@ikarmic/forge-core 5.1.1 → 5.2.0

package/dist/pricing.js

@@ -9,6 +9,9 @@ const PRICING = {
     // OpenAI ----------------------------------------------------
     'gpt-4o': { input: 2.5, output: 10 },
     'gpt-4o-mini': { input: 0.15, output: 0.6 },
+    'gpt-4.1': { input: 2, output: 8 },
+    'gpt-4.1-mini': { input: 0.4, output: 1.6 },
+    'gpt-4.1-nano': { input: 0.1, output: 0.4 },
     'gpt-4-turbo': { input: 10, output: 30 },
     'gpt-4': { input: 30, output: 60 },
     'gpt-3.5-turbo': { input: 0.5, output: 1.5 },
@@ -26,7 +29,9 @@ const PRICING = {
     'claude-sonnet-4-5': { input: 3, output: 15 },
     'claude-opus-4': { input: 15, output: 75 },
     'claude-opus-4-1': { input: 15, output: 75 },
+    'claude-opus-4-5': { input: 5, output: 25 },
     'claude-haiku-4': { input: 0.8, output: 4 },
+    'claude-haiku-4-5': { input: 1, output: 5 },
     // Google ----------------------------------------------------
     'gemini-1.5-pro': { input: 1.25, output: 5 },
     'gemini-1.5-flash': { input: 0.075, output: 0.3 },
@@ -35,25 +40,11 @@ const PRICING = {
     'gemini-2.0-flash-lite': { input: 0.025, output: 0.1 },
     'gemini-2.5-pro': { input: 1.25, output: 10 },
     'gemini-2.5-flash': { input: 0.3, output: 2.5 },
-    // Ollama is local: no API cost. We surface this as 0/$0.00 in the UI so
-    // users see the meter running with $0.00 instead of "unpriced" churn.
-    // List a few popular model id prefixes so substring matching resolves them.
-    'llama3.1': { input: 0, output: 0 },
-    'llama3.2': { input: 0, output: 0 },
-    'llama3.3': { input: 0, output: 0 },
-    'qwen2.5': { input: 0, output: 0 },
-    'mistral': { input: 0, output: 0 },
-    'mixtral': { input: 0, output: 0 },
-    'gemma2': { input: 0, output: 0 },
-    'codellama': { input: 0, output: 0 },
-    'deepseek-coder': { input: 0, output: 0 },
-    'phi3': { input: 0, output: 0 },
     // OpenRouter ----------------------------------------------------
     // OpenRouter passes through third-party models. We list the popular ones
     // explicitly; everything else falls back to "unpriced" but still works
     // (cost events just get suppressed). Prices track OpenRouter's published
     // list at the time of writing.
-    'openrouter/auto': { input: 0, output: 0 }, // dynamic routing, unknown
     'anthropic/claude-3.5-sonnet': { input: 3, output: 15 },
     'anthropic/claude-3.5-haiku': { input: 0.8, output: 4 },
     'anthropic/claude-3-opus': { input: 15, output: 75 },
@@ -70,6 +61,30 @@ const PRICING = {
     // MiniMax --------------------------------------------------
     'minimax-m3': { input: 0.3, output: 1.2 },
 };
+/**
+ * Providers that run on the person's own machine. Their models cost nothing
+ * whatever they are called, and only they may be priced at $0: a free entry
+ * keyed by a model name ("mistral") once priced the paid hosted model of the
+ * same name at $0 too, so a cost cap never stopped it.
+ */
+const LOCAL_PROVIDERS = new Set(['ollama', 'lmstudio']);
+/**
+ * Whether `key` names the model `id` at `at`, rather than an older version of
+ * it or part of another word. `claude-opus-4` is inside `claude-opus-4-5` and
+ * `gpt-4` inside `gpt-4.1`, and each once priced the newer model at the older
+ * one's rate. A date (`-20241022`), revision (`-002`), size (`:7b`) or variant
+ * (`-latest`) after the key is still the same model.
+ */
+function namesModelAt(id, key, at) {
+    if (at > 0 && /[a-z0-9]/.test(id[at - 1]))
+        return false;
+    const rest = id.slice(at + key.length);
+    if (rest === '')
+        return true;
+    if (/^[a-z0-9]/.test(rest))
+        return false;
+    return !/^(?:\.\d|-\d{1,2}(?=$|[-.:@_]))/.test(rest);
+}
 /** Provider prompt-cache billing relative to the normal input rate. */
 function cacheMultipliersFor(model) {
     switch (model.provider) {
@@ -103,6 +118,8 @@ export function lookupPricing(model, override) {
     const configured = overrideCost(model);
     if (configured)
         return { ...cache, ...configured, known: true };
+    if (typeof model !== 'string' && LOCAL_PROVIDERS.has(model.provider))
+        return { input: 0, output: 0, known: true };
     const id = (typeof model === 'string' ? model : model.model).toLowerCase();
     // Strip only the OpenRouter-style 'models/' prefix so 'models/gemini-1.5-pro'
     // resolves the same way as 'gemini-1.5-pro'. We do NOT strip provider prefixes
@@ -115,8 +132,10 @@ export function lookupPricing(model, override) {
     // Substring match: longest key wins, so 'gpt-4o-mini' beats 'gpt-4o'.
     const keys = Object.keys(PRICING).sort((a, b) => b.length - a.length);
     for (const key of keys) {
-        if (stripped.includes(key))
-            return { ...PRICING[key], ...cache, known: true };
+        for (let at = stripped.indexOf(key); at !== -1; at = stripped.indexOf(key, at + 1)) {
+            if (namesModelAt(stripped, key, at))
+                return { ...PRICING[key], ...cache, known: true, matchedKey: key };
+        }
     }
     return { input: 0, output: 0, known: false };
 }

package/dist/structured/schema.js

@@ -258,36 +258,33 @@ export function formatZodError(err) {
     return err.issues
         .map((issue) => {
         const pathStr = issue.path.length > 0 ? issue.path.join('.') : '(root)';
-        const expected = issueCode(issue.code);
+        const expected = issueCode(issue);
         const received = describeReceived(issue);
         return `${pathStr}: ${issue.message}${expected ? ` (expected ${expected}${received ? `, got ${received}` : ''})` : ''}`;
     })
         .join('\n');
 }
-function issueCode(code) {
-    switch (code) {
+function issueCode(issue) {
+    switch (issue.code) {
         case 'invalid_type':
             return 'correct type';
-        case 'invalid_string':
+        case 'invalid_format':
             return 'string matching format';
         case 'too_small':
             return 'value >= min';
         case 'too_big':
             return 'value <= max';
-        case 'invalid_enum_value':
-            return 'one of the allowed values';
+        case 'invalid_value':
+            return issue.values.length === 1 ? 'the literal value' : 'one of the allowed values';
         case 'unrecognized_keys':
             return 'no extra keys';
         case 'invalid_union':
             return 'one of the union variants';
-        case 'invalid_literal':
-            return 'the literal value';
         default:
             return '';
     }
 }
-function describeReceived(issue) {
-    if (issue.code !== 'invalid_type')
-        return '';
-    return JSON.stringify(issue.received);
+// Zod 4 dropped `received` from the issue; its message already says "received <type>".
+function describeReceived(_issue) {
+    return '';
 }

package/dist/tools/apply-patch.d.ts

@@ -2,11 +2,7 @@ import { z } from 'zod';
 import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     patch: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    patch: string;
-}, {
-    patch: string;
-}>;
+}, z.core.$strip>;
 export type PatchOp = {
     kind: 'add';
     path: string;

package/dist/tools/ask-user.d.ts

@@ -7,17 +7,9 @@ import type { ToolDefinition } from '../types.js';
  */
 declare const params: z.ZodObject<{
     question: z.ZodString;
-    options: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    options: z.ZodOptional<z.ZodArray<z.ZodString>>;
     allowCustom: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    question: string;
-    options?: string[] | undefined;
-    allowCustom?: boolean | undefined;
-}, {
-    question: string;
-    options?: string[] | undefined;
-    allowCustom?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export interface AskUserResult {
     answer: string;
     unavailable?: boolean;

package/dist/tools/ask-user.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { raceAbort } from '../agent/race-abort.js';
 /**
  * Ask the person a question with optional choices. The agent only offers this tool when a surface can answer
  * (AgentConfig.askUser) and the run is not autonomous; if it is called anyway, or the run is stopped while the
@@ -45,16 +46,23 @@ export const askUserTool = {
             ctx.askBudget.used += 1;
         }
         const budget = ctx.askBudget;
+        const refund = () => {
+            if (budget)
+                budget.used = Math.max(0, budget.used - 1);
+        };
         const answered = ctx.askUser(args, signal).then((answer) => {
             // A question the person dismissed resolves to an empty answer and must not
             // cost part of the budget: four dismissals would otherwise end an interview
             // without a single question being answered. Refunding keeps the budget a
             // count of questions actually answered.
-            if (budget && answer.trim() === '')
-                budget.used = Math.max(0, budget.used - 1);
+            if (answer.trim() === '')
+                refund();
             return { answer };
+        }, (err) => {
+            // A surface that failed never showed the question, so it costs nothing either.
+            refund();
+            throw err;
         });
-        const aborted = new Promise((resolve) => signal?.addEventListener('abort', () => resolve(UNAVAILABLE), { once: true }));
-        return Promise.race([answered, aborted]);
+        return raceAbort(answered, signal, UNAVAILABLE);
     },
 };

package/dist/tools/browser-tools.d.ts

@@ -4,15 +4,15 @@ import type { ToolContext, ToolDefinition } from '../types.js';
 /** Throws unless `rawUrl` is an http(s) URL the browser may visit. */
 export declare function assertBrowsableUrl(rawUrl: string, policy: ToolContext['policy']): Promise<void>;
 declare const observeParams: z.ZodObject<{
-    action: z.ZodEnum<["open", "screenshot", "text", "console", "close"]>;
+    action: z.ZodEnum<{
+        close: "close";
+        text: "text";
+        open: "open";
+        screenshot: "screenshot";
+        console: "console";
+    }>;
     url: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    action: "close" | "text" | "open" | "screenshot" | "console";
-    url?: string | undefined;
-}, {
-    action: "close" | "text" | "open" | "screenshot" | "console";
-    url?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type BrowserResult = {
     action: 'open';
     url: string;
@@ -48,30 +48,14 @@ export declare function createBrowserTools(session: BrowserSession): [
         note?: string;
     }>
 ];
-declare const actParams: z.ZodEffects<z.ZodObject<{
-    action: z.ZodEnum<["click", "type", "evaluate"]>;
+declare const actParams: z.ZodObject<{
+    action: z.ZodEnum<{
+        type: "type";
+        click: "click";
+        evaluate: "evaluate";
+    }>;
     selector: z.ZodOptional<z.ZodString>;
     text: z.ZodOptional<z.ZodString>;
     expression: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}>, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}, {
-    action: "type" | "click" | "evaluate";
-    text?: string | undefined;
-    expression?: string | undefined;
-    selector?: string | undefined;
-}>;
+}, z.core.$strip>;
 export {};

package/dist/tools/codebase-search.d.ts

@@ -5,13 +5,7 @@ import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     query: z.ZodString;
     limit: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    query: string;
-    limit?: number | undefined;
-}, {
-    query: string;
-    limit?: number | undefined;
-}>;
+}, z.core.$strip>;
 export interface CodebaseSearchResult {
     query: string;
     embedder: string;

package/dist/tools/dependency-audit.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../types.js';
+export declare const AUDIT_TIMEOUT_MS = 60000;
+export declare const MAX_AUDIT_CHARS = 60000;
+export interface AuditFinding {
+    package: string;
+    installed?: string;
+    advisory: string;
+    severity: string;
+    fixedIn?: string;
+}
+export interface AuditorPlan {
+    ecosystem: 'npm' | 'pnpm' | 'yarn' | 'python' | 'cargo' | 'go';
+    program: string;
+    args: string[];
+    lockfile: string;
+}
+/** The auditors for the lockfiles at the workspace root, in a fixed order. */
+export declare function pickAuditors(cwd: string): AuditorPlan[];
+/** npm 7+ (`auditReportVersion: 2`): one finding per package with its own advisory; entries that only inherit one are skipped. */
+export declare function parseNpmAudit(text: string): AuditFinding[];
+/** pnpm (npm 6 format): `advisories` keyed by id. */
+export declare function parsePnpmAudit(text: string): AuditFinding[];
+/** pip-audit `-f json`: `{ dependencies: [...] }` (older versions print the list itself). pip-audit reports no severity. */
+export declare function parsePipAudit(text: string): AuditFinding[];
+/** cargo-audit `--json`: `vulnerabilities.list`. */
+export declare function parseCargoAudit(text: string): AuditFinding[];
+declare const params: z.ZodObject<{}, z.core.$strip>;
+export declare const dependencyAuditTool: ToolDefinition<z.infer<typeof params>, string>;
+export {};

package/dist/tools/dependency-audit.js

@@ -0,0 +1,197 @@
+/**
+ * `dependency_audit`: known vulnerabilities in the workspace's dependencies. The auditor is chosen from the
+ * lockfiles at the workspace root and run with fixed arguments; the model chooses nothing. It still asks first
+ * (RB-41): an auditor follows the repository's own settings, so `yarnPath` in .yarnrc.yml runs a script the
+ * repository ships, pip-audit builds sdists, and a cargo alias can replace `cargo audit`. The auditors also
+ * send the dependency list to their registry's advisory service, which the description says.
+ */
+import { execFile } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { resolveOnPath } from '../lsp/client.js';
+import { shellEnv } from './shell-env.js';
+export const AUDIT_TIMEOUT_MS = 60_000;
+export const MAX_AUDIT_CHARS = 60_000;
+const INSTALL_HINT = {
+    npm: 'install Node.js, which ships npm',
+    pnpm: 'npm install -g pnpm',
+    yarn: 'npm install -g yarn',
+    python: 'pip install pip-audit',
+    cargo: 'cargo install cargo-audit',
+    go: 'go install golang.org/x/vuln/cmd/govulncheck@latest',
+};
+/** A requirements file name that is safe to hand to a program a shell may start (npm-style `.cmd` shims on Windows). */
+const REQUIREMENTS = /^requirements[A-Za-z0-9._-]*\.txt$/;
+/** The auditors for the lockfiles at the workspace root, in a fixed order. */
+export function pickAuditors(cwd) {
+    const has = (name) => existsSync(path.join(cwd, name));
+    const plans = [];
+    if (has('package-lock.json'))
+        plans.push({ ecosystem: 'npm', program: 'npm', args: ['audit', '--json'], lockfile: 'package-lock.json' });
+    if (has('pnpm-lock.yaml'))
+        plans.push({ ecosystem: 'pnpm', program: 'pnpm', args: ['audit', '--json'], lockfile: 'pnpm-lock.yaml' });
+    if (has('yarn.lock')) {
+        let berry = false;
+        try {
+            berry = readFileSync(path.join(cwd, 'yarn.lock'), 'utf8').includes('__metadata:');
+        }
+        catch {
+            // Unreadable: treat as classic.
+        }
+        plans.push({ ecosystem: 'yarn', program: 'yarn', args: berry ? ['npm', 'audit', '--json', '--recursive'] : ['audit', '--json'], lockfile: 'yarn.lock' });
+    }
+    let entries = [];
+    try {
+        entries = readdirSync(cwd).sort();
+    }
+    catch {
+        // An unreadable folder has no requirements files.
+    }
+    for (const name of entries.filter((n) => REQUIREMENTS.test(n))) {
+        plans.push({ ecosystem: 'python', program: 'pip-audit', args: ['-f', 'json', '-r', name], lockfile: name });
+    }
+    const pyLock = ['poetry.lock', 'uv.lock'].find(has);
+    if (pyLock)
+        plans.push({ ecosystem: 'python', program: 'pip-audit', args: ['-f', 'json', '.'], lockfile: pyLock });
+    if (has('Cargo.lock'))
+        plans.push({ ecosystem: 'cargo', program: 'cargo', args: ['audit', '--json'], lockfile: 'Cargo.lock' });
+    if (has('go.sum'))
+        plans.push({ ecosystem: 'go', program: 'govulncheck', args: ['-json', './...'], lockfile: 'go.sum' });
+    return plans;
+}
+const rec = (v) => (v && typeof v === 'object' && !Array.isArray(v) ? v : {});
+const str = (v) => (typeof v === 'string' && v ? v : undefined);
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function finding(f) {
+    return Object.fromEntries(Object.entries(f).filter(([, v]) => v !== undefined));
+}
+/** npm 7+ (`auditReportVersion: 2`): one finding per package with its own advisory; entries that only inherit one are skipped. */
+export function parseNpmAudit(text) {
+    const out = [];
+    for (const [name, raw] of Object.entries(rec(rec(parseJson(text)).vulnerabilities))) {
+        const v = rec(raw);
+        const via = Array.isArray(v.via) ? v.via.map(rec).find((x) => str(x.url) || str(x.title)) : undefined;
+        if (!via)
+            continue;
+        const url = str(via.url) ?? '';
+        const fix = rec(v.fixAvailable);
+        out.push(finding({
+            package: name,
+            advisory: url.match(/GHSA-[a-z0-9-]+/i)?.[0] ?? str(via.title) ?? url,
+            severity: str(v.severity) ?? 'unknown',
+            fixedIn: str(fix.name) === name ? str(fix.version) : undefined,
+        }));
+    }
+    return out;
+}
+/** pnpm (npm 6 format): `advisories` keyed by id. */
+export function parsePnpmAudit(text) {
+    return Object.values(rec(rec(parseJson(text)).advisories)).map((raw) => {
+        const a = rec(raw);
+        const first = Array.isArray(a.findings) ? rec(a.findings[0]) : {};
+        return finding({
+            package: str(a.module_name) ?? 'unknown',
+            installed: str(first.version),
+            advisory: str(a.github_advisory_id) ?? str(a.url) ?? str(a.title) ?? 'unknown',
+            severity: str(a.severity) ?? 'unknown',
+            fixedIn: str(a.patched_versions),
+        });
+    });
+}
+/** pip-audit `-f json`: `{ dependencies: [...] }` (older versions print the list itself). pip-audit reports no severity. */
+export function parsePipAudit(text) {
+    const parsed = parseJson(text);
+    const deps = Array.isArray(parsed) ? parsed : rec(parsed).dependencies;
+    if (!Array.isArray(deps))
+        return [];
+    const out = [];
+    for (const d of deps.map(rec)) {
+        for (const v of Array.isArray(d.vulns) ? d.vulns.map(rec) : []) {
+            const fixes = Array.isArray(v.fix_versions) ? v.fix_versions.filter((x) => typeof x === 'string') : [];
+            out.push(finding({ package: str(d.name) ?? 'unknown', installed: str(d.version), advisory: str(v.id) ?? 'unknown', severity: 'unknown', fixedIn: fixes.join(', ') || undefined }));
+        }
+    }
+    return out;
+}
+/** cargo-audit `--json`: `vulnerabilities.list`. */
+export function parseCargoAudit(text) {
+    const list = rec(rec(parseJson(text)).vulnerabilities).list;
+    if (!Array.isArray(list))
+        return [];
+    return list.map(rec).map((v) => {
+        const adv = rec(v.advisory);
+        const pkg = rec(v.package);
+        const patched = rec(v.versions).patched;
+        return finding({
+            package: str(pkg.name) ?? str(adv.package) ?? 'unknown',
+            installed: str(pkg.version),
+            advisory: str(adv.id) ?? 'unknown',
+            severity: str(adv.severity) ?? 'unknown',
+            fixedIn: Array.isArray(patched) ? patched.filter((x) => typeof x === 'string').join(', ') || undefined : undefined,
+        });
+    });
+}
+const PARSERS = {
+    npm: parseNpmAudit,
+    pnpm: parsePnpmAudit,
+    python: parsePipAudit,
+    cargo: parseCargoAudit,
+};
+function runAuditor(program, args, cwd) {
+    // npm-style `.cmd` shims need a shell on Windows; the arguments are fixed or checked above, never the model's.
+    const shell = process.platform === 'win32' && /\.(cmd|bat)$/i.test(program);
+    return new Promise((resolve) => {
+        execFile(shell ? `"${program}"` : program, args, { cwd, env: shellEnv(process.env), shell, timeout: AUDIT_TIMEOUT_MS, maxBuffer: 64 * 1024 * 1024, windowsHide: true }, (err, stdout, stderr) => {
+            // Auditors exit non-zero when they find something: the JSON on stdout is still the answer.
+            if (err && !String(stdout).trim())
+                resolve({ stdout: '', error: (String(stderr).trim() || err.message).split('\n')[0] });
+            else
+                resolve({ stdout: String(stdout) });
+        });
+    });
+}
+function formatFindings(plan, findings) {
+    const head = `${plan.program} ${plan.args.join(' ')} (${plan.lockfile}): ${findings.length} known vulnerabilit${findings.length === 1 ? 'y' : 'ies'}`;
+    const lines = findings.map((f) => `- ${f.package}${f.installed ? ` ${f.installed}` : ''}: ${f.advisory} (${f.severity})${f.fixedIn ? `, fixed in ${f.fixedIn}` : ''}`);
+    return [head, ...lines].join('\n');
+}
+const params = z.object({});
+export const dependencyAuditTool = {
+    name: 'dependency_audit',
+    description: 'Check the project dependencies for known vulnerabilities with the auditor that fits its lockfile (npm, pnpm, yarn, pip-audit, cargo audit, govulncheck). ' +
+        "It changes no files, but the auditor follows the project's own package-manager settings and can run code the project ships, so it asks first. It contacts the package registry: the dependency list is sent to its advisory service. Takes no arguments.",
+    parameters: params,
+    destructive: true,
+    execute: async (_args, ctx) => {
+        const plans = pickAuditors(ctx.cwd);
+        if (plans.length === 0)
+            return 'Nothing to audit: no lockfile or requirements file at the project root.';
+        const env = shellEnv(process.env);
+        const parts = [];
+        for (const plan of plans) {
+            const program = resolveOnPath(plan.program, env, process.platform);
+            if (!program) {
+                parts.push(`${plan.program} is not installed, so ${plan.lockfile} was not audited. To install it: ${INSTALL_HINT[plan.ecosystem]}.`);
+                continue;
+            }
+            const { stdout, error } = await runAuditor(program, plan.args, ctx.cwd);
+            if (error) {
+                const missing = /no such (sub)?command|unknown command/i.test(error);
+                parts.push(missing ? `${plan.program} ${plan.args[0]} is not installed. To install it: ${INSTALL_HINT[plan.ecosystem]}.` : `${plan.program} failed: ${error}`);
+                continue;
+            }
+            const parse = PARSERS[plan.ecosystem];
+            parts.push(parse ? formatFindings(plan, parse(stdout)) : `${plan.program} output (not parsed):\n${stdout}`);
+        }
+        const text = parts.join('\n\n');
+        return text.length > MAX_AUDIT_CHARS ? `${text.slice(0, MAX_AUDIT_CHARS)}\n[audit output cut: ${text.length - MAX_AUDIT_CHARS} characters left out]` : text;
+    },
+};

package/dist/tools/edit-file.d.ts

@@ -4,22 +4,8 @@ declare const params: z.ZodObject<{
     path: z.ZodString;
     old_text: z.ZodString;
     new_text: z.ZodString;
-    /**
-     * If true (default), require old_text to match exactly once. If false,
-     * replace_all mode is used and every occurrence is replaced.
-     */
     replace_all: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    old_text: string;
-    new_text: string;
-    replace_all?: boolean | undefined;
-}, {
-    path: string;
-    old_text: string;
-    new_text: string;
-    replace_all?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export interface EditFileResult {
     path: string;
     replacements: number;

package/dist/tools/fetch-url.d.ts

@@ -2,27 +2,10 @@ import { z } from 'zod';
 import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     url: z.ZodString;
-    /**
-     * Hard cap on response body size in bytes. Defaults to 200KB. The fetch
-     * is aborted as soon as the cap is exceeded, so a runaway response cannot
-     * blow up the agent's context window.
-     */
     max_bytes: z.ZodOptional<z.ZodNumber>;
-    /** Per-request timeout in ms. Default 10 seconds. Set 0 to disable. */
     timeout_ms: z.ZodOptional<z.ZodNumber>;
-    /** Follow HTTP redirects. Default true. */
     follow_redirects: z.ZodOptional<z.ZodBoolean>;
-}, "strip", z.ZodTypeAny, {
-    url: string;
-    timeout_ms?: number | undefined;
-    max_bytes?: number | undefined;
-    follow_redirects?: boolean | undefined;
-}, {
-    url: string;
-    timeout_ms?: number | undefined;
-    max_bytes?: number | undefined;
-    follow_redirects?: boolean | undefined;
-}>;
+}, z.core.$strip>;
 export interface FetchUrlResult {
     /** Final URL after redirects (may differ from the input). */
     url: string;

package/dist/tools/find-references.d.ts

@@ -2,11 +2,7 @@ import { z } from 'zod';
 import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     name: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-}, {
-    name: string;
-}>;
+}, z.core.$strip>;
 export interface ReferenceHit {
     path: string;
     line: number;

package/dist/tools/find-symbol.d.ts

@@ -3,14 +3,16 @@ import type { SymbolKind } from '../code-index/types.js';
 import type { ToolDefinition } from '../types.js';
 declare const params: z.ZodObject<{
     name: z.ZodString;
-    kind: z.ZodOptional<z.ZodEnum<["function", "class", "interface", "type", "enum", "const", "method"]>>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    kind?: "function" | "class" | "interface" | "type" | "enum" | "const" | "method" | undefined;
-}, {
-    name: string;
-    kind?: "function" | "class" | "interface" | "type" | "enum" | "const" | "method" | undefined;
-}>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        function: "function";
+        class: "class";
+        interface: "interface";
+        type: "type";
+        enum: "enum";
+        const: "const";
+        method: "method";
+    }>>;
+}, z.core.$strip>;
 export interface FindSymbolMatch {
     name: string;
     kind: SymbolKind;

package/dist/tools/git-diff.d.ts

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+import type { ToolDefinition } from '../types.js';
+/** The most diff text handed to the model; the rest is cut with a note. */
+export declare const MAX_DIFF_CHARS = 60000;
+declare const params: z.ZodObject<{
+    base: z.ZodOptional<z.ZodString>;
+    staged: z.ZodOptional<z.ZodBoolean>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** A ref git will read as a ref, never as an option: no leading dash, only the characters refs and ranges use. */
+export declare function isSafeGitRef(ref: string): boolean;
+export declare const gitDiffTool: ToolDefinition<z.infer<typeof params>, string>;
+export {};