@lov3kaizen/agentsea-core 1.1.0 → 1.2.0

package/dist/index.d.mts

@@ -198,6 +198,8 @@ declare class AnthropicProvider implements LLMProvider {
     streamResponse(messages: Message[], config: ProviderConfig): AsyncIterable<LLMStreamChunk>;
     parseToolCalls(response: LLMResponse): ToolCall[];
     private convertMessages;
+    private ensureToolUse;
+    private toolResultBlock;
 }
 
 declare class OpenAIProvider implements LLMProvider {

package/dist/index.d.ts

@@ -198,6 +198,8 @@ declare class AnthropicProvider implements LLMProvider {
     streamResponse(messages: Message[], config: ProviderConfig): AsyncIterable<LLMStreamChunk>;
     parseToolCalls(response: LLMResponse): ToolCall[];
     private convertMessages;
+    private ensureToolUse;
+    private toolResultBlock;
 }
 
 declare class OpenAIProvider implements LLMProvider {

package/dist/index.js

@@ -743,7 +743,7 @@ var ToolRegistry = class {
    * Sleep helper
    */
   sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+    return new Promise((resolve2) => setTimeout(resolve2, ms));
   }
 };
 
@@ -778,7 +778,49 @@ var calculatorTool = {
 };
 
 // src/tools/built-in/http-request.tool.ts
+var import_promises = require("dns/promises");
+var import_net = require("net");
 var import_zod2 = require("zod");
+function isPrivateIp(ip) {
+  const mapped = ip.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+  const addr = mapped ? mapped[1] : ip;
+  if ((0, import_net.isIP)(addr) === 4) {
+    const [a, b] = addr.split(".").map(Number);
+    return a === 0 || // 0.0.0.0/8
+    a === 10 || // 10.0.0.0/8 (private)
+    a === 127 || // 127.0.0.0/8 (loopback)
+    a === 169 && b === 254 || // 169.254.0.0/16 (link-local incl. cloud metadata)
+    a === 172 && b >= 16 && b <= 31 || // 172.16.0.0/12 (private)
+    a === 192 && b === 168 || // 192.168.0.0/16 (private)
+    a === 100 && b >= 64 && b <= 127 || // 100.64.0.0/10 (CGNAT)
+    a >= 224;
+  }
+  const lower = ip.toLowerCase();
+  return lower === "::1" || // loopback
+  lower === "::" || // unspecified
+  lower.startsWith("fe80:") || // link-local
+  lower.startsWith("fc") || // unique-local fc00::/7
+  lower.startsWith("fd");
+}
+async function assertPublicUrl(rawUrl) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error("Invalid URL");
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Blocked URL scheme: ${parsed.protocol}`);
+  }
+  const host = parsed.hostname;
+  if (host === "localhost") {
+    throw new Error("Blocked request to localhost");
+  }
+  const candidates = (0, import_net.isIP)(host) ? [host] : (await (0, import_promises.lookup)(host, { all: true })).map((r) => r.address);
+  if (candidates.some(isPrivateIp)) {
+    throw new Error(`Blocked request to non-public address for host "${host}"`);
+  }
+}
 var httpRequestTool = {
   name: "http_request",
   description: "Make HTTP requests to external APIs. Supports GET, POST, PUT, DELETE methods.",
@@ -790,6 +832,7 @@ var httpRequestTool = {
     timeout: import_zod2.z.number().optional().default(1e4).describe("Request timeout in milliseconds")
   }),
   execute: async (params) => {
+    await assertPublicUrl(params.url);
     const controller = new AbortController();
     const timeoutId = setTimeout(
       () => controller.abort(),
@@ -844,8 +887,21 @@ var httpRequestTool = {
 
 // src/tools/built-in/file-operations.tool.ts
 var import_fs = require("fs");
-var import_path = require("path");
+var import_path2 = require("path");
 var import_zod3 = require("zod");
+
+// src/tools/built-in/path-guard.ts
+var import_path = require("path");
+function resolveWithinRoot(inputPath) {
+  const root = (0, import_path.resolve)(process.env.AGENTSEA_FILE_ROOT || process.cwd());
+  const resolved = (0, import_path.resolve)(root, inputPath);
+  if (resolved !== root && !resolved.startsWith(root + import_path.sep)) {
+    throw new Error(`Path escapes the allowed root directory: ${inputPath}`);
+  }
+  return resolved;
+}
+
+// src/tools/built-in/file-operations.tool.ts
 var fileReadTool = {
   name: "file_read",
   description: "Read contents of a file from the file system",
@@ -855,11 +911,12 @@ var fileReadTool = {
   }),
   execute: async (params) => {
     try {
+      const safePath = resolveWithinRoot(params.path);
       const content = await import_fs.promises.readFile(
-        params.path,
+        safePath,
         params.encoding
       );
-      const stats = await import_fs.promises.stat(params.path);
+      const stats = await import_fs.promises.stat(safePath);
       return {
         content,
         size: stats.size,
@@ -885,23 +942,24 @@ var fileWriteTool = {
   }),
   execute: async (params) => {
     try {
+      const safePath = resolveWithinRoot(params.path);
       if (params.append) {
         await import_fs.promises.appendFile(
-          params.path,
+          safePath,
           params.content,
           params.encoding
         );
       } else {
         await import_fs.promises.writeFile(
-          params.path,
+          safePath,
           params.content,
           params.encoding
         );
       }
-      const stats = await import_fs.promises.stat(params.path);
+      const stats = await import_fs.promises.stat(safePath);
       return {
         success: true,
-        path: params.path,
+        path: safePath,
         size: stats.size,
         modified: stats.mtime
       };
@@ -922,10 +980,11 @@ var fileListTool = {
   }),
   execute: async (params) => {
     try {
-      const items = await import_fs.promises.readdir(params.path, { withFileTypes: true });
+      const safePath = resolveWithinRoot(params.path);
+      const items = await import_fs.promises.readdir(safePath, { withFileTypes: true });
       const results = [];
       for (const item of items) {
-        const fullPath = (0, import_path.join)(params.path, item.name);
+        const fullPath = (0, import_path2.join)(safePath, item.name);
         const stats = await import_fs.promises.stat(fullPath);
         results.push({
           name: item.name,
@@ -1444,7 +1503,7 @@ async function pollExecutionStatus(executionId, apiKey, baseUrl, maxAttempts = 3
       return execution;
     }
     if (attempt < maxAttempts - 1) {
-      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
     }
   }
   throw new Error(
@@ -1459,10 +1518,10 @@ var MAX_OUTPUT_BYTES = 100 * 1024;
 var DEFAULT_TIMEOUT_MS = 3e4;
 var MAX_TIMEOUT_MS = 12e4;
 var DANGEROUS_PATTERNS = [
-  /\brm\s+-[^\s]*r[^\s]*f[^\s]*\s+\/\s*$/,
-  // rm -rf /
-  /\brm\s+-[^\s]*f[^\s]*r[^\s]*\s+\/\s*$/,
-  // rm -fr /
+  /\brm\s+-[^\s]*r[^\s]*f[^\s]*\s+\/(\s|\*|$)/,
+  // rm -rf / , / * , /...
+  /\brm\s+-[^\s]*f[^\s]*r[^\s]*\s+\/(\s|\*|$)/,
+  // rm -fr / , / * , /...
   /\bmkfs\b/,
   // mkfs (format disk)
   /:(){ :\|:& };:/,
@@ -1478,7 +1537,7 @@ var DANGEROUS_PATTERNS = [
 ];
 var shellExecuteTool = {
   name: "shell_execute",
-  description: "Execute a shell command and return stdout/stderr. Commands are checked against a safety blocklist. Non-zero exit codes return results (not errors) since tools like grep exit 1 on no matches.",
+  description: "Execute a shell command and return stdout/stderr. A best-effort blocklist rejects a few obviously destructive commands, but this is NOT a security boundary \u2014 only enable this tool for trusted callers and prefer a sandboxed host. Non-zero exit codes return results (not errors) since tools like grep exit 1 on no matches.",
   parameters: import_zod7.z.object({
     command: import_zod7.z.string().describe("The shell command to execute"),
     cwd: import_zod7.z.string().optional().describe(
@@ -1555,13 +1614,14 @@ var codeEditTool = {
   }),
   execute: async (params) => {
     try {
-      const content = await import_fs2.promises.readFile(params.path, "utf8");
+      const safePath = resolveWithinRoot(params.path);
+      const content = await import_fs2.promises.readFile(safePath, "utf8");
       if (params.oldString === "") {
         const newContent2 = params.newString + content;
-        await import_fs2.promises.writeFile(params.path, newContent2, "utf8");
+        await import_fs2.promises.writeFile(safePath, newContent2, "utf8");
         return {
           success: true,
-          path: params.path,
+          path: safePath,
           replacements: 1,
           message: "Content inserted at beginning of file"
         };
@@ -1585,10 +1645,10 @@ var codeEditTool = {
         );
       }
       const newContent = content.split(params.oldString).join(params.newString);
-      await import_fs2.promises.writeFile(params.path, newContent, "utf8");
+      await import_fs2.promises.writeFile(safePath, newContent, "utf8");
       return {
         success: true,
-        path: params.path,
+        path: safePath,
         replacements: count,
         message: `Replaced ${count} occurrence(s)`
       };
@@ -1665,7 +1725,7 @@ var globTool = {
 
 // src/tools/built-in/grep.tool.ts
 var import_fs4 = require("fs");
-var import_path2 = require("path");
+var import_path3 = require("path");
 var import_zod10 = require("zod");
 var MAX_FILE_SIZE = 5 * 1024 * 1024;
 var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
@@ -1685,7 +1745,7 @@ async function walkDir(dir, includePattern) {
   for (const entry of entries) {
     if (DEFAULT_IGNORE_DIRS.has(entry.name)) continue;
     if (entry.name.startsWith(".") && entry.name !== ".env.example") continue;
-    const fullPath = (0, import_path2.join)(dir, entry.name);
+    const fullPath = (0, import_path3.join)(dir, entry.name);
     if (entry.isDirectory()) {
       const subResults = await walkDir(fullPath, includePattern);
       results.push(...subResults);
@@ -1761,7 +1821,7 @@ var grepTool = {
           );
           for (const match of matches) {
             if (allMatches.length >= params.maxResults) break;
-            match.file = stat.isFile() ? match.file : (0, import_path2.relative)(searchPath, match.file);
+            match.file = stat.isFile() ? match.file : (0, import_path3.relative)(searchPath, match.file);
             allMatches.push(match);
           }
         } catch {
@@ -1787,7 +1847,7 @@ var import_child_process2 = require("child_process");
 var import_zod11 = require("zod");
 var GIT_TIMEOUT_MS = 3e4;
 function gitExec(args, cwd) {
-  return (0, import_child_process2.execSync)(`git ${args}`, {
+  return (0, import_child_process2.execFileSync)("git", args, {
     cwd: cwd || process.cwd(),
     timeout: GIT_TIMEOUT_MS,
     encoding: "utf8",
@@ -1802,8 +1862,8 @@ var gitStatusTool = {
   }),
   execute: (params) => {
     try {
-      const output = gitExec("status --porcelain", params.cwd);
-      const branch = gitExec("branch --show-current", params.cwd);
+      const output = gitExec(["status", "--porcelain"], params.cwd);
+      const branch = gitExec(["branch", "--show-current"], params.cwd);
       const staged = [];
       const unstaged = [];
       const untracked = [];
@@ -1845,9 +1905,9 @@ var gitDiffTool = {
   }),
   execute: (params) => {
     try {
-      let args = "diff";
-      if (params.staged) args += " --cached";
-      if (params.path) args += ` -- ${params.path}`;
+      const args = ["diff"];
+      if (params.staged) args.push("--cached");
+      if (params.path) args.push("--", params.path);
       const output = gitExec(args, params.cwd);
       return Promise.resolve({
         diff: output,
@@ -1870,8 +1930,7 @@ var gitAddTool = {
   }),
   execute: (params) => {
     try {
-      const escapedPaths = params.paths.map((p) => `"${p}"`).join(" ");
-      gitExec(`add ${escapedPaths}`, params.cwd);
+      gitExec(["add", "--", ...params.paths], params.cwd);
       return Promise.resolve({
         success: true,
         added: params.paths
@@ -1893,8 +1952,7 @@ var gitCommitTool = {
   }),
   execute: (params) => {
     try {
-      const safeMessage = params.message.replace(/'/g, "'\\''");
-      const output = gitExec(`commit -m '${safeMessage}'`, params.cwd);
+      const output = gitExec(["commit", "-m", params.message], params.cwd);
       return Promise.resolve({
         success: true,
         output
@@ -1918,13 +1976,13 @@ var gitLogTool = {
   }),
   execute: (params) => {
     try {
-      let args = `log -${params.maxCount}`;
+      const args = ["log", `-${params.maxCount}`];
       if (params.oneline) {
-        args += " --oneline";
+        args.push("--oneline");
       } else {
-        args += " --format=%H%n%an%n%ae%n%ai%n%s%n---";
+        args.push("--format=%H%n%an%n%ae%n%ai%n%s%n---");
       }
-      if (params.path) args += ` -- ${params.path}`;
+      if (params.path) args.push("--", params.path);
       const output = gitExec(args, params.cwd);
       if (params.oneline) {
         const commits = output.split("\n").filter(Boolean).map((line) => {
@@ -1957,8 +2015,8 @@ var gitBranchTool = {
     try {
       switch (params.action) {
         case "list": {
-          const output = gitExec("branch -a", params.cwd);
-          const current = gitExec("branch --show-current", params.cwd);
+          const output = gitExec(["branch", "-a"], params.cwd);
+          const current = gitExec(["branch", "--show-current"], params.cwd);
           const branches = output.split("\n").filter(Boolean).map((b) => b.replace(/^\*?\s+/, "").trim());
           return Promise.resolve({ branches, current });
         }
@@ -1966,14 +2024,20 @@ var gitBranchTool = {
           if (!params.name) {
             throw new Error("Branch name is required for create action");
           }
-          gitExec(`branch ${params.name}`, params.cwd);
+          if (params.name.startsWith("-")) {
+            throw new Error("Invalid branch name");
+          }
+          gitExec(["branch", params.name], params.cwd);
           return Promise.resolve({ success: true, created: params.name });
         }
         case "switch": {
           if (!params.name) {
             throw new Error("Branch name is required for switch action");
           }
-          gitExec(`checkout ${params.name}`, params.cwd);
+          if (params.name.startsWith("-")) {
+            throw new Error("Invalid branch name");
+          }
+          gitExec(["checkout", params.name], params.cwd);
           return Promise.resolve({ success: true, switched: params.name });
         }
       }
@@ -2278,17 +2342,28 @@ var AnthropicProvider = class {
         continue;
       }
       if (message.role === "tool") {
-        const lastMessage = converted[converted.length - 1];
-        if (lastMessage && lastMessage.role === "assistant") {
-          const content = lastMessage.content;
-          if (Array.isArray(content)) {
-            content.push({
-              type: "tool_result",
-              tool_use_id: message.toolCallId || "",
-              content: message.content
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            });
+        const toolUseId = message.toolCallId || "";
+        const resultBlock = this.toolResultBlock(toolUseId, message.content);
+        const prev = converted[converted.length - 1];
+        if (prev && prev.role === "user" && Array.isArray(prev.content) && prev.content.some((b) => b.type === "tool_result")) {
+          const assistant = converted[converted.length - 2];
+          if (assistant && assistant.role === "assistant") {
+            assistant.content = this.ensureToolUse(
+              assistant.content,
+              toolUseId,
+              message.name
+            );
           }
+          prev.content.push(resultBlock);
+        } else if (prev && prev.role === "assistant") {
+          prev.content = this.ensureToolUse(
+            prev.content,
+            toolUseId,
+            message.name
+          );
+          converted.push({ role: "user", content: [resultBlock] });
+        } else {
+          converted.push({ role: "user", content: [resultBlock] });
         }
         continue;
       }
@@ -2299,6 +2374,20 @@ var AnthropicProvider = class {
     }
     return converted;
   }
+  /**
+   * Ensure an assistant message's content is a block array that includes a
+   * `tool_use` block with the given id, backfilling one if missing.
+   */
+  ensureToolUse(content, id, name) {
+    const blocks = typeof content === "string" ? content ? [{ type: "text", text: content }] : [] : [...content];
+    if (!blocks.some((b) => b.type === "tool_use" && b.id === id)) {
+      blocks.push({ type: "tool_use", id, name: name || "tool", input: {} });
+    }
+    return blocks;
+  }
+  toolResultBlock(toolUseId, content) {
+    return { type: "tool_result", tool_use_id: toolUseId, content };
+  }
 };
 
 // src/providers/openai.ts
@@ -3560,7 +3649,7 @@ var Workflow = class {
         if (attempt < maxAttempts && initialDelayMs > 0) {
           const raw = backoff === "linear" ? initialDelayMs * attempt : initialDelayMs * 2 ** (attempt - 1);
           await new Promise(
-            (resolve) => setTimeout(resolve, Math.min(raw, maxDelayMs))
+            (resolve2) => setTimeout(resolve2, Math.min(raw, maxDelayMs))
           );
         }
       }
@@ -4152,7 +4241,7 @@ var RateLimiter = class {
    * Sleep helper
    */
   sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+    return new Promise((resolve2) => setTimeout(resolve2, ms));
   }
 };
 var SlidingWindowRateLimiter = class {
@@ -4384,7 +4473,7 @@ var StdioTransport = class extends import_events.EventEmitter {
   connected = false;
   buffer = "";
   async connect() {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         this.process = (0, import_child_process3.spawn)(this.command, this.args, {
           env: { ...process.env, ...this.env },
@@ -4407,7 +4496,7 @@ var StdioTransport = class extends import_events.EventEmitter {
         });
         this.connected = true;
         this.emit("connect");
-        resolve();
+        resolve2();
       } catch (error) {
         reject(error);
       }
@@ -4455,7 +4544,7 @@ var SSETransport = class extends import_events.EventEmitter {
   eventSource = null;
   connected = false;
   async connect() {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         if (typeof EventSource === "undefined") {
           throw new Error(
@@ -4466,7 +4555,7 @@ var SSETransport = class extends import_events.EventEmitter {
         this.eventSource.onopen = () => {
           this.connected = true;
           this.emit("connect");
-          resolve();
+          resolve2();
         };
         this.eventSource.onmessage = (event) => {
           try {
@@ -4677,9 +4766,9 @@ var MCPClient = class extends import_events2.EventEmitter {
     if (!this.transport || !this.transport.isConnected()) {
       throw new Error("Not connected to MCP server");
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const id = message.id;
-      this.pendingRequests.set(id, { resolve, reject });
+      this.pendingRequests.set(id, { resolve: resolve2, reject });
       try {
         this.transport.send(message);
       } catch (error) {
@@ -5814,7 +5903,7 @@ Respond naturally while ensuring you gather the required information.`;
 
 // src/voice/voice-agent.ts
 var import_fs5 = require("fs");
-var import_path3 = require("path");
+var import_path4 = require("path");
 var VoiceAgent = class {
   agent;
   sttProvider;
@@ -5978,10 +6067,10 @@ var VoiceAgent = class {
   exportConversation(outputDir) {
     for (let i = 0; i < this.conversationHistory.length; i++) {
       const message = this.conversationHistory[i];
-      const textPath = (0, import_path3.join)(outputDir, `${i}-${message.role}.txt`);
+      const textPath = (0, import_path4.join)(outputDir, `${i}-${message.role}.txt`);
       (0, import_fs5.writeFileSync)(textPath, message.text);
       if (message.audio) {
-        const audioPath = (0, import_path3.join)(outputDir, `${i}-${message.role}.mp3`);
+        const audioPath = (0, import_path4.join)(outputDir, `${i}-${message.role}.mp3`);
         (0, import_fs5.writeFileSync)(audioPath, message.audio);
       }
     }
@@ -6202,9 +6291,9 @@ var OpenAIWhisperProvider = class {
 var import_child_process4 = require("child_process");
 var import_fs7 = require("fs");
 var import_os = require("os");
-var import_path4 = require("path");
+var import_path5 = require("path");
 var import_util = require("util");
-var execAsync = (0, import_util.promisify)(import_child_process4.exec);
+var execFileAsync = (0, import_util.promisify)(import_child_process4.execFile);
 var LocalWhisperProvider = class {
   whisperPath;
   modelPath;
@@ -6220,7 +6309,7 @@ var LocalWhisperProvider = class {
     let isTemporary = false;
     try {
       if (Buffer.isBuffer(audio)) {
-        audioPath = (0, import_path4.join)((0, import_os.tmpdir)(), `audio-${Date.now()}.wav`);
+        audioPath = (0, import_path5.join)((0, import_os.tmpdir)(), `audio-${Date.now()}.wav`);
         (0, import_fs7.writeFileSync)(audioPath, audio);
         isTemporary = true;
       } else {
@@ -6230,16 +6319,23 @@ var LocalWhisperProvider = class {
         throw new Error(`Audio file not found: ${audioPath}`);
       }
       const model = config?.model || "base";
-      const language = config?.language ? `--language ${config.language}` : "";
+      const languageArgs = config?.language ? ["--language", config.language] : [];
       const outputFormat = config?.responseFormat || "txt";
-      let command;
+      let args;
       if (this.whisperPath.includes("whisper.cpp")) {
         const modelFile = this.modelPath || `ggml-${model}.bin`;
-        command = `${this.whisperPath} -m ${modelFile} ${language} -otxt "${audioPath}"`;
+        args = ["-m", modelFile, ...languageArgs, "-otxt", audioPath];
       } else {
-        command = `${this.whisperPath} "${audioPath}" --model ${model} ${language} --output_format ${outputFormat}`;
-      }
-      const { stdout } = await execAsync(command, {
+        args = [
+          audioPath,
+          "--model",
+          model,
+          ...languageArgs,
+          "--output_format",
+          outputFormat
+        ];
+      }
+      const { stdout } = await execFileAsync(this.whisperPath, args, {
         maxBuffer: 10 * 1024 * 1024
         // 10MB buffer
       });
@@ -6281,7 +6377,7 @@ var LocalWhisperProvider = class {
    */
   async isInstalled() {
     try {
-      await execAsync(`${this.whisperPath} --help`);
+      await execFileAsync(this.whisperPath, ["--help"]);
       return true;
     } catch {
       return false;
@@ -6587,9 +6683,9 @@ var ElevenLabsTTSProvider = class {
 var import_child_process5 = require("child_process");
 var import_fs8 = require("fs");
 var import_os2 = require("os");
-var import_path5 = require("path");
+var import_path6 = require("path");
 var import_util2 = require("util");
-var execAsync2 = (0, import_util2.promisify)(import_child_process5.exec);
+var execFileAsync2 = (0, import_util2.promisify)(import_child_process5.execFile);
 var PiperTTSProvider = class {
   piperPath;
   modelPath;
@@ -6603,26 +6699,40 @@ var PiperTTSProvider = class {
    * Synthesize text to speech
    */
   async synthesize(text, config) {
+    const outputPath = (0, import_path6.join)((0, import_os2.tmpdir)(), `speech-${Date.now()}.wav`);
     try {
-      const outputPath = (0, import_path5.join)((0, import_os2.tmpdir)(), `speech-${Date.now()}.wav`);
       const model = this.modelPath || config?.model;
       if (!model) {
         throw new Error("Model path is required for Piper TTS");
       }
       const modelConfig = this.configPath || model.replace(".onnx", ".json");
-      const textPath = (0, import_path5.join)((0, import_os2.tmpdir)(), `text-${Date.now()}.txt`);
-      (0, import_fs8.writeFileSync)(textPath, text, "utf-8");
-      const command = `${this.piperPath} --model ${model} --config ${modelConfig} --output_file ${outputPath} < ${textPath}`;
-      await execAsync2(command, {
-        maxBuffer: 50 * 1024 * 1024
-        // 50MB buffer
+      const args = [
+        "--model",
+        model,
+        "--config",
+        modelConfig,
+        "--output_file",
+        outputPath
+      ];
+      await new Promise((resolve2, reject) => {
+        const child = (0, import_child_process5.spawn)(this.piperPath, args, {
+          stdio: ["pipe", "ignore", "pipe"]
+        });
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => {
+          stderr += String(chunk);
+        });
+        child.on("error", reject);
+        child.on("close", (code) => {
+          if (code === 0) resolve2();
+          else reject(new Error(`piper exited with code ${code}: ${stderr}`));
+        });
+        child.stdin?.end(text);
       });
       if (!(0, import_fs8.existsSync)(outputPath)) {
         throw new Error("Piper failed to generate audio file");
       }
       const audio = (0, import_fs8.readFileSync)(outputPath);
-      (0, import_fs8.unlinkSync)(outputPath);
-      (0, import_fs8.unlinkSync)(textPath);
       return {
         audio,
         format: "wav",
@@ -6632,6 +6742,10 @@ var PiperTTSProvider = class {
       throw new Error(
         `Piper TTS synthesis failed: ${error instanceof Error ? error.message : String(error)}`
       );
+    } finally {
+      if ((0, import_fs8.existsSync)(outputPath)) {
+        (0, import_fs8.unlinkSync)(outputPath);
+      }
     }
   }
   /**
@@ -6645,7 +6759,7 @@ var PiperTTSProvider = class {
    */
   async isInstalled() {
     try {
-      await execAsync2(`${this.piperPath} --version`);
+      await execFileAsync2(this.piperPath, ["--version"]);
       return true;
     } catch {
       return false;

package/dist/index.mjs

@@ -731,7 +731,7 @@ var ToolRegistry = class {
    * Sleep helper
    */
   sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+    return new Promise((resolve2) => setTimeout(resolve2, ms));
   }
 };
 
@@ -766,7 +766,49 @@ var calculatorTool = {
 };
 
 // src/tools/built-in/http-request.tool.ts
+import { lookup } from "dns/promises";
+import { isIP } from "net";
 import { z as z2 } from "zod";
+function isPrivateIp(ip) {
+  const mapped = ip.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+  const addr = mapped ? mapped[1] : ip;
+  if (isIP(addr) === 4) {
+    const [a, b] = addr.split(".").map(Number);
+    return a === 0 || // 0.0.0.0/8
+    a === 10 || // 10.0.0.0/8 (private)
+    a === 127 || // 127.0.0.0/8 (loopback)
+    a === 169 && b === 254 || // 169.254.0.0/16 (link-local incl. cloud metadata)
+    a === 172 && b >= 16 && b <= 31 || // 172.16.0.0/12 (private)
+    a === 192 && b === 168 || // 192.168.0.0/16 (private)
+    a === 100 && b >= 64 && b <= 127 || // 100.64.0.0/10 (CGNAT)
+    a >= 224;
+  }
+  const lower = ip.toLowerCase();
+  return lower === "::1" || // loopback
+  lower === "::" || // unspecified
+  lower.startsWith("fe80:") || // link-local
+  lower.startsWith("fc") || // unique-local fc00::/7
+  lower.startsWith("fd");
+}
+async function assertPublicUrl(rawUrl) {
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error("Invalid URL");
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Blocked URL scheme: ${parsed.protocol}`);
+  }
+  const host = parsed.hostname;
+  if (host === "localhost") {
+    throw new Error("Blocked request to localhost");
+  }
+  const candidates = isIP(host) ? [host] : (await lookup(host, { all: true })).map((r) => r.address);
+  if (candidates.some(isPrivateIp)) {
+    throw new Error(`Blocked request to non-public address for host "${host}"`);
+  }
+}
 var httpRequestTool = {
   name: "http_request",
   description: "Make HTTP requests to external APIs. Supports GET, POST, PUT, DELETE methods.",
@@ -778,6 +820,7 @@ var httpRequestTool = {
     timeout: z2.number().optional().default(1e4).describe("Request timeout in milliseconds")
   }),
   execute: async (params) => {
+    await assertPublicUrl(params.url);
     const controller = new AbortController();
     const timeoutId = setTimeout(
       () => controller.abort(),
@@ -834,6 +877,19 @@ var httpRequestTool = {
 import { promises as fs } from "fs";
 import { join } from "path";
 import { z as z3 } from "zod";
+
+// src/tools/built-in/path-guard.ts
+import { resolve, sep } from "path";
+function resolveWithinRoot(inputPath) {
+  const root = resolve(process.env.AGENTSEA_FILE_ROOT || process.cwd());
+  const resolved = resolve(root, inputPath);
+  if (resolved !== root && !resolved.startsWith(root + sep)) {
+    throw new Error(`Path escapes the allowed root directory: ${inputPath}`);
+  }
+  return resolved;
+}
+
+// src/tools/built-in/file-operations.tool.ts
 var fileReadTool = {
   name: "file_read",
   description: "Read contents of a file from the file system",
@@ -843,11 +899,12 @@ var fileReadTool = {
   }),
   execute: async (params) => {
     try {
+      const safePath = resolveWithinRoot(params.path);
       const content = await fs.readFile(
-        params.path,
+        safePath,
         params.encoding
       );
-      const stats = await fs.stat(params.path);
+      const stats = await fs.stat(safePath);
       return {
         content,
         size: stats.size,
@@ -873,23 +930,24 @@ var fileWriteTool = {
   }),
   execute: async (params) => {
     try {
+      const safePath = resolveWithinRoot(params.path);
       if (params.append) {
         await fs.appendFile(
-          params.path,
+          safePath,
           params.content,
           params.encoding
         );
       } else {
         await fs.writeFile(
-          params.path,
+          safePath,
           params.content,
           params.encoding
         );
       }
-      const stats = await fs.stat(params.path);
+      const stats = await fs.stat(safePath);
       return {
         success: true,
-        path: params.path,
+        path: safePath,
         size: stats.size,
         modified: stats.mtime
       };
@@ -910,10 +968,11 @@ var fileListTool = {
   }),
   execute: async (params) => {
     try {
-      const items = await fs.readdir(params.path, { withFileTypes: true });
+      const safePath = resolveWithinRoot(params.path);
+      const items = await fs.readdir(safePath, { withFileTypes: true });
       const results = [];
       for (const item of items) {
-        const fullPath = join(params.path, item.name);
+        const fullPath = join(safePath, item.name);
         const stats = await fs.stat(fullPath);
         results.push({
           name: item.name,
@@ -1432,7 +1491,7 @@ async function pollExecutionStatus(executionId, apiKey, baseUrl, maxAttempts = 3
       return execution;
     }
     if (attempt < maxAttempts - 1) {
-      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
     }
   }
   throw new Error(
@@ -1447,10 +1506,10 @@ var MAX_OUTPUT_BYTES = 100 * 1024;
 var DEFAULT_TIMEOUT_MS = 3e4;
 var MAX_TIMEOUT_MS = 12e4;
 var DANGEROUS_PATTERNS = [
-  /\brm\s+-[^\s]*r[^\s]*f[^\s]*\s+\/\s*$/,
-  // rm -rf /
-  /\brm\s+-[^\s]*f[^\s]*r[^\s]*\s+\/\s*$/,
-  // rm -fr /
+  /\brm\s+-[^\s]*r[^\s]*f[^\s]*\s+\/(\s|\*|$)/,
+  // rm -rf / , / * , /...
+  /\brm\s+-[^\s]*f[^\s]*r[^\s]*\s+\/(\s|\*|$)/,
+  // rm -fr / , / * , /...
   /\bmkfs\b/,
   // mkfs (format disk)
   /:(){ :\|:& };:/,
@@ -1466,7 +1525,7 @@ var DANGEROUS_PATTERNS = [
 ];
 var shellExecuteTool = {
   name: "shell_execute",
-  description: "Execute a shell command and return stdout/stderr. Commands are checked against a safety blocklist. Non-zero exit codes return results (not errors) since tools like grep exit 1 on no matches.",
+  description: "Execute a shell command and return stdout/stderr. A best-effort blocklist rejects a few obviously destructive commands, but this is NOT a security boundary \u2014 only enable this tool for trusted callers and prefer a sandboxed host. Non-zero exit codes return results (not errors) since tools like grep exit 1 on no matches.",
   parameters: z7.object({
     command: z7.string().describe("The shell command to execute"),
     cwd: z7.string().optional().describe(
@@ -1543,13 +1602,14 @@ var codeEditTool = {
   }),
   execute: async (params) => {
     try {
-      const content = await fs2.readFile(params.path, "utf8");
+      const safePath = resolveWithinRoot(params.path);
+      const content = await fs2.readFile(safePath, "utf8");
       if (params.oldString === "") {
         const newContent2 = params.newString + content;
-        await fs2.writeFile(params.path, newContent2, "utf8");
+        await fs2.writeFile(safePath, newContent2, "utf8");
         return {
           success: true,
-          path: params.path,
+          path: safePath,
           replacements: 1,
           message: "Content inserted at beginning of file"
         };
@@ -1573,10 +1633,10 @@ var codeEditTool = {
         );
       }
       const newContent = content.split(params.oldString).join(params.newString);
-      await fs2.writeFile(params.path, newContent, "utf8");
+      await fs2.writeFile(safePath, newContent, "utf8");
       return {
         success: true,
-        path: params.path,
+        path: safePath,
         replacements: count,
         message: `Replaced ${count} occurrence(s)`
       };
@@ -1771,11 +1831,11 @@ var grepTool = {
 };
 
 // src/tools/built-in/git.tool.ts
-import { execSync as execSync2 } from "child_process";
+import { execFileSync } from "child_process";
 import { z as z11 } from "zod";
 var GIT_TIMEOUT_MS = 3e4;
 function gitExec(args, cwd) {
-  return execSync2(`git ${args}`, {
+  return execFileSync("git", args, {
     cwd: cwd || process.cwd(),
     timeout: GIT_TIMEOUT_MS,
     encoding: "utf8",
@@ -1790,8 +1850,8 @@ var gitStatusTool = {
   }),
   execute: (params) => {
     try {
-      const output = gitExec("status --porcelain", params.cwd);
-      const branch = gitExec("branch --show-current", params.cwd);
+      const output = gitExec(["status", "--porcelain"], params.cwd);
+      const branch = gitExec(["branch", "--show-current"], params.cwd);
       const staged = [];
       const unstaged = [];
       const untracked = [];
@@ -1833,9 +1893,9 @@ var gitDiffTool = {
   }),
   execute: (params) => {
     try {
-      let args = "diff";
-      if (params.staged) args += " --cached";
-      if (params.path) args += ` -- ${params.path}`;
+      const args = ["diff"];
+      if (params.staged) args.push("--cached");
+      if (params.path) args.push("--", params.path);
       const output = gitExec(args, params.cwd);
       return Promise.resolve({
         diff: output,
@@ -1858,8 +1918,7 @@ var gitAddTool = {
   }),
   execute: (params) => {
     try {
-      const escapedPaths = params.paths.map((p) => `"${p}"`).join(" ");
-      gitExec(`add ${escapedPaths}`, params.cwd);
+      gitExec(["add", "--", ...params.paths], params.cwd);
       return Promise.resolve({
         success: true,
         added: params.paths
@@ -1881,8 +1940,7 @@ var gitCommitTool = {
   }),
   execute: (params) => {
     try {
-      const safeMessage = params.message.replace(/'/g, "'\\''");
-      const output = gitExec(`commit -m '${safeMessage}'`, params.cwd);
+      const output = gitExec(["commit", "-m", params.message], params.cwd);
       return Promise.resolve({
         success: true,
         output
@@ -1906,13 +1964,13 @@ var gitLogTool = {
   }),
   execute: (params) => {
     try {
-      let args = `log -${params.maxCount}`;
+      const args = ["log", `-${params.maxCount}`];
       if (params.oneline) {
-        args += " --oneline";
+        args.push("--oneline");
       } else {
-        args += " --format=%H%n%an%n%ae%n%ai%n%s%n---";
+        args.push("--format=%H%n%an%n%ae%n%ai%n%s%n---");
       }
-      if (params.path) args += ` -- ${params.path}`;
+      if (params.path) args.push("--", params.path);
       const output = gitExec(args, params.cwd);
       if (params.oneline) {
         const commits = output.split("\n").filter(Boolean).map((line) => {
@@ -1945,8 +2003,8 @@ var gitBranchTool = {
     try {
       switch (params.action) {
         case "list": {
-          const output = gitExec("branch -a", params.cwd);
-          const current = gitExec("branch --show-current", params.cwd);
+          const output = gitExec(["branch", "-a"], params.cwd);
+          const current = gitExec(["branch", "--show-current"], params.cwd);
           const branches = output.split("\n").filter(Boolean).map((b) => b.replace(/^\*?\s+/, "").trim());
           return Promise.resolve({ branches, current });
         }
@@ -1954,14 +2012,20 @@ var gitBranchTool = {
           if (!params.name) {
             throw new Error("Branch name is required for create action");
           }
-          gitExec(`branch ${params.name}`, params.cwd);
+          if (params.name.startsWith("-")) {
+            throw new Error("Invalid branch name");
+          }
+          gitExec(["branch", params.name], params.cwd);
           return Promise.resolve({ success: true, created: params.name });
         }
         case "switch": {
           if (!params.name) {
             throw new Error("Branch name is required for switch action");
           }
-          gitExec(`checkout ${params.name}`, params.cwd);
+          if (params.name.startsWith("-")) {
+            throw new Error("Invalid branch name");
+          }
+          gitExec(["checkout", params.name], params.cwd);
           return Promise.resolve({ success: true, switched: params.name });
         }
       }
@@ -2266,17 +2330,28 @@ var AnthropicProvider = class {
         continue;
       }
       if (message.role === "tool") {
-        const lastMessage = converted[converted.length - 1];
-        if (lastMessage && lastMessage.role === "assistant") {
-          const content = lastMessage.content;
-          if (Array.isArray(content)) {
-            content.push({
-              type: "tool_result",
-              tool_use_id: message.toolCallId || "",
-              content: message.content
-              // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            });
+        const toolUseId = message.toolCallId || "";
+        const resultBlock = this.toolResultBlock(toolUseId, message.content);
+        const prev = converted[converted.length - 1];
+        if (prev && prev.role === "user" && Array.isArray(prev.content) && prev.content.some((b) => b.type === "tool_result")) {
+          const assistant = converted[converted.length - 2];
+          if (assistant && assistant.role === "assistant") {
+            assistant.content = this.ensureToolUse(
+              assistant.content,
+              toolUseId,
+              message.name
+            );
           }
+          prev.content.push(resultBlock);
+        } else if (prev && prev.role === "assistant") {
+          prev.content = this.ensureToolUse(
+            prev.content,
+            toolUseId,
+            message.name
+          );
+          converted.push({ role: "user", content: [resultBlock] });
+        } else {
+          converted.push({ role: "user", content: [resultBlock] });
         }
         continue;
       }
@@ -2287,6 +2362,20 @@ var AnthropicProvider = class {
     }
     return converted;
   }
+  /**
+   * Ensure an assistant message's content is a block array that includes a
+   * `tool_use` block with the given id, backfilling one if missing.
+   */
+  ensureToolUse(content, id, name) {
+    const blocks = typeof content === "string" ? content ? [{ type: "text", text: content }] : [] : [...content];
+    if (!blocks.some((b) => b.type === "tool_use" && b.id === id)) {
+      blocks.push({ type: "tool_use", id, name: name || "tool", input: {} });
+    }
+    return blocks;
+  }
+  toolResultBlock(toolUseId, content) {
+    return { type: "tool_result", tool_use_id: toolUseId, content };
+  }
 };
 
 // src/providers/openai.ts
@@ -3550,7 +3639,7 @@ var Workflow = class {
         if (attempt < maxAttempts && initialDelayMs > 0) {
           const raw = backoff === "linear" ? initialDelayMs * attempt : initialDelayMs * 2 ** (attempt - 1);
           await new Promise(
-            (resolve) => setTimeout(resolve, Math.min(raw, maxDelayMs))
+            (resolve2) => setTimeout(resolve2, Math.min(raw, maxDelayMs))
           );
         }
       }
@@ -4142,7 +4231,7 @@ var RateLimiter = class {
    * Sleep helper
    */
   sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+    return new Promise((resolve2) => setTimeout(resolve2, ms));
   }
 };
 var SlidingWindowRateLimiter = class {
@@ -4374,7 +4463,7 @@ var StdioTransport = class extends EventEmitter {
   connected = false;
   buffer = "";
   async connect() {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         this.process = spawn(this.command, this.args, {
           env: { ...process.env, ...this.env },
@@ -4397,7 +4486,7 @@ var StdioTransport = class extends EventEmitter {
         });
         this.connected = true;
         this.emit("connect");
-        resolve();
+        resolve2();
       } catch (error) {
         reject(error);
       }
@@ -4445,7 +4534,7 @@ var SSETransport = class extends EventEmitter {
   eventSource = null;
   connected = false;
   async connect() {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         if (typeof EventSource === "undefined") {
           throw new Error(
@@ -4456,7 +4545,7 @@ var SSETransport = class extends EventEmitter {
         this.eventSource.onopen = () => {
           this.connected = true;
           this.emit("connect");
-          resolve();
+          resolve2();
         };
         this.eventSource.onmessage = (event) => {
           try {
@@ -4667,9 +4756,9 @@ var MCPClient = class extends EventEmitter2 {
     if (!this.transport || !this.transport.isConnected()) {
       throw new Error("Not connected to MCP server");
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const id = message.id;
-      this.pendingRequests.set(id, { resolve, reject });
+      this.pendingRequests.set(id, { resolve: resolve2, reject });
       try {
         this.transport.send(message);
       } catch (error) {
@@ -6189,12 +6278,12 @@ var OpenAIWhisperProvider = class {
 };
 
 // src/voice/stt/local-whisper.ts
-import { exec } from "child_process";
+import { execFile } from "child_process";
 import { writeFileSync as writeFileSync2, unlinkSync, existsSync } from "fs";
 import { tmpdir } from "os";
 import { join as join4 } from "path";
 import { promisify } from "util";
-var execAsync = promisify(exec);
+var execFileAsync = promisify(execFile);
 var LocalWhisperProvider = class {
   whisperPath;
   modelPath;
@@ -6220,16 +6309,23 @@ var LocalWhisperProvider = class {
         throw new Error(`Audio file not found: ${audioPath}`);
       }
       const model = config?.model || "base";
-      const language = config?.language ? `--language ${config.language}` : "";
+      const languageArgs = config?.language ? ["--language", config.language] : [];
       const outputFormat = config?.responseFormat || "txt";
-      let command;
+      let args;
       if (this.whisperPath.includes("whisper.cpp")) {
         const modelFile = this.modelPath || `ggml-${model}.bin`;
-        command = `${this.whisperPath} -m ${modelFile} ${language} -otxt "${audioPath}"`;
+        args = ["-m", modelFile, ...languageArgs, "-otxt", audioPath];
       } else {
-        command = `${this.whisperPath} "${audioPath}" --model ${model} ${language} --output_format ${outputFormat}`;
-      }
-      const { stdout } = await execAsync(command, {
+        args = [
+          audioPath,
+          "--model",
+          model,
+          ...languageArgs,
+          "--output_format",
+          outputFormat
+        ];
+      }
+      const { stdout } = await execFileAsync(this.whisperPath, args, {
         maxBuffer: 10 * 1024 * 1024
         // 10MB buffer
       });
@@ -6271,7 +6367,7 @@ var LocalWhisperProvider = class {
    */
   async isInstalled() {
     try {
-      await execAsync(`${this.whisperPath} --help`);
+      await execFileAsync(this.whisperPath, ["--help"]);
       return true;
     } catch {
       return false;
@@ -6574,12 +6670,12 @@ var ElevenLabsTTSProvider = class {
 };
 
 // src/voice/tts/piper-tts.ts
-import { exec as exec2 } from "child_process";
-import { writeFileSync as writeFileSync3, readFileSync, unlinkSync as unlinkSync2, existsSync as existsSync2 } from "fs";
+import { execFile as execFile2, spawn as spawn2 } from "child_process";
+import { readFileSync, unlinkSync as unlinkSync2, existsSync as existsSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join5 } from "path";
 import { promisify as promisify2 } from "util";
-var execAsync2 = promisify2(exec2);
+var execFileAsync2 = promisify2(execFile2);
 var PiperTTSProvider = class {
   piperPath;
   modelPath;
@@ -6593,26 +6689,40 @@ var PiperTTSProvider = class {
    * Synthesize text to speech
    */
   async synthesize(text, config) {
+    const outputPath = join5(tmpdir2(), `speech-${Date.now()}.wav`);
     try {
-      const outputPath = join5(tmpdir2(), `speech-${Date.now()}.wav`);
       const model = this.modelPath || config?.model;
       if (!model) {
         throw new Error("Model path is required for Piper TTS");
       }
       const modelConfig = this.configPath || model.replace(".onnx", ".json");
-      const textPath = join5(tmpdir2(), `text-${Date.now()}.txt`);
-      writeFileSync3(textPath, text, "utf-8");
-      const command = `${this.piperPath} --model ${model} --config ${modelConfig} --output_file ${outputPath} < ${textPath}`;
-      await execAsync2(command, {
-        maxBuffer: 50 * 1024 * 1024
-        // 50MB buffer
+      const args = [
+        "--model",
+        model,
+        "--config",
+        modelConfig,
+        "--output_file",
+        outputPath
+      ];
+      await new Promise((resolve2, reject) => {
+        const child = spawn2(this.piperPath, args, {
+          stdio: ["pipe", "ignore", "pipe"]
+        });
+        let stderr = "";
+        child.stderr?.on("data", (chunk) => {
+          stderr += String(chunk);
+        });
+        child.on("error", reject);
+        child.on("close", (code) => {
+          if (code === 0) resolve2();
+          else reject(new Error(`piper exited with code ${code}: ${stderr}`));
+        });
+        child.stdin?.end(text);
       });
       if (!existsSync2(outputPath)) {
         throw new Error("Piper failed to generate audio file");
       }
       const audio = readFileSync(outputPath);
-      unlinkSync2(outputPath);
-      unlinkSync2(textPath);
       return {
         audio,
         format: "wav",
@@ -6622,6 +6732,10 @@ var PiperTTSProvider = class {
       throw new Error(
         `Piper TTS synthesis failed: ${error instanceof Error ? error.message : String(error)}`
       );
+    } finally {
+      if (existsSync2(outputPath)) {
+        unlinkSync2(outputPath);
+      }
     }
   }
   /**
@@ -6635,7 +6749,7 @@ var PiperTTSProvider = class {
    */
   async isInstalled() {
     try {
-      await execAsync2(`${this.piperPath} --version`);
+      await execFileAsync2(this.piperPath, ["--version"]);
       return true;
     } catch {
       return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lov3kaizen/agentsea-core",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "AgentSea - Unite and orchestrate AI agents. A production-ready ADK for building agentic AI applications with multi-provider support.",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -25,7 +25,7 @@
     "winston": "^3.19.0",
     "ioredis": "^5.11.1",
     "marked": "^12.0.2",
-    "@lov3kaizen/agentsea-types": "1.1.0"
+    "@lov3kaizen/agentsea-types": "1.2.0"
   },
   "devDependencies": {
     "@types/node": "^20.19.0",