat(1 - pointAt) + digits;
+    pointAt += 1 - pointAt;
+  }
+  if (pointAt >= padded.length) padded += "0".repeat(pointAt - padded.length + 1);
+  const intPart = padded.slice(0, pointAt).replace(/^0+(?=\d)/, "");
+  const fracPart = padded.slice(pointAt).replace(/0+$/, "");
+  const value = fracPart ? `${intPart}.${fracPart}` : intPart;
+  return (sign === "-" && /[1-9]/.test(digits) ? "-" : "") + value;
+}
+function changesWhenRead(token) {
+  const value = Number(token);
+  if (!Number.isFinite(value)) return true;
+  const mine = asPlainDecimal(token);
+  const theirs = asPlainDecimal(String(value));
+  if (mine === null) return /[1-9]/.test(token);
+  if (theirs === null) return true;
+  return mine !== theirs;
+}
+function unsafeNumberSpans(line) {
+  const spans = [];
+  let inString = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const c = line[i];
+    if (inString) {
+      if (c === "\\") i += 1;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') {
+      inString = true;
+      continue;
+    }
+    if (c !== "-" && (c < "0" || c > "9")) continue;
+    const start = i;
+    if (c === "-") i += 1;
+    while (i < line.length && line[i] >= "0" && line[i] <= "9") i += 1;
+    if (line[i] === ".") {
+      i += 1;
+      while (i < line.length && line[i] >= "0" && line[i] <= "9") i += 1;
+    }
+    if (line[i] === "e" || line[i] === "E") {
+      i += 1;
+      if (line[i] === "+" || line[i] === "-") i += 1;
+      while (i < line.length && line[i] >= "0" && line[i] <= "9") i += 1;
+    }
+    const token = line.slice(start, i);
+    if (changesWhenRead(token)) spans.push([start, i]);
+    i -= 1;
+  }
+  return spans;
+}
+function withPreservedNumbers(line) {
+  const spans = unsafeNumberSpans(line);
+  if (spans.length === 0) return { parse: () => JSON.parse(line), serialize: (v) => JSON.stringify(v) };
+  let sentinel = "n";
+  while (line.includes(`@@${sentinel}`)) sentinel += "n";
+  const token = (index) => `@@${sentinel}${index}@@`;
+  let out = "";
+  let cursor = 0;
+  const originals = [];
+  spans.forEach(([start, end], index) => {
+    out += line.slice(cursor, start) + JSON.stringify(token(index));
+    originals.push(line.slice(start, end));
+    cursor = end;
+  });
+  out += line.slice(cursor);
+  return {
+    parse: () => JSON.parse(out),
+    serialize: (value) => {
+      let text = JSON.stringify(value);
+      originals.forEach((original, index) => {
+        text = text.split(JSON.stringify(token(index))).join(original);
+      });
+      return text;
+    }
+  };
+}
+function hasDuplicateJsonKeys(line) {
+  const stack = [];
+  const skipSpace = (at) => {
+    while (at < line.length && /\s/.test(line[at])) at += 1;
+    return at;
+  };
+  for (let i = 0; i < line.length; i += 1) {
+    const c = line[i];
+    if (c === '"') {
+      const start = i;
+      i += 1;
+      while (i < line.length) {
+        if (line[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (line[i] === '"') break;
+        i += 1;
+      }
+      const frame = stack[stack.length - 1];
+      const colon = skipSpace(i + 1);
+      if (frame?.kind === "object" && frame.expectingKey && line[colon] === ":") {
+        try {
+          const key = JSON.parse(line.slice(start, i + 1));
+          if (frame.keys.has(key)) return true;
+          frame.keys.add(key);
+          frame.expectingKey = false;
+        } catch {
+        }
+      }
+      continue;
+    }
+    if (c === "{") stack.push({ kind: "object", expectingKey: true, keys: /* @__PURE__ */ new Set() });
+    else if (c === "[") stack.push({ kind: "array", expectingKey: false });
+    else if (c === "}" || c === "]") stack.pop();
+    else if (c === "," && stack.at(-1)?.kind === "object") stack.at(-1).expectingKey = true;
+  }
+  return false;
+}
+var FIELD_ASSIGNMENTS = new RegExp(
+  String.raw`(?<![A-Za-z0-9_.])(\\{0,8}["']?([A-Za-z_][A-Za-z0-9_.-]{0,255})\\{0,8}["']?\s{0,8}\\{0,8}[:=]\\{0,8}\s{0,8}\\{0,8}(["']?))`,
+  "g"
+);
+var JSON_NUMBER = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?$/;
+var COMPLETE_MASKED_VALUE = new RegExp(`^(?:${MASK}|${ci("bearer")} ${MASK})$`);
+function codeIdentifierEnd(value, at) {
+  if (!/[A-Za-z_$]/.test(value[at] ?? "")) return -1;
+  at += 1;
+  while (/[A-Za-z0-9_$]/.test(value[at] ?? "")) at += 1;
+  return at;
+}
+function codeGroupEnd(value, at) {
+  const pairs = { "(": ")", "[": "]", "{": "}" };
+  const stack = [pairs[value[at]]];
+  for (let i = at + 1; i < value.length; i += 1) {
+    const c = value[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i += 1; i < value.length; i += 1) {
+        if (value[i] === "\\") i += 1;
+        else if (value[i] === c) break;
+      }
+      if (i >= value.length) return -1;
+      continue;
+    }
+    if (pairs[c]) stack.push(pairs[c]);
+    else if (c === ")" || c === "]" || c === "}") {
+      if (stack.pop() !== c) return -1;
+      if (stack.length === 0) return i + 1;
+    }
+  }
+  return -1;
+}
+function credentialRhsBoundary(value, start, lineEnd) {
+  const pairs = { "(": ")", "[": "]", "{": "}" };
+  const stack = [];
+  for (let i = start; i < lineEnd; i += 1) {
+    const c = value[i];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i += 1; i < lineEnd; i += 1) {
+        if (value[i] === "\\") i += 1;
+        else if (value[i] === c) break;
+      }
+      if (i >= lineEnd) return { end: lineEnd, unsafe: true };
+      continue;
+    }
+    if (c === "/") return { end: lineEnd, unsafe: true };
+    if (pairs[c]) stack.push(pairs[c]);
+    else if (c === ")" || c === "]" || c === "}") {
+      if (stack.pop() !== c) return { end: lineEnd, unsafe: true };
+    }
+  }
+  return { end: lineEnd, unsafe: stack.length > 0 };
+}
+function maskExpressionLiterals(value) {
+  let out = "";
+  const groups = [];
+  let previousNonWhitespace = "";
+  for (let i = 0; i < value.length; i += 1) {
+    const c = value[i];
+    if (c === "(" || c === "{") {
+      groups.push(c);
+      out += c;
+      previousNonWhitespace = c;
+      continue;
+    }
+    if (c === "[") {
+      let kind = /[A-Za-z0-9_$.)\]}]/.test(previousNonWhitespace) ? "index" : "array";
+      if (kind === "index") {
+        const end = codeGroupEnd(value, i);
+        if (end < 0) return null;
+        const content = value.slice(i + 1, end - 1).trim();
+        if (/^[-+.0-9]/.test(content) && !/^(?:0|[1-9][0-9]*)$/.test(content)) return null;
+        if (/^(?:0|[1-9][0-9]*)$/.test(content)) kind = "index-number";
+      }
+      groups.push(kind);
+      out += c;
+      previousNonWhitespace = c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      groups.pop();
+      out += c;
+      previousNonWhitespace = c;
+      continue;
+    }
+    const previousIsIdentifier = i > 0 && /[A-Za-z0-9_$]/.test(value[i - 1]);
+    const numberLooking = !previousIsIdentifier && (/[0-9]/.test(c) || c === "." && /[0-9]/.test(value[i + 1] ?? "") || (c === "+" || c === "-") && (/[0-9]/.test(value[i + 1] ?? "") || value[i + 1] === "." && /[0-9]/.test(value[i + 2] ?? "")));
+    if (numberLooking && groups.at(-1) !== "index-number") return null;
+    if (c !== '"' && c !== "'" && c !== "`") {
+      out += c;
+      if (!/\s/.test(c)) previousNonWhitespace = c;
+      continue;
+    }
+    const start = i;
+    for (i += 1; i < value.length; i += 1) {
+      if (value[i] === "\\") i += 1;
+      else if (value[i] === c) break;
+    }
+    const literal2 = value.slice(start, i + 1);
+    out += groups.at(-1)?.startsWith("index") ? literal2 : `${c}${MASK}${c}`;
+    previousNonWhitespace = c;
+  }
+  return out;
+}
+function rewriteCodeExpression(value, declaration) {
+  let source = value.trim();
+  const semicolon = source.endsWith(";");
+  if (semicolon) source = source.slice(0, -1).trimEnd();
+  if (/^(?:null|undefined)$/.test(source)) return value;
+  if (source.startsWith("`")) {
+    if (codeGroupEnd(`(${source})`, 0) !== source.length + 2) return null;
+    return value.replace(source, `\`${MASK}\``);
+  }
+  const awaitPrefix = /^await\s+/.exec(source)?.[0] ?? "";
+  if (awaitPrefix) source = source.slice(awaitPrefix.length);
+  if (source.startsWith("[") || source.startsWith("{")) {
+    if (codeGroupEnd(source, 0) !== source.length) return null;
+    const full2 = semicolon ? `${MASK};` : MASK;
+    return value.replace(value.trim(), full2);
+  }
+  let at = codeIdentifierEnd(source, 0);
+  if (at < 0) return null;
+  let syntax = false;
+  while (at < source.length) {
+    if (source.startsWith("?.", at)) {
+      at += 2;
+      if (source[at] === "[" || source[at] === "(") {
+        const end2 = codeGroupEnd(source, at);
+        if (end2 < 0) return null;
+        syntax = true;
+        at = end2;
+        continue;
+      }
+    } else if (source[at] === ".") at += 1;
+    else if (source[at] === "[" || source[at] === "(") {
+      const end2 = codeGroupEnd(source, at);
+      if (end2 < 0) return null;
+      syntax = true;
+      at = end2;
+      continue;
+    } else return null;
+    const end = codeIdentifierEnd(source, at);
+    if (end < 0) return null;
+    syntax = true;
+    at = end;
+  }
+  if (!syntax && !declaration) return null;
+  const rewritten = maskExpressionLiterals(source);
+  if (rewritten === null) return null;
+  const full = semicolon ? `${awaitPrefix}${rewritten};` : `${awaitPrefix}${rewritten}`;
+  return value.replace(value.trim(), full);
+}
+function redactPlainText(text) {
+  const hits = {};
+  let out = redactFieldAssignments(text, () => {
+    hits["secret field"] = (hits["secret field"] ?? 0) + 1;
+  });
+  for (const p of compiled) {
+    p.re.lastIndex = 0;
+    out = out.replace(p.re, (...m) => {
+      hits[p.name] = (hits[p.name] ?? 0) + 1;
+      return p.replacement.replace(/\$(\d)/g, (_, i) => String(m[Number(i)] ?? ""));
+    });
+  }
+  return { text: out, hits };
+}
+function nameSegments(name) {
+  return name.replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.toLowerCase());
+}
+var CREDENTIAL_WORDS = /* @__PURE__ */ new Set([
+  "token",
+  "secret",
+  "secrets",
+  "password",
+  "passwords",
+  "passwd",
+  "credential",
+  "credentials",
+  "authorization",
+  "cookie",
+  "cookies"
+]);
+var KEY_OWNERS = /* @__PURE__ */ new Set(["api", "access", "private", "secret", "signing", "encryption"]);
+var COUNT_QUALIFIERS = /* @__PURE__ */ new Set(["max", "min", "num", "total", "input", "output", "cache", "prompt", "completion", "reasoning", "thinking", "used", "remaining", "limit", "budget"]);
+var COUNT_SUFFIXES = /* @__PURE__ */ new Set(["count", "counts", "used", "usage", "remaining", "limit", "limits", "budget", "price", "cost", "total", "size", "length"]);
+function ownsKey(segment) {
+  if (!segment) return false;
+  for (const owner of KEY_OWNERS) if (segment === owner || segment.endsWith(owner)) return true;
+  return false;
+}
+function isCredentialField(name) {
+  const segments = nameSegments(name);
+  for (let i = 0; i < segments.length; i += 1) {
+    const segment = segments[i];
+    if (segment === "token") {
+      if (!COUNT_QUALIFIERS.has(segments[i - 1] ?? "") && !COUNT_SUFFIXES.has(segments[i + 1] ?? "")) return true;
+      continue;
+    }
+    if (CREDENTIAL_WORDS.has(segment)) return true;
+    if ((segment === "key" || segment === "keys") && i > 0 && ownsKey(segments[i - 1])) return true;
+    if (segment === "id" && i > 0 && segments[i - 1] === "session") return true;
+    if (segment === "sessionid" || segment === "apikey" || segment === "accesskey" || segment === "privatekey") return true;
+  }
+  return false;
+}
+function redactFieldAssignments(value, onHit) {
+  FIELD_ASSIGNMENTS.lastIndex = 0;
+  let out = "";
+  let copiedThrough = 0;
+  for (let match = FIELD_ASSIGNMENTS.exec(value); match; match = FIELD_ASSIGNMENTS.exec(value)) {
+    const name = match[2];
+    if (!isCredentialField(name)) continue;
+    const valueStart = FIELD_ASSIGNMENTS.lastIndex;
+    const quote = match[3];
+    const limit = value.length;
+    const lineEnd = value.slice(valueStart, limit).search(/[\r\n]/);
+    const boundedLineEnd = lineEnd < 0 ? limit : valueStart + lineEnd;
+    const boundary = quote ? { end: boundedLineEnd, unsafe: false } : credentialRhsBoundary(value, valueStart, boundedLineEnd);
+    const expressionEnd = boundary.end;
+    const lineStart = value.lastIndexOf("\n", match.index - 1) + 1;
+    const declaration = /(?:^|[;{}]\s*)(?:const|let|var)\s+$/.test(value.slice(lineStart, match.index));
+    const expression = quote || boundary.unsafe ? null : rewriteCodeExpression(value.slice(valueStart, expressionEnd), declaration);
+    if (expression !== null) {
+      if (expression !== value.slice(valueStart, expressionEnd)) {
+        out += value.slice(copiedThrough, valueStart) + expression;
+        copiedThrough = expressionEnd;
+        onHit(value.slice(valueStart, expressionEnd));
+      }
+      FIELD_ASSIGNMENTS.lastIndex = expressionEnd;
+      continue;
+    }
+    if (!quote) {
+      const fieldValue2 = value.slice(valueStart, expressionEnd);
+      const trimmed2 = fieldValue2.trim();
+      if (!COMPLETE_MASKED_VALUE.test(trimmed2)) {
+        out += value.slice(copiedThrough, valueStart) + (JSON_NUMBER.test(trimmed2) ? `"${MASK}"` : MASK);
+        copiedThrough = expressionEnd;
+        onHit(fieldValue2);
+      }
+      FIELD_ASSIGNMENTS.lastIndex = expressionEnd;
+      continue;
+    }
+    let valueEnd = valueStart;
+    if (quote) {
+      let openingSlashes = 0;
+      for (let i = match[1].length - 2; i >= 0 && match[1][i] === "\\"; i -= 1) openingSlashes += 1;
+      while (valueEnd < limit && value[valueEnd] !== "\r" && value[valueEnd] !== "\n") {
+        if (value[valueEnd] === quote) {
+          let syntaxStart = valueEnd;
+          while (syntaxStart > valueStart && value[syntaxStart - 1] === "\\") syntaxStart -= 1;
+          if (valueEnd - syntaxStart === openingSlashes) {
+            valueEnd = syntaxStart;
+            break;
+          }
+        }
+        valueEnd += 1;
+      }
+    } else {
+      while (valueEnd < limit && !/["'\r\n,}]/.test(value[valueEnd])) valueEnd += 1;
+    }
+    if (valueEnd === valueStart) continue;
+    const fieldValue = value.slice(valueStart, valueEnd);
+    const trimmed = fieldValue.trim();
+    if (COMPLETE_MASKED_VALUE.test(trimmed)) continue;
+    out += value.slice(copiedThrough, valueStart) + (!match[3] && JSON_NUMBER.test(trimmed) ? `"${MASK}"` : MASK);
+    copiedThrough = valueEnd;
+    onHit(fieldValue);
+    FIELD_ASSIGNMENTS.lastIndex = valueEnd;
+  }
+  return copiedThrough ? out + value.slice(copiedThrough) : value;
+}
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Bytes(value) {
+  const clean = value.endsWith("==") ? value.slice(0, -2) : value.endsWith("=") ? value.slice(0, -1) : value;
+  const out = [];
+  let bits = 0;
+  let acc = 0;
+  for (const ch of clean) {
+    const index = B64.indexOf(ch);
+    if (index < 0) throw new Error("not base64");
+    acc = acc << 6 | index;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out.push(acc >> bits & 255);
+    }
+  }
+  return Uint8Array.from(out);
+}
+function bytesBase64(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const a = bytes[i], b = bytes[i + 1], c = bytes[i + 2];
+    out += B64[a >> 2] + B64[(a & 3) << 4 | (b ?? 0) >> 4] + (b === void 0 ? "=" : B64[(b & 15) << 2 | (c ?? 0) >> 6]) + (c === void 0 ? "=" : B64[c & 63]);
+  }
+  return out;
+}
+function redactLine(line, options = {}) {
+  const hits = {};
+  function fieldCredentials(value) {
+    return redactFieldAssignments(value, (fieldValue) => {
+      const kind = /^[A-Za-z0-9_/+.=-]{12,}$/.test(fieldValue) ? "env assignment" : "secret field";
+      hits[kind] = (hits[kind] ?? 0) + 1;
+    });
+  }
+  function redactPatterns(value) {
+    let out = value;
+    for (const p of compiled) {
+      p.re.lastIndex = 0;
+      out = out.replace(p.re, (...m) => {
+        hits[p.name] = (hits[p.name] ?? 0) + 1;
+        return p.replacement.replace(/\$(\d)/g, (_, i) => String(m[Number(i)] ?? ""));
+      });
+    }
+    return fieldCredentials(out);
+  }
+  function redactDuplicateRecord(value) {
+    let out = value;
+    for (const p of compiled) {
+      p.re.lastIndex = 0;
+      out = out.replace(p.re, (...m) => {
+        hits[p.name] = (hits[p.name] ?? 0) + 1;
+        return p.replacement.replace(/\$(\d)/g, (_, i) => String(m[Number(i)] ?? ""));
+      });
+    }
+    return out.replace(/("(?:\\.|[^"\\])*"\s*:\s*")((?:\\.|[^"\\])*)(")/g, (whole, prefix, fieldValue, suffix) => {
+      const rawKey = prefix.slice(0, prefix.indexOf(":")).trim();
+      let key;
+      try {
+        key = JSON.parse(rawKey);
+      } catch {
+        return whole;
+      }
+      if (!isCredentialField(key) || fieldValue === MASK) return whole;
+      hits["secret field"] = (hits["secret field"] ?? 0) + 1;
+      return prefix + MASK + suffix;
+    });
+  }
+  function restoreHits(snapshot) {
+    for (const key of Object.keys(hits)) delete hits[key];
+    Object.assign(hits, snapshot);
+  }
+  function redactText(value) {
+    const uri = BASE64_DATA_URI_PREFIX.exec(value);
+    if (uri && isCanonicalBase64(uri[2])) {
+      const prefix = uri[1];
+      const metadata = redactPlainText(prefix.slice(0, -8));
+      for (const [kind, n] of Object.entries(metadata.hits)) hits[kind] = (hits[kind] ?? 0) + n;
+      const mediaType = /^data:([^;,]*)/i.exec(prefix)?.[1] || "text/plain";
+      return metadata.text + prefix.slice(-8) + recodePayload(uri[2], mediaType);
+    }
+    const trimmed = value.trim();
+    if (trimmed.startsWith("{") && trimmed.endsWith("}") || trimmed.startsWith("[") && trimmed.endsWith("]")) {
+      if (hasDuplicateJsonKeys(value)) throw new UnsafeImportError("Duplicate keys in serialized JSON are not safe to import.");
+      const snapshot = { ...hits };
+      try {
+        const json3 = withPreservedNumbers(value);
+        if (json3) {
+          const parsed = json3.parse();
+          const walked = walk(parsed);
+          if (JSON.stringify(walked) !== JSON.stringify(parsed)) return json3.serialize(walked);
+          restoreHits(snapshot);
+          return value;
+        }
+      } catch (error61) {
+        if (error61 instanceof UnsafeImportError) throw error61;
+        restoreHits(snapshot);
+      }
+    }
+    return redactPatterns(value);
+  }
+  function recodePayload(data, mediaType) {
+    const bytes = base64Bytes(data);
+    if (!isTextMediaType(mediaType)) return data;
+    let content;
+    try {
+      content = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      throw new UnsafeImportError("A declared text attachment is not valid UTF-8.");
+    }
+    const cleaned = redactText(content);
+    return cleaned === content ? data : bytesBase64(new TextEncoder().encode(cleaned));
+  }
+  function maskDescendants(value) {
+    if (typeof value === "string") return value === MASK ? value : MASK;
+    if (typeof value === "number" || typeof value === "boolean") return MASK;
+    if (Array.isArray(value)) return value.map(maskDescendants);
+    if (value && typeof value === "object") {
+      const result = {};
+      for (const [key, item] of Object.entries(value)) {
+        const name = redactText(key);
+        let at = name;
+        for (let n = 2; at in result; n += 1) at = `${name} (${n})`;
+        result[at] = maskDescendants(item);
+      }
+      return result;
+    }
+    return value;
+  }
+  function walk(value) {
+    if (typeof value === "string") return redactText(value);
+    if (Array.isArray(value)) return value.map(walk);
+    if (!value || typeof value !== "object") return value;
+    const node2 = value;
+    const payload = isFilePayload(node2);
+    const out = {};
+    const place = (name, item) => {
+      let at = name;
+      for (let n = 2; at in out; n += 1) at = `${name} (${n})`;
+      out[at] = item;
+    };
+    for (const [key, item] of Object.entries(node2)) {
+      const name = redactText(key);
+      if (payload && key === "data") {
+        place(name, recodePayload(item, node2.media_type ?? node2.mime_type));
+        continue;
+      }
+      if (isCredentialField(key) && item !== null && item !== void 0) {
+        const masked = maskDescendants(item);
+        if (JSON.stringify(masked) !== JSON.stringify(item)) {
+          hits["secret field"] = (hits["secret field"] ?? 0) + 1;
+        }
+        place(name, masked);
+        continue;
+      }
+      place(name, walk(item));
+    }
+    return out;
+  }
+  if (hasDuplicateJsonKeys(line)) return { line: redactDuplicateRecord(line), hits };
+  const json2 = withPreservedNumbers(line);
+  if (!json2) {
+    if (options.requireStructured) throw new Error("Could not preserve JSON numbers during redaction.");
+    return { line: redactPatterns(line), hits };
+  }
+  try {
+    const walked = json2.serialize(walk(json2.parse()));
+    return { line: Object.keys(hits).length ? walked : line, hits };
+  } catch (error61) {
+    if (options.requireStructured || error61 instanceof UnsafeImportError) throw error61;
+    return { line: redactPatterns(line), hits };
+  }
+}
+var BASE64_DATA_URI_PREFIX = /^(data:[^,]*;base64,)([\s\S]*)(?![\s\S])/i;
+function isFilePayload(node2) {
+  return typeof node2.data === "string" && node2.data !== "" && (typeof node2.media_type === "string" || typeof node2.mime_type === "string" || node2.type === "import.resource" || node2.type === "base64");
+}
+
 // ../../packages/spec/src/index.ts
 var NATIVE_AGENT_TYPES = [
   "hermes",
@@ -21174,6 +21886,7 @@ var LEGACY_CAPABILITY_IDS = [
   "exa.contents",
   "tinyfish.fetch",
   "tinyfish.browser",
+  "tinyfish.agent",
   "dataforseo.serp",
   "dataforseo.ai-keywords",
   "dataforseo.llm-responses",
@@ -21344,6 +22057,8 @@ var allowedLlms = {
     "kimi-k3",
     "kimi-k2.7-code",
     "grok-4.6",
+    "muse-spark-1.1",
+    "muse-spark-1.2",
     "claude-opus-5-5",
     "claude-opus-5",
     "claude-fable-5-1",
@@ -21397,6 +22112,8 @@ var allowedLlms = {
     "kimi-k3",
     "kimi-k2.7-code",
     "grok-4.6",
+    "muse-spark-1.1",
+    "muse-spark-1.2",
     "claude-opus-5-5",
     "claude-opus-5",
     "claude-fable-5-1",
@@ -21491,6 +22208,10 @@ function canonicalCapabilityId(value) {
 }
 var capabilityIdInputSchema = external_exports.preprocess(canonicalCapabilityId, external_exports.enum(CAPABILITY_IDS));
 var capabilitiesSchema = external_exports.array(capabilityIdInputSchema).default([]);
+var CAPABILITY_PERMISSION_POLICIES = ["always_allow", "always_ask", "auto"];
+var capabilityPermissionPolicySchema = external_exports.enum(
+  CAPABILITY_PERMISSION_POLICIES
+);
 var basicsSchema = external_exports.object({
   name: external_exports.string().trim().min(1, "Give your agent a name."),
   description: external_exports.string().default("")
@@ -21567,6 +22288,30 @@ var mcpServerSchema = external_exports.object({
   tools: mcpToolFilterSchema.optional()
 });
 var mcpServersSchema = external_exports.array(mcpServerSchema).max(20);
+var HOOK_EVENTS = [
+  "pre_session_start",
+  "session_start",
+  "user_prompt_submit",
+  "pre_tool_use",
+  "post_tool_use",
+  "stop",
+  "session_end"
+];
+var HOOK_MATCHER = /^(?:[A-Za-z0-9_-]|\.\*)+(?:\|(?:[A-Za-z0-9_-]|\.\*)+)*$/;
+var hookSchema = external_exports.object({
+  event: external_exports.enum(HOOK_EVENTS),
+  command: external_exports.string().min(1).max(4e3).refine((value) => !/[\u0000\uD800-\uDFFF]/u.test(value), {
+    message: "command must be plain text without a NUL character"
+  }),
+  matcher: external_exports.string().min(1).max(255).refine((value) => HOOK_MATCHER.test(value), {
+    message: "matcher must be tool names separated by |, with .* as the only wildcard"
+  }).optional(),
+  timeout_s: external_exports.number().int().min(1).max(600).optional()
+}).strict().refine((hook) => hook.matcher === void 0 || hook.event === "pre_tool_use" || hook.event === "post_tool_use", {
+  message: "matcher applies only to pre_tool_use and post_tool_use hooks",
+  path: ["matcher"]
+});
+var hooksSchema = external_exports.array(hookSchema).max(20);
 var packagesSchema = external_exports.object({
   apt: external_exports.array(packageNameSchema).max(32).default([]),
   pip: external_exports.array(packageNameSchema).max(32).default([]),
@@ -21602,6 +22347,10 @@ var dataSchema = external_exports.object({
     }
   })
 });
+var capabilityPoliciesSchema = external_exports.record(
+  capabilityIdInputSchema,
+  capabilityPermissionPolicySchema
+);
 var publishSchema = external_exports.object({
   name: external_exports.string().trim().min(1, "Give your agent a name."),
   description: external_exports.string().default(""),
@@ -21610,7 +22359,9 @@ var publishSchema = external_exports.object({
   instructions: external_exports.array(instructionFileSchema),
   skills: external_exports.array(skillRefSchema),
   customData: external_exports.array(customDataSchema),
-  capabilities: capabilitiesSchema
+  capabilities: capabilitiesSchema,
+  /** Platform-owned capability permission-policy map. Absent keys default to always_allow. */
+  capabilityPolicies: capabilityPoliciesSchema.optional()
 }).refine((v) => isCompatible(v.agentType, v.llm), {
   path: ["llm"],
   message: "This model isn't available for the selected agent type."
@@ -21624,6 +22375,11 @@ var specPatchSchema = external_exports.object({
   skills: external_exports.array(skillRefSchema).optional(),
   customData: external_exports.array(customDataSchema).optional(),
   capabilities: capabilitiesSchema.optional()
+  // capabilityPolicies is intentionally absent: the chat update_spec tool cannot
+  // set it because Guild's applySpecPatch does not persist it (the policy map
+  // lives in a separate AgentSpecPolicyMap table on the asteroids side and is
+  // written exclusively via PATCH /api/v1/agents/:id).  Including it here would
+  // create an accept-and-drop field.
 }).partial();
 
 export {
@@ -21637,6 +22393,7 @@ export {
   isModelEffortSupported,
   reasoningEffortDocLine,
   sessionResourcesParamSchema,
+  redactLine,
   AGENT_TYPES,
   supersededBy,
   defaultLlm,