@moikapy/lich 0.6.0 → 0.7.1

package/dist/{chunk-7HLVKVIG.js → chunk-WNFBIX4E.js}

@@ -4,6 +4,7 @@ import { readdir } from "fs/promises";
 import path2 from "path";
 
 // src/tools/guard.ts
+import fs from "fs";
 import path from "path";
 
 // src/util/json.ts
@@ -33,14 +34,73 @@ function truncate_text(text, max_chars) {
 // src/tools/guard.ts
 var DEFAULT_MAX_OUTPUT_CHARS = 2e4;
 var DEFAULT_TOOL_TIMEOUT_MS = 3e4;
-function resolve_safe_path(base_dir, target) {
+function is_inside(base, candidate) {
+  const relative = path.relative(base, candidate);
+  return relative.startsWith("..") === false && path.isAbsolute(relative) === false;
+}
+function deepest_existing(target) {
+  let current = target;
+  while (fs.existsSync(current) === false) {
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return current;
+    }
+    current = parent;
+  }
+  return current;
+}
+function resolve_safe_path(base_dir, target, for_write = false) {
   const base = path.resolve(base_dir);
   const resolved = path.resolve(base, target);
-  const relative = path.relative(base, resolved);
-  if (relative.startsWith("..") === true || path.isAbsolute(relative) === true) {
+  if (is_inside(base, resolved) === false) {
+    throw new Error(`path_escape: ${target} escapes ${base_dir}`);
+  }
+  const real_base = fs.realpathSync(base);
+  const existing = deepest_existing(resolved);
+  const real_existing = fs.realpathSync(existing);
+  const suffix = path.relative(existing, resolved);
+  const real_resolved = suffix.length === 0 ? real_existing : path.resolve(real_existing, suffix);
+  if (is_inside(real_base, real_resolved) === false) {
+    throw new Error(`path_escape: ${target} escapes ${base_dir}`);
+  }
+  if (for_write === true) {
+    reject_symlink_leaf(resolved, target, base_dir);
+  }
+  return real_resolved;
+}
+function reject_symlink_leaf(resolved, target, base_dir) {
+  let info;
+  try {
+    info = fs.lstatSync(resolved);
+  } catch (err) {
+    if (is_enoent(err) === true) {
+      return;
+    }
+    throw err;
+  }
+  if (info.isSymbolicLink() === true) {
     throw new Error(`path_escape: ${target} escapes ${base_dir}`);
   }
-  return resolved;
+}
+function assert_file_tool_access(work_dir, resolved, mode) {
+  const base = fs.realpathSync(path.resolve(work_dir));
+  const rel = path.relative(base, resolved);
+  const parts = rel.split(path.sep).filter((part) => part.length > 0);
+  if (parts[0] === ".lich" && parts[1] === "config.json" && parts.length === 2) {
+    throw new Error("forbidden_path: .lich/config.json");
+  }
+  if (mode === "write" && parts[0] === ".lich") {
+    const allowed = parts[1] === "skills" || parts[1] === "plugins";
+    if (allowed === false) {
+      throw new Error("forbidden_path: .lich writes limited to skills/ and plugins/");
+    }
+  }
+  if (mode === "write") {
+    const leaf = path.basename(resolved);
+    if (leaf === ".env" || leaf.startsWith(".env.")) {
+      throw new Error("forbidden_path: .env*");
+    }
+  }
 }
 function require_string_arg(args, key) {
   const value = args[key];
@@ -116,6 +176,233 @@ async function capture_errors(run) {
   }
 }
 
+// src/tools/url_guard.ts
+import dns from "dns/promises";
+import http from "http";
+import https from "https";
+import net from "net";
+var MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var fetch_override;
+function private_urls_allowed() {
+  return process.env["LICH_ALLOW_PRIVATE_URLS"] === "1";
+}
+function is_blocked_ipv4(address) {
+  const parts = address.split(".").map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((n) => Number.isFinite(n) === false)) {
+    return true;
+  }
+  const [a, b] = parts;
+  if (a === 0 || a === 10 || a === 127) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  if (a === 100 && b >= 64 && b <= 127) {
+    return true;
+  }
+  return a >= 224;
+}
+function is_blocked_ipv6(address) {
+  const normalized = address.toLowerCase();
+  if (normalized === "::" || normalized === "::1") {
+    return true;
+  }
+  if (normalized.startsWith("::ffff:")) {
+    const mapped = normalized.slice("::ffff:".length);
+    return net.isIPv4(mapped) === true ? is_blocked_ipv4(mapped) : true;
+  }
+  const head = Number.parseInt(normalized.split(":")[0] ?? "", 16);
+  if (Number.isFinite(head) === false) {
+    return true;
+  }
+  if ((head & 65472) === 65152) {
+    return true;
+  }
+  if ((head & 65024) === 64512) {
+    return true;
+  }
+  return false;
+}
+function is_blocked_ip(address) {
+  if (net.isIPv4(address) === true) {
+    return is_blocked_ipv4(address);
+  }
+  if (net.isIPv6(address) === true) {
+    return is_blocked_ipv6(address);
+  }
+  return true;
+}
+function parse_http_url(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error(`invalid_url: ${raw}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`invalid_url: unsupported protocol ${parsed.protocol}`);
+  }
+  return parsed;
+}
+function normalize_hostname(hostname) {
+  if (hostname.startsWith("[") === true && hostname.endsWith("]") === true) {
+    return hostname.slice(1, -1);
+  }
+  return hostname;
+}
+async function resolve_public_ip(raw_hostname) {
+  const hostname = normalize_hostname(raw_hostname);
+  if (private_urls_allowed() === true) {
+    if (net.isIP(hostname) !== 0) {
+      return hostname;
+    }
+    const hit = await dns.lookup(hostname);
+    return hit.address;
+  }
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
+    throw new Error(`blocked_url: ${hostname}`);
+  }
+  if (net.isIP(hostname) !== 0) {
+    if (is_blocked_ip(hostname) === true) {
+      throw new Error(`blocked_url: ${hostname}`);
+    }
+    return hostname;
+  }
+  const records = await dns.lookup(hostname, { all: true, verbatim: true });
+  if (records.length === 0) {
+    throw new Error(`blocked_url: ${hostname}`);
+  }
+  for (const record of records) {
+    if (is_blocked_ip(record.address) === true) {
+      throw new Error(`blocked_url: ${hostname}`);
+    }
+  }
+  return records[0]?.address ?? hostname;
+}
+function pinned_lookup(ip) {
+  const family = net.isIPv6(ip) === true ? 6 : 4;
+  return ((_hostname, options, callback) => {
+    const cb = typeof options === "function" ? options : callback;
+    const opts = typeof options === "function" ? void 0 : options;
+    if (typeof cb !== "function") {
+      return;
+    }
+    if (opts !== void 0 && opts.all === true) {
+      cb(null, [{ address: ip, family }]);
+      return;
+    }
+    cb(null, ip, family);
+  });
+}
+function request_headers(init) {
+  const headers = {};
+  new Headers(init?.headers).forEach((value, key) => {
+    headers[key] = value;
+  });
+  return headers;
+}
+function request_body(init) {
+  const body = init?.body;
+  if (body === void 0 || body === null) {
+    return void 0;
+  }
+  if (typeof body === "string" || body instanceof Uint8Array) {
+    return body;
+  }
+  throw new Error("blocked_url: unsupported_body");
+}
+function pinned_http_fetch(url, ip, init) {
+  const lib = url.protocol === "https:" ? https : http;
+  const method = (init.method ?? "GET").toUpperCase();
+  const headers = request_headers(init);
+  const body = request_body(init);
+  return new Promise((resolve, reject) => {
+    const req = lib.request(
+      {
+        protocol: url.protocol,
+        hostname: url.hostname,
+        port: url.port.length > 0 ? Number(url.port) : void 0,
+        path: `${url.pathname}${url.search}`,
+        method,
+        headers,
+        lookup: pinned_lookup(ip)
+      },
+      (incoming) => {
+        const chunks = [];
+        incoming.on("data", (chunk) => {
+          chunks.push(chunk);
+        });
+        incoming.on("end", () => {
+          const status = incoming.statusCode ?? 0;
+          const response_headers = new Headers();
+          for (const [key, value] of Object.entries(incoming.headers)) {
+            if (typeof value === "string") {
+              response_headers.set(key, value);
+            } else if (Array.isArray(value) === true) {
+              for (const part of value) {
+                response_headers.append(key, part);
+              }
+            }
+          }
+          resolve(new Response(Buffer.concat(chunks), { status, headers: response_headers }));
+        });
+      }
+    );
+    req.on("error", reject);
+    const signal = init.signal;
+    if (signal !== void 0 && signal !== null) {
+      if (signal.aborted === true) {
+        req.destroy(new Error("aborted"));
+        return;
+      }
+      signal.addEventListener(
+        "abort",
+        () => {
+          req.destroy(new Error("aborted"));
+        },
+        { once: true }
+      );
+    }
+    if (body !== void 0) {
+      req.write(body);
+    }
+    req.end();
+  });
+}
+function redirect_target(current, response) {
+  if (REDIRECT_STATUSES.has(response.status) === false) {
+    return void 0;
+  }
+  const location = response.headers.get("location");
+  if (location === null || location.length === 0) {
+    return void 0;
+  }
+  return new URL(location, current);
+}
+async function safe_fetch(raw_url, init) {
+  let current = parse_http_url(raw_url);
+  let request_init = { ...init ?? {}, redirect: "manual" };
+  for (let hop = 0; hop < MAX_REDIRECTS; hop += 1) {
+    const ip = await resolve_public_ip(current.hostname);
+    const response = fetch_override !== void 0 ? await fetch_override(current.href, { ...request_init, redirect: "manual" }) : await pinned_http_fetch(current, ip, request_init);
+    const next = redirect_target(current, response);
+    if (next === void 0) {
+      return response;
+    }
+    current = next;
+    request_init = { ...request_init, method: "GET", body: void 0 };
+  }
+  throw new Error("blocked_url: too_many_redirects");
+}
+
 // src/tools/builtin/fetch_url.ts
 var DEFAULT_MAX_CHARS = 2e4;
 var MAX_MAX_CHARS = 1e5;
@@ -136,15 +423,7 @@ function clamp_int_arg(args, key, fallback, max) {
   return Math.min(max, Math.max(1, Math.floor(optional_number_arg(args, key, fallback))));
 }
 function valid_http_url(raw) {
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    throw new Error(`invalid_url: ${raw}`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`invalid_url: unsupported protocol ${parsed.protocol}`);
-  }
+  parse_http_url(raw);
 }
 function compose_abort_signal(timeout_ms, external) {
   const timeout_signal = AbortSignal.timeout(timeout_ms);
@@ -155,8 +434,7 @@ async function run_fetch_url(args, external) {
   valid_http_url(url);
   const max_chars = clamp_int_arg(args, "max_chars", DEFAULT_MAX_CHARS, MAX_MAX_CHARS);
   const timeout_ms = clamp_int_arg(args, "timeout_ms", DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
-  const response = await fetch(url, {
-    redirect: "follow",
+  const response = await safe_fetch(url, {
     headers: { "user-agent": USER_AGENT },
     signal: compose_abort_signal(timeout_ms, external)
   });
@@ -618,10 +896,11 @@ function replacement_for(content, old_string, new_string, replace_all) {
   if (replace_all === true) {
     return content.split(old_string).join(new_string);
   }
-  return content.replace(old_string, new_string);
+  return content.replace(old_string, () => new_string);
 }
 async function apply_edit(work_dir, target, old_string, new_string, replace_all) {
-  const file_path = resolve_safe_path(work_dir, target);
+  const file_path = resolve_safe_path(work_dir, target, true);
+  assert_file_tool_access(work_dir, file_path, "write");
   let content;
   try {
     content = await readFile(file_path, "utf8");
@@ -650,9 +929,12 @@ var edit_file_tool = {
   execute: async (args, context) => capture_errors(async () => {
     const target = require_string_arg(args, "path");
     const old_string = require_string_arg(args, "old_string");
-    const new_string = require_string_arg(args, "new_string");
+    const new_raw = args["new_string"];
+    if (typeof new_raw !== "string") {
+      throw new Error("missing_arg: new_string");
+    }
     const replace_all = optional_boolean_arg(args, "replace_all", false);
-    const result = await apply_edit(context.work_dir, target, old_string, new_string, replace_all);
+    const result = await apply_edit(context.work_dir, target, old_string, new_raw, replace_all);
     return { ok: true, output: result.output };
   })
 };
@@ -812,7 +1094,7 @@ async function scan_dir(frame, matcher) {
     return { files, dirs };
   }
   for (const entry of entries) {
-    if (SKIP_DIRS.has(entry.name) === true) {
+    if (SKIP_DIRS.has(entry.name) === true || entry.isSymbolicLink() === true) {
       continue;
     }
     const full = path5.join(frame.dir, entry.name);
@@ -824,13 +1106,25 @@ async function scan_dir(frame, matcher) {
   }
   return { files, dirs };
 }
-async function search_file(frame, relative_root, regex, collected, max_results) {
-  const size = await file_size(frame.dir);
-  const lines = await read_if_text(frame.dir, size);
+function guard_grep_target(work_dir, absolute) {
+  const relative = path5.relative(work_dir, absolute);
+  const safe = resolve_safe_path(work_dir, relative);
+  assert_file_tool_access(work_dir, safe, "read");
+  return safe;
+}
+async function search_file(frame, work_dir, relative_root, regex, collected, max_results) {
+  let safe;
+  try {
+    safe = guard_grep_target(work_dir, frame.dir);
+  } catch {
+    return false;
+  }
+  const size = await file_size(safe);
+  const lines = await read_if_text(safe, size);
   if (lines === void 0) {
     return false;
   }
-  const relative = path5.relative(relative_root, frame.dir);
+  const relative = path5.relative(relative_root, safe);
   for (const hit of match_lines(lines, regex)) {
     collected.push(`${relative}:${hit.line_no}: ${hit.text}`);
     if (collected.length >= max_results) {
@@ -839,7 +1133,7 @@ async function search_file(frame, relative_root, regex, collected, max_results)
   }
   return false;
 }
-async function search_tree(root, regex, matcher, max_results) {
+async function search_tree(root, work_dir, regex, matcher, max_results) {
   const collected = [];
   const stack = [{ dir: root, name: root }];
   while (stack.length > 0 && collected.length < max_results) {
@@ -849,7 +1143,7 @@ async function search_tree(root, regex, matcher, max_results) {
     }
     const found = await scan_dir(frame, matcher);
     for (const file of found.files) {
-      const hit_cap = await search_file(file, root, regex, collected, max_results);
+      const hit_cap = await search_file(file, work_dir, root, regex, collected, max_results);
       if (hit_cap === true) {
         break;
       }
@@ -869,13 +1163,20 @@ function finalize_output(matches, max_results) {
   }
   return matches.join("\n");
 }
-function search_file_direct(file_path, regex, collected, max_results) {
-  return search_file({ dir: file_path, name: path5.basename(file_path) }, path5.dirname(file_path), regex, collected, max_results);
+function search_file_direct(file_path, work_dir, regex, collected, max_results) {
+  return search_file(
+    { dir: file_path, name: path5.basename(file_path) },
+    work_dir,
+    path5.dirname(file_path),
+    regex,
+    collected,
+    max_results
+  );
 }
-async function collect_file_matches(root, regex, matcher, max_results) {
+async function collect_file_matches(root, work_dir, regex, matcher, max_results) {
   const collected = [];
   if (matcher(path5.basename(root)) === true) {
-    await search_file_direct(root, regex, collected, max_results);
+    await search_file_direct(root, work_dir, regex, collected, max_results);
   }
   return collected;
 }
@@ -892,9 +1193,10 @@ async function run_grep(args, work_dir) {
   }
   const matcher = glob.length > 0 ? glob_matcher(glob) : () => true;
   const root = resolve_safe_path(work_dir, target);
+  assert_file_tool_access(work_dir, root, "read");
   const root_stat = await stat(root);
   const cap = max_results + 1;
-  const matches = root_stat.isDirectory() === true ? await search_tree(root, regex, matcher, cap) : await collect_file_matches(root, regex, matcher, cap);
+  const matches = root_stat.isDirectory() === true ? await search_tree(root, work_dir, regex, matcher, cap) : await collect_file_matches(root, work_dir, regex, matcher, cap);
   return finalize_output(matches, max_results);
 }
 var grep_files_tool = {
@@ -966,7 +1268,6 @@ async function run_http(args, external) {
   const init = {
     method,
     headers: read_headers(args),
-    redirect: "follow",
     signal: compose_abort_signal(timeout_ms, external)
   };
   if (method !== "GET" && method !== "HEAD") {
@@ -975,7 +1276,7 @@ async function run_http(args, external) {
       init.body = body;
     }
   }
-  const response = await fetch(url, init);
+  const response = await safe_fetch(url, init);
   const content_type = response.headers.get("content-type") ?? "unknown";
   const text = await response.text();
   const sections = [
@@ -1187,6 +1488,7 @@ function slice_lines2(content, offset, limit) {
 }
 async function read_target(args, work_dir, target) {
   const file_path = resolve_safe_path(work_dir, target);
+  assert_file_tool_access(work_dir, file_path, "read");
   const content = await readFile3(file_path, "utf8");
   const offset = optional_number_arg(args, "offset", 1);
   const limit = optional_number_arg(args, "limit", Number.MAX_SAFE_INTEGER);
@@ -1211,78 +1513,47 @@ var read_file_tool = {
 };
 
 // src/tools/builtin/run_tests.ts
+import { spawn as spawn2 } from "child_process";
+
+// src/tools/builtin/terminal.ts
 import { spawn } from "child_process";
-var MAX_OUTPUT_CHARS = 2e3;
-var DEFAULT_TEST_COMMAND = "node node_modules/vitest/vitest.mjs run";
-var parameters12 = {
-  type: "object",
-  properties: {
-    filter: {
-      type: "string",
-      description: "Optional test-file filter appended to the test command (e.g. a vitest file filter)"
-    }
-  },
-  additionalProperties: false
+
+// src/gateway/token_env.ts
+var DEFAULT_GATEWAY_TOKEN_ENVS = {
+  webhook: "LICH_GATEWAY_TOKEN",
+  telegram: "LICH_TELEGRAM_BOT_TOKEN",
+  discord: "LICH_DISCORD_BOT_TOKEN",
+  twitch: "LICH_TWITCH_OAUTH_TOKEN"
 };
-var busy = false;
-var run_test_command = default_runner;
-function default_runner(command, cwd, on_chunk) {
-  const child = spawn("bash", ["-lc", command], {
-    cwd,
-    env: process.env,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  child.stdout?.on("data", (chunk) => on_chunk("stdout", chunk));
-  child.stderr?.on("data", (chunk) => on_chunk("stderr", chunk));
-  return new Promise((resolve) => {
-    child.on("close", (code) => resolve({ exit_code: code ?? -1 }));
-    child.on("error", () => resolve({ exit_code: -1 }));
-  });
+var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function is_env_var_name(value) {
+  return ENV_VAR_NAME.test(value) === true;
 }
-function shell_quote(token) {
-  return `'${token.replaceAll("'", "'\\''")}'`;
+function platform_token_env(config, platform) {
+  const named = config.gateway?.token_envs[platform];
+  if (named !== void 0 && named.length > 0) {
+    return is_env_var_name(named) === true ? named : "";
+  }
+  return DEFAULT_GATEWAY_TOKEN_ENVS[platform] ?? "";
 }
-function build_command(filter, env) {
-  const base = optional_string_arg(env, "LICH_TEST_COMMAND", DEFAULT_TEST_COMMAND);
-  return filter === void 0 ? base : `${base} ${shell_quote(filter)}`;
+function read_platform_token(config, platform) {
+  const key = platform_token_env(config, platform);
+  if (is_env_var_name(key) === false) {
+    return void 0;
+  }
+  const value = process.env[key];
+  if (typeof value !== "string" || value.length === 0) {
+    return void 0;
+  }
+  return value;
 }
-var run_tests_tool = {
-  name: "run_tests",
-  description: "Run the project's test suite via LICH_TEST_COMMAND (default: vitest) in work_dir and report a structured pass/fail result with clamped output.",
-  parameters: parameters12,
-  timeout_ms: 6e5,
-  execute: async (args, context) => capture_errors(async () => {
-    if (busy === true) {
-      return { ok: false, output: "", error: "run_tests_busy" };
-    }
-    busy = true;
-    try {
-      const filter = optional_string_arg(args, "filter", "");
-      const command = build_command(filter === "" ? void 0 : filter, context.env);
-      const streams = { stdout: "", stderr: "" };
-      const on_chunk = (stream, chunk) => {
-        streams[stream] = streams[stream] + chunk.toString("utf8");
-      };
-      const outcome = await run_test_command(command, context.work_dir, on_chunk);
-      const ok = outcome.exit_code === 0;
-      return {
-        ok,
-        output: clamp_output(`${streams.stdout}${streams.stderr}
-[exit ${outcome.exit_code}]`, MAX_OUTPUT_CHARS),
-        ...ok ? {} : { error: "tests_failed" }
-      };
-    } finally {
-      busy = false;
-    }
-  })
-};
 
 // src/tools/builtin/terminal.ts
-import { spawn as spawn2 } from "child_process";
 var MAX_STREAM_CHARS = 5e4;
 var DEFAULT_TIMEOUT_MS3 = 6e4;
 var MAX_TIMEOUT_MS3 = 3e5;
-var parameters13 = {
+var PROVIDER_KEY_ENVS = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY", "LICH_API_KEY"];
+var parameters12 = {
   type: "object",
   properties: {
     command: { type: "string", description: "Shell command to run via bash -lc" },
@@ -1303,6 +1574,21 @@ function stream_chunk(current, chunk) {
 function clamp_timeout(raw) {
   return Math.min(MAX_TIMEOUT_MS3, Math.max(1, Math.floor(raw)));
 }
+function scrub_spawn_env(process_env, context_env) {
+  const drop = /* @__PURE__ */ new Set([...Object.values(DEFAULT_GATEWAY_TOKEN_ENVS), ...PROVIDER_KEY_ENVS]);
+  const merged = { ...process_env, ...context_env };
+  const scrubbed = {};
+  for (const [name, value] of Object.entries(merged)) {
+    if (value === void 0) {
+      continue;
+    }
+    if (drop.has(name) === true || SECRET_PATTERN.test(name) === true) {
+      continue;
+    }
+    scrubbed[name] = value;
+  }
+  return scrubbed;
+}
 function wire_kill(child, timeout_signal, external) {
   timeout_signal.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
   external?.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
@@ -1316,7 +1602,10 @@ function wait_close(child) {
 async function run_command(command, work_dir, env, timeout_ms, external) {
   const stdout = { text: "" };
   const stderr = { text: "" };
-  const child = spawn2("bash", ["-lc", command], { cwd: work_dir, env: { ...process.env, ...env } });
+  const child = spawn("bash", ["-lc", command], {
+    cwd: work_dir,
+    env: scrub_spawn_env(process.env, env)
+  });
   child.stdout.on("data", (chunk) => stream_chunk(stdout, chunk));
   child.stderr.on("data", (chunk) => stream_chunk(stderr, chunk));
   const close_promise = wait_close(child);
@@ -1354,7 +1643,7 @@ function terminal_result(outcome) {
 var terminal_tool = {
   name: "terminal",
   description: "Run a shell command with bash -lc and capture combined stdout/stderr plus the exit code.",
-  parameters: parameters13,
+  parameters: parameters12,
   timeout_ms: MAX_TIMEOUT_MS3,
   execute: async (args, context) => capture_errors(async () => {
     const command = require_string_arg(args, "command");
@@ -1364,6 +1653,75 @@ var terminal_tool = {
   })
 };
 
+// src/tools/builtin/run_tests.ts
+var MAX_OUTPUT_CHARS = 2e3;
+var DEFAULT_TEST_COMMAND = "node node_modules/vitest/vitest.mjs run";
+var parameters13 = {
+  type: "object",
+  properties: {
+    filter: {
+      type: "string",
+      description: "Optional test-file filter appended to the test command (e.g. a vitest file filter)"
+    }
+  },
+  additionalProperties: false
+};
+var busy = false;
+var run_test_command = default_runner;
+function default_runner(command, cwd, on_chunk) {
+  const child = spawn2("bash", ["-lc", command], {
+    cwd,
+    env: scrub_spawn_env(process.env, {}),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  child.stdout?.on("data", (chunk) => on_chunk("stdout", chunk));
+  child.stderr?.on("data", (chunk) => on_chunk("stderr", chunk));
+  return new Promise((resolve) => {
+    child.on("close", (code) => resolve({ exit_code: code ?? -1 }));
+    child.on("error", () => resolve({ exit_code: -1 }));
+  });
+}
+function shell_quote(token) {
+  return `'${token.replaceAll("'", "'\\''")}'`;
+}
+function build_command(filter, env) {
+  const base = optional_string_arg(env, "LICH_TEST_COMMAND", DEFAULT_TEST_COMMAND);
+  return filter === void 0 ? base : `${base} ${shell_quote(filter)}`;
+}
+var run_tests_tool = {
+  name: "run_tests",
+  description: "Run the project's test suite via LICH_TEST_COMMAND (default: vitest) in work_dir and report a structured pass/fail result with clamped output.",
+  parameters: parameters13,
+  timeout_ms: 6e5,
+  execute: async (args, context) => capture_errors(async () => {
+    if (busy === true) {
+      return { ok: false, output: "", error: "run_tests_busy" };
+    }
+    busy = true;
+    try {
+      const filter = optional_string_arg(args, "filter", "");
+      if (filter.startsWith("-") === true) {
+        return { ok: false, output: "", error: "invalid_filter: must not start with -" };
+      }
+      const command = build_command(filter === "" ? void 0 : filter, context.env);
+      const streams = { stdout: "", stderr: "" };
+      const on_chunk = (stream, chunk) => {
+        streams[stream] = streams[stream] + chunk.toString("utf8");
+      };
+      const outcome = await run_test_command(command, context.work_dir, on_chunk);
+      const ok = outcome.exit_code === 0;
+      return {
+        ok,
+        output: clamp_output(`${streams.stdout}${streams.stderr}
+[exit ${outcome.exit_code}]`, MAX_OUTPUT_CHARS),
+        ...ok ? {} : { error: "tests_failed" }
+      };
+    } finally {
+      busy = false;
+    }
+  })
+};
+
 // src/tools/builtin/web_search.ts
 var DEFAULT_MAX_RESULTS4 = 8;
 var MAX_RESULTS = 20;
@@ -1490,7 +1848,8 @@ function read_content_arg(args) {
   return content;
 }
 async function write_target(work_dir, target, content) {
-  const file_path = resolve_safe_path(work_dir, target);
+  const file_path = resolve_safe_path(work_dir, target, true);
+  assert_file_tool_access(work_dir, file_path, "write");
   await mkdir(path7.dirname(file_path), { recursive: true });
   await writeFile2(file_path, content, "utf8");
   return `wrote ${content.length} chars to ${target}`;
@@ -1882,41 +2241,219 @@ var ProviderError = class extends Error {
 // src/agent/config.ts
 import { z } from "zod";
 
-// src/gateway/token_env.ts
-var DEFAULT_GATEWAY_TOKEN_ENVS = {
-  webhook: "LICH_GATEWAY_TOKEN",
-  telegram: "LICH_TELEGRAM_BOT_TOKEN",
-  discord: "LICH_DISCORD_BOT_TOKEN",
-  twitch: "LICH_TWITCH_OAUTH_TOKEN"
-};
-var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function is_env_var_name(value) {
-  return ENV_VAR_NAME.test(value) === true;
+// src/gateway/access.ts
+var PUBLIC_PLATFORMS = /* @__PURE__ */ new Set(["telegram", "discord", "twitch"]);
+var DEFAULT_GATEWAY_TOOLS_ENABLED = [
+  "read_file",
+  "list_dir",
+  "grep_files",
+  "fetch_url",
+  "web_search",
+  "docs_read",
+  "docs_search"
+];
+function gateway_tools_enabled(config) {
+  return config.gateway?.tools_enabled ?? DEFAULT_GATEWAY_TOOLS_ENABLED;
 }
-function platform_token_env(config, platform) {
-  const named = config.gateway?.token_envs[platform];
-  if (named !== void 0 && named.length > 0) {
-    return is_env_var_name(named) === true ? named : "";
+function is_gateway_sender_allowed(config, platform, chat_id, user_id) {
+  if (PUBLIC_PLATFORMS.has(platform) === false) {
+    return true;
   }
-  return DEFAULT_GATEWAY_TOKEN_ENVS[platform] ?? "";
+  const users = config.gateway?.allowed_users?.[platform] ?? [];
+  const chats = config.gateway?.allowed_chats?.[platform] ?? [];
+  if (users.length === 0 && chats.length === 0) {
+    return false;
+  }
+  const user_ok = users.length === 0 || users.includes(user_id);
+  const chat_ok = chats.length === 0 || chats.includes(chat_id);
+  return user_ok && chat_ok;
 }
-function read_platform_token(config, platform) {
-  const key = platform_token_env(config, platform);
-  if (is_env_var_name(key) === false) {
-    return void 0;
+function check_gateway_sender(config, platform, chat_id, user_id) {
+  if (is_gateway_sender_allowed(config, platform, chat_id, user_id) === true) {
+    return true;
   }
-  const value = process.env[key];
-  if (typeof value !== "string" || value.length === 0) {
+  logger.warn(`gateway denied ${platform} chat=${chat_id} user=${user_id}`);
+  return false;
+}
+
+// src/mcp/mcp_pin.ts
+import path11 from "path";
+
+// src/mcp/mcp_catalog.ts
+import { existsSync as existsSync2, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "fs";
+import path9 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var cached;
+function catalog_dir() {
+  let dir = path9.dirname(fileURLToPath2(import.meta.url));
+  for (let hop = 0; hop < 6; hop += 1) {
+    const candidate = path9.join(dir, "optional-mcps");
+    if (existsSync2(path9.join(candidate, "redot", "manifest.json")) === true) {
+      return candidate;
+    }
+    dir = path9.dirname(dir);
+  }
+  throw new Error("mcp catalog not found");
+}
+function read_manifest(file) {
+  const parsed = safe_json_parse(readFileSync4(file, "utf8"));
+  if (parsed === void 0 || typeof parsed.name !== "string") {
+    throw new Error("mcp catalog manifest rejected");
+  }
+  return parsed;
+}
+function load_catalog() {
+  if (cached !== void 0) {
+    return cached;
+  }
+  const manifests = [];
+  for (const name of readdirSync3(catalog_dir())) {
+    const file = path9.join(catalog_dir(), name, "manifest.json");
+    if (existsSync2(file) === true) {
+      manifests.push(read_manifest(file));
+    }
+  }
+  cached = manifests;
+  return cached;
+}
+function catalog_by_name(name) {
+  return load_catalog().find((entry) => entry.name === name);
+}
+
+// src/mcp/mcp_refuse.ts
+import path10 from "path";
+var SHELL = /[;&|`$<>]/;
+var DOWNLOADERS = /* @__PURE__ */ new Set(["npx", "npm", "bunx", "uvx", "curl", "wget"]);
+function refuse_stdio_command(command) {
+  if (command.includes("://") === true) {
+    return "refused url; only a local binary is allowed";
+  }
+  if (SHELL.test(command) === true) {
+    return "refused shell metacharacters in mcp command";
+  }
+  if (command.length === 0 || command.trim() !== command || /\s/.test(command) === true) {
+    return "refused mcp command";
+  }
+  const base = path10.basename(command);
+  if (DOWNLOADERS.has(base) === true) {
+    return `refused download command '${base}'`;
+  }
+  return void 0;
+}
+function refuse_stdio_arg(arg) {
+  if (arg.includes("://") === true) {
+    return "refused url in mcp args";
+  }
+  if (SHELL.test(arg) === true) {
+    return "refused shell metacharacters in mcp args";
+  }
+  return void 0;
+}
+
+// src/mcp/mcp_url.ts
+function refuse_http_url(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "refused mcp url";
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return "refused mcp url";
+  }
+  if (parsed.username.length > 0 || parsed.password.length > 0) {
+    return "refused mcp url credentials";
+  }
+  const host = parsed.hostname.toLowerCase();
+  if (host !== "127.0.0.1" && host !== "localhost") {
+    return "refused mcp url; loopback only";
+  }
+  return void 0;
+}
+
+// src/mcp/mcp_pin.ts
+function refuse_catalog_stdio(name, command, args) {
+  const pin = catalog_by_name(name);
+  if (pin?.command_basename === void 0) {
     return void 0;
   }
-  return value;
+  if (path11.basename(command) !== pin.command_basename) {
+    return `refused command basename '${path11.basename(command)}'; only '${pin.command_basename}' is allowed`;
+  }
+  const prefix = pin.args_prefix ?? [];
+  if (args.length !== prefix.length + 1) {
+    return `refused ${name} args; expected ${prefix.join(" ")} <project>`;
+  }
+  for (let index = 0; index < prefix.length; index += 1) {
+    if (args[index] !== prefix[index]) {
+      return `refused ${name} args; expected ${prefix.join(" ")} <project>`;
+    }
+  }
+  const project = args[prefix.length];
+  if (project === void 0 || project.length === 0 || project.includes("://") === true) {
+    return "refused project path; pass a local project directory";
+  }
+  return void 0;
+}
+function refuse_arg_list(args) {
+  for (const arg of args) {
+    const refused = refuse_stdio_arg(arg);
+    if (refused !== void 0) {
+      return refused;
+    }
+  }
+  return void 0;
+}
+function refuse_mcp_entry(name, entry) {
+  if (typeof entry.url === "string") {
+    return refuse_http_url(entry.url);
+  }
+  if (typeof entry.command !== "string") {
+    return "refused mcp entry";
+  }
+  const args = entry.args ?? [];
+  return refuse_stdio_command(entry.command) ?? refuse_catalog_stdio(name, entry.command, args) ?? refuse_arg_list(args);
 }
 
 // src/agent/config.ts
+var gateway_allowlist = z.record(z.string(), z.array(z.string())).default({});
 var gateway_schema = z.object({
   platforms: z.array(z.enum(["webhook", "telegram", "discord", "twitch"])).default([]),
   /** Env-var names that hold tokens. Never store the secrets themselves. */
-  token_envs: z.record(z.string(), z.string().regex(ENV_VAR_NAME, "invalid env var name")).default({})
+  token_envs: z.record(z.string(), z.string().regex(ENV_VAR_NAME, "invalid env var name")).default({}),
+  /** Per-platform user ids allowed to talk to the bot (default-deny on public platforms). */
+  allowed_users: gateway_allowlist,
+  /** Per-platform chat/channel ids allowed (default-deny on public platforms). */
+  allowed_chats: gateway_allowlist,
+  /** Tool allowlist for the gateway agent; defaults to a read-only safe subset. */
+  tools_enabled: z.union([z.literal("all"), z.array(z.string())]).default([...DEFAULT_GATEWAY_TOOLS_ENABLED])
+}).optional();
+var stdio_mcp_schema = z.object({
+  enabled: z.boolean().default(false),
+  command: z.string().min(1),
+  args: z.array(z.string()).default([]),
+  env: z.record(z.string().regex(ENV_VAR_NAME, "invalid env var name"), z.string()).optional()
+}).strict();
+var http_mcp_schema = z.object({
+  enabled: z.boolean().default(false),
+  url: z.string().min(1)
+}).strict();
+var mcp_server_schema = z.union([stdio_mcp_schema, http_mcp_schema]);
+var SERVER_NAME = /^[a-z][a-z0-9_]*$/;
+var mcp_servers_schema = z.record(z.string(), mcp_server_schema).superRefine((servers, ctx) => {
+  for (const [name, entry] of Object.entries(servers)) {
+    if (SERVER_NAME.test(name) === false) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [name],
+        message: "mcp server name must be snake_case"
+      });
+    }
+    const refused = refuse_mcp_entry(name, entry);
+    if (refused !== void 0) {
+      ctx.addIssue({ code: z.ZodIssueCode.custom, path: [name], message: refused });
+    }
+  }
 }).optional();
 var provider_schema = z.object({
   kind: z.enum(["openai_compat", "anthropic", "ollama"]),
@@ -1947,7 +2484,9 @@ var agent_config_schema = z.object({
   plugins: z.array(z.string()).default([]),
   gateway: gateway_schema,
   log_level: z.enum(["debug", "info", "warn", "error"]).default("info"),
-  theme: z.string().min(1).default("lich")
+  theme: z.string().min(1).default("lich"),
+  /** Named MCP servers. Each entry is stdio or loopback http. Default off. */
+  mcp_servers: mcp_servers_schema
 }).transform((config) => {
   const work_dir = config.work_dir ?? process.cwd();
   return {
@@ -1966,8 +2505,25 @@ function freeze_config(config) {
   if (config.gateway !== void 0) {
     Object.freeze(config.gateway.platforms);
     Object.freeze(config.gateway.token_envs);
+    Object.freeze(config.gateway.allowed_users);
+    Object.freeze(config.gateway.allowed_chats);
+    if (Array.isArray(config.gateway.tools_enabled) === true) {
+      Object.freeze(config.gateway.tools_enabled);
+    }
     Object.freeze(config.gateway);
   }
+  if (config.mcp_servers !== void 0) {
+    for (const entry of Object.values(config.mcp_servers)) {
+      if ("args" in entry) {
+        Object.freeze(entry.args);
+      }
+      if ("env" in entry && entry.env !== void 0) {
+        Object.freeze(entry.env);
+      }
+      Object.freeze(entry);
+    }
+    Object.freeze(config.mcp_servers);
+  }
   return config;
 }
 function parse_agent_config(raw) {
@@ -2000,15 +2556,547 @@ var AgentEmitter = class {
   }
 };
 
-// src/plugins/builtin/gatekeeper.plugin.ts
+// src/mcp/mcp_http.ts
+async function post_rpc(url, fetch_fn, body) {
+  const response = await fetch_fn(url, {
+    method: "POST",
+    redirect: "error",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify(body)
+  });
+  const parsed = await response.json();
+  if (parsed.error !== void 0) {
+    const detail = parsed.error.message;
+    throw new Error(typeof detail === "string" && detail.length > 0 ? detail : "mcp error");
+  }
+  return parsed.result;
+}
+function http_pipe(url, fetch_fn) {
+  let next_id = 1;
+  return {
+    request(method, params) {
+      const id = next_id;
+      next_id += 1;
+      return post_rpc(url, fetch_fn, { jsonrpc: "2.0", id, method, params });
+    },
+    notify(method) {
+      void fetch_fn(url, {
+        method: "POST",
+        redirect: "error",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ jsonrpc: "2.0", method })
+      }).catch(() => void 0);
+    },
+    close() {
+      return void 0;
+    }
+  };
+}
+
+// src/mcp/mcp_plan.ts
+import { existsSync as existsSync3 } from "fs";
+import path12 from "path";
+function find_on_path(command, env_path) {
+  if (env_path === void 0 || env_path.length === 0) {
+    return void 0;
+  }
+  for (const dir of env_path.split(path12.delimiter)) {
+    if (dir.length === 0) {
+      continue;
+    }
+    const candidate = path12.join(dir, command);
+    if (existsSync3(candidate) === true) {
+      return candidate;
+    }
+  }
+  return void 0;
+}
+function locate(command, env_path) {
+  if (command.includes("/") === true || command.includes("\\") === true) {
+    return existsSync3(command) === true ? command : void 0;
+  }
+  return find_on_path(command, env_path);
+}
+function plan_stdio(name, command, args, env_path) {
+  const refused = refuse_mcp_entry(name, { command, args });
+  if (refused !== void 0) {
+    return refused;
+  }
+  const binary = locate(command, env_path);
+  if (binary === void 0) {
+    return catalog_by_name(name)?.missing_hint ?? "mcp command not found";
+  }
+  return { command: binary, args };
+}
+
+// src/mcp/mcp_pipe.ts
+var SKIP_LIMIT = 32;
+function parse_rpc_line(line) {
+  const parsed = safe_json_parse(line);
+  if (typeof parsed !== "object" || parsed === null) {
+    return void 0;
+  }
+  return parsed;
+}
+async function read_id(child, id) {
+  for (let skipped = 0; skipped < SKIP_LIMIT; skipped += 1) {
+    const line = await child.read_line();
+    const failure = child.failed();
+    if (failure !== void 0) {
+      throw new Error(failure);
+    }
+    if (line === void 0) {
+      throw new Error("mcp closed the pipe");
+    }
+    const parsed = parse_rpc_line(line);
+    if (parsed === void 0 || parsed.id !== id) {
+      continue;
+    }
+    if (parsed.error !== void 0) {
+      const detail = parsed.error.message;
+      throw new Error(typeof detail === "string" && detail.length > 0 ? detail : "mcp error");
+    }
+    return parsed.result;
+  }
+  throw new Error("mcp sent no matching response");
+}
+function stdio_pipe(child) {
+  let next_id = 1;
+  return {
+    request(method, params) {
+      const id = next_id;
+      next_id += 1;
+      child.write_line(JSON.stringify({ jsonrpc: "2.0", id, method, params }));
+      return read_id(child, id);
+    },
+    notify(method) {
+      child.write_line(JSON.stringify({ jsonrpc: "2.0", method }));
+    },
+    close() {
+      child.stop();
+    }
+  };
+}
+
+// src/mcp/mcp_names.ts
+function mcp_tool_name(server, tool) {
+  return `mcp_${sanitize(server)}_${sanitize(tool)}`;
+}
+function sanitize(value) {
+  return value.replace(/[^a-zA-Z0-9_]/g, "_");
+}
+
+// src/mcp/mcp_register.ts
+function name_allowed(enabled, name) {
+  if (enabled === "all") {
+    return true;
+  }
+  return enabled.includes(name);
+}
+function run_call(session, wire_name, args, context) {
+  return capture_errors(async () => {
+    if (context.signal?.aborted === true) {
+      throw new Error("cancelled");
+    }
+    return { ok: true, output: await session.call_tool(wire_name, args) };
+  });
+}
+function tool_for(registered, wire_name, spec, session) {
+  return {
+    name: registered,
+    description: spec.description,
+    parameters: spec.parameters,
+    timeout_ms: 12e4,
+    execute: (args, context) => run_call(session, wire_name, args, context)
+  };
+}
+function register_listed(registry, server, listed, enabled, session) {
+  const excluded = new Set(catalog_by_name(server)?.exclude_tools ?? []);
+  for (const spec of listed) {
+    if (excluded.has(spec.name) === true) {
+      continue;
+    }
+    const registered = mcp_tool_name(server, spec.name);
+    if (name_allowed(enabled, registered) === false || registry.has(registered) === true) {
+      continue;
+    }
+    registry.register(tool_for(registered, spec.name, spec, session));
+  }
+}
+
+// src/mcp/mcp_handshake.ts
+var PROTOCOL_VERSION = "2024-11-05";
+function init_params() {
+  return {
+    protocolVersion: PROTOCOL_VERSION,
+    capabilities: {},
+    clientInfo: { name: "lich", version: "1" }
+  };
+}
+function assert_handshake(result) {
+  if (typeof result !== "object" || result === null) {
+    throw new Error("mcp handshake rejected");
+  }
+  const body = result;
+  if (typeof body.protocolVersion !== "string" || body.protocolVersion.length === 0) {
+    throw new Error("mcp handshake rejected");
+  }
+  if (typeof body.serverInfo?.name !== "string" || body.serverInfo.name.length === 0) {
+    throw new Error("mcp handshake rejected");
+  }
+}
+
+// src/mcp/mcp_content.ts
+function content_text(result) {
+  if (typeof result !== "object" || result === null) {
+    return "";
+  }
+  const body = result;
+  const parts = [];
+  if (Array.isArray(body.content) === true) {
+    for (const item of body.content) {
+      if (typeof item !== "object" || item === null) {
+        continue;
+      }
+      const chunk = item;
+      if (chunk.type === "text" && typeof chunk.text === "string") {
+        parts.push(chunk.text);
+      }
+      if (chunk.type === "image") {
+        parts.push("[image omitted]");
+      }
+    }
+  }
+  const text = parts.join("\n");
+  if (body.isError === true) {
+    throw new Error(text.length > 0 ? text : "mcp tool failed");
+  }
+  return text;
+}
+
+// src/mcp/mcp_result.ts
+function tool_schema(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return { type: "object" };
+  }
+  const body = raw;
+  const schema = { type: "object" };
+  if (typeof body.properties === "object" && body.properties !== null) {
+    schema.properties = body.properties;
+  }
+  if (Array.isArray(body.required) === true) {
+    schema.required = body.required.filter((item) => typeof item === "string");
+  }
+  if (typeof body.additionalProperties === "boolean") {
+    schema.additionalProperties = body.additionalProperties;
+  }
+  return schema;
+}
+function parse_tools(result) {
+  if (typeof result !== "object" || result === null || Array.isArray(result.tools) === false) {
+    throw new Error("mcp tools/list rejected");
+  }
+  const tools = [];
+  for (const item of result.tools) {
+    if (typeof item !== "object" || item === null) {
+      continue;
+    }
+    const tool = item;
+    if (typeof tool.name !== "string" || tool.name.length === 0) {
+      continue;
+    }
+    tools.push({
+      name: tool.name,
+      description: typeof tool.description === "string" ? tool.description : tool.name,
+      parameters: tool_schema(tool.inputSchema)
+    });
+  }
+  return tools;
+}
+
+// src/mcp/mcp_session.ts
+var McpSession = class {
+  constructor(pipe) {
+    this.pipe = pipe;
+  }
+  pipe;
+  ready_done = false;
+  closed = false;
+  close() {
+    if (this.closed === true) {
+      return;
+    }
+    this.closed = true;
+    this.pipe.close();
+  }
+  async list_tools() {
+    await this.ensure_ready();
+    return parse_tools(await this.pipe.request("tools/list", {}));
+  }
+  async call_tool(name, args) {
+    await this.ensure_ready();
+    return content_text(await this.pipe.request("tools/call", { name, arguments: args }));
+  }
+  async ensure_ready() {
+    if (this.ready_done === true) {
+      return;
+    }
+    try {
+      assert_handshake(await this.pipe.request("initialize", init_params()));
+      this.pipe.notify("notifications/initialized");
+      this.ready_done = true;
+    } catch (error) {
+      this.close();
+      throw error;
+    }
+  }
+};
+
+// src/mcp/mcp_lines.ts
+function create_line_queue() {
+  const pending = [];
+  const waiters = [];
+  let closed = false;
+  return {
+    push(line) {
+      const waiter = waiters.shift();
+      if (waiter !== void 0) {
+        waiter(line);
+        return;
+      }
+      pending.push(line);
+    },
+    close() {
+      closed = true;
+      for (const waiter of waiters.splice(0)) {
+        waiter(void 0);
+      }
+    },
+    read() {
+      const next = pending.shift();
+      if (next !== void 0) {
+        return Promise.resolve(next);
+      }
+      if (closed === true) {
+        return Promise.resolve(void 0);
+      }
+      return new Promise((resolve) => {
+        waiters.push(resolve);
+      });
+    }
+  };
+}
+
+// src/mcp/mcp_child.ts
+function spawn_failure(code) {
+  if (code === "ENOENT") {
+    return "mcp command not found";
+  }
+  return "mcp spawn failed";
+}
+function failed_child(message) {
+  return {
+    write_line() {
+      return void 0;
+    },
+    read_line() {
+      return Promise.resolve(void 0);
+    },
+    stop() {
+      return void 0;
+    },
+    failed() {
+      return message;
+    }
+  };
+}
+
+// src/mcp/mcp_stdio_bun.ts
+async function pump_stdout(stream, queue) {
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  for (; ; ) {
+    const next = await reader.read();
+    if (next.done === true) {
+      if (buffer.length > 0) {
+        queue.push(buffer);
+      }
+      queue.close();
+      return;
+    }
+    buffer += decoder.decode(next.value, { stream: true });
+    const parts = buffer.split("\n");
+    buffer = parts.pop() ?? "";
+    for (const part of parts) {
+      queue.push(part);
+    }
+  }
+}
+async function drain_stderr(stream) {
+  const reader = stream.getReader();
+  while ((await reader.read()).done === false) {
+    continue;
+  }
+}
+function bun_line_child(command, args, env) {
+  const queue = create_line_queue();
+  try {
+    const options = { stdin: "pipe", stdout: "pipe", stderr: "pipe" };
+    const child = env === void 0 ? Bun.spawn([command, ...args], options) : Bun.spawn([command, ...args], { ...options, env });
+    void pump_stdout(child.stdout, queue);
+    void drain_stderr(child.stderr);
+    return {
+      write_line(line) {
+        child.stdin.write(`${line}
+`);
+        void child.stdin.flush();
+      },
+      read_line() {
+        return queue.read();
+      },
+      stop() {
+        child.kill();
+      },
+      failed() {
+        return void 0;
+      }
+    };
+  } catch (error) {
+    const coded = error;
+    return failed_child(spawn_failure(coded.code));
+  }
+}
+
+// src/mcp/mcp_stdio_node.ts
 import { spawn as spawn3 } from "child_process";
+import { createInterface } from "readline";
+function child_env(extra) {
+  if (extra === void 0) {
+    return void 0;
+  }
+  const merged = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (typeof value === "string") {
+      merged[key] = value;
+    }
+  }
+  for (const [key, value] of Object.entries(extra)) {
+    merged[key] = value;
+  }
+  return merged;
+}
+function node_line_child(command, args, env) {
+  const queue = create_line_queue();
+  let failure;
+  const child = spawn3(command, [...args], { stdio: ["pipe", "pipe", "pipe"], env: child_env(env) });
+  child.unref();
+  const reader = createInterface({ input: child.stdout });
+  reader.on("line", (line) => {
+    queue.push(line);
+  });
+  reader.on("close", () => {
+    queue.close();
+  });
+  child.stderr?.resume();
+  child.on("error", (error) => {
+    failure = spawn_failure(error.code);
+    queue.close();
+  });
+  return {
+    write_line(line) {
+      child.stdin?.write(`${line}
+`);
+    },
+    read_line() {
+      return queue.read();
+    },
+    stop() {
+      child.kill();
+    },
+    failed() {
+      return failure;
+    }
+  };
+}
+
+// src/mcp/mcp_stdio.ts
+function running_under_bun() {
+  return process.versions.bun !== void 0;
+}
+function default_line_spawner(command, args, env) {
+  if (running_under_bun() === true) {
+    return bun_line_child(command, args, env);
+  }
+  return node_line_child(command, args, env);
+}
+
+// src/mcp/mcp_attach.ts
+async function open_and_register(registry, name, enabled, session) {
+  try {
+    register_listed(registry, name, await session.list_tools(), enabled, session);
+    return session;
+  } catch (error) {
+    session.close();
+    const message = error instanceof Error ? error.message : "mcp skipped";
+    logger.warn(`mcp ${name} skipped: ${message}`);
+    return void 0;
+  }
+}
+async function attach_stdio(registry, name, entry, config, runtime) {
+  const planned = plan_stdio(name, entry.command, entry.args, runtime?.env_path ?? process.env.PATH);
+  if (typeof planned === "string") {
+    logger.warn(`mcp ${name} skipped: ${planned}`);
+    return void 0;
+  }
+  const spawn5 = runtime?.spawn ?? default_line_spawner;
+  const session = new McpSession(stdio_pipe(spawn5(planned.command, planned.args, entry.env)));
+  return open_and_register(registry, name, config.tools_enabled, session);
+}
+async function attach_http(registry, name, url, config, runtime) {
+  const session = new McpSession(http_pipe(url, runtime?.fetch_fn ?? fetch));
+  return open_and_register(registry, name, config.tools_enabled, session);
+}
+
+// src/mcp/mcp_tools.ts
+function allowlist_wants_mcp(enabled) {
+  if (enabled === "all") {
+    return true;
+  }
+  return enabled.some((name) => name.startsWith("mcp_") === true);
+}
+async function attach_enabled_mcp_tools(registry, config, runtime) {
+  const sessions = [];
+  const servers = config.mcp_servers;
+  if (servers === void 0 || allowlist_wants_mcp(config.tools_enabled) === false) {
+    return sessions;
+  }
+  for (const [name, entry] of Object.entries(servers)) {
+    if (entry.enabled !== true) {
+      continue;
+    }
+    try {
+      const session = "url" in entry ? await attach_http(registry, name, entry.url, config, runtime) : await attach_stdio(registry, name, entry, config, runtime);
+      if (session !== void 0) {
+        sessions.push(session);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "mcp skipped";
+      logger.warn(`mcp ${name} skipped: ${message}`);
+    }
+  }
+  return sessions;
+}
+
+// src/plugins/builtin/gatekeeper.plugin.ts
+import { spawn as spawn4 } from "child_process";
 import { statSync as statSync2 } from "fs";
-import path9 from "path";
+import path13 from "path";
 var HOOKS_OFF = ["-c", "core.hooksPath=/dev/null"];
 var PATHSPEC_MAGIC = /[:*?[]/;
 var SECRET_BASENAMES = [".env", ".env.local", "id_rsa"];
 function is_secret_path(file_path) {
-  const base = path9.basename(file_path);
+  const base = path13.basename(file_path);
   if (SECRET_BASENAMES.includes(base) === true) {
     return true;
   }
@@ -2035,7 +3123,7 @@ function matches_git_denylist(command) {
 }
 function run_git(args, work_dir, signal) {
   return new Promise((resolve) => {
-    const child = spawn3("git", args, { cwd: work_dir, env: process.env });
+    const child = spawn4("git", args, { cwd: work_dir, env: process.env });
     let settled = false;
     let out = "";
     const on_abort = () => {
@@ -2086,7 +3174,7 @@ function invalid_commit_path(raw, work_dir) {
     return `invalid_path: ${raw}`;
   }
   const resolved = resolve_safe_path(work_dir, raw);
-  if (resolved === path9.resolve(work_dir)) {
+  if (resolved === path13.resolve(work_dir)) {
     return `invalid_path: ${raw} resolves to work_dir`;
   }
   if (is_secret_path(raw) === true) {
@@ -2204,8 +3292,12 @@ function gatekeeper_hooks(allow_self_commit) {
       if (info.tool_name === "write_file" || info.tool_name === "edit_file") {
         ctx.state?.set("dirty", true);
       } else if (info.tool_name === "run_tests") {
-        ctx.state?.set("tests_ok", true);
-        ctx.state?.set("dirty", false);
+        const filter = info.args["filter"];
+        const filtered = typeof filter === "string" && filter.length > 0;
+        if (filtered === false) {
+          ctx.state?.set("tests_ok", true);
+          ctx.state?.set("dirty", false);
+        }
       } else if (info.tool_name === "git_commit") {
         ctx.state?.set("commits", state_count(ctx, "commits") + 1);
       }
@@ -2347,6 +3439,7 @@ var MAX_ERROR_BODY_CHARS = 500;
 var OVERFLOW_BODY_PATTERN = /context|token|maximum/i;
 var OVERLOADED_STATUS = 529;
 var UNPARSEABLE_ARGS_NOTE = "[unparseable tool arguments]";
+var EMPTY_TEXT_PLACEHOLDER = "(empty)";
 var DEFAULT_MAX_TOKENS = 4096;
 var AnthropicProvider = class {
   name;
@@ -2460,7 +3553,7 @@ function to_anthropic_turns(messages) {
     }
     flush_tool_results(turns, pending_tool_results);
     if (message.role === "user") {
-      turns.push({ role: "user", content: [{ type: "text", text: message.content }] });
+      turns.push({ role: "user", content: [text_block(message.content)] });
     } else {
       turns.push({ role: "assistant", content: assistant_to_blocks(message) });
     }
@@ -2474,11 +3567,14 @@ function flush_tool_results(turns, pending_tool_results) {
   }
   turns.push({ role: "user", content: pending_tool_results.splice(0, pending_tool_results.length) });
 }
+function text_block(text) {
+  return { type: "text", text: text.length > 0 ? text : EMPTY_TEXT_PLACEHOLDER };
+}
 function tool_message_to_block(message) {
   const block = {
     type: "tool_result",
     tool_use_id: message.tool_call_id,
-    content: [{ type: "text", text: message.content }]
+    content: [text_block(message.content)]
   };
   if (message.is_error === true) {
     return { ...block, is_error: true };
@@ -2494,7 +3590,7 @@ function assistant_to_blocks(message) {
     blocks.push({ type: "tool_use", id: tool_call.id, name: tool_call.name, input: tool_call.args });
   }
   if (blocks.length === 0) {
-    blocks.push({ type: "text", text: "" });
+    blocks.push(text_block(""));
   }
   return blocks;
 }
@@ -3338,6 +4434,9 @@ async function chat_with_failover(router, messages, tools, options) {
     if (result.ok === true) {
       return result.value;
     }
+    if (is_abort_failure(result.error, options?.signal) === true) {
+      throw result.error;
+    }
     last_error = result.error;
     log_fail_over(result.error);
   }
@@ -3371,9 +4470,18 @@ async function attempt_provider(provider, messages, tools, options) {
       })
     };
   } catch (error) {
+    if (is_abort_failure(error, options?.signal) === true) {
+      throw error;
+    }
     return { ok: false, error: to_provider_error(error, provider.name) };
   }
 }
+function is_abort_failure(error, signal) {
+  if (signal?.aborted === true) {
+    return true;
+  }
+  return error instanceof Error && error.name === "AbortError";
+}
 function to_provider_error(error, fallback_name) {
   if (error instanceof ProviderError) {
     return error;
@@ -3388,7 +4496,7 @@ function to_provider_error(error, fallback_name) {
 
 // src/session/store.ts
 import { appendFile, mkdir as mkdir2, readFile as readFile4 } from "fs/promises";
-import path10 from "path";
+import path14 from "path";
 var counter_state = { value: 0 };
 function slugify_label(label) {
   const slug = label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
@@ -3399,7 +4507,7 @@ async function open_session(dir, label) {
   counter_state.value += 1;
   const label_part = label === void 0 ? "" : slugify_label(label);
   const id = `${Date.now().toString(36)}-${counter_state.value}${label_part}`;
-  const file_path = path10.join(dir, `${id}.jsonl`);
+  const file_path = path14.join(dir, `${id}.jsonl`);
   return {
     id,
     path: file_path,
@@ -3455,12 +4563,18 @@ function log_compression_failure(error) {
   }
   logger.warn("context compression failed", error);
 }
+function split_keep_recent(non_system, keep_recent) {
+  let cut = Math.max(0, non_system.length - keep_recent);
+  while (cut > 0 && non_system[cut]?.role === "tool") {
+    cut -= 1;
+  }
+  return { recent: non_system.slice(cut), older: non_system.slice(0, cut) };
+}
 async function compress_messages(deps, messages, params) {
   const system_messages = messages.filter((message) => message.role === "system");
   const non_system = messages.filter((message) => message.role !== "system");
   const keep_recent = Math.max(0, params.keep_recent);
-  const recent = non_system.slice(-keep_recent);
-  const older = non_system.slice(0, Math.max(0, non_system.length - recent.length));
+  const { recent, older } = split_keep_recent(non_system, keep_recent);
   if (older.length === 0) {
     return { messages: [...messages], summary_chars: 0 };
   }
@@ -3513,8 +4627,12 @@ function format_tool_result_content(result) {
   }
   return result.output;
 }
-async function run_tool_calls(deps, history, turn, calls, emitter) {
+async function run_tool_calls(deps, history, turn, calls, emitter, signal) {
   for (const call of calls) {
+    if (signal_aborted(signal) === true) {
+      history.push(cancelled_tool_message(call));
+      continue;
+    }
     emitter?.emit({ type: "tool_call_start", turn, call });
     const result = await deps.tools.execute(call.name, call.args, deps.tool_context);
     const tool_message = {
@@ -3529,6 +4647,16 @@ async function run_tool_calls(deps, history, turn, calls, emitter) {
     history.push(tool_message);
     emitter?.emit({ type: "tool_call_end", turn, call, result });
   }
+  return signal_aborted(signal) === true ? "aborted" : "continued";
+}
+function cancelled_tool_message(call) {
+  return {
+    role: "tool",
+    tool_call_id: call.id,
+    name: call.name,
+    content: format_tool_result_content({ ok: false, output: "", error: "cancelled" }),
+    is_error: true
+  };
 }
 async function call_chat(deps, history, params, emitter) {
   try {
@@ -3538,6 +4666,9 @@ async function call_chat(deps, history, params, emitter) {
       signal: params.signal
     });
   } catch (error) {
+    if (signal_aborted(params.signal) === true) {
+      throw error;
+    }
     if (error instanceof ProviderError) {
       logger.error(`provider error kind=${error.kind} provider=${error.provider_name}`, error);
     } else {
@@ -3575,24 +4706,38 @@ async function compress_if_needed(deps, history, params, emitter) {
 function find_last_assistant(messages) {
   return [...messages].reverse().find((message) => message.role === "assistant");
 }
+function signal_aborted(signal) {
+  return signal?.aborted === true;
+}
+function aborted_outcome(history, turns_used, emitter) {
+  emitter?.emit({ type: "error", error: new DOMException("agent loop aborted", "AbortError") });
+  return {
+    messages: history,
+    final: find_last_assistant(history),
+    result: void 0,
+    turns_used,
+    stopped_reason: "aborted"
+  };
+}
 async function run_conversation(deps, messages, params) {
   const history = seed_system_prompt(messages, params.system_prompt);
   const emitter = deps.emitter;
   for (const turn of turn_range(params.max_turns)) {
-    if (params.signal?.aborted === true) {
-      emitter?.emit({ type: "error", error: new DOMException("agent loop aborted", "AbortError") });
-      return {
-        messages: history,
-        final: find_last_assistant(history),
-        result: void 0,
-        turns_used: turn - 1,
-        stopped_reason: "aborted"
-      };
+    if (signal_aborted(params.signal) === true) {
+      return aborted_outcome(history, turn - 1, emitter);
     }
     emitter?.emit({ type: "turn_start", turn });
     await compress_if_needed(deps, history, params, emitter);
     emitter?.emit({ type: "llm_start", turn });
-    const result = await call_chat(deps, history, params, emitter);
+    let result;
+    try {
+      result = await call_chat(deps, history, params, emitter);
+    } catch (error) {
+      if (signal_aborted(params.signal) === true) {
+        return aborted_outcome(history, turn - 1, emitter);
+      }
+      throw error;
+    }
     emitter?.emit({ type: "llm_end", turn, result });
     history.push(result.message);
     const calls = result.message.tool_calls ?? [];
@@ -3601,7 +4746,10 @@ async function run_conversation(deps, messages, params) {
       emitter?.emit({ type: "turn_end", turn });
       return { messages: history, final: result.message, result, turns_used: turn, stopped_reason: "final" };
     }
-    await run_tool_calls(deps, history, turn, calls, emitter);
+    const tool_status = await run_tool_calls(deps, history, turn, calls, emitter, params.signal);
+    if (tool_status === "aborted") {
+      return aborted_outcome(history, turn, emitter);
+    }
   }
   emitter?.emit({ type: "budget_exhausted", turns_used: params.max_turns });
   emitter?.emit({ type: "turn_end", turn: params.max_turns });
@@ -3680,8 +4828,12 @@ var Agent = class {
   registry;
   executor;
   hook_runner;
-  constructor(config, plugins = []) {
+  mcp_runtime;
+  mcp_sessions = [];
+  mcp_attach;
+  constructor(config, plugins = [], runtime) {
     this.config = config;
+    this.mcp_runtime = runtime?.mcp;
     this.events = new AgentEmitter();
     this.router = new ProviderRouter(config.providers);
     const base_registry = new ToolRegistry();
@@ -3705,15 +4857,22 @@ var Agent = class {
     }
   }
   async run(options) {
+    await this.attach_mcp_once();
     const usage_total = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 };
-    const stop_collecting = this.events.on(collect_usage(usage_total));
+    const run_events = new AgentEmitter();
+    const stop_forwarding = run_events.on((event) => this.events.emit(event));
+    const stop_collecting = run_events.on(collect_usage(usage_total));
     await this.call_plugin_run_start(options.input);
     let outcome;
     try {
       const seed_messages = [...options.history ?? []];
       seed_messages.push({ role: "user", content: options.input });
-      const tool_context = { work_dir: this.config.work_dir, env: tool_env(this.config) };
-      outcome = await run_conversation(this.loop_deps(tool_context), seed_messages, {
+      const tool_context = {
+        work_dir: this.config.work_dir,
+        env: tool_env(this.config),
+        signal: options.signal
+      };
+      outcome = await run_conversation(this.loop_deps(tool_context, run_events), seed_messages, {
         system_prompt: this.config.system_prompt ?? DEFAULT_AGENT_SYSTEM_PROMPT,
         max_turns: this.config.max_turns,
         temperature: this.config.temperature,
@@ -3724,21 +4883,36 @@ var Agent = class {
       });
     } finally {
       stop_collecting();
+      stop_forwarding();
       if (outcome !== void 0) {
         await this.call_plugin_run_end(outcome);
       }
     }
     const session_path = await this.persist_session(outcome, options, usage_total);
-    const full_messages = [...options.history ?? [], ...outcome.messages];
-    return { outcome, messages: full_messages, usage_total, session_path };
+    return { outcome, messages: outcome.messages, usage_total, session_path };
+  }
+  /** Close MCP sessions so stdio children do not keep the event loop alive. */
+  close() {
+    for (const session of this.mcp_sessions) {
+      session.close();
+    }
+    this.mcp_sessions = [];
+  }
+  /** tools/list once, before the model sees definitions. Empty allowlists never connect. */
+  async attach_mcp_once() {
+    this.mcp_attach ??= this.do_attach_mcp();
+    await this.mcp_attach;
+  }
+  async do_attach_mcp() {
+    this.mcp_sessions = await attach_enabled_mcp_tools(this.registry, this.config, this.mcp_runtime);
   }
   /** Per-run deps: the built-once ToolContext threads through every tool execution. */
-  loop_deps(tool_context) {
+  loop_deps(tool_context, emitter = this.events) {
     return {
       chat: (messages, tools, chat_options) => this.router.chat_with_failover(messages, tools, chat_options),
       tools: this.executor,
       definitions: () => this.registry.definitions(),
-      emitter: this.events,
+      emitter,
       tool_context
     };
   }
@@ -3793,14 +4967,24 @@ async function create_agent_with_plugins(raw_config) {
 }
 async function run_agent(raw_config, input, options) {
   const agent = await create_agent_with_plugins(raw_config);
-  return agent.run({ input, signal: options?.signal, label: options?.label });
+  try {
+    return await agent.run({ input, signal: options?.signal, label: options?.label });
+  } finally {
+    agent.close();
+  }
 }
 
 export {
   safe_json_parse,
   truncate_text,
+  DEFAULT_GATEWAY_TOKEN_ENVS,
+  is_env_var_name,
+  platform_token_env,
+  read_platform_token,
   logger,
   register_builtin_tools,
+  catalog_by_name,
+  refuse_mcp_entry,
   ToolRegistry,
   ToolExecutor,
   HookedToolRunner,
@@ -3808,10 +4992,8 @@ export {
   plugin_errors_summary,
   sleep,
   ProviderError,
-  DEFAULT_GATEWAY_TOKEN_ENVS,
-  is_env_var_name,
-  platform_token_env,
-  read_platform_token,
+  gateway_tools_enabled,
+  check_gateway_sender,
   parse_agent_config,
   AgentEmitter,
   Agent,
@@ -3819,4 +5001,4 @@ export {
   create_agent_with_plugins,
   run_agent
 };
-//# sourceMappingURL=chunk-7HLVKVIG.js.map
+//# sourceMappingURL=chunk-WNFBIX4E.js.map