@elizaos/agent 2.0.0-beta.2 → 2.0.11-beta.6

package/packages/agent/src/api/server-helpers-config.js

@@ -1,293 +0,0 @@
-/**
- * Config redaction, onboarding, and skill validation helpers extracted from server.ts.
- */
-import path from "node:path";
-import { logger, sendJsonError } from "@elizaos/core";
-import { getDefaultStylePreset, getStylePresets, normalizeCharacterLanguage, ONBOARDING_CLOUD_PROVIDER_OPTIONS, ONBOARDING_PROVIDER_CATALOG, } from "@elizaos/shared";
-import { generateWalletKeys, setSolanaWalletEnv } from "./wallet.js";
-// ---------------------------------------------------------------------------
-// Config redaction
-// ---------------------------------------------------------------------------
-/**
- * Key patterns that indicate a value is sensitive and must be redacted.
- */
-export const SENSITIVE_KEY_RE = /password|secret|api.?key|private.?key|seed.?phrase|authorization|connection.?string|credential|(?<!max)tokens?$/i;
-export function isBlockedObjectKey(key) {
-    return (key === "__proto__" ||
-        key === "constructor" ||
-        key === "prototype" ||
-        key === "$include");
-}
-function redactValue(val) {
-    if (val === null || val === undefined)
-        return val;
-    if (typeof val === "string")
-        return val.length > 0 ? "[REDACTED]" : "";
-    if (typeof val === "number" || typeof val === "boolean")
-        return "[REDACTED]";
-    if (Array.isArray(val))
-        return val.map(redactValue);
-    if (typeof val === "object") {
-        const out = {};
-        for (const [k, v] of Object.entries(val)) {
-            out[k] = redactValue(v);
-        }
-        return out;
-    }
-    return "[REDACTED]";
-}
-export function redactDeep(val) {
-    if (val === null || val === undefined)
-        return val;
-    if (Array.isArray(val))
-        return val.map(redactDeep);
-    if (typeof val === "object") {
-        const out = {};
-        for (const [key, child] of Object.entries(val)) {
-            if (SENSITIVE_KEY_RE.test(key)) {
-                out[key] = redactValue(child);
-            }
-            else {
-                out[key] = redactDeep(child);
-            }
-        }
-        return out;
-    }
-    return val;
-}
-export function redactConfigSecrets(config) {
-    return redactDeep(config);
-}
-export function isRedactedSecretValue(value) {
-    return (typeof value === "string" && value.trim().toUpperCase() === "[REDACTED]");
-}
-/** Remove UI round-trip placeholders so GET /api/config -> PUT never persists "[REDACTED]". */
-export function stripRedactedPlaceholderValuesDeep(value) {
-    if (value === null || typeof value !== "object")
-        return;
-    if (Array.isArray(value)) {
-        for (const item of value) {
-            stripRedactedPlaceholderValuesDeep(item);
-        }
-        return;
-    }
-    const obj = value;
-    for (const key of Object.keys(obj)) {
-        const v = obj[key];
-        if (isRedactedSecretValue(v)) {
-            delete obj[key];
-        }
-        else if (v !== null && typeof v === "object") {
-            stripRedactedPlaceholderValuesDeep(v);
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// Skill-ID path-traversal guard
-// ---------------------------------------------------------------------------
-const SAFE_SKILL_ID_RE = /^[a-zA-Z0-9._-]+$/;
-export function validateSkillId(skillId, res) {
-    if (!skillId ||
-        !SAFE_SKILL_ID_RE.test(skillId) ||
-        skillId === "." ||
-        skillId.includes("..")) {
-        const safeDisplay = skillId.slice(0, 80).replace(/[^\x20-\x7e]/g, "?");
-        sendJsonError(res, `Invalid skill ID: "${safeDisplay}"`, 400);
-        return null;
-    }
-    return skillId;
-}
-// ---------------------------------------------------------------------------
-// Onboarding helpers
-// ---------------------------------------------------------------------------
-const DEFAULT_ELEVENLABS_TTS_MODEL = "eleven_flash_v2_5";
-const ELEVENLABS_VOICE_ID_BY_PRESET = {
-    rachel: "21m00Tcm4TlvDq8ikWAM",
-    sarah: "EXAVITQu4vr4xnSDxMaL",
-    matilda: "XrExE9yKIg1WjnnlVkGX",
-    lily: "pFZP5JQG7iQjIQuC4Bku",
-    alice: "Xb7hH8MSUJpSbSDYk0k2",
-    brian: "nPczCjzI2devNBz1zQrb",
-    adam: "pNInz6obpgDQGcFmaJgB",
-    josh: "TxGEqnHWrfWFTfGW9XjX",
-    daniel: "onwK4e9ZLuTAKqWW03F9",
-    liam: "TX3LPaxmHKxFdv7VOQHJ",
-    gigi: "jBpfuIE2acCO8z3wKNLl",
-    mimi: "zrHiDhphv9ZnVXBqCLjz",
-    dorothy: "ThT5KcBeYPX3keUQqHPh",
-    glinda: "z9fAnlkpzviPz146aGWa",
-    charlotte: "XB0fDUnXU5powFXDhCwa",
-    callum: "N2lVS1w4EtoT3dr4eOWO",
-    momo: "n7Wi4g1bhpw4Bs8HK5ph",
-    yuki: "4tRn1lSkEn13EVTuqb0g",
-    rin: "cNYrMw9glwJZXR8RwbuR",
-    kei: "eadgjmk4R4uojdsheG9t",
-    jin: "6IwYbsNENZgAB1dtBZDp",
-    satoshi: "7cOBG34AiHrAzs842Rdi",
-    ryu: "QzTKubutNn9TjrB7Xb2Q",
-};
-export function readUiLanguageHeader(req) {
-    if (!req) {
-        return undefined;
-    }
-    const header = req.headers["x-eliza-ui-language"] ?? req.headers["x-eliza-ui-language"];
-    if (Array.isArray(header)) {
-        return header.find((value) => value.trim())?.trim();
-    }
-    return typeof header === "string" && header.trim()
-        ? header.trim()
-        : undefined;
-}
-export function resolveConfiguredCharacterLanguage(config, req) {
-    const uiLanguage = readUiLanguageHeader(req) ??
-        config?.ui?.language;
-    return normalizeCharacterLanguage(uiLanguage);
-}
-export function resolveOnboardingStylePreset(body, language) {
-    const presets = getStylePresets(language);
-    const requestedPresetId = typeof body.presetId === "string" ? body.presetId.trim() : "";
-    if (requestedPresetId) {
-        const byId = presets.find((preset) => preset.id === requestedPresetId);
-        if (byId)
-            return byId;
-    }
-    if (typeof body.avatarIndex === "number" &&
-        Number.isFinite(body.avatarIndex)) {
-        const byAvatar = presets.find((preset) => preset.avatarIndex === Number(body.avatarIndex));
-        if (byAvatar)
-            return byAvatar;
-    }
-    const requestedName = typeof body.name === "string" ? body.name.trim() : "";
-    if (requestedName) {
-        const byName = presets.find((preset) => preset.name === requestedName);
-        if (byName)
-            return byName;
-    }
-    return getDefaultStylePreset(language);
-}
-export function applyOnboardingVoicePreset(config, body, language) {
-    const elevenLabsApiKey = process.env.ELEVENLABS_API_KEY?.trim();
-    if (!elevenLabsApiKey) {
-        return;
-    }
-    const stylePreset = resolveOnboardingStylePreset(body, language);
-    const voicePresetId = stylePreset?.voicePresetId?.trim();
-    if (!voicePresetId) {
-        return;
-    }
-    const voiceId = ELEVENLABS_VOICE_ID_BY_PRESET[voicePresetId];
-    if (!voiceId) {
-        return;
-    }
-    if (!config.messages || typeof config.messages !== "object") {
-        config.messages = {};
-    }
-    const messages = config.messages;
-    const existingTts = messages.tts && typeof messages.tts === "object"
-        ? messages.tts
-        : {};
-    const existingElevenlabs = existingTts.elevenlabs && typeof existingTts.elevenlabs === "object"
-        ? existingTts.elevenlabs
-        : {};
-    messages.tts = {
-        ...existingTts,
-        provider: "elevenlabs",
-        elevenlabs: {
-            ...existingElevenlabs,
-            voiceId,
-            modelId: typeof existingElevenlabs.modelId === "string" &&
-                existingElevenlabs.modelId.trim()
-                ? existingElevenlabs.modelId.trim()
-                : DEFAULT_ELEVENLABS_TTS_MODEL,
-        },
-    };
-}
-export function resolveDefaultAgentName(config, req) {
-    const configuredName = config?.ui?.assistant?.name?.trim() ??
-        config?.agents?.list?.[0]?.name?.trim();
-    if (configuredName) {
-        return configuredName;
-    }
-    return getDefaultStylePreset(resolveConfiguredCharacterLanguage(config, req))
-        .name;
-}
-export function getProviderOptions() {
-    return ONBOARDING_PROVIDER_CATALOG.map((provider) => ({
-        id: provider.id,
-        name: provider.name,
-        envKey: provider.envKey,
-        pluginName: provider.pluginName,
-        keyPrefix: provider.keyPrefix,
-        description: provider.description,
-    }));
-}
-export function getCloudProviderOptions() {
-    return ONBOARDING_CLOUD_PROVIDER_OPTIONS.map((provider) => ({
-        id: provider.id,
-        name: provider.name,
-        description: provider.description,
-    }));
-}
-export function ensureWalletKeysInEnvAndConfig(config) {
-    const missingEvm = typeof process.env.EVM_PRIVATE_KEY !== "string" ||
-        !process.env.EVM_PRIVATE_KEY.trim();
-    const missingSolana = typeof process.env.SOLANA_PRIVATE_KEY !== "string" ||
-        !process.env.SOLANA_PRIVATE_KEY.trim();
-    if (!missingEvm && !missingSolana) {
-        return false;
-    }
-    try {
-        const walletKeys = generateWalletKeys();
-        if (!config.env ||
-            typeof config.env !== "object" ||
-            Array.isArray(config.env)) {
-            config.env = {};
-        }
-        const envConfig = config.env;
-        if (missingEvm) {
-            envConfig.EVM_PRIVATE_KEY = walletKeys.evmPrivateKey;
-            process.env.EVM_PRIVATE_KEY = walletKeys.evmPrivateKey;
-            logger.info(`[eliza-api] Generated EVM wallet: ${walletKeys.evmAddress}`);
-        }
-        if (missingSolana) {
-            envConfig.SOLANA_PRIVATE_KEY = walletKeys.solanaPrivateKey;
-            setSolanaWalletEnv(walletKeys.solanaPrivateKey);
-            logger.info(`[eliza-api] Generated Solana wallet: ${walletKeys.solanaAddress}`);
-        }
-        return true;
-    }
-    catch (err) {
-        logger.warn(`[eliza-api] Failed to generate wallet keys: ${err instanceof Error ? err.message : String(err)}`);
-        return false;
-    }
-}
-// ---------------------------------------------------------------------------
-// State dir safety
-// ---------------------------------------------------------------------------
-const RESET_STATE_ALLOWED_SEGMENTS = new Set([
-    ".eliza",
-    "eliza",
-    ".eliza",
-    "eliza",
-]);
-function hasAllowedResetSegment(resolvedState) {
-    return resolvedState
-        .split(path.sep)
-        .some((segment) => RESET_STATE_ALLOWED_SEGMENTS.has(segment.trim().toLowerCase()));
-}
-export function isSafeResetStateDir(resolvedState, homeDir) {
-    const normalizedState = path.resolve(resolvedState);
-    const normalizedHome = path.resolve(homeDir);
-    const parsedRoot = path.parse(normalizedState).root;
-    if (normalizedState === parsedRoot)
-        return false;
-    if (normalizedState === normalizedHome)
-        return false;
-    const relativeToHome = path.relative(normalizedHome, normalizedState);
-    const isUnderHome = relativeToHome.length > 0 &&
-        !relativeToHome.startsWith("..") &&
-        !path.isAbsolute(relativeToHome);
-    if (!isUnderHome)
-        return false;
-    return hasAllowedResetSegment(normalizedState);
-}

package/packages/agent/src/api/server-helpers-fetch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-helpers-fetch.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-fetch.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,KAAK,wBAAwB,GAAG,IAAI,CAClC,IAAI,CAAC,cAAc,EACnB,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,gBAAgB,GAAG,eAAe,GAAG,WAAW,CAC5E,CAAC;AAgBF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAC5B,MAAM,GAAG,IAAI,CAMf;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKpD;AAQD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC,CAwCnB;AA8BD;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,wBAAwB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAmEjB"}

package/packages/agent/src/api/server-helpers-mcp.d.ts

@@ -1,12 +0,0 @@
-/**
- * MCP server configuration validation helpers extracted from server.ts.
- */
-import type http from "node:http";
-import type { TerminalRunRejection } from "./server-helpers-auth.ts";
-export declare function validateMcpServerConfig(config: Record<string, unknown>): Promise<string | null>;
-export declare function resolveMcpServersRejection(servers: Record<string, unknown>): Promise<string | null>;
-export declare function mcpServersIncludeStdio(servers: Record<string, unknown>): boolean;
-export declare function resolveMcpTerminalAuthorizationRejection(req: Pick<http.IncomingMessage, "headers">, servers: Record<string, unknown>, body: {
-    terminalToken?: string;
-}): TerminalRunRejection | null;
-//# sourceMappingURL=server-helpers-mcp.d.ts.map

package/packages/agent/src/api/server-helpers-mcp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-helpers-mcp.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-mcp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAOlC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AA+MrE,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4GxB;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAWT;AAED,wBAAgB,wCAAwC,CACtD,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,oBAAoB,GAAG,IAAI,CAK7B"}

package/packages/agent/src/api/server-helpers-mcp.js

@@ -1,315 +0,0 @@
-/**
- * MCP server configuration validation helpers extracted from server.ts.
- */
-import { lookup as dnsLookup } from "node:dns/promises";
-import net from "node:net";
-import { isBlockedPrivateOrLinkLocalIp, normalizeHostLike, } from "../security/network-policy.js";
-import { hasBlockedObjectKeyDeep } from "./server-helpers.js";
-import { resolveTerminalRunRejection } from "./server-helpers-auth.js";
-const ALLOWED_MCP_CONFIG_TYPES = new Set([
-    "stdio",
-    "http",
-    "streamable-http",
-    "sse",
-]);
-const ALLOWED_MCP_COMMANDS = new Set([
-    "npx",
-    "node",
-    "bun",
-    "bunx",
-    "deno",
-    "python",
-    "python3",
-    "uvx",
-    "uv",
-    "docker",
-    "podman",
-]);
-const BLOCKED_MCP_ENV_KEYS = new Set([
-    "LD_PRELOAD",
-    "LD_LIBRARY_PATH",
-    "DYLD_INSERT_LIBRARIES",
-    "DYLD_LIBRARY_PATH",
-    "NODE_OPTIONS",
-    "NODE_EXTRA_CA_CERTS",
-    "NODE_TLS_REJECT_UNAUTHORIZED",
-    "HTTP_PROXY",
-    "HTTPS_PROXY",
-    "ALL_PROXY",
-    "NO_PROXY",
-    "NODE_PATH",
-    "SSL_CERT_FILE",
-    "SSL_CERT_DIR",
-    "CURL_CA_BUNDLE",
-    "PATH",
-    "HOME",
-    "SHELL",
-]);
-const INTERPRETER_MCP_COMMANDS = new Set([
-    "node",
-    "bun",
-    "deno",
-    "python",
-    "python3",
-    "uv",
-]);
-const PACKAGE_RUNNER_MCP_COMMANDS = new Set(["npx", "bunx", "uvx"]);
-const CONTAINER_MCP_COMMANDS = new Set(["docker", "podman"]);
-const BLOCKED_INTERPRETER_FLAGS = new Set([
-    "-e",
-    "--eval",
-    "-p",
-    "--print",
-    "-r",
-    "--require",
-    "--import",
-    "--loader",
-    "--experimental-loader",
-    "--preload",
-    "-c",
-    "-m",
-    // V8 inspector -- opens an unauthenticated debug port (default 9229) that
-    // allows arbitrary code execution via Chrome DevTools Protocol.  If bound
-    // to 0.0.0.0, any network peer can connect -> RCE without any token.
-    "--inspect",
-    "--inspect-brk",
-    "--inspect-wait",
-    "--inspect-port",
-    "--inspect-publish-uid",
-    // Policy / diagnostics file access
-    "--experimental-policy",
-    "--diagnostic-dir",
-]);
-const BLOCKED_PACKAGE_RUNNER_FLAGS = new Set(["-c", "--call", "-e", "--eval"]);
-const BLOCKED_CONTAINER_FLAGS = new Set([
-    "--privileged",
-    "-v",
-    "--volume",
-    "--mount",
-    "--cap-add",
-    "--security-opt",
-    "--pid",
-    "--network",
-    "--device",
-    "--ipc",
-    "--uts",
-    "--userns",
-    "--cgroupns",
-]);
-const BLOCKED_DENO_SUBCOMMANDS = new Set(["eval"]);
-const BLOCKED_MCP_REMOTE_HOST_LITERALS = new Set([
-    "localhost",
-    "metadata.google.internal",
-]);
-function normalizeMcpCommand(command) {
-    const baseName = command.replace(/\\/g, "/").split("/").pop() ?? "";
-    return baseName.replace(/\.(exe|cmd|bat)$/i, "").toLowerCase();
-}
-function hasBlockedFlag(args, blockedFlags) {
-    for (const arg of args) {
-        const trimmed = arg.trim();
-        for (const flag of blockedFlags) {
-            if (trimmed === flag || trimmed.startsWith(`${flag}=`)) {
-                return flag;
-            }
-            // Block attached short-option forms like -cpayload or -epayload.
-            if (/^-[A-Za-z]$/.test(flag) &&
-                trimmed.startsWith(flag) &&
-                trimmed.length > flag.length) {
-                return flag;
-            }
-        }
-    }
-    return null;
-}
-function firstPositionalArg(args) {
-    for (const arg of args) {
-        const trimmed = arg.trim();
-        if (!trimmed || trimmed === "--" || trimmed.startsWith("-"))
-            continue;
-        return trimmed.toLowerCase();
-    }
-    return null;
-}
-async function resolveMcpRemoteUrlRejection(rawUrl) {
-    let parsed;
-    try {
-        parsed = new URL(rawUrl);
-    }
-    catch {
-        return "URL must be a valid absolute URL";
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-        return "URL must use http:// or https://";
-    }
-    const hostname = normalizeHostLike(parsed.hostname);
-    if (!hostname)
-        return "URL hostname is required";
-    if (BLOCKED_MCP_REMOTE_HOST_LITERALS.has(hostname) ||
-        hostname.endsWith(".localhost") ||
-        hostname.endsWith(".local")) {
-        return `URL host "${hostname}" is blocked for security reasons`;
-    }
-    if (net.isIP(hostname)) {
-        if (isBlockedPrivateOrLinkLocalIp(hostname)) {
-            return `URL host "${hostname}" is blocked for security reasons`;
-        }
-        return null;
-    }
-    let addresses;
-    try {
-        const resolved = await dnsLookup(hostname, { all: true });
-        addresses = Array.isArray(resolved) ? resolved : [resolved];
-    }
-    catch {
-        return `Could not resolve URL host "${hostname}"`;
-    }
-    if (addresses.length === 0) {
-        return `Could not resolve URL host "${hostname}"`;
-    }
-    for (const entry of addresses) {
-        if (isBlockedPrivateOrLinkLocalIp(entry.address)) {
-            return `URL host "${hostname}" resolves to blocked address ${entry.address}`;
-        }
-    }
-    return null;
-}
-function isBlockedObjectKey(key) {
-    return (key === "__proto__" ||
-        key === "constructor" ||
-        key === "prototype" ||
-        // Block config include directives -- if an API caller embeds "$include"
-        // inside a config patch, the next loadElizaConfig() -> resolveConfigIncludes
-        // pass would read arbitrary local files and merge them into the config.
-        key === "$include");
-}
-export async function validateMcpServerConfig(config) {
-    const configType = config.type;
-    if (typeof configType !== "string" ||
-        !ALLOWED_MCP_CONFIG_TYPES.has(configType)) {
-        return `Invalid config type. Must be one of: ${[...ALLOWED_MCP_CONFIG_TYPES].join(", ")}`;
-    }
-    if (configType === "stdio") {
-        const command = typeof config.command === "string" ? config.command.trim() : "";
-        if (!command) {
-            return "Command is required for stdio servers";
-        }
-        if (!/^[A-Za-z0-9._-]+$/.test(command)) {
-            return "Command must be a bare executable name without path separators";
-        }
-        const normalizedCommand = normalizeMcpCommand(command);
-        if (!ALLOWED_MCP_COMMANDS.has(normalizedCommand)) {
-            return (`Command "${command}" is not allowed. ` +
-                `Allowed commands: ${[...ALLOWED_MCP_COMMANDS].join(", ")}`);
-        }
-        if (config.args !== undefined) {
-            if (!Array.isArray(config.args)) {
-                return "args must be an array of strings";
-            }
-            for (const arg of config.args) {
-                if (typeof arg !== "string") {
-                    return "Each arg must be a string";
-                }
-            }
-            const args = config.args;
-            if (INTERPRETER_MCP_COMMANDS.has(normalizedCommand)) {
-                const blocked = hasBlockedFlag(args, BLOCKED_INTERPRETER_FLAGS);
-                if (blocked) {
-                    return `Flag "${blocked}" is not allowed for ${normalizedCommand} MCP servers`;
-                }
-            }
-            if (PACKAGE_RUNNER_MCP_COMMANDS.has(normalizedCommand)) {
-                const blocked = hasBlockedFlag(args, BLOCKED_PACKAGE_RUNNER_FLAGS);
-                if (blocked) {
-                    return `Flag "${blocked}" is not allowed for ${normalizedCommand} MCP servers`;
-                }
-            }
-            if (CONTAINER_MCP_COMMANDS.has(normalizedCommand)) {
-                const blocked = hasBlockedFlag(args, BLOCKED_CONTAINER_FLAGS);
-                if (blocked) {
-                    return `Flag "${blocked}" is not allowed for ${normalizedCommand} MCP servers`;
-                }
-            }
-            if (normalizedCommand === "deno") {
-                const subcommand = firstPositionalArg(args);
-                if (subcommand && BLOCKED_DENO_SUBCOMMANDS.has(subcommand)) {
-                    return `Subcommand "${subcommand}" is not allowed for deno MCP servers`;
-                }
-            }
-        }
-    }
-    else {
-        const url = typeof config.url === "string" ? config.url.trim() : "";
-        if (!url) {
-            return "URL is required for remote servers";
-        }
-        const urlRejection = await resolveMcpRemoteUrlRejection(url);
-        if (urlRejection)
-            return urlRejection;
-    }
-    if (config.env !== undefined) {
-        if (typeof config.env !== "object" ||
-            config.env === null ||
-            Array.isArray(config.env)) {
-            return "env must be a plain object of string key-value pairs";
-        }
-        for (const [key, value] of Object.entries(config.env)) {
-            if (isBlockedObjectKey(key)) {
-                return `env key "${key}" is blocked for security reasons`;
-            }
-            if (typeof value !== "string") {
-                return `env.${key} must be a string`;
-            }
-            if (BLOCKED_MCP_ENV_KEYS.has(key.toUpperCase())) {
-                return `env variable "${key}" is not allowed for security reasons`;
-            }
-        }
-    }
-    if (config.cwd !== undefined && typeof config.cwd !== "string") {
-        return "cwd must be a string";
-    }
-    if (config.timeoutInMillis !== undefined) {
-        if (typeof config.timeoutInMillis !== "number" ||
-            !Number.isFinite(config.timeoutInMillis) ||
-            config.timeoutInMillis < 0) {
-            return "timeoutInMillis must be a non-negative number";
-        }
-    }
-    return null;
-}
-export async function resolveMcpServersRejection(servers) {
-    for (const [serverName, serverConfig] of Object.entries(servers)) {
-        if (isBlockedObjectKey(serverName)) {
-            return `Invalid server name: "${serverName}"`;
-        }
-        if (!serverConfig ||
-            typeof serverConfig !== "object" ||
-            Array.isArray(serverConfig)) {
-            return `Server "${serverName}" config must be a JSON object`;
-        }
-        if (hasBlockedObjectKeyDeep(serverConfig)) {
-            return `Server "${serverName}" contains blocked object keys`;
-        }
-        const configError = await validateMcpServerConfig(serverConfig);
-        if (configError) {
-            return `Server "${serverName}": ${configError}`;
-        }
-    }
-    return null;
-}
-export function mcpServersIncludeStdio(servers) {
-    return Object.values(servers).some((serverConfig) => {
-        if (!serverConfig ||
-            typeof serverConfig !== "object" ||
-            Array.isArray(serverConfig)) {
-            return false;
-        }
-        return serverConfig.type === "stdio";
-    });
-}
-export function resolveMcpTerminalAuthorizationRejection(req, servers, body) {
-    if (!mcpServersIncludeStdio(servers)) {
-        return null;
-    }
-    return resolveTerminalRunRejection(req, body);
-}

package/packages/agent/src/api/server-helpers-plugin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"server-helpers-plugin.d.ts","sourceRoot":"","sources":["../../../../../src/api/server-helpers-plugin.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAsFrD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,SAAS,CAAC,GAC9C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4DxB;AAMD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qCAAqC,CACnD,YAAY,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,EACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,6BAA6B,EAAE,CA0BjC"}