@garuda-agent/garuda 0.0.1 → 0.15.0

package/dist/chunk-5DEWP3YX.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+
+// src/mcp/trust.ts
+import { randomBytes } from "crypto";
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { z } from "zod";
+var TRUST_FILE = join(".garuda", "trust.json");
+var entry = z.object({
+  def: z.string().optional(),
+  tools: z.string().optional(),
+  /** A hash per tool name, to say which tools changed. */
+  toolHashes: z.record(z.string(), z.string()).optional()
+});
+var schema = z.object({
+  version: z.literal(1),
+  mcp: z.record(z.string(), z.record(z.string(), entry)).default({}),
+  /** Project root → hash of the approved project hooks. */
+  hooks: z.record(z.string(), z.string()).default({}),
+  /** Project root → command name → hash of the approved command file (0.4). */
+  commands: z.record(z.string(), z.record(z.string(), z.string())).default({}),
+  /** Project root → skill name → hash of the approved SKILL.md (0.5). */
+  skills: z.record(z.string(), z.record(z.string(), z.string())).default({}),
+  /** Project root → agent name → hash of the approved agent file (0.5). */
+  agents: z.record(z.string(), z.record(z.string(), z.string())).default({}),
+  /** Project root → hash of the approved network allowlist (0.13). */
+  network: z.record(z.string(), z.string()).default({}),
+  /** Project root → language plugin name → hash of the approved plugin file (0.16). */
+  languages: z.record(z.string(), z.record(z.string(), z.string())).default({}),
+  /** Project root → hash of the approved settings parts that loosen safety (review, 2026-10). */
+  settings: z.record(z.string(), z.string()).default({})
+});
+var USER_SCOPE = "~";
+var TrustStore = class _TrustStore {
+  constructor(file) {
+    this.file = file;
+  }
+  file;
+  data = {
+    version: 1,
+    mcp: {},
+    hooks: {},
+    commands: {},
+    skills: {},
+    agents: {},
+    network: {},
+    languages: {},
+    settings: {}
+  };
+  static async open(home = homedir()) {
+    const store = new _TrustStore(join(home, TRUST_FILE));
+    try {
+      const parsed = schema.safeParse(JSON.parse(await readFile(store.file, "utf8")));
+      if (parsed.success) store.data = parsed.data;
+    } catch {
+    }
+    return store;
+  }
+  get(scope, server) {
+    return this.data.mcp[scope]?.[server] ?? {};
+  }
+  hooksHash(root) {
+    return this.data.hooks[root];
+  }
+  async setHooksHash(root, hash) {
+    this.data.hooks[root] = hash;
+    await this.save();
+  }
+  commandHash(root, name) {
+    return this.data.commands[root]?.[name];
+  }
+  async setCommandHash(root, name, hash) {
+    const commands = this.data.commands[root] ?? {};
+    this.data.commands[root] = commands;
+    commands[name] = hash;
+    await this.save();
+  }
+  skillHash(root, name) {
+    return this.data.skills[root]?.[name];
+  }
+  async setSkillHash(root, name, hash) {
+    const skills = this.data.skills[root] ?? {};
+    this.data.skills[root] = skills;
+    skills[name] = hash;
+    await this.save();
+  }
+  agentHash(root, name) {
+    return this.data.agents[root]?.[name];
+  }
+  async setAgentHash(root, name, hash) {
+    const agents = this.data.agents[root] ?? {};
+    this.data.agents[root] = agents;
+    agents[name] = hash;
+    await this.save();
+  }
+  networkHash(root) {
+    return this.data.network[root];
+  }
+  async setNetworkHash(root, hash) {
+    this.data.network[root] = hash;
+    await this.save();
+  }
+  settingsHash(root) {
+    return this.data.settings[root];
+  }
+  async setSettingsHash(root, hash) {
+    this.data.settings[root] = hash;
+    await this.save();
+  }
+  languageHash(root, name) {
+    return this.data.languages[root]?.[name];
+  }
+  async setLanguageHash(root, name, hash) {
+    const languages = this.data.languages[root] ?? {};
+    this.data.languages[root] = languages;
+    languages[name] = hash;
+    await this.save();
+  }
+  async set(scope, server, value) {
+    const servers = this.data.mcp[scope] ?? {};
+    this.data.mcp[scope] = servers;
+    servers[server] = { ...servers[server], ...value };
+    await this.save();
+  }
+  async save() {
+    await mkdir(dirname(this.file), { recursive: true, mode: 448 });
+    const temp = `${this.file}.${randomBytes(4).toString("hex")}.tmp`;
+    await writeFile(temp, `${JSON.stringify(this.data, null, 2)}
+`, { mode: 384, flag: "wx" });
+    await rename(temp, this.file);
+  }
+};
+
+export {
+  USER_SCOPE,
+  TrustStore
+};
+//# sourceMappingURL=chunk-5DEWP3YX.js.map

package/dist/chunk-A2QAIRQL.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+// src/model/serverTools.ts
+function serverCallText(call) {
+  const input = call.input ?? {};
+  return typeof input.query === "string" ? input.query : JSON.stringify(call.input);
+}
+function serverResultSummary(result) {
+  if (result === void 0) return "runs with the next request";
+  if (result.error !== void 0) return `error ${result.error}`;
+  const n = result.results.length;
+  return n === 0 ? "no results" : `${n} result${n === 1 ? "" : "s"}`;
+}
+function serverPairText(call, result) {
+  const head = `[Earlier ${result.name}${call === void 0 ? "" : ` "${serverCallText(call)}"`}: ${serverResultSummary(result)}]`;
+  return [head, ...result.results.map((r, i) => `${i + 1}. ${r.title} \u2014 ${r.url}`)].join("\n");
+}
+function withoutServerBlocks(content) {
+  const calls = /* @__PURE__ */ new Map();
+  for (const block of content) if (block.type === "server_tool_use") calls.set(block.id, block);
+  const out = [];
+  for (const block of content) {
+    if (block.type === "server_tool_use") continue;
+    if (block.type === "server_tool_result") {
+      out.push({ type: "text", text: serverPairText(calls.get(block.toolUseId), block) });
+    } else if (block.type === "text" && block.citations !== void 0) {
+      out.push({ type: "text", text: block.text });
+    } else out.push(block);
+  }
+  return out;
+}
+function hasServerBlocks(content) {
+  return content.some(
+    (b) => b.type === "server_tool_use" || b.type === "server_tool_result" || b.type === "text" && b.citations !== void 0
+  );
+}
+
+export {
+  serverCallText,
+  serverResultSummary,
+  serverPairText,
+  withoutServerBlocks,
+  hasServerBlocks
+};
+//# sourceMappingURL=chunk-A2QAIRQL.js.map

package/dist/chunk-ATW7BNIG.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+
+// src/net/address.ts
+import ipaddr from "ipaddr.js";
+function checkAddress(address, allowLocalhost) {
+  let parsed;
+  try {
+    parsed = ipaddr.process(address);
+  } catch {
+    return { ok: false, range: "invalid" };
+  }
+  const range = parsed.range();
+  if (range === "unicast") return { ok: true };
+  if (range === "loopback" && allowLocalhost) return { ok: true };
+  return { ok: false, range };
+}
+function isIpLiteral(host) {
+  return ipaddr.isValid(host.replace(/^\[|\]$/g, ""));
+}
+function isLoopbackHost(host) {
+  const bare = host.replace(/^\[|\]$/g, "");
+  if (bare === "localhost") return true;
+  return ipaddr.isValid(bare) && ipaddr.process(bare).range() === "loopback";
+}
+
+export {
+  checkAddress,
+  isIpLiteral,
+  isLoopbackHost
+};
+//# sourceMappingURL=chunk-ATW7BNIG.js.map

package/dist/chunk-B25VL4RU.js

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+import {
+  isLoopbackHost
+} from "./chunk-ATW7BNIG.js";
+
+// src/web/search.ts
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { z } from "zod";
+var SEARCH_FILE = join(".garuda", "search.json");
+var SEARCH_TIMEOUT_MS = 2e4;
+var SEARCH_MAX_BYTES = 2 * 1024 * 1024;
+var DEFAULT_RESULTS = 5;
+var MAX_RESULTS = 10;
+var SEARCH_USES = ["claude", "provider", "off"];
+var DEFAULT_CLAUDE_MAX_USES = 5;
+var domains = z.array(
+  z.string().min(1).regex(/^[^\s:/][^\s:]*$/, "a bare domain, with an optional path (no scheme)")
+);
+var claudeSchema = z.strictObject({
+  /** Searches per model request, 1–20. Default 5. */
+  maxUses: z.number().int().min(1).max(20).optional(),
+  allowedDomains: domains.optional(),
+  blockedDomains: domains.optional()
+}).refine((c) => c.allowedDomains === void 0 || c.blockedDomains === void 0, {
+  message: "use allowedDomains or blockedDomains, not both"
+});
+var fileSchema = z.strictObject({
+  /** The user's choice (0.14); absent: the chat asks once and saves the answer. */
+  use: z.enum(SEARCH_USES).optional(),
+  provider: z.enum(["brave", "tavily", "searxng"]).optional(),
+  /** Claude's own web search (0.6). */
+  claude: claudeSchema.optional(),
+  /** SearXNG only: the server's base URL. */
+  url: z.string().optional(),
+  /** The environment variable with the key. Default: BRAVE_API_KEY or TAVILY_API_KEY. */
+  apiKeyEnv: z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional(),
+  /** Results per search, 1–10. Default 5. */
+  maxResults: z.number().int().min(1).max(MAX_RESULTS).optional()
+});
+var LABELS = {
+  brave: "Brave Search",
+  tavily: "Tavily",
+  searxng: "SearXNG"
+};
+function providerLabel(config) {
+  return `${LABELS[config.provider]} (${config.endpoint.host})`;
+}
+async function loadSearchConfig(home = homedir(), env = process.env) {
+  const file = join(home, SEARCH_FILE);
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      return { problem: `${file}: ${error.message}` };
+    }
+  }
+  if (text === void 0) return fromEnv(env, DEFAULT_RESULTS);
+  let parsed;
+  try {
+    const result = fileSchema.safeParse(JSON.parse(text));
+    if (!result.success) return { problem: `${file}: ${z.prettifyError(result.error)}` };
+    parsed = result.data;
+  } catch (error) {
+    return { problem: `${file}: invalid JSON: ${error.message}` };
+  }
+  const max = parsed.maxResults ?? DEFAULT_RESULTS;
+  const use = parsed.use === void 0 ? {} : { use: parsed.use };
+  const claude = parsed.claude === void 0 ? {} : {
+    claude: {
+      maxUses: parsed.claude.maxUses ?? DEFAULT_CLAUDE_MAX_USES,
+      ...parsed.claude.allowedDomains === void 0 ? {} : { allowedDomains: parsed.claude.allowedDomains },
+      ...parsed.claude.blockedDomains === void 0 ? {} : { blockedDomains: parsed.claude.blockedDomains }
+    }
+  };
+  if (parsed.provider === void 0) {
+    if (parsed.claude === void 0 && parsed.use === void 0) {
+      return { problem: `${file}: name a "provider", or add a "claude" section.` };
+    }
+    return { ...fromEnv(env, max), ...claude, ...use };
+  }
+  const client = clientConfig(file, { ...parsed, provider: parsed.provider }, env, max);
+  return "problem" in client ? { ...client, ...claude, ...use } : { config: client.config, ...claude, ...use };
+}
+async function saveSearchUse(home, use) {
+  const file = join(home, SEARCH_FILE);
+  let data = {};
+  try {
+    data = JSON.parse(await readFile(file, "utf8"));
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  await mkdir(dirname(file), { recursive: true });
+  await writeFile(file, `${JSON.stringify({ ...data, use }, null, 2)}
+`, { mode: 384 });
+  return file;
+}
+function fromEnv(env, max) {
+  if (env.BRAVE_API_KEY) return { config: brave(env.BRAVE_API_KEY, max) };
+  if (env.TAVILY_API_KEY) return { config: tavily(env.TAVILY_API_KEY, max) };
+  return {};
+}
+function clientConfig(file, parsed, env, max) {
+  if (parsed.provider === "searxng") {
+    if (parsed.url === void 0) return { problem: `${file}: "searxng" needs a "url".` };
+    const endpoint = searxngEndpoint(parsed.url);
+    if (typeof endpoint === "string") return { problem: `${file}: ${endpoint}` };
+    return { config: { provider: "searxng", endpoint, maxResults: max } };
+  }
+  const variable = parsed.apiKeyEnv ?? (parsed.provider === "brave" ? "BRAVE_API_KEY" : "TAVILY_API_KEY");
+  const key = env[variable];
+  if (!key) return { problem: `${file}: web search needs the key in ${variable}; it is not set.` };
+  return { config: parsed.provider === "brave" ? brave(key, max) : tavily(key, max) };
+}
+function brave(apiKey, maxResults) {
+  return {
+    provider: "brave",
+    endpoint: new URL("https://api.search.brave.com/res/v1/web/search"),
+    apiKey,
+    maxResults
+  };
+}
+function tavily(apiKey, maxResults) {
+  return {
+    provider: "tavily",
+    endpoint: new URL("https://api.tavily.com/search"),
+    apiKey,
+    maxResults
+  };
+}
+function searxngEndpoint(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return `"${raw}" is not a valid URL.`;
+  }
+  if (url.username !== "" || url.password !== "")
+    return "a URL with a user name or password is not allowed.";
+  const local = isLoopbackHost(url.hostname.replace(/^\[|\]$/g, ""));
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) {
+    return "use https (http only for localhost).";
+  }
+  return new URL(`${url.pathname.replace(/\/+$/, "")}/search`, url);
+}
+async function search(config, query, maxResults, signal, fetchFn = fetch) {
+  const count = Math.min(Math.max(1, maxResults), MAX_RESULTS);
+  const timeout = AbortSignal.any([signal, AbortSignal.timeout(SEARCH_TIMEOUT_MS)]);
+  let request;
+  if (config.provider === "brave") {
+    const url = new URL(config.endpoint);
+    url.searchParams.set("q", query);
+    url.searchParams.set("count", String(count));
+    request = new Request(url, {
+      headers: { accept: "application/json", "x-subscription-token": config.apiKey ?? "" }
+    });
+  } else if (config.provider === "tavily") {
+    request = new Request(config.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${config.apiKey ?? ""}`
+      },
+      body: JSON.stringify({ query, max_results: count, search_depth: "basic" })
+    });
+  } else {
+    const url = new URL(config.endpoint);
+    url.searchParams.set("q", query);
+    url.searchParams.set("format", "json");
+    request = new Request(url, { headers: { accept: "application/json" } });
+  }
+  let response;
+  try {
+    response = await fetchFn(request, { signal: timeout, redirect: "error" });
+  } catch (error) {
+    if (signal.aborted) throw error;
+    throw new Error(`${LABELS[config.provider]} did not answer: ${error.message}`);
+  }
+  if (!response.ok) {
+    const hint = response.status === 401 || response.status === 403 ? " Check the API key." : response.status === 429 ? " Too many searches; wait, or check your plan." : "";
+    throw new Error(`${LABELS[config.provider]} answered ${response.status}.${hint}`);
+  }
+  const text = await readCapped(response, SEARCH_MAX_BYTES);
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${LABELS[config.provider]} did not answer with JSON.${config.provider === "searxng" ? ' Turn on the "json" format in its settings.yml (search.formats).' : ""}`
+    );
+  }
+  return parseResults(config.provider, json).slice(0, count);
+}
+function parseResults(provider, json) {
+  const obj = (v) => v !== null && typeof v === "object" ? v : {};
+  const str = (v) => typeof v === "string" ? v : "";
+  const list = provider === "brave" ? obj(obj(json).web).results : obj(json).results;
+  if (!Array.isArray(list)) return [];
+  const out = [];
+  for (const item of list) {
+    const r = obj(item);
+    const url = str(r.url);
+    if (!/^https?:\/\//.test(url)) continue;
+    const snippet = provider === "brave" ? str(r.description) : str(r.content);
+    const age = provider === "brave" ? str(r.age) : str(r.publishedDate);
+    out.push({
+      title: str(r.title),
+      url,
+      snippet,
+      ...age === "" ? {} : { age }
+    });
+  }
+  return out;
+}
+async function readCapped(response, max) {
+  const reader = response.body?.getReader();
+  if (reader === void 0) return "";
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > max) {
+      await reader.cancel();
+      throw new Error(`The search answer is larger than ${max} bytes.`);
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+export {
+  MAX_RESULTS,
+  providerLabel,
+  loadSearchConfig,
+  saveSearchUse,
+  search
+};
+//# sourceMappingURL=chunk-B25VL4RU.js.map

package/dist/chunk-EPKWDCV4.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+
+// src/version.ts
+var VERSION = "0.15.0";
+
+export {
+  VERSION
+};
+//# sourceMappingURL=chunk-EPKWDCV4.js.map