@kernel.chat/kbot 3.21.0 → 3.23.0

package/dist/sandbox-policy.d.ts

@@ -0,0 +1,47 @@
+export interface AgentPolicy {
+    /** Agent ID this policy applies to */
+    agentId: string;
+    /** Tools this agent is allowed to use (empty = all allowed) */
+    allowedTools: string[];
+    /** Tools explicitly blocked */
+    blockedTools: string[];
+    /** File paths the agent can access (glob patterns) */
+    allowedPaths: string[];
+    /** File paths the agent cannot access */
+    blockedPaths: string[];
+    /** Max execution time in seconds per tool call */
+    maxExecutionTime: number;
+    /** Whether the agent can make network requests */
+    networkAccess: boolean;
+    /** Whether the agent can execute shell commands */
+    shellAccess: boolean;
+    /** Max file size the agent can write (bytes) */
+    maxFileSize: number;
+    /** Whether the agent can install packages */
+    canInstallPackages: boolean;
+}
+declare const DEFAULT_POLICY: Omit<AgentPolicy, 'agentId'>;
+/** Strict policy for untrusted/new agents */
+declare const STRICT_POLICY: Omit<AgentPolicy, 'agentId'>;
+/** Built-in policies for known agents */
+declare const BUILTIN_POLICIES: Record<string, Partial<AgentPolicy>>;
+/** Load a specific agent's policy from file, falling back to builtins then defaults */
+export declare function loadAgentPolicy(agentId: string): AgentPolicy;
+export interface PolicyCheckResult {
+    allowed: boolean;
+    reason?: string;
+}
+/** Check if an agent is allowed to use a specific tool */
+export declare function checkToolAccess(agentId: string, toolName: string, policy?: AgentPolicy): PolicyCheckResult;
+/** Check if an agent can access a file path */
+export declare function checkPathAccess(agentId: string, filePath: string, policy?: AgentPolicy): PolicyCheckResult;
+/** List all agent policies (builtin + user-defined) */
+export declare function listPolicies(): Array<{
+    agentId: string;
+    source: 'builtin' | 'user';
+    policy: AgentPolicy;
+}>;
+/** Write a policy file for an agent */
+export declare function writeAgentPolicy(agentId: string, policy: AgentPolicy): void;
+export { DEFAULT_POLICY, STRICT_POLICY, BUILTIN_POLICIES };
+//# sourceMappingURL=sandbox-policy.d.ts.map

package/dist/sandbox-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy.d.ts","sourceRoot":"","sources":["../src/sandbox-policy.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,+BAA+B;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,sDAAsD;IACtD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,yCAAyC;IACzC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,kDAAkD;IAClD,gBAAgB,EAAE,MAAM,CAAA;IACxB,kDAAkD;IAClD,aAAa,EAAE,OAAO,CAAA;IACtB,mDAAmD;IACnD,WAAW,EAAE,OAAO,CAAA;IACpB,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,kBAAkB,EAAE,OAAO,CAAA;CAC5B;AAYD,QAAA,MAAM,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAUhD,CAAA;AAED,6CAA6C;AAC7C,QAAA,MAAM,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAU/C,CAAA;AAED,yCAAyC;AACzC,QAAA,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CA6C1D,CAAA;AAID,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAmB5D;AAuCD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAwB1G;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,iBAAiB,CAuB1G;AAID,uDAAuD;AACvD,wBAAgB,YAAY,IAAI,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsB1G;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAyB3E;AAED,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/sandbox-policy.js

@@ -0,0 +1,257 @@
+// kbot Sandbox Policies — YAML-defined agent restrictions
+//
+// Inspired by NemoClaw's OpenShell sandbox.
+// Each agent gets a policy defining what it can and cannot do.
+//
+// Default-deny: agents have NO permissions until explicitly granted.
+// Policy files live in ~/.kbot/policies/agents/
+//
+// Example policy (coder.yaml):
+//   allowedTools:
+//     - read_file
+//     - write_file
+//     - edit_file
+//     - bash
+//     - grep
+//     - glob
+//   blockedTools:
+//     - social_post
+//     - forge_publish
+//   allowedPaths:
+//     - ./src/**
+//     - ./tests/**
+//   blockedPaths:
+//     - .env
+//     - ~/.ssh/**
+//   maxExecutionTime: 300
+//   networkAccess: false
+import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+// ── Paths ──
+const POLICY_DIR = join(homedir(), '.kbot', 'policies', 'agents');
+function ensureDir() {
+    if (!existsSync(POLICY_DIR))
+        mkdirSync(POLICY_DIR, { recursive: true });
+}
+// ── Default Policies ──
+const DEFAULT_POLICY = {
+    allowedTools: [], // empty = all allowed
+    blockedTools: ['social_post', 'forge_publish'], // conservative defaults
+    allowedPaths: ['./**'],
+    blockedPaths: ['.env', '.env.*', '*.pem', '*.key', '~/.ssh/**', '~/.aws/**'],
+    maxExecutionTime: 300,
+    networkAccess: true,
+    shellAccess: true,
+    maxFileSize: 10 * 1024 * 1024, // 10MB
+    canInstallPackages: false,
+};
+/** Strict policy for untrusted/new agents */
+const STRICT_POLICY = {
+    allowedTools: ['read_file', 'grep', 'glob', 'web_search'],
+    blockedTools: ['bash', 'write_file', 'edit_file', 'forge_tool', 'social_post'],
+    allowedPaths: ['./**'],
+    blockedPaths: ['.env', '.env.*', '*.pem', '*.key', '~/.ssh/**', '~/.aws/**', 'node_modules/**'],
+    maxExecutionTime: 60,
+    networkAccess: false,
+    shellAccess: false,
+    maxFileSize: 0,
+    canInstallPackages: false,
+};
+/** Built-in policies for known agents */
+const BUILTIN_POLICIES = {
+    coder: {
+        allowedTools: [],
+        blockedTools: ['social_post'],
+        shellAccess: true,
+        networkAccess: true,
+        canInstallPackages: true,
+        maxExecutionTime: 600,
+    },
+    researcher: {
+        allowedTools: ['read_file', 'grep', 'glob', 'web_search', 'url_fetch', 'research_arxiv', 'research_papers'],
+        blockedTools: ['bash', 'write_file', 'edit_file'],
+        shellAccess: false,
+        networkAccess: true,
+        canInstallPackages: false,
+    },
+    guardian: {
+        allowedTools: [],
+        blockedTools: ['social_post', 'forge_publish'],
+        shellAccess: true,
+        networkAccess: true,
+        maxExecutionTime: 600,
+    },
+    hacker: {
+        allowedTools: [],
+        blockedTools: ['social_post', 'forge_publish'],
+        shellAccess: true,
+        networkAccess: true,
+        maxExecutionTime: 300,
+    },
+    writer: {
+        allowedTools: ['read_file', 'write_file', 'edit_file', 'grep', 'glob', 'web_search'],
+        blockedTools: ['bash', 'forge_tool'],
+        shellAccess: false,
+        networkAccess: true,
+        canInstallPackages: false,
+    },
+    gamedev: {
+        allowedTools: [],
+        blockedTools: ['social_post'],
+        shellAccess: true,
+        networkAccess: true,
+        canInstallPackages: true,
+        maxExecutionTime: 600,
+    },
+};
+// ── Policy Loading ──
+/** Load a specific agent's policy from file, falling back to builtins then defaults */
+export function loadAgentPolicy(agentId) {
+    const filePath = join(POLICY_DIR, `${agentId}.yaml`);
+    // Try user-defined policy file first
+    if (existsSync(filePath)) {
+        try {
+            const content = readFileSync(filePath, 'utf8');
+            return parsePolicy(agentId, content);
+        }
+        catch { /* fall through to builtins */ }
+    }
+    // Try builtin policy
+    const builtin = BUILTIN_POLICIES[agentId];
+    if (builtin) {
+        return { agentId, ...DEFAULT_POLICY, ...builtin };
+    }
+    // Default policy
+    return { agentId, ...DEFAULT_POLICY };
+}
+/** Parse a YAML-like policy file */
+function parsePolicy(agentId, content) {
+    const policy = { agentId, ...DEFAULT_POLICY };
+    // Parse list fields
+    const listFields = ['allowedTools', 'blockedTools', 'allowedPaths', 'blockedPaths'];
+    for (const field of listFields) {
+        const section = content.match(new RegExp(`${field}:\\n((?:\\s+-\\s+.+\\n?)+)`));
+        if (section) {
+            policy[field] = section[1]
+                .split('\n')
+                .map(l => l.replace(/^\s+-\s+/, '').trim().replace(/^["']|["']$/g, ''))
+                .filter(Boolean);
+        }
+    }
+    // Parse scalar fields
+    const maxTime = content.match(/maxExecutionTime:\s*(\d+)/);
+    if (maxTime)
+        policy.maxExecutionTime = Number(maxTime[1]);
+    const network = content.match(/networkAccess:\s*(true|false)/);
+    if (network)
+        policy.networkAccess = network[1] === 'true';
+    const shell = content.match(/shellAccess:\s*(true|false)/);
+    if (shell)
+        policy.shellAccess = shell[1] === 'true';
+    const maxFile = content.match(/maxFileSize:\s*(\d+)/);
+    if (maxFile)
+        policy.maxFileSize = Number(maxFile[1]);
+    const install = content.match(/canInstallPackages:\s*(true|false)/);
+    if (install)
+        policy.canInstallPackages = install[1] === 'true';
+    return policy;
+}
+/** Check if an agent is allowed to use a specific tool */
+export function checkToolAccess(agentId, toolName, policy) {
+    const p = policy || loadAgentPolicy(agentId);
+    // Blocked tools take priority
+    if (p.blockedTools.includes(toolName)) {
+        return { allowed: false, reason: `Tool "${toolName}" is blocked for agent "${agentId}"` };
+    }
+    // If allowedTools is non-empty, tool must be in the list
+    if (p.allowedTools.length > 0 && !p.allowedTools.includes(toolName)) {
+        return { allowed: false, reason: `Tool "${toolName}" is not in allowed list for agent "${agentId}"` };
+    }
+    // Shell access check
+    if (toolName === 'bash' && !p.shellAccess) {
+        return { allowed: false, reason: `Shell access denied for agent "${agentId}"` };
+    }
+    // Network access check
+    if (['web_search', 'url_fetch', 'research_arxiv'].includes(toolName) && !p.networkAccess) {
+        return { allowed: false, reason: `Network access denied for agent "${agentId}"` };
+    }
+    return { allowed: true };
+}
+/** Check if an agent can access a file path */
+export function checkPathAccess(agentId, filePath, policy) {
+    const p = policy || loadAgentPolicy(agentId);
+    const normalized = filePath.toLowerCase();
+    // Check blocked paths first
+    for (const blocked of p.blockedPaths) {
+        const b = blocked.toLowerCase();
+        if (b.startsWith('**/')) {
+            if (normalized.includes(b.slice(3))) {
+                return { allowed: false, reason: `Path "${filePath}" is blocked for agent "${agentId}"` };
+            }
+        }
+        else if (b.startsWith('*.')) {
+            if (normalized.endsWith(b.slice(1))) {
+                return { allowed: false, reason: `File type "${b}" is blocked for agent "${agentId}"` };
+            }
+        }
+        else {
+            if (normalized.endsWith(b) || normalized.includes(`/${b}`)) {
+                return { allowed: false, reason: `Path "${filePath}" is blocked for agent "${agentId}"` };
+            }
+        }
+    }
+    return { allowed: true };
+}
+// ── Policy Management ──
+/** List all agent policies (builtin + user-defined) */
+export function listPolicies() {
+    const result = [];
+    // User-defined policies
+    ensureDir();
+    try {
+        const files = readdirSync(POLICY_DIR).filter(f => f.endsWith('.yaml'));
+        for (const f of files) {
+            const agentId = f.replace('.yaml', '');
+            result.push({ agentId, source: 'user', policy: loadAgentPolicy(agentId) });
+        }
+    }
+    catch { /* ignore */ }
+    // Builtin policies (not already loaded from user files)
+    const userIds = new Set(result.map(r => r.agentId));
+    for (const [agentId] of Object.entries(BUILTIN_POLICIES)) {
+        if (!userIds.has(agentId)) {
+            result.push({ agentId, source: 'builtin', policy: loadAgentPolicy(agentId) });
+        }
+    }
+    return result;
+}
+/** Write a policy file for an agent */
+export function writeAgentPolicy(agentId, policy) {
+    ensureDir();
+    const filePath = join(POLICY_DIR, `${agentId}.yaml`);
+    const yaml = `# kbot Sandbox Policy for agent: ${agentId}
+# Edit this file to customize what this agent can do.
+
+allowedTools:
+${policy.allowedTools.map(t => `  - ${t}`).join('\n') || '  # empty = all allowed'}
+
+blockedTools:
+${policy.blockedTools.map(t => `  - ${t}`).join('\n')}
+
+allowedPaths:
+${policy.allowedPaths.map(p => `  - "${p}"`).join('\n')}
+
+blockedPaths:
+${policy.blockedPaths.map(p => `  - "${p}"`).join('\n')}
+
+maxExecutionTime: ${policy.maxExecutionTime}
+networkAccess: ${policy.networkAccess}
+shellAccess: ${policy.shellAccess}
+maxFileSize: ${policy.maxFileSize}
+canInstallPackages: ${policy.canInstallPackages}
+`;
+    writeFileSync(filePath, yaml);
+}
+export { DEFAULT_POLICY, STRICT_POLICY, BUILTIN_POLICIES };
+//# sourceMappingURL=sandbox-policy.js.map

package/dist/sandbox-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy.js","sourceRoot":"","sources":["../src/sandbox-policy.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,4CAA4C;AAC5C,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,gDAAgD;AAChD,EAAE;AACF,+BAA+B;AAC/B,kBAAkB;AAClB,kBAAkB;AAClB,mBAAmB;AACnB,kBAAkB;AAClB,aAAa;AACb,aAAa;AACb,aAAa;AACb,kBAAkB;AAClB,oBAAoB;AACpB,sBAAsB;AACtB,kBAAkB;AAClB,iBAAiB;AACjB,mBAAmB;AACnB,kBAAkB;AAClB,aAAa;AACb,kBAAkB;AAClB,0BAA0B;AAC1B,yBAAyB;AAEzB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AA2BjC,cAAc;AAEd,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;AAEjE,SAAS,SAAS;IAChB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,yBAAyB;AAEzB,MAAM,cAAc,GAAiC;IACnD,YAAY,EAAE,EAAE,EAAE,sBAAsB;IACxC,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,wBAAwB;IACxE,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;IAC5E,gBAAgB,EAAE,GAAG;IACrB,aAAa,EAAE,IAAI;IACnB,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;IACtC,kBAAkB,EAAE,KAAK;CAC1B,CAAA;AAED,6CAA6C;AAC7C,MAAM,aAAa,GAAiC;IAClD,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC;IACzD,YAAY,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC;IAC9E,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAC;IAC/F,gBAAgB,EAAE,EAAE;IACpB,aAAa,EAAE,KAAK;IACpB,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,CAAC;IACd,kBAAkB,EAAE,KAAK;CAC1B,CAAA;AAED,yCAAyC;AACzC,MAAM,gBAAgB,GAAyC;IAC7D,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,GAAG;KACtB;IACD,UAAU,EAAE;QACV,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;QAC3G,YAAY,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC;QACjD,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,KAAK;KAC1B;IACD,QAAQ,EAAE;QACR,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;QAC9C,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,GAAG;KACtB;IACD,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;QAC9C,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,GAAG;KACtB;IACD,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC;QACpF,YAAY,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC;QACpC,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,KAAK;KAC1B;IACD,OAAO,EAAE;QACP,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,IAAI;QACnB,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,GAAG;KACtB;CACF,CAAA;AAED,uBAAuB;AAEvB,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,OAAO,CAAC,CAAA;IAEpD,qCAAqC;IACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC9C,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAC5C,CAAC;IAED,qBAAqB;IACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,EAAE,CAAA;IACnD,CAAC;IAED,iBAAiB;IACjB,OAAO,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAA;AACvC,CAAC;AAED,oCAAoC;AACpC,SAAS,WAAW,CAAC,OAAe,EAAE,OAAe;IACnD,MAAM,MAAM,GAAgB,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAA;IAE1D,oBAAoB;IACpB,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,CAAU,CAAA;IAC5F,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC,CAAA;QAC/E,IAAI,OAAO,EAAE,CAAC;YACX,MAAc,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;iBAChC,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;iBACtE,MAAM,CAAC,OAAO,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;IAC1D,IAAI,OAAO;QAAE,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAEzD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC9D,IAAI,OAAO;QAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAA;IAEzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC1D,IAAI,KAAK;QAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAA;IAEnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrD,IAAI,OAAO;QAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAEpD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACnE,IAAI,OAAO;QAAE,MAAM,CAAC,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAA;IAE9D,OAAO,MAAM,CAAA;AACf,CAAC;AASD,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAoB;IACrF,MAAM,CAAC,GAAG,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAA;IAE5C,8BAA8B;IAC9B,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,2BAA2B,OAAO,GAAG,EAAE,CAAA;IAC3F,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,uCAAuC,OAAO,GAAG,EAAE,CAAA;IACvG,CAAC;IAED,qBAAqB;IACrB,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,OAAO,GAAG,EAAE,CAAA;IACjF,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,OAAO,GAAG,EAAE,CAAA;IACnF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAgB,EAAE,MAAoB;IACrF,MAAM,CAAC,GAAG,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAEzC,4BAA4B;IAC5B,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,2BAA2B,OAAO,GAAG,EAAE,CAAA;YAC3F,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,2BAA2B,OAAO,GAAG,EAAE,CAAA;YACzF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,2BAA2B,OAAO,GAAG,EAAE,CAAA;YAC3F,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,0BAA0B;AAE1B,uDAAuD;AACvD,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAgF,EAAE,CAAA;IAE9F,wBAAwB;IACxB,SAAS,EAAE,CAAA;IACX,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACtE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YACtC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAExB,wDAAwD;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IACnD,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAmB;IACnE,SAAS,EAAE,CAAA;IACX,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,OAAO,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,oCAAoC,OAAO;;;;EAIxD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yBAAyB;;;EAGhF,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;EAGnD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;EAGrD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;oBAEnC,MAAM,CAAC,gBAAgB;iBAC1B,MAAM,CAAC,aAAa;eACtB,MAAM,CAAC,WAAW;eAClB,MAAM,CAAC,WAAW;sBACX,MAAM,CAAC,kBAAkB;CAC9C,CAAA;IACC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kernel.chat/kbot",
-  "version": "3.21.0",
+  "version": "3.23.0",
   "description": "The only AI agent that builds its own tools. Multi-channel cognitive engine: email agent, iMessage agent, consultation pipeline, 25 specialist agents, 290+ tools, 20 providers. Runtime tool forging, Forge Registry, autopoietic health, immune self-audit. Cost-aware model routing, fallback chains, Bayesian skill routing. Embedded llama.cpp, MCP server, SDK. MIT.",
   "type": "module",
   "repository": {