@easynet/agent-tool-buildin 0.0.3 → 0.0.4

package/dist/index.cjs

@@ -1801,7 +1801,7 @@ var init_mustache = __esm({
     Context.prototype.push = function push(view) {
       return new Context(view, this);
     };
-    Context.prototype.lookup = function lookup2(name) {
+    Context.prototype.lookup = function lookup(name) {
       var cache = this.cache;
       var value;
       if (cache.hasOwnProperty(name)) {
@@ -2021,21 +2021,21 @@ __export(index_exports, {
   getBuiltinContext: () => getBuiltinContext,
   hashTextSpec: () => hashTextSpec,
   headSpec: () => headSpec,
-  isIpInBlockedCidrs: () => isIpInBlockedCidrs,
+  isIpInBlockedCidrs: () => import_agent_tool25.isIpInBlockedCidrs,
   jsonSelectSpec: () => jsonSelectSpec,
   listDirSpec: () => listDirSpec,
   nowHandler: () => nowHandler,
   nowSpec: () => nowSpec,
   readTextSpec: () => readTextSpec,
   registerCoreTools: () => registerCoreTools,
-  resolveSandboxedPath: () => resolveSandboxedPath,
+  resolveSandboxedPath: () => import_agent_tool25.resolveSandboxedPath,
   runCommandSpec: () => runCommandSpec,
   runWithBuiltinContext: () => runWithBuiltinContext,
   searchTextSpec: () => searchTextSpec,
   sha256Spec: () => sha256Spec,
   templateRenderSpec: () => templateRenderSpec,
   truncateSpec: () => truncateSpec,
-  validateUrl: () => validateUrl,
+  validateUrl: () => import_agent_tool25.validateUrl,
   writeTextSpec: () => writeTextSpec,
   yahooFinanceQuoteSpec: () => yahooFinanceQuoteSpec
 });
@@ -2143,51 +2143,8 @@ var DEFAULT_CORE_TOOLS_CONFIG = {
 };
 
 // fs/readText.ts
-var import_promises2 = require("fs/promises");
-
-// security/sandbox.ts
-var import_node_path = require("path");
 var import_promises = require("fs/promises");
 var import_agent_tool = require("@easynet/agent-tool");
-async function resolveSandboxedPath(inputPath, sandboxRoot) {
-  let normalizedRoot;
-  try {
-    normalizedRoot = await (0, import_promises.realpath)((0, import_node_path.resolve)(sandboxRoot));
-  } catch {
-    normalizedRoot = (0, import_node_path.normalize)((0, import_node_path.resolve)(sandboxRoot));
-  }
-  const resolved = (0, import_node_path.resolve)(normalizedRoot, inputPath);
-  let real;
-  try {
-    await (0, import_promises.access)(resolved);
-    real = await (0, import_promises.realpath)(resolved);
-  } catch {
-    const parentDir = (0, import_node_path.dirname)(resolved);
-    let realParent;
-    try {
-      await (0, import_promises.access)(parentDir);
-      realParent = await (0, import_promises.realpath)(parentDir);
-    } catch {
-      realParent = (0, import_node_path.normalize)(parentDir);
-    }
-    real = (0, import_node_path.resolve)(realParent, (0, import_node_path.basename)(resolved));
-  }
-  if (!isWithinRoot(real, normalizedRoot)) {
-    throw (0, import_agent_tool.createTaggedError)(
-      "PATH_OUTSIDE_SANDBOX",
-      `Path "${inputPath}" resolves to "${real}" which is outside sandbox "${normalizedRoot}"`,
-      { inputPath, resolvedPath: real, sandboxRoot: normalizedRoot }
-    );
-  }
-  return real;
-}
-function isWithinRoot(path, root) {
-  const normalizedPath = (0, import_node_path.normalize)(path);
-  const normalizedRoot = (0, import_node_path.normalize)(root);
-  return normalizedPath === normalizedRoot || normalizedPath.startsWith(normalizedRoot + "/");
-}
-
-// fs/readText.ts
 var import_agent_tool2 = require("@easynet/agent-tool");
 var readTextHandler = (async (args) => {
   const ctx = getBuiltinContext();
@@ -2196,8 +2153,8 @@ var readTextHandler = (async (args) => {
     throw (0, import_agent_tool2.createTaggedError)("FS_INVALID", "path is required (pass 'path' or 'filePath')", {});
   }
   const maxBytes = args.maxBytes ?? ctx.config.maxReadBytes;
-  const resolvedPath = await resolveSandboxedPath(inputPath, ctx.config.sandboxRoot);
-  const fileStat = await (0, import_promises2.stat)(resolvedPath);
+  const resolvedPath = await (0, import_agent_tool.resolveSandboxedPath)(inputPath, ctx.config.sandboxRoot);
+  const fileStat = await (0, import_promises.stat)(resolvedPath);
   if (fileStat.size > maxBytes) {
     throw (0, import_agent_tool2.createTaggedError)(
       "FILE_TOO_LARGE",
@@ -2205,7 +2162,7 @@ var readTextHandler = (async (args) => {
       { path: resolvedPath, size: fileStat.size, limit: maxBytes }
     );
   }
-  const text = await (0, import_promises2.readFile)(resolvedPath, "utf-8");
+  const text = await (0, import_promises.readFile)(resolvedPath, "utf-8");
   return {
     result: {
       path: resolvedPath,
@@ -2224,9 +2181,10 @@ var readTextHandler = (async (args) => {
 });
 
 // fs/writeText.ts
-var import_promises3 = require("fs/promises");
+var import_promises2 = require("fs/promises");
 var import_node_crypto = require("crypto");
-var import_node_path2 = require("path");
+var import_node_path = require("path");
+var import_agent_tool3 = require("@easynet/agent-tool");
 var writeTextHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const inputPath = (args.path ?? args.filePath)?.trim();
@@ -2236,11 +2194,11 @@ var writeTextHandler = (async (args) => {
   const text = args.text ?? args.content ?? "";
   const overwrite = args.overwrite ?? false;
   const mkdirp = args.mkdirp ?? true;
-  const resolvedPath = await resolveSandboxedPath(inputPath, ctx.config.sandboxRoot);
+  const resolvedPath = await (0, import_agent_tool3.resolveSandboxedPath)(inputPath, ctx.config.sandboxRoot);
   if (!overwrite) {
-    const { access: access2 } = await import("fs/promises");
+    const { access } = await import("fs/promises");
     try {
-      await access2(resolvedPath);
+      await access(resolvedPath);
       throw new Error(
         `File already exists: ${resolvedPath}. Set overwrite=true to allow overwriting.`
       );
@@ -2252,9 +2210,9 @@ var writeTextHandler = (async (args) => {
     }
   }
   if (mkdirp) {
-    await (0, import_promises3.mkdir)((0, import_node_path2.dirname)(resolvedPath), { recursive: true });
+    await (0, import_promises2.mkdir)((0, import_node_path.dirname)(resolvedPath), { recursive: true });
   }
-  await (0, import_promises3.writeFile)(resolvedPath, text, "utf-8");
+  await (0, import_promises2.writeFile)(resolvedPath, text, "utf-8");
   const bytes = Buffer.byteLength(text, "utf-8");
   const sha256 = (0, import_node_crypto.createHash)("sha256").update(text).digest("hex");
   return {
@@ -2275,8 +2233,9 @@ var writeTextHandler = (async (args) => {
 });
 
 // fs/listDir.ts
-var import_promises4 = require("fs/promises");
-var import_node_path3 = require("path");
+var import_promises3 = require("fs/promises");
+var import_node_path2 = require("path");
+var import_agent_tool4 = require("@easynet/agent-tool");
 var listDirHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const inputPath = (args.path ?? args.filePath ?? args.dir ?? args.directory)?.trim();
@@ -2287,7 +2246,7 @@ var listDirHandler = (async (args) => {
   const includeHidden = args.includeHidden ?? false;
   const recursive = args.recursive ?? false;
   const maxDepth = args.maxDepth ?? 5;
-  const resolvedPath = await resolveSandboxedPath(inputPath, ctx.config.sandboxRoot);
+  const resolvedPath = await (0, import_agent_tool4.resolveSandboxedPath)(inputPath, ctx.config.sandboxRoot);
   const entries = [];
   let truncated = false;
   await walkDir(resolvedPath, "", entries, {
@@ -2322,8 +2281,8 @@ async function walkDir(basePath, relativePath, entries, options) {
     options.onTruncate();
     return;
   }
-  const fullPath = relativePath ? (0, import_node_path3.resolve)(basePath, relativePath) : basePath;
-  const dirEntries = await (0, import_promises4.readdir)(fullPath, { withFileTypes: true });
+  const fullPath = relativePath ? (0, import_node_path2.resolve)(basePath, relativePath) : basePath;
+  const dirEntries = await (0, import_promises3.readdir)(fullPath, { withFileTypes: true });
   for (const dirent of dirEntries) {
     if (entries.length >= options.maxEntries) {
       options.onTruncate();
@@ -2332,8 +2291,8 @@ async function walkDir(basePath, relativePath, entries, options) {
     if (!options.includeHidden && dirent.name.startsWith(".")) {
       continue;
     }
-    const entryPath = (0, import_node_path3.join)(fullPath, dirent.name);
-    const entryRelative = relativePath ? (0, import_node_path3.join)(relativePath, dirent.name) : dirent.name;
+    const entryPath = (0, import_node_path2.join)(fullPath, dirent.name);
+    const entryRelative = relativePath ? (0, import_node_path2.join)(relativePath, dirent.name) : dirent.name;
     let entryType;
     if (dirent.isSymbolicLink()) {
       entryType = "symlink";
@@ -2347,7 +2306,7 @@ async function walkDir(basePath, relativePath, entries, options) {
     let size = 0;
     let mtime = "";
     try {
-      const entryStat = await (0, import_promises4.stat)(entryPath);
+      const entryStat = await (0, import_promises3.stat)(entryPath);
       size = entryStat.size;
       mtime = entryStat.mtime.toISOString();
     } catch {
@@ -2368,10 +2327,11 @@ async function walkDir(basePath, relativePath, entries, options) {
 }
 
 // fs/searchText.ts
-var import_promises5 = require("fs/promises");
+var import_promises4 = require("fs/promises");
 var import_node_fs = require("fs");
 var import_node_readline = require("readline");
-var import_node_path4 = require("path");
+var import_node_path3 = require("path");
+var import_agent_tool5 = require("@easynet/agent-tool");
 var searchTextHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const rootPath = (args.root ?? args.path ?? args.dir ?? args.directory)?.trim();
@@ -2385,7 +2345,7 @@ var searchTextHandler = (async (args) => {
   const glob = args.glob ?? "**/*.{md,txt,log,json,ts,js,py,java,scala}";
   const maxMatches = args.maxMatches ?? 100;
   const maxFiles = args.maxFiles ?? 500;
-  const resolvedRoot = await resolveSandboxedPath(rootPath, ctx.config.sandboxRoot);
+  const resolvedRoot = await (0, import_agent_tool5.resolveSandboxedPath)(rootPath, ctx.config.sandboxRoot);
   let regex;
   try {
     regex = new RegExp(query, "i");
@@ -2432,13 +2392,13 @@ async function collectFiles(dirPath, files, options) {
   if (files.length >= options.maxFiles) return;
   let entries;
   try {
-    entries = await (0, import_promises5.readdir)(dirPath, { withFileTypes: true });
+    entries = await (0, import_promises4.readdir)(dirPath, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (files.length >= options.maxFiles) return;
-    const fullPath = (0, import_node_path4.join)(dirPath, entry.name);
+    const fullPath = (0, import_node_path3.join)(dirPath, entry.name);
     if (entry.isDirectory()) {
       if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
       await collectFiles(fullPath, files, options);
@@ -2452,7 +2412,7 @@ async function collectFiles(dirPath, files, options) {
   }
 }
 async function searchFile(filePath, root, regex, matches, maxMatches) {
-  const fileStat = await (0, import_promises5.stat)(filePath).catch(() => null);
+  const fileStat = await (0, import_promises4.stat)(filePath).catch(() => null);
   if (!fileStat || fileStat.size > 1024 * 1024) return;
   const stream = (0, import_node_fs.createReadStream)(filePath, { encoding: "utf-8" });
   const rl = (0, import_node_readline.createInterface)({ input: stream, crlfDelay: Infinity });
@@ -2465,7 +2425,7 @@ async function searchFile(filePath, root, regex, matches, maxMatches) {
     }
     if (regex.test(line)) {
       matches.push({
-        file: (0, import_node_path4.relative)(root, filePath),
+        file: (0, import_node_path3.relative)(root, filePath),
         lineNo,
         excerpt: line.slice(0, 200)
       });
@@ -2498,22 +2458,23 @@ function escapeRegExp(str) {
 
 // fs/sha256.ts
 var import_node_fs2 = require("fs");
-var import_promises6 = require("fs/promises");
+var import_promises5 = require("fs/promises");
 var import_node_crypto2 = require("crypto");
-var import_agent_tool3 = require("@easynet/agent-tool");
+var import_agent_tool6 = require("@easynet/agent-tool");
+var import_agent_tool7 = require("@easynet/agent-tool");
 var sha256Handler = (async (args) => {
   const ctx = getBuiltinContext();
   const inputPath = (args.path ?? args.filePath)?.trim();
   if (!inputPath) {
-    throw (0, import_agent_tool3.createTaggedError)("FS_INVALID", "path is required (pass 'path' or 'filePath')", {});
+    throw (0, import_agent_tool7.createTaggedError)("FS_INVALID", "path is required (pass 'path' or 'filePath')", {});
   }
-  const resolvedPath = await resolveSandboxedPath(inputPath, ctx.config.sandboxRoot);
-  const fileStat = await (0, import_promises6.stat)(resolvedPath);
-  const hash = await new Promise((resolve3, reject) => {
+  const resolvedPath = await (0, import_agent_tool6.resolveSandboxedPath)(inputPath, ctx.config.sandboxRoot);
+  const fileStat = await (0, import_promises5.stat)(resolvedPath);
+  const hash = await new Promise((resolve2, reject) => {
     const hasher = (0, import_node_crypto2.createHash)("sha256");
     const stream = (0, import_node_fs2.createReadStream)(resolvedPath);
     stream.on("data", (chunk) => hasher.update(chunk));
-    stream.on("end", () => resolve3(hasher.digest("hex")));
+    stream.on("end", () => resolve2(hasher.digest("hex")));
     stream.on("error", reject);
   });
   return {
@@ -2534,7 +2495,8 @@ var sha256Handler = (async (args) => {
 });
 
 // fs/deletePath.ts
-var import_promises7 = require("fs/promises");
+var import_promises6 = require("fs/promises");
+var import_agent_tool8 = require("@easynet/agent-tool");
 var deletePathHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const inputPath = (args.path ?? args.filePath)?.trim();
@@ -2548,7 +2510,7 @@ var deletePathHandler = (async (args) => {
       "Deletion not confirmed. Set confirm=true to proceed with deletion."
     );
   }
-  const resolvedPath = await resolveSandboxedPath(inputPath, ctx.config.sandboxRoot);
+  const resolvedPath = await (0, import_agent_tool8.resolveSandboxedPath)(inputPath, ctx.config.sandboxRoot);
   let realSandboxRoot;
   try {
     const { realpath: rp } = await import("fs/promises");
@@ -2559,16 +2521,16 @@ var deletePathHandler = (async (args) => {
   if (resolvedPath === realSandboxRoot) {
     throw new Error("Cannot delete the sandbox root directory.");
   }
-  const fileStat = await (0, import_promises7.stat)(resolvedPath);
+  const fileStat = await (0, import_promises6.stat)(resolvedPath);
   const isDirectory = fileStat.isDirectory();
   if (isDirectory) {
     if (recursive) {
-      await (0, import_promises7.rm)(resolvedPath, { recursive: true, force: true });
+      await (0, import_promises6.rm)(resolvedPath, { recursive: true, force: true });
     } else {
-      await (0, import_promises7.rmdir)(resolvedPath);
+      await (0, import_promises6.rmdir)(resolvedPath);
     }
   } else {
-    await (0, import_promises7.unlink)(resolvedPath);
+    await (0, import_promises6.unlink)(resolvedPath);
   }
   return {
     result: {
@@ -2587,175 +2549,25 @@ var deletePathHandler = (async (args) => {
   };
 });
 
-// security/ssrf.ts
-var import_promises8 = require("dns/promises");
-var import_agent_tool4 = require("@easynet/agent-tool");
-async function validateUrl(url, allowedHosts, blockedCidrs) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw (0, import_agent_tool4.createTaggedError)(
-      "HTTP_DISALLOWED_HOST",
-      `Invalid URL: ${url}`,
-      { url }
-    );
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw (0, import_agent_tool4.createTaggedError)(
-      "HTTP_DISALLOWED_HOST",
-      `Protocol not allowed: ${parsed.protocol}. Only http: and https: are supported.`,
-      { url, protocol: parsed.protocol }
-    );
-  }
-  const hostname = parsed.hostname;
-  if (!isHostAllowed(hostname, allowedHosts)) {
-    throw (0, import_agent_tool4.createTaggedError)(
-      "HTTP_DISALLOWED_HOST",
-      `Host "${hostname}" is not in the allowed hosts list`,
-      { url, hostname, allowedHosts }
-    );
-  }
-  try {
-    const { address } = await (0, import_promises8.lookup)(hostname);
-    if (isIpInBlockedCidrs(address, blockedCidrs)) {
-      throw (0, import_agent_tool4.createTaggedError)(
-        "HTTP_DISALLOWED_HOST",
-        `Host "${hostname}" resolves to blocked IP: ${address}`,
-        { url, hostname, resolvedIp: address }
-      );
-    }
-  } catch (err) {
-    if (err instanceof Error && err.kind === "HTTP_DISALLOWED_HOST") {
-      throw err;
-    }
-    throw (0, import_agent_tool4.createTaggedError)(
-      "HTTP_DISALLOWED_HOST",
-      `DNS resolution failed for host "${hostname}": ${err instanceof Error ? err.message : String(err)}`,
-      { url, hostname }
-    );
-  }
-  return parsed;
-}
-function isHostAllowed(hostname, allowedHosts) {
-  for (const pattern of allowedHosts) {
-    if (pattern === "*") {
-      return true;
-    }
-    if (pattern.startsWith("*.")) {
-      const suffix = pattern.slice(1);
-      if (hostname.endsWith(suffix) || hostname === pattern.slice(2)) {
-        return true;
-      }
-    } else if (hostname === pattern) {
-      return true;
-    }
-  }
-  return false;
-}
-function isIpInBlockedCidrs(ip, cidrs) {
-  const normalizedIp = normalizeIp(ip);
-  if (!normalizedIp) return false;
-  for (const cidr of cidrs) {
-    if (cidr.includes(":")) {
-      if (!ip.includes(":")) continue;
-      if (isIpv6InCidr(ip, cidr)) return true;
-    } else {
-      if (isIpv4InCidr(normalizedIp, cidr)) return true;
-    }
-  }
-  return false;
-}
-function normalizeIp(ip) {
-  if (ip.startsWith("::ffff:")) {
-    return ip.slice(7);
-  }
-  if (/^\d+\.\d+\.\d+\.\d+$/.test(ip)) {
-    return ip;
-  }
-  return null;
-}
-function isIpv4InCidr(ip, cidr) {
-  const [cidrIp, prefixStr] = cidr.split("/");
-  if (!cidrIp || !prefixStr) return false;
-  const prefix = parseInt(prefixStr, 10);
-  if (isNaN(prefix) || prefix < 0 || prefix > 32) return false;
-  const ipNum = ipv4ToNum(ip);
-  const cidrNum = ipv4ToNum(cidrIp);
-  if (ipNum === null || cidrNum === null) return false;
-  const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
-  return (ipNum & mask) === (cidrNum & mask);
-}
-function ipv4ToNum(ip) {
-  const parts = ip.split(".");
-  if (parts.length !== 4) return null;
-  let num = 0;
-  for (const part of parts) {
-    const n = parseInt(part, 10);
-    if (isNaN(n) || n < 0 || n > 255) return null;
-    num = num << 8 | n;
-  }
-  return num >>> 0;
-}
-function isIpv6InCidr(ip, cidr) {
-  const [cidrIp, prefixStr] = cidr.split("/");
-  if (!cidrIp || !prefixStr) return false;
-  const prefix = parseInt(prefixStr, 10);
-  if (isNaN(prefix)) return false;
-  const ipBytes = expandIpv6(ip);
-  const cidrBytes = expandIpv6(cidrIp);
-  if (!ipBytes || !cidrBytes) return false;
-  const fullBytes = Math.floor(prefix / 8);
-  for (let i = 0; i < fullBytes && i < 16; i++) {
-    if (ipBytes[i] !== cidrBytes[i]) return false;
-  }
-  const remainingBits = prefix % 8;
-  if (remainingBits > 0 && fullBytes < 16) {
-    const mask = ~0 << 8 - remainingBits & 255;
-    if ((ipBytes[fullBytes] & mask) !== (cidrBytes[fullBytes] & mask)) return false;
-  }
-  return true;
-}
-function expandIpv6(ip) {
-  const zoneIdx = ip.indexOf("%");
-  if (zoneIdx !== -1) ip = ip.slice(0, zoneIdx);
-  const parts = ip.split("::");
-  if (parts.length > 2) return null;
-  const bytes = new Array(16).fill(0);
-  const expandGroup = (group) => {
-    if (!group) return [];
-    return group.split(":").flatMap((hex) => {
-      const val = parseInt(hex || "0", 16);
-      return [val >> 8 & 255, val & 255];
-    });
-  };
-  if (parts.length === 1) {
-    const expanded = expandGroup(parts[0]);
-    if (expanded.length !== 16) return null;
-    return expanded;
-  }
-  const left = expandGroup(parts[0]);
-  const right = expandGroup(parts[1]);
-  if (left.length + right.length > 16) return null;
-  for (let i = 0; i < left.length; i++) bytes[i] = left[i];
-  for (let i = 0; i < right.length; i++) bytes[16 - right.length + i] = right[i];
-  return bytes;
-}
-
 // http/fetchText.ts
-var import_agent_tool5 = require("@easynet/agent-tool");
+var import_agent_tool9 = require("@easynet/agent-tool");
+var import_agent_tool10 = require("@easynet/agent-tool");
 var fetchTextHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const url = (args.url ?? args.uri)?.trim();
   if (!url) {
-    throw (0, import_agent_tool5.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
+    throw (0, import_agent_tool10.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
   }
   const method = args.method ?? "GET";
   const headers = args.headers ?? {};
   const body = args.body ?? void 0;
   const timeoutMs = args.timeoutMs ?? ctx.config.defaultTimeoutMs;
   const maxBytes = args.maxBytes ?? ctx.config.maxHttpBytes;
-  await validateUrl(url, ctx.config.allowedHosts, ctx.config.blockedCidrs);
+  await (0, import_agent_tool9.validateUrl)(url, {
+    allowedHosts: ctx.config.allowedHosts,
+    blockedHosts: ctx.config.blockedHosts,
+    blockedCidrs: ctx.config.blockedCidrs
+  });
   if (!headers["User-Agent"] && !headers["user-agent"]) {
     headers["User-Agent"] = ctx.config.httpUserAgent;
   }
@@ -2771,13 +2583,13 @@ var fetchTextHandler = (async (args) => {
     });
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
-      throw (0, import_agent_tool5.createTaggedError)(
+      throw (0, import_agent_tool10.createTaggedError)(
         "HTTP_TIMEOUT",
         `Request to ${url} timed out after ${timeoutMs}ms`,
         { url, timeoutMs }
       );
     }
-    throw (0, import_agent_tool5.createTaggedError)(
+    throw (0, import_agent_tool10.createTaggedError)(
       "UPSTREAM_ERROR",
       `Fetch failed for ${url}: ${err instanceof Error ? err.message : String(err)}`,
       { url }
@@ -2787,7 +2599,7 @@ var fetchTextHandler = (async (args) => {
   }
   const contentLength = response.headers.get("content-length");
   if (contentLength && parseInt(contentLength, 10) > maxBytes) {
-    throw (0, import_agent_tool5.createTaggedError)(
+    throw (0, import_agent_tool10.createTaggedError)(
       "HTTP_TOO_LARGE",
       `Response Content-Length ${contentLength} exceeds limit of ${maxBytes} bytes`,
       { url, contentLength: parseInt(contentLength, 10), limit: maxBytes }
@@ -2832,7 +2644,7 @@ async function readResponseWithLimit(response, maxBytes, url) {
       totalBytes += value.byteLength;
       if (totalBytes > maxBytes) {
         reader.cancel();
-        throw (0, import_agent_tool5.createTaggedError)(
+        throw (0, import_agent_tool10.createTaggedError)(
           "HTTP_TOO_LARGE",
           `Response body exceeded limit of ${maxBytes} bytes while reading from ${url}`,
           { url, bytesRead: totalBytes, limit: maxBytes }
@@ -2848,19 +2660,24 @@ async function readResponseWithLimit(response, maxBytes, url) {
 }
 
 // http/fetchJson.ts
-var import_agent_tool6 = require("@easynet/agent-tool");
+var import_agent_tool11 = require("@easynet/agent-tool");
+var import_agent_tool12 = require("@easynet/agent-tool");
 var fetchJsonHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const url = (args.url ?? args.uri)?.trim();
   if (!url) {
-    throw (0, import_agent_tool6.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
+    throw (0, import_agent_tool12.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
   }
   const method = args.method ?? "GET";
   const headers = args.headers ?? {};
   const body = args.body ?? void 0;
   const timeoutMs = args.timeoutMs ?? ctx.config.defaultTimeoutMs;
   const maxBytes = args.maxBytes ?? ctx.config.maxHttpBytes;
-  await validateUrl(url, ctx.config.allowedHosts, ctx.config.blockedCidrs);
+  await (0, import_agent_tool11.validateUrl)(url, {
+    allowedHosts: ctx.config.allowedHosts,
+    blockedHosts: ctx.config.blockedHosts,
+    blockedCidrs: ctx.config.blockedCidrs
+  });
   if (!headers["Accept"] && !headers["accept"]) {
     headers["Accept"] = "application/json";
   }
@@ -2879,13 +2696,13 @@ var fetchJsonHandler = (async (args) => {
     });
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
-      throw (0, import_agent_tool6.createTaggedError)(
+      throw (0, import_agent_tool12.createTaggedError)(
         "HTTP_TIMEOUT",
         `Request to ${url} timed out after ${timeoutMs}ms`,
         { url, timeoutMs }
       );
     }
-    throw (0, import_agent_tool6.createTaggedError)(
+    throw (0, import_agent_tool12.createTaggedError)(
       "UPSTREAM_ERROR",
       `Fetch failed for ${url}: ${err instanceof Error ? err.message : String(err)}`,
       { url }
@@ -2895,7 +2712,7 @@ var fetchJsonHandler = (async (args) => {
   }
   const contentLength = response.headers.get("content-length");
   if (contentLength && parseInt(contentLength, 10) > maxBytes) {
-    throw (0, import_agent_tool6.createTaggedError)(
+    throw (0, import_agent_tool12.createTaggedError)(
       "HTTP_TOO_LARGE",
       `Response Content-Length ${contentLength} exceeds limit of ${maxBytes} bytes`,
       { url, contentLength: parseInt(contentLength, 10), limit: maxBytes }
@@ -2904,7 +2721,7 @@ var fetchJsonHandler = (async (args) => {
   const text = await response.text();
   const bytes = Buffer.byteLength(text, "utf-8");
   if (bytes > maxBytes) {
-    throw (0, import_agent_tool6.createTaggedError)(
+    throw (0, import_agent_tool12.createTaggedError)(
       "HTTP_TOO_LARGE",
       `Response body ${bytes} bytes exceeds limit of ${maxBytes} bytes`,
       { url, bytes, limit: maxBytes }
@@ -2914,7 +2731,7 @@ var fetchJsonHandler = (async (args) => {
   try {
     json = JSON.parse(text);
   } catch {
-    throw (0, import_agent_tool6.createTaggedError)(
+    throw (0, import_agent_tool12.createTaggedError)(
       "UPSTREAM_ERROR",
       `Failed to parse JSON response from ${url}: ${text.slice(0, 200)}`,
       { url, status: response.status, textPreview: text.slice(0, 500) }
@@ -2939,30 +2756,35 @@ var fetchJsonHandler = (async (args) => {
 });
 
 // http/downloadFile.ts
-var import_promises9 = require("fs/promises");
+var import_promises7 = require("fs/promises");
 var import_node_crypto3 = require("crypto");
-var import_node_path5 = require("path");
-var import_agent_tool7 = require("@easynet/agent-tool");
+var import_node_path4 = require("path");
+var import_agent_tool13 = require("@easynet/agent-tool");
+var import_agent_tool14 = require("@easynet/agent-tool");
 var downloadFileHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const url = (args.url ?? args.uri)?.trim();
   if (!url) {
-    throw (0, import_agent_tool7.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
+    throw (0, import_agent_tool14.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
   }
   const destPath = (args.destPath ?? args.destination ?? args.filePath)?.trim();
   if (!destPath) {
-    throw (0, import_agent_tool7.createTaggedError)("HTTP_INVALID", "destPath is required (pass 'destPath', 'destination', or 'filePath')", {});
+    throw (0, import_agent_tool14.createTaggedError)("HTTP_INVALID", "destPath is required (pass 'destPath', 'destination', or 'filePath')", {});
   }
   const headers = args.headers ?? {};
   const timeoutMs = args.timeoutMs ?? ctx.config.defaultTimeoutMs;
   const maxBytes = args.maxBytes ?? ctx.config.maxDownloadBytes;
   const overwrite = args.overwrite ?? false;
-  await validateUrl(url, ctx.config.allowedHosts, ctx.config.blockedCidrs);
-  const resolvedDest = await resolveSandboxedPath(destPath, ctx.config.sandboxRoot);
+  await (0, import_agent_tool13.validateUrl)(url, {
+    allowedHosts: ctx.config.allowedHosts,
+    blockedHosts: ctx.config.blockedHosts,
+    blockedCidrs: ctx.config.blockedCidrs
+  });
+  const resolvedDest = await (0, import_agent_tool13.resolveSandboxedPath)(destPath, ctx.config.sandboxRoot);
   if (!overwrite) {
-    const { access: access2 } = await import("fs/promises");
+    const { access } = await import("fs/promises");
     try {
-      await access2(resolvedDest);
+      await access(resolvedDest);
       throw new Error(
         `File already exists: ${resolvedDest}. Set overwrite=true to allow overwriting.`
       );
@@ -2987,13 +2809,13 @@ var downloadFileHandler = (async (args) => {
     });
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
-      throw (0, import_agent_tool7.createTaggedError)(
+      throw (0, import_agent_tool14.createTaggedError)(
         "HTTP_TIMEOUT",
         `Download from ${url} timed out after ${timeoutMs}ms`,
         { url, timeoutMs }
       );
     }
-    throw (0, import_agent_tool7.createTaggedError)(
+    throw (0, import_agent_tool14.createTaggedError)(
       "UPSTREAM_ERROR",
       `Download failed for ${url}: ${err instanceof Error ? err.message : String(err)}`,
       { url }
@@ -3003,14 +2825,14 @@ var downloadFileHandler = (async (args) => {
   }
   const contentLength = response.headers.get("content-length");
   if (contentLength && parseInt(contentLength, 10) > maxBytes) {
-    throw (0, import_agent_tool7.createTaggedError)(
+    throw (0, import_agent_tool14.createTaggedError)(
       "HTTP_TOO_LARGE",
       `Download Content-Length ${contentLength} exceeds limit of ${maxBytes} bytes`,
       { url, contentLength: parseInt(contentLength, 10), limit: maxBytes }
     );
   }
   if (!response.body) {
-    throw (0, import_agent_tool7.createTaggedError)("UPSTREAM_ERROR", `No response body from ${url}`, { url });
+    throw (0, import_agent_tool14.createTaggedError)("UPSTREAM_ERROR", `No response body from ${url}`, { url });
   }
   const reader = response.body.getReader();
   const chunks = [];
@@ -3023,7 +2845,7 @@ var downloadFileHandler = (async (args) => {
       totalBytes += value.byteLength;
       if (totalBytes > maxBytes) {
         reader.cancel();
-        throw (0, import_agent_tool7.createTaggedError)(
+        throw (0, import_agent_tool14.createTaggedError)(
           "HTTP_TOO_LARGE",
           `Download from ${url} exceeded limit of ${maxBytes} bytes (received ${totalBytes})`,
           { url, bytesRead: totalBytes, limit: maxBytes }
@@ -3036,9 +2858,9 @@ var downloadFileHandler = (async (args) => {
     reader.releaseLock();
   }
   const sha256 = hasher.digest("hex");
-  await (0, import_promises9.mkdir)((0, import_node_path5.dirname)(resolvedDest), { recursive: true });
+  await (0, import_promises7.mkdir)((0, import_node_path4.dirname)(resolvedDest), { recursive: true });
   const buffer = Buffer.concat(chunks);
-  await (0, import_promises9.writeFile)(resolvedDest, buffer);
+  await (0, import_promises7.writeFile)(resolvedDest, buffer);
   return {
     result: {
       destPath: resolvedDest,
@@ -3065,16 +2887,21 @@ var downloadFileHandler = (async (args) => {
 });
 
 // http/head.ts
-var import_agent_tool8 = require("@easynet/agent-tool");
+var import_agent_tool15 = require("@easynet/agent-tool");
+var import_agent_tool16 = require("@easynet/agent-tool");
 var headHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const url = (args.url ?? args.uri)?.trim();
   if (!url) {
-    throw (0, import_agent_tool8.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
+    throw (0, import_agent_tool16.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
   }
   const headers = args.headers ?? {};
   const timeoutMs = args.timeoutMs ?? ctx.config.defaultTimeoutMs;
-  await validateUrl(url, ctx.config.allowedHosts, ctx.config.blockedCidrs);
+  await (0, import_agent_tool15.validateUrl)(url, {
+    allowedHosts: ctx.config.allowedHosts,
+    blockedHosts: ctx.config.blockedHosts,
+    blockedCidrs: ctx.config.blockedCidrs
+  });
   if (!headers["User-Agent"] && !headers["user-agent"]) {
     headers["User-Agent"] = ctx.config.httpUserAgent;
   }
@@ -3089,13 +2916,13 @@ var headHandler = (async (args) => {
     });
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
-      throw (0, import_agent_tool8.createTaggedError)(
+      throw (0, import_agent_tool16.createTaggedError)(
         "HTTP_TIMEOUT",
         `HEAD request to ${url} timed out after ${timeoutMs}ms`,
         { url, timeoutMs }
       );
     }
-    throw (0, import_agent_tool8.createTaggedError)(
+    throw (0, import_agent_tool16.createTaggedError)(
       "UPSTREAM_ERROR",
       `HEAD request failed for ${url}: ${err instanceof Error ? err.message : String(err)}`,
       { url }
@@ -3125,18 +2952,23 @@ var headHandler = (async (args) => {
 });
 
 // http/duckduckgoSearch.ts
-var import_agent_tool9 = require("@easynet/agent-tool");
+var import_agent_tool17 = require("@easynet/agent-tool");
+var import_agent_tool18 = require("@easynet/agent-tool");
 var DUCKDUCKGO_API = "https://api.duckduckgo.com/";
 var duckduckgoSearchHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const query = (args.query ?? args.q)?.trim();
   if (!query) {
-    throw (0, import_agent_tool9.createTaggedError)("DUCKDUCKGO_INVALID", "query is required (pass 'query' or 'q')", {});
+    throw (0, import_agent_tool18.createTaggedError)("DUCKDUCKGO_INVALID", "query is required (pass 'query' or 'q')", {});
   }
   const timeoutMs = args.timeoutMs ?? ctx.config.defaultTimeoutMs;
   const maxResults = args.maxResults ?? 10;
   const url = `${DUCKDUCKGO_API}?q=${encodeURIComponent(query)}&format=json`;
-  await validateUrl(url, ctx.config.allowedHosts, ctx.config.blockedCidrs);
+  await (0, import_agent_tool17.validateUrl)(url, {
+    allowedHosts: ctx.config.allowedHosts,
+    blockedHosts: ctx.config.blockedHosts,
+    blockedCidrs: ctx.config.blockedCidrs
+  });
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   let response;
@@ -3149,13 +2981,13 @@ var duckduckgoSearchHandler = (async (args) => {
   } catch (err) {
     clearTimeout(timer);
     if (err instanceof Error && err.name === "AbortError") {
-      throw (0, import_agent_tool9.createTaggedError)(
+      throw (0, import_agent_tool18.createTaggedError)(
         "HTTP_TIMEOUT",
         `DuckDuckGo search timed out after ${timeoutMs}ms`,
         { query, timeoutMs }
       );
     }
-    throw (0, import_agent_tool9.createTaggedError)(
+    throw (0, import_agent_tool18.createTaggedError)(
       "UPSTREAM_ERROR",
       `DuckDuckGo search failed: ${err instanceof Error ? err.message : String(err)}`,
       { query }
@@ -3166,7 +2998,7 @@ var duckduckgoSearchHandler = (async (args) => {
   const text = await response.text();
   const bytes = Buffer.byteLength(text, "utf-8");
   if (bytes > maxBytes) {
-    throw (0, import_agent_tool9.createTaggedError)(
+    throw (0, import_agent_tool18.createTaggedError)(
       "HTTP_TOO_LARGE",
       `DuckDuckGo response ${bytes} bytes exceeds limit of ${maxBytes} bytes`,
       { query, bytes, limit: maxBytes }
@@ -3176,7 +3008,7 @@ var duckduckgoSearchHandler = (async (args) => {
   try {
     raw = JSON.parse(text);
   } catch {
-    throw (0, import_agent_tool9.createTaggedError)(
+    throw (0, import_agent_tool18.createTaggedError)(
       "UPSTREAM_ERROR",
       `DuckDuckGo returned invalid JSON`,
       { query, textPreview: text.slice(0, 200) }
@@ -3227,7 +3059,8 @@ var duckduckgoSearchHandler = (async (args) => {
 
 // http/fetchPageMainContent.ts
 var import_node_html_parser = require("node-html-parser");
-var import_agent_tool10 = require("@easynet/agent-tool");
+var import_agent_tool19 = require("@easynet/agent-tool");
+var import_agent_tool20 = require("@easynet/agent-tool");
 var MAIN_SELECTORS = [
   "main",
   "article",
@@ -3270,11 +3103,15 @@ var fetchPageMainContentHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const url = (args.url ?? args.uri)?.trim();
   if (!url) {
-    throw (0, import_agent_tool10.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
+    throw (0, import_agent_tool20.createTaggedError)("HTTP_INVALID", "url is required (pass 'url' or 'uri')", {});
   }
   const timeoutMs = args.timeoutMs ?? ctx.config.defaultTimeoutMs;
   const maxBytes = args.maxBytes ?? ctx.config.maxHttpBytes;
-  await validateUrl(url, ctx.config.allowedHosts, ctx.config.blockedCidrs);
+  await (0, import_agent_tool19.validateUrl)(url, {
+    allowedHosts: ctx.config.allowedHosts,
+    blockedHosts: ctx.config.blockedHosts,
+    blockedCidrs: ctx.config.blockedCidrs
+  });
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   let response;
@@ -3287,13 +3124,13 @@ var fetchPageMainContentHandler = (async (args) => {
   } catch (err) {
     clearTimeout(timer);
     if (err instanceof Error && err.name === "AbortError") {
-      throw (0, import_agent_tool10.createTaggedError)(
+      throw (0, import_agent_tool20.createTaggedError)(
         "HTTP_TIMEOUT",
         `Request to ${url} timed out after ${timeoutMs}ms`,
         { url, timeoutMs }
       );
     }
-    throw (0, import_agent_tool10.createTaggedError)(
+    throw (0, import_agent_tool20.createTaggedError)(
       "UPSTREAM_ERROR",
       `Fetch failed for ${url}: ${err instanceof Error ? err.message : String(err)}`,
       { url }
@@ -3302,7 +3139,7 @@ var fetchPageMainContentHandler = (async (args) => {
   clearTimeout(timer);
   const contentLength = response.headers.get("content-length");
   if (contentLength && parseInt(contentLength, 10) > maxBytes) {
-    throw (0, import_agent_tool10.createTaggedError)(
+    throw (0, import_agent_tool20.createTaggedError)(
       "HTTP_TOO_LARGE",
       `Response Content-Length ${contentLength} exceeds limit of ${maxBytes} bytes`,
       { url, contentLength: parseInt(contentLength, 10), limit: maxBytes }
@@ -3311,7 +3148,7 @@ var fetchPageMainContentHandler = (async (args) => {
   const rawText = await response.text();
   const rawBytes = Buffer.byteLength(rawText, "utf-8");
   if (rawBytes > maxBytes) {
-    throw (0, import_agent_tool10.createTaggedError)(
+    throw (0, import_agent_tool20.createTaggedError)(
       "HTTP_TOO_LARGE",
       `Response body ${rawBytes} bytes exceeds limit of ${maxBytes} bytes`,
       { url, bytes: rawBytes, limit: maxBytes }
@@ -3354,14 +3191,15 @@ var fetchPageMainContentHandler = (async (args) => {
 });
 
 // http/yahooFinance.ts
-var import_agent_tool11 = require("@easynet/agent-tool");
+var import_agent_tool21 = require("@easynet/agent-tool");
+var import_agent_tool22 = require("@easynet/agent-tool");
 var YAHOO_CHART_BASE = "https://query1.finance.yahoo.com/v8/finance/chart/";
 var yahooFinanceQuoteHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const rawSymbols = args.symbols ?? args.symbol ?? args.tickers;
   const symbols = Array.isArray(rawSymbols) ? rawSymbols.map((s) => String(s).trim().toUpperCase()).filter(Boolean) : rawSymbols != null ? [String(rawSymbols).trim().toUpperCase()].filter(Boolean) : [];
   if (symbols.length === 0) {
-    throw (0, import_agent_tool11.createTaggedError)(
+    throw (0, import_agent_tool22.createTaggedError)(
       "YAHOO_INVALID",
       "At least one symbol is required",
       {}
@@ -3373,7 +3211,11 @@ var yahooFinanceQuoteHandler = (async (args) => {
   const quotes = [];
   for (const symbol of symbols) {
     const url2 = `${YAHOO_CHART_BASE}${encodeURIComponent(symbol)}?interval=1d&range=${range}`;
-    await validateUrl(url2, ctx.config.allowedHosts, ctx.config.blockedCidrs);
+    await (0, import_agent_tool21.validateUrl)(url2, {
+      allowedHosts: ctx.config.allowedHosts,
+      blockedHosts: ctx.config.blockedHosts,
+      blockedCidrs: ctx.config.blockedCidrs
+    });
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
     let response;
@@ -3389,13 +3231,13 @@ var yahooFinanceQuoteHandler = (async (args) => {
     } catch (err) {
       clearTimeout(timer);
       if (err instanceof Error && err.name === "AbortError") {
-        throw (0, import_agent_tool11.createTaggedError)(
+        throw (0, import_agent_tool22.createTaggedError)(
           "HTTP_TIMEOUT",
           `Yahoo Finance request for ${symbol} timed out after ${timeoutMs}ms`,
           { symbol, timeoutMs }
         );
       }
-      throw (0, import_agent_tool11.createTaggedError)(
+      throw (0, import_agent_tool22.createTaggedError)(
         "UPSTREAM_ERROR",
         `Yahoo Finance request failed: ${err instanceof Error ? err.message : String(err)}`,
         { symbol }
@@ -3405,7 +3247,7 @@ var yahooFinanceQuoteHandler = (async (args) => {
     const text = await response.text();
     const bytes = Buffer.byteLength(text, "utf-8");
     if (bytes > maxBytes) {
-      throw (0, import_agent_tool11.createTaggedError)(
+      throw (0, import_agent_tool22.createTaggedError)(
         "HTTP_TOO_LARGE",
         `Yahoo Finance response ${bytes} bytes exceeds limit of ${maxBytes} bytes`,
         { symbol, bytes, limit: maxBytes }
@@ -3415,7 +3257,7 @@ var yahooFinanceQuoteHandler = (async (args) => {
     try {
       data = JSON.parse(text);
     } catch {
-      throw (0, import_agent_tool11.createTaggedError)(
+      throw (0, import_agent_tool22.createTaggedError)(
         "UPSTREAM_ERROR",
         "Yahoo Finance returned invalid JSON",
         { symbol, textPreview: text.slice(0, 200) }
@@ -3423,7 +3265,7 @@ var yahooFinanceQuoteHandler = (async (args) => {
     }
     const error = data.chart?.error;
     if (error?.description) {
-      throw (0, import_agent_tool11.createTaggedError)(
+      throw (0, import_agent_tool22.createTaggedError)(
         "YAHOO_ERROR",
         `Yahoo Finance error for ${symbol}: ${error.description}`,
         { symbol, code: error.code }
@@ -3635,13 +3477,14 @@ var templateRenderHandler = (async (args) => {
 
 // exec/runCommand.ts
 var import_node_child_process = require("child_process");
-var import_node_path6 = require("path");
-var import_agent_tool12 = require("@easynet/agent-tool");
+var import_node_path5 = require("path");
+var import_agent_tool23 = require("@easynet/agent-tool");
+var import_agent_tool24 = require("@easynet/agent-tool");
 var runCommandHandler = (async (args) => {
   const ctx = getBuiltinContext();
   const { allowedCommands, maxCommandOutputBytes, commandTimeoutMs } = ctx.config;
   if (!allowedCommands.length) {
-    throw (0, import_agent_tool12.createTaggedError)(
+    throw (0, import_agent_tool24.createTaggedError)(
       "EXEC_DISABLED",
       "Exec is disabled: allowedCommands is empty",
       {}
@@ -3649,18 +3492,18 @@ var runCommandHandler = (async (args) => {
   }
   const rawCommand = (args.command ?? args.cmd)?.trim();
   if (!rawCommand) {
-    throw (0, import_agent_tool12.createTaggedError)("EXEC_INVALID", "command is required (pass 'command' or 'cmd')", {});
+    throw (0, import_agent_tool24.createTaggedError)("EXEC_INVALID", "command is required (pass 'command' or 'cmd')", {});
   }
   const baseName = rawCommand.replace(/^.*\//, "").trim();
   if (baseName !== rawCommand || /[;&|$`\s]/.test(rawCommand)) {
-    throw (0, import_agent_tool12.createTaggedError)(
+    throw (0, import_agent_tool24.createTaggedError)(
       "EXEC_INVALID",
       "command must be a single executable name (no path, no shell chars)",
       { command: rawCommand }
     );
   }
   if (!allowedCommands.includes(baseName)) {
-    throw (0, import_agent_tool12.createTaggedError)(
+    throw (0, import_agent_tool24.createTaggedError)(
       "EXEC_NOT_ALLOWED",
       `Command "${baseName}" is not in allowedCommands`,
       { command: baseName, allowed: allowedCommands }
@@ -3668,9 +3511,9 @@ var runCommandHandler = (async (args) => {
   }
   const cmdArgs = Array.isArray(args.args) ? args.args : Array.isArray(args.arguments) ? args.arguments : [];
   const timeoutMs = args.timeoutMs ?? commandTimeoutMs;
-  let cwd = (0, import_node_path6.resolve)(ctx.config.sandboxRoot);
+  let cwd = (0, import_node_path5.resolve)(ctx.config.sandboxRoot);
   if (args.cwd != null && args.cwd !== "") {
-    cwd = await resolveSandboxedPath(args.cwd, ctx.config.sandboxRoot);
+    cwd = await (0, import_agent_tool23.resolveSandboxedPath)(args.cwd, ctx.config.sandboxRoot);
   }
   return new Promise((resolvePromise, rejectPromise) => {
     const proc = (0, import_node_child_process.spawn)(baseName, cmdArgs, {
@@ -3687,7 +3530,7 @@ var runCommandHandler = (async (args) => {
       if (totalBytes + len > maxCommandOutputBytes) {
         proc.kill("SIGKILL");
         rejectPromise(
-          (0, import_agent_tool12.createTaggedError)(
+          (0, import_agent_tool24.createTaggedError)(
             "EXEC_OUTPUT_TOO_LARGE",
             `Command output exceeded ${maxCommandOutputBytes} bytes`,
             { maxBytes: maxCommandOutputBytes }
@@ -3725,7 +3568,7 @@ var runCommandHandler = (async (args) => {
     proc.on("error", (err) => {
       clearTimeout(timeout);
       rejectPromise(
-        (0, import_agent_tool12.createTaggedError)("EXEC_SPAWN_ERROR", err.message, { command: baseName })
+        (0, import_agent_tool24.createTaggedError)("EXEC_SPAWN_ERROR", err.message, { command: baseName })
       );
     });
     proc.on("close", (code, signal) => {
@@ -3959,7 +3802,8 @@ var CORE_GROUP_PREFIX = {
 function registerCoreTools(registry, userConfig, options) {
   const config = {
     ...DEFAULT_CORE_TOOLS_CONFIG,
-    ...userConfig
+    ...userConfig,
+    blockedHosts: userConfig.blockedHosts ?? []
   };
   const adapter = new CoreAdapter(config);
   const onlySet = options?.only?.length ? new Set(options.only) : null;
@@ -3976,6 +3820,9 @@ function registerCoreTools(registry, userConfig, options) {
   }
   return adapter;
 }
+
+// index.ts
+var import_agent_tool25 = require("@easynet/agent-tool");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CoreAdapter,