@appliqation/agent-core 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +40 -0
  3. package/dist/appq/index.d.ts +3 -0
  4. package/dist/appq/index.d.ts.map +1 -0
  5. package/dist/appq/index.js +3 -0
  6. package/dist/appq/index.js.map +1 -0
  7. package/dist/appq/mcpClient.d.ts +52 -0
  8. package/dist/appq/mcpClient.d.ts.map +1 -0
  9. package/dist/appq/mcpClient.js +79 -0
  10. package/dist/appq/mcpClient.js.map +1 -0
  11. package/dist/appq/scenarioResolvers.d.ts +60 -0
  12. package/dist/appq/scenarioResolvers.d.ts.map +1 -0
  13. package/dist/appq/scenarioResolvers.js +114 -0
  14. package/dist/appq/scenarioResolvers.js.map +1 -0
  15. package/dist/audit/index.d.ts +2 -0
  16. package/dist/audit/index.d.ts.map +1 -0
  17. package/dist/audit/index.js +2 -0
  18. package/dist/audit/index.js.map +1 -0
  19. package/dist/audit/sink.d.ts +69 -0
  20. package/dist/audit/sink.d.ts.map +1 -0
  21. package/dist/audit/sink.js +93 -0
  22. package/dist/audit/sink.js.map +1 -0
  23. package/dist/config/helpers.d.ts +3 -0
  24. package/dist/config/helpers.d.ts.map +1 -0
  25. package/dist/config/helpers.js +16 -0
  26. package/dist/config/helpers.js.map +1 -0
  27. package/dist/config/index.d.ts +2 -0
  28. package/dist/config/index.d.ts.map +1 -0
  29. package/dist/config/index.js +2 -0
  30. package/dist/config/index.js.map +1 -0
  31. package/dist/engine/budget.d.ts +18 -0
  32. package/dist/engine/budget.d.ts.map +1 -0
  33. package/dist/engine/budget.js +31 -0
  34. package/dist/engine/budget.js.map +1 -0
  35. package/dist/engine/index.d.ts +4 -0
  36. package/dist/engine/index.d.ts.map +1 -0
  37. package/dist/engine/index.js +4 -0
  38. package/dist/engine/index.js.map +1 -0
  39. package/dist/engine/loop.d.ts +20 -0
  40. package/dist/engine/loop.d.ts.map +1 -0
  41. package/dist/engine/loop.js +60 -0
  42. package/dist/engine/loop.js.map +1 -0
  43. package/dist/engine/workflowRunner.d.ts +27 -0
  44. package/dist/engine/workflowRunner.d.ts.map +1 -0
  45. package/dist/engine/workflowRunner.js +31 -0
  46. package/dist/engine/workflowRunner.js.map +1 -0
  47. package/dist/evidence/capture.d.ts +53 -0
  48. package/dist/evidence/capture.d.ts.map +1 -0
  49. package/dist/evidence/capture.js +80 -0
  50. package/dist/evidence/capture.js.map +1 -0
  51. package/dist/evidence/index.d.ts +2 -0
  52. package/dist/evidence/index.d.ts.map +1 -0
  53. package/dist/evidence/index.js +2 -0
  54. package/dist/evidence/index.js.map +1 -0
  55. package/dist/index.d.ts +9 -0
  56. package/dist/index.d.ts.map +1 -0
  57. package/dist/index.js +9 -0
  58. package/dist/index.js.map +1 -0
  59. package/dist/providers/anthropic.d.ts +4 -0
  60. package/dist/providers/anthropic.d.ts.map +1 -0
  61. package/dist/providers/anthropic.js +113 -0
  62. package/dist/providers/anthropic.js.map +1 -0
  63. package/dist/providers/index.d.ts +3 -0
  64. package/dist/providers/index.d.ts.map +1 -0
  65. package/dist/providers/index.js +3 -0
  66. package/dist/providers/index.js.map +1 -0
  67. package/dist/providers/openai.d.ts +4 -0
  68. package/dist/providers/openai.d.ts.map +1 -0
  69. package/dist/providers/openai.js +87 -0
  70. package/dist/providers/openai.js.map +1 -0
  71. package/dist/tools/apiTools.d.ts +21 -0
  72. package/dist/tools/apiTools.d.ts.map +1 -0
  73. package/dist/tools/apiTools.js +82 -0
  74. package/dist/tools/apiTools.js.map +1 -0
  75. package/dist/tools/authState.d.ts +21 -0
  76. package/dist/tools/authState.d.ts.map +1 -0
  77. package/dist/tools/authState.js +29 -0
  78. package/dist/tools/authState.js.map +1 -0
  79. package/dist/tools/browserTools.d.ts +35 -0
  80. package/dist/tools/browserTools.d.ts.map +1 -0
  81. package/dist/tools/browserTools.js +313 -0
  82. package/dist/tools/browserTools.js.map +1 -0
  83. package/dist/tools/destructiveActionGate.d.ts +10 -0
  84. package/dist/tools/destructiveActionGate.d.ts.map +1 -0
  85. package/dist/tools/destructiveActionGate.js +40 -0
  86. package/dist/tools/destructiveActionGate.js.map +1 -0
  87. package/dist/tools/gatedDispatcher.d.ts +15 -0
  88. package/dist/tools/gatedDispatcher.d.ts.map +1 -0
  89. package/dist/tools/gatedDispatcher.js +39 -0
  90. package/dist/tools/gatedDispatcher.js.map +1 -0
  91. package/dist/tools/index.d.ts +8 -0
  92. package/dist/tools/index.d.ts.map +1 -0
  93. package/dist/tools/index.js +8 -0
  94. package/dist/tools/index.js.map +1 -0
  95. package/dist/tools/projectContext.d.ts +4 -0
  96. package/dist/tools/projectContext.d.ts.map +1 -0
  97. package/dist/tools/projectContext.js +37 -0
  98. package/dist/tools/projectContext.js.map +1 -0
  99. package/dist/tools/roleInference.d.ts +65 -0
  100. package/dist/tools/roleInference.d.ts.map +1 -0
  101. package/dist/tools/roleInference.js +128 -0
  102. package/dist/tools/roleInference.js.map +1 -0
  103. package/dist/types.d.ts +78 -0
  104. package/dist/types.d.ts.map +1 -0
  105. package/dist/types.js +3 -0
  106. package/dist/types.js.map +1 -0
  107. package/package.json +74 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"browserTools.js","sourceRoot":"","sources":["../../src/tools/browserTools.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,sEAAsE;AACtE,wEAAwE;AACxE,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAI3E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAoB,MAAM,4BAA4B,CAAC;AAe7E,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;KAC5F;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,+BAA+B;QAC5C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;KAChD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,iGAAiG;YACjG,2DAA2D;QAC7D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;KAChD;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,mGAAmG;YACnG,uGAAuG;YACvG,gCAAgC;QAClC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAClE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;SAC3B;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,sEAAsE;QACnF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;YAC9F,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;SAC1B;KACF;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,oDAAoD;QACjE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAClE,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;SAC3B;KACF;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gDAAgD;QAC7D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;KAC5F;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACT,wGAAwG;YACxG,0GAA0G;YAC1G,wDAAwD;QAC1D,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;KAChD;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,sDAAsD;QACnE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;KAChD;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,WAAW,EAAE,wDAAwD;QACrE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;KAChD;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,yEAAyE;QACtF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;SACrE;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,4DAA4D;QACzE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACrE,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC9B;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,2GAA2G;YAC3G,uGAAuG;YACvG,sGAAsG;YACtG,0GAA0G;YAC1G,mGAAmG;QACrG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACpE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACxB;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,wGAAwG;YACxG,2GAA2G;YAC3G,2GAA2G;YAC3G,+CAA+C;QACjD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE;KACtG;CACF,CAAC;AAEF,iGAAiG;AACjG,MAAM,OAAO,sBAAsB;IAqBd;IACA;IArBnB,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IAC/D,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,0EAA0E;IAC1E,sEAAsE;IACtE,oEAAoE;IACpE,wEAAwE;IAChE,KAAK,CAAS;IACd,QAAQ,GAAG,CAAC,CAAC;IACb,cAAc,CAA6B;IAEnD,YACE,IAAU,EACO,aAAsB,EACtB,QAA2B,EAAE;QAD7B,kBAAa,GAAb,aAAa,CAAS;QACtB,UAAK,GAAL,KAAK,CAAwB;QAE9C,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,gHAAgH;IAChH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAE,CAAC;IACtD,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,iCAAiC,CAAC,CAAC;QACpG,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA6B;QACxD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxD,CAAC;YACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;gBAC7B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAC9C,CAAC;YACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,cAAc,EAAE,CAAC;YACpD,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,yEAAyE;gBACzE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC;gBACvD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC/C,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;gBAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,GAAG,GAAG,EAAE,CAAC;YACzD,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,IAAI,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,GAAG,EAAE,EAAE,CAAC;YACjD,CAAC;YACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,EAAE,CAAC;YAClE,CAAC;YACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnD,CAAC;YACD,KAAK,yBAAyB,CAAC,CAAC,CAAC;gBAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;oBAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,GAAG,CAAC,MAAM,wDAAwD,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACnI,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;oBACrE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;wBACd,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,GAAG,CAAC,MAAM,kCAAkC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;oBACzH,CAAC;oBACD,iEAAiE;oBACjE,8DAA8D;oBAC9D,kDAAkD;oBAClD,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,IAAI,EAAE,wBAAwB,GAAG,CAAC,MAAM,mCAAmC,MAAM,CAAC,IAAI,IAAI;4BACxF,gFAAgF;wBAClF,IAAI,EAAE,GAAG;qBACV,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,IAAI,EAAE,wBAAwB,GAAG,CAAC,MAAM,mCAAoC,GAAa,CAAC,OAAO,IAAI;4BACnG,gFAAgF;wBAClF,IAAI,EAAE,GAAG;qBACV,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;YAC9E,CAAC;YACD,KAAK,0BAA0B,CAAC,CAAC,CAAC;gBAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;YAC9E,CAAC;YACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC5D,CAAC;gBACD,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACtC,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,KAAK,IAAI,MAAM,EAAE,EAAE,CAAC;YACtE,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACzF,CAAC;YACD;gBACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAI,GAAG,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAA6B;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACtG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;gBAC7D,IAAI,IAAI,CAAC,GAAG;oBAAE,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBACtF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBACnF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;gBAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YAC3G,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAC5E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC9D,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qCAAqC,EAAE,CAAC;gBAC/F,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;qBACzE,IAAI,IAAI,CAAC,QAAQ,GAAG,KAAK;oBAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACnD,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;gBAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,KAAK,gBAAgB,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC/G,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;oBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC9D,CAAC;gBACD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACtB,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;gBAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,KAAK,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACnF,CAAC;YACD;gBACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,MAAM,GAAG,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;CACF"}
@@ -0,0 +1,10 @@
1
+ import type { ToolResult } from '../types.js';
2
+ export interface ClickTarget {
3
+ label: string;
4
+ tag: string;
5
+ type?: string;
6
+ href?: string;
7
+ }
8
+ export declare const DESTRUCTIVE_VERBS: RegExp[];
9
+ export declare function classifyClick(target: ClickTarget): ToolResult | null;
10
+ //# sourceMappingURL=destructiveActionGate.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"destructiveActionGate.d.ts","sourceRoot":"","sources":["../../src/tools/destructiveActionGate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAQD,eAAO,MAAM,iBAAiB,UAc7B,CAAC;AAEF,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,GAAG,IAAI,CAiBpE"}
@@ -0,0 +1,40 @@
1
+ // Destructive-action gate, checked before any click/submit dispatches. Pure
2
+ // — inspects only a click's accessible label, no appq coupling — shared by
3
+ // every consuming agent that drives a real browser.
4
+ // Final-step or side-effecting verbs. Checked against the accessible label of
5
+ // whatever's about to be clicked, before the click happens. Headless/CI runs
6
+ // have no human watching the transcript live, so this blocks outright on any
7
+ // match rather than a softer "proceed until the final commit step" policy —
8
+ // side effects (reserved inventory, sent OTPs, draft orders) can happen
9
+ // before a final confirmation even without anyone reviewing in real time.
10
+ export const DESTRUCTIVE_VERBS = [
11
+ /\bpay( now)?\b/i,
12
+ /\bpurchase\b/i,
13
+ /\bplace (the )?order\b/i,
14
+ /\bbuy now\b/i,
15
+ /\bcheckout\b/i,
16
+ /\bconfirm (and )?(pay|purchase|order|delete|remove)\b/i,
17
+ /\bdelete\b/i,
18
+ /\bremove (account|everything)\b/i,
19
+ /\bsend (message|email|invite)\b/i,
20
+ /\bpublish\b/i,
21
+ /\bsubmit (order|payment)\b/i,
22
+ /\bunsubscribe\b/i,
23
+ /\bcancel (subscription|account)\b/i,
24
+ ];
25
+ export function classifyClick(target) {
26
+ const text = `${target.label} ${target.type ?? ''}`.trim();
27
+ if (target.href && /^(mailto:|sms:|tel:)/i.test(target.href)) {
28
+ return { ok: false, text: `Blocked: external contact link (${target.href}). Not triggered.` };
29
+ }
30
+ if (DESTRUCTIVE_VERBS.some((re) => re.test(text))) {
31
+ return {
32
+ ok: false,
33
+ text: `Blocked: destructive/side-effecting control "${target.label}". This step was not ` +
34
+ `executed — mark the outcome as blocked/needs-review here rather than guessing a verdict, ` +
35
+ `and note in the report that verification stopped at this control.`,
36
+ };
37
+ }
38
+ return null;
39
+ }
40
+ //# sourceMappingURL=destructiveActionGate.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"destructiveActionGate.js","sourceRoot":"","sources":["../../src/tools/destructiveActionGate.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,oDAAoD;AAWpD,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,iBAAiB;IACjB,eAAe;IACf,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,wDAAwD;IACxD,aAAa;IACb,kCAAkC;IAClC,kCAAkC;IAClC,cAAc;IACd,6BAA6B;IAC7B,kBAAkB;IAClB,oCAAoC;CACrC,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAE3D,IAAI,MAAM,CAAC,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;IAChG,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EACF,gDAAgD,MAAM,CAAC,KAAK,uBAAuB;gBACnF,2FAA2F;gBAC3F,mEAAmE;SACtE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
@@ -0,0 +1,15 @@
1
+ import type { LlmToolDef, ToolDispatcher, ToolResult } from '../types.js';
2
+ import type { McpClient } from '../appq/mcpClient.js';
3
+ export type ToolAllowlist = Set<string>;
4
+ /**
5
+ * The actual enforcement point for "the one hardcoded client-side
6
+ * invariant" every consuming agent relies on. fetchAppqToolDefs() only
7
+ * controls what's *offered* to the model; this is what stops a call that
8
+ * shouldn't happen from *executing*, regardless of what the model attempts
9
+ * or what a served prompt says.
10
+ */
11
+ export declare function assertToolAllowed(toolName: string, allowlist: ToolAllowlist): void;
12
+ export declare function fetchAppqToolDefs(client: McpClient, allowlist: ToolAllowlist): Promise<LlmToolDef[]>;
13
+ export declare function dispatchAppqTool(client: McpClient, name: string, args: Record<string, unknown>): Promise<ToolResult>;
14
+ export declare function createGatedAppqDispatcher(client: McpClient, allowlist: ToolAllowlist): ToolDispatcher;
15
+ //# sourceMappingURL=gatedDispatcher.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"gatedDispatcher.d.ts","sourceRoot":"","sources":["../../src/tools/gatedDispatcher.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AAExC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,IAAI,CASlF;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAK1G;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAG1H;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,GAAG,cAAc,CAKrG"}
@@ -0,0 +1,39 @@
1
+ // Wraps appq MCP tools as LLM-callable tool defs, filtered to whatever
2
+ // allowlist the calling stage was constructed with, and enforces that
3
+ // allowlist before every dispatch. This is the mechanism only — the
4
+ // allowlist *content* (which tools a given agent/stage may touch) is each
5
+ // consuming agent's own domain knowledge, kept in its own tools/safety.ts,
6
+ // never here. Schemas are fetched live from appq's tools/list rather than
7
+ // hardcoded, so this stays correct as appq's tool surface evolves.
8
+ /**
9
+ * The actual enforcement point for "the one hardcoded client-side
10
+ * invariant" every consuming agent relies on. fetchAppqToolDefs() only
11
+ * controls what's *offered* to the model; this is what stops a call that
12
+ * shouldn't happen from *executing*, regardless of what the model attempts
13
+ * or what a served prompt says.
14
+ */
15
+ export function assertToolAllowed(toolName, allowlist) {
16
+ if (!allowlist.has(toolName)) {
17
+ throw new Error(`Tool "${toolName}" is not in this stage's allowlist. This is a hardcoded ` +
18
+ `boundary — no workflow prompt can widen it. If this tool genuinely needs to be ` +
19
+ `reachable from this stage, that's a code change to the agent's own tools/safety.ts, ` +
20
+ `not a prompt change.`);
21
+ }
22
+ }
23
+ export async function fetchAppqToolDefs(client, allowlist) {
24
+ const all = await client.listTools();
25
+ return all
26
+ .filter((t) => allowlist.has(t.name))
27
+ .map((t) => ({ name: t.name, description: t.description, inputSchema: t.inputSchema }));
28
+ }
29
+ export async function dispatchAppqTool(client, name, args) {
30
+ const outcome = await client.callTool(name, args);
31
+ return { ok: outcome.ok, text: outcome.text, data: outcome.raw };
32
+ }
33
+ export function createGatedAppqDispatcher(client, allowlist) {
34
+ return async (name, args) => {
35
+ assertToolAllowed(name, allowlist);
36
+ return dispatchAppqTool(client, name, args);
37
+ };
38
+ }
39
+ //# sourceMappingURL=gatedDispatcher.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"gatedDispatcher.js","sourceRoot":"","sources":["../../src/tools/gatedDispatcher.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AAOnE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAwB;IAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,SAAS,QAAQ,0DAA0D;YACzE,iFAAiF;YACjF,sFAAsF;YACtF,sBAAsB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAiB,EAAE,SAAwB;IACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACrC,OAAO,GAAG;SACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAsC,EAAE,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAiB,EAAE,IAAY,EAAE,IAA6B;IACnG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,SAAwB;IACnF,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC"}
@@ -0,0 +1,8 @@
1
+ export { assertToolAllowed, fetchAppqToolDefs, dispatchAppqTool, createGatedAppqDispatcher, type ToolAllowlist } from './gatedDispatcher.js';
2
+ export { classifyClick, DESTRUCTIVE_VERBS, type ClickTarget } from './destructiveActionGate.js';
3
+ export { PlaywrightBrowserTools, BROWSER_TOOL_DEFS, type ClickGate, type ScreenshotSink, type BrowserToolsHooks } from './browserTools.js';
4
+ export { ApiRequestTools, API_TOOL_DEFS, type ApiRequestRecord } from './apiTools.js';
5
+ export { resolveStorageState, resolveApiAuth, type ApiAuthHeader } from './authState.js';
6
+ export { PROJECT_CONTEXT_TOOL, createReadOnlyProjectContextDispatcher } from './projectContext.js';
7
+ export { knownRolesForProject, inferRole, isApiTest, parseScenarioTcList, parseTestSetTcList, type TcInfo } from './roleInference.js';
8
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7I,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAChG,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3I,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC"}
@@ -0,0 +1,8 @@
1
+ export { assertToolAllowed, fetchAppqToolDefs, dispatchAppqTool, createGatedAppqDispatcher } from './gatedDispatcher.js';
2
+ export { classifyClick, DESTRUCTIVE_VERBS } from './destructiveActionGate.js';
3
+ export { PlaywrightBrowserTools, BROWSER_TOOL_DEFS } from './browserTools.js';
4
+ export { ApiRequestTools, API_TOOL_DEFS } from './apiTools.js';
5
+ export { resolveStorageState, resolveApiAuth } from './authState.js';
6
+ export { PROJECT_CONTEXT_TOOL, createReadOnlyProjectContextDispatcher } from './projectContext.js';
7
+ export { knownRolesForProject, inferRole, isApiTest, parseScenarioTcList, parseTestSetTcList } from './roleInference.js';
8
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,yBAAyB,EAAsB,MAAM,sBAAsB,CAAC;AAC7I,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAoB,MAAM,4BAA4B,CAAC;AAChG,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAA+D,MAAM,mBAAmB,CAAC;AAC3I,OAAO,EAAE,eAAe,EAAE,aAAa,EAAyB,MAAM,eAAe,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,sCAAsC,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAe,MAAM,oBAAoB,CAAC"}
@@ -0,0 +1,4 @@
1
+ import type { ToolDispatcher } from '../types.js';
2
+ export declare const PROJECT_CONTEXT_TOOL = "enrich_project_context";
3
+ export declare function createReadOnlyProjectContextDispatcher(inner: ToolDispatcher): ToolDispatcher;
4
+ //# sourceMappingURL=projectContext.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"projectContext.d.ts","sourceRoot":"","sources":["../../src/tools/projectContext.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AAE9D,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAgB5F"}
@@ -0,0 +1,37 @@
1
+ // enrich_project_context support: a hardcoded, non-negotiable argument-level
2
+ // gate, the same class of thing as destructiveActionGate.ts's click-verb
3
+ // check or a consuming agent's own commandGate-style argv-shape check — just
4
+ // applied to one argument value instead of a tool name or command shape.
5
+ //
6
+ // The tool itself has both action=read and action=write modes. A "zero
7
+ // write tools" invariant is normally enforced by tool-NAME allowlisting
8
+ // (gatedDispatcher.ts), which can't express "this one tool, but only this
9
+ // one argument value" — so this dispatcher-level interceptor is what
10
+ // actually keeps the guarantee true for this specific tool. Allowlists the
11
+ // one safe shape (action=read) rather than denylisting the unsafe one:
12
+ // anything that isn't explicitly "read" is refused, including a missing or
13
+ // malformed action, not just an explicit "write".
14
+ //
15
+ // Shared here (not local to one agent) because more than one unsupervised
16
+ // agent needs the identical guarantee: an interactive appq workflow prompt
17
+ // may itself instruct a write-back as "persistent memory" once a human has
18
+ // reviewed its report, but a headless agent has no equivalent supervision
19
+ // moment, so it holds the conservative default regardless of what the
20
+ // served prompt asks for.
21
+ export const PROJECT_CONTEXT_TOOL = 'enrich_project_context';
22
+ export function createReadOnlyProjectContextDispatcher(inner) {
23
+ return async (name, args) => {
24
+ if (name !== PROJECT_CONTEXT_TOOL)
25
+ return inner(name, args);
26
+ if (args.action !== 'read') {
27
+ return {
28
+ ok: false,
29
+ text: `${PROJECT_CONTEXT_TOOL} is read-only for this agent — action "${String(args.action)}" is refused. ` +
30
+ 'This is a hardcoded boundary, not a prompt-adjustable one: this agent never writes to the project ' +
31
+ 'context document, only reads it.',
32
+ };
33
+ }
34
+ return inner(name, args);
35
+ };
36
+ }
37
+ //# sourceMappingURL=projectContext.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"projectContext.js","sourceRoot":"","sources":["../../src/tools/projectContext.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AACvE,2EAA2E;AAC3E,kDAAkD;AAClD,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,0BAA0B;AAI1B,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAE7D,MAAM,UAAU,sCAAsC,CAAC,KAAqB;IAC1E,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1B,IAAI,IAAI,KAAK,oBAAoB;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EACF,GAAG,oBAAoB,0CAA0C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB;oBACpG,oGAAoG;oBACpG,kCAAkC;aAChB,CAAC;QACzB,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}
@@ -0,0 +1,65 @@
1
+ /**
2
+ * Scans process.env for APPQ_PROJECT_<id>_<ROLE>_USERNAME keys to discover
3
+ * which roles this environment actually has credentials configured for.
4
+ * Role names are UI-validated to already be lowercase with no spaces, so
5
+ * the env var's role segment round-trips back to the real role name
6
+ * exactly — no sanitization/normalization needed on this side.
7
+ */
8
+ export declare function knownRolesForProject(projectId: number): string[];
9
+ export interface TcInfo {
10
+ testCaseUuid: string;
11
+ name: string;
12
+ tag?: string;
13
+ }
14
+ /**
15
+ * Returns the role a TC should authenticate as, or null for "run
16
+ * unauthenticated" (either explicitly signalled, or no confident signal
17
+ * either way — see module docblock for why that's the safe default, not
18
+ * an error).
19
+ *
20
+ * Precedence:
21
+ * 1. Explicit `role:<name>` tag on the TC — `role:anonymous` means
22
+ * explicitly unauthenticated, same as any other unmatched case.
23
+ * 2. "anonymous" appearing as a whole word in the TC's own title —
24
+ * same explicit-unauthenticated signal, just spelled in the name
25
+ * instead of a tag.
26
+ * 3. A known (locally credentialed) role's name appearing in the TC's
27
+ * title.
28
+ * 4. No match — unauthenticated, not an error.
29
+ */
30
+ export declare function inferRole(tc: TcInfo, knownRoles: string[]): string | null;
31
+ /**
32
+ * Whether a TC's own tag(s) mark it as an API test case (execute via
33
+ * http_request, judge from a captured request/response pair) rather than
34
+ * the default UI/browser path. `tag` can hold multiple comma-separated
35
+ * values (get_scenario's real format, e.g. "Functional, Appq_Auto") so
36
+ * this checks each one individually rather than the whole string at once
37
+ * — same deterministic, no-LLM-call discipline as inferRole() above, for
38
+ * the same reason: test-type selection is safety/routing-adjacent (it
39
+ * decides whether a browser or a raw HTTP client gets offered at all),
40
+ * kept out of the model's hands like every other decision of that kind in
41
+ * this codebase.
42
+ */
43
+ export declare function isApiTest(tc: TcInfo): boolean;
44
+ /**
45
+ * Parses get_scenario's formatted TC list text (" 1. Name (UUID: x) [Tag:
46
+ * y]") into structured {testCaseUuid, name, tag} entries. Coupled to that
47
+ * tool's current text format (GetScenarioTool.php) — the same trade-off
48
+ * fetchScenarioInfo() already accepts parsing "Project ID: N" out of the
49
+ * same response, not a new fragility this introduces.
50
+ */
51
+ export declare function parseScenarioTcList(scenarioText: string): TcInfo[];
52
+ /**
53
+ * Parses get_test_set's formatted TC list text — a different shape than
54
+ * get_scenario's, since a test set can span multiple scenarios: each TC's
55
+ * own "Scenario ID: N" appears on the line *after* its name/UUID, not
56
+ * inline, and the tag (when present) rides on that second line too
57
+ * ("Scenario ID: 1540 | Tag: Functional") rather than a "[Tag: x]" suffix
58
+ * on the first. A TC's scenario_id isn't captured here as a separate
59
+ * field — it's always re-derivable from the UUID itself via
60
+ * scenarioIdFromTcUuid(), the same source of truth every other TC-scoped
61
+ * resolution in this package already trusts, so there's no second value
62
+ * that could quietly disagree with it.
63
+ */
64
+ export declare function parseTestSetTcList(testSetText: string): TcInfo[];
65
+ //# sourceMappingURL=roleInference.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"roleInference.d.ts","sourceRoot":"","sources":["../../src/tools/roleInference.ts"],"names":[],"mappings":"AAoBA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAWhE;AAED,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAczE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAM7C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAQlE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAQhE"}
@@ -0,0 +1,128 @@
1
+ // Per-TC role inference for mixed-role scenarios (e.g. RBAC tests: "admin
2
+ // can see settings", "standard user gets 403 on the same page" — both
3
+ // belong in one scenario, but need different authenticated sessions).
4
+ // Mirrors the precedence already proven in production by
5
+ // workers/automan-worker/src/services/AIScriptGenerator.js's
6
+ // parseRoleFromTestcaseName()/tcIntent.tag handling for the deterministic
7
+ // pipeline — same idea, reused rather than reinvented, and — unlike that
8
+ // implementation — deliberately never falls back to an LLM call: a caller
9
+ // can already see everything it needs (env vars + TC tag/name) without one,
10
+ // and keeping role selection out of LLM judgment is consistent with every
11
+ // other safety-adjacent decision in this codebase (dry-run, destructive-
12
+ // action gate, image_fid guard).
13
+ //
14
+ // No ambiguity-blocking here on purpose: when no role can be confidently
15
+ // determined, the TC simply runs unauthenticated. If it actually needed a
16
+ // session, the existing fail-closed executor/validator machinery already
17
+ // surfaces that honestly (blocked/failed on a login wall) — duplicating a
18
+ // hard stop at this layer would wrongly block the common case where a
19
+ // mixed scenario legitimately has some TCs that need no auth at all.
20
+ /**
21
+ * Scans process.env for APPQ_PROJECT_<id>_<ROLE>_USERNAME keys to discover
22
+ * which roles this environment actually has credentials configured for.
23
+ * Role names are UI-validated to already be lowercase with no spaces, so
24
+ * the env var's role segment round-trips back to the real role name
25
+ * exactly — no sanitization/normalization needed on this side.
26
+ */
27
+ export function knownRolesForProject(projectId) {
28
+ const prefix = `APPQ_PROJECT_${projectId}_`;
29
+ const suffix = '_USERNAME';
30
+ const roles = new Set();
31
+ for (const key of Object.keys(process.env)) {
32
+ if (key.startsWith(prefix) && key.endsWith(suffix)) {
33
+ const role = key.slice(prefix.length, key.length - suffix.length).toLowerCase();
34
+ if (role)
35
+ roles.add(role);
36
+ }
37
+ }
38
+ return [...roles];
39
+ }
40
+ /**
41
+ * Returns the role a TC should authenticate as, or null for "run
42
+ * unauthenticated" (either explicitly signalled, or no confident signal
43
+ * either way — see module docblock for why that's the safe default, not
44
+ * an error).
45
+ *
46
+ * Precedence:
47
+ * 1. Explicit `role:<name>` tag on the TC — `role:anonymous` means
48
+ * explicitly unauthenticated, same as any other unmatched case.
49
+ * 2. "anonymous" appearing as a whole word in the TC's own title —
50
+ * same explicit-unauthenticated signal, just spelled in the name
51
+ * instead of a tag.
52
+ * 3. A known (locally credentialed) role's name appearing in the TC's
53
+ * title.
54
+ * 4. No match — unauthenticated, not an error.
55
+ */
56
+ export function inferRole(tc, knownRoles) {
57
+ const tag = tc.tag?.trim().toLowerCase();
58
+ if (tag?.startsWith('role:')) {
59
+ const explicit = tag.slice('role:'.length).trim();
60
+ return explicit && explicit !== 'anonymous' ? explicit : null;
61
+ }
62
+ const lowerName = tc.name.toLowerCase();
63
+ if (/\banonymous\b/.test(lowerName))
64
+ return null;
65
+ for (const role of knownRoles) {
66
+ if (lowerName.includes(role))
67
+ return role;
68
+ }
69
+ return null;
70
+ }
71
+ /**
72
+ * Whether a TC's own tag(s) mark it as an API test case (execute via
73
+ * http_request, judge from a captured request/response pair) rather than
74
+ * the default UI/browser path. `tag` can hold multiple comma-separated
75
+ * values (get_scenario's real format, e.g. "Functional, Appq_Auto") so
76
+ * this checks each one individually rather than the whole string at once
77
+ * — same deterministic, no-LLM-call discipline as inferRole() above, for
78
+ * the same reason: test-type selection is safety/routing-adjacent (it
79
+ * decides whether a browser or a raw HTTP client gets offered at all),
80
+ * kept out of the model's hands like every other decision of that kind in
81
+ * this codebase.
82
+ */
83
+ export function isApiTest(tc) {
84
+ if (!tc.tag)
85
+ return false;
86
+ return tc.tag
87
+ .split(',')
88
+ .map((t) => t.trim().toLowerCase())
89
+ .includes('api');
90
+ }
91
+ /**
92
+ * Parses get_scenario's formatted TC list text (" 1. Name (UUID: x) [Tag:
93
+ * y]") into structured {testCaseUuid, name, tag} entries. Coupled to that
94
+ * tool's current text format (GetScenarioTool.php) — the same trade-off
95
+ * fetchScenarioInfo() already accepts parsing "Project ID: N" out of the
96
+ * same response, not a new fragility this introduces.
97
+ */
98
+ export function parseScenarioTcList(scenarioText) {
99
+ const tcs = [];
100
+ const lineRe = /^\s*\d+\.\s+(.+?)\s*\(UUID:\s*([^)]+)\)(?:\s*\[Tag:\s*([^\]]+)\])?\s*$/gm;
101
+ let m;
102
+ while ((m = lineRe.exec(scenarioText))) {
103
+ tcs.push({ name: m[1].trim(), testCaseUuid: m[2].trim(), tag: m[3]?.trim() });
104
+ }
105
+ return tcs;
106
+ }
107
+ /**
108
+ * Parses get_test_set's formatted TC list text — a different shape than
109
+ * get_scenario's, since a test set can span multiple scenarios: each TC's
110
+ * own "Scenario ID: N" appears on the line *after* its name/UUID, not
111
+ * inline, and the tag (when present) rides on that second line too
112
+ * ("Scenario ID: 1540 | Tag: Functional") rather than a "[Tag: x]" suffix
113
+ * on the first. A TC's scenario_id isn't captured here as a separate
114
+ * field — it's always re-derivable from the UUID itself via
115
+ * scenarioIdFromTcUuid(), the same source of truth every other TC-scoped
116
+ * resolution in this package already trusts, so there's no second value
117
+ * that could quietly disagree with it.
118
+ */
119
+ export function parseTestSetTcList(testSetText) {
120
+ const tcs = [];
121
+ const lineRe = /^\s*\d+\.\s+(.+?)\s*\(UUID:\s*([^)]+)\)\s*\n\s*Scenario ID:\s*\d+(?:\s*\|\s*Tag:\s*([^\n]+))?\s*$/gm;
122
+ let m;
123
+ while ((m = lineRe.exec(testSetText))) {
124
+ tcs.push({ name: m[1].trim(), testCaseUuid: m[2].trim(), tag: m[3]?.trim() });
125
+ }
126
+ return tcs;
127
+ }
128
+ //# sourceMappingURL=roleInference.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"roleInference.js","sourceRoot":"","sources":["../../src/tools/roleInference.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,sEAAsE;AACtE,sEAAsE;AACtE,yDAAyD;AACzD,6DAA6D;AAC7D,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,iCAAiC;AACjC,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,qEAAqE;AAErE;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,MAAM,GAAG,gBAAgB,SAAS,GAAG,CAAC;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAChF,IAAI,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAQD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,UAAoB;IACxD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,QAAQ,IAAI,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,EAAE,CAAC,GAAG;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,0EAA0E,CAAC;IAC1F,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,qGAAqG,CAAC;IACrH,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
@@ -0,0 +1,78 @@
1
+ export interface LlmToolDef {
2
+ name: string;
3
+ description: string;
4
+ inputSchema: Record<string, unknown>;
5
+ }
6
+ export interface LlmToolCall {
7
+ id: string;
8
+ name: string;
9
+ arguments: Record<string, unknown>;
10
+ }
11
+ export interface LlmImage {
12
+ /** Base64-encoded image bytes (no data: URI prefix). */
13
+ data: string;
14
+ mimeType: string;
15
+ /** Optional caption, e.g. "step 3 screenshot" — helps the model refer back to it. */
16
+ label?: string;
17
+ }
18
+ export interface LlmMessage {
19
+ role: 'user' | 'assistant' | 'tool';
20
+ content: string;
21
+ toolCalls?: LlmToolCall[];
22
+ toolCallId?: string;
23
+ /** Images attached to a tool result — see ToolResult.images. */
24
+ images?: LlmImage[];
25
+ }
26
+ export interface LlmCompleteResult {
27
+ text: string;
28
+ toolCalls: LlmToolCall[];
29
+ usage?: {
30
+ inputTokens: number;
31
+ outputTokens: number;
32
+ /** Tokens written to the prompt cache this turn (first time a prefix is seen). */
33
+ cacheWriteTokens?: number;
34
+ /** Tokens served from the prompt cache this turn (cheap re-reads of a cached prefix). */
35
+ cacheReadTokens?: number;
36
+ };
37
+ }
38
+ export interface ProviderAdapter {
39
+ complete(args: {
40
+ system: string;
41
+ messages: LlmMessage[];
42
+ tools: LlmToolDef[];
43
+ signal?: AbortSignal;
44
+ }): Promise<LlmCompleteResult>;
45
+ }
46
+ export interface ToolResult {
47
+ ok: boolean;
48
+ text: string;
49
+ data?: unknown;
50
+ /**
51
+ * Real image content to attach as vision input on the next turn — not just
52
+ * a URL in text. Populated when a tool result should actually be *seen* by
53
+ * the model, not merely referenced.
54
+ */
55
+ images?: LlmImage[];
56
+ }
57
+ export interface RunBudget {
58
+ maxCalls: number;
59
+ maxPages: number;
60
+ maxMillis: number;
61
+ /** Hard backstop on model turns, independent of the other caps — see engine/loop.ts. */
62
+ maxTurns: number;
63
+ }
64
+ export type ToolDispatcher = (name: string, args: Record<string, unknown>) => Promise<ToolResult>;
65
+ export interface WorkflowRunOptions {
66
+ workflowName: string;
67
+ workflowArgs?: Record<string, unknown>;
68
+ tools: LlmToolDef[];
69
+ dispatch: ToolDispatcher;
70
+ budget: RunBudget;
71
+ signal?: AbortSignal;
72
+ }
73
+ export interface WorkflowRunResult {
74
+ report: string;
75
+ turns: number;
76
+ budgetExceeded: boolean;
77
+ }
78
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,kFAAkF;QAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,yFAAyF;QACzF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE;QACb,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,UAAU,EAAE,CAAC;QACvB,KAAK,EAAE,UAAU,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAElG,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,OAAO,CAAC;CACzB"}
package/dist/types.js ADDED
@@ -0,0 +1,3 @@
1
+ // Shared, dependency-free domain types for the engine.
2
+ export {};
3
+ //# sourceMappingURL=types.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,uDAAuD"}
package/package.json ADDED
@@ -0,0 +1,74 @@
1
+ {
2
+ "name": "@appliqation/agent-core",
3
+ "version": "0.1.0",
4
+ "description": "Shared engine (think->act->observe loop, budget tracking, appq MCP client, gated tool dispatch, Playwright browser tools, evidence capture) for Appliqation's family of standalone agents.",
5
+ "type": "module",
6
+ "main": "dist/index.js",
7
+ "types": "dist/index.d.ts",
8
+ "engines": {
9
+ "node": ">=20"
10
+ },
11
+ "exports": {
12
+ ".": {
13
+ "types": "./dist/index.d.ts",
14
+ "import": "./dist/index.js"
15
+ },
16
+ "./engine": {
17
+ "types": "./dist/engine/index.d.ts",
18
+ "import": "./dist/engine/index.js"
19
+ },
20
+ "./appq": {
21
+ "types": "./dist/appq/index.d.ts",
22
+ "import": "./dist/appq/index.js"
23
+ },
24
+ "./providers": {
25
+ "types": "./dist/providers/index.d.ts",
26
+ "import": "./dist/providers/index.js"
27
+ },
28
+ "./tools": {
29
+ "types": "./dist/tools/index.d.ts",
30
+ "import": "./dist/tools/index.js"
31
+ },
32
+ "./evidence": {
33
+ "types": "./dist/evidence/index.d.ts",
34
+ "import": "./dist/evidence/index.js"
35
+ },
36
+ "./config": {
37
+ "types": "./dist/config/index.d.ts",
38
+ "import": "./dist/config/index.js"
39
+ },
40
+ "./audit": {
41
+ "types": "./dist/audit/index.d.ts",
42
+ "import": "./dist/audit/index.js"
43
+ }
44
+ },
45
+ "files": [
46
+ "dist/",
47
+ "README.md",
48
+ "LICENSE"
49
+ ],
50
+ "scripts": {
51
+ "build": "tsc -p tsconfig.build.json",
52
+ "typecheck": "tsc -p tsconfig.json --noEmit",
53
+ "lint": "eslint src --ext .ts",
54
+ "test": "vitest run",
55
+ "test:watch": "vitest"
56
+ },
57
+ "dependencies": {
58
+ "@anthropic-ai/sdk": "^0.39.0",
59
+ "mongodb": "^6.21.0",
60
+ "openai": "^4.87.3"
61
+ },
62
+ "peerDependencies": {
63
+ "@appliqation/automation-sdk": "^2.7.0",
64
+ "playwright": ">=1.51.0"
65
+ },
66
+ "devDependencies": {
67
+ "@appliqation/automation-sdk": "^2.7.0",
68
+ "@types/node": "^22.13.10",
69
+ "playwright": "^1.51.0",
70
+ "tsx": "^4.19.3",
71
+ "typescript": "^5.8.2",
72
+ "vitest": "^3.2.7"
73
+ }
74
+ }