@backendkit-labs/agent-coding 0.14.0

package/dist/tools/edit-file.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.editFileTool = void 0;
+const fs_1 = require("fs");
+const agent_core_1 = require("@backendkit-labs/agent-core");
+const path_sandbox_1 = require("./path-sandbox");
+const secret_scanner_1 = require("./secret-scanner");
+exports.editFileTool = (0, agent_core_1.defineTool)({
+    name: 'edit_file',
+    description: 'Replace an exact string in a file. Safer than write_file for partial edits.',
+    input: agent_core_1.z.object({
+        file_path: agent_core_1.z.string().describe('Path to the file'),
+        old_string: agent_core_1.z.string().describe('Exact text to replace (must be unique in the file)'),
+        new_string: agent_core_1.z.string().describe('Replacement text'),
+        replace_all: agent_core_1.z.boolean().default(false).describe('Replace all occurrences (default: false)'),
+    }),
+    execute: async ({ file_path, old_string, new_string, replace_all }, ctx) => {
+        try {
+            const abs = (0, path_sandbox_1.resolveAndCheck)(ctx.workingDir, file_path);
+            const fwWarn = (0, path_sandbox_1.checkFrameworkProtection)(abs, ctx.workingDir);
+            if (fwWarn)
+                return `Error: ${fwWarn}`;
+            const content = (0, fs_1.readFileSync)(abs, 'utf-8');
+            if (!content.includes(old_string)) {
+                return `Error: old_string not found in "${abs}"`;
+            }
+            if (!replace_all) {
+                const count = content.split(old_string).length - 1;
+                if (count > 1) {
+                    return `Error: old_string appears ${count} times in "${abs}". Use replace_all: true or provide more context.`;
+                }
+            }
+            const updated = replace_all
+                ? content.split(old_string).join(new_string)
+                : content.replace(old_string, new_string);
+            const warning = (0, secret_scanner_1.warnIfSecrets)(abs, updated);
+            (0, agent_core_1.atomicWriteSync)(abs, updated);
+            return warning ? `Edited: ${abs}\n⚠ ${warning}` : `Edited: ${abs}`;
+        }
+        catch (err) {
+            return `Error: ${err.message}`;
+        }
+    },
+});
+//# sourceMappingURL=edit-file.js.map

package/dist/tools/edit-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-file.js","sourceRoot":"","sources":["../../src/tools/edit-file.ts"],"names":[],"mappings":";;;AAAA,2BAAkC;AAClC,4DAA6E;AAC7E,iDAA2E;AAC3E,qDAAiD;AAEpC,QAAA,YAAY,GAAG,IAAA,uBAAU,EAAC;IACnC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC;QACZ,SAAS,EAAI,cAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpD,UAAU,EAAG,cAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;QACtF,UAAU,EAAG,cAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpD,WAAW,EAAE,cAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KAC/F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE;QACvE,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAA,8BAAe,EAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,IAAA,uCAAwB,EAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,MAAM;gBAAE,OAAO,UAAU,MAAM,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAE3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,OAAO,mCAAmC,GAAG,GAAG,CAAC;YACrD,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBACnD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACZ,OAAO,6BAA6B,KAAK,cAAc,GAAG,mDAAmD,CAAC;gBAClH,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,WAAW;gBACvB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC5C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAE9C,MAAM,OAAO,GAAG,IAAA,8BAAa,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5C,IAAA,4BAAe,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}

package/dist/tools/list-directory.d.ts

@@ -0,0 +1,2 @@
+export declare const listDirectoryTool: import("@backendkit-labs/agent-core").ToolDefinition;
+//# sourceMappingURL=list-directory.d.ts.map

package/dist/tools/list-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-directory.d.ts","sourceRoot":"","sources":["../../src/tools/list-directory.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,iBAAiB,sDAkB5B,CAAC"}

package/dist/tools/list-directory.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listDirectoryTool = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const agent_core_1 = require("@backendkit-labs/agent-core");
+const path_sandbox_1 = require("./path-sandbox");
+function listRecursive(dir, depth, maxDepth) {
+    if (depth > maxDepth)
+        return [];
+    const lines = [];
+    for (const entry of (0, fs_1.readdirSync)(dir, { withFileTypes: true })) {
+        if (entry.name.startsWith('.') || entry.name === 'node_modules')
+            continue;
+        const indent = '  '.repeat(depth);
+        if (entry.isDirectory()) {
+            lines.push(`${indent}${entry.name}/`);
+            lines.push(...listRecursive((0, path_1.join)(dir, entry.name), depth + 1, maxDepth));
+        }
+        else {
+            lines.push(`${indent}${entry.name}`);
+        }
+    }
+    return lines;
+}
+exports.listDirectoryTool = (0, agent_core_1.defineTool)({
+    name: 'list_directory',
+    description: 'List files and directories inside the working directory, recursively.',
+    input: agent_core_1.z.object({
+        path: agent_core_1.z.string().describe('Directory path to list'),
+        max_depth: agent_core_1.z.number().int().min(1).max(10).default(3).describe('Max recursion depth (default: 3)'),
+    }),
+    execute: async ({ path: inputPath, max_depth }, ctx) => {
+        try {
+            const abs = (0, path_sandbox_1.resolveAndCheck)(ctx.workingDir, inputPath);
+            const stat = (0, fs_1.statSync)(abs);
+            if (!stat.isDirectory())
+                return `${abs} (file, not a directory)`;
+            const lines = listRecursive(abs, 0, max_depth);
+            return lines.join('\n') || '(empty directory)';
+        }
+        catch (err) {
+            return `Error: ${err.message}`;
+        }
+    },
+});
+//# sourceMappingURL=list-directory.js.map

package/dist/tools/list-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-directory.js","sourceRoot":"","sources":["../../src/tools/list-directory.ts"],"names":[],"mappings":";;;AAAA,2BAA2C;AAC3C,+BAA4B;AAC5B,4DAA4D;AAC5D,iDAAiD;AAEjD,SAAS,aAAa,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;IAC/D,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAA,gBAAW,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAA,WAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7E,CAAC;aAAM,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAEY,QAAA,iBAAiB,GAAG,IAAA,uBAAU,EAAC;IACxC,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,uEAAuE;IACpF,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC;QACZ,IAAI,EAAO,cAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACxD,SAAS,EAAE,cAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KACrG,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE;QACnD,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAA,8BAAe,EAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,aAAQ,EAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO,GAAG,GAAG,0BAA0B,CAAC;YACjE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}

package/dist/tools/path-sandbox.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Resolves `filePath` relative to `workingDir` and verifies the result
+ * is contained within `workingDir`. Throws on path traversal attempts.
+ *
+ * Uses prefix comparison instead of relative() to correctly handle cross-drive
+ * paths (D:\outside) and UNC paths (\\server\share) on Windows, where relative()
+ * returns an absolute path that does not start with '..'.
+ */
+/**
+ * Resolves `filePath` and verifies it is contained within one of the allowed
+ * roots: `workingDir` (primary) or any `additionalRoots` (e.g. the agent's
+ * memory directory at ~/.{appName}/projects/{key}).
+ * Throws on path traversal attempts outside all allowed roots.
+ */
+export declare function resolveAndCheck(workingDir: string | undefined, filePath: string, additionalRoots?: string[]): string;
+/**
+ * Blocks writes to framework source directories when the agent is running in a
+ * project context (workingDir is NOT a framework package directory).
+ *
+ * Returns an error string when protection triggers, undefined when the write
+ * is safe.
+ *
+ * Protection is SKIPPED when:
+ * - workingDir itself is inside a protected segment (user is developing the
+ *   framework — all writes to framework source are intentional).
+ * - workingDir is the monorepo root (user has explicitly scoped to the full
+ *   repo; checkFrameworkProtection cannot tell which project they intend to
+ *   work on, so it defers to path-sandbox alone and the startup warning).
+ */
+export declare function checkFrameworkProtection(abs: string, workingDir: string | undefined): string | undefined;
+//# sourceMappingURL=path-sandbox.d.ts.map

package/dist/tools/path-sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-sandbox.d.ts","sourceRoot":"","sources":["../../src/tools/path-sandbox.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAC3B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,MAAM,EAChB,eAAe,GAAE,MAAM,EAAO,GAC/B,MAAM,CA2BR;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgCxG"}

package/dist/tools/path-sandbox.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAndCheck = resolveAndCheck;
+exports.checkFrameworkProtection = checkFrameworkProtection;
+const path_1 = require("path");
+/**
+ * Resolves `filePath` relative to `workingDir` and verifies the result
+ * is contained within `workingDir`. Throws on path traversal attempts.
+ *
+ * Uses prefix comparison instead of relative() to correctly handle cross-drive
+ * paths (D:\outside) and UNC paths (\\server\share) on Windows, where relative()
+ * returns an absolute path that does not start with '..'.
+ */
+/**
+ * Resolves `filePath` and verifies it is contained within one of the allowed
+ * roots: `workingDir` (primary) or any `additionalRoots` (e.g. the agent's
+ * memory directory at ~/.{appName}/projects/{key}).
+ * Throws on path traversal attempts outside all allowed roots.
+ */
+function resolveAndCheck(workingDir, filePath, additionalRoots = []) {
+    const cwd = workingDir ?? process.cwd();
+    const abs = (0, path_1.resolve)(cwd, filePath);
+    // Normalize separators to forward slashes before comparison so that
+    // mixed-slash paths (workingDir passed as C:/... but resolve() returns C:\...)
+    // don't cause false-negative containment checks on Windows.
+    const norm = (p) => {
+        const s = process.platform === 'win32' ? p.toLowerCase() : p;
+        return s.replace(/\\/g, '/');
+    };
+    const isInside = (root) => {
+        const prefix = norm(root).endsWith('/') ? norm(root) : norm(root) + '/';
+        return norm(abs) === norm(root) || norm(abs).startsWith(prefix);
+    };
+    if (isInside(cwd))
+        return abs;
+    for (const root of additionalRoots) {
+        if (isInside(root))
+            return abs;
+    }
+    throw new Error(`Access denied: "${filePath}" resolves outside the working directory. ` +
+        `Path traversal is not allowed.`);
+}
+/**
+ * Framework-level directory segments that agents must never modify.
+ * These are core source directories — writing to them from a project context
+ * would corrupt the framework itself.
+ *
+ * Checked as relative path segments so they work regardless of where the
+ * monorepo is installed.
+ */
+const PROTECTED_SEGMENTS = [
+    'packages/core/src',
+    'packages/coding/src',
+    'packages/mcp-server/src',
+    'packages\\core\\src',
+    'packages\\coding\\src',
+    'packages\\mcp-server\\src',
+];
+/**
+ * Blocks writes to framework source directories when the agent is running in a
+ * project context (workingDir is NOT a framework package directory).
+ *
+ * Returns an error string when protection triggers, undefined when the write
+ * is safe.
+ *
+ * Protection is SKIPPED when:
+ * - workingDir itself is inside a protected segment (user is developing the
+ *   framework — all writes to framework source are intentional).
+ * - workingDir is the monorepo root (user has explicitly scoped to the full
+ *   repo; checkFrameworkProtection cannot tell which project they intend to
+ *   work on, so it defers to path-sandbox alone and the startup warning).
+ */
+function checkFrameworkProtection(abs, workingDir) {
+    if (!workingDir)
+        return undefined;
+    const cwdNorm = workingDir.replace(/\\/g, '/').toLowerCase();
+    const absNorm = abs.replace(/\\/g, '/').toLowerCase();
+    // Skip protection when workingDir IS a framework package directory.
+    // The user is deliberately developing the framework.
+    const workingOnFramework = PROTECTED_SEGMENTS.some(seg => cwdNorm.includes(seg.replace(/\\/g, '/').toLowerCase()));
+    if (workingOnFramework)
+        return undefined;
+    // Skip protection when the target is not inside a protected segment.
+    const triggered = PROTECTED_SEGMENTS.find(seg => absNorm.includes(seg.replace(/\\/g, '/').toLowerCase()));
+    if (!triggered)
+        return undefined;
+    // Skip protection when workingDir is a direct ancestor of the protected
+    // segment — i.e., the monorepo root. Use /cwd or WORKING_DIR to narrow scope.
+    const triggerNorm = triggered.replace(/\\/g, '/').toLowerCase();
+    const isAncestor = triggerNorm.startsWith(cwdNorm.replace(/\\/g, '/')) ||
+        cwdNorm.split('/').length <= 2; // very short path = likely root
+    if (isAncestor)
+        return undefined;
+    const rel = (0, path_1.relative)(workingDir, abs).replace(/\\/g, '/');
+    return (`⛔ Framework protection: "${rel}" is inside a protected source directory. ` +
+        `Agents should not modify framework source files while working on a project. ` +
+        `Use /cwd <framework-root> or set WORKING_DIR to the repo root if you intend to develop the framework.`);
+}
+//# sourceMappingURL=path-sandbox.js.map

package/dist/tools/path-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-sandbox.js","sourceRoot":"","sources":["../../src/tools/path-sandbox.ts"],"names":[],"mappings":";;AAgBA,0CA+BC;AAiCD,4DAgCC;AAhHD,+BAA8C;AAE9C;;;;;;;GAOG;AACH;;;;;GAKG;AACH,SAAgB,eAAe,CAC3B,UAA8B,EAC9B,QAAgB,EAChB,kBAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEnC,oEAAoE;IACpE,+EAA+E;IAC/E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC,CAAC;IAEF,IAAI,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;IACnC,CAAC;IAED,MAAM,IAAI,KAAK,CACX,mBAAmB,QAAQ,4CAA4C;QACvE,gCAAgC,CACnC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG;IACvB,mBAAmB;IACnB,qBAAqB;IACrB,yBAAyB;IACzB,qBAAqB;IACrB,uBAAuB;IACvB,2BAA2B;CAC9B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,SAAgB,wBAAwB,CAAC,GAAW,EAAE,UAA8B;IAChF,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAEtD,oEAAoE;IACpE,qDAAqD;IACrD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAEzC,qEAAqE;IACrE,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAC1D,CAAC;IACF,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,gCAAgC;IACnF,IAAI,UAAU;QAAE,OAAO,SAAS,CAAC;IAEjC,MAAM,GAAG,GAAG,IAAA,eAAQ,EAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,CACH,4BAA4B,GAAG,4CAA4C;QAC3E,8EAA8E;QAC9E,uGAAuG,CAC1G,CAAC;AACN,CAAC"}

package/dist/tools/read-file.d.ts

@@ -0,0 +1,2 @@
+export declare const readFileTool: import("@backendkit-labs/agent-core").ToolDefinition;
+//# sourceMappingURL=read-file.d.ts.map

package/dist/tools/read-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-file.d.ts","sourceRoot":"","sources":["../../src/tools/read-file.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,YAAY,sDAmBvB,CAAC"}

package/dist/tools/read-file.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readFileTool = void 0;
+const fs_1 = require("fs");
+const agent_core_1 = require("@backendkit-labs/agent-core");
+const path_sandbox_1 = require("./path-sandbox");
+exports.readFileTool = (0, agent_core_1.defineTool)({
+    name: 'read_file',
+    description: [
+        'Read the contents of a file.',
+        'Allowed roots: the active working directory and the agent memory directory (~/.{appName}/projects/{key}/).',
+        'Use relative paths for project files; use the full path for memory files (e.g. memory/session.md).',
+    ].join(' '),
+    input: agent_core_1.z.object({
+        file_path: agent_core_1.z.string().describe('Relative path (project file) or full path (memory file)'),
+    }),
+    execute: async ({ file_path }, ctx) => {
+        try {
+            const memoryDir = ctx.store?.projectDir;
+            const abs = (0, path_sandbox_1.resolveAndCheck)(ctx.workingDir, file_path, memoryDir ? [memoryDir] : []);
+            return (0, fs_1.readFileSync)(abs, 'utf-8');
+        }
+        catch (err) {
+            return `Error: ${err.message}`;
+        }
+    },
+});
+//# sourceMappingURL=read-file.js.map

package/dist/tools/read-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-file.js","sourceRoot":"","sources":["../../src/tools/read-file.ts"],"names":[],"mappings":";;;AAAA,2BAAkC;AAClC,4DAA4D;AAC5D,iDAAiD;AAEpC,QAAA,YAAY,GAAG,IAAA,uBAAU,EAAC;IACnC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE;QACT,8BAA8B;QAC9B,4GAA4G;QAC5G,oGAAoG;KACvG,CAAC,IAAI,CAAC,GAAG,CAAC;IACX,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC;QACZ,SAAS,EAAE,cAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC5F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC;YACxC,MAAM,GAAG,GAAG,IAAA,8BAAe,EAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO,IAAA,iBAAY,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}

package/dist/tools/run-command.d.ts

@@ -0,0 +1,2 @@
+export declare const runCommandTool: import("@backendkit-labs/agent-core").ToolDefinition;
+//# sourceMappingURL=run-command.d.ts.map

package/dist/tools/run-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-command.d.ts","sourceRoot":"","sources":["../../src/tools/run-command.ts"],"names":[],"mappings":"AAuFA,eAAO,MAAM,cAAc,sDAwHzB,CAAC"}

package/dist/tools/run-command.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCommandTool = void 0;
+const child_process_1 = require("child_process");
+const agent_core_1 = require("@backendkit-labs/agent-core");
+const path_sandbox_1 = require("./path-sandbox");
+const MAX_OUTPUT = 20_000;
+/**
+ * Allowed base binaries. ALL binaries in a chained command (pipes, &&, ;)
+ * must be present here — not just the first one.
+ */
+const COMMAND_ALLOWLIST = new Set([
+    // Node / JS ecosystem
+    'node', 'npm', 'npx', 'yarn', 'pnpm', 'bun', 'tsx', 'ts-node', 'tsc',
+    // Test / lint / format
+    'jest', 'vitest', 'mocha', 'c8', 'nyc', 'eslint', 'prettier', 'biome', 'stylelint',
+    // Version control
+    'git', 'gh',
+    // Python
+    'python', 'python3', 'pip', 'pip3', 'uv', 'poetry', 'pytest', 'ruff', 'mypy',
+    // Go
+    'go', 'golangci-lint',
+    // Rust
+    'cargo',
+    // JVM
+    'mvn', 'gradle', 'gradlew', 'java', 'javac', 'kotlin', 'kotlinc',
+    // Shell utilities (safe subset)
+    'echo', 'cat', 'ls', 'pwd', 'which', 'where', 'env', 'printenv',
+    'head', 'tail', 'grep', 'find', 'wc', 'sort', 'uniq', 'diff', 'jq', 'yq',
+    'mkdir', 'cp', 'mv', 'rm', 'touch', 'chmod',
+    'sleep', 'timeout', 'date', 'xargs',
+    // Windows equivalents
+    'dir', 'type', 'copy', 'move', 'del', 'rd', 'md', 'icacls', 'attrib',
+    // Containers / infra
+    'docker', 'docker-compose', 'kubectl', 'helm',
+    'terraform', 'pulumi', 'ansible', 'ansible-playbook',
+    // Network
+    'curl', 'wget',
+    // Build
+    'make', 'act',
+]);
+/** Extract the base binary name from a single command segment. */
+function extractBin(command) {
+    // Strip leading env var assignments like KEY=val CMD ...
+    const stripped = command.trim().replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)+/, '');
+    const first = stripped.split(/[\s|;&<>]/)[0] ?? '';
+    // Strip any path prefix (e.g. ./node_modules/.bin/jest → jest)
+    return first.split('/').pop()?.split('\\').pop() ?? '';
+}
+/**
+ * C1: Split a shell command at operator boundaries and return the binary of
+ * each segment. Quoted strings are neutralized first so operators inside
+ * quotes are not treated as delimiters.
+ */
+function extractAllBins(command) {
+    const noQuotes = command.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""');
+    // Strip I/O redirects (e.g. 2>&1, >/dev/null, 2>file, >> file) before
+    // splitting so that the target filename is never treated as a command binary.
+    // \s* after >>? consumes optional whitespace before the filename/target.
+    const noRedirects = noQuotes.replace(/[0-9]*>>?\s*(?:&[0-9]*|\S*)/g, '');
+    const segments = noRedirects.split(/&&|\|\||[|;`]|\$\(|(?<!>)&(?!&)/).map(s => s.trim()).filter(Boolean);
+    return segments.map(extractBin).filter(Boolean);
+}
+/**
+ * Parse `cd <dir> && <rest>` pattern and return the target cwd + real command.
+ * Handles both Unix (`cd dir && cmd`) and Windows (`cd /D dir && cmd`) forms.
+ */
+function parseCdAndCommand(command) {
+    const match = command.trim().match(/^cd(?:\s+\/D)?\s+([^\s&]+)\s*&&\s*(.+)$/i);
+    if (match) {
+        return { resolvedCd: match[1].trim(), command: match[2].trim() };
+    }
+    return { command };
+}
+/** A1: Windows binary-only remap — applied to the leading binary, never to args. */
+const WIN_BIN_MAP = {
+    pwd: 'echo %cd%',
+    ls: 'dir',
+    which: 'where',
+    cat: 'type',
+    touch: 'type nul >>',
+};
+exports.runCommandTool = (0, agent_core_1.defineTool)({
+    name: 'run_command',
+    description: 'Execute a shell command in the working directory. ' +
+        'Use the optional `cwd` parameter to run in a subdirectory instead of `cd dir && cmd`. ' +
+        'Allowed binaries: npm, git, node, python, go, cargo, docker, kubectl, and common build/test/lint tools. ' +
+        'Shell features (pipes, &&, redirects) are supported when ALL commands in the chain are on the allowlist.',
+    input: agent_core_1.z.object({
+        command: agent_core_1.z.string().describe('Shell command to execute'),
+        cwd: agent_core_1.z.string().optional().describe('Subdirectory to run in, relative to the working directory (e.g. "frontend", "packages/api")'),
+        timeout_ms: agent_core_1.z.number().int().min(1000).max(300_000).default(30_000).describe('Timeout in ms (default: 30 000)'),
+    }),
+    execute: async ({ command, cwd, timeout_ms }, ctx) => {
+        const baseDir = ctx.workingDir ?? process.cwd();
+        // Parse `cd dir && cmd` patterns transparently
+        const { resolvedCd, command: realCommand } = parseCdAndCommand(command);
+        const effectiveCdDir = resolvedCd ?? cwd;
+        // C2: apply path sandbox to cwd — prevents running outside the working directory
+        let workDir;
+        if (effectiveCdDir) {
+            try {
+                workDir = (0, path_sandbox_1.resolveAndCheck)(baseDir, effectiveCdDir);
+            }
+            catch (err) {
+                return `Error: ${err.message}`;
+            }
+        }
+        else {
+            workDir = baseDir;
+        }
+        // A1: Windows binary normalization — only the leading binary, not args
+        let effectiveCommand = realCommand;
+        const bin = extractBin(effectiveCommand);
+        if (process.platform === 'win32') {
+            const envVarMatch = effectiveCommand.match(/^((?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*)/);
+            const envVarPrefix = envVarMatch?.[0] ?? '';
+            const afterEnvVars = effectiveCommand.slice(envVarPrefix.length);
+            if (bin === 'sleep') {
+                const seconds = afterEnvVars.slice(bin.length).trim().split(/\s+/)[0] ?? '1';
+                effectiveCommand = `${envVarPrefix}timeout /t ${seconds} /nobreak >nul`;
+            }
+            else if (bin in WIN_BIN_MAP) {
+                effectiveCommand = envVarPrefix + WIN_BIN_MAP[bin] + afterEnvVars.slice(bin.length);
+            }
+        }
+        // C1: validate ALL binaries in the chain, not just the first
+        const allBins = extractAllBins(effectiveCommand);
+        const blockedBin = allBins.find(b => !COMMAND_ALLOWLIST.has(b));
+        if (blockedBin) {
+            return `Error: Command "${blockedBin}" is not in the allowed list. ` +
+                `Allowed: ${[...COMMAND_ALLOWLIST].join(', ')}`;
+        }
+        // C3: per-agent command blocklist — steers agents toward MCP tools
+        const agentBlocked = ctx.blockedCommands ?? [];
+        if (agentBlocked.length > 0) {
+            const forbidden = allBins.find(b => agentBlocked.includes(b));
+            if (forbidden) {
+                return (`Error: Command "${forbidden}" is not available for agent "${ctx.agentId}". ` +
+                    `This agent uses MCP tools for this capability instead of running shell commands directly. ` +
+                    `Use the appropriate MCP tool (e.g. pg_create, pg_run_sql) to accomplish this task.`);
+            }
+        }
+        // Use async spawn — spawnSync blocks the entire main process thread,
+        // which freezes Electron's IPC channel for the duration of the command.
+        const output = await new Promise((resolve) => {
+            const chunks = [];
+            let totalLen = 0;
+            let timedOut = false;
+            const proc = (0, child_process_1.spawn)(effectiveCommand, {
+                shell: true,
+                cwd: workDir,
+                timeout: timeout_ms,
+            });
+            const collect = (data) => {
+                if (totalLen >= MAX_OUTPUT * 2)
+                    return;
+                const s = data.toString('utf-8');
+                chunks.push(s);
+                totalLen += s.length;
+            };
+            proc.stdout.on('data', collect);
+            proc.stderr.on('data', collect);
+            const timer = setTimeout(() => {
+                timedOut = true;
+                proc.kill();
+                resolve(`Error: Command timed out after ${timeout_ms}ms`);
+            }, timeout_ms);
+            proc.on('error', (err) => {
+                clearTimeout(timer);
+                resolve(`Error: ${err.message}`);
+            });
+            proc.on('close', (code) => {
+                if (timedOut)
+                    return;
+                clearTimeout(timer);
+                const raw = chunks.join('').trim();
+                const truncated = raw.length > MAX_OUTPUT
+                    ? raw.slice(0, MAX_OUTPUT) + `\n[truncated — ${raw.length} total chars]`
+                    : raw;
+                if (code !== 0 && !truncated) {
+                    resolve(`Error: Command exited with status ${code}`);
+                }
+                else {
+                    resolve(truncated || '(no output)');
+                }
+            });
+        });
+        return output;
+    },
+});
+//# sourceMappingURL=run-command.js.map

package/dist/tools/run-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-command.js","sourceRoot":"","sources":["../../src/tools/run-command.ts"],"names":[],"mappings":";;;AAAA,iDAAsC;AAEtC,4DAA4D;AAC5D,iDAAiD;AAEjD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAC9B,sBAAsB;IACtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;IACpE,uBAAuB;IACvB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW;IAClF,kBAAkB;IAClB,KAAK,EAAE,IAAI;IACX,SAAS;IACT,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IAC5E,KAAK;IACL,IAAI,EAAE,eAAe;IACrB,OAAO;IACP,OAAO;IACP,MAAM;IACN,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;IAChE,gCAAgC;IAChC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;IAC/D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI;IACxE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO;IAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO;IACnC,sBAAsB;IACtB,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ;IACpE,qBAAqB;IACrB,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM;IAC7C,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB;IACpD,UAAU;IACV,MAAM,EAAE,MAAM;IACd,QAAQ;IACR,MAAM,EAAE,KAAK;CAChB,CAAC,CAAC;AAEH,kEAAkE;AAClE,SAAS,UAAU,CAAC,OAAe;IAC/B,yDAAyD;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,+DAA+D;IAC/D,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAe;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,sCAAsC,EAAE,IAAI,CAAC,CAAC;IAC/E,sEAAsE;IACtE,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC/E,IAAI,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC;AACvB,CAAC;AAED,oFAAoF;AACpF,MAAM,WAAW,GAA2B;IACxC,GAAG,EAAI,WAAW;IAClB,EAAE,EAAK,KAAK;IACZ,KAAK,EAAE,OAAO;IACd,GAAG,EAAI,MAAM;IACb,KAAK,EAAE,aAAa;CACvB,CAAC;AAEW,QAAA,cAAc,GAAG,IAAA,uBAAU,EAAC;IACrC,IAAI,EAAE,aAAa;IACnB,WAAW,EACP,oDAAoD;QACpD,wFAAwF;QACxF,0GAA0G;QAC1G,0GAA0G;IAC9G,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC;QACZ,OAAO,EAAK,cAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC3D,GAAG,EAAS,cAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC;QACzI,UAAU,EAAE,cAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;KAClH,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAEhD,+CAA+C;QAC/C,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,UAAU,IAAI,GAAG,CAAC;QAEzC,iFAAiF;QACjF,IAAI,OAAe,CAAC;QACpB,IAAI,cAAc,EAAE,CAAC;YACjB,IAAI,CAAC;gBACD,OAAO,GAAG,IAAA,8BAAe,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC;YAC9C,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,OAAO,GAAG,OAAO,CAAC;QACtB,CAAC;QAED,uEAAuE;QACvE,IAAI,gBAAgB,GAAG,WAAW,CAAC;QACnC,MAAM,GAAG,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAEzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACpF,MAAM,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAEjE,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;gBAC7E,gBAAgB,GAAG,GAAG,YAAY,cAAc,OAAO,gBAAgB,CAAC;YAC5E,CAAC;iBAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,UAAU,EAAE,CAAC;YACb,OAAO,mBAAmB,UAAU,gCAAgC;gBAC7D,YAAY,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,CAAC;QAED,mEAAmE;QACnE,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,SAAS,EAAE,CAAC;gBACZ,OAAO,CACH,mBAAmB,SAAS,iCAAiC,GAAG,CAAC,OAAO,KAAK;oBAC7E,4FAA4F;oBAC5F,oFAAoF,CACvF,CAAC;YACN,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACjD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,gBAAgB,EAAE;gBACjC,KAAK,EAAE,IAAI;gBACX,GAAG,EAAI,OAAO;gBACd,OAAO,EAAE,UAAU;aACtB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;gBAC7B,IAAI,QAAQ,IAAI,UAAU,GAAG,CAAC;oBAAE,OAAO;gBACvC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACf,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC;YACzB,CAAC,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEhC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,OAAO,CAAC,kCAAkC,UAAU,IAAI,CAAC,CAAC;YAC9D,CAAC,EAAE,UAAU,CAAC,CAAC;YAEf,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACtB,IAAI,QAAQ;oBAAE,OAAO;gBACrB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,GAAG,UAAU;oBACrC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,MAAM,eAAe;oBACxE,CAAC,CAAC,GAAG,CAAC;gBACV,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC3B,OAAO,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC;qBAAM,CAAC;oBACJ,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC;gBACxC,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAC,CAAC"}

package/dist/tools/save-audit.d.ts

@@ -0,0 +1,4 @@
+export declare const saveAuditTool: import("@backendkit-labs/agent-core").ToolDefinition;
+export declare const getLatestAuditTool: import("@backendkit-labs/agent-core").ToolDefinition;
+export declare const listAuditsTool: import("@backendkit-labs/agent-core").ToolDefinition;
+//# sourceMappingURL=save-audit.d.ts.map

package/dist/tools/save-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-audit.d.ts","sourceRoot":"","sources":["../../src/tools/save-audit.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,sDAYxB,CAAC;AAEH,eAAO,MAAM,kBAAkB,sDAU7B,CAAC;AAEH,eAAO,MAAM,cAAc,sDASzB,CAAC"}

package/dist/tools/save-audit.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAuditsTool = exports.getLatestAuditTool = exports.saveAuditTool = void 0;
+const agent_core_1 = require("@backendkit-labs/agent-core");
+exports.saveAuditTool = (0, agent_core_1.defineTool)({
+    name: 'save_audit',
+    description: "Save the results of a project audit (security, QA, architecture, etc.) with today's date.",
+    input: agent_core_1.z.object({
+        agent_id: agent_core_1.z.string().min(1).describe('Agent ID performing the audit (e.g. security, qa-engineer)'),
+        content: agent_core_1.z.string().min(1).describe('Full audit report in markdown'),
+    }),
+    execute: async ({ agent_id, content }, ctx) => {
+        if (!ctx.store)
+            return 'Error: no persistent store configured';
+        ctx.store.saveAudit(agent_id, content);
+        return `Audit saved for agent "${agent_id}".`;
+    },
+});
+exports.getLatestAuditTool = (0, agent_core_1.defineTool)({
+    name: 'get_latest_audit',
+    description: 'Retrieve the most recent audit report for a given agent type.',
+    input: agent_core_1.z.object({
+        agent_id: agent_core_1.z.string().min(1).describe('Agent ID to retrieve audit for (e.g. security, qa-engineer)'),
+    }),
+    execute: async ({ agent_id }, ctx) => {
+        if (!ctx.store)
+            return 'Error: no persistent store configured';
+        return ctx.store.getLatestAudit(agent_id) ?? `No previous audit found for "${agent_id}".`;
+    },
+});
+exports.listAuditsTool = (0, agent_core_1.defineTool)({
+    name: 'list_audits',
+    description: 'List all saved audit files for this project.',
+    input: agent_core_1.z.object({}),
+    execute: async (_args, ctx) => {
+        if (!ctx.store)
+            return 'Error: no persistent store configured';
+        const audits = ctx.store.listAudits();
+        return audits.length > 0 ? audits.join('\n') : 'No audits saved yet.';
+    },
+});
+//# sourceMappingURL=save-audit.js.map

package/dist/tools/save-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-audit.js","sourceRoot":"","sources":["../../src/tools/save-audit.ts"],"names":[],"mappings":";;;AAAA,4DAA4D;AAE/C,QAAA,aAAa,GAAG,IAAA,uBAAU,EAAC;IACpC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,2FAA2F;IACxG,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC;QACZ,QAAQ,EAAE,cAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4DAA4D,CAAC;QAClG,OAAO,EAAG,cAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACxE,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,uCAAuC,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,0BAA0B,QAAQ,IAAI,CAAC;IAClD,CAAC;CACJ,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,IAAA,uBAAU,EAAC;IACzC,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,+DAA+D;IAC5E,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC;QACZ,QAAQ,EAAE,cAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6DAA6D,CAAC;KACtG,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE;QACjC,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,uCAAuC,CAAC;QAC/D,OAAO,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,gCAAgC,QAAQ,IAAI,CAAC;IAC9F,CAAC;CACJ,CAAC,CAAC;AAEU,QAAA,cAAc,GAAG,IAAA,uBAAU,EAAC;IACrC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,8CAA8C;IAC3D,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,uCAAuC,CAAC;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAC1E,CAAC;CACJ,CAAC,CAAC"}

package/dist/tools/save-context.d.ts

@@ -0,0 +1,2 @@
+export declare const saveContextTool: import("@backendkit-labs/agent-core").ToolDefinition;
+//# sourceMappingURL=save-context.d.ts.map

package/dist/tools/save-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-context.d.ts","sourceRoot":"","sources":["../../src/tools/save-context.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,eAAe,sDAW1B,CAAC"}

package/dist/tools/save-context.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.saveContextTool = void 0;
+const agent_core_1 = require("@backendkit-labs/agent-core");
+exports.saveContextTool = (0, agent_core_1.defineTool)({
+    name: 'save_context',
+    description: 'Save a discovery about the project — tech stack, architecture, key files, conventions. Persists across sessions.',
+    input: agent_core_1.z.object({
+        content: agent_core_1.z.string().min(1).describe('The context to save (markdown supported)'),
+    }),
+    execute: async ({ content }, ctx) => {
+        if (!ctx.store)
+            return 'Error: no persistent store configured';
+        ctx.store.appendContext(content);
+        return 'Context saved.';
+    },
+});
+//# sourceMappingURL=save-context.js.map

package/dist/tools/save-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-context.js","sourceRoot":"","sources":["../../src/tools/save-context.ts"],"names":[],"mappings":";;;AAAA,4DAA4D;AAE/C,QAAA,eAAe,GAAG,IAAA,uBAAU,EAAC;IACtC,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,kHAAkH;IAC/H,KAAK,EAAE,cAAC,CAAC,MAAM,CAAC;QACZ,OAAO,EAAE,cAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KAClF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE;QAChC,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,uCAAuC,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,gBAAgB,CAAC;IAC5B,CAAC;CACJ,CAAC,CAAC"}

package/dist/tools/save-learning.d.ts

@@ -0,0 +1,2 @@
+export declare const saveLearningTool: import("@backendkit-labs/agent-core").ToolDefinition;
+//# sourceMappingURL=save-learning.d.ts.map

package/dist/tools/save-learning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-learning.d.ts","sourceRoot":"","sources":["../../src/tools/save-learning.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,gBAAgB,sDAoC3B,CAAC"}