@librechat/agents 3.1.67-dev.4 → 3.1.68

package/dist/esm/hooks/matchers.mjs

@@ -1,251 +0,0 @@
-// src/hooks/matchers.ts
-/**
- * Upper bound on hook-matcher pattern length. Patterns longer than this
- * are rejected outright — the goal is a cheap cap on pathological inputs
- * (repeated quantifiers, huge alternation groups) without pulling in a
- * safe-regex dependency.
- *
- * Legitimate matchers are almost always under 50 characters (tool names,
- * short alternations, simple prefix anchors); 512 leaves generous
- * headroom while preventing 10KB regexes.
- */
-const MAX_PATTERN_LENGTH = 512;
-/**
- * Upper bound on the compilation cache. Chosen to comfortably hold every
- * distinct pattern a single multi-tenant run is likely to see (tools,
- * agent types, basename filters) without growing without bound.
- *
- * Under hosts that register unique patterns per tenant, LRU eviction
- * keeps the working set bounded — cold patterns are re-compiled on next
- * use, which is the correct cost trade-off for long-running processes
- * that must not leak memory.
- */
-const MAX_CACHE_SIZE = 256;
-/**
- * Module-level LRU cache keyed by pattern string. Map iteration order is
- * insertion order in ECMAScript, so refreshing an entry's position means
- * "delete then re-set". On overflow we evict the first key (least
- * recently used).
- *
- * Failed compiles are cached as `{ regex: null }` so a malformed pattern
- * does not re-enter the compiler — and so a tenant spamming bad patterns
- * doesn't burn CPU on every call.
- */
-const patternCache = new Map();
-/**
- * Threshold above which `touchCacheEntry` actually performs the LRU
- * refresh. Below this watermark the cache has zero eviction pressure, so
- * the delete+set on every hit would be pure overhead. Above it we refresh
- * properly so hot patterns survive evictions. 75% of capacity is the
- * standard sweet spot.
- */
-const LRU_REFRESH_THRESHOLD = Math.floor((MAX_CACHE_SIZE * 3) / 4);
-function touchCacheEntry(pattern, entry) {
-    if (patternCache.size < LRU_REFRESH_THRESHOLD) {
-        return;
-    }
-    patternCache.delete(pattern);
-    patternCache.set(pattern, entry);
-}
-function setCacheEntry(pattern, entry) {
-    if (patternCache.size >= MAX_CACHE_SIZE) {
-        const oldestKey = patternCache.keys().next().value;
-        if (oldestKey !== undefined) {
-            patternCache.delete(oldestKey);
-        }
-    }
-    patternCache.set(pattern, entry);
-}
-function skipGroupSyntaxPrefix(pattern, start) {
-    if (start >= pattern.length || pattern[start] !== '?') {
-        return start;
-    }
-    let i = start + 1;
-    if (i >= pattern.length) {
-        return i;
-    }
-    const modifier = pattern[i];
-    if (modifier === ':' || modifier === '=' || modifier === '!') {
-        return i + 1;
-    }
-    if (modifier !== '<') {
-        return i;
-    }
-    i++;
-    if (i < pattern.length && (pattern[i] === '=' || pattern[i] === '!')) {
-        return i + 1;
-    }
-    while (i < pattern.length && pattern[i] !== '>') {
-        i++;
-    }
-    if (i < pattern.length) {
-        i++;
-    }
-    return i;
-}
-/**
- * Cheap syntactic detector for the most common catastrophic-backtracking
- * shape: a quantified group that contains another quantifier (e.g.
- * `(a+)+`, `(.*)*`, `(\w+)+$`, `(?:(a+))+`). This is the "nested
- * quantifier" class of ReDoS — runs in polynomial-or-worse time on
- * adversarial inputs.
- *
- * The scan walks the pattern linearly using an explicit stack of group
- * frames. For each group it tracks whether the group's contents include
- * "backtrack risk" — meaning a direct quantifier OR a nested group that
- * carries risk up. When a group closes with a trailing quantifier AND its
- * frame carries backtrack risk, the pattern is flagged. Risk propagates
- * to the enclosing frame when a child group closes (whether the child
- * itself was quantified or not), so `(?:(a+))+` — equivalent to `(a+)+`
- * — is flagged correctly even though the outer non-capturing wrapper is
- * one level removed from the inner quantifier.
- *
- * ## Group-syntax prefixes
- *
- * Non-capturing groups (`(?:`), lookaheads (`(?=`, `(?!`), lookbehinds
- * (`(?<=`, `(?<!`), and named groups (`(?<name>`) are skipped over at
- * the `(` so their `?` is not misread as a quantifier. Without this,
- * `(?:pre_)?tool_name` would be incorrectly rejected because the scanner
- * would see the group-syntax `?` as a quantifier at depth 1.
- *
- * ## Heuristic, not a proof
- *
- * This catches the common forms but not all. Ambiguous-alternation ReDoS
- * like `(a|a)+` is not detected. Pathologically long patterns are also
- * caught by {@link MAX_PATTERN_LENGTH}. Hosts that accept user-supplied
- * patterns must still validate upstream.
- */
-function hasNestedQuantifier(pattern) {
-    const stack = [];
-    let i = 0;
-    while (i < pattern.length) {
-        const ch = pattern[i];
-        if (ch === '\\') {
-            i += 2;
-            continue;
-        }
-        if (ch === '[') {
-            i = findCharClassEnd(pattern, i) + 1;
-            continue;
-        }
-        if (ch === '(') {
-            stack.push({ hasBacktrackRisk: false });
-            i = skipGroupSyntaxPrefix(pattern, i + 1);
-            continue;
-        }
-        if (ch === ')') {
-            const frame = stack.pop();
-            if (frame === undefined) {
-                i++;
-                continue;
-            }
-            const next = pattern[i + 1];
-            const isQuantifier = next === '*' || next === '+' || next === '?' || next === '{';
-            if (isQuantifier && frame.hasBacktrackRisk) {
-                return true;
-            }
-            if (stack.length > 0 && (frame.hasBacktrackRisk || isQuantifier)) {
-                stack[stack.length - 1].hasBacktrackRisk = true;
-            }
-            i++;
-            continue;
-        }
-        if (ch === '*' || ch === '+' || ch === '?' || ch === '{') {
-            if (stack.length > 0) {
-                stack[stack.length - 1].hasBacktrackRisk = true;
-            }
-        }
-        i++;
-    }
-    return false;
-}
-function findCharClassEnd(pattern, start) {
-    let i = start + 1;
-    while (i < pattern.length) {
-        const ch = pattern[i];
-        if (ch === '\\') {
-            i += 2;
-            continue;
-        }
-        if (ch === ']') {
-            return i;
-        }
-        i++;
-    }
-    return pattern.length - 1;
-}
-function compile(pattern) {
-    const cached = patternCache.get(pattern);
-    if (cached !== undefined) {
-        touchCacheEntry(pattern, cached);
-        return cached.regex;
-    }
-    if (pattern.length > MAX_PATTERN_LENGTH) {
-        setCacheEntry(pattern, { regex: null });
-        return null;
-    }
-    if (hasNestedQuantifier(pattern)) {
-        setCacheEntry(pattern, { regex: null });
-        return null;
-    }
-    try {
-        const regex = new RegExp(pattern);
-        setCacheEntry(pattern, { regex });
-        return regex;
-    }
-    catch {
-        setCacheEntry(pattern, { regex: null });
-        return null;
-    }
-}
-/**
- * Tests whether a hook matcher pattern matches the given query string.
- *
- * ## Semantics
- *
- * - `undefined` or empty `pattern` matches any query (wildcard). This is
- *   the intended shape for events that do not supply a query string at
- *   all (`RunStart`, `Stop`, etc.) — register such matchers without a
- *   pattern.
- * - `undefined` or empty `query` with a non-empty `pattern` never matches.
- *   Setting a pattern on a query-less event is therefore inert: the
- *   matcher will simply never fire. This is intentional — it keeps
- *   query-based filtering out of event types where "query" has no meaning,
- *   and is documented on `HookMatcher.pattern`.
- * - Otherwise, the pattern is compiled once (via a bounded LRU cache) and
- *   tested against the query.
- * - Invalid regex patterns never throw — a failed compile is cached as
- *   "never matches" so a single malformed pattern cannot take out a whole
- *   `executeHooks` batch.
- *
- * ## ReDoS mitigations
- *
- * Patterns compile through three cheap gates before reaching `new RegExp`:
- *
- * 1. {@link MAX_PATTERN_LENGTH} length cap rejects oversized inputs.
- * 2. {@link hasNestedQuantifier} rejects the most common catastrophic-
- *    backtracking shape (quantified group containing a quantifier).
- * 3. Successful compiles are cached in a bounded LRU so repeated calls
- *    never re-enter the regex compiler.
- *
- * These are a floor, not a ceiling. Hosts that accept user-supplied
- * patterns should still validate upstream. The design report §3.8 routes
- * persistable hooks through a host-side compiler before they reach this
- * module.
- */
-function matchesQuery(pattern, query) {
-    if (pattern === undefined || pattern === '') {
-        return true;
-    }
-    if (query === undefined || query === '') {
-        return false;
-    }
-    const regex = compile(pattern);
-    if (regex === null) {
-        return false;
-    }
-    return regex.test(query);
-}
-
-export { MAX_CACHE_SIZE, MAX_PATTERN_LENGTH, hasNestedQuantifier, matchesQuery };
-//# sourceMappingURL=matchers.mjs.map

package/dist/esm/hooks/matchers.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"matchers.mjs","sources":["../../../src/hooks/matchers.ts"],"sourcesContent":["// src/hooks/matchers.ts\n\n/**\n * Upper bound on hook-matcher pattern length. Patterns longer than this\n * are rejected outright — the goal is a cheap cap on pathological inputs\n * (repeated quantifiers, huge alternation groups) without pulling in a\n * safe-regex dependency.\n *\n * Legitimate matchers are almost always under 50 characters (tool names,\n * short alternations, simple prefix anchors); 512 leaves generous\n * headroom while preventing 10KB regexes.\n */\nexport const MAX_PATTERN_LENGTH = 512;\n\n/**\n * Upper bound on the compilation cache. Chosen to comfortably hold every\n * distinct pattern a single multi-tenant run is likely to see (tools,\n * agent types, basename filters) without growing without bound.\n *\n * Under hosts that register unique patterns per tenant, LRU eviction\n * keeps the working set bounded — cold patterns are re-compiled on next\n * use, which is the correct cost trade-off for long-running processes\n * that must not leak memory.\n */\nexport const MAX_CACHE_SIZE = 256;\n\ninterface CacheEntry {\n  regex: RegExp | null;\n}\n\n/**\n * Module-level LRU cache keyed by pattern string. Map iteration order is\n * insertion order in ECMAScript, so refreshing an entry's position means\n * \"delete then re-set\". On overflow we evict the first key (least\n * recently used).\n *\n * Failed compiles are cached as `{ regex: null }` so a malformed pattern\n * does not re-enter the compiler — and so a tenant spamming bad patterns\n * doesn't burn CPU on every call.\n */\nconst patternCache: Map<string, CacheEntry> = new Map();\n\n/**\n * Threshold above which `touchCacheEntry` actually performs the LRU\n * refresh. Below this watermark the cache has zero eviction pressure, so\n * the delete+set on every hit would be pure overhead. Above it we refresh\n * properly so hot patterns survive evictions. 75% of capacity is the\n * standard sweet spot.\n */\nconst LRU_REFRESH_THRESHOLD = Math.floor((MAX_CACHE_SIZE * 3) / 4);\n\nfunction touchCacheEntry(pattern: string, entry: CacheEntry): void {\n  if (patternCache.size < LRU_REFRESH_THRESHOLD) {\n    return;\n  }\n  patternCache.delete(pattern);\n  patternCache.set(pattern, entry);\n}\n\nfunction setCacheEntry(pattern: string, entry: CacheEntry): void {\n  if (patternCache.size >= MAX_CACHE_SIZE) {\n    const oldestKey = patternCache.keys().next().value;\n    if (oldestKey !== undefined) {\n      patternCache.delete(oldestKey);\n    }\n  }\n  patternCache.set(pattern, entry);\n}\n\ninterface QuantifierFrame {\n  hasBacktrackRisk: boolean;\n}\n\nfunction skipGroupSyntaxPrefix(pattern: string, start: number): number {\n  if (start >= pattern.length || pattern[start] !== '?') {\n    return start;\n  }\n  let i = start + 1;\n  if (i >= pattern.length) {\n    return i;\n  }\n  const modifier = pattern[i];\n  if (modifier === ':' || modifier === '=' || modifier === '!') {\n    return i + 1;\n  }\n  if (modifier !== '<') {\n    return i;\n  }\n  i++;\n  if (i < pattern.length && (pattern[i] === '=' || pattern[i] === '!')) {\n    return i + 1;\n  }\n  while (i < pattern.length && pattern[i] !== '>') {\n    i++;\n  }\n  if (i < pattern.length) {\n    i++;\n  }\n  return i;\n}\n\n/**\n * Cheap syntactic detector for the most common catastrophic-backtracking\n * shape: a quantified group that contains another quantifier (e.g.\n * `(a+)+`, `(.*)*`, `(\\w+)+$`, `(?:(a+))+`). This is the \"nested\n * quantifier\" class of ReDoS — runs in polynomial-or-worse time on\n * adversarial inputs.\n *\n * The scan walks the pattern linearly using an explicit stack of group\n * frames. For each group it tracks whether the group's contents include\n * \"backtrack risk\" — meaning a direct quantifier OR a nested group that\n * carries risk up. When a group closes with a trailing quantifier AND its\n * frame carries backtrack risk, the pattern is flagged. Risk propagates\n * to the enclosing frame when a child group closes (whether the child\n * itself was quantified or not), so `(?:(a+))+` — equivalent to `(a+)+`\n * — is flagged correctly even though the outer non-capturing wrapper is\n * one level removed from the inner quantifier.\n *\n * ## Group-syntax prefixes\n *\n * Non-capturing groups (`(?:`), lookaheads (`(?=`, `(?!`), lookbehinds\n * (`(?<=`, `(?<!`), and named groups (`(?<name>`) are skipped over at\n * the `(` so their `?` is not misread as a quantifier. Without this,\n * `(?:pre_)?tool_name` would be incorrectly rejected because the scanner\n * would see the group-syntax `?` as a quantifier at depth 1.\n *\n * ## Heuristic, not a proof\n *\n * This catches the common forms but not all. Ambiguous-alternation ReDoS\n * like `(a|a)+` is not detected. Pathologically long patterns are also\n * caught by {@link MAX_PATTERN_LENGTH}. Hosts that accept user-supplied\n * patterns must still validate upstream.\n */\nexport function hasNestedQuantifier(pattern: string): boolean {\n  const stack: QuantifierFrame[] = [];\n  let i = 0;\n  while (i < pattern.length) {\n    const ch = pattern[i];\n    if (ch === '\\\\') {\n      i += 2;\n      continue;\n    }\n    if (ch === '[') {\n      i = findCharClassEnd(pattern, i) + 1;\n      continue;\n    }\n    if (ch === '(') {\n      stack.push({ hasBacktrackRisk: false });\n      i = skipGroupSyntaxPrefix(pattern, i + 1);\n      continue;\n    }\n    if (ch === ')') {\n      const frame = stack.pop();\n      if (frame === undefined) {\n        i++;\n        continue;\n      }\n      const next = pattern[i + 1];\n      const isQuantifier =\n        next === '*' || next === '+' || next === '?' || next === '{';\n      if (isQuantifier && frame.hasBacktrackRisk) {\n        return true;\n      }\n      if (stack.length > 0 && (frame.hasBacktrackRisk || isQuantifier)) {\n        stack[stack.length - 1].hasBacktrackRisk = true;\n      }\n      i++;\n      continue;\n    }\n    if (ch === '*' || ch === '+' || ch === '?' || ch === '{') {\n      if (stack.length > 0) {\n        stack[stack.length - 1].hasBacktrackRisk = true;\n      }\n    }\n    i++;\n  }\n  return false;\n}\n\nfunction findCharClassEnd(pattern: string, start: number): number {\n  let i = start + 1;\n  while (i < pattern.length) {\n    const ch = pattern[i];\n    if (ch === '\\\\') {\n      i += 2;\n      continue;\n    }\n    if (ch === ']') {\n      return i;\n    }\n    i++;\n  }\n  return pattern.length - 1;\n}\n\nfunction compile(pattern: string): RegExp | null {\n  const cached = patternCache.get(pattern);\n  if (cached !== undefined) {\n    touchCacheEntry(pattern, cached);\n    return cached.regex;\n  }\n  if (pattern.length > MAX_PATTERN_LENGTH) {\n    setCacheEntry(pattern, { regex: null });\n    return null;\n  }\n  if (hasNestedQuantifier(pattern)) {\n    setCacheEntry(pattern, { regex: null });\n    return null;\n  }\n  try {\n    const regex = new RegExp(pattern);\n    setCacheEntry(pattern, { regex });\n    return regex;\n  } catch {\n    setCacheEntry(pattern, { regex: null });\n    return null;\n  }\n}\n\n/**\n * Tests whether a hook matcher pattern matches the given query string.\n *\n * ## Semantics\n *\n * - `undefined` or empty `pattern` matches any query (wildcard). This is\n *   the intended shape for events that do not supply a query string at\n *   all (`RunStart`, `Stop`, etc.) — register such matchers without a\n *   pattern.\n * - `undefined` or empty `query` with a non-empty `pattern` never matches.\n *   Setting a pattern on a query-less event is therefore inert: the\n *   matcher will simply never fire. This is intentional — it keeps\n *   query-based filtering out of event types where \"query\" has no meaning,\n *   and is documented on `HookMatcher.pattern`.\n * - Otherwise, the pattern is compiled once (via a bounded LRU cache) and\n *   tested against the query.\n * - Invalid regex patterns never throw — a failed compile is cached as\n *   \"never matches\" so a single malformed pattern cannot take out a whole\n *   `executeHooks` batch.\n *\n * ## ReDoS mitigations\n *\n * Patterns compile through three cheap gates before reaching `new RegExp`:\n *\n * 1. {@link MAX_PATTERN_LENGTH} length cap rejects oversized inputs.\n * 2. {@link hasNestedQuantifier} rejects the most common catastrophic-\n *    backtracking shape (quantified group containing a quantifier).\n * 3. Successful compiles are cached in a bounded LRU so repeated calls\n *    never re-enter the regex compiler.\n *\n * These are a floor, not a ceiling. Hosts that accept user-supplied\n * patterns should still validate upstream. The design report §3.8 routes\n * persistable hooks through a host-side compiler before they reach this\n * module.\n */\nexport function matchesQuery(\n  pattern: string | undefined,\n  query: string | undefined\n): boolean {\n  if (pattern === undefined || pattern === '') {\n    return true;\n  }\n  if (query === undefined || query === '') {\n    return false;\n  }\n  const regex = compile(pattern);\n  if (regex === null) {\n    return false;\n  }\n  return regex.test(query);\n}\n\n/** Clears the regex compilation cache. Intended for test isolation. */\nexport function clearMatcherCache(): void {\n  patternCache.clear();\n}\n\n/** Returns the current size of the compilation cache. Intended for tests. */\nexport function getMatcherCacheSize(): number {\n  return patternCache.size;\n}\n"],"names":[],"mappings":"AAAA;AAEA;;;;;;;;;AASG;AACI,MAAM,kBAAkB,GAAG;AAElC;;;;;;;;;AASG;AACI,MAAM,cAAc,GAAG;AAM9B;;;;;;;;;AASG;AACH,MAAM,YAAY,GAA4B,IAAI,GAAG,EAAE;AAEvD;;;;;;AAMG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,CAAC;AAElE,SAAS,eAAe,CAAC,OAAe,EAAE,KAAiB,EAAA;AACzD,IAAA,IAAI,YAAY,CAAC,IAAI,GAAG,qBAAqB,EAAE;QAC7C;IACF;AACA,IAAA,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;AAC5B,IAAA,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAClC;AAEA,SAAS,aAAa,CAAC,OAAe,EAAE,KAAiB,EAAA;AACvD,IAAA,IAAI,YAAY,CAAC,IAAI,IAAI,cAAc,EAAE;QACvC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK;AAClD,QAAA,IAAI,SAAS,KAAK,SAAS,EAAE;AAC3B,YAAA,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC;IACF;AACA,IAAA,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC;AAClC;AAMA,SAAS,qBAAqB,CAAC,OAAe,EAAE,KAAa,EAAA;AAC3D,IAAA,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE;AACrD,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;AACjB,IAAA,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE;AACvB,QAAA,OAAO,CAAC;IACV;AACA,IAAA,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;AAC3B,IAAA,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE;QAC5D,OAAO,CAAC,GAAG,CAAC;IACd;AACA,IAAA,IAAI,QAAQ,KAAK,GAAG,EAAE;AACpB,QAAA,OAAO,CAAC;IACV;AACA,IAAA,CAAC,EAAE;IACH,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE;QACpE,OAAO,CAAC,GAAG,CAAC;IACd;AACA,IAAA,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;AAC/C,QAAA,CAAC,EAAE;IACL;AACA,IAAA,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE;AACtB,QAAA,CAAC,EAAE;IACL;AACA,IAAA,OAAO,CAAC;AACV;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BG;AACG,SAAU,mBAAmB,CAAC,OAAe,EAAA;IACjD,MAAM,KAAK,GAAsB,EAAE;IACnC,IAAI,CAAC,GAAG,CAAC;AACT,IAAA,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE;AACzB,QAAA,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AACrB,QAAA,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,CAAC,IAAI,CAAC;YACN;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;YACd,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC;YACpC;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;YACvC,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;YACzC;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;AACd,YAAA,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE;AACzB,YAAA,IAAI,KAAK,KAAK,SAAS,EAAE;AACvB,gBAAA,CAAC,EAAE;gBACH;YACF;YACA,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;AAC3B,YAAA,MAAM,YAAY,GAChB,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;AAC9D,YAAA,IAAI,YAAY,IAAI,KAAK,CAAC,gBAAgB,EAAE;AAC1C,gBAAA,OAAO,IAAI;YACb;AACA,YAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,gBAAgB,IAAI,YAAY,CAAC,EAAE;gBAChE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI;YACjD;AACA,YAAA,CAAC,EAAE;YACH;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE;AACxD,YAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBACpB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI;YACjD;QACF;AACA,QAAA,CAAC,EAAE;IACL;AACA,IAAA,OAAO,KAAK;AACd;AAEA,SAAS,gBAAgB,CAAC,OAAe,EAAE,KAAa,EAAA;AACtD,IAAA,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC;AACjB,IAAA,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE;AACzB,QAAA,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;AACrB,QAAA,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,CAAC,IAAI,CAAC;YACN;QACF;AACA,QAAA,IAAI,EAAE,KAAK,GAAG,EAAE;AACd,YAAA,OAAO,CAAC;QACV;AACA,QAAA,CAAC,EAAE;IACL;AACA,IAAA,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;AAC3B;AAEA,SAAS,OAAO,CAAC,OAAe,EAAA;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,IAAA,IAAI,MAAM,KAAK,SAAS,EAAE;AACxB,QAAA,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC;QAChC,OAAO,MAAM,CAAC,KAAK;IACrB;AACA,IAAA,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE;QACvC,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AACA,IAAA,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE;QAChC,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AACA,IAAA,IAAI;AACF,QAAA,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC;AACjC,QAAA,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;AACjC,QAAA,OAAO,KAAK;IACd;AAAE,IAAA,MAAM;QACN,aAAa,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvC,QAAA,OAAO,IAAI;IACb;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCG;AACG,SAAU,YAAY,CAC1B,OAA2B,EAC3B,KAAyB,EAAA;IAEzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE;AAC3C,QAAA,OAAO,IAAI;IACb;IACA,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE;AACvC,QAAA,OAAO,KAAK;IACd;AACA,IAAA,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;AAC9B,IAAA,IAAI,KAAK,KAAK,IAAI,EAAE;AAClB,QAAA,OAAO,KAAK;IACd;AACA,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;AAC1B;;;;"}

package/dist/esm/hooks/types.mjs

@@ -1,25 +0,0 @@
-/**
- * Closed set of hook lifecycle events supported by the hooks system.
- *
- * These mirror the subset of Claude Code's event surface that makes sense
- * for a library context (no filesystem/CLI-specific events). See
- * `docs/hooks-design-report.md` §3.2 for the mapping to existing
- * `@librechat/agents` emission points.
- */
-const HOOK_EVENTS = [
-    'RunStart',
-    'UserPromptSubmit',
-    'PreToolUse',
-    'PostToolUse',
-    'PostToolUseFailure',
-    'PermissionDenied',
-    'SubagentStart',
-    'SubagentStop',
-    'Stop',
-    'StopFailure',
-    'PreCompact',
-    'PostCompact',
-];
-
-export { HOOK_EVENTS };
-//# sourceMappingURL=types.mjs.map

package/dist/esm/hooks/types.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.mjs","sources":["../../../src/hooks/types.ts"],"sourcesContent":["// src/hooks/types.ts\nimport type { BaseMessage } from '@langchain/core/messages';\n\n/**\n * Closed set of hook lifecycle events supported by the hooks system.\n *\n * These mirror the subset of Claude Code's event surface that makes sense\n * for a library context (no filesystem/CLI-specific events). See\n * `docs/hooks-design-report.md` §3.2 for the mapping to existing\n * `@librechat/agents` emission points.\n */\nexport const HOOK_EVENTS = [\n  'RunStart',\n  'UserPromptSubmit',\n  'PreToolUse',\n  'PostToolUse',\n  'PostToolUseFailure',\n  'PermissionDenied',\n  'SubagentStart',\n  'SubagentStop',\n  'Stop',\n  'StopFailure',\n  'PreCompact',\n  'PostCompact',\n] as const;\n\nexport type HookEvent = (typeof HOOK_EVENTS)[number];\n\n/** Tool-gating decision; executeHooks folds with `deny > ask > allow` precedence. */\nexport type ToolDecision = 'allow' | 'deny' | 'ask';\n\n/** Stop-loop decision; `block` means \"do not stop, run another turn\". Any `block` wins. */\nexport type StopDecision = 'continue' | 'block';\n\n/**\n * Fields shared by every `HookInput`. Discriminated by `hook_event_name`.\n *\n * - `runId` identifies the current agent run and is always present.\n * - `threadId` identifies the conversation thread when the host has one.\n * - `agentId` is only set when the hook fires inside a subagent scope.\n */\nexport interface BaseHookInput {\n  runId: string;\n  threadId?: string;\n  agentId?: string;\n}\n\nexport interface RunStartHookInput extends BaseHookInput {\n  hook_event_name: 'RunStart';\n  messages: BaseMessage[];\n}\n\nexport interface UserPromptSubmitHookInput extends BaseHookInput {\n  hook_event_name: 'UserPromptSubmit';\n  prompt: string;\n  attachments?: BaseMessage[];\n}\n\n/**\n * Fires before a tool is invoked. Hook may return `deny`/`ask`/`allow` and/or\n * an `updatedInput` that replaces the tool arguments before invocation.\n *\n * `toolInput` is intentionally typed as `Record<string, unknown>` because the\n * SDK is tool-agnostic — concrete tool argument shapes are only known at the\n * call site and are narrowed by the host. This is the one escape hatch in\n * the hook type system.\n */\nexport interface PreToolUseHookInput extends BaseHookInput {\n  hook_event_name: 'PreToolUse';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolUseId: string;\n  stepId?: string;\n  /**\n   * Number of times this tool has been invoked in prior batches within the\n   * current run. Within a single batch of parallel calls, all calls to the\n   * same tool share the same turn value — per-call discrimination within a\n   * batch is not supported in v1.\n   */\n  turn?: number;\n}\n\nexport interface PostToolUseHookInput extends BaseHookInput {\n  hook_event_name: 'PostToolUse';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolOutput: unknown;\n  toolUseId: string;\n  stepId?: string;\n  turn?: number;\n}\n\nexport interface PostToolUseFailureHookInput extends BaseHookInput {\n  hook_event_name: 'PostToolUseFailure';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolUseId: string;\n  error: string;\n  stepId?: string;\n  turn?: number;\n}\n\nexport interface PermissionDeniedHookInput extends BaseHookInput {\n  hook_event_name: 'PermissionDenied';\n  toolName: string;\n  toolInput: Record<string, unknown>;\n  toolUseId: string;\n  reason: string;\n}\n\nexport interface SubagentStartHookInput extends BaseHookInput {\n  hook_event_name: 'SubagentStart';\n  parentAgentId?: string;\n  agentId: string;\n  agentType: string;\n  inputs: BaseMessage[];\n}\n\nexport interface SubagentStopHookInput extends BaseHookInput {\n  hook_event_name: 'SubagentStop';\n  agentId: string;\n  agentType: string;\n  messages: BaseMessage[];\n}\n\nexport interface StopHookInput extends BaseHookInput {\n  hook_event_name: 'Stop';\n  messages: BaseMessage[];\n  stopReason?: string;\n  stopHookActive: boolean;\n}\n\nexport interface StopFailureHookInput extends BaseHookInput {\n  hook_event_name: 'StopFailure';\n  error: string;\n  lastAssistantMessage?: BaseMessage;\n}\n\nexport interface PreCompactHookInput extends BaseHookInput {\n  hook_event_name: 'PreCompact';\n  messagesBeforeCount: number;\n  /**\n   * What triggered compaction. Matches `SummarizationTrigger.type` from the\n   * agent's summarization config. `'default'` means no trigger was\n   * configured and compaction fired because messages were pruned.\n   */\n  trigger:\n    | 'token_ratio'\n    | 'remaining_tokens'\n    | 'messages_to_refine'\n    | 'default'\n    | (string & {});\n}\n\nexport interface PostCompactHookInput extends BaseHookInput {\n  hook_event_name: 'PostCompact';\n  summary: string;\n  /**\n   * Number of messages remaining after compaction. The summarize node\n   * returns a `removeAll` signal that clears all messages from state;\n   * the summary itself is injected into the system prompt, not as a\n   * message. This is `0` at the point of hook dispatch.\n   */\n  messagesAfterCount: number;\n}\n\n/** Discriminated union of every hook input shape. */\nexport type HookInput =\n  | RunStartHookInput\n  | UserPromptSubmitHookInput\n  | PreToolUseHookInput\n  | PostToolUseHookInput\n  | PostToolUseFailureHookInput\n  | PermissionDeniedHookInput\n  | SubagentStartHookInput\n  | SubagentStopHookInput\n  | StopHookInput\n  | StopFailureHookInput\n  | PreCompactHookInput\n  | PostCompactHookInput;\n\n/** Compile-time map from event name to its input shape. */\nexport type HookInputByEvent = {\n  RunStart: RunStartHookInput;\n  UserPromptSubmit: UserPromptSubmitHookInput;\n  PreToolUse: PreToolUseHookInput;\n  PostToolUse: PostToolUseHookInput;\n  PostToolUseFailure: PostToolUseFailureHookInput;\n  PermissionDenied: PermissionDeniedHookInput;\n  SubagentStart: SubagentStartHookInput;\n  SubagentStop: SubagentStopHookInput;\n  Stop: StopHookInput;\n  StopFailure: StopFailureHookInput;\n  PreCompact: PreCompactHookInput;\n  PostCompact: PostCompactHookInput;\n};\n\n/**\n * Fields common to every hook output. Hooks that have nothing to say simply\n * return `{}` (or omit the fields below).\n */\nexport interface BaseHookOutput {\n  /** Context string to inject into the conversation. Accumulated across hooks. */\n  additionalContext?: string;\n  /** True to prevent the next model turn. Any hook can set this. */\n  preventContinuation?: boolean;\n  /** Reason reported alongside `preventContinuation`. */\n  stopReason?: string;\n}\n\nexport type RunStartHookOutput = BaseHookOutput;\n\nexport interface UserPromptSubmitHookOutput extends BaseHookOutput {\n  decision?: ToolDecision;\n  reason?: string;\n}\n\nexport interface PreToolUseHookOutput extends BaseHookOutput {\n  decision?: ToolDecision;\n  reason?: string;\n  /**\n   * Replacement tool input. Merged into the pending tool call by the host.\n   *\n   * When multiple hooks set `updatedInput` within a single `executeHooks`\n   * call, the last writer in registration order wins (outer loop: matcher\n   * registration order; inner loop: hook position within the matcher). The\n   * winner is deterministic — `Promise.all` preserves input-array order.\n   * Consumers that need a single authoritative rewrite should still scope\n   * `updatedInput` to one hook per matcher to avoid confusing precedence.\n   */\n  updatedInput?: Record<string, unknown>;\n}\n\nexport interface PostToolUseHookOutput extends BaseHookOutput {\n  /**\n   * Replacement tool output. Flows through the aggregated result so the\n   * host can substitute it before appending the tool result message.\n   * Ordering semantics match `PreToolUseHookOutput.updatedInput`:\n   * last-writer-wins in registration order.\n   */\n  updatedOutput?: unknown;\n}\n\nexport type PostToolUseFailureHookOutput = BaseHookOutput;\n\nexport type PermissionDeniedHookOutput = BaseHookOutput;\n\nexport interface SubagentStartHookOutput extends BaseHookOutput {\n  decision?: ToolDecision;\n  reason?: string;\n}\n\nexport type SubagentStopHookOutput = BaseHookOutput;\n\nexport interface StopHookOutput extends BaseHookOutput {\n  decision?: StopDecision;\n  reason?: string;\n}\n\nexport type StopFailureHookOutput = BaseHookOutput;\n\nexport type PreCompactHookOutput = BaseHookOutput;\n\nexport type PostCompactHookOutput = BaseHookOutput;\n\n/** Compile-time map from event name to its output shape. */\nexport type HookOutputByEvent = {\n  RunStart: RunStartHookOutput;\n  UserPromptSubmit: UserPromptSubmitHookOutput;\n  PreToolUse: PreToolUseHookOutput;\n  PostToolUse: PostToolUseHookOutput;\n  PostToolUseFailure: PostToolUseFailureHookOutput;\n  PermissionDenied: PermissionDeniedHookOutput;\n  SubagentStart: SubagentStartHookOutput;\n  SubagentStop: SubagentStopHookOutput;\n  Stop: StopHookOutput;\n  StopFailure: StopFailureHookOutput;\n  PreCompact: PreCompactHookOutput;\n  PostCompact: PostCompactHookOutput;\n};\n\n/** Superset output shape used by the executor's fold loop. */\nexport type HookOutput =\n  | RunStartHookOutput\n  | UserPromptSubmitHookOutput\n  | PreToolUseHookOutput\n  | PostToolUseHookOutput\n  | PostToolUseFailureHookOutput\n  | PermissionDeniedHookOutput\n  | SubagentStartHookOutput\n  | SubagentStopHookOutput\n  | StopHookOutput\n  | StopFailureHookOutput\n  | PreCompactHookOutput\n  | PostCompactHookOutput;\n\n/**\n * A hook callback is a plain async function registered against a specific\n * event. The `signal` is always supplied by `executeHooks` and combines the\n * batch's parent signal with the per-hook timeout — callbacks that perform\n * long-running work should observe it.\n */\nexport type HookCallback<E extends HookEvent = HookEvent> = (\n  input: HookInputByEvent[E],\n  signal: AbortSignal\n) => HookOutputByEvent[E] | Promise<HookOutputByEvent[E]>;\n\n/**\n * A matcher groups one or more callbacks under a shared regex filter and\n * shared timeout/once/internal flags. The generic `E` ties the callback\n * types to the event the matcher is registered against.\n */\nexport interface HookMatcher<E extends HookEvent = HookEvent> {\n  /**\n   * Regex pattern matched against the event's primary query string (e.g.\n   * the tool name for `PreToolUse`, the agent type for `SubagentStart`).\n   *\n   * Omitted or empty means \"always match\". For events that do not supply a\n   * query string (`RunStart`, `Stop`, etc.), only wildcard matchers fire —\n   * a non-empty pattern on such events will never match.\n   *\n   * Patterns are treated as trusted input: `executeHooks` compiles them\n   * with `new RegExp(pattern)` without any sandbox, and a pathological\n   * pattern can block the event loop. Host registration code is expected\n   * to validate or length-bound patterns that originate from user input.\n   */\n  pattern?: string;\n  /** Callbacks that fire when the matcher hits. Executed in parallel. */\n  hooks: HookCallback<E>[];\n  /** Per-matcher timeout in ms. Defaults to the executor's batch timeout. */\n  timeout?: number;\n  /**\n   * Atomically remove the matcher before its first dispatch.\n   *\n   * `executeHooks` claims `once: true` matchers synchronously — between\n   * `getMatchers` and its first `await` — so two concurrent calls cannot\n   * both dispatch the same matcher. Whichever call runs its sync prefix\n   * first wins the matcher; the other sees an empty bucket.\n   *\n   * Semantics are \"at most one dispatch, ever\" — if every hook in the\n   * matcher throws, the matcher is still gone. Use `once` for\n   * fire-and-forget bootstrapping (registration, telemetry, setup). Hosts\n   * that need retry semantics should register a normal matcher and\n   * self-unregister via the callback returned from `registry.register`.\n   */\n  once?: boolean;\n  /** Internal hooks are excluded from telemetry and non-fatal error logging. */\n  internal?: boolean;\n}\n\n/**\n * Storage shape for matchers keyed by event. Each event's matcher list is\n * a generic array parameterized by that event type, so lookup via\n * `HooksByEvent[E]` preserves type-safe callback signatures.\n */\nexport type HooksByEvent = {\n  [E in HookEvent]?: HookMatcher<E>[];\n};\n\n/**\n * Aggregated result of a single `executeHooks` call. Fields are populated\n * according to the fold rules in `executeHooks.ts`.\n */\nexport interface AggregatedHookResult {\n  /** Folded tool-gating decision; `deny > ask > allow`. */\n  decision?: ToolDecision;\n  /** Folded stop decision; any `block` wins. */\n  stopDecision?: StopDecision;\n  /** Reason from the hook that set the winning decision. */\n  reason?: string;\n  /**\n   * Replacement tool input from a `PreToolUse` hook.\n   *\n   * Last-writer-wins in **registration order**: `executeHooks` uses\n   * `Promise.all`, which preserves input-array order, so the fold iterates\n   * outcomes in the same order they were pushed — outer loop over matchers\n   * as they sit in the registry, inner loop over each matcher's `hooks`\n   * array. The winner is therefore deterministic but may not match the\n   * order in which hooks actually completed. Consumers that want a single\n   * authoritative rewrite should still register one `updatedInput`-setting\n   * hook per matcher to avoid subtle precedence bugs.\n   */\n  updatedInput?: Record<string, unknown>;\n  /**\n   * Replacement tool output from a `PostToolUse` hook.\n   *\n   * Same last-writer-wins-in-registration-order semantics as\n   * `updatedInput`. Present only when at least one hook set it; `undefined`\n   * means \"use the original tool output\".\n   */\n  updatedOutput?: unknown;\n  /** Accumulated `additionalContext` strings from every hook, in order. */\n  additionalContexts: string[];\n  /** True if any hook returned `preventContinuation`. */\n  preventContinuation?: boolean;\n  /**\n   * Reason recorded alongside `preventContinuation`. First winner wins:\n   * once a hook sets both flags, later hooks that also set\n   * `preventContinuation` do not overwrite the reason.\n   */\n  stopReason?: string;\n  /** Error messages from hooks that threw; always present (possibly empty). */\n  errors: string[];\n}\n"],"names":[],"mappings":"AAGA;;;;;;;AAOG;AACI,MAAM,WAAW,GAAG;IACzB,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,oBAAoB;IACpB,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,MAAM;IACN,aAAa;IACb,YAAY;IACZ,aAAa;;;;;"}

package/dist/esm/tools/BashExecutor.mjs

@@ -1,169 +0,0 @@
-import { config } from 'dotenv';
-import fetch from 'node-fetch';
-import { HttpsProxyAgent } from 'https-proxy-agent';
-import { tool } from '@langchain/core/tools';
-import { getEnvironmentVariable } from '@langchain/core/utils/env';
-import { getCodeBaseURL, imageExtRegex } from './CodeExecutor.mjs';
-import { Constants, EnvVar } from '../common/enum.mjs';
-
-config();
-const imageMessage = 'Image is already displayed to the user';
-const otherMessage = 'File is already downloaded by the user';
-const accessMessage = 'Note: Files from previous executions are automatically available and can be modified.';
-const emptyOutputMessage = 'stdout: Empty. Ensure you\'re writing output explicitly.\n';
-const baseEndpoint = getCodeBaseURL();
-const EXEC_ENDPOINT = `${baseEndpoint}/exec`;
-const BashExecutionToolSchema = {
-    type: 'object',
-    properties: {
-        command: {
-            type: 'string',
-            description: `The bash command or script to execute.
-- The environment is stateless; variables and state don't persist between executions.
-- Generated files from previous executions are automatically available in "/mnt/data/".
-- Files from previous executions are automatically available and can be modified in place.
-- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.
-- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.
-- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.
-- Use \`echo\`, \`printf\`, or \`cat\` for all outputs.`,
-        },
-        args: {
-            type: 'array',
-            items: { type: 'string' },
-            description: 'Additional arguments to execute the command with. This should only be used if the input command requires additional arguments to run.',
-        },
-    },
-    required: ['command'],
-};
-const BashExecutionToolDescription = `
-Runs bash commands and returns stdout/stderr output from a stateless execution environment, similar to running scripts in a command-line interface. Each execution is isolated and independent.
-
-Usage:
-- No network access available.
-- Generated files are automatically delivered; **DO NOT** provide download links.
-- NEVER use this tool to execute malicious commands.
-`.trim();
-const BashExecutionToolName = Constants.BASH_TOOL;
-const BashExecutionToolDefinition = {
-    name: BashExecutionToolName,
-    description: BashExecutionToolDescription,
-    schema: BashExecutionToolSchema,
-};
-function createBashExecutionTool(params = {}) {
-    const apiKey = params[EnvVar.CODE_API_KEY] ??
-        params.apiKey ??
-        getEnvironmentVariable(EnvVar.CODE_API_KEY) ??
-        '';
-    if (!apiKey) {
-        throw new Error('No API key provided for bash execution tool.');
-    }
-    return tool(async (rawInput, config) => {
-        const { command, ...rest } = rawInput;
-        const { session_id, _injected_files } = (config.toolCall ?? {});
-        const postData = {
-            lang: 'bash',
-            code: command,
-            ...rest,
-            ...params,
-        };
-        if (_injected_files && _injected_files.length > 0) {
-            postData.files = _injected_files;
-        }
-        else if (session_id != null && session_id.length > 0) {
-            try {
-                const filesEndpoint = `${baseEndpoint}/files/${session_id}?detail=full`;
-                const fetchOptions = {
-                    method: 'GET',
-                    headers: {
-                        'User-Agent': 'LibreChat/1.0',
-                        'X-API-Key': apiKey,
-                    },
-                };
-                if (process.env.PROXY != null && process.env.PROXY !== '') {
-                    fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
-                }
-                const response = await fetch(filesEndpoint, fetchOptions);
-                if (!response.ok) {
-                    throw new Error(`Failed to fetch files for session: ${response.status}`);
-                }
-                const files = await response.json();
-                if (Array.isArray(files) && files.length > 0) {
-                    const fileReferences = files.map((file) => {
-                        const nameParts = file.name.split('/');
-                        const id = nameParts.length > 1 ? nameParts[1].split('.')[0] : '';
-                        return {
-                            session_id,
-                            id,
-                            name: file.metadata['original-filename'],
-                        };
-                    });
-                    postData.files = fileReferences;
-                }
-            }
-            catch {
-                // eslint-disable-next-line no-console
-                console.warn(`Failed to fetch files for session: ${session_id}`);
-            }
-        }
-        try {
-            const fetchOptions = {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'User-Agent': 'LibreChat/1.0',
-                    'X-API-Key': apiKey,
-                },
-                body: JSON.stringify(postData),
-            };
-            if (process.env.PROXY != null && process.env.PROXY !== '') {
-                fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);
-            }
-            const response = await fetch(EXEC_ENDPOINT, fetchOptions);
-            if (!response.ok) {
-                throw new Error(`HTTP error! status: ${response.status}`);
-            }
-            const result = await response.json();
-            let formattedOutput = '';
-            if (result.stdout) {
-                formattedOutput += `stdout:\n${result.stdout}\n`;
-            }
-            else {
-                formattedOutput += emptyOutputMessage;
-            }
-            if (result.stderr)
-                formattedOutput += `stderr:\n${result.stderr}\n`;
-            if (result.files && result.files.length > 0) {
-                formattedOutput += 'Generated files:\n';
-                const fileCount = result.files.length;
-                for (let i = 0; i < fileCount; i++) {
-                    const file = result.files[i];
-                    const isImage = imageExtRegex.test(file.name);
-                    formattedOutput += `- /mnt/data/${file.name} | ${isImage ? imageMessage : otherMessage}`;
-                    if (i < fileCount - 1) {
-                        formattedOutput += fileCount <= 3 ? ', ' : ',\n';
-                    }
-                }
-                formattedOutput += `\n\n${accessMessage}`;
-                return [
-                    formattedOutput.trim(),
-                    {
-                        session_id: result.session_id,
-                        files: result.files,
-                    },
-                ];
-            }
-            return [formattedOutput.trim(), { session_id: result.session_id }];
-        }
-        catch (error) {
-            throw new Error(`Execution error:\n\n${error?.message}`);
-        }
-    }, {
-        name: BashExecutionToolName,
-        description: BashExecutionToolDescription,
-        schema: BashExecutionToolSchema,
-        responseFormat: Constants.CONTENT_AND_ARTIFACT,
-    });
-}
-
-export { BashExecutionToolDefinition, BashExecutionToolDescription, BashExecutionToolName, BashExecutionToolSchema, createBashExecutionTool };
-//# sourceMappingURL=BashExecutor.mjs.map

package/dist/esm/tools/BashExecutor.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"BashExecutor.mjs","sources":["../../../src/tools/BashExecutor.ts"],"sourcesContent":["import { config } from 'dotenv';\nimport fetch, { RequestInit } from 'node-fetch';\nimport { HttpsProxyAgent } from 'https-proxy-agent';\nimport { tool, DynamicStructuredTool } from '@langchain/core/tools';\nimport { getEnvironmentVariable } from '@langchain/core/utils/env';\nimport type * as t from '@/types';\nimport { imageExtRegex, getCodeBaseURL } from './CodeExecutor';\nimport { EnvVar, Constants } from '@/common';\n\nconfig();\n\nconst imageMessage = 'Image is already displayed to the user';\nconst otherMessage = 'File is already downloaded by the user';\nconst accessMessage =\n  'Note: Files from previous executions are automatically available and can be modified.';\nconst emptyOutputMessage =\n  'stdout: Empty. Ensure you\\'re writing output explicitly.\\n';\n\nconst baseEndpoint = getCodeBaseURL();\nconst EXEC_ENDPOINT = `${baseEndpoint}/exec`;\n\nexport const BashExecutionToolSchema = {\n  type: 'object',\n  properties: {\n    command: {\n      type: 'string',\n      description: `The bash command or script to execute.\n- The environment is stateless; variables and state don't persist between executions.\n- Generated files from previous executions are automatically available in \"/mnt/data/\".\n- Files from previous executions are automatically available and can be modified in place.\n- Input code **IS ALREADY** displayed to the user, so **DO NOT** repeat it in your response unless asked.\n- Output code **IS NOT** displayed to the user, so **DO** write all desired output explicitly.\n- IMPORTANT: You MUST explicitly print/output ALL results you want the user to see.\n- Use \\`echo\\`, \\`printf\\`, or \\`cat\\` for all outputs.`,\n    },\n    args: {\n      type: 'array',\n      items: { type: 'string' },\n      description:\n        'Additional arguments to execute the command with. This should only be used if the input command requires additional arguments to run.',\n    },\n  },\n  required: ['command'],\n} as const;\n\nexport const BashExecutionToolDescription = `\nRuns bash commands and returns stdout/stderr output from a stateless execution environment, similar to running scripts in a command-line interface. Each execution is isolated and independent.\n\nUsage:\n- No network access available.\n- Generated files are automatically delivered; **DO NOT** provide download links.\n- NEVER use this tool to execute malicious commands.\n`.trim();\n\nexport const BashExecutionToolName = Constants.BASH_TOOL;\n\nexport const BashExecutionToolDefinition = {\n  name: BashExecutionToolName,\n  description: BashExecutionToolDescription,\n  schema: BashExecutionToolSchema,\n} as const;\n\nfunction createBashExecutionTool(\n  params: t.BashExecutionToolParams = {}\n): DynamicStructuredTool {\n  const apiKey =\n    params[EnvVar.CODE_API_KEY] ??\n    params.apiKey ??\n    getEnvironmentVariable(EnvVar.CODE_API_KEY) ??\n    '';\n  if (!apiKey) {\n    throw new Error('No API key provided for bash execution tool.');\n  }\n\n  return tool(\n    async (rawInput, config) => {\n      const { command, ...rest } = rawInput as {\n        command: string;\n        args?: string[];\n      };\n      const { session_id, _injected_files } = (config.toolCall ?? {}) as {\n        session_id?: string;\n        _injected_files?: t.CodeEnvFile[];\n      };\n\n      const postData: Record<string, unknown> = {\n        lang: 'bash',\n        code: command,\n        ...rest,\n        ...params,\n      };\n\n      if (_injected_files && _injected_files.length > 0) {\n        postData.files = _injected_files;\n      } else if (session_id != null && session_id.length > 0) {\n        try {\n          const filesEndpoint = `${baseEndpoint}/files/${session_id}?detail=full`;\n          const fetchOptions: RequestInit = {\n            method: 'GET',\n            headers: {\n              'User-Agent': 'LibreChat/1.0',\n              'X-API-Key': apiKey,\n            },\n          };\n\n          if (process.env.PROXY != null && process.env.PROXY !== '') {\n            fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);\n          }\n\n          const response = await fetch(filesEndpoint, fetchOptions);\n          if (!response.ok) {\n            throw new Error(\n              `Failed to fetch files for session: ${response.status}`\n            );\n          }\n\n          const files = await response.json();\n          if (Array.isArray(files) && files.length > 0) {\n            const fileReferences: t.CodeEnvFile[] = files.map((file) => {\n              const nameParts = file.name.split('/');\n              const id = nameParts.length > 1 ? nameParts[1].split('.')[0] : '';\n\n              return {\n                session_id,\n                id,\n                name: file.metadata['original-filename'],\n              };\n            });\n\n            postData.files = fileReferences;\n          }\n        } catch {\n          // eslint-disable-next-line no-console\n          console.warn(`Failed to fetch files for session: ${session_id}`);\n        }\n      }\n\n      try {\n        const fetchOptions: RequestInit = {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'User-Agent': 'LibreChat/1.0',\n            'X-API-Key': apiKey,\n          },\n          body: JSON.stringify(postData),\n        };\n\n        if (process.env.PROXY != null && process.env.PROXY !== '') {\n          fetchOptions.agent = new HttpsProxyAgent(process.env.PROXY);\n        }\n        const response = await fetch(EXEC_ENDPOINT, fetchOptions);\n        if (!response.ok) {\n          throw new Error(`HTTP error! status: ${response.status}`);\n        }\n\n        const result: t.ExecuteResult = await response.json();\n        let formattedOutput = '';\n        if (result.stdout) {\n          formattedOutput += `stdout:\\n${result.stdout}\\n`;\n        } else {\n          formattedOutput += emptyOutputMessage;\n        }\n        if (result.stderr) formattedOutput += `stderr:\\n${result.stderr}\\n`;\n        if (result.files && result.files.length > 0) {\n          formattedOutput += 'Generated files:\\n';\n\n          const fileCount = result.files.length;\n          for (let i = 0; i < fileCount; i++) {\n            const file = result.files[i];\n            const isImage = imageExtRegex.test(file.name);\n            formattedOutput += `- /mnt/data/${file.name} | ${isImage ? imageMessage : otherMessage}`;\n\n            if (i < fileCount - 1) {\n              formattedOutput += fileCount <= 3 ? ', ' : ',\\n';\n            }\n          }\n\n          formattedOutput += `\\n\\n${accessMessage}`;\n          return [\n            formattedOutput.trim(),\n            {\n              session_id: result.session_id,\n              files: result.files,\n            },\n          ];\n        }\n\n        return [formattedOutput.trim(), { session_id: result.session_id }];\n      } catch (error) {\n        throw new Error(\n          `Execution error:\\n\\n${(error as Error | undefined)?.message}`\n        );\n      }\n    },\n    {\n      name: BashExecutionToolName,\n      description: BashExecutionToolDescription,\n      schema: BashExecutionToolSchema,\n      responseFormat: Constants.CONTENT_AND_ARTIFACT,\n    }\n  );\n}\n\nexport { createBashExecutionTool };\n"],"names":[],"mappings":";;;;;;;;AASA,MAAM,EAAE;AAER,MAAM,YAAY,GAAG,wCAAwC;AAC7D,MAAM,YAAY,GAAG,wCAAwC;AAC7D,MAAM,aAAa,GACjB,uFAAuF;AACzF,MAAM,kBAAkB,GACtB,4DAA4D;AAE9D,MAAM,YAAY,GAAG,cAAc,EAAE;AACrC,MAAM,aAAa,GAAG,CAAA,EAAG,YAAY,OAAO;AAErC,MAAM,uBAAuB,GAAG;AACrC,IAAA,IAAI,EAAE,QAAQ;AACd,IAAA,UAAU,EAAE;AACV,QAAA,OAAO,EAAE;AACP,YAAA,IAAI,EAAE,QAAQ;AACd,YAAA,WAAW,EAAE,CAAA;;;;;;;AAOqC,uDAAA,CAAA;AACnD,SAAA;AACD,QAAA,IAAI,EAAE;AACJ,YAAA,IAAI,EAAE,OAAO;AACb,YAAA,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;AACzB,YAAA,WAAW,EACT,uIAAuI;AAC1I,SAAA;AACF,KAAA;IACD,QAAQ,EAAE,CAAC,SAAS,CAAC;;AAGhB,MAAM,4BAA4B,GAAG;;;;;;;CAO3C,CAAC,IAAI;AAEC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAExC,MAAM,2BAA2B,GAAG;AACzC,IAAA,IAAI,EAAE,qBAAqB;AAC3B,IAAA,WAAW,EAAE,4BAA4B;AACzC,IAAA,MAAM,EAAE,uBAAuB;;AAGjC,SAAS,uBAAuB,CAC9B,MAAA,GAAoC,EAAE,EAAA;AAEtC,IAAA,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;AAC3B,QAAA,MAAM,CAAC,MAAM;AACb,QAAA,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC;AAC3C,QAAA,EAAE;IACJ,IAAI,CAAC,MAAM,EAAE;AACX,QAAA,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC;IACjE;IAEA,OAAO,IAAI,CACT,OAAO,QAAQ,EAAE,MAAM,KAAI;QACzB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,QAG5B;AACD,QAAA,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,CAG7D;AAED,QAAA,MAAM,QAAQ,GAA4B;AACxC,YAAA,IAAI,EAAE,MAAM;AACZ,YAAA,IAAI,EAAE,OAAO;AACb,YAAA,GAAG,IAAI;AACP,YAAA,GAAG,MAAM;SACV;QAED,IAAI,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;AACjD,YAAA,QAAQ,CAAC,KAAK,GAAG,eAAe;QAClC;aAAO,IAAI,UAAU,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;AACtD,YAAA,IAAI;AACF,gBAAA,MAAM,aAAa,GAAG,CAAA,EAAG,YAAY,CAAA,OAAA,EAAU,UAAU,cAAc;AACvE,gBAAA,MAAM,YAAY,GAAgB;AAChC,oBAAA,MAAM,EAAE,KAAK;AACb,oBAAA,OAAO,EAAE;AACP,wBAAA,YAAY,EAAE,eAAe;AAC7B,wBAAA,WAAW,EAAE,MAAM;AACpB,qBAAA;iBACF;AAED,gBAAA,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,EAAE;AACzD,oBAAA,YAAY,CAAC,KAAK,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC7D;gBAEA,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC;AACzD,gBAAA,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAChB,MAAM,IAAI,KAAK,CACb,CAAA,mCAAA,EAAsC,QAAQ,CAAC,MAAM,CAAA,CAAE,CACxD;gBACH;AAEA,gBAAA,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE;AACnC,gBAAA,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC5C,MAAM,cAAc,GAAoB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,KAAI;wBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;wBACtC,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;wBAEjE,OAAO;4BACL,UAAU;4BACV,EAAE;AACF,4BAAA,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;yBACzC;AACH,oBAAA,CAAC,CAAC;AAEF,oBAAA,QAAQ,CAAC,KAAK,GAAG,cAAc;gBACjC;YACF;AAAE,YAAA,MAAM;;AAEN,gBAAA,OAAO,CAAC,IAAI,CAAC,sCAAsC,UAAU,CAAA,CAAE,CAAC;YAClE;QACF;AAEA,QAAA,IAAI;AACF,YAAA,MAAM,YAAY,GAAgB;AAChC,gBAAA,MAAM,EAAE,MAAM;AACd,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AAClC,oBAAA,YAAY,EAAE,eAAe;AAC7B,oBAAA,WAAW,EAAE,MAAM;AACpB,iBAAA;AACD,gBAAA,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;aAC/B;AAED,YAAA,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,EAAE;AACzD,gBAAA,YAAY,CAAC,KAAK,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7D;YACA,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC;AACzD,YAAA,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAChB,MAAM,IAAI,KAAK,CAAC,CAAA,oBAAA,EAAuB,QAAQ,CAAC,MAAM,CAAA,CAAE,CAAC;YAC3D;AAEA,YAAA,MAAM,MAAM,GAAoB,MAAM,QAAQ,CAAC,IAAI,EAAE;YACrD,IAAI,eAAe,GAAG,EAAE;AACxB,YAAA,IAAI,MAAM,CAAC,MAAM,EAAE;AACjB,gBAAA,eAAe,IAAI,CAAA,SAAA,EAAY,MAAM,CAAC,MAAM,IAAI;YAClD;iBAAO;gBACL,eAAe,IAAI,kBAAkB;YACvC;YACA,IAAI,MAAM,CAAC,MAAM;AAAE,gBAAA,eAAe,IAAI,CAAA,SAAA,EAAY,MAAM,CAAC,MAAM,IAAI;AACnE,YAAA,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC3C,eAAe,IAAI,oBAAoB;AAEvC,gBAAA,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;AACrC,gBAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE;oBAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7C,oBAAA,eAAe,IAAI,CAAA,YAAA,EAAe,IAAI,CAAC,IAAI,MAAM,OAAO,GAAG,YAAY,GAAG,YAAY,EAAE;AAExF,oBAAA,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE;AACrB,wBAAA,eAAe,IAAI,SAAS,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK;oBAClD;gBACF;AAEA,gBAAA,eAAe,IAAI,CAAA,IAAA,EAAO,aAAa,CAAA,CAAE;gBACzC,OAAO;oBACL,eAAe,CAAC,IAAI,EAAE;AACtB,oBAAA;wBACE,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;AACpB,qBAAA;iBACF;YACH;AAEA,YAAA,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QACpE;QAAE,OAAO,KAAK,EAAE;YACd,MAAM,IAAI,KAAK,CACb,CAAA,oBAAA,EAAwB,KAA2B,EAAE,OAAO,CAAA,CAAE,CAC/D;QACH;AACF,IAAA,CAAC,EACD;AACE,QAAA,IAAI,EAAE,qBAAqB;AAC3B,QAAA,WAAW,EAAE,4BAA4B;AACzC,QAAA,MAAM,EAAE,uBAAuB;QAC/B,cAAc,EAAE,SAAS,CAAC,oBAAoB;AAC/C,KAAA,CACF;AACH;;;;"}