@celestea/tools 2.7.1

package/dist/http/ssrf.js

@@ -0,0 +1,272 @@
+/**
+ * SSRF target policy for `http_request` (`crates/tools/src/http.rs`, W249 P0-3).
+ *
+ * `CELESTEA_HTTP_ALLOW` / `CELESTEA_HTTP_DENY` carry comma-separated IP/CIDR
+ * entries. Both unset ⇒ the policy is inactive and every target is allowed
+ * (status quo, surfaced as `active === false` so the caller can decide to log
+ * it). When a policy is active, EVERY resolved IP of the target — and of every
+ * redirect hop — must pass it (`allow` is a whitelist when non-empty, `deny`
+ * always wins).
+ *
+ * **Fail closed**: a malformed entry makes the policy deny everything until the
+ * operator fixes the configuration — a typo can never silently widen access.
+ *
+ * **No check-then-use (W738 P1)**: [HttpTargetPolicy.checkUrl] is a verdict only.
+ * The *authorizing* call is [HttpTargetPolicy.resolveChecked], which returns the
+ * exact addresses it approved so the transport can PIN them: between the check
+ * and the connect there is no second `getaddrinfo`, so a host name that answers
+ * with a public address during the check and with `127.0.0.1`/`169.254.169.254`
+ * at connect time (DNS rebinding) can no longer reach an address the policy
+ * refused. Never connect by name after a check.
+ *
+ * W516 (session grants): a host may pass an [SsrfGrantView] with the session's
+ * `net_hosts` entries. They are UNIONed into the allow side only, and only when
+ * the env policy is active: neither the deny list nor the fail-closed verdict
+ * can be reached by a grant, and an inactive policy (both env vars unset) stays
+ * inactive — a grant must never *tighten* a deployment into a whitelist
+ * (`netHostsIneffective` reports exactly that case to the host's audit).
+ */
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { envString } from "../env.js";
+export const ENV_HTTP_ALLOW = "CELESTEA_HTTP_ALLOW";
+export const ENV_HTTP_DENY = "CELESTEA_HTTP_DENY";
+/** Parse `1.2.3.4`, `10.0.0.0/8`, `::1` or `fd00::/8` (throws on nonsense). */
+export function parseIpRange(entry) {
+    const [baseText = "", prefixText] = entry.trim().split("/");
+    const family = isIP(baseText);
+    if (family !== 4 && family !== 6)
+        throw new Error(`unparseable ip/cidr '${entry}'`);
+    const bits = family === 4 ? 32 : 128;
+    const prefix = prefixText === undefined ? bits : Number(prefixText.trim());
+    if (!Number.isInteger(prefix) || prefix < 0 || prefix > bits) {
+        throw new Error(`bad ipv${family} prefix '${prefixText}' in '${entry}'`);
+    }
+    return { family, base: ipToBigInt(baseText, family), prefix };
+}
+/** Containment test on the masked network prefix. */
+export function ipInRange(range, ip) {
+    const family = isIP(ip);
+    if (family !== 4 && family !== 6)
+        return false;
+    // W824 (W812 P0-4 / W822 A1): an IPv4-mapped IPv6 address (::ffff:a.b.c.d)
+    // IS the IPv4 address the socket actually reaches on Linux. Normalize both
+    // sides into the RANGE's family before masking, so a v4 deny range catches
+    // the mapped form and a mapped v6 range catches the plain v4 form.
+    let value;
+    let bits;
+    if (family === range.family) {
+        value = ipToBigInt(ip, family);
+        bits = family === 4 ? 32 : 128;
+    }
+    else if (family === 6) {
+        const v4 = mappedV4(ipToBigInt(ip, 6));
+        if (v4 === null)
+            return false;
+        value = v4;
+        bits = 32;
+    }
+    else {
+        value = (0xffffn << 32n) | ipToBigInt(ip, 4);
+        bits = 128;
+    }
+    const hostBits = BigInt(bits - range.prefix);
+    if (hostBits < 0n)
+        return false;
+    const mask = ((1n << BigInt(bits)) - 1n) ^ ((1n << hostBits) - 1n);
+    return (value & mask) === (range.base & mask);
+}
+/** The IPv4 value inside ::ffff:0:0/96, or null when not an IPv4-mapped v6. */
+function mappedV4(value) {
+    return value >> 32n === 0xffffn ? value & 0xffffffffn : null;
+}
+function ipToBigInt(ip, family) {
+    if (family === 4)
+        return ip.split(".").reduce((acc, part) => (acc << 8n) | BigInt(Number(part)), 0n);
+    return expandV6(ip).reduce((acc, part) => (acc << 16n) | BigInt(parseInt(part, 16)), 0n);
+}
+/** 169.254.169.254 -> ["a9fe", "a9fe"] (two 16-bit groups). */
+function v4Groups(quad) {
+    const [a = 0, b = 0, c = 0, d = 0] = quad.split(".").map((part) => Number(part));
+    return [(((a << 8) | b).toString(16)), (((c << 8) | d).toString(16))];
+}
+function expandV6(ip) {
+    // W822 A1: an embedded dotted quad (::ffff:169.254.169.254) must be split
+    // into two 16-bit groups; parseInt("169.254.169.254", 16) used to truncate it
+    // to 0x00a9 and corrupt the base.
+    const embedded = /^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/.exec(ip);
+    const prefix = embedded === null ? "" : (embedded[1] ?? "");
+    const quad = embedded === null ? "" : (embedded[2] ?? "");
+    const text = embedded === null ? ip : `${prefix}${v4Groups(quad).join(":")}`;
+    const [head = "", tail = ""] = text.split("::");
+    const headParts = head === "" ? [] : head.split(":");
+    if (!text.includes("::"))
+        return padV6(headParts);
+    const tailParts = tail === "" ? [] : tail.split(":");
+    const gap = 8 - headParts.length - tailParts.length;
+    return [...headParts, ...Array.from({ length: Math.max(gap, 0) }, () => "0"), ...tailParts];
+}
+function padV6(parts) {
+    const missing = 8 - parts.length;
+    return missing <= 0 ? parts : [...parts, ...Array.from({ length: missing }, () => "0")];
+}
+export class HttpTargetPolicy {
+    allow;
+    deny;
+    failClosed;
+    hostAllow;
+    hostsIneffective;
+    resolver;
+    constructor(state) {
+        this.allow = state.allow;
+        this.deny = state.deny;
+        this.failClosed = state.failClosed;
+        this.hostAllow = state.hostAllow ?? [];
+        this.hostsIneffective = state.hostsIneffective ?? false;
+        this.resolver = state.resolver ?? resolveTargets;
+    }
+    /** Parse the two lists; a malformed entry throws (see [fromEnv] for env use). */
+    static parse(allowSpec, denySpec, options = {}) {
+        return new HttpTargetPolicy({
+            allow: parseList(allowSpec),
+            deny: parseList(denySpec),
+            failClosed: false,
+            resolver: options.resolver,
+        });
+    }
+    /**
+     * Policy from the environment; malformed config ⇒ fail closed. Session grants
+     * are merged on the allow side ONLY (see the module docs): the env policy must
+     * be active for them to count at all.
+     */
+    static fromEnv(env = process.env, grants = {}, options = {}) {
+        const allowSpec = envString(env, ENV_HTTP_ALLOW);
+        const denySpec = envString(env, ENV_HTTP_DENY);
+        const hosts = [...(grants.netHosts ?? [])].filter((h) => h.trim() !== "");
+        try {
+            const allow = parseList(allowSpec);
+            const deny = parseList(denySpec);
+            if (allowSpec === undefined && denySpec === undefined) {
+                return new HttpTargetPolicy({ ...options, allow, deny, failClosed: false, hostsIneffective: hosts.length > 0 });
+            }
+            const merged = splitGrantHosts(hosts);
+            return new HttpTargetPolicy({
+                ...options,
+                allow: [...allow, ...merged.ranges],
+                deny,
+                failClosed: false,
+                hostAllow: merged.names,
+            });
+        }
+        catch {
+            return new HttpTargetPolicy({ ...options, allow: [], deny: [], failClosed: true });
+        }
+    }
+    /** Whether the policy constrains targets at all. */
+    get active() {
+        return this.failClosed || this.allow.length > 0 || this.deny.length > 0;
+    }
+    /** Allow/deny entry counts (diagnostics). */
+    get sizes() {
+        return { allow: this.allow.length, deny: this.deny.length, failClosed: this.failClosed };
+    }
+    /** true when `net_hosts` grants were dropped because the env policy is off. */
+    get netHostsIneffective() {
+        return this.hostsIneffective;
+    }
+    /**
+     * Verdict only (`null` = authorized). NEVER sufficient on its own: the caller
+     * must connect to the addresses returned by [resolveChecked] instead of
+     * letting the transport resolve the name again (W738 check-then-use).
+     */
+    async checkUrl(url) {
+        return (await this.resolveChecked(url)).reason;
+    }
+    /**
+     * Authorize a target and return the addresses it approved. `reason !== null`
+     * ⇒ `ips` is empty and nothing may be connected; `reason === null` ⇒ `ips` is
+     * non-empty and is the COMPLETE set of addresses the caller may use (pin them
+     * on every hop).
+     */
+    async resolveChecked(url) {
+        const parsed = new URL(url);
+        const host = parsed.hostname.replace(/^\[|\]$/g, "");
+        if (host === "")
+            return { reason: "target url has no host", ips: [] };
+        const granted = this.hostAllow.includes(host.toLowerCase());
+        const ips = await this.resolver(host, parsed.port === "" ? defaultPort(parsed.protocol) : Number(parsed.port));
+        if (typeof ips === "string")
+            return { reason: ips, ips: [] };
+        if (ips.length === 0)
+            return { reason: `host '${host}' resolves to no addresses`, ips: [] };
+        for (const ip of ips) {
+            const reason = this.ipAllowed(ip, granted);
+            if (reason !== null)
+                return { reason, ips: [] };
+        }
+        return { reason: null, ips: [...ips] };
+    }
+    ipAllowed(ip, hostGranted = false) {
+        if (this.failClosed) {
+            return `ssrf policy misconfigured (fail-closed): fix ${ENV_HTTP_ALLOW}/${ENV_HTTP_DENY}`;
+        }
+        if (!hostGranted && this.allow.length > 0 && !this.allow.some((range) => ipInRange(range, ip))) {
+            return `target ip ${ip} is not in the ${ENV_HTTP_ALLOW} allow list`;
+        }
+        // Deny always wins: a granted host still has to pass the deny list.
+        if (this.deny.some((range) => ipInRange(range, ip))) {
+            return `target ip ${ip} is in the ${ENV_HTTP_DENY} deny list`;
+        }
+        return null;
+    }
+}
+/** IP/CIDR entries -> extra allow ranges; host names -> host allow list. */
+function splitGrantHosts(hosts) {
+    const ranges = [];
+    const names = [];
+    for (const raw of hosts) {
+        const entry = raw.trim();
+        const ipLike = isIP(entry) !== 0 || /^[0-9a-fA-F:.]+\/\d+$/.test(entry);
+        if (ipLike) {
+            try {
+                ranges.push(parseIpRange(entry));
+            }
+            catch {
+                // An unparseable grant entry is DROPPED (never fail-closed, §4.3.7).
+            }
+            continue;
+        }
+        const name = entry.toLowerCase();
+        if (HOST_NAME_RE.test(name))
+            names.push(name);
+    }
+    return { ranges, names };
+}
+/** RFC 1123 host name (no scheme, no port, no slash, no whitespace). */
+const HOST_NAME_RE = /^(?=.{1,253}$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/;
+function parseList(spec) {
+    if (spec === undefined || spec === null || spec.trim() === "")
+        return [];
+    return spec
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+        .map((entry) => parseIpRange(entry));
+}
+/** Every address a target host resolves to, or a failure reason string. */
+export async function resolveTargets(host, port) {
+    if (isIP(host) !== 0)
+        return [host];
+    try {
+        const addresses = await lookup(host, { all: true });
+        if (addresses.length === 0)
+            return `host '${host}' resolves to no addresses`;
+        return addresses.map((a) => a.address);
+    }
+    catch (e) {
+        return `cannot resolve host '${host}': ${e instanceof Error ? e.message : String(e)}`;
+    }
+}
+function defaultPort(protocol) {
+    return protocol === "https:" ? 443 : 80;
+}

package/dist/http/transport.d.ts

@@ -0,0 +1,50 @@
+/**
+ * One HTTP(S) hop over `node:http` / `node:https` (`crates/tools/src/http.rs`).
+ *
+ * Deliberately low-level: no ambient proxy from the environment (`no_proxy`
+ * parity), no automatic redirect following (the caller caps hops at 5 and
+ * re-checks every hop against the SSRF policy), a total per-call deadline, and
+ * a hard cap on the buffered body — bytes past the cap are dropped, the socket
+ * is torn down, and `truncated: true` is reported instead of flooding the
+ * context.
+ *
+ * **Address pinning (W738 P1)**: the SSRF verdict is only worth something if the
+ * socket connects to the address that was checked. When `pinnedIps` is given,
+ * the request carries a custom `lookup` that answers from that list and never
+ * touches the resolver, so the connection cannot be re-bound to a different (for
+ * example internal) address between check and use. The URL, `Host` header and
+ * TLS `servername` stay exactly as before — only the address source changes.
+ */
+import type { LookupFunction } from "node:net";
+import { type HeaderPairs } from "./headers.js";
+export interface TransportRequest {
+    url: URL;
+    method: string;
+    headers: HeaderPairs;
+    body: string | null;
+    timeoutMs: number;
+    maxBodyBytes: number;
+    /**
+     * Addresses the SSRF policy approved for THIS hop (W738). When present the
+     * connection must use one of them — the transport's own DNS is bypassed — so a
+     * second, different resolution can never carry the request to another host.
+     */
+    pinnedIps?: readonly string[];
+}
+export interface TransportResult {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    truncated: boolean;
+    /** Raw `Location` value; redirect targets are resolved by the caller. */
+    location: string | null;
+}
+/** Perform exactly one request (no redirect following) and capture the body. */
+export declare function requestOnce(req: TransportRequest): Promise<TransportResult>;
+/**
+ * A `lookup` replacement that answers from an already-authorized address list.
+ * It never resolves anything: an empty list (or a family filter that matches
+ * none of the pinned addresses) is a hard `ENOTFOUND`, never a fallback to the
+ * platform resolver — a silent fallback would re-open the rebinding hole.
+ */
+export declare function pinnedLookup(pinned: readonly string[]): LookupFunction;

package/dist/http/transport.js

@@ -0,0 +1,130 @@
+/**
+ * One HTTP(S) hop over `node:http` / `node:https` (`crates/tools/src/http.rs`).
+ *
+ * Deliberately low-level: no ambient proxy from the environment (`no_proxy`
+ * parity), no automatic redirect following (the caller caps hops at 5 and
+ * re-checks every hop against the SSRF policy), a total per-call deadline, and
+ * a hard cap on the buffered body — bytes past the cap are dropped, the socket
+ * is torn down, and `truncated: true` is reported instead of flooding the
+ * context.
+ *
+ * **Address pinning (W738 P1)**: the SSRF verdict is only worth something if the
+ * socket connects to the address that was checked. When `pinnedIps` is given,
+ * the request carries a custom `lookup` that answers from that list and never
+ * touches the resolver, so the connection cannot be re-bound to a different (for
+ * example internal) address between check and use. The URL, `Host` header and
+ * TLS `servername` stay exactly as before — only the address source changes.
+ */
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { TransportError } from "./errors.js";
+import { headerLookup, pickHeaders } from "./headers.js";
+/** Perform exactly one request (no redirect following) and capture the body. */
+export async function requestOnce(req) {
+    const send = req.url.protocol === "https:" ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let timedOut = false;
+        // W824 (W812 P0-3): declared with let (not a TDZ const) and dereferenced
+        // with optional chaining, because the timeout callback may fire after a
+        // SYNCHRONOUS send() failure. Every settling path (finish/fail) - including
+        // the synchronous throw below - clears the timer, so a rejected request can
+        // no longer leave an armed, process-killing timer behind.
+        let request;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            request?.destroy(new Error(`request timed out after ${req.timeoutMs}ms`));
+        }, req.timeoutMs);
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(new TransportError(error, timedOut));
+        };
+        try {
+            request = send(req.url, requestOptions(req), (response) => collectBody(response, req.maxBodyBytes, finish, fail));
+        }
+        catch (error) {
+            fail(error);
+            return;
+        }
+        request?.on("error", fail);
+        if (req.body !== null && req.body !== "")
+            request?.write(req.body);
+        request?.end();
+    });
+}
+/** Wire options for one hop; `lookup` is only overridden when addresses are pinned. */
+function requestOptions(req) {
+    const options = { method: req.method, headers: Object.fromEntries(req.headers), timeout: 0 };
+    if (req.pinnedIps !== undefined)
+        options.lookup = pinnedLookup(req.pinnedIps);
+    return options;
+}
+/**
+ * A `lookup` replacement that answers from an already-authorized address list.
+ * It never resolves anything: an empty list (or a family filter that matches
+ * none of the pinned addresses) is a hard `ENOTFOUND`, never a fallback to the
+ * platform resolver — a silent fallback would re-open the rebinding hole.
+ */
+export function pinnedLookup(pinned) {
+    return (_hostname, options, callback) => {
+        const family = familyOf(options);
+        const usable = family === 0 ? [...pinned] : pinned.filter((ip) => isIP(ip) === family);
+        if (usable.length === 0) {
+            const error = new Error("no pinned address matches the requested family (ssrf pin)");
+            error.code = "ENOTFOUND";
+            callback(error, "", 0);
+            return;
+        }
+        if (options.all === true) {
+            callback(null, usable.map((address) => ({ address, family: isIP(address) })));
+            return;
+        }
+        const [first = ""] = usable;
+        callback(null, first, isIP(first));
+    };
+}
+/** `4` / `6` when the caller demanded a family, else `0` (any). */
+function familyOf(options) {
+    const raw = typeof options === "number" ? options : options?.family;
+    if (raw === 4 || raw === "IPv4")
+        return 4;
+    if (raw === 6 || raw === "IPv6")
+        return 6;
+    return 0;
+}
+function collectBody(response, cap, finish, fail) {
+    const status = response.statusCode ?? 0;
+    const headers = pickHeaders(response.headers);
+    const location = headerLookup(response.headers, "location");
+    const chunks = [];
+    let size = 0;
+    response.on("data", (chunk) => {
+        const room = cap - size;
+        // B3 / W812 P2-1: a body that is exactly `cap` bytes is complete; only a
+        // byte beyond the remaining capacity trips the truncated path.
+        if (chunk.length <= room) {
+            chunks.push(chunk);
+            size += chunk.length;
+            return;
+        }
+        if (room > 0)
+            chunks.push(chunk.subarray(0, room));
+        response.destroy();
+        finish({ status, headers, body: Buffer.concat(chunks).toString("utf8"), truncated: true, location });
+    });
+    response.on("end", () => {
+        finish({ status, headers, body: Buffer.concat(chunks).toString("utf8"), truncated: false, location });
+    });
+    response.on("error", fail);
+}

package/dist/index.d.ts

@@ -0,0 +1,114 @@
+/**
+ * `@celestea/tools` — the tool pipeline: registry + guard chain + builtin tools.
+ *
+ * Parity target: `celestea_harness/crates/tools` (`registry.rs`, `guard.rs`,
+ * `builtin.rs`, `http.rs`, `process.rs`, `sandbox.rs`). The package implements
+ * the `Tool` / `ToolGuard` / `ToolRegistry` / `Sandbox` seams declared by
+ * `@celestea/core`; nothing here is reachable except through this barrel
+ * (ARCHITECTURE.md §2.2).
+ *
+ * Pipeline (one dispatch, `registry.ts` — the order is contract, not taste):
+ *   schema validation → ToolGuard chain → execute → structured ToolOutput
+ *
+ * Module map:
+ *   index.ts             public surface (this file)
+ *   registry.ts          ToolRegistryImpl: the four-stage dispatch pipeline  (registry.rs)
+ *   exposure.ts          exposedRegistry: the per-mode model-visible face  (W791 §5.2)
+ *   schema.ts            JSON-Schema subset validator (pipeline stage 1)
+ *   args.ts              argument readers with parity error text
+ *   desc.ts              the shared `desc` UI-label parameter of every tool   (W779)
+ *   errors.ts            structured contract errors (`toolargs:` / `toolguard:`)
+ *   tool-failure.ts      ToolFailure: the single rejection type of a Tool
+ *   fn-tool.ts           Tool over a plain async closure                        (builtin.rs)
+ *   env.ts               env readers (string / int / on-off flag)
+ *   guard/paths.ts       canonicalization: traversal + symlink containment      (guard.rs)
+ *   guard/path-guard.ts  PathGuard: CELESTEA_TOOL_ROOTS whitelist, fail-closed  (guard.rs)
+ *   fs/file-io.ts        capped reads, binary rejection, capped listings
+ *   tools/read-file.ts   read_file                                              (builtin.rs)
+ *   tools/write-file.ts  write_file                                             (builtin.rs)
+ *   tools/list-dir.ts    list_dir                                               (builtin.rs)
+ *   tools/load-skill.ts  load_skill: one SKILL.md body on demand (W884)
+ *   tools/memory.ts      remember / forget: append-only workspace memory (F3 P1)
+ *   tools/run_shell      run_shell: orchestration over the Sandbox seam         (builtin.rs, sandbox.rs)
+ *   tools/process-control.ts  process_control (poll / stdin / kill)             (process.rs)
+ *   tools/http-request.ts     http_request (SSRF, timeout, truncation)          (http.rs)
+ *   tools/run-code.ts    run_code: the broker tool + late-bound RegistryHandle   (run_code.rs)
+ *   run-code/sdk.ts      the injected Python SDK preamble + runner + assembly    (run_code.rs)
+ *   run-code/limits.ts   hard limits + env-tuned broker config                   (run_code.rs)
+ *   run-code/lines.ts    newline-framed line reader + UTF-8-safe byte budgets  (run_code.rs)
+ *   run-code/broker.ts   the parent broker loop: dispatch, ledger, events        (run_code.rs)
+ *   http/ssrf.ts         IP/CIDR allow+deny policy, fail-closed                 (http.rs)
+ *   http/headers.ts      request-header validation + response-header subset     (http.rs)
+ *   http/transport.ts    one HTTP(S) hop over node:http/https                   (http.rs)
+ *   http/redirects.ts    policy-checked redirect following (<= 5 hops)          (http.rs)
+ *   http/errors.ts       transport error classification (timeout|dns|connect|…)
+ *   process/registry.ts  background process registry + reaper + completion sink (process.rs)
+ *   process/buffers.ts   capped ring buffers / tails                            (process.rs)
+ *   sandbox/config.ts    sandbox knobs + shell invocation + env allowlist       (sandbox.rs)
+ *   sandbox/child.ts     SandboxChild over node:child_process                   (sandbox.rs)
+ *   sandbox/async.ts     timeout race + bounded poll
+ *   sandbox/userspace.ts userspace-lite Sandbox implementation (P2c: real isolation)
+ *   sandbox/fake-sandbox.ts  scripted FakeSandbox test double (seam replaceability)
+ *   builtin.ts           the six builtin tools, sharing one sandbox + registry  (builtin.rs)
+ *   plugin.ts            toolsPlugin: provides the three tool services          (plugin.rs)
+ */
+export { createToolRegistry, humanRender, ToolRegistryImpl } from "./registry.js";
+export { EXECUTION_GUIDANCE, EXECUTION_TOOL_NAMES, executionExposure, exposedRegistry, exposedSpecs, faceForMode, TOOL_UNAVAILABLE_CODE, unavailableError, type ExposureOptions, } from "./exposure.js";
+export type { ArgsValidationFailure } from "./schema.js";
+export { DisclosurePolicy, disclosureExposure, type DisclosureGuidance, type DisclosurePolicyOptions, type DisclosureSnapshot, } from "./disclosure.js";
+export { validateArgs } from "./schema.js";
+export { contractError, contractFailure, errorCode, errorText, GUARD_ERROR_PREFIX, quoteMessage, TOOLARG_ERROR_PREFIX } from "./errors.js";
+export { isToolFailure, ToolFailure } from "./tool-failure.js";
+export { fnTool } from "./fn-tool.js";
+export { ENV_TOOL_GUARD, ENV_TOOL_ROOTS, ENV_TOOL_WORKDIR, mountProductionGuards, parseToolRoots, PATH_ACCESS, PATH_ARG_KEYS, PathGuard, PathGuardPolicy, type PathAccess, type PathGuardGrants, type PathGuardPolicyInit, } from "./guard/path-guard.js";
+export { absolutize, canonicalExisting, isDirectory, isInside, resolveExistingTarget, resolveWriteTarget } from "./guard/paths.js";
+export { readFileTool, readFileSpec } from "./tools/read-file.js";
+export { writeFileTool, writeFileSpec } from "./tools/write-file.js";
+export { listDirTool, listDirSpec } from "./tools/list-dir.js";
+export { runShellSpec, runShellTool, type RunShellToolOptions } from "./tools/run-shell.js";
+export { processControlSpec, processControlTool } from "./tools/process-control.js";
+export { RegistryHandle, runCodeSpec, runCodeTool, runCodeToolWithHandle, type RunCodeToolOptions } from "./tools/run-code.js";
+export { httpRequestSpec, httpRequestTool, type HttpRequestToolOptions } from "./tools/http-request.js";
+export { ASK_USER_DESCRIPTION, askUserSpec, askUserTool, type AskUserToolOptions } from "./tools/ask-user.js";
+export { READ_IMAGE_DESCRIPTION, readImageSpec, readImageTool, type ReadImageToolOptions } from "./tools/read-image.js";
+export { LOAD_SKILL_DESCRIPTION, LOAD_SKILL_ERROR_PREFIX, loadSkillSpec, loadSkillTool, type LoadSkillToolOptions } from "./tools/load-skill.js";
+export { FORGET_DESCRIPTION, MEMORY_ERROR_PREFIX, REMEMBER_DESCRIPTION, forgetSpec, forgetTool, rememberSpec, rememberTool, type MemoryToolOptions, } from "./tools/memory.js";
+export { MEMORY_ENTRIES_FILE_NAME, MEMORY_ENTRY_MAX_BYTES, MEMORY_LOG_VERSION, findEntryByText, foldMemoryLog, memoryEntryPaths, memoryLogHeader, memoryTextHash, nextMemoryId, parseMemoryLog, renderMemoryMarkdown, serializeMemoryLine, type MemoryEntryLine, type MemoryForgetLine, type MemoryLogLine, type MemoryLogState, } from "./memory/log.js";
+export { appendMemoryLine, memoryStoreOf, nodeMemoryStoreIo, readMemoryLog, readMemoryState, type MemoryStore, type MemoryStoreIo } from "./memory/store.js";
+export { builtinTools, type BuiltinToolsOptions } from "./builtin.js";
+export { ATTACHMENTS_DIRNAME, ATTACHMENT_MAX_BYTES, ATTACHMENT_MAX_PIXELS, ATTACHMENT_MAX_SIDE, AttachmentError, createAttachmentStore, readImageDimensions, sniffImageMediaType, type AttachmentErrorCode, type AttachmentStore, type StoredAttachment, } from "./attachments/store.js";
+export { ENV_HTTP_ALLOW, ENV_HTTP_DENY, HttpTargetPolicy, ipInRange, parseIpRange, resolveTargets, type CheckedTarget, type HostResolver, type HttpTargetPolicyOptions, type IpRange, type SsrfGrantView, } from "./http/ssrf.js";
+export { HEADER_SUBSET, pickHeaders, validateHeaderPairs, type HeaderPairs } from "./http/headers.js";
+export { MAX_REDIRECT_HOPS } from "./http/redirects.js";
+export { pinnedLookup, requestOnce, type TransportRequest, type TransportResult } from "./http/transport.js";
+export { HTTP_ERROR_PREFIX, classifyTransportError, httpFailure, TransportError } from "./http/errors.js";
+export { MAX_BODY_BYTES, DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS } from "./tools/http-request.js";
+export { BINARY_SNIFF_BYTES, DEFAULT_READ_LIMIT, isProbablyBinary, listDirNames, MAX_DIR_ENTRIES, MAX_READ_BYTES, readTextFile, readTextLines, truncationNote, writeTextFile } from "./fs/file-io.js";
+export { COMPLETION_TAIL_BYTES, foldNewlines, MAX_STREAM_BUFFER, RingBuffer, TAIL_BYTES, } from "./process/buffers.js";
+export { KILL_GRACE_MS, KILL_WAIT_MS, PROCESS_REGISTRY_SERVICE, ProcessRegistry, STDIN_WRITE_TIMEOUT_MS, type CompletionSink, type ProcessCompletion, type ProcessHandle, type ProcessRegistryOptions, } from "./process/registry.js";
+export { ENV_SHELL_PIN, ShellNotFoundError, execSuffixes, envValue, isWindows, kindOfExecutable, lookupFor, pathApi, pathDelimiter, resolveShell, resolveShellKind, shellArgv, whichInPath, WINDOWS_EXEC_SUFFIXES, type PlatformInput, type ResolvedShell, type ShellKind, type ShellLookup, type ShellResolveInput, } from "./platform/index.js";
+export { PYTHON_CANDIDATES_POSIX, PYTHON_CANDIDATES_WINDOWS, pythonCandidates, quoteCmd, quoteForShell, quotePath, quoteWord, runCodeCommand, shellQuote, type RunCodeLanguageName, } from "./platform/quote.js";
+export { taskkillTree } from "./sandbox/child.js";
+export { FILE_MODES_MEANINGFUL, POSIX_PROCESS_GROUPS, POSIX_SHELL, platformGates, whichUsable, type PlatformGates, } from "./testing/platform-gates.js";
+export { buildSandboxConfig, DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_MAX_TIMEOUT_MS, DEFAULT_TIMEOUT_MS as DEFAULT_SANDBOX_TIMEOUT_MS, ENV_ALLOWLIST, ENV_SHELL_MAX_OUTPUT_BYTES, ENV_SHELL_MAX_TIMEOUT_MS, ENV_SHELL_ROOT, ENV_SHELL_TIMEOUT_MS, ENV_SHELL_WORKDIR, gitToplevelOr, sandboxConfigFromEnv, sanitizedEnv, sessionSandboxConfig, shellInvocation, type SandboxConfigOverrides, type SessionFsScope, } from "./sandbox/config.js";
+export { USERSPACE_META, UserspaceSandbox, userspaceSandbox, userspaceSandboxWith } from "./sandbox/userspace.js";
+export { readCapped, REAP_GRACE_MS, type CappedText } from "./sandbox/launch.js";
+export { resolveWorkdir } from "./sandbox/workdir.js";
+export { BWRAP_PROVIDER, buildBwrapArgv, buildBwrapCommand, bwrapMeta, DEFAULT_BWRAP_OPTIONS, SECCOMP_FD, type BwrapOptions, } from "./sandbox/bwrap-argv.js";
+export { BwrapSandbox, bwrapSandbox, bwrapSandboxWith, rlimitVia, type BwrapMeta, type BwrapSandboxOptions } from "./sandbox/bwrap.js";
+export { ENV_SANDBOX_FALLBACK, ENV_SANDBOX_MASK, ENV_SANDBOX_NET, ENV_SANDBOX_SECCOMP, ENV_SANDBOX_SHARE_TMP, bwrapOptionsFromEnv, fallbackMode, selectSandbox, selectSandboxDetailed, type SandboxFallbackMode, type SandboxGrantView, type SandboxSelection, type SelectOptions, } from "./sandbox/provider.js";
+export { countUidThreads, DEFAULT_LIMITS, deriveNproc, ENV_SANDBOX_NPROC, ENV_SANDBOX_NPROC_HEADROOM, limitsFromEnv, NPROC_FLOOR, NPROC_HEADROOM, rlimitsEnabled, type SandboxLimits, } from "./sandbox/limits.js";
+export { ENV_SANDBOX_BWRAP, probeHost, resetProbeCache, whichSync, type HostProbe } from "./sandbox/probe.js";
+export { applyLimits, ulimitScript, type RlimitPlan, type RlimitVia } from "./sandbox/rlimit.js";
+export { buildSeccompFilter, instructionCount, openSeccompBlob, toBlobBytes, type BpfInstruction } from "./sandbox/seccomp.js";
+export { assembleTools, httpOptions, TOOLS_PLUGIN_NAME, toolsPlugin, type RunCodeMount, type ToolAssembly, type ToolAssemblyGrants, type ToolsPluginOptions, } from "./plugin.js";
+export { assembleProgram, firstNonblankLineIndented, RUN_CODE_RUNNER, RUN_CODE_SDK } from "./run-code/sdk.js";
+export { clampTimeoutMs, DEFAULT_TIMEOUT_MS as RUN_CODE_DEFAULT_TIMEOUT_MS, ENV_RUN_CODE_TIMEOUT_MS, EXIT_GRACE_MS, MAX_LINE_BYTES, MAX_LOG_BYTES, MAX_SUB_CALLS, MAX_SUB_OUTPUT_BYTES, MAX_TIMEOUT_MS as RUN_CODE_MAX_TIMEOUT_MS, resolveTimeoutMs, RUN_CODE_ERROR_PREFIX, runCodeConfig, runCodeConfigFromEnv, SDK_TOOLS, type RunCodeConfig, } from "./run-code/limits.js";
+export { brokerRun, type BrokerContext, type RunCodeEventSink } from "./run-code/broker.js";
+export { appendBounded, jsonByteLength, LineReader, safeUtf8, tail, truncateValue, utf8Prefix, type BoundedLine } from "./run-code/lines.js";
+export { assertHttpUrl, BROWSER_ACT_DESCRIPTION, BROWSER_OPEN_DESCRIPTION, browserActSpec, browserActTool, browserOpenSpec, browserOpenTool, type BrowserToolOptions, } from "./tools/browser.js";
+export { ADDRESS_SPACE_NOTE, BrowserManager, DEFAULT_BROWSER_MAX_BYTES, DEFAULT_BROWSER_MAX_NODES, DEFAULT_BROWSER_STARTUP_MS, type BrowserActRequest, type BrowserIsolation, type BrowserManagerOptions, type BrowserRef, type BrowserResult, type BrowserScreenshot, type BrowserSnapshotValue, type BrowserViewport, } from "./browser/session.js";
+export { armMemoryGuard, DEFAULT_BROWSER_MEMORY_MB, readOwnCgroupPath, readTreeRssKb, type MemoryGuard, type MemoryGuardKind, type MemoryGuardStatus, } from "./browser/memory-guard.js";
+export { buildAxSnapshot, collectBoxes, isInteractiveRole, quadToBox, type AxSnapshot, type SnapshotOptions, type SnapshotRef, } from "./browser/snapshot.js";
+export { attachBrowser, BrowserNotFoundError, BrowserStartupError, findHeadlessShell, launchBrowser, parseDevToolsEndpoint, type AttachedBrowser, type BrowserProcess, type LaunchedBrowser, } from "./browser/launch.js";
+export { CdpClient, CdpClosedError, CdpProtocolError, CdpTimeoutError, CdpTransportError, openWebSocketTransport, WebSocketTransport, type CdpTransport } from "./browser/cdp.js";