@helloleo/plugins 0.1.3 → 0.1.4

package/dist/index.js

@@ -10,11 +10,7 @@ var __export = (target, all) => {
     });
 };
 
-// src/tools/remove.ts
-import { unlink } from "fs/promises";
-import path from "path";
-
-// node_modules/zod/v4/classic/external.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
   xid: () => xid2,
@@ -244,7 +240,7 @@ __export(exports_external, {
   $brand: () => $brand
 });
 
-// node_modules/zod/v4/core/index.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/index.js
 var exports_core2 = {};
 __export(exports_core2, {
   version: () => version,
@@ -508,7 +504,7 @@ __export(exports_core2, {
   $ZodAny: () => $ZodAny
 });
 
-// node_modules/zod/v4/core/core.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({
   status: "aborted"
 });
@@ -575,7 +571,7 @@ function config(newConfig) {
     Object.assign(globalConfig, newConfig);
   return globalConfig;
 }
-// node_modules/zod/v4/core/util.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/util.js
 var exports_util = {};
 __export(exports_util, {
   unwrapMessage: () => unwrapMessage,
@@ -1204,7 +1200,7 @@ class Class {
   constructor(..._args) {}
 }
 
-// node_modules/zod/v4/core/errors.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/errors.js
 var initializer = (inst, def) => {
   inst.name = "$ZodError";
   Object.defineProperty(inst, "_zod", {
@@ -1347,7 +1343,7 @@ function prettifyError(error) {
 `);
 }
 
-// node_modules/zod/v4/core/parse.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/parse.js
 var _parse = (_Err) => (schema, value, _ctx, _params) => {
   const ctx = _ctx ? Object.assign(_ctx, { async: false }) : { async: false };
   const result = schema._zod.run({ value, issues: [] }, ctx);
@@ -1434,7 +1430,7 @@ var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
   return _safeParseAsync(_Err)(schema, value, _ctx);
 };
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync($ZodRealError);
-// node_modules/zod/v4/core/regexes.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/regexes.js
 var exports_regexes = {};
 __export(exports_regexes, {
   xid: () => xid,
@@ -1586,7 +1582,7 @@ var sha512_hex = /^[0-9a-fA-F]{128}$/;
 var sha512_base64 = /* @__PURE__ */ fixedBase64(86, "==");
 var sha512_base64url = /* @__PURE__ */ fixedBase64url(86);
 
-// node_modules/zod/v4/core/checks.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a;
   inst._zod ?? (inst._zod = {});
@@ -2127,7 +2123,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// node_modules/zod/v4/core/doc.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/doc.js
 class Doc {
   constructor(args = []) {
     this.content = [];
@@ -2165,14 +2161,14 @@ class Doc {
   }
 }
 
-// node_modules/zod/v4/core/versions.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 1,
   patch: 8
 };
 
-// node_modules/zod/v4/core/schemas.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a;
   inst ?? (inst = {});
@@ -3995,7 +3991,7 @@ function handleRefineResult(result, payload, input, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-// node_modules/zod/v4/locales/index.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/index.js
 var exports_locales = {};
 __export(exports_locales, {
   zhTW: () => zh_TW_default,
@@ -4046,7 +4042,7 @@ __export(exports_locales, {
   ar: () => ar_default
 });
 
-// node_modules/zod/v4/locales/ar.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ar.js
 var error = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0641", verb: "\u0623\u0646 \u064A\u062D\u0648\u064A" },
@@ -4162,7 +4158,7 @@ function ar_default() {
     localeError: error()
   };
 }
-// node_modules/zod/v4/locales/az.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/az.js
 var error2 = () => {
   const Sizable = {
     string: { unit: "simvol", verb: "olmal\u0131d\u0131r" },
@@ -4277,7 +4273,7 @@ function az_default() {
     localeError: error2()
   };
 }
-// node_modules/zod/v4/locales/be.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/be.js
 function getBelarusianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -4441,7 +4437,7 @@ function be_default() {
     localeError: error3()
   };
 }
-// node_modules/zod/v4/locales/ca.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ca.js
 var error4 = () => {
   const Sizable = {
     string: { unit: "car\xE0cters", verb: "contenir" },
@@ -4558,7 +4554,7 @@ function ca_default() {
     localeError: error4()
   };
 }
-// node_modules/zod/v4/locales/cs.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/cs.js
 var error5 = () => {
   const Sizable = {
     string: { unit: "znak\u016F", verb: "m\xEDt" },
@@ -4693,7 +4689,7 @@ function cs_default() {
     localeError: error5()
   };
 }
-// node_modules/zod/v4/locales/da.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/da.js
 var error6 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "havde" },
@@ -4824,7 +4820,7 @@ function da_default() {
     localeError: error6()
   };
 }
-// node_modules/zod/v4/locales/de.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/de.js
 var error7 = () => {
   const Sizable = {
     string: { unit: "Zeichen", verb: "zu haben" },
@@ -4940,7 +4936,7 @@ function de_default() {
     localeError: error7()
   };
 }
-// node_modules/zod/v4/locales/en.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/en.js
 var parsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -5057,7 +5053,7 @@ function en_default() {
     localeError: error8()
   };
 }
-// node_modules/zod/v4/locales/eo.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/eo.js
 var parsedType2 = (data) => {
   const t = typeof data;
   switch (t) {
@@ -5173,7 +5169,7 @@ function eo_default() {
     localeError: error9()
   };
 }
-// node_modules/zod/v4/locales/es.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/es.js
 var error10 = () => {
   const Sizable = {
     string: { unit: "caracteres", verb: "tener" },
@@ -5321,7 +5317,7 @@ function es_default() {
     localeError: error10()
   };
 }
-// node_modules/zod/v4/locales/fa.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/fa.js
 var error11 = () => {
   const Sizable = {
     string: { unit: "\u06A9\u0627\u0631\u0627\u06A9\u062A\u0631", verb: "\u062F\u0627\u0634\u062A\u0647 \u0628\u0627\u0634\u062F" },
@@ -5443,7 +5439,7 @@ function fa_default() {
     localeError: error11()
   };
 }
-// node_modules/zod/v4/locales/fi.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/fi.js
 var error12 = () => {
   const Sizable = {
     string: { unit: "merkki\xE4", subject: "merkkijonon" },
@@ -5565,7 +5561,7 @@ function fi_default() {
     localeError: error12()
   };
 }
-// node_modules/zod/v4/locales/fr.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/fr.js
 var error13 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -5681,7 +5677,7 @@ function fr_default() {
     localeError: error13()
   };
 }
-// node_modules/zod/v4/locales/fr-CA.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/fr-CA.js
 var error14 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -5798,7 +5794,7 @@ function fr_CA_default() {
     localeError: error14()
   };
 }
-// node_modules/zod/v4/locales/he.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/he.js
 var error15 = () => {
   const Sizable = {
     string: { unit: "\u05D0\u05D5\u05EA\u05D9\u05D5\u05EA", verb: "\u05DC\u05DB\u05DC\u05D5\u05DC" },
@@ -5914,7 +5910,7 @@ function he_default() {
     localeError: error15()
   };
 }
-// node_modules/zod/v4/locales/hu.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/hu.js
 var error16 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "legyen" },
@@ -6030,7 +6026,7 @@ function hu_default() {
     localeError: error16()
   };
 }
-// node_modules/zod/v4/locales/id.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/id.js
 var error17 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "memiliki" },
@@ -6146,7 +6142,7 @@ function id_default() {
     localeError: error17()
   };
 }
-// node_modules/zod/v4/locales/is.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/is.js
 var parsedType3 = (data) => {
   const t = typeof data;
   switch (t) {
@@ -6263,7 +6259,7 @@ function is_default() {
     localeError: error18()
   };
 }
-// node_modules/zod/v4/locales/it.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/it.js
 var error19 = () => {
   const Sizable = {
     string: { unit: "caratteri", verb: "avere" },
@@ -6379,7 +6375,7 @@ function it_default() {
     localeError: error19()
   };
 }
-// node_modules/zod/v4/locales/ja.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ja.js
 var error20 = () => {
   const Sizable = {
     string: { unit: "\u6587\u5B57", verb: "\u3067\u3042\u308B" },
@@ -6494,7 +6490,7 @@ function ja_default() {
     localeError: error20()
   };
 }
-// node_modules/zod/v4/locales/ka.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ka.js
 var parsedType4 = (data) => {
   const t = typeof data;
   switch (t) {
@@ -6619,7 +6615,7 @@ function ka_default() {
     localeError: error21()
   };
 }
-// node_modules/zod/v4/locales/km.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/km.js
 var error22 = () => {
   const Sizable = {
     string: { unit: "\u178F\u17BD\u17A2\u1780\u17D2\u179F\u179A", verb: "\u1782\u17BD\u179A\u1798\u17B6\u1793" },
@@ -6737,11 +6733,11 @@ function km_default() {
   };
 }
 
-// node_modules/zod/v4/locales/kh.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/kh.js
 function kh_default() {
   return km_default();
 }
-// node_modules/zod/v4/locales/ko.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ko.js
 var error23 = () => {
   const Sizable = {
     string: { unit: "\uBB38\uC790", verb: "to have" },
@@ -6862,7 +6858,7 @@ function ko_default() {
     localeError: error23()
   };
 }
-// node_modules/zod/v4/locales/lt.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/lt.js
 var parsedType5 = (data) => {
   const t = typeof data;
   return parsedTypeFromType(t, data);
@@ -7091,7 +7087,7 @@ function lt_default() {
     localeError: error24()
   };
 }
-// node_modules/zod/v4/locales/mk.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/mk.js
 var error25 = () => {
   const Sizable = {
     string: { unit: "\u0437\u043D\u0430\u0446\u0438", verb: "\u0434\u0430 \u0438\u043C\u0430\u0430\u0442" },
@@ -7208,7 +7204,7 @@ function mk_default() {
     localeError: error25()
   };
 }
-// node_modules/zod/v4/locales/ms.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ms.js
 var error26 = () => {
   const Sizable = {
     string: { unit: "aksara", verb: "mempunyai" },
@@ -7324,7 +7320,7 @@ function ms_default() {
     localeError: error26()
   };
 }
-// node_modules/zod/v4/locales/nl.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/nl.js
 var error27 = () => {
   const Sizable = {
     string: { unit: "tekens" },
@@ -7441,7 +7437,7 @@ function nl_default() {
     localeError: error27()
   };
 }
-// node_modules/zod/v4/locales/no.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/no.js
 var error28 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "\xE5 ha" },
@@ -7557,7 +7553,7 @@ function no_default() {
     localeError: error28()
   };
 }
-// node_modules/zod/v4/locales/ota.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ota.js
 var error29 = () => {
   const Sizable = {
     string: { unit: "harf", verb: "olmal\u0131d\u0131r" },
@@ -7673,7 +7669,7 @@ function ota_default() {
     localeError: error29()
   };
 }
-// node_modules/zod/v4/locales/ps.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ps.js
 var error30 = () => {
   const Sizable = {
     string: { unit: "\u062A\u0648\u06A9\u064A", verb: "\u0648\u0644\u0631\u064A" },
@@ -7795,7 +7791,7 @@ function ps_default() {
     localeError: error30()
   };
 }
-// node_modules/zod/v4/locales/pl.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/pl.js
 var error31 = () => {
   const Sizable = {
     string: { unit: "znak\xF3w", verb: "mie\u0107" },
@@ -7912,7 +7908,7 @@ function pl_default() {
     localeError: error31()
   };
 }
-// node_modules/zod/v4/locales/pt.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/pt.js
 var error32 = () => {
   const Sizable = {
     string: { unit: "caracteres", verb: "ter" },
@@ -8028,7 +8024,7 @@ function pt_default() {
     localeError: error32()
   };
 }
-// node_modules/zod/v4/locales/ru.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ru.js
 function getRussianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -8192,7 +8188,7 @@ function ru_default() {
     localeError: error33()
   };
 }
-// node_modules/zod/v4/locales/sl.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/sl.js
 var error34 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "imeti" },
@@ -8309,7 +8305,7 @@ function sl_default() {
     localeError: error34()
   };
 }
-// node_modules/zod/v4/locales/sv.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/sv.js
 var error35 = () => {
   const Sizable = {
     string: { unit: "tecken", verb: "att ha" },
@@ -8427,7 +8423,7 @@ function sv_default() {
     localeError: error35()
   };
 }
-// node_modules/zod/v4/locales/ta.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ta.js
 var error36 = () => {
   const Sizable = {
     string: { unit: "\u0B8E\u0BB4\u0BC1\u0BA4\u0BCD\u0BA4\u0BC1\u0B95\u0BCD\u0B95\u0BB3\u0BCD", verb: "\u0B95\u0BCA\u0BA3\u0BCD\u0B9F\u0BBF\u0BB0\u0BC1\u0B95\u0BCD\u0B95 \u0BB5\u0BC7\u0BA3\u0BCD\u0B9F\u0BC1\u0BAE\u0BCD" },
@@ -8544,7 +8540,7 @@ function ta_default() {
     localeError: error36()
   };
 }
-// node_modules/zod/v4/locales/th.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/th.js
 var error37 = () => {
   const Sizable = {
     string: { unit: "\u0E15\u0E31\u0E27\u0E2D\u0E31\u0E01\u0E29\u0E23", verb: "\u0E04\u0E27\u0E23\u0E21\u0E35" },
@@ -8661,7 +8657,7 @@ function th_default() {
     localeError: error37()
   };
 }
-// node_modules/zod/v4/locales/tr.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/tr.js
 var parsedType6 = (data) => {
   const t = typeof data;
   switch (t) {
@@ -8776,7 +8772,7 @@ function tr_default() {
     localeError: error38()
   };
 }
-// node_modules/zod/v4/locales/uk.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/uk.js
 var error39 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0456\u0432", verb: "\u043C\u0430\u0442\u0438\u043C\u0435" },
@@ -8893,11 +8889,11 @@ function uk_default() {
   };
 }
 
-// node_modules/zod/v4/locales/ua.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ua.js
 function ua_default() {
   return uk_default();
 }
-// node_modules/zod/v4/locales/ur.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/ur.js
 var error40 = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0648\u0641", verb: "\u06C1\u0648\u0646\u0627" },
@@ -9014,7 +9010,7 @@ function ur_default() {
     localeError: error40()
   };
 }
-// node_modules/zod/v4/locales/vi.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/vi.js
 var error41 = () => {
   const Sizable = {
     string: { unit: "k\xFD t\u1EF1", verb: "c\xF3" },
@@ -9130,7 +9126,7 @@ function vi_default() {
     localeError: error41()
   };
 }
-// node_modules/zod/v4/locales/zh-CN.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/zh-CN.js
 var error42 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u7B26", verb: "\u5305\u542B" },
@@ -9246,7 +9242,7 @@ function zh_CN_default() {
     localeError: error42()
   };
 }
-// node_modules/zod/v4/locales/zh-TW.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/zh-TW.js
 var error43 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u5143", verb: "\u64C1\u6709" },
@@ -9363,7 +9359,7 @@ function zh_TW_default() {
     localeError: error43()
   };
 }
-// node_modules/zod/v4/locales/yo.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/locales/yo.js
 var error44 = () => {
   const Sizable = {
     string: { unit: "\xE0mi", verb: "n\xED" },
@@ -9478,7 +9474,7 @@ function yo_default() {
     localeError: error44()
   };
 }
-// node_modules/zod/v4/core/registries.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/registries.js
 var $output = Symbol("ZodOutput");
 var $input = Symbol("ZodInput");
 
@@ -9529,7 +9525,7 @@ function registry() {
   return new $ZodRegistry;
 }
 var globalRegistry = /* @__PURE__ */ registry();
-// node_modules/zod/v4/core/api.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/api.js
 function _string(Class2, params) {
   return new Class2({
     type: "string",
@@ -10407,7 +10403,7 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
   const inst = new Class2(def);
   return inst;
 }
-// node_modules/zod/v4/core/to-json-schema.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/to-json-schema.js
 class JSONSchemaGenerator {
   constructor(params) {
     this.counter = 0;
@@ -11211,9 +11207,9 @@ function isTransforming(_schema, _ctx) {
   }
   throw new Error(`Unknown schema type: ${def.type}`);
 }
-// node_modules/zod/v4/core/json-schema.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/core/json-schema.js
 var exports_json_schema = {};
-// node_modules/zod/v4/classic/iso.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/iso.js
 var exports_iso = {};
 __export(exports_iso, {
   time: () => time2,
@@ -11254,7 +11250,7 @@ function duration2(params) {
   return _isoDuration(ZodISODuration, params);
 }
 
-// node_modules/zod/v4/classic/errors.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/errors.js
 var initializer2 = (inst, issues) => {
   $ZodError.init(inst, issues);
   inst.name = "ZodError";
@@ -11289,7 +11285,7 @@ var ZodRealError = $constructor("ZodError", initializer2, {
   Parent: Error
 });
 
-// node_modules/zod/v4/classic/parse.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/parse.js
 var parse3 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -11303,7 +11299,7 @@ var safeDecode2 = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync2 = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync2 = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// node_modules/zod/v4/classic/schemas.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/schemas.js
 var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
   $ZodType.init(inst, def);
   inst.def = def;
@@ -12278,7 +12274,7 @@ function json(params) {
 function preprocess(fn, schema) {
   return pipe(transform(fn), schema);
 }
-// node_modules/zod/v4/classic/compat.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/compat.js
 var ZodIssueCode = {
   invalid_type: "invalid_type",
   too_big: "too_big",
@@ -12302,7 +12298,7 @@ function getErrorMap() {
 }
 var ZodFirstPartyTypeKind;
 (function(ZodFirstPartyTypeKind2) {})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
-// node_modules/zod/v4/classic/coerce.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/coerce.js
 var exports_coerce = {};
 __export(exports_coerce, {
   string: () => string3,
@@ -12327,14 +12323,193 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/zod/v4/classic/external.js
+// node_modules/@opencode-ai/plugin/node_modules/zod/v4/classic/external.js
 config(en_default());
 // node_modules/@opencode-ai/plugin/dist/tool.js
 function tool(input) {
   return input;
 }
 tool.schema = exports_external;
+// src/tools/inspect-http.ts
+var z = tool.schema;
+var ALLOWED_EXACT_HOSTS = new Set(["api.app.helloleo.dev"]);
+var ALLOWED_HOST_SUFFIXES = [
+  ".augustin-d60.workers.dev",
+  ".live.helloleo.dev"
+];
+var DEFAULT_TIMEOUT_MS = 15000;
+var MAX_TIMEOUT_MS = 30000;
+var MAX_RESPONSE_BYTES = 1e6;
+var METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var METHODS_AUTO_JSON = new Set(["POST", "PUT", "PATCH"]);
+var argsShape = {
+  url: z.string().describe("Fully-qualified URL to request. Must be on the HelloLeo whitelist " + "(api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev)."),
+  method: z.enum(METHODS).default("GET").describe(`HTTP method (${METHODS.join(", ")}). Defaults to GET.`),
+  body: z.string().optional().describe("Request body as a string. Not valid for GET. Sent with " + "Content-Type: application/json on POST/PUT/PATCH unless a " + "different Content-Type is supplied via headers."),
+  headers: z.record(z.string(), z.string()).default({}).describe("Optional additional request headers as key/value pairs (e.g. Authorization)."),
+  timeout: z.number().max(MAX_TIMEOUT_MS).default(DEFAULT_TIMEOUT_MS).describe(`Optional timeout in milliseconds (max ${MAX_TIMEOUT_MS}, default ${DEFAULT_TIMEOUT_MS}).`)
+};
+var argsSchema = z.object(argsShape);
+var inspectHttp = tool({
+  description: "Send an HTTP request to a HelloLeo endpoint and return the status code, " + "response headers, and response body. Use this to inspect the live behaviour " + "of HelloLeo workers, the production API, or preview deployments so you can " + "self-debug instead of operating blind. " + "Only URLs on the HelloLeo whitelist are allowed: " + "api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev. " + "Supports GET, POST, PUT, PATCH and DELETE (with an optional JSON body).",
+  args: argsShape,
+  async execute(rawArgs, context) {
+    const args = argsSchema.parse(rawArgs);
+    const url2 = parseTargetUrl(args.url);
+    if (args.method === "GET" && args.body !== undefined) {
+      throw new Error("GET requests cannot have a body");
+    }
+    await context.ask({
+      permission: "inspect_http",
+      patterns: [url2.toString()],
+      always: [`${url2.protocol}//${url2.hostname}/*`],
+      metadata: {
+        url: url2.toString(),
+        method: args.method,
+        hasBody: args.body !== undefined
+      }
+    });
+    const timeoutMs = Math.max(1, Math.min(args.timeout, MAX_TIMEOUT_MS));
+    const requestHeaders = {
+      Accept: "application/json, text/plain, */*",
+      "User-Agent": "helloleo-plugins-inspect-http/0.1",
+      Origin: "https://app.helloleo.dev",
+      ...args.headers
+    };
+    if (METHODS_AUTO_JSON.has(args.method) && args.body !== undefined && !hasHeader(requestHeaders, "content-type")) {
+      requestHeaders["Content-Type"] = "application/json";
+    }
+    const signal = AbortSignal.any([
+      context.abort,
+      AbortSignal.timeout(timeoutMs)
+    ]);
+    let response;
+    try {
+      response = await fetch(url2, {
+        method: args.method,
+        headers: requestHeaders,
+        body: args.method === "GET" ? undefined : args.body,
+        signal,
+        redirect: "follow"
+      });
+    } catch (err) {
+      if (err instanceof DOMException && err.name === "TimeoutError") {
+        throw new Error(`Request timed out after ${timeoutMs}ms`);
+      }
+      if (err instanceof DOMException && err.name === "AbortError") {
+        throw new Error("Request aborted");
+      }
+      const message = err instanceof Error ? err.message : String(err);
+      throw new Error(`Request failed: ${message}`);
+    }
+    const { text, truncated } = await readBody(response);
+    const contentType = response.headers.get("content-type");
+    const formattedBody = formatBody(text, contentType);
+    const redirected = response.url && response.url !== url2.toString();
+    const lines = [`${args.method} ${url2.toString()}`];
+    if (redirected) {
+      lines.push(`Final URL: ${response.url}`);
+    }
+    lines.push(`Status: ${response.status}${response.statusText ? ` ${response.statusText}` : ""}`, "", "Response headers:", formatHeaders(response.headers) || "(none)", "", "Response body:", formattedBody.length > 0 ? formattedBody : "(empty)");
+    if (truncated) {
+      lines.push("", `(body truncated at ${MAX_RESPONSE_BYTES} bytes)`);
+    }
+    return lines.join(`
+`);
+  }
+});
+function parseTargetUrl(raw) {
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    throw new Error(`Invalid URL: ${raw}`);
+  }
+  if (url2.protocol !== "https:" && url2.protocol !== "http:") {
+    throw new Error(`URL must use http or https scheme (got "${url2.protocol}")`);
+  }
+  if (url2.username || url2.password) {
+    throw new Error("URL must not contain embedded credentials");
+  }
+  if (!isAllowedHost(url2.hostname)) {
+    throw new Error(`Host "${url2.hostname}" is not on the HelloLeo whitelist. Allowed: ${allowedHostsHuman()}`);
+  }
+  return url2;
+}
+function allowedHostsHuman() {
+  return [
+    ...ALLOWED_EXACT_HOSTS,
+    ...ALLOWED_HOST_SUFFIXES.map((s) => `*${s}`)
+  ].join(", ");
+}
+function isAllowedHost(hostname3) {
+  const host = hostname3.toLowerCase().replace(/\.$/, "");
+  if (ALLOWED_EXACT_HOSTS.has(host))
+    return true;
+  for (const suffix of ALLOWED_HOST_SUFFIXES) {
+    if (host.endsWith(suffix) && host.length > suffix.length)
+      return true;
+  }
+  return false;
+}
+function hasHeader(headers, name) {
+  const target = name.toLowerCase();
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === target)
+      return true;
+  }
+  return false;
+}
+function formatHeaders(headers) {
+  const entries = [];
+  headers.forEach((value, key) => {
+    entries.push(`${key}: ${value}`);
+  });
+  return entries.sort().join(`
+`);
+}
+function formatBody(raw, contentType) {
+  const mime = contentType?.split(";")[0]?.trim().toLowerCase() ?? "";
+  if (mime.includes("application/json") || mime.endsWith("+json")) {
+    try {
+      return JSON.stringify(JSON.parse(raw), null, 2);
+    } catch {}
+  }
+  return raw;
+}
+async function readBody(response) {
+  if (!response.body)
+    return { text: "", truncated: false };
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  let text = "";
+  let total = 0;
+  let truncated = false;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done)
+      break;
+    if (!value)
+      continue;
+    total += value.byteLength;
+    if (total > MAX_RESPONSE_BYTES) {
+      truncated = true;
+      await reader.cancel();
+      break;
+    }
+    text += decoder.decode(value, { stream: true });
+  }
+  text += decoder.decode();
+  return { text, truncated };
+}
+var InspectHttpPlugin = async () => {
+  return {
+    tool: { inspect_http: inspectHttp }
+  };
+};
 // src/tools/remove.ts
+import { unlink } from "fs/promises";
+import path from "path";
 var remove = tool({
   description: "Remove a file from the project. The file path must be relative to the project root. " + "This tool will ask for permission before deleting. " + "Cannot delete files outside the project boundary.",
   args: {
@@ -12366,262 +12541,7 @@ var RemovePlugin = async () => {
     tool: { remove }
   };
 };
-// src/tools/scaffold.ts
-import { mkdir } from "fs/promises";
-import path2 from "path";
-function packageJson(name) {
-  return JSON.stringify({
-    name,
-    private: true,
-    version: "0.0.0",
-    type: "module",
-    scripts: {
-      dev: "vite",
-      start: "vite",
-      build: "vite build",
-      preview: "vite preview"
-    },
-    dependencies: {
-      react: "^18.3.1",
-      "react-dom": "^18.3.1",
-      clsx: "^2.1.1",
-      "tailwind-merge": "^2.6.0"
-    },
-    devDependencies: {
-      "@types/react": "^18.3.12",
-      "@types/react-dom": "^18.3.1",
-      "@vitejs/plugin-react": "^4.3.4",
-      autoprefixer: "^10.4.20",
-      postcss: "^8.4.49",
-      tailwindcss: "^3.4.17",
-      typescript: "^5.6.3",
-      vite: "^6.0.5"
-    }
-  }, null, 2);
-}
-function indexHtml(fontFamily) {
-  const fontParam = fontFamily.replace(/\s+/g, "+");
-  return `<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=${fontParam}:wght@400;500;600;700&display=swap" rel="stylesheet">
-    <title>App</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/src/main.tsx"></script>
-  </body>
-</html>`;
-}
-function viteConfig() {
-  return `import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
-import path from 'path'
-
-export default defineConfig({
-  plugins: [react()],
-  server: {
-    allowedHosts: true,
-  },
-  resolve: {
-    alias: {
-      '@': path.resolve(__dirname, './src'),
-    },
-  },
-})`;
-}
-function tailwindConfig() {
-  return `export default {
-  darkMode: ["class"],
-  content: ["./index.html", "./src/**/*.{js,ts,jsx,tsx}"],
-  theme: {
-    extend: {
-      colors: {
-        background: "hsl(var(--background))",
-        foreground: "hsl(var(--foreground))",
-        card: { DEFAULT: "hsl(var(--card))", foreground: "hsl(var(--card-foreground))" },
-        primary: { DEFAULT: "hsl(var(--primary))", foreground: "hsl(var(--primary-foreground))" },
-        secondary: { DEFAULT: "hsl(var(--secondary))", foreground: "hsl(var(--secondary-foreground))" },
-        muted: { DEFAULT: "hsl(var(--muted))", foreground: "hsl(var(--muted-foreground))" },
-        accent: { DEFAULT: "hsl(var(--accent))", foreground: "hsl(var(--accent-foreground))" },
-        destructive: { DEFAULT: "hsl(var(--destructive))", foreground: "hsl(var(--destructive-foreground))" },
-        success: { DEFAULT: "hsl(var(--success))", foreground: "hsl(var(--success-foreground))" },
-        warning: { DEFAULT: "hsl(var(--warning))", foreground: "hsl(var(--warning-foreground))" },
-        border: "hsl(var(--border))",
-        input: "hsl(var(--input))",
-        ring: "hsl(var(--ring))",
-      },
-      fontFamily: {
-        sans: "var(--font-sans)",
-        heading: "var(--font-heading)",
-      },
-      borderRadius: {
-        lg: "var(--radius)",
-        md: "calc(var(--radius) - 2px)",
-        sm: "calc(var(--radius) - 4px)",
-      },
-      borderWidth: {
-        DEFAULT: "var(--border-width)",
-      },
-      boxShadow: {
-        DEFAULT: "var(--shadow)",
-        lg: "var(--shadow-lg)",
-      },
-    },
-  },
-  plugins: [],
-}`;
-}
-function postcssConfig() {
-  return `export default {
-  plugins: {
-    tailwindcss: {},
-    autoprefixer: {},
-  },
-}`;
-}
-function indexCss(primaryColor, fontFamily, borderRadius) {
-  const fontValue = `'${fontFamily}', ui-sans-serif, system-ui, sans-serif`;
-  return `@tailwind base;
-@tailwind components;
-@tailwind utilities;
-
-@layer base {
-  :root {
-    --background: 0 0% 100%;
-    --foreground: 222.2 84% 4.9%;
-    --card: 0 0% 100%;
-    --card-foreground: 222.2 84% 4.9%;
-    --primary: ${primaryColor};
-    --primary-foreground: 210 40% 98%;
-    --secondary: 210 40% 96.1%;
-    --secondary-foreground: 222.2 47.4% 11.2%;
-    --muted: 210 40% 96.1%;
-    --muted-foreground: 215.4 16.3% 46.9%;
-    --accent: 210 40% 96.1%;
-    --accent-foreground: 222.2 47.4% 11.2%;
-    --destructive: 0 84.2% 60.2%;
-    --destructive-foreground: 210 40% 98%;
-    --success: 142 76% 36%;
-    --success-foreground: 210 40% 98%;
-    --warning: 38 92% 50%;
-    --warning-foreground: 222.2 47.4% 11.2%;
-    --border: 214.3 31.8% 91.4%;
-    --input: 214.3 31.8% 91.4%;
-    --ring: 221.2 83.2% 53.3%;
-    --radius: ${borderRadius};
-    --border-width: 1px;
-    --shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
-    --shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1);
-    --font-sans: ${fontValue};
-    --font-heading: ${fontValue};
-  }
-
-  .dark {
-    --background: 222.2 84% 4.9%;
-    --foreground: 210 40% 98%;
-    --card: 222.2 84% 4.9%;
-    --card-foreground: 210 40% 98%;
-    --primary: 217.2 91.2% 59.8%;
-    --primary-foreground: 222.2 47.4% 11.2%;
-    --secondary: 217.2 32.6% 17.5%;
-    --secondary-foreground: 210 40% 98%;
-    --muted: 217.2 32.6% 17.5%;
-    --muted-foreground: 215 20.2% 65.1%;
-    --accent: 217.2 32.6% 17.5%;
-    --accent-foreground: 210 40% 98%;
-    --destructive: 0 62.8% 30.6%;
-    --destructive-foreground: 210 40% 98%;
-    --success: 142 76% 36%;
-    --success-foreground: 210 40% 98%;
-    --warning: 38 92% 50%;
-    --warning-foreground: 222.2 47.4% 11.2%;
-    --border: 217.2 32.6% 17.5%;
-    --input: 217.2 32.6% 17.5%;
-    --ring: 224.3 76.3% 48%;
-    --border-width: 1px;
-    --shadow: 0 1px 3px 0 rgb(0 0 0 / 0.3), 0 1px 2px -1px rgb(0 0 0 / 0.3);
-    --shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.3), 0 4px 6px -4px rgb(0 0 0 / 0.3);
-    --font-sans: ${fontValue};
-    --font-heading: ${fontValue};
-  }
-}
-
-body {
-  @apply bg-background text-foreground font-sans;
-}`;
-}
-function utilsTs() {
-  return `import { clsx, type ClassValue } from 'clsx'
-import { twMerge } from 'tailwind-merge'
-
-export function cn(...inputs: ClassValue[]) {
-  return twMerge(clsx(inputs))
-}`;
-}
-function mainTsx() {
-  return `import React from 'react'
-import ReactDOM from 'react-dom/client'
-import App from './App'
-import './index.css'
-
-ReactDOM.createRoot(document.getElementById('root')!).render(
-  <React.StrictMode>
-    <App />
-  </React.StrictMode>,
-)`;
-}
-var scaffold = tool({
-  description: "Scaffold a new React + Vite + Tailwind CSS project with the HelloLeo design system. " + "Creates all mandatory boilerplate: package.json, index.html (with Google Fonts), " + "vite.config.js, tailwind.config.js, postcss.config.js, src/index.css (CSS variables " + "light+dark), src/lib/utils.ts (cn helper), and src/main.tsx. " + "Call this FIRST for any new project before writing App.tsx and components.",
-  args: {
-    name: tool.schema.string().optional().describe("Project name for package.json (default: leo-project)"),
-    primaryColor: tool.schema.string().optional().describe('HSL values for primary color, e.g. "221.2 83.2% 53.3%" (default: blue)'),
-    fontFamily: tool.schema.string().optional().describe('Google Font family name, e.g. "Inter", "Poppins" (default: Inter)'),
-    borderRadius: tool.schema.string().optional().describe('Base border radius, e.g. "0.5rem", "0.75rem" (default: 0.5rem)')
-  },
-  async execute(args, context) {
-    const dir = context.directory;
-    const name = args.name ?? "leo-project";
-    const primary = args.primaryColor ?? "221.2 83.2% 53.3%";
-    const font = args.fontFamily ?? "Inter";
-    const radius = args.borderRadius ?? "0.5rem";
-    await mkdir(path2.join(dir, "src", "lib"), { recursive: true });
-    const files = [
-      ["package.json", packageJson(name)],
-      ["index.html", indexHtml(font)],
-      ["vite.config.js", viteConfig()],
-      ["tailwind.config.js", tailwindConfig()],
-      ["postcss.config.js", postcssConfig()],
-      [path2.join("src", "index.css"), indexCss(primary, font, radius)],
-      [path2.join("src", "lib", "utils.ts"), utilsTs()],
-      [path2.join("src", "main.tsx"), mainTsx()]
-    ];
-    const created = [];
-    for (const [filePath, content] of files) {
-      await Bun.write(path2.join(dir, filePath), content);
-      created.push(filePath);
-    }
-    return [
-      `Scaffolded ${created.length} files:`,
-      ...created.map((f) => `  - ${f}`),
-      "",
-      "Next: create src/App.tsx with your application code.",
-      "The design system is ready -- use design tokens (bg-primary, text-foreground, etc.)",
-      "and create UI components in src/components/ui/."
-    ].join(`
-`);
-  }
-});
-var ScaffoldPlugin = async () => {
-  return {
-    tool: { scaffold }
-  };
-};
 export {
-  ScaffoldPlugin,
-  RemovePlugin
+  RemovePlugin,
+  InspectHttpPlugin
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/index.ts

@@ -1,5 +1,6 @@
+export { InspectHttpPlugin } from "./tools/inspect-http.ts";
 export { RemovePlugin } from "./tools/remove.ts";
-export { ScaffoldPlugin } from "./tools/scaffold.ts";
+// export { ScaffoldPlugin } from "./tools/scaffold.ts";
 // export { CreatePlanPlugin } from "./tools/create-plan.ts";
 // export { ListPlansPlugin } from "./tools/list-plans.ts";
 // export { ModifyPlanPlugin } from "./tools/modify-plan.ts";

package/src/tools/inspect-http.ts

@@ -0,0 +1,258 @@
+import type { Plugin } from "@opencode-ai/plugin";
+import { tool } from "@opencode-ai/plugin";
+
+const z = tool.schema;
+
+const ALLOWED_EXACT_HOSTS = new Set(["api.app.helloleo.dev"]);
+const ALLOWED_HOST_SUFFIXES = [
+	".augustin-d60.workers.dev",
+	".live.helloleo.dev",
+] as const;
+
+const DEFAULT_TIMEOUT_MS = 15_000;
+const MAX_TIMEOUT_MS = 30_000;
+const MAX_RESPONSE_BYTES = 1_000_000;
+
+const METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"] as const;
+const METHODS_AUTO_JSON = new Set(["POST", "PUT", "PATCH"]);
+
+// tool() is an identity function; parse args explicitly so .default() applies.
+const argsShape = {
+	url: z
+		.string()
+		.describe(
+			"Fully-qualified URL to request. Must be on the HelloLeo whitelist " +
+				"(api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev).",
+		),
+	method: z
+		.enum(METHODS)
+		.default("GET")
+		.describe(`HTTP method (${METHODS.join(", ")}). Defaults to GET.`),
+	body: z
+		.string()
+		.optional()
+		.describe(
+			"Request body as a string. Not valid for GET. Sent with " +
+				"Content-Type: application/json on POST/PUT/PATCH unless a " +
+				"different Content-Type is supplied via headers.",
+		),
+	headers: z
+		.record(z.string(), z.string())
+		.default({})
+		.describe(
+			"Optional additional request headers as key/value pairs (e.g. Authorization).",
+		),
+	timeout: z
+		.number()
+		.max(MAX_TIMEOUT_MS)
+		.default(DEFAULT_TIMEOUT_MS)
+		.describe(
+			`Optional timeout in milliseconds (max ${MAX_TIMEOUT_MS}, default ${DEFAULT_TIMEOUT_MS}).`,
+		),
+};
+
+const argsSchema = z.object(argsShape);
+
+export const inspectHttp = tool({
+	description:
+		"Send an HTTP request to a HelloLeo endpoint and return the status code, " +
+		"response headers, and response body. Use this to inspect the live behaviour " +
+		"of HelloLeo workers, the production API, or preview deployments so you can " +
+		"self-debug instead of operating blind. " +
+		"Only URLs on the HelloLeo whitelist are allowed: " +
+		"api.app.helloleo.dev, *.augustin-d60.workers.dev, *.live.helloleo.dev. " +
+		"Supports GET, POST, PUT, PATCH and DELETE (with an optional JSON body).",
+	args: argsShape,
+	async execute(rawArgs, context) {
+		const args = argsSchema.parse(rawArgs);
+		const url = parseTargetUrl(args.url);
+
+		if (args.method === "GET" && args.body !== undefined) {
+			throw new Error("GET requests cannot have a body");
+		}
+
+		await context.ask({
+			permission: "inspect_http",
+			patterns: [url.toString()],
+			always: [`${url.protocol}//${url.hostname}/*`],
+			metadata: {
+				url: url.toString(),
+				method: args.method,
+				hasBody: args.body !== undefined,
+			},
+		});
+
+		const timeoutMs = Math.max(1, Math.min(args.timeout, MAX_TIMEOUT_MS));
+
+		const requestHeaders: Record<string, string> = {
+			Accept: "application/json, text/plain, */*",
+			"User-Agent": "helloleo-plugins-inspect-http/0.1",
+			Origin: "https://app.helloleo.dev",
+			...args.headers,
+		};
+
+		if (
+			METHODS_AUTO_JSON.has(args.method) &&
+			args.body !== undefined &&
+			!hasHeader(requestHeaders, "content-type")
+		) {
+			requestHeaders["Content-Type"] = "application/json";
+		}
+
+		const signal = AbortSignal.any([
+			context.abort,
+			AbortSignal.timeout(timeoutMs),
+		]);
+
+		let response: Response;
+		try {
+			response = await fetch(url, {
+				method: args.method,
+				headers: requestHeaders,
+				body: args.method === "GET" ? undefined : args.body,
+				signal,
+				redirect: "follow",
+			});
+		} catch (err) {
+			if (err instanceof DOMException && err.name === "TimeoutError") {
+				throw new Error(`Request timed out after ${timeoutMs}ms`);
+			}
+			if (err instanceof DOMException && err.name === "AbortError") {
+				throw new Error("Request aborted");
+			}
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(`Request failed: ${message}`);
+		}
+
+		const { text, truncated } = await readBody(response);
+		const contentType = response.headers.get("content-type");
+		const formattedBody = formatBody(text, contentType);
+
+		const redirected = response.url && response.url !== url.toString();
+
+		const lines: string[] = [`${args.method} ${url.toString()}`];
+		if (redirected) {
+			lines.push(`Final URL: ${response.url}`);
+		}
+		lines.push(
+			`Status: ${response.status}${response.statusText ? ` ${response.statusText}` : ""}`,
+			"",
+			"Response headers:",
+			formatHeaders(response.headers) || "(none)",
+			"",
+			"Response body:",
+			formattedBody.length > 0 ? formattedBody : "(empty)",
+		);
+
+		if (truncated) {
+			lines.push("", `(body truncated at ${MAX_RESPONSE_BYTES} bytes)`);
+		}
+
+		return lines.join("\n");
+	},
+});
+
+function parseTargetUrl(raw: string): URL {
+	let url: URL;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new Error(`Invalid URL: ${raw}`);
+	}
+
+	if (url.protocol !== "https:" && url.protocol !== "http:") {
+		throw new Error(
+			`URL must use http or https scheme (got "${url.protocol}")`,
+		);
+	}
+
+	if (url.username || url.password) {
+		throw new Error("URL must not contain embedded credentials");
+	}
+
+	if (!isAllowedHost(url.hostname)) {
+		throw new Error(
+			`Host "${url.hostname}" is not on the HelloLeo whitelist. Allowed: ${allowedHostsHuman()}`,
+		);
+	}
+
+	return url;
+}
+
+function allowedHostsHuman(): string {
+	return [
+		...ALLOWED_EXACT_HOSTS,
+		...ALLOWED_HOST_SUFFIXES.map((s) => `*${s}`),
+	].join(", ");
+}
+
+function isAllowedHost(hostname: string): boolean {
+	const host = hostname.toLowerCase().replace(/\.$/, "");
+	if (ALLOWED_EXACT_HOSTS.has(host)) return true;
+	for (const suffix of ALLOWED_HOST_SUFFIXES) {
+		if (host.endsWith(suffix) && host.length > suffix.length) return true;
+	}
+	return false;
+}
+
+function hasHeader(headers: Record<string, string>, name: string): boolean {
+	const target = name.toLowerCase();
+	for (const key of Object.keys(headers)) {
+		if (key.toLowerCase() === target) return true;
+	}
+	return false;
+}
+
+function formatHeaders(headers: Headers): string {
+	const entries: string[] = [];
+	headers.forEach((value, key) => {
+		entries.push(`${key}: ${value}`);
+	});
+	return entries.sort().join("\n");
+}
+
+function formatBody(raw: string, contentType: string | null): string {
+	const mime = contentType?.split(";")[0]?.trim().toLowerCase() ?? "";
+	if (mime.includes("application/json") || mime.endsWith("+json")) {
+		try {
+			return JSON.stringify(JSON.parse(raw), null, 2);
+		} catch {}
+	}
+	return raw;
+}
+
+async function readBody(response: Response): Promise<{
+	text: string;
+	truncated: boolean;
+}> {
+	if (!response.body) return { text: "", truncated: false };
+
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let total = 0;
+	let truncated = false;
+
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (!value) continue;
+
+		total += value.byteLength;
+		if (total > MAX_RESPONSE_BYTES) {
+			truncated = true;
+			await reader.cancel();
+			break;
+		}
+		text += decoder.decode(value, { stream: true });
+	}
+	text += decoder.decode();
+
+	return { text, truncated };
+}
+
+export const InspectHttpPlugin: Plugin = async () => {
+	return {
+		tool: { inspect_http: inspectHttp },
+	};
+};

package/src/utils/try-catch.ts

@@ -0,0 +1,22 @@
+type Success<T> = {
+	data: T;
+	error: null;
+};
+
+type Failure<E> = {
+	data: null;
+	error: E;
+};
+
+type Result<T, E = Error> = Success<T> | Failure<E>;
+
+export async function tryCatch<T, E = Error>(
+	promise: Promise<T>,
+): Promise<Result<T, E>> {
+	try {
+		const data = await promise;
+		return { data, error: null };
+	} catch (error) {
+		return { data: null, error: error as E };
+	}
+}