@mastra/code-sdk 1.0.3-alpha.1 → 1.1.0-alpha.2

package/dist/tool-names.js

@@ -1,43 +1,52 @@
 import { WORKSPACE_TOOLS } from "@mastra/core/workspace";
+//#region src/tool-names.ts
+/**
+* Mastracode tool name constants.
+*
+* These are the names exposed to the LLM via workspace tool name remapping.
+* Used throughout mastracode for permissions, TUI rendering, tool guidance,
+* subagent allowedTools, etc.
+*
+* The workspace tools get remapped from their core names (e.g. `mastra_workspace_read_file`)
+* to these names (e.g. `view`) via the `name` property in workspace tool config.
+*/
 const MC_TOOLS = {
-  // Filesystem
-  VIEW: "view",
-  WRITE_FILE: "write_file",
-  STRING_REPLACE_LSP: "string_replace_lsp",
-  FIND_FILES: "find_files",
-  DELETE_FILE: "delete_file",
-  FILE_STAT: "file_stat",
-  MKDIR: "mkdir",
-  // Search
-  SEARCH_CONTENT: "search_content",
-  // Code intelligence
-  AST_SMART_EDIT: "ast_smart_edit",
-  // Sandbox
-  EXECUTE_COMMAND: "execute_command",
-  GET_PROCESS_OUTPUT: "get_process_output",
-  KILL_PROCESS: "kill_process",
-  // Code intelligence
-  LSP_INSPECT: "lsp_inspect",
-  // Notifications
-  NOTIFICATION_INBOX: "notification_inbox"
+	VIEW: "view",
+	WRITE_FILE: "write_file",
+	STRING_REPLACE_LSP: "string_replace_lsp",
+	FIND_FILES: "find_files",
+	DELETE_FILE: "delete_file",
+	FILE_STAT: "file_stat",
+	MKDIR: "mkdir",
+	SEARCH_CONTENT: "search_content",
+	AST_SMART_EDIT: "ast_smart_edit",
+	EXECUTE_COMMAND: "execute_command",
+	GET_PROCESS_OUTPUT: "get_process_output",
+	KILL_PROCESS: "kill_process",
+	LSP_INSPECT: "lsp_inspect",
+	NOTIFICATION_INBOX: "notification_inbox"
 };
+/**
+* Workspace tool name remapping config.
+* Maps core workspace tool constants to mastracode's tool names.
+* Pass this (or spread it) into `Workspace({ tools: ... })`.
+*/
 const TOOL_NAME_OVERRIDES = {
-  [WORKSPACE_TOOLS.FILESYSTEM.READ_FILE]: { name: MC_TOOLS.VIEW },
-  [WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE]: { name: MC_TOOLS.WRITE_FILE },
-  [WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE]: { name: MC_TOOLS.STRING_REPLACE_LSP },
-  [WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES]: { name: MC_TOOLS.FIND_FILES },
-  [WORKSPACE_TOOLS.FILESYSTEM.DELETE]: { name: MC_TOOLS.DELETE_FILE },
-  [WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT]: { name: MC_TOOLS.FILE_STAT },
-  [WORKSPACE_TOOLS.FILESYSTEM.MKDIR]: { name: MC_TOOLS.MKDIR },
-  [WORKSPACE_TOOLS.FILESYSTEM.GREP]: { name: MC_TOOLS.SEARCH_CONTENT },
-  [WORKSPACE_TOOLS.FILESYSTEM.AST_EDIT]: { name: MC_TOOLS.AST_SMART_EDIT },
-  [WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND]: { name: MC_TOOLS.EXECUTE_COMMAND },
-  [WORKSPACE_TOOLS.SANDBOX.GET_PROCESS_OUTPUT]: { name: MC_TOOLS.GET_PROCESS_OUTPUT },
-  [WORKSPACE_TOOLS.SANDBOX.KILL_PROCESS]: { name: MC_TOOLS.KILL_PROCESS },
-  [WORKSPACE_TOOLS.LSP.LSP_INSPECT]: { name: MC_TOOLS.LSP_INSPECT }
-};
-export {
-  MC_TOOLS,
-  TOOL_NAME_OVERRIDES
+	[WORKSPACE_TOOLS.FILESYSTEM.READ_FILE]: { name: MC_TOOLS.VIEW },
+	[WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE]: { name: MC_TOOLS.WRITE_FILE },
+	[WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE]: { name: MC_TOOLS.STRING_REPLACE_LSP },
+	[WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES]: { name: MC_TOOLS.FIND_FILES },
+	[WORKSPACE_TOOLS.FILESYSTEM.DELETE]: { name: MC_TOOLS.DELETE_FILE },
+	[WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT]: { name: MC_TOOLS.FILE_STAT },
+	[WORKSPACE_TOOLS.FILESYSTEM.MKDIR]: { name: MC_TOOLS.MKDIR },
+	[WORKSPACE_TOOLS.FILESYSTEM.GREP]: { name: MC_TOOLS.SEARCH_CONTENT },
+	[WORKSPACE_TOOLS.FILESYSTEM.AST_EDIT]: { name: MC_TOOLS.AST_SMART_EDIT },
+	[WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND]: { name: MC_TOOLS.EXECUTE_COMMAND },
+	[WORKSPACE_TOOLS.SANDBOX.GET_PROCESS_OUTPUT]: { name: MC_TOOLS.GET_PROCESS_OUTPUT },
+	[WORKSPACE_TOOLS.SANDBOX.KILL_PROCESS]: { name: MC_TOOLS.KILL_PROCESS },
+	[WORKSPACE_TOOLS.LSP.LSP_INSPECT]: { name: MC_TOOLS.LSP_INSPECT }
 };
+//#endregion
+export { MC_TOOLS, TOOL_NAME_OVERRIDES };
+
 //# sourceMappingURL=tool-names.js.map

package/dist/tool-names.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/tool-names.ts"],"sourcesContent":["/**\n * Mastracode tool name constants.\n *\n * These are the names exposed to the LLM via workspace tool name remapping.\n * Used throughout mastracode for permissions, TUI rendering, tool guidance,\n * subagent allowedTools, etc.\n *\n * The workspace tools get remapped from their core names (e.g. `mastra_workspace_read_file`)\n * to these names (e.g. `view`) via the `name` property in workspace tool config.\n */\n\nimport { WORKSPACE_TOOLS } from '@mastra/core/workspace';\n\nexport const MC_TOOLS = {\n  // Filesystem\n  VIEW: 'view',\n  WRITE_FILE: 'write_file',\n  STRING_REPLACE_LSP: 'string_replace_lsp',\n  FIND_FILES: 'find_files',\n  DELETE_FILE: 'delete_file',\n  FILE_STAT: 'file_stat',\n  MKDIR: 'mkdir',\n\n  // Search\n  SEARCH_CONTENT: 'search_content',\n\n  // Code intelligence\n  AST_SMART_EDIT: 'ast_smart_edit',\n\n  // Sandbox\n  EXECUTE_COMMAND: 'execute_command',\n  GET_PROCESS_OUTPUT: 'get_process_output',\n  KILL_PROCESS: 'kill_process',\n\n  // Code intelligence\n  LSP_INSPECT: 'lsp_inspect',\n\n  // Notifications\n  NOTIFICATION_INBOX: 'notification_inbox',\n} as const;\n\n/**\n * Workspace tool name remapping config.\n * Maps core workspace tool constants to mastracode's tool names.\n * Pass this (or spread it) into `Workspace({ tools: ... })`.\n */\nexport const TOOL_NAME_OVERRIDES = {\n  [WORKSPACE_TOOLS.FILESYSTEM.READ_FILE]: { name: MC_TOOLS.VIEW },\n  [WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE]: { name: MC_TOOLS.WRITE_FILE },\n  [WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE]: { name: MC_TOOLS.STRING_REPLACE_LSP },\n  [WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES]: { name: MC_TOOLS.FIND_FILES },\n  [WORKSPACE_TOOLS.FILESYSTEM.DELETE]: { name: MC_TOOLS.DELETE_FILE },\n  [WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT]: { name: MC_TOOLS.FILE_STAT },\n  [WORKSPACE_TOOLS.FILESYSTEM.MKDIR]: { name: MC_TOOLS.MKDIR },\n  [WORKSPACE_TOOLS.FILESYSTEM.GREP]: { name: MC_TOOLS.SEARCH_CONTENT },\n  [WORKSPACE_TOOLS.FILESYSTEM.AST_EDIT]: { name: MC_TOOLS.AST_SMART_EDIT },\n  [WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND]: { name: MC_TOOLS.EXECUTE_COMMAND },\n  [WORKSPACE_TOOLS.SANDBOX.GET_PROCESS_OUTPUT]: { name: MC_TOOLS.GET_PROCESS_OUTPUT },\n  [WORKSPACE_TOOLS.SANDBOX.KILL_PROCESS]: { name: MC_TOOLS.KILL_PROCESS },\n  [WORKSPACE_TOOLS.LSP.LSP_INSPECT]: { name: MC_TOOLS.LSP_INSPECT },\n} as const;\n"],"mappings":"AAWA,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA;AAAA,EAEtB,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,WAAW;AAAA,EACX,OAAO;AAAA;AAAA,EAGP,gBAAgB;AAAA;AAAA,EAGhB,gBAAgB;AAAA;AAAA,EAGhB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,cAAc;AAAA;AAAA,EAGd,aAAa;AAAA;AAAA,EAGb,oBAAoB;AACtB;AAOO,MAAM,sBAAsB;AAAA,EACjC,CAAC,gBAAgB,WAAW,SAAS,GAAG,EAAE,MAAM,SAAS,KAAK;AAAA,EAC9D,CAAC,gBAAgB,WAAW,UAAU,GAAG,EAAE,MAAM,SAAS,WAAW;AAAA,EACrE,CAAC,gBAAgB,WAAW,SAAS,GAAG,EAAE,MAAM,SAAS,mBAAmB;AAAA,EAC5E,CAAC,gBAAgB,WAAW,UAAU,GAAG,EAAE,MAAM,SAAS,WAAW;AAAA,EACrE,CAAC,gBAAgB,WAAW,MAAM,GAAG,EAAE,MAAM,SAAS,YAAY;AAAA,EAClE,CAAC,gBAAgB,WAAW,SAAS,GAAG,EAAE,MAAM,SAAS,UAAU;AAAA,EACnE,CAAC,gBAAgB,WAAW,KAAK,GAAG,EAAE,MAAM,SAAS,MAAM;AAAA,EAC3D,CAAC,gBAAgB,WAAW,IAAI,GAAG,EAAE,MAAM,SAAS,eAAe;AAAA,EACnE,CAAC,gBAAgB,WAAW,QAAQ,GAAG,EAAE,MAAM,SAAS,eAAe;AAAA,EACvE,CAAC,gBAAgB,QAAQ,eAAe,GAAG,EAAE,MAAM,SAAS,gBAAgB;AAAA,EAC5E,CAAC,gBAAgB,QAAQ,kBAAkB,GAAG,EAAE,MAAM,SAAS,mBAAmB;AAAA,EAClF,CAAC,gBAAgB,QAAQ,YAAY,GAAG,EAAE,MAAM,SAAS,aAAa;AAAA,EACtE,CAAC,gBAAgB,IAAI,WAAW,GAAG,EAAE,MAAM,SAAS,YAAY;AAClE;","names":[]}
+{"version":3,"file":"tool-names.js","names":[],"sources":["../src/tool-names.ts"],"sourcesContent":["/**\n * Mastracode tool name constants.\n *\n * These are the names exposed to the LLM via workspace tool name remapping.\n * Used throughout mastracode for permissions, TUI rendering, tool guidance,\n * subagent allowedTools, etc.\n *\n * The workspace tools get remapped from their core names (e.g. `mastra_workspace_read_file`)\n * to these names (e.g. `view`) via the `name` property in workspace tool config.\n */\n\nimport { WORKSPACE_TOOLS } from '@mastra/core/workspace';\n\nexport const MC_TOOLS = {\n  // Filesystem\n  VIEW: 'view',\n  WRITE_FILE: 'write_file',\n  STRING_REPLACE_LSP: 'string_replace_lsp',\n  FIND_FILES: 'find_files',\n  DELETE_FILE: 'delete_file',\n  FILE_STAT: 'file_stat',\n  MKDIR: 'mkdir',\n\n  // Search\n  SEARCH_CONTENT: 'search_content',\n\n  // Code intelligence\n  AST_SMART_EDIT: 'ast_smart_edit',\n\n  // Sandbox\n  EXECUTE_COMMAND: 'execute_command',\n  GET_PROCESS_OUTPUT: 'get_process_output',\n  KILL_PROCESS: 'kill_process',\n\n  // Code intelligence\n  LSP_INSPECT: 'lsp_inspect',\n\n  // Notifications\n  NOTIFICATION_INBOX: 'notification_inbox',\n} as const;\n\n/**\n * Workspace tool name remapping config.\n * Maps core workspace tool constants to mastracode's tool names.\n * Pass this (or spread it) into `Workspace({ tools: ... })`.\n */\nexport const TOOL_NAME_OVERRIDES = {\n  [WORKSPACE_TOOLS.FILESYSTEM.READ_FILE]: { name: MC_TOOLS.VIEW },\n  [WORKSPACE_TOOLS.FILESYSTEM.WRITE_FILE]: { name: MC_TOOLS.WRITE_FILE },\n  [WORKSPACE_TOOLS.FILESYSTEM.EDIT_FILE]: { name: MC_TOOLS.STRING_REPLACE_LSP },\n  [WORKSPACE_TOOLS.FILESYSTEM.LIST_FILES]: { name: MC_TOOLS.FIND_FILES },\n  [WORKSPACE_TOOLS.FILESYSTEM.DELETE]: { name: MC_TOOLS.DELETE_FILE },\n  [WORKSPACE_TOOLS.FILESYSTEM.FILE_STAT]: { name: MC_TOOLS.FILE_STAT },\n  [WORKSPACE_TOOLS.FILESYSTEM.MKDIR]: { name: MC_TOOLS.MKDIR },\n  [WORKSPACE_TOOLS.FILESYSTEM.GREP]: { name: MC_TOOLS.SEARCH_CONTENT },\n  [WORKSPACE_TOOLS.FILESYSTEM.AST_EDIT]: { name: MC_TOOLS.AST_SMART_EDIT },\n  [WORKSPACE_TOOLS.SANDBOX.EXECUTE_COMMAND]: { name: MC_TOOLS.EXECUTE_COMMAND },\n  [WORKSPACE_TOOLS.SANDBOX.GET_PROCESS_OUTPUT]: { name: MC_TOOLS.GET_PROCESS_OUTPUT },\n  [WORKSPACE_TOOLS.SANDBOX.KILL_PROCESS]: { name: MC_TOOLS.KILL_PROCESS },\n  [WORKSPACE_TOOLS.LSP.LSP_INSPECT]: { name: MC_TOOLS.LSP_INSPECT },\n} as const;\n"],"mappings":";;;;;;;;;;;;AAaA,MAAa,WAAW;CAEtB,MAAM;CACN,YAAY;CACZ,oBAAoB;CACpB,YAAY;CACZ,aAAa;CACb,WAAW;CACX,OAAO;CAGP,gBAAgB;CAGhB,gBAAgB;CAGhB,iBAAiB;CACjB,oBAAoB;CACpB,cAAc;CAGd,aAAa;CAGb,oBAAoB;AACtB;;;;;;AAOA,MAAa,sBAAsB;EAChC,gBAAgB,WAAW,YAAY,EAAE,MAAM,SAAS,KAAK;EAC7D,gBAAgB,WAAW,aAAa,EAAE,MAAM,SAAS,WAAW;EACpE,gBAAgB,WAAW,YAAY,EAAE,MAAM,SAAS,mBAAmB;EAC3E,gBAAgB,WAAW,aAAa,EAAE,MAAM,SAAS,WAAW;EACpE,gBAAgB,WAAW,SAAS,EAAE,MAAM,SAAS,YAAY;EACjE,gBAAgB,WAAW,YAAY,EAAE,MAAM,SAAS,UAAU;EAClE,gBAAgB,WAAW,QAAQ,EAAE,MAAM,SAAS,MAAM;EAC1D,gBAAgB,WAAW,OAAO,EAAE,MAAM,SAAS,eAAe;EAClE,gBAAgB,WAAW,WAAW,EAAE,MAAM,SAAS,eAAe;EACtE,gBAAgB,QAAQ,kBAAkB,EAAE,MAAM,SAAS,gBAAgB;EAC3E,gBAAgB,QAAQ,qBAAqB,EAAE,MAAM,SAAS,mBAAmB;EACjF,gBAAgB,QAAQ,eAAe,EAAE,MAAM,SAAS,aAAa;EACrE,gBAAgB,IAAI,cAAc,EAAE,MAAM,SAAS,YAAY;AAClE"}

package/dist/tools/index.js

@@ -1,9 +1,3 @@
-import { createWebSearchTool, createWebExtractTool, hasTavilyKey } from "./web-search.js";
+import { createWebExtractTool, createWebSearchTool, hasTavilyKey } from "./web-search.js";
 import { requestSandboxAccessTool } from "./request-sandbox-access.js";
-export {
-  createWebExtractTool,
-  createWebSearchTool,
-  hasTavilyKey,
-  requestSandboxAccessTool
-};
-//# sourceMappingURL=index.js.map
+export { createWebExtractTool, createWebSearchTool, hasTavilyKey, requestSandboxAccessTool };

package/dist/tools/request-sandbox-access.js

@@ -1,88 +1,79 @@
-import * as os from "node:os";
-import * as path from "node:path";
+import { getAllowedPathsFromContext, isPathAllowed } from "./utils.js";
+import * as os$1 from "os";
+import * as path$1 from "path";
 import { createTool } from "@mastra/core/tools";
 import { LocalFilesystem } from "@mastra/core/workspace";
 import { z } from "zod";
-import { isPathAllowed, getAllowedPathsFromContext } from "./utils.js";
+//#region src/tools/request-sandbox-access.ts
+/**
+* request_access tool — requests permission to access a directory outside the project root.
+* The user can approve or deny the request via TUI dialog.
+*/
 function expandTilde(p) {
-  if (p === "~") return os.homedir();
-  if (p.startsWith("~/") || p.startsWith("~\\")) return path.join(os.homedir(), p.slice(2));
-  return p;
+	if (p === "~") return os$1.homedir();
+	if (p.startsWith("~/") || p.startsWith("~\\")) return path$1.join(os$1.homedir(), p.slice(2));
+	return p;
 }
-const requestSandboxAccessInputSchema = z.object({
-  path: z.string().min(1).describe("The absolute path to the directory you need access to."),
-  reason: z.string().min(1).describe("Brief explanation of why you need access to this directory.")
-});
 const requestSandboxAccessTool = createTool({
-  id: "request_access",
-  description: `Request permission to access a directory outside the current project. Use this when you need to read or write files in a directory that is not within the project root. The user will be prompted to approve or deny the request.`,
-  inputSchema: requestSandboxAccessInputSchema,
-  suspendSchema: z.object({
-    kind: z.literal("sandbox_access_request"),
-    path: z.string(),
-    reason: z.string()
-  }),
-  resumeSchema: z.union([z.string(), z.array(z.string())]),
-  execute: async ({ path: requestedPath, reason }, context) => {
-    try {
-      const agentControllerCtx = context?.requestContext?.get("controller");
-      const expanded = expandTilde(requestedPath);
-      const absolutePath = path.isAbsolute(expanded) ? expanded : path.resolve(process.cwd(), expanded);
-      const projectRoot = process.cwd();
-      const allowedPaths = getAllowedPathsFromContext(context);
-      if (isPathAllowed(absolutePath, projectRoot, allowedPaths)) {
-        return {
-          content: `Access already granted: "${absolutePath}" is within the project root or allowed paths.`,
-          isError: false
-        };
-      }
-      const suspend = context?.agent?.suspend ?? context?.suspend;
-      const resumeData = context?.agent?.resumeData ?? context?.resumeData;
-      if (resumeData === void 0) {
-        if (!suspend) {
-          return {
-            content: `Cannot request sandbox access: interactive context not available. The user should manually run /sandbox add ${absolutePath}`,
-            isError: true
-          };
-        }
-        await suspend({ kind: "sandbox_access_request", path: absolutePath, reason });
-        return;
-      }
-      const answerText = Array.isArray(resumeData) ? resumeData.join(", ") : String(resumeData);
-      const approved = answerText.toLowerCase().startsWith("y") || answerText.toLowerCase() === "approve";
-      if (approved) {
-        const controllerState = agentControllerCtx?.getState();
-        const currentAllowed = controllerState?.sandboxAllowedPaths ?? [];
-        const nextAllowed = currentAllowed.includes(absolutePath) ? currentAllowed : [...currentAllowed, absolutePath];
-        if (!currentAllowed.includes(absolutePath)) {
-          await agentControllerCtx?.setState({
-            sandboxAllowedPaths: nextAllowed
-          });
-        }
-        const fs = agentControllerCtx?.workspace?.filesystem ?? context?.workspace?.filesystem;
-        if (fs instanceof LocalFilesystem) {
-          fs.setAllowedPaths((prev) => [...prev, absolutePath]);
-        }
-        return {
-          content: `Access granted: "${absolutePath}" has been added to allowed paths. You can now access files in this directory.`,
-          isError: false
-        };
-      } else {
-        return {
-          content: `Access denied: The user declined access to "${absolutePath}".`,
-          isError: false
-        };
-      }
-    } catch (error) {
-      const msg = error instanceof Error ? error.message : "Unknown error";
-      return {
-        content: `Failed to request sandbox access: ${msg}`,
-        isError: true
-      };
-    }
-  }
+	id: "request_access",
+	description: `Request permission to access a directory outside the current project. Use this when you need to read or write files in a directory that is not within the project root. The user will be prompted to approve or deny the request.`,
+	inputSchema: z.object({
+		path: z.string().min(1).describe("The absolute path to the directory you need access to."),
+		reason: z.string().min(1).describe("Brief explanation of why you need access to this directory.")
+	}),
+	suspendSchema: z.object({
+		kind: z.literal("sandbox_access_request"),
+		path: z.string(),
+		reason: z.string()
+	}),
+	resumeSchema: z.union([z.string(), z.array(z.string())]),
+	execute: async ({ path: requestedPath, reason }, context) => {
+		try {
+			const agentControllerCtx = context?.requestContext?.get("controller");
+			const expanded = expandTilde(requestedPath);
+			const absolutePath = path$1.isAbsolute(expanded) ? expanded : path$1.resolve(process.cwd(), expanded);
+			if (isPathAllowed(absolutePath, process.cwd(), getAllowedPathsFromContext(context))) return {
+				content: `Access already granted: "${absolutePath}" is within the project root or allowed paths.`,
+				isError: false
+			};
+			const suspend = context?.agent?.suspend ?? context?.suspend;
+			const resumeData = context?.agent?.resumeData ?? context?.resumeData;
+			if (resumeData === void 0) {
+				if (!suspend) return {
+					content: `Cannot request sandbox access: interactive context not available. The user should manually run /sandbox add ${absolutePath}`,
+					isError: true
+				};
+				await suspend({
+					kind: "sandbox_access_request",
+					path: absolutePath,
+					reason
+				});
+				return;
+			}
+			const answerText = Array.isArray(resumeData) ? resumeData.join(", ") : String(resumeData);
+			if (answerText.toLowerCase().startsWith("y") || answerText.toLowerCase() === "approve") {
+				const currentAllowed = (agentControllerCtx?.getState())?.sandboxAllowedPaths ?? [];
+				const nextAllowed = currentAllowed.includes(absolutePath) ? currentAllowed : [...currentAllowed, absolutePath];
+				if (!currentAllowed.includes(absolutePath)) await agentControllerCtx?.setState({ sandboxAllowedPaths: nextAllowed });
+				const fs = agentControllerCtx?.workspace?.filesystem ?? context?.workspace?.filesystem;
+				if (fs instanceof LocalFilesystem) fs.setAllowedPaths((prev) => [...prev, absolutePath]);
+				return {
+					content: `Access granted: "${absolutePath}" has been added to allowed paths. You can now access files in this directory.`,
+					isError: false
+				};
+			} else return {
+				content: `Access denied: The user declined access to "${absolutePath}".`,
+				isError: false
+			};
+		} catch (error) {
+			return {
+				content: `Failed to request sandbox access: ${error instanceof Error ? error.message : "Unknown error"}`,
+				isError: true
+			};
+		}
+	}
 });
-export {
-  requestSandboxAccessTool
-};
+//#endregion
+export { requestSandboxAccessTool };
+
 //# sourceMappingURL=request-sandbox-access.js.map

package/dist/tools/request-sandbox-access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tools/request-sandbox-access.ts"],"sourcesContent":["/**\n * request_access tool — requests permission to access a directory outside the project root.\n * The user can approve or deny the request via TUI dialog.\n */\n\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport { createTool } from '@mastra/core/tools';\nimport { LocalFilesystem } from '@mastra/core/workspace';\nimport { z } from 'zod';\nimport type { MastraCodeState } from '../schema.js';\nimport { isPathAllowed, getAllowedPathsFromContext } from './utils.js';\n\nfunction expandTilde(p: string): string {\n  if (p === '~') return os.homedir();\n  if (p.startsWith('~/') || p.startsWith('~\\\\')) return path.join(os.homedir(), p.slice(2));\n  return p;\n}\n\ntype RequestSandboxAccessInput = {\n  path: string;\n  reason: string;\n};\n\nconst requestSandboxAccessInputSchema = z.object({\n  path: z.string().min(1).describe('The absolute path to the directory you need access to.'),\n  reason: z.string().min(1).describe('Brief explanation of why you need access to this directory.'),\n});\n\nexport const requestSandboxAccessTool = createTool({\n  id: 'request_access',\n  description: `Request permission to access a directory outside the current project. Use this when you need to read or write files in a directory that is not within the project root. The user will be prompted to approve or deny the request.`,\n  inputSchema: requestSandboxAccessInputSchema,\n  suspendSchema: z.object({\n    kind: z.literal('sandbox_access_request'),\n    path: z.string(),\n    reason: z.string(),\n  }),\n  resumeSchema: z.union([z.string(), z.array(z.string())]),\n  execute: async ({ path: requestedPath, reason }: RequestSandboxAccessInput, context: any) => {\n    try {\n      const agentControllerCtx = context?.requestContext?.get('controller') as\n        | AgentControllerRequestContext<MastraCodeState>\n        | undefined;\n\n      // Resolve to absolute path (expand ~ first since Node path APIs don't handle it)\n      const expanded = expandTilde(requestedPath);\n      const absolutePath = path.isAbsolute(expanded) ? expanded : path.resolve(process.cwd(), expanded);\n\n      // Check if already allowed\n      const projectRoot = process.cwd();\n      const allowedPaths = getAllowedPathsFromContext(context);\n      if (isPathAllowed(absolutePath, projectRoot, allowedPaths)) {\n        return {\n          content: `Access already granted: \"${absolutePath}\" is within the project root or allowed paths.`,\n          isError: false,\n        };\n      }\n\n      const suspend = context?.agent?.suspend ?? context?.suspend;\n      const resumeData = context?.agent?.resumeData ?? context?.resumeData;\n\n      // First pass: pause via the native tool-suspension primitive so the host can\n      // prompt the user. The suspend payload carries the request details; the host\n      // resumes with the user's answer as resume data.\n      if (resumeData === undefined) {\n        if (!suspend) {\n          return {\n            content: `Cannot request sandbox access: interactive context not available. The user should manually run /sandbox add ${absolutePath}`,\n            isError: true,\n          };\n        }\n        await suspend({ kind: 'sandbox_access_request', path: absolutePath, reason });\n        return;\n      }\n\n      const answerText = Array.isArray(resumeData) ? resumeData.join(', ') : String(resumeData);\n      const approved = answerText.toLowerCase().startsWith('y') || answerText.toLowerCase() === 'approve';\n      if (approved) {\n        // Persist to controller state first (and await it) so the value is\n        // committed before the next tool call re-derives the workspace's\n        // allowed paths from state. The workspace factory rebuilds the\n        // filesystem allowlist from `sandboxAllowedPaths` on every call\n        // (getDynamicWorkspace), so an unawaited setState would let that\n        // rebuild clobber the in-turn widen below before the grant lands.\n        const controllerState = agentControllerCtx?.getState();\n        const currentAllowed = (controllerState?.sandboxAllowedPaths as string[] | undefined) ?? [];\n        const nextAllowed = currentAllowed.includes(absolutePath) ? currentAllowed : [...currentAllowed, absolutePath];\n        if (!currentAllowed.includes(absolutePath)) {\n          await agentControllerCtx?.setState({\n            sandboxAllowedPaths: nextAllowed,\n          });\n        }\n\n        // Also update the live workspace filesystem immediately so tools in\n        // the same turn (e.g. `view`) can access the path without waiting for\n        // a fresh workspace build. The resolved workspace is carried on the\n        // controller request context — the tool-execution context does not expose\n        // it — so read the filesystem from there.\n        const fs = agentControllerCtx?.workspace?.filesystem ?? context?.workspace?.filesystem;\n        if (fs instanceof LocalFilesystem) {\n          fs.setAllowedPaths((prev: readonly string[]) => [...prev, absolutePath]);\n        }\n\n        return {\n          content: `Access granted: \"${absolutePath}\" has been added to allowed paths. You can now access files in this directory.`,\n          isError: false,\n        };\n      } else {\n        return {\n          content: `Access denied: The user declined access to \"${absolutePath}\".`,\n          isError: false,\n        };\n      }\n    } catch (error) {\n      const msg = error instanceof Error ? error.message : 'Unknown error';\n      return {\n        content: `Failed to request sandbox access: ${msg}`,\n        isError: true,\n      };\n    }\n  },\n} as any);\n"],"mappings":"AAKA,YAAY,QAAQ;AACpB,YAAY,UAAU;AAEtB,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAAS,SAAS;AAElB,SAAS,eAAe,kCAAkC;AAE1D,SAAS,YAAY,GAAmB;AACtC,MAAI,MAAM,IAAK,QAAO,GAAG,QAAQ;AACjC,MAAI,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,KAAK,EAAG,QAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM,CAAC,CAAC;AACxF,SAAO;AACT;AAOA,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,wDAAwD;AAAA,EACzF,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,6DAA6D;AAClG,CAAC;AAEM,MAAM,2BAA2B,WAAW;AAAA,EACjD,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,EAAE,OAAO;AAAA,IACtB,MAAM,EAAE,QAAQ,wBAAwB;AAAA,IACxC,MAAM,EAAE,OAAO;AAAA,IACf,QAAQ,EAAE,OAAO;AAAA,EACnB,CAAC;AAAA,EACD,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,EACvD,SAAS,OAAO,EAAE,MAAM,eAAe,OAAO,GAA8B,YAAiB;AAC3F,QAAI;AACF,YAAM,qBAAqB,SAAS,gBAAgB,IAAI,YAAY;AAKpE,YAAM,WAAW,YAAY,aAAa;AAC1C,YAAM,eAAe,KAAK,WAAW,QAAQ,IAAI,WAAW,KAAK,QAAQ,QAAQ,IAAI,GAAG,QAAQ;AAGhG,YAAM,cAAc,QAAQ,IAAI;AAChC,YAAM,eAAe,2BAA2B,OAAO;AACvD,UAAI,cAAc,cAAc,aAAa,YAAY,GAAG;AAC1D,eAAO;AAAA,UACL,SAAS,4BAA4B,YAAY;AAAA,UACjD,SAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,UAAU,SAAS,OAAO,WAAW,SAAS;AACpD,YAAM,aAAa,SAAS,OAAO,cAAc,SAAS;AAK1D,UAAI,eAAe,QAAW;AAC5B,YAAI,CAAC,SAAS;AACZ,iBAAO;AAAA,YACL,SAAS,+GAA+G,YAAY;AAAA,YACpI,SAAS;AAAA,UACX;AAAA,QACF;AACA,cAAM,QAAQ,EAAE,MAAM,0BAA0B,MAAM,cAAc,OAAO,CAAC;AAC5E;AAAA,MACF;AAEA,YAAM,aAAa,MAAM,QAAQ,UAAU,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU;AACxF,YAAM,WAAW,WAAW,YAAY,EAAE,WAAW,GAAG,KAAK,WAAW,YAAY,MAAM;AAC1F,UAAI,UAAU;AAOZ,cAAM,kBAAkB,oBAAoB,SAAS;AACrD,cAAM,iBAAkB,iBAAiB,uBAAgD,CAAC;AAC1F,cAAM,cAAc,eAAe,SAAS,YAAY,IAAI,iBAAiB,CAAC,GAAG,gBAAgB,YAAY;AAC7G,YAAI,CAAC,eAAe,SAAS,YAAY,GAAG;AAC1C,gBAAM,oBAAoB,SAAS;AAAA,YACjC,qBAAqB;AAAA,UACvB,CAAC;AAAA,QACH;AAOA,cAAM,KAAK,oBAAoB,WAAW,cAAc,SAAS,WAAW;AAC5E,YAAI,cAAc,iBAAiB;AACjC,aAAG,gBAAgB,CAAC,SAA4B,CAAC,GAAG,MAAM,YAAY,CAAC;AAAA,QACzE;AAEA,eAAO;AAAA,UACL,SAAS,oBAAoB,YAAY;AAAA,UACzC,SAAS;AAAA,QACX;AAAA,MACF,OAAO;AACL,eAAO;AAAA,UACL,SAAS,+CAA+C,YAAY;AAAA,UACpE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU;AACrD,aAAO;AAAA,QACL,SAAS,qCAAqC,GAAG;AAAA,QACjD,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF,CAAQ;","names":[]}
+{"version":3,"file":"request-sandbox-access.js","names":["os","path"],"sources":["../../src/tools/request-sandbox-access.ts"],"sourcesContent":["/**\n * request_access tool — requests permission to access a directory outside the project root.\n * The user can approve or deny the request via TUI dialog.\n */\n\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport type { AgentControllerRequestContext } from '@mastra/core/agent-controller';\nimport { createTool } from '@mastra/core/tools';\nimport { LocalFilesystem } from '@mastra/core/workspace';\nimport { z } from 'zod';\nimport type { MastraCodeState } from '../schema.js';\nimport { isPathAllowed, getAllowedPathsFromContext } from './utils.js';\n\nfunction expandTilde(p: string): string {\n  if (p === '~') return os.homedir();\n  if (p.startsWith('~/') || p.startsWith('~\\\\')) return path.join(os.homedir(), p.slice(2));\n  return p;\n}\n\ntype RequestSandboxAccessInput = {\n  path: string;\n  reason: string;\n};\n\nconst requestSandboxAccessInputSchema = z.object({\n  path: z.string().min(1).describe('The absolute path to the directory you need access to.'),\n  reason: z.string().min(1).describe('Brief explanation of why you need access to this directory.'),\n});\n\nexport const requestSandboxAccessTool = createTool({\n  id: 'request_access',\n  description: `Request permission to access a directory outside the current project. Use this when you need to read or write files in a directory that is not within the project root. The user will be prompted to approve or deny the request.`,\n  inputSchema: requestSandboxAccessInputSchema,\n  suspendSchema: z.object({\n    kind: z.literal('sandbox_access_request'),\n    path: z.string(),\n    reason: z.string(),\n  }),\n  resumeSchema: z.union([z.string(), z.array(z.string())]),\n  execute: async ({ path: requestedPath, reason }: RequestSandboxAccessInput, context: any) => {\n    try {\n      const agentControllerCtx = context?.requestContext?.get('controller') as\n        | AgentControllerRequestContext<MastraCodeState>\n        | undefined;\n\n      // Resolve to absolute path (expand ~ first since Node path APIs don't handle it)\n      const expanded = expandTilde(requestedPath);\n      const absolutePath = path.isAbsolute(expanded) ? expanded : path.resolve(process.cwd(), expanded);\n\n      // Check if already allowed\n      const projectRoot = process.cwd();\n      const allowedPaths = getAllowedPathsFromContext(context);\n      if (isPathAllowed(absolutePath, projectRoot, allowedPaths)) {\n        return {\n          content: `Access already granted: \"${absolutePath}\" is within the project root or allowed paths.`,\n          isError: false,\n        };\n      }\n\n      const suspend = context?.agent?.suspend ?? context?.suspend;\n      const resumeData = context?.agent?.resumeData ?? context?.resumeData;\n\n      // First pass: pause via the native tool-suspension primitive so the host can\n      // prompt the user. The suspend payload carries the request details; the host\n      // resumes with the user's answer as resume data.\n      if (resumeData === undefined) {\n        if (!suspend) {\n          return {\n            content: `Cannot request sandbox access: interactive context not available. The user should manually run /sandbox add ${absolutePath}`,\n            isError: true,\n          };\n        }\n        await suspend({ kind: 'sandbox_access_request', path: absolutePath, reason });\n        return;\n      }\n\n      const answerText = Array.isArray(resumeData) ? resumeData.join(', ') : String(resumeData);\n      const approved = answerText.toLowerCase().startsWith('y') || answerText.toLowerCase() === 'approve';\n      if (approved) {\n        // Persist to controller state first (and await it) so the value is\n        // committed before the next tool call re-derives the workspace's\n        // allowed paths from state. The workspace factory rebuilds the\n        // filesystem allowlist from `sandboxAllowedPaths` on every call\n        // (getDynamicWorkspace), so an unawaited setState would let that\n        // rebuild clobber the in-turn widen below before the grant lands.\n        const controllerState = agentControllerCtx?.getState();\n        const currentAllowed = (controllerState?.sandboxAllowedPaths as string[] | undefined) ?? [];\n        const nextAllowed = currentAllowed.includes(absolutePath) ? currentAllowed : [...currentAllowed, absolutePath];\n        if (!currentAllowed.includes(absolutePath)) {\n          await agentControllerCtx?.setState({\n            sandboxAllowedPaths: nextAllowed,\n          });\n        }\n\n        // Also update the live workspace filesystem immediately so tools in\n        // the same turn (e.g. `view`) can access the path without waiting for\n        // a fresh workspace build. The resolved workspace is carried on the\n        // controller request context — the tool-execution context does not expose\n        // it — so read the filesystem from there.\n        const fs = agentControllerCtx?.workspace?.filesystem ?? context?.workspace?.filesystem;\n        if (fs instanceof LocalFilesystem) {\n          fs.setAllowedPaths((prev: readonly string[]) => [...prev, absolutePath]);\n        }\n\n        return {\n          content: `Access granted: \"${absolutePath}\" has been added to allowed paths. You can now access files in this directory.`,\n          isError: false,\n        };\n      } else {\n        return {\n          content: `Access denied: The user declined access to \"${absolutePath}\".`,\n          isError: false,\n        };\n      }\n    } catch (error) {\n      const msg = error instanceof Error ? error.message : 'Unknown error';\n      return {\n        content: `Failed to request sandbox access: ${msg}`,\n        isError: true,\n      };\n    }\n  },\n} as any);\n"],"mappings":";;;;;;;;;;;AAcA,SAAS,YAAY,GAAmB;CACtC,IAAI,MAAM,KAAK,OAAOA,KAAG,QAAQ;CACjC,IAAI,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,KAAK,GAAG,OAAOC,OAAK,KAAKD,KAAG,QAAQ,GAAG,EAAE,MAAM,CAAC,CAAC;CACxF,OAAO;AACT;AAYA,MAAa,2BAA2B,WAAW;CACjD,IAAI;CACJ,aAAa;CACb,aARsC,EAAE,OAAO;EAC/C,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,wDAAwD;EACzF,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,6DAA6D;CAClG,CAKe;CACb,eAAe,EAAE,OAAO;EACtB,MAAM,EAAE,QAAQ,wBAAwB;EACxC,MAAM,EAAE,OAAO;EACf,QAAQ,EAAE,OAAO;CACnB,CAAC;CACD,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD,SAAS,OAAO,EAAE,MAAM,eAAe,UAAqC,YAAiB;EAC3F,IAAI;GACF,MAAM,qBAAqB,SAAS,gBAAgB,IAAI,YAAY;GAKpE,MAAM,WAAW,YAAY,aAAa;GAC1C,MAAM,eAAeC,OAAK,WAAW,QAAQ,IAAI,WAAWA,OAAK,QAAQ,QAAQ,IAAI,GAAG,QAAQ;GAKhG,IAAI,cAAc,cAFE,QAAQ,IAEc,GADrB,2BAA2B,OACQ,CAAC,GACvD,OAAO;IACL,SAAS,4BAA4B,aAAa;IAClD,SAAS;GACX;GAGF,MAAM,UAAU,SAAS,OAAO,WAAW,SAAS;GACpD,MAAM,aAAa,SAAS,OAAO,cAAc,SAAS;GAK1D,IAAI,eAAe,KAAA,GAAW;IAC5B,IAAI,CAAC,SACH,OAAO;KACL,SAAS,+GAA+G;KACxH,SAAS;IACX;IAEF,MAAM,QAAQ;KAAE,MAAM;KAA0B,MAAM;KAAc;IAAO,CAAC;IAC5E;GACF;GAEA,MAAM,aAAa,MAAM,QAAQ,UAAU,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU;GAExF,IADiB,WAAW,YAAY,CAAC,CAAC,WAAW,GAAG,KAAK,WAAW,YAAY,MAAM,WAC5E;IAQZ,MAAM,kBADkB,oBAAoB,SAAS,EAAA,EACZ,uBAAgD,CAAC;IAC1F,MAAM,cAAc,eAAe,SAAS,YAAY,IAAI,iBAAiB,CAAC,GAAG,gBAAgB,YAAY;IAC7G,IAAI,CAAC,eAAe,SAAS,YAAY,GACvC,MAAM,oBAAoB,SAAS,EACjC,qBAAqB,YACvB,CAAC;IAQH,MAAM,KAAK,oBAAoB,WAAW,cAAc,SAAS,WAAW;IAC5E,IAAI,cAAc,iBAChB,GAAG,iBAAiB,SAA4B,CAAC,GAAG,MAAM,YAAY,CAAC;IAGzE,OAAO;KACL,SAAS,oBAAoB,aAAa;KAC1C,SAAS;IACX;GACF,OACE,OAAO;IACL,SAAS,+CAA+C,aAAa;IACrE,SAAS;GACX;EAEJ,SAAS,OAAO;GAEd,OAAO;IACL,SAAS,qCAFC,iBAAiB,QAAQ,MAAM,UAAU;IAGnD,SAAS;GACX;EACF;CACF;AACF,CAAQ"}

package/dist/tools/utils.js

@@ -1,22 +1,32 @@
-import * as path from "node:path";
+import "../constants.js";
 import { buildSkillPaths } from "../agents/workspace.js";
-import { DEFAULT_CONFIG_DIR } from "../constants.js";
+import * as path$1 from "path";
+//#region src/tools/utils.ts
+/**
+* Check whether `targetPath` falls inside `projectRoot` or any of the
+* additional `allowedPaths`.  All arguments are expected to be absolute.
+*
+* Returns `true` when access should be **allowed**.
+*/
 function isPathAllowed(targetPath, projectRoot, allowedPaths = []) {
-  const resolved = path.resolve(targetPath);
-  const roots = [projectRoot, ...allowedPaths].map((p) => path.resolve(p));
-  return roots.some((root) => resolved === root || resolved.startsWith(root + path.sep));
+	const resolved = path$1.resolve(targetPath);
+	return [projectRoot, ...allowedPaths].map((p) => path$1.resolve(p)).some((root) => resolved === root || resolved.startsWith(root + path$1.sep));
 }
+/**
+* Read allowed paths from the Mastra controller runtime context.
+* Combines skill paths (computed dynamically from projectPath and configDir)
+* with user-approved sandbox paths from controller state so that both parent
+* and subagent tools have the same access.
+* Returns default skill paths when the context is unavailable (e.g. in tests).
+*/
 function getAllowedPathsFromContext(toolContext) {
-  const agentControllerCtx = toolContext?.requestContext?.get("controller");
-  const state = agentControllerCtx?.getState?.() ?? agentControllerCtx?.session?.state?.get?.();
-  const projectPath = state?.projectPath ? path.resolve(state.projectPath) : process.cwd();
-  const configDir = state?.configDir ?? DEFAULT_CONFIG_DIR;
-  const skillPaths = buildSkillPaths(projectPath, configDir);
-  const sandboxPaths = state?.sandboxAllowedPaths ?? [];
-  return [...skillPaths, ...sandboxPaths];
+	const agentControllerCtx = toolContext?.requestContext?.get("controller");
+	const state = agentControllerCtx?.getState?.() ?? agentControllerCtx?.session?.state?.get?.();
+	const skillPaths = buildSkillPaths(state?.projectPath ? path$1.resolve(state.projectPath) : process.cwd(), state?.configDir ?? ".mastracode");
+	const sandboxPaths = state?.sandboxAllowedPaths ?? [];
+	return [...skillPaths, ...sandboxPaths];
 }
-export {
-  getAllowedPathsFromContext,
-  isPathAllowed
-};
+//#endregion
+export { getAllowedPathsFromContext, isPathAllowed };
+
 //# sourceMappingURL=utils.js.map

package/dist/tools/utils.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tools/utils.ts"],"sourcesContent":["import * as path from 'node:path';\nimport { buildSkillPaths } from '../agents/workspace.js';\nimport { DEFAULT_CONFIG_DIR } from '../constants.js';\n\n/**\n * Check whether `targetPath` falls inside `projectRoot` or any of the\n * additional `allowedPaths`.  All arguments are expected to be absolute.\n *\n * Returns `true` when access should be **allowed**.\n */\nexport function isPathAllowed(targetPath: string, projectRoot: string, allowedPaths: string[] = []): boolean {\n  const resolved = path.resolve(targetPath);\n  const roots = [projectRoot, ...allowedPaths].map(p => path.resolve(p));\n\n  return roots.some(root => resolved === root || resolved.startsWith(root + path.sep));\n}\n\n/**\n * Read allowed paths from the Mastra controller runtime context.\n * Combines skill paths (computed dynamically from projectPath and configDir)\n * with user-approved sandbox paths from controller state so that both parent\n * and subagent tools have the same access.\n * Returns default skill paths when the context is unavailable (e.g. in tests).\n */\nexport function getAllowedPathsFromContext(\n  toolContext: { requestContext?: { get: (key: string) => unknown } } | undefined,\n): string[] {\n  const agentControllerCtx = toolContext?.requestContext?.get('controller') as\n    | {\n        getState?: () => { sandboxAllowedPaths?: string[]; projectPath?: string; configDir?: string };\n        session?: {\n          state?: { get?: () => { sandboxAllowedPaths?: string[]; projectPath?: string; configDir?: string } };\n        };\n      }\n    | undefined;\n  const state = agentControllerCtx?.getState?.() ?? agentControllerCtx?.session?.state?.get?.();\n  const projectPath = state?.projectPath ? path.resolve(state.projectPath) : process.cwd();\n  const configDir = state?.configDir ?? DEFAULT_CONFIG_DIR;\n  const skillPaths = buildSkillPaths(projectPath, configDir);\n  const sandboxPaths = state?.sandboxAllowedPaths ?? [];\n\n  return [...skillPaths, ...sandboxPaths];\n}\n"],"mappings":"AAAA,YAAY,UAAU;AACtB,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AAQ5B,SAAS,cAAc,YAAoB,aAAqB,eAAyB,CAAC,GAAY;AAC3G,QAAM,WAAW,KAAK,QAAQ,UAAU;AACxC,QAAM,QAAQ,CAAC,aAAa,GAAG,YAAY,EAAE,IAAI,OAAK,KAAK,QAAQ,CAAC,CAAC;AAErE,SAAO,MAAM,KAAK,UAAQ,aAAa,QAAQ,SAAS,WAAW,OAAO,KAAK,GAAG,CAAC;AACrF;AASO,SAAS,2BACd,aACU;AACV,QAAM,qBAAqB,aAAa,gBAAgB,IAAI,YAAY;AAQxE,QAAM,QAAQ,oBAAoB,WAAW,KAAK,oBAAoB,SAAS,OAAO,MAAM;AAC5F,QAAM,cAAc,OAAO,cAAc,KAAK,QAAQ,MAAM,WAAW,IAAI,QAAQ,IAAI;AACvF,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,aAAa,gBAAgB,aAAa,SAAS;AACzD,QAAM,eAAe,OAAO,uBAAuB,CAAC;AAEpD,SAAO,CAAC,GAAG,YAAY,GAAG,YAAY;AACxC;","names":[]}
+{"version":3,"file":"utils.js","names":["path"],"sources":["../../src/tools/utils.ts"],"sourcesContent":["import * as path from 'node:path';\nimport { buildSkillPaths } from '../agents/workspace.js';\nimport { DEFAULT_CONFIG_DIR } from '../constants.js';\n\n/**\n * Check whether `targetPath` falls inside `projectRoot` or any of the\n * additional `allowedPaths`.  All arguments are expected to be absolute.\n *\n * Returns `true` when access should be **allowed**.\n */\nexport function isPathAllowed(targetPath: string, projectRoot: string, allowedPaths: string[] = []): boolean {\n  const resolved = path.resolve(targetPath);\n  const roots = [projectRoot, ...allowedPaths].map(p => path.resolve(p));\n\n  return roots.some(root => resolved === root || resolved.startsWith(root + path.sep));\n}\n\n/**\n * Read allowed paths from the Mastra controller runtime context.\n * Combines skill paths (computed dynamically from projectPath and configDir)\n * with user-approved sandbox paths from controller state so that both parent\n * and subagent tools have the same access.\n * Returns default skill paths when the context is unavailable (e.g. in tests).\n */\nexport function getAllowedPathsFromContext(\n  toolContext: { requestContext?: { get: (key: string) => unknown } } | undefined,\n): string[] {\n  const agentControllerCtx = toolContext?.requestContext?.get('controller') as\n    | {\n        getState?: () => { sandboxAllowedPaths?: string[]; projectPath?: string; configDir?: string };\n        session?: {\n          state?: { get?: () => { sandboxAllowedPaths?: string[]; projectPath?: string; configDir?: string } };\n        };\n      }\n    | undefined;\n  const state = agentControllerCtx?.getState?.() ?? agentControllerCtx?.session?.state?.get?.();\n  const projectPath = state?.projectPath ? path.resolve(state.projectPath) : process.cwd();\n  const configDir = state?.configDir ?? DEFAULT_CONFIG_DIR;\n  const skillPaths = buildSkillPaths(projectPath, configDir);\n  const sandboxPaths = state?.sandboxAllowedPaths ?? [];\n\n  return [...skillPaths, ...sandboxPaths];\n}\n"],"mappings":";;;;;;;;;;AAUA,SAAgB,cAAc,YAAoB,aAAqB,eAAyB,CAAC,GAAY;CAC3G,MAAM,WAAWA,OAAK,QAAQ,UAAU;CAGxC,OAFc,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC,KAAI,MAAKA,OAAK,QAAQ,CAAC,CAEzD,CAAC,CAAC,MAAK,SAAQ,aAAa,QAAQ,SAAS,WAAW,OAAOA,OAAK,GAAG,CAAC;AACrF;;;;;;;;AASA,SAAgB,2BACd,aACU;CACV,MAAM,qBAAqB,aAAa,gBAAgB,IAAI,YAAY;CAQxE,MAAM,QAAQ,oBAAoB,WAAW,KAAK,oBAAoB,SAAS,OAAO,MAAM;CAG5F,MAAM,aAAa,gBAFC,OAAO,cAAcA,OAAK,QAAQ,MAAM,WAAW,IAAI,QAAQ,IAAI,GACrE,OAAO,aAAA,aACgC;CACzD,MAAM,eAAe,OAAO,uBAAuB,CAAC;CAEpD,OAAO,CAAC,GAAG,YAAY,GAAG,YAAY;AACxC"}

package/dist/tools/web-search.js

@@ -1,65 +1,61 @@
-import { createTool } from "@mastra/core/tools";
-import { createTavilySearchTool, createTavilyExtractTool } from "@mastra/tavily";
 import { truncateStringForTokenEstimate } from "../utils/token-estimator.js";
+import { createTool } from "@mastra/core/tools";
+import { createTavilyExtractTool, createTavilySearchTool } from "@mastra/tavily";
+//#region src/tools/web-search.ts
 const MAX_WEB_SEARCH_TOKENS = 2e3;
 const MAX_WEB_EXTRACT_TOKENS = 2e3;
-const MIN_RELEVANCE_SCORE = 0.25;
+const MIN_RELEVANCE_SCORE = .25;
+/**
+* Check whether a Tavily API key is available in the environment.
+* Used by main.ts to decide whether to include Tavily tools or fall back
+* to Anthropic's native web search.
+*/
 function hasTavilyKey() {
-  return !!process.env.TAVILY_API_KEY;
+	return !!process.env.TAVILY_API_KEY;
 }
+/**
+* Wraps the @mastra/tavily search tool with mastracode-specific behavior:
+* relevance filtering, markdown string formatting, and token truncation.
+* The underlying Tavily tool handles client init, input validation, and the API call.
+*/
 function createWebSearchTool() {
-  const tavilySearchTool = createTavilySearchTool();
-  return createTool({
-    id: "web-search",
-    description: tavilySearchTool.description,
-    inputSchema: tavilySearchTool.inputSchema,
-    execute: async (input, context) => {
-      const output = await tavilySearchTool.execute(input, context);
-      const parts = [];
-      if (output.answer) {
-        parts.push(`Answer: ${output.answer}`);
-      }
-      const filtered = output.results.filter((r) => (r.score ?? 1) >= MIN_RELEVANCE_SCORE);
-      for (const r of filtered) {
-        parts.push(`## ${r.title}
-${r.url}
-${r.content}`);
-      }
-      const images = (output.images || []).map((img) => img.url).filter(Boolean);
-      if (images.length > 0) {
-        parts.push(`Images:
-${images.join("\n")}`);
-      }
-      const text = parts.join("\n\n");
-      return truncateStringForTokenEstimate(text, MAX_WEB_SEARCH_TOKENS);
-    }
-  });
+	const tavilySearchTool = createTavilySearchTool();
+	return createTool({
+		id: "web-search",
+		description: tavilySearchTool.description,
+		inputSchema: tavilySearchTool.inputSchema,
+		execute: async (input, context) => {
+			const output = await tavilySearchTool.execute(input, context);
+			const parts = [];
+			if (output.answer) parts.push(`Answer: ${output.answer}`);
+			const filtered = output.results.filter((r) => (r.score ?? 1) >= MIN_RELEVANCE_SCORE);
+			for (const r of filtered) parts.push(`## ${r.title}\n${r.url}\n${r.content}`);
+			const images = (output.images || []).map((img) => img.url).filter(Boolean);
+			if (images.length > 0) parts.push(`Images:\n${images.join("\n")}`);
+			return truncateStringForTokenEstimate(parts.join("\n\n"), MAX_WEB_SEARCH_TOKENS);
+		}
+	});
 }
+/**
+* Wraps the @mastra/tavily extract tool with mastracode-specific behavior:
+* markdown string formatting and token truncation.
+*/
 function createWebExtractTool() {
-  const tavilyExtractTool = createTavilyExtractTool();
-  return createTool({
-    id: "web-extract",
-    description: tavilyExtractTool.description,
-    inputSchema: tavilyExtractTool.inputSchema,
-    execute: async (input, context) => {
-      const output = await tavilyExtractTool.execute(input, context);
-      const parts = [];
-      for (const r of output.results) {
-        parts.push(`## ${r.url}
-${r.rawContent}`);
-      }
-      for (const r of output.failedResults) {
-        parts.push(`## ${r.url}
-Error: ${r.error}`);
-      }
-      const text = parts.join("\n\n");
-      return truncateStringForTokenEstimate(text, MAX_WEB_EXTRACT_TOKENS);
-    }
-  });
+	const tavilyExtractTool = createTavilyExtractTool();
+	return createTool({
+		id: "web-extract",
+		description: tavilyExtractTool.description,
+		inputSchema: tavilyExtractTool.inputSchema,
+		execute: async (input, context) => {
+			const output = await tavilyExtractTool.execute(input, context);
+			const parts = [];
+			for (const r of output.results) parts.push(`## ${r.url}\n${r.rawContent}`);
+			for (const r of output.failedResults) parts.push(`## ${r.url}\nError: ${r.error}`);
+			return truncateStringForTokenEstimate(parts.join("\n\n"), MAX_WEB_EXTRACT_TOKENS);
+		}
+	});
 }
-export {
-  createWebExtractTool,
-  createWebSearchTool,
-  hasTavilyKey
-};
+//#endregion
+export { createWebExtractTool, createWebSearchTool, hasTavilyKey };
+
 //# sourceMappingURL=web-search.js.map

package/dist/tools/web-search.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/tools/web-search.ts"],"sourcesContent":["import { createTool } from '@mastra/core/tools';\nimport { createTavilySearchTool, createTavilyExtractTool } from '@mastra/tavily';\n\nimport { truncateStringForTokenEstimate } from '../utils/token-estimator.js';\n\nconst MAX_WEB_SEARCH_TOKENS = 2_000;\nconst MAX_WEB_EXTRACT_TOKENS = 2_000;\n\nconst MIN_RELEVANCE_SCORE = 0.25;\n\n/**\n * Check whether a Tavily API key is available in the environment.\n * Used by main.ts to decide whether to include Tavily tools or fall back\n * to Anthropic's native web search.\n */\nexport function hasTavilyKey(): boolean {\n  return !!process.env.TAVILY_API_KEY;\n}\n\n/**\n * Wraps the @mastra/tavily search tool with mastracode-specific behavior:\n * relevance filtering, markdown string formatting, and token truncation.\n * The underlying Tavily tool handles client init, input validation, and the API call.\n */\nexport function createWebSearchTool() {\n  const tavilySearchTool = createTavilySearchTool();\n\n  return createTool({\n    id: 'web-search',\n    description: tavilySearchTool.description!,\n    inputSchema: tavilySearchTool.inputSchema!,\n    execute: async (input, context) => {\n      const output: any = await tavilySearchTool.execute!(input as any, context as any);\n\n      const parts: string[] = [];\n\n      if (output.answer) {\n        parts.push(`Answer: ${output.answer}`);\n      }\n\n      const filtered = output.results.filter((r: any) => (r.score ?? 1) >= MIN_RELEVANCE_SCORE);\n      for (const r of filtered) {\n        parts.push(`## ${r.title}\\n${r.url}\\n${r.content}`);\n      }\n\n      const images = (output.images || []).map((img: any) => img.url).filter(Boolean);\n      if (images.length > 0) {\n        parts.push(`Images:\\n${images.join('\\n')}`);\n      }\n\n      const text = parts.join('\\n\\n');\n      return truncateStringForTokenEstimate(text, MAX_WEB_SEARCH_TOKENS);\n    },\n  });\n}\n\n/**\n * Wraps the @mastra/tavily extract tool with mastracode-specific behavior:\n * markdown string formatting and token truncation.\n */\nexport function createWebExtractTool() {\n  const tavilyExtractTool = createTavilyExtractTool();\n\n  return createTool({\n    id: 'web-extract',\n    description: tavilyExtractTool.description!,\n    inputSchema: tavilyExtractTool.inputSchema!,\n    execute: async (input, context) => {\n      const output: any = await tavilyExtractTool.execute!(input as any, context as any);\n\n      const parts: string[] = [];\n\n      for (const r of output.results) {\n        parts.push(`## ${r.url}\\n${r.rawContent}`);\n      }\n\n      for (const r of output.failedResults) {\n        parts.push(`## ${r.url}\\nError: ${r.error}`);\n      }\n\n      const text = parts.join('\\n\\n');\n      return truncateStringForTokenEstimate(text, MAX_WEB_EXTRACT_TOKENS);\n    },\n  });\n}\n"],"mappings":"AAAA,SAAS,kBAAkB;AAC3B,SAAS,wBAAwB,+BAA+B;AAEhE,SAAS,sCAAsC;AAE/C,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAE/B,MAAM,sBAAsB;AAOrB,SAAS,eAAwB;AACtC,SAAO,CAAC,CAAC,QAAQ,IAAI;AACvB;AAOO,SAAS,sBAAsB;AACpC,QAAM,mBAAmB,uBAAuB;AAEhD,SAAO,WAAW;AAAA,IAChB,IAAI;AAAA,IACJ,aAAa,iBAAiB;AAAA,IAC9B,aAAa,iBAAiB;AAAA,IAC9B,SAAS,OAAO,OAAO,YAAY;AACjC,YAAM,SAAc,MAAM,iBAAiB,QAAS,OAAc,OAAc;AAEhF,YAAM,QAAkB,CAAC;AAEzB,UAAI,OAAO,QAAQ;AACjB,cAAM,KAAK,WAAW,OAAO,MAAM,EAAE;AAAA,MACvC;AAEA,YAAM,WAAW,OAAO,QAAQ,OAAO,CAAC,OAAY,EAAE,SAAS,MAAM,mBAAmB;AACxF,iBAAW,KAAK,UAAU;AACxB,cAAM,KAAK,MAAM,EAAE,KAAK;AAAA,EAAK,EAAE,GAAG;AAAA,EAAK,EAAE,OAAO,EAAE;AAAA,MACpD;AAEA,YAAM,UAAU,OAAO,UAAU,CAAC,GAAG,IAAI,CAAC,QAAa,IAAI,GAAG,EAAE,OAAO,OAAO;AAC9E,UAAI,OAAO,SAAS,GAAG;AACrB,cAAM,KAAK;AAAA,EAAY,OAAO,KAAK,IAAI,CAAC,EAAE;AAAA,MAC5C;AAEA,YAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,aAAO,+BAA+B,MAAM,qBAAqB;AAAA,IACnE;AAAA,EACF,CAAC;AACH;AAMO,SAAS,uBAAuB;AACrC,QAAM,oBAAoB,wBAAwB;AAElD,SAAO,WAAW;AAAA,IAChB,IAAI;AAAA,IACJ,aAAa,kBAAkB;AAAA,IAC/B,aAAa,kBAAkB;AAAA,IAC/B,SAAS,OAAO,OAAO,YAAY;AACjC,YAAM,SAAc,MAAM,kBAAkB,QAAS,OAAc,OAAc;AAEjF,YAAM,QAAkB,CAAC;AAEzB,iBAAW,KAAK,OAAO,SAAS;AAC9B,cAAM,KAAK,MAAM,EAAE,GAAG;AAAA,EAAK,EAAE,UAAU,EAAE;AAAA,MAC3C;AAEA,iBAAW,KAAK,OAAO,eAAe;AACpC,cAAM,KAAK,MAAM,EAAE,GAAG;AAAA,SAAY,EAAE,KAAK,EAAE;AAAA,MAC7C;AAEA,YAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,aAAO,+BAA+B,MAAM,sBAAsB;AAAA,IACpE;AAAA,EACF,CAAC;AACH;","names":[]}
+{"version":3,"file":"web-search.js","names":[],"sources":["../../src/tools/web-search.ts"],"sourcesContent":["import { createTool } from '@mastra/core/tools';\nimport { createTavilySearchTool, createTavilyExtractTool } from '@mastra/tavily';\n\nimport { truncateStringForTokenEstimate } from '../utils/token-estimator.js';\n\nconst MAX_WEB_SEARCH_TOKENS = 2_000;\nconst MAX_WEB_EXTRACT_TOKENS = 2_000;\n\nconst MIN_RELEVANCE_SCORE = 0.25;\n\n/**\n * Check whether a Tavily API key is available in the environment.\n * Used by main.ts to decide whether to include Tavily tools or fall back\n * to Anthropic's native web search.\n */\nexport function hasTavilyKey(): boolean {\n  return !!process.env.TAVILY_API_KEY;\n}\n\n/**\n * Wraps the @mastra/tavily search tool with mastracode-specific behavior:\n * relevance filtering, markdown string formatting, and token truncation.\n * The underlying Tavily tool handles client init, input validation, and the API call.\n */\nexport function createWebSearchTool() {\n  const tavilySearchTool = createTavilySearchTool();\n\n  return createTool({\n    id: 'web-search',\n    description: tavilySearchTool.description!,\n    inputSchema: tavilySearchTool.inputSchema!,\n    execute: async (input, context) => {\n      const output: any = await tavilySearchTool.execute!(input as any, context as any);\n\n      const parts: string[] = [];\n\n      if (output.answer) {\n        parts.push(`Answer: ${output.answer}`);\n      }\n\n      const filtered = output.results.filter((r: any) => (r.score ?? 1) >= MIN_RELEVANCE_SCORE);\n      for (const r of filtered) {\n        parts.push(`## ${r.title}\\n${r.url}\\n${r.content}`);\n      }\n\n      const images = (output.images || []).map((img: any) => img.url).filter(Boolean);\n      if (images.length > 0) {\n        parts.push(`Images:\\n${images.join('\\n')}`);\n      }\n\n      const text = parts.join('\\n\\n');\n      return truncateStringForTokenEstimate(text, MAX_WEB_SEARCH_TOKENS);\n    },\n  });\n}\n\n/**\n * Wraps the @mastra/tavily extract tool with mastracode-specific behavior:\n * markdown string formatting and token truncation.\n */\nexport function createWebExtractTool() {\n  const tavilyExtractTool = createTavilyExtractTool();\n\n  return createTool({\n    id: 'web-extract',\n    description: tavilyExtractTool.description!,\n    inputSchema: tavilyExtractTool.inputSchema!,\n    execute: async (input, context) => {\n      const output: any = await tavilyExtractTool.execute!(input as any, context as any);\n\n      const parts: string[] = [];\n\n      for (const r of output.results) {\n        parts.push(`## ${r.url}\\n${r.rawContent}`);\n      }\n\n      for (const r of output.failedResults) {\n        parts.push(`## ${r.url}\\nError: ${r.error}`);\n      }\n\n      const text = parts.join('\\n\\n');\n      return truncateStringForTokenEstimate(text, MAX_WEB_EXTRACT_TOKENS);\n    },\n  });\n}\n"],"mappings":";;;;AAKA,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAE/B,MAAM,sBAAsB;;;;;;AAO5B,SAAgB,eAAwB;CACtC,OAAO,CAAC,CAAC,QAAQ,IAAI;AACvB;;;;;;AAOA,SAAgB,sBAAsB;CACpC,MAAM,mBAAmB,uBAAuB;CAEhD,OAAO,WAAW;EAChB,IAAI;EACJ,aAAa,iBAAiB;EAC9B,aAAa,iBAAiB;EAC9B,SAAS,OAAO,OAAO,YAAY;GACjC,MAAM,SAAc,MAAM,iBAAiB,QAAS,OAAc,OAAc;GAEhF,MAAM,QAAkB,CAAC;GAEzB,IAAI,OAAO,QACT,MAAM,KAAK,WAAW,OAAO,QAAQ;GAGvC,MAAM,WAAW,OAAO,QAAQ,QAAQ,OAAY,EAAE,SAAS,MAAM,mBAAmB;GACxF,KAAK,MAAM,KAAK,UACd,MAAM,KAAK,MAAM,EAAE,MAAM,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS;GAGpD,MAAM,UAAU,OAAO,UAAU,CAAC,EAAA,CAAG,KAAK,QAAa,IAAI,GAAG,CAAC,CAAC,OAAO,OAAO;GAC9E,IAAI,OAAO,SAAS,GAClB,MAAM,KAAK,YAAY,OAAO,KAAK,IAAI,GAAG;GAI5C,OAAO,+BADM,MAAM,KAAK,MACiB,GAAG,qBAAqB;EACnE;CACF,CAAC;AACH;;;;;AAMA,SAAgB,uBAAuB;CACrC,MAAM,oBAAoB,wBAAwB;CAElD,OAAO,WAAW;EAChB,IAAI;EACJ,aAAa,kBAAkB;EAC/B,aAAa,kBAAkB;EAC/B,SAAS,OAAO,OAAO,YAAY;GACjC,MAAM,SAAc,MAAM,kBAAkB,QAAS,OAAc,OAAc;GAEjF,MAAM,QAAkB,CAAC;GAEzB,KAAK,MAAM,KAAK,OAAO,SACrB,MAAM,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,YAAY;GAG3C,KAAK,MAAM,KAAK,OAAO,eACrB,MAAM,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,OAAO;GAI7C,OAAO,+BADM,MAAM,KAAK,MACiB,GAAG,sBAAsB;EACpE;CACF,CAAC;AACH"}