@chatpanel/events 0.101.0 → 0.103.1

package/source-gate.js

@@ -1,92 +1 @@
-// The source ceiling — would this turn send internal material to a model that is too far
-// away? — as a GATE, not a ranking.
-//
-// Routing is not enough. A router returns null in every uncertain case and null means
-// "leave the choice alone", which is right for a preference and catastrophic for a privacy
-// rule: an internal page with no local model available would have gone to the third party
-// the user had selected. And routing only runs under Auto, so a manually chosen cloud model
-// bypassed it entirely. So this runs on every turn, after routing has had its chance to
-// pick something local, and it REFUSES rather than substituting: silently answering from a
-// different model is the substitution this codebase keeps removing, and silently sending
-// anyway is the leak it exists to stop.
-//
-// Was the extension's `sourceGate` + `sourcePolicySettings` + `sourceUrlsOf`; the desktop
-// had none of it and sent internal pages wherever the picker pointed. The policy (which
-// hosts are internal, how far their content may travel) is the user's and travels in the
-// shared `internalSites` preference section, so both clients enforce the same rule.
-//
-// Class R: no I/O. The target's reach comes from `reachOf` (a bridge agent is 'trusted', a
-// localhost endpoint 'device', the rest 'any') unless the caller already knows it.
-
-import { sourcePolicyFor, sourceUrlsOf, DEFAULT_INTERNAL_PATTERNS } from './sources.js';
-import { reachOf } from './model-candidates.js';
-import { REACH, reachRank } from './reach.js';
-
-// `sourceUrlsOf` lives in sources.js (no router on its graph) so a client's first paint can
-// list a turn's addresses without pulling the router in; it is re-exported here for callers
-// that have the gate anyway.
-export { sourceUrlsOf };
-
-/**
- * The internal-source policy, read from the `privacy` settings object in ONE place.
- *
- * NEVER CONFIGURED and CONFIGURED TO NOTHING are different answers. Undefined means the
- * user has not been here yet, so the built-ins apply; an array — even an empty one — is a
- * list they edited, and prepending our own to it would make a default impossible to
- * remove. Someone testing against localhost has a real reason to delete that line.
- */
-export function sourcePolicySettings(privacy = {}) {
-  const cfg = privacy || {};
-  const saved = cfg.internalPatterns;
-  const list = Array.isArray(saved)
-    ? saved
-    : (saved == null ? DEFAULT_INTERNAL_PATTERNS : String(saved).split(/[\s,]+/));
-  return {
-    enabled: cfg.internalGuard !== false,
-    patterns: list.map((x) => String(x || '').trim().toLowerCase()).filter(Boolean),
-    ceiling: cfg.internalCeiling === 'trusted' ? 'trusted' : 'device',
-  };
-}
-
-/** What the sources of a turn allow. Null when the guard is off or nothing matched. */
-export function sourceGuardFor(policy, sources = []) {
-  if (!policy || !policy.enabled || !sources?.length) return null;
-  const p = sourcePolicyFor(sources, { patterns: policy.patterns, ceiling: policy.ceiling });
-  return p.internal ? p : null;
-}
-
-/**
- * The gate. `{ blocked, why, reach, message }` when the target is out of reach for these
- * sources; null when the turn may go.
- *
- * @param policy    `sourcePolicySettings(privacy)`
- * @param messages  the conversation as it will be sent
- * @param sources   anything else the caller knows was attached
- * @param target    `{ kind, baseUrl }` (reach computed) or `{ reach }` (reach known)
- * @param label     how to name the target in the message
- */
-export function sourceGate({ policy, messages = [], sources = [], target = {}, label = '' } = {}) {
-  const guard = sourceGuardFor(policy, sourceUrlsOf(messages, sources));
-  if (!guard) return null;
-  const actual = REACH.includes(target?.reach) ? target.reach : reachOf(target || {});
-  if (reachRank(actual) <= reachRank(guard.reach)) return null;
-  const where = guard.reach === 'device' ? 'stay on this device' : 'stay inside your workspace';
-  return {
-    blocked: true,
-    why: guard.why,
-    reach: guard.reach,
-    // Name the source, the model and the way out. A refusal a person cannot act on gets
-    // switched off wholesale, which would leave them worse protected than before.
-    message: `Not sent: ${guard.why}. "${label || 'this model'}" is outside that, and content from an internal source must ${where}. `
-      + 'Pick a local model (or run one), or remove this site under Settings → Privacy → Internal sites.',
-  };
-}
-
-/** Is this error the gate's refusal? A runner reads it as "this model, not this task". */
-export const isSourceGateError = (err) => /^Not sent: /.test(String(err?.message || err || ''));
-
-/** The candidates a turn under `guard` may be handed at all — for a roster, before appointment. */
-export function withinReach(candidates = [], guard = null) {
-  if (!guard) return candidates;
-  return (candidates || []).filter((c) => reachRank(REACH.includes(c?.reach) ? c.reach : reachOf(c || {})) <= reachRank(guard.reach));
-}
+import{sourcePolicyFor as f,sourceUrlsOf as a,DEFAULT_INTERNAL_PATTERNS as d}from"./sources.js";import{reachOf as c}from"./model-candidates.js";import{REACH as l,reachRank as o}from"./reach.js";function w(e={}){const t=e||{},r=t.internalPatterns,i=Array.isArray(r)?r:r==null?d:String(r).split(/[\s,]+/);return{enabled:t.internalGuard!==!1,patterns:i.map(s=>String(s||"").trim().toLowerCase()).filter(Boolean),ceiling:t.internalCeiling==="trusted"?"trusted":"device"}}function m(e,t=[]){if(!e||!e.enabled||!t?.length)return null;const r=f(t,{patterns:e.patterns,ceiling:e.ceiling});return r.internal?r:null}function S({policy:e,messages:t=[],sources:r=[],target:i={},label:s=""}={}){const n=m(e,a(t,r));if(!n)return null;const u=l.includes(i?.reach)?i.reach:c(i||{});if(o(u)<=o(n.reach))return null;const h=n.reach==="device"?"stay on this device":"stay inside your workspace";return{blocked:!0,why:n.why,reach:n.reach,message:`Not sent: ${n.why}. "${s||"this model"}" is outside that, and content from an internal source must ${h}. Pick a local model (or run one), or remove this site under Settings → Privacy → Internal sites.`}}const v=e=>/^Not sent: /.test(String(e?.message||e||""));function x(e=[],t=null){return t?(e||[]).filter(r=>o(l.includes(r?.reach)?r.reach:c(r||{}))<=o(t.reach)):e}export{v as isSourceGateError,S as sourceGate,m as sourceGuardFor,w as sourcePolicySettings,a as sourceUrlsOf,x as withinReach};

package/sources-retrieval.js

@@ -1,189 +1,8 @@
-/**
- * SOURCES ARE QUERIED, NOT POURED IN.
- *
- * Attached context used to be flattened into the first message: every attached tab, in full,
- * before the model had said anything. So "hi" on a long page paid for the whole page, and
- * five attached tabs meant five documents in the prompt to answer a question that concerned
- * one paragraph of one of them.
- *
- * The model is instead shown a MANIFEST — what exists, how big it is, where it came from —
- * and pulls what it needs. Three things follow that are not just savings:
- *
- *   - The turn starts small, so a cheap model can handle a greeting on a heavy page.
- *   - What was read is a fact in the log rather than an assumption about the prompt.
- *   - Retrieval takes a QUERY, so a large source returns the relevant part instead of its
- *     first N characters — which is what truncation gives you, and it is rarely the part
- *     that matters.
- *
- * Pure and dependency-free: the extension, the gateway and the bridge all have attached
- * sources, and three implementations of "what did the model actually read" would drift.
- */
+const $=/\n{2,}/,d=i=>Math.ceil(String(i||"").length/4);function p(i,r=0){return`${String(i?.kind||"src").toLowerCase().replace(/[^a-z0-9]+/g,"")||"src"}-${r+1}`}function S(i=[]){const r=(Array.isArray(i)?i:[i]).filter(e=>e&&(e.text||e.url)).map((e,t)=>({id:e.id||p(e,t),kind:e.kind||"context",title:e.title||e.url||"Untitled",url:e.url||"",text:String(e.text||""),tokens:d(e.text)})),o=new Map(r.map(e=>[e.id,e]));return{entries:r,get:e=>o.get(String(e||"").trim())||null,get tokens(){return r.reduce((e,t)=>e+t.tokens,0)}}}function k(i,r=120){const o=String(i||"");if(!o||o.length<=r)return o;try{const e=new URL(o),t=`${e.host}${e.pathname}`.replace(/\/$/,""),c=[...e.searchParams.entries()][0],u=c&&`${c[0]}=${c[1]}`,a=u&&`${t}?${u}`,h=a&&a.length<=r?a:t;return h.length<=r?`${h}…`:`${h.slice(0,r)}…`}catch{return`${o.slice(0,r)}…`}}function b(i){return i?.entries?.length?["Attached sources (NOT included below — read them with the `source` tool):",...i.entries.map(o=>`- ${o.id} — ${o.title}${o.url?` (${k(o.url)})`:""} · ~${o.tokens} tokens`)].join(`
+`):""}function w(i,r){if(!r.length)return 0;const o=i.toLowerCase();let e=0;for(const t of r)o.includes(t)&&(e+=Math.min(3,t.length/4));return e}const x=new Set(["the","and","for","this","that","with","from","what","when","where","which","have","has","was","are","you","your","can","about","into","does","did","how","why","all","any","its"]);function m(i){return String(i||"").toLowerCase().split(/[^a-z0-9]+/).filter(r=>r.length>2&&!x.has(r))}function y(i,{id:r,query:o="",maxTokens:e=2e3}={}){const t=i?.get?.(r);if(!t){const n=(i?.entries||[]).map(s=>s.id).join(", ");return{error:`No attached source '${r}'.${n?` Available: ${n}.`:" Nothing is attached."}`}}const c=Math.max(200,Number(e)||2e3);if(t.tokens<=c)return{id:t.id,title:t.title,url:t.url,text:t.text,truncated:!1,of:t.tokens};const u=m(o),a=t.text.split($).filter(n=>n.trim());if(!u.length){const n=t.text.slice(0,c*4);return{id:t.id,title:t.title,url:t.url,text:n,truncated:!0,of:t.tokens,note:`Showing the first ~${d(n)} of ${t.tokens} tokens. Pass a query to get the relevant parts instead.`}}const h=a.map((n,s)=>({c:n,i:s,s:w(n,u)})).filter(n=>n.s>0).sort((n,s)=>s.s-n.s),l=[];let f=0;for(const n of h){const s=d(n.c);f+s>c||(l.push(n),f+=s)}if(!l.length){const n=t.text.slice(0,c*4);return{id:t.id,title:t.title,url:t.url,text:n,truncated:!0,of:t.tokens,note:`Nothing in this source matched '${o}'. Showing the beginning instead.`}}l.sort((n,s)=>n.i-s.i);const g=l.some((n,s)=>s>0&&n.i!==l[s-1].i+1);return{id:t.id,title:t.title,url:t.url,text:l.map(n=>n.c).join(g?`
 
-const CHUNK_SPLIT = /\n{2,}/;
+[…]
 
-/** ~4 chars per token — the same estimate the dispatcher budget uses. One rough number beats two. */
-export const approxTokens = (s) => Math.ceil(String(s || '').length / 4);
+`:`
 
-/**
- * A stable, short id for a source. The model has to type this back, so it is derived from the
- * title rather than from a random string: `page-2` is recoverable from a manifest a model
- * half-remembers in a way that `k3f9a1` is not.
- */
-export function sourceId(source, index = 0) {
-  const base = String(source?.kind || 'src').toLowerCase().replace(/[^a-z0-9]+/g, '') || 'src';
-  return `${base}-${index + 1}`;
-}
-
-/**
- * Build the manifest the model sees INSTEAD of the content.
- *
- * Deliberately includes the size. A model that can see one source is 300 tokens and another
- * is 40,000 can decide to read the small one whole and query the large one — a decision it
- * cannot make when both are simply "a document".
- */
-export function makeSourceStore(sources = []) {
-  const entries = (Array.isArray(sources) ? sources : [sources])
-    .filter((s) => s && (s.text || s.url))
-    .map((s, i) => ({
-      id: s.id || sourceId(s, i),
-      kind: s.kind || 'context',
-      title: s.title || s.url || 'Untitled',
-      url: s.url || '',
-      text: String(s.text || ''),
-      tokens: approxTokens(s.text),
-    }));
-  const byId = new Map(entries.map((e) => [e.id, e]));
-  return {
-    entries,
-    get: (id) => byId.get(String(id || '').trim()) || null,
-    get tokens() { return entries.reduce((a, e) => a + e.tokens, 0); },
-  };
-}
-
-/**
- * WHERE IT CAME FROM, not the whole address bar.
- *
- * A Google results URL carries about a thousand characters of tracking parameters — sca_esv,
- * gs_lp, sclient — and the manifest printed every one of them, on every turn, in a line whose
- * job is "here is a source you may read". That is a quarter of a thousand tokens of noise the
- * model cannot use and must still read past.
- *
- * The host and path identify the source; the query string is kept only when it is short
- * enough to be meaning rather than machinery. An unparseable URL is left exactly as given —
- * guessing at a string we could not read is how a source becomes unidentifiable.
- */
-export function shortUrl(url, max = 120) {
-  const raw = String(url || '');
-  if (!raw || raw.length <= max) return raw;
-  try {
-    const u = new URL(raw);
-    const base = `${u.host}${u.pathname}`.replace(/\/$/, '');
-    // A short query is often the whole point of the address ("?q=how+do+tides+work");
-    // a long one is machinery. Keep the first parameter when it fits, drop the rest.
-    const first = [...u.searchParams.entries()][0];
-    const q = first && `${first[0]}=${first[1]}`;
-    const withQ = q && `${base}?${q}`;
-    const out = withQ && withQ.length <= max ? withQ : base;
-    return out.length <= max ? `${out}…` : `${out.slice(0, max)}…`;
-  } catch {
-    return `${raw.slice(0, max)}…`;
-  }
-}
-
-/** One line per source: what it is, where it came from, what it would cost to read. */
-export function manifestText(store) {
-  if (!store?.entries?.length) return '';
-  const lines = store.entries.map((e) => `- ${e.id} — ${e.title}${e.url ? ` (${shortUrl(e.url)})` : ''} · ~${e.tokens} tokens`);
-  return [
-    'Attached sources (NOT included below — read them with the `source` tool):',
-    ...lines,
-  ].join('\n');
-}
-
-/**
- * Score a chunk against the query by term overlap.
- *
- * Deliberately not a model call and not an embedding: retrieval that needs a model to decide
- * what to retrieve costs a round trip before the real one, and this runs on every source read.
- * Term overlap is crude and instant, and for "which paragraph of this page mentions X" crude
- * is usually right.
- */
-function scoreChunk(chunk, terms) {
-  if (!terms.length) return 0;
-  const hay = chunk.toLowerCase();
-  let score = 0;
-  for (const t of terms) {
-    if (!hay.includes(t)) continue;
-    // Rarer terms are worth more, approximated by length: 'authentication' discriminates,
-    // 'the' does not.
-    score += Math.min(3, t.length / 4);
-  }
-  return score;
-}
-
-const STOP = new Set(['the', 'and', 'for', 'this', 'that', 'with', 'from', 'what', 'when', 'where', 'which', 'have', 'has', 'was', 'are', 'you', 'your', 'can', 'about', 'into', 'does', 'did', 'how', 'why', 'all', 'any', 'its']);
-
-export function queryTerms(query) {
-  return String(query || '')
-    .toLowerCase()
-    .split(/[^a-z0-9]+/)
-    .filter((t) => t.length > 2 && !STOP.has(t));
-}
-
-/**
- * Read a source, optionally narrowed by a query.
- *
- * Returns `{ id, title, url, text, truncated, of }`. `truncated` is stated rather than
- * implied: a model handed a silently-cut document answers confidently about the part it was
- * not given, and there is no way for it — or the person reading the answer — to tell.
- */
-export function readSource(store, { id, query = '', maxTokens = 2000 } = {}) {
-  const entry = store?.get?.(id);
-  if (!entry) {
-    const known = (store?.entries || []).map((e) => e.id).join(', ');
-    return { error: `No attached source '${id}'.${known ? ` Available: ${known}.` : ' Nothing is attached.'}` };
-  }
-  const budget = Math.max(200, Number(maxTokens) || 2000);
-  if (entry.tokens <= budget) {
-    return { id: entry.id, title: entry.title, url: entry.url, text: entry.text, truncated: false, of: entry.tokens };
-  }
-  const terms = queryTerms(query);
-  const chunks = entry.text.split(CHUNK_SPLIT).filter((c) => c.trim());
-  if (!terms.length) {
-    // No query: the head is the honest default — it is the only part we can justify choosing
-    // without being told what matters.
-    const text = entry.text.slice(0, budget * 4);
-    return { id: entry.id, title: entry.title, url: entry.url, text, truncated: true, of: entry.tokens,
-      note: `Showing the first ~${approxTokens(text)} of ${entry.tokens} tokens. Pass a query to get the relevant parts instead.` };
-  }
-  // Keep the ORIGINAL ORDER of whatever is selected. Ranking by score and presenting in score
-  // order rearranges a document, and a reordered document reads as a different argument.
-  const ranked = chunks
-    .map((c, i) => ({ c, i, s: scoreChunk(c, terms) }))
-    .filter((x) => x.s > 0)
-    .sort((a, b) => b.s - a.s);
-  const picked = [];
-  let used = 0;
-  for (const x of ranked) {
-    const t = approxTokens(x.c);
-    if (used + t > budget) continue;
-    picked.push(x);
-    used += t;
-  }
-  if (!picked.length) {
-    const text = entry.text.slice(0, budget * 4);
-    return { id: entry.id, title: entry.title, url: entry.url, text, truncated: true, of: entry.tokens,
-      note: `Nothing in this source matched '${query}'. Showing the beginning instead.` };
-  }
-  picked.sort((a, b) => a.i - b.i);
-  const gaps = picked.some((x, n) => n > 0 && x.i !== picked[n - 1].i + 1);
-  return {
-    id: entry.id,
-    title: entry.title,
-    url: entry.url,
-    text: picked.map((x) => x.c).join(gaps ? '\n\n[…]\n\n' : '\n\n'),
-    truncated: true,
-    of: entry.tokens,
-    note: `${picked.length} of ${chunks.length} sections, matched on '${query}'.`,
-  };
-}
+`),truncated:!0,of:t.tokens,note:`${l.length} of ${a.length} sections, matched on '${o}'.`}}export{d as approxTokens,S as makeSourceStore,b as manifestText,m as queryTerms,y as readSource,k as shortUrl,p as sourceId};

package/sources.js

@@ -1,273 +1 @@
-/**
- * WHERE THE CONTENT CAME FROM DECIDES HOW FAR IT MAY TRAVEL.
- *
- * A model was summarising an internal access-management page and the turn went to a public
- * inference host, because routing asked what the WORK needed — tools, vision, quality — and
- * never asked where the material came from. Capability decided; provenance did not exist.
- *
- * This module supplies the missing question. It classifies a source URL as internal or not,
- * and turns that into a REACH CEILING the router already knows how to enforce. Two properties
- * make it a guard rather than a preference:
- *
- *   - It only ever NARROWS. `meetReach` takes the tighter of two ceilings, so no later step,
- *     plugin or user dial can widen what an internal source already restricted. A guard that
- *     something downstream can relax is a suggestion.
- *   - It fails CLOSED. An unparseable URL is treated as internal, because the alternative is
- *     to send data outward on the strength of a string we could not read.
- *
- * Pure and dependency-free: the same rules must hold in the extension, the gateway and the
- * bridge, or "internal" means three different things and the strictest one is not the one
- * that runs.
- */
-
-const REACH_ORDER = ['device', 'trusted', 'any'];
-
-/** The tighter of two reach ceilings. Guards compose by MEET — they can only narrow. */
-export function meetReach(a, b) {
-  const ia = REACH_ORDER.indexOf(a);
-  const ib = REACH_ORDER.indexOf(b);
-  // An unknown value is not a licence to travel further: treat it as the tightest.
-  if (ia < 0) return REACH_ORDER.includes(b) ? b : 'device';
-  if (ib < 0) return a;
-  return REACH_ORDER[Math.min(ia, ib)];
-}
-
-/**
- * Hosts that are internal by NETWORK TOPOLOGY — the STARTING list, not a floor.
- *
- * Deliberately limited to what the address itself proves. A corporate wiki on a public SaaS
- * domain looks exactly like any other public host from here — that case needs the user's own
- * patterns, and pretending to detect it would give a false sense of coverage.
- *
- * These are seeded into the user's editable list rather than silently prepended to it,
- * because "internal" is a fact about someone's network, not about ours: a developer testing
- * against localhost may well want that traffic to reach a cloud model, and a rule they cannot
- * see is a rule they cannot correct.
- */
-export const INTERNAL_PATTERN_CATALOG = Object.freeze([
-  { pattern: 'localhost', label: 'This machine, by name' },
-  { pattern: '127.0.0.0/8', label: 'Loopback' },
-  { pattern: '::1', label: 'Loopback (IPv6)' },
-  { pattern: '0.0.0.0/8', label: 'This network' },
-  { pattern: '10.0.0.0/8', label: 'Private network' },
-  { pattern: '172.16.0.0/12', label: 'Private network' },
-  { pattern: '192.168.0.0/16', label: 'Private network (home / office)' },
-  { pattern: '100.64.0.0/10', label: 'Carrier-grade NAT — used by some corporate networks' },
-  { pattern: '169.254.0.0/16', label: 'Link-local — never routes off this segment' },
-  { pattern: 'fe80::/10', label: 'Link-local (IPv6)' },
-  { pattern: 'fc00::/7', label: 'Unique local (IPv6) — the 10.x of IPv6' },
-  { pattern: '*.internal', label: 'Reserved name' },
-  { pattern: '*.intranet', label: 'Reserved name' },
-  { pattern: '*.corp', label: 'Conventional corporate suffix' },
-  { pattern: '*.lan', label: 'Conventional LAN suffix' },
-  { pattern: '*.local', label: 'mDNS / Bonjour' },
-  { pattern: '*.localdomain', label: 'Default suffix on many routers' },
-  { pattern: '*.home', label: 'Home network' },
-  { pattern: '*.home.arpa', label: 'Home network (RFC 8375)' },
-  { pattern: '*.private', label: 'Conventional private suffix' },
-  { pattern: '*.test', label: 'Reserved for testing (RFC 2606)' },
-  { pattern: '*.invalid', label: 'Reserved as never-resolvable' },
-  { pattern: '<intranet>', label: 'Any bare hostname with no dots, e.g. http://wiki/ — includes localhost' },
-]);
-
-/**
- * The patterns on by default. Derived from the catalog so the list a UI offers and the list
- * the classifier applies cannot drift — two copies of this would mean a rule someone can see
- * and not switch off, or switch off and not escape.
- */
-export const DEFAULT_INTERNAL_PATTERNS = Object.freeze(INTERNAL_PATTERN_CATALOG.map((x) => x.pattern));
-const IPV4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-
-function ipToInt(host) {
-  const m = IPV4.exec(host);
-  if (!m) return null;
-  const parts = m.slice(1).map(Number);
-  if (parts.some((n) => n > 255)) return null;
-  return parts.reduce((acc, n) => acc * 256 + n, 0);
-}
-
-/**
- * An IPv6 address as its 128 bits, or null if it is not one. Bits rather than a normalised
- * string because prefix matching (fc00::/7, fe80::/10) is a bit-length comparison — a
- * textual "starts with" would get /7 wrong, since the boundary falls inside a hex digit.
- */
-function v6Bits(host) {
-  const h = String(host || '').replace(/^\[|\]$/g, '').toLowerCase();
-  if (!h.includes(':')) return null;
-  const [headRaw, tailRaw, ...rest] = h.split('::');
-  if (rest.length) return null;   // more than one '::' is not a valid address
-  const parse = (part) => (part ? part.split(':').filter((x) => x !== '') : []);
-  let head = parse(headRaw);
-  let tail = tailRaw === undefined ? [] : parse(tailRaw);
-  // A trailing IPv4 form (::ffff:10.0.0.1) — the last group is four octets, not two.
-  const last = (tail.length ? tail : head)[Math.max(0, (tail.length ? tail : head).length - 1)];
-  if (last && last.includes('.')) {
-    const v4 = ipToInt(last);
-    if (v4 == null) return null;
-    const pair = [(v4 >>> 16).toString(16), (v4 & 0xffff).toString(16)];
-    if (tail.length) tail = [...tail.slice(0, -1), ...pair];
-    else head = [...head.slice(0, -1), ...pair];
-  }
-  const missing = 8 - head.length - tail.length;
-  if (tailRaw === undefined ? missing !== 0 : missing < 0) return null;
-  const groups = [...head, ...Array(Math.max(0, missing)).fill('0'), ...tail];
-  if (groups.length !== 8) return null;
-  let bits = '';
-  for (const g of groups) {
-    if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
-    bits += parseInt(g, 16).toString(2).padStart(16, '0');
-  }
-  return bits;
-}
-
-function inCidr(host, cidr) {
-  const [net, bitsRaw] = cidr.split('/');
-  const hostV6 = v6Bits(host);
-  const netV6 = v6Bits(net);
-  if (hostV6 || netV6) {
-    // A v4 host never sits inside a v6 range, and vice versa — comparing them would be a
-    // type confusion that quietly matches or quietly does not.
-    if (!hostV6 || !netV6) return false;
-    const n = Number(bitsRaw);
-    if (!Number.isFinite(n) || n < 0 || n > 128) return false;
-    return hostV6.slice(0, n) === netV6.slice(0, n);
-  }
-  const ip = ipToInt(host);
-  const base = ipToInt(net);
-  if (ip == null || base == null) return false;
-  const bits = Number(bitsRaw);
-  if (!Number.isFinite(bits) || bits < 0 || bits > 32) return false;
-  // Shifting by 32 is a no-op in JS, so /0 is spelled out rather than computed.
-  const mask = bits === 0 ? 0 : (-1 << (32 - bits)) >>> 0;
-  return (ip & mask) >>> 0 === (base & mask) >>> 0;
-}
-
-/**
- * Does `host` match one pattern? Supported forms, in the order a person would expect:
- *   `*.example.com`  the domain and every subdomain
- *   `example.com`    the same — a bare domain covers its subdomains, because someone adding
- *                    their company domain means the whole company, not one host
- *   `10.0.0.0/8`     a CIDR range
- *   `<intranet>`     any single-label host, which can only resolve on a private network
- */
-export function hostMatches(host, pattern) {
-  const h = String(host || '').toLowerCase().replace(/\.$/, '');
-  const p = String(pattern || '').toLowerCase().trim();
-  if (!h || !p) return false;
-  // A NAME with no dots — not an address. A public IPv6 literal has no dots either, and
-  // sweeping it in here would have quietly pinned every v6 host on the internet as internal.
-  if (p === '<intranet>') return !h.includes('.') && !h.includes(':') && !h.startsWith('[') && !IPV4.test(h);
-  if (p.includes('/')) return inCidr(h, p);
-  // '::1' and '[::1]' and '0:0:0:0:0:0:0:1' are one address written three ways.
-  const pv6 = v6Bits(p);
-  if (pv6) return v6Bits(h) === pv6;
-  const bare = p.startsWith('*.') ? p.slice(2) : p;
-  if (h === bare) return true;
-  if (h.endsWith(`.${bare}`)) return true;
-  // A leading wildcard anywhere else ("*.corp.*") is not supported rather than
-  // half-supported: a pattern that silently matches nothing is worse than one that is
-  // rejected, because it looks like protection.
-  return false;
-}
-
-/**
- * Classify one source. Returns `{ internal, host, matched }`.
- *
- * FAILS CLOSED. A URL we cannot parse counts as internal: we would rather keep a public page
- * on-device than send an internal one out because a string was malformed. The same applies to
- * non-http schemes — a `file:` path is local by definition.
- */
-export function classifySource(url, { patterns = DEFAULT_INTERNAL_PATTERNS } = {}) {
-  const raw = String(url || '').trim();
-  if (!raw) return { internal: false, host: '', matched: null };
-  let host = '';
-  let scheme = '';
-  try {
-    const u = new URL(raw);
-    host = u.hostname;
-    scheme = u.protocol.replace(':', '');
-  } catch {
-    return { internal: true, host: '', matched: 'unparseable' };
-  }
-  if (scheme === 'file') return { internal: true, host, matched: 'file:' };
-  // Extension and browser-internal pages carry no third-party content, and are not sources
-  // anyone means to protect — treating them as internal would pin every turn to a local
-  // model for no reason.
-  if (/^(chrome|edge|about|moz|chrome-extension|data|blob)$/.test(scheme)) {
-    return { internal: false, host, matched: null };
-  }
-  for (const p of patterns) {
-    if (hostMatches(host, p)) return { internal: true, host, matched: p };
-  }
-  return { internal: false, host, matched: null };
-}
-
-/**
- * Every url written in a piece of text.
- *
- * Declared sources are not the only way internal material enters a turn: someone pastes a
- * link to an internal runbook, or a tool result comes back carrying one. The address is the
- * evidence, and it is evidence wherever it appears — so the same classifier that reads the
- * tab reads the body too.
- *
- * Explicit schemes only. A bare host like `wiki/page` is indistinguishable from an ordinary
- * path, and matching it would pin turns on text that mentions no site at all — a guard that
- * fires on prose gets switched off, which protects nobody.
- */
-export function extractUrls(text) {
-  const out = [];
-  const re = /\b(?:https?|file):\/\/[^\s<>"'`)\]}]+/gi;
-  for (const m of String(text || '').matchAll(re)) {
-    // Trailing punctuation belongs to the sentence, not to the address.
-    out.push(m[0].replace(/[.,;:!?]+$/, ''));
-  }
-  return out;
-}
-
-/**
- * Build the reach policy for a turn from everything it draws on.
- *
- * ANY internal source pins the WHOLE turn. A turn that mixes an internal page with a public
- * one is still carrying the internal page, and splitting the difference would send it out.
- *
- * `ceiling` is what an internal source narrows to — 'device' for local models only, or
- * 'trusted' to also allow a workspace gateway the user runs. It cannot widen anything: the
- * result is always the tighter of the ceiling and what was already required.
- */
-export function sourcePolicyFor(sources = [], { patterns, ceiling = 'device', base = 'any' } = {}) {
-  const list = (Array.isArray(sources) ? sources : [sources]).filter(Boolean);
-  const hits = [];
-  for (const s of list) {
-    const url = typeof s === 'string' ? s : (s?.url || s?.href || '');
-    if (!url) continue;
-    const c = classifySource(url, patterns ? { patterns } : undefined);
-    if (c.internal) hits.push({ url, host: c.host, matched: c.matched });
-  }
-  if (!hits.length) return { internal: false, reach: base, hits: [], why: null };
-  const safeCeiling = REACH_ORDER.includes(ceiling) ? ceiling : 'device';
-  return {
-    internal: true,
-    reach: meetReach(base, safeCeiling),
-    hits,
-    // Named so the person can see WHICH rule pinned the turn — an unexplained restriction
-    // gets switched off wholesale.
-    why: `${hits[0].host || 'the source'} matches '${hits[0].matched}' — kept ${safeCeiling === 'device' ? 'on this device' : 'inside your workspace'}`,
-  };
-}
-
-/**
- * Every address a conversation carries: each attachment's `url`, every URL in a message
- * body (an internal link pasted into a message — or arriving in a tool result written back
- * into the conversation — is internal material just as much as an attachment is), plus
- * anything the caller states outright. The WHOLE conversation, because an internal page
- * attached three turns ago is still in the text being sent now.
- */
-export function sourceUrlsOf(messages, extraSources = []) {
-  const urls = [];
-  for (const m of messages || []) {
-    for (const a of m?.attachments || []) if (a?.url) urls.push(a.url);
-    for (const u of extractUrls(typeof m?.content === 'string' ? m.content : '')) urls.push(u);
-  }
-  for (const s of extraSources || []) if (s) urls.push(typeof s === 'string' ? s : (s.url || s.href || ''));
-  return urls.filter(Boolean);
-}
+const h=["device","trusted","any"];function v(n,r){const t=h.indexOf(n),e=h.indexOf(r);return t<0?h.includes(r)?r:"device":e<0?n:h[Math.min(t,e)]}const x=Object.freeze([{pattern:"localhost",label:"This machine, by name"},{pattern:"127.0.0.0/8",label:"Loopback"},{pattern:"::1",label:"Loopback (IPv6)"},{pattern:"0.0.0.0/8",label:"This network"},{pattern:"10.0.0.0/8",label:"Private network"},{pattern:"172.16.0.0/12",label:"Private network"},{pattern:"192.168.0.0/16",label:"Private network (home / office)"},{pattern:"100.64.0.0/10",label:"Carrier-grade NAT — used by some corporate networks"},{pattern:"169.254.0.0/16",label:"Link-local — never routes off this segment"},{pattern:"fe80::/10",label:"Link-local (IPv6)"},{pattern:"fc00::/7",label:"Unique local (IPv6) — the 10.x of IPv6"},{pattern:"*.internal",label:"Reserved name"},{pattern:"*.intranet",label:"Reserved name"},{pattern:"*.corp",label:"Conventional corporate suffix"},{pattern:"*.lan",label:"Conventional LAN suffix"},{pattern:"*.local",label:"mDNS / Bonjour"},{pattern:"*.localdomain",label:"Default suffix on many routers"},{pattern:"*.home",label:"Home network"},{pattern:"*.home.arpa",label:"Home network (RFC 8375)"},{pattern:"*.private",label:"Conventional private suffix"},{pattern:"*.test",label:"Reserved for testing (RFC 2606)"},{pattern:"*.invalid",label:"Reserved as never-resolvable"},{pattern:"<intranet>",label:"Any bare hostname with no dots, e.g. http://wiki/ — includes localhost"}]),w=Object.freeze(x.map(n=>n.pattern)),g=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;function m(n){const r=g.exec(n);if(!r)return null;const t=r.slice(1).map(Number);return t.some(e=>e>255)?null:t.reduce((e,l)=>e*256+l,0)}function d(n){const r=String(n||"").replace(/^\[|\]$/g,"").toLowerCase();if(!r.includes(":"))return null;const[t,e,...l]=r.split("::");if(l.length)return null;const o=u=>u?u.split(":").filter(p=>p!==""):[];let s=o(t),a=e===void 0?[]:o(e);const i=(a.length?a:s)[Math.max(0,(a.length?a:s).length-1)];if(i&&i.includes(".")){const u=m(i);if(u==null)return null;const p=[(u>>>16).toString(16),(u&65535).toString(16)];a.length?a=[...a.slice(0,-1),...p]:s=[...s.slice(0,-1),...p]}const c=8-s.length-a.length;if(e===void 0?c!==0:c<0)return null;const f=[...s,...Array(Math.max(0,c)).fill("0"),...a];if(f.length!==8)return null;let b="";for(const u of f){if(!/^[0-9a-f]{1,4}$/.test(u))return null;b+=parseInt(u,16).toString(2).padStart(16,"0")}return b}function y(n,r){const[t,e]=r.split("/"),l=d(n),o=d(t);if(l||o){if(!l||!o)return!1;const f=Number(e);return!Number.isFinite(f)||f<0||f>128?!1:l.slice(0,f)===o.slice(0,f)}const s=m(n),a=m(t);if(s==null||a==null)return!1;const i=Number(e);if(!Number.isFinite(i)||i<0||i>32)return!1;const c=i===0?0:-1<<32-i>>>0;return(s&c)>>>0===(a&c)>>>0}function R(n,r){const t=String(n||"").toLowerCase().replace(/\.$/,""),e=String(r||"").toLowerCase().trim();if(!t||!e)return!1;if(e==="<intranet>")return!t.includes(".")&&!t.includes(":")&&!t.startsWith("[")&&!g.test(t);if(e.includes("/"))return y(t,e);const l=d(e);if(l)return d(t)===l;const o=e.startsWith("*.")?e.slice(2):e;return!!(t===o||t.endsWith(`.${o}`))}function k(n,{patterns:r=w}={}){const t=String(n||"").trim();if(!t)return{internal:!1,host:"",matched:null};let e="",l="";try{const o=new URL(t);e=o.hostname,l=o.protocol.replace(":","")}catch{return{internal:!0,host:"",matched:"unparseable"}}if(l==="file")return{internal:!0,host:e,matched:"file:"};if(/^(chrome|edge|about|moz|chrome-extension|data|blob)$/.test(l))return{internal:!1,host:e,matched:null};for(const o of r)if(R(e,o))return{internal:!0,host:e,matched:o};return{internal:!1,host:e,matched:null}}function A(n){const r=[],t=/\b(?:https?|file):\/\/[^\s<>"'`)\]}]+/gi;for(const e of String(n||"").matchAll(t))r.push(e[0].replace(/[.,;:!?]+$/,""));return r}function N(n=[],{patterns:r,ceiling:t="device",base:e="any"}={}){const l=(Array.isArray(n)?n:[n]).filter(Boolean),o=[];for(const a of l){const i=typeof a=="string"?a:a?.url||a?.href||"";if(!i)continue;const c=k(i,r?{patterns:r}:void 0);c.internal&&o.push({url:i,host:c.host,matched:c.matched})}if(!o.length)return{internal:!1,reach:e,hits:[],why:null};const s=h.includes(t)?t:"device";return{internal:!0,reach:v(e,s),hits:o,why:`${o[0].host||"the source"} matches '${o[0].matched}' — kept ${s==="device"?"on this device":"inside your workspace"}`}}function C(n,r=[]){const t=[];for(const e of n||[]){for(const l of e?.attachments||[])l?.url&&t.push(l.url);for(const l of A(typeof e?.content=="string"?e.content:""))t.push(l)}for(const e of r||[])e&&t.push(typeof e=="string"?e:e.url||e.href||"");return t.filter(Boolean)}export{w as DEFAULT_INTERNAL_PATTERNS,x as INTERNAL_PATTERN_CATALOG,k as classifySource,A as extractUrls,R as hostMatches,v as meetReach,N as sourcePolicyFor,C as sourceUrlsOf};