@kenkaiiii/ggcoder 4.2.14 → 4.2.15

package/dist/core/auth-storage.d.ts

@@ -3,6 +3,8 @@ export declare class AuthStorage {
     private data;
     private filePath;
     private loaded;
+    /** Per-provider lock to serialize concurrent refresh calls. */
+    private refreshLocks;
     constructor(filePath?: string);
     load(): Promise<void>;
     private ensureLoaded;

package/dist/core/auth-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAS;gBAEX,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAUb,YAAY;IAIpB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAKvE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAK/B;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,gBAAgB,CAAC;IA4B5B;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAKvC,IAAI;CAInB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,EAAE,MAAM,CAAC;gBACL,QAAQ,EAAE,MAAM;CAK7B"}
+{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,+DAA+D;IAC/D,OAAO,CAAC,YAAY,CAAgD;gBAExD,QAAQ,CAAC,EAAE,MAAM;IAIvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAUb,YAAY;IAIpB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAKvE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAK/B;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAwC5B;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAKvC,IAAI;CAInB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,EAAE,MAAM,CAAC;gBACL,QAAQ,EAAE,MAAM;CAK7B"}

package/dist/core/auth-storage.js

@@ -6,6 +6,8 @@ export class AuthStorage {
     data = {};
     filePath;
     loaded = false;
+    /** Per-provider lock to serialize concurrent refresh calls. */
+    refreshLocks = new Map();
     constructor(filePath) {
         this.filePath = filePath ?? getAppPaths().authFile;
     }
@@ -61,15 +63,27 @@ export class AuthStorage {
         if (!opts?.forceRefresh && Date.now() < creds.expiresAt) {
             return creds;
         }
-        // Refresh (preserve accountId if not returned by refresh)
-        const refreshFn = provider === "anthropic" ? refreshAnthropicToken : refreshOpenAIToken;
-        const refreshed = await refreshFn(creds.refreshToken);
-        if (!refreshed.accountId && creds.accountId) {
-            refreshed.accountId = creds.accountId;
+        // Serialize concurrent refresh calls per provider to avoid races
+        const existing = this.refreshLocks.get(provider);
+        if (existing)
+            return existing;
+        const refreshPromise = (async () => {
+            const refreshFn = provider === "anthropic" ? refreshAnthropicToken : refreshOpenAIToken;
+            const refreshed = await refreshFn(creds.refreshToken);
+            if (!refreshed.accountId && creds.accountId) {
+                refreshed.accountId = creds.accountId;
+            }
+            this.data[provider] = refreshed;
+            await this.save();
+            return refreshed;
+        })();
+        this.refreshLocks.set(provider, refreshPromise);
+        try {
+            return await refreshPromise;
+        }
+        finally {
+            this.refreshLocks.delete(provider);
         }
-        this.data[provider] = refreshed;
-        await this.save();
-        return refreshed;
     }
     /**
      * Returns a valid access token, auto-refreshing if expired.

package/dist/core/auth-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,OAAO,WAAW;IACd,IAAI,GAAa,EAAE,CAAC;IACpB,QAAQ,CAAS;IACjB,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,KAAuB;QAC5D,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,QAAgB,EAChB,IAAiC;QAEjC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0DAA0D;QAC1D,MAAM,SAAS,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACxF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5C,SAAS,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;QAChC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAS;IACjB,YAAY,QAAgB;QAC1B,KAAK,CAAC,oBAAoB,QAAQ,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,OAAO,WAAW;IACd,IAAI,GAAa,EAAE,CAAC;IACpB,QAAQ,CAAS;IACjB,MAAM,GAAG,KAAK,CAAC;IACvB,+DAA+D;IACvD,YAAY,GAAG,IAAI,GAAG,EAAqC,CAAC;IAEpE,YAAY,QAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,KAAuB;QAC5D,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,QAAgB,EAChB,IAAiC;QAEjC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YACjC,MAAM,SAAS,GAAG,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACxF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC5C,SAAS,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,WAAW,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAS;IACjB,YAAY,QAAgB;QAC1B,KAAK,CAAC,oBAAoB,QAAQ,wCAAwC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF"}

package/dist/tools/bash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash.d.ts","sourceRoot":"","sources":["../../src/tools/bash.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAOjE,QAAA,MAAM,UAAU;;;;iBAed,CAAC;AAEH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,GAC7B,SAAS,CAAC,OAAO,UAAU,CAAC,CAuG9B"}
+{"version":3,"file":"bash.d.ts","sourceRoot":"","sources":["../../src/tools/bash.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA0DjE,QAAA,MAAM,UAAU;;;;iBAed,CAAC;AAEH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,GAC7B,SAAS,CAAC,OAAO,UAAU,CAAC,CAuG9B"}

package/dist/tools/bash.js

@@ -7,6 +7,56 @@ import { killProcessTree } from "../utils/process.js";
 import { truncateTail } from "./truncate.js";
 const DEFAULT_TIMEOUT = 120_000; // 120 seconds
 const MAX_OUTPUT_BYTES = 10 * 1024 * 1024; // 10 MB — cap buffered output to prevent OOM
+/** Environment variables safe to inherit. Everything else is stripped to prevent leaking secrets to LLM. */
+const ENV_ALLOWLIST = new Set([
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TMPDIR",
+    "XDG_CONFIG_HOME",
+    "XDG_DATA_HOME",
+    "XDG_CACHE_HOME",
+    "XDG_RUNTIME_DIR",
+    "EDITOR",
+    "VISUAL",
+    "PAGER",
+    "CLICOLOR",
+    "CLICOLOR_FORCE",
+    "NO_COLOR",
+    "FORCE_COLOR",
+    // Development toolchains
+    "NODE_PATH",
+    "NVM_DIR",
+    "NPM_CONFIG_PREFIX",
+    "PNPM_HOME",
+    "GOPATH",
+    "GOROOT",
+    "CARGO_HOME",
+    "RUSTUP_HOME",
+    "PYENV_ROOT",
+    "VIRTUAL_ENV",
+    "CONDA_DEFAULT_ENV",
+    "CONDA_PREFIX",
+    "JAVA_HOME",
+    "ANDROID_HOME",
+    "ANDROID_SDK_ROOT",
+    "RUBY_VERSION",
+    "GEM_HOME",
+    "RBENV_ROOT",
+]);
+function getSafeEnv() {
+    const env = { TERM: "dumb" };
+    for (const key of ENV_ALLOWLIST) {
+        if (process.env[key])
+            env[key] = process.env[key];
+    }
+    return env;
+}
 const BashParams = z.object({
     command: z.string().describe("The bash command to execute"),
     timeout: z
@@ -47,7 +97,7 @@ export function createBashTool(cwd, processManager) {
                     cwd,
                     detached: true,
                     stdio: ["ignore", "pipe", "pipe"],
-                    env: { ...process.env, TERM: "dumb" },
+                    env: getSafeEnv(),
                 });
                 const chunks = [];
                 let totalBytes = 0;

package/dist/tools/bash.js.map

@@ -1 +1 @@
-{"version":3,"file":"bash.js","sourceRoot":"","sources":["../../src/tools/bash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,cAAc;AAC/C,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,6CAA6C;AAExF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC3D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,uEAAuE;QACrE,0DAA0D,CAC7D;CACJ,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,cAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,6FAA6F;YAC7F,iFAAiF;YACjF,gDAAgD;YAChD,+DAA+D;YAC/D,wCAAwC;YACxC,iFAAiF;YACjF,kEAAkE;QACpE,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,OAAO;YACvE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACxD,OAAO,CACL,+BAA+B;oBAC/B,OAAO,MAAM,CAAC,EAAE,IAAI;oBACpB,QAAQ,MAAM,CAAC,GAAG,IAAI;oBACtB,QAAQ,MAAM,CAAC,OAAO,IAAI;oBAC1B,4BAA4B,MAAM,CAAC,EAAE,mBAAmB,CACzD,CAAC;YACJ,CAAC;YAED,MAAM,gBAAgB,GAAG,SAAS,IAAI,eAAe,CAAC;YAEtD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;oBAC3C,GAAG;oBACH,QAAQ,EAAE,IAAI;oBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;oBACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;iBACtC,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;gBACnB,IAAI,YAAY,GAAG,KAAK,CAAC;gBAEzB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;oBAC9B,IAAI,YAAY;wBAAE,OAAO;oBACzB,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;oBAC1B,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;wBAClC,YAAY,GAAG,IAAI,CAAC;wBACpB,gEAAgE;wBAChE,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC,CAAC;gBACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAEjC,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,mBAAmB;gBACnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,KAAK,CAAC,GAAG;wBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,EAAE,gBAAgB,CAAC,CAAC;gBAErB,wBAAwB;gBACxB,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,KAAK,CAAC,GAAG;wBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAElE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAErD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;oBAEvC,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;oBAC5B,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,qBAAqB,gBAAgB,GAAG,IAAI,GAAG,IAAI,sCAAsC,MAAM,EAAE,CAAC;oBAC7G,CAAC;oBACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;wBACrB,gCAAgC;wBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;wBACpE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;wBAChE,MAAM,GAAG,4BAA4B,MAAM,CAAC,SAAS,OAAO,MAAM,CAAC,UAAU,wBAAwB,OAAO,MAAM,MAAM,EAAE,CAAC;oBAC7H,CAAC;oBAED,MAAM,QAAQ,GAAG,QAAQ;wBACvB,CAAC,CAAC,YAAY,gBAAgB,KAAK;wBACnC,CAAC,CAAC,MAAM;4BACN,CAAC,CAAC,QAAQ;4BACV,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;oBAExB,OAAO,CAAC,cAAc,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;gBAC/C,CAAC,CAAC,CAAC;gBAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACrD,OAAO,CAAC,kCAAkC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bash.js","sourceRoot":"","sources":["../../src/tools/bash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,cAAc;AAC/C,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,6CAA6C;AAExF,4GAA4G;AAC5G,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,OAAO;IACP,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,aAAa;IACb,yBAAyB;IACzB,WAAW;IACX,SAAS;IACT,mBAAmB;IACnB,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,aAAa;IACb,mBAAmB;IACnB,cAAc;IACd,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,UAAU;IACjB,MAAM,GAAG,GAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAC3D,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;IACxD,iBAAiB,EAAE,CAAC;SACjB,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,uEAAuE;QACrE,0DAA0D,CAC7D;CACJ,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,cAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,6FAA6F;YAC7F,iFAAiF;YACjF,gDAAgD;YAChD,+DAA+D;YAC/D,wCAAwC;YACxC,iFAAiF;YACjF,kEAAkE;QACpE,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,OAAO;YACvE,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACxD,OAAO,CACL,+BAA+B;oBAC/B,OAAO,MAAM,CAAC,EAAE,IAAI;oBACpB,QAAQ,MAAM,CAAC,GAAG,IAAI;oBACtB,QAAQ,MAAM,CAAC,OAAO,IAAI;oBAC1B,4BAA4B,MAAM,CAAC,EAAE,mBAAmB,CACzD,CAAC;YACJ,CAAC;YAED,MAAM,gBAAgB,GAAG,SAAS,IAAI,eAAe,CAAC;YAEtD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;oBAC3C,GAAG;oBACH,QAAQ,EAAE,IAAI;oBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;oBACjC,GAAG,EAAE,UAAU,EAAE;iBAClB,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;gBACnB,IAAI,YAAY,GAAG,KAAK,CAAC;gBAEzB,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;oBAC9B,IAAI,YAAY;wBAAE,OAAO;oBACzB,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;oBAC1B,IAAI,UAAU,GAAG,gBAAgB,EAAE,CAAC;wBAClC,YAAY,GAAG,IAAI,CAAC;wBACpB,gEAAgE;wBAChE,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC,CAAC;gBACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAEjC,IAAI,MAAM,GAAG,KAAK,CAAC;gBACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,mBAAmB;gBACnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,KAAK,CAAC,GAAG;wBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,EAAE,gBAAgB,CAAC,CAAC;gBAErB,wBAAwB;gBACxB,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,MAAM,GAAG,IAAI,CAAC;oBACd,IAAI,KAAK,CAAC,GAAG;wBAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC,CAAC;gBACF,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAElE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAErD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;oBAEvC,IAAI,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;oBAC5B,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,GAAG,qBAAqB,gBAAgB,GAAG,IAAI,GAAG,IAAI,sCAAsC,MAAM,EAAE,CAAC;oBAC7G,CAAC;oBACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;wBACrB,gCAAgC;wBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;wBACpE,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;wBAChE,MAAM,GAAG,4BAA4B,MAAM,CAAC,SAAS,OAAO,MAAM,CAAC,UAAU,wBAAwB,OAAO,MAAM,MAAM,EAAE,CAAC;oBAC7H,CAAC;oBAED,MAAM,QAAQ,GAAG,QAAQ;wBACvB,CAAC,CAAC,YAAY,gBAAgB,KAAK;wBACnC,CAAC,CAAC,MAAM;4BACN,CAAC,CAAC,QAAQ;4BACV,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;oBAExB,OAAO,CAAC,cAAc,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;gBAC/C,CAAC,CAAC,CAAC;gBAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACrD,OAAO,CAAC,kCAAkC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/edit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"edit.d.ts","sourceRoot":"","sources":["../../src/tools/edit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,QAAA,MAAM,UAAU;;;;iBAId,CAAC;AAEH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,UAAU,CAAC,CA4DjG"}
+{"version":3,"file":"edit.d.ts","sourceRoot":"","sources":["../../src/tools/edit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,QAAA,MAAM,UAAU;;;;iBAId,CAAC;AAEH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,UAAU,CAAC,CA6DjG"}

package/dist/tools/edit.js

@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
-import { resolvePath } from "./path-utils.js";
+import { resolvePath, rejectSymlink } from "./path-utils.js";
 import { fuzzyFindText, countOccurrences, generateDiff } from "./edit-diff.js";
 const EditParams = z.object({
     file_path: z.string().describe("The file path to edit"),
@@ -16,6 +16,7 @@ export function createEditTool(cwd, readFiles) {
         parameters: EditParams,
         async execute({ file_path, old_text, new_text }) {
             const resolved = resolvePath(cwd, file_path);
+            await rejectSymlink(resolved);
             if (readFiles && !readFiles.has(resolved)) {
                 throw new Error("File must be read first before editing. Use the read tool first.");
             }

package/dist/tools/edit.js.map

@@ -1 +1 @@
-{"version":3,"file":"edit.js","sourceRoot":"","sources":["../../src/tools/edit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE/E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACnE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAAuB;IACjE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,wFAAwF;YACxF,0GAA0G;QAC5G,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAE7C,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAErD,sBAAsB;YACtB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEzC,yBAAyB;YACzB,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACtE,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE3E,mBAAmB;YACnB,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAChE,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI;oBAClD,2EAA2E,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,kBAAkB,WAAW,aAAa,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI;oBACnE,4DAA4D,CAC/D,CAAC;YACJ,CAAC;YAED,mBAAmB;YACnB,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,UAAU,GACd,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChC,aAAa;gBACb,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;YAEpD,iCAAiC;YACjC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;YAE9E,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAEpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"edit.js","sourceRoot":"","sources":["../../src/tools/edit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE/E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACnE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAAuB;IACjE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,wFAAwF;YACxF,0GAA0G;QAC5G,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAE9B,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAErD,sBAAsB;YACtB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEzC,yBAAyB;YACzB,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACtE,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE3E,mBAAmB;YACnB,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAChE,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI;oBAClD,2EAA2E,CAC9E,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,kBAAkB,WAAW,aAAa,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI;oBACnE,4DAA4D,CAC/D,CAAC;YACJ,CAAC;YAED,mBAAmB;YACnB,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,UAAU,GACd,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChC,aAAa;gBACb,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;YAEpD,iCAAiC;YACjC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;YAE9E,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAEpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/path-utils.d.ts

@@ -1,2 +1,7 @@
 export declare function resolvePath(cwd: string, filePath: string): string;
+/**
+ * Check if a path is a symlink. Used by file tools to prevent symlink-based
+ * attacks that could read/write sensitive files outside the working directory.
+ */
+export declare function rejectSymlink(resolved: string): Promise<void>;
 //# sourceMappingURL=path-utils.d.ts.map

package/dist/tools/path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../src/tools/path-utils.ts"],"names":[],"mappings":"AAGA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKjE"}
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../../src/tools/path-utils.ts"],"names":[],"mappings":"AAIA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnE"}

package/dist/tools/path-utils.js

@@ -1,3 +1,4 @@
+import fs from "node:fs/promises";
 import path from "node:path";
 import os from "node:os";
 export function resolvePath(cwd, filePath) {
@@ -6,4 +7,21 @@ export function resolvePath(cwd, filePath) {
     }
     return path.resolve(cwd, filePath);
 }
+/**
+ * Check if a path is a symlink. Used by file tools to prevent symlink-based
+ * attacks that could read/write sensitive files outside the working directory.
+ */
+export async function rejectSymlink(resolved) {
+    try {
+        const stat = await fs.lstat(resolved);
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Refusing to follow symlink: ${resolved}`);
+        }
+    }
+    catch (err) {
+        // Re-throw our own error; swallow ENOENT (file doesn't exist yet, e.g. write/new file)
+        if (err instanceof Error && err.message.startsWith("Refusing to follow"))
+            throw err;
+    }
+}
 //# sourceMappingURL=path-utils.js.map

package/dist/tools/path-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.js","sourceRoot":"","sources":["../../src/tools/path-utils.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAgB;IACvD,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"path-utils.js","sourceRoot":"","sources":["../../src/tools/path-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAgB;IACvD,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAAE,MAAM,GAAG,CAAC;IACtF,CAAC;AACH,CAAC"}

package/dist/tools/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/tools/read.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,eAAO,MAAM,iBAAiB,aAqD5B,CAAC;AAEH,QAAA,MAAM,UAAU;;;;iBASd,CAAC;AAEH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,UAAU,CAAC,CAkDjG"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/tools/read.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,eAAO,MAAM,iBAAiB,aAqD5B,CAAC;AAEH,QAAA,MAAM,UAAU;;;;iBASd,CAAC;AAEH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,UAAU,CAAC,CAmDjG"}

package/dist/tools/read.js

@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
-import { resolvePath } from "./path-utils.js";
+import { resolvePath, rejectSymlink } from "./path-utils.js";
 import { truncateHead } from "./truncate.js";
 export const BINARY_EXTENSIONS = new Set([
     ".png",
@@ -76,6 +76,7 @@ export function createReadTool(cwd, readFiles) {
         parameters: ReadParams,
         async execute({ file_path, offset, limit }) {
             const resolved = resolvePath(cwd, file_path);
+            await rejectSymlink(resolved);
             readFiles?.add(resolved);
             const ext = path.extname(resolved).toLowerCase();
             if (BINARY_EXTENSIONS.has(ext)) {

package/dist/tools/read.js.map

@@ -1 +1 @@
-{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/tools/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACvD,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;CACtF,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAAuB;IACjE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,iEAAiE;YACjE,iGAAiG;YACjG,kDAAkD;QACpD,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;YACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7C,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAEjD,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,gBAAgB,QAAQ,KAAK,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC;YACjE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5B,qBAAqB;YACrB,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YACzD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAExC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAErC,sCAAsC;YACtC,MAAM,WAAW,GAAG,SAAS,GAAG,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO;iBAC5B,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBACf,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzD,OAAO,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/B,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;gBACpD,OAAO,CACL,GAAG,QAAQ,IAAI;oBACf,6BAA6B,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,IAAI;oBAC5G,cAAc,UAAU,iBAAiB,CAC1C,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/tools/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACvD,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;CACtF,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAAuB;IACjE,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,iEAAiE;YACjE,iGAAiG;YACjG,kDAAkD;QACpD,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;YACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9B,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAEjD,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,gBAAgB,QAAQ,KAAK,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC;YACjE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5B,qBAAqB;YACrB,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YACzD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAExC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAErC,sCAAsC;YACtC,MAAM,WAAW,GAAG,SAAS,GAAG,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO;iBAC5B,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBACf,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzD,OAAO,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/B,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;gBACpD,OAAO,CACL,GAAG,QAAQ,IAAI;oBACf,6BAA6B,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,IAAI;oBAC5G,cAAc,UAAU,iBAAiB,CAC1C,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/web-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-fetch.d.ts","sourceRoot":"","sources":["../../src/tools/web-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,OAAO,UAAU,CAAC,CAgDjE;AAED,QAAA,MAAM,UAAU;;;iBAGd,CAAC"}
+{"version":3,"file":"web-fetch.d.ts","sourceRoot":"","sources":["../../src/tools/web-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAkDrD,wBAAgB,kBAAkB,IAAI,SAAS,CAAC,OAAO,UAAU,CAAC,CAoDjE;AAED,QAAA,MAAM,UAAU;;;iBAGd,CAAC"}

package/dist/tools/web-fetch.js

@@ -1,4 +1,48 @@
 import { z } from "zod";
+/**
+ * Block requests to private/internal network addresses to prevent SSRF.
+ * Checks the hostname against known private IP ranges and reserved domains.
+ */
+function isBlockedUrl(urlString) {
+    let parsed;
+    try {
+        parsed = new URL(urlString);
+    }
+    catch {
+        return true; // Malformed URLs are blocked
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    // Block non-HTTP(S) schemes
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return true;
+    }
+    // Block localhost and loopback
+    if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1") {
+        return true;
+    }
+    // Block 0.0.0.0
+    if (hostname === "0.0.0.0") {
+        return true;
+    }
+    // Block private IPv4 ranges: 10.x.x.x, 172.16-31.x.x, 192.168.x.x
+    if (/^10\./.test(hostname))
+        return true;
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(hostname))
+        return true;
+    if (/^192\.168\./.test(hostname))
+        return true;
+    // Block link-local (169.254.x.x — includes AWS metadata endpoint)
+    if (/^169\.254\./.test(hostname))
+        return true;
+    // Block IPv6 private/link-local
+    if (hostname.startsWith("[fe80:") || hostname.startsWith("[fd") || hostname.startsWith("[fc")) {
+        return true;
+    }
+    // Block cloud metadata endpoints
+    if (hostname === "metadata.google.internal")
+        return true;
+    return false;
+}
 export function createWebFetchTool() {
     return {
         name: "web_fetch",
@@ -6,6 +50,9 @@ export function createWebFetchTool() {
         parameters,
         async execute(args) {
             const maxLength = args.max_length ?? 10000;
+            if (isBlockedUrl(args.url)) {
+                return "Error: URL blocked — requests to private/internal network addresses are not allowed.";
+            }
             try {
                 const response = await fetch(args.url, {
                     headers: {

package/dist/tools/web-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-fetch.js","sourceRoot":"","sources":["../../src/tools/web-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,WAAW,EACT,+JAA+J;QACjK,UAAU;QACV,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;YAE3C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;oBACrC,OAAO,EAAE;wBACP,YAAY,EAAE,uCAAuC;wBACrD,MAAM,EAAE,iEAAiE;qBAC1E;oBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnC,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,OAAO,eAAe,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACjE,CAAC;gBAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAEnC,IAAI,OAAe,CAAC;gBACpB,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,OAAO,GAAG,IAAI;yBACX,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;yBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;yBACxC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;yBACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;yBACpB,IAAI,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAED,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;oBAC/B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,yBAAyB,CAAC;gBACpE,CAAC;gBAED,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,OAAO,kBAAkB,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;CAC5F,CAAC,CAAC"}
+{"version":3,"file":"web-fetch.js","sourceRoot":"","sources":["../../src/tools/web-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;GAGG;AACH,SAAS,YAAY,CAAC,SAAiB;IACrC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6BAA6B;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,4BAA4B;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+BAA+B;IAC/B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gBAAgB;IAChB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,kEAAkE;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,gCAAgC;IAChC,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iCAAiC;IACjC,IAAI,QAAQ,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAC;IAEzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,WAAW,EACT,+JAA+J;QACjK,UAAU;QACV,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;YAE3C,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,sFAAsF,CAAC;YAChG,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;oBACrC,OAAO,EAAE;wBACP,YAAY,EAAE,uCAAuC;wBACrD,MAAM,EAAE,iEAAiE;qBAC1E;oBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;iBACnC,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,OAAO,eAAe,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACjE,CAAC;gBAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAEnC,IAAI,OAAe,CAAC;gBACpB,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,OAAO,GAAG,IAAI;yBACX,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;yBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;yBACxC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;yBACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;yBACpB,IAAI,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAED,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;oBAC/B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,yBAAyB,CAAC;gBACpE,CAAC;gBAED,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnE,OAAO,kBAAkB,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;CAC5F,CAAC,CAAC"}

package/dist/tools/write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/tools/write.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,QAAA,MAAM,WAAW;;;iBAGf,CAAC;AAEH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB,SAAS,CAAC,OAAO,WAAW,CAAC,CA0B/B"}
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../src/tools/write.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,QAAA,MAAM,WAAW;;;iBAGf,CAAC;AAEH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB,SAAS,CAAC,OAAO,WAAW,CAAC,CA2B/B"}

package/dist/tools/write.js

@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
-import { resolvePath } from "./path-utils.js";
+import { resolvePath, rejectSymlink } from "./path-utils.js";
 const WriteParams = z.object({
     file_path: z.string().describe("The file path to write to"),
     content: z.string().describe("The content to write"),
@@ -14,6 +14,7 @@ export function createWriteTool(cwd, readFiles) {
         parameters: WriteParams,
         async execute({ file_path, content }) {
             const resolved = resolvePath(cwd, file_path);
+            await rejectSymlink(resolved);
             // Block overwriting existing files that haven't been read
             if (readFiles && !readFiles.has(resolved)) {
                 const exists = await fs.stat(resolved).then(() => true, () => false);

package/dist/tools/write.js.map

@@ -1 +1 @@
-{"version":3,"file":"write.js","sourceRoot":"","sources":["../../src/tools/write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;CACrD,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,SAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EACT,iEAAiE;YACjE,+FAA+F;QACjG,UAAU,EAAE,WAAW;QACvB,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE;YAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAE7C,0DAA0D;YAC1D,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACzC,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,SAAS,KAAK,aAAa,QAAQ,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"write.js","sourceRoot":"","sources":["../../src/tools/write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE7D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC;CACrD,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,SAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EACT,iEAAiE;YACjE,+FAA+F;QACjG,UAAU,EAAE,WAAW;QACvB,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE;YAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7C,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAE9B,0DAA0D;YAC1D,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACzC,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,SAAS,KAAK,aAAa,QAAQ,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenkaiiii/ggcoder",
-  "version": "4.2.14",
+  "version": "4.2.15",
   "type": "module",
   "description": "CLI coding agent with OAuth authentication for Anthropic and OpenAI",
   "license": "MIT",
@@ -35,8 +35,8 @@
     "string-width": "^8.2.0",
     "wrap-ansi": "^10.0.0",
     "zod": "^4.3.6",
-    "@kenkaiiii/gg-agent": "4.2.14",
-    "@kenkaiiii/gg-ai": "4.2.14"
+    "@kenkaiiii/gg-agent": "4.2.15",
+    "@kenkaiiii/gg-ai": "4.2.15"
   },
   "devDependencies": {
     "@types/node": "^25.3.5",