@moikapy/lich 0.7.0 → 0.7.1

package/dist/{chunk-QVJCIZIF.js → chunk-WNFBIX4E.js}

@@ -4,6 +4,7 @@ import { readdir } from "fs/promises";
 import path2 from "path";
 
 // src/tools/guard.ts
+import fs from "fs";
 import path from "path";
 
 // src/util/json.ts
@@ -33,14 +34,73 @@ function truncate_text(text, max_chars) {
 // src/tools/guard.ts
 var DEFAULT_MAX_OUTPUT_CHARS = 2e4;
 var DEFAULT_TOOL_TIMEOUT_MS = 3e4;
-function resolve_safe_path(base_dir, target) {
+function is_inside(base, candidate) {
+  const relative = path.relative(base, candidate);
+  return relative.startsWith("..") === false && path.isAbsolute(relative) === false;
+}
+function deepest_existing(target) {
+  let current = target;
+  while (fs.existsSync(current) === false) {
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return current;
+    }
+    current = parent;
+  }
+  return current;
+}
+function resolve_safe_path(base_dir, target, for_write = false) {
   const base = path.resolve(base_dir);
   const resolved = path.resolve(base, target);
-  const relative = path.relative(base, resolved);
-  if (relative.startsWith("..") === true || path.isAbsolute(relative) === true) {
+  if (is_inside(base, resolved) === false) {
+    throw new Error(`path_escape: ${target} escapes ${base_dir}`);
+  }
+  const real_base = fs.realpathSync(base);
+  const existing = deepest_existing(resolved);
+  const real_existing = fs.realpathSync(existing);
+  const suffix = path.relative(existing, resolved);
+  const real_resolved = suffix.length === 0 ? real_existing : path.resolve(real_existing, suffix);
+  if (is_inside(real_base, real_resolved) === false) {
+    throw new Error(`path_escape: ${target} escapes ${base_dir}`);
+  }
+  if (for_write === true) {
+    reject_symlink_leaf(resolved, target, base_dir);
+  }
+  return real_resolved;
+}
+function reject_symlink_leaf(resolved, target, base_dir) {
+  let info;
+  try {
+    info = fs.lstatSync(resolved);
+  } catch (err) {
+    if (is_enoent(err) === true) {
+      return;
+    }
+    throw err;
+  }
+  if (info.isSymbolicLink() === true) {
     throw new Error(`path_escape: ${target} escapes ${base_dir}`);
   }
-  return resolved;
+}
+function assert_file_tool_access(work_dir, resolved, mode) {
+  const base = fs.realpathSync(path.resolve(work_dir));
+  const rel = path.relative(base, resolved);
+  const parts = rel.split(path.sep).filter((part) => part.length > 0);
+  if (parts[0] === ".lich" && parts[1] === "config.json" && parts.length === 2) {
+    throw new Error("forbidden_path: .lich/config.json");
+  }
+  if (mode === "write" && parts[0] === ".lich") {
+    const allowed = parts[1] === "skills" || parts[1] === "plugins";
+    if (allowed === false) {
+      throw new Error("forbidden_path: .lich writes limited to skills/ and plugins/");
+    }
+  }
+  if (mode === "write") {
+    const leaf = path.basename(resolved);
+    if (leaf === ".env" || leaf.startsWith(".env.")) {
+      throw new Error("forbidden_path: .env*");
+    }
+  }
 }
 function require_string_arg(args, key) {
   const value = args[key];
@@ -116,6 +176,233 @@ async function capture_errors(run) {
   }
 }
 
+// src/tools/url_guard.ts
+import dns from "dns/promises";
+import http from "http";
+import https from "https";
+import net from "net";
+var MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var fetch_override;
+function private_urls_allowed() {
+  return process.env["LICH_ALLOW_PRIVATE_URLS"] === "1";
+}
+function is_blocked_ipv4(address) {
+  const parts = address.split(".").map((part) => Number(part));
+  if (parts.length !== 4 || parts.some((n) => Number.isFinite(n) === false)) {
+    return true;
+  }
+  const [a, b] = parts;
+  if (a === 0 || a === 10 || a === 127) {
+    return true;
+  }
+  if (a === 169 && b === 254) {
+    return true;
+  }
+  if (a === 172 && b >= 16 && b <= 31) {
+    return true;
+  }
+  if (a === 192 && b === 168) {
+    return true;
+  }
+  if (a === 100 && b >= 64 && b <= 127) {
+    return true;
+  }
+  return a >= 224;
+}
+function is_blocked_ipv6(address) {
+  const normalized = address.toLowerCase();
+  if (normalized === "::" || normalized === "::1") {
+    return true;
+  }
+  if (normalized.startsWith("::ffff:")) {
+    const mapped = normalized.slice("::ffff:".length);
+    return net.isIPv4(mapped) === true ? is_blocked_ipv4(mapped) : true;
+  }
+  const head = Number.parseInt(normalized.split(":")[0] ?? "", 16);
+  if (Number.isFinite(head) === false) {
+    return true;
+  }
+  if ((head & 65472) === 65152) {
+    return true;
+  }
+  if ((head & 65024) === 64512) {
+    return true;
+  }
+  return false;
+}
+function is_blocked_ip(address) {
+  if (net.isIPv4(address) === true) {
+    return is_blocked_ipv4(address);
+  }
+  if (net.isIPv6(address) === true) {
+    return is_blocked_ipv6(address);
+  }
+  return true;
+}
+function parse_http_url(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new Error(`invalid_url: ${raw}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`invalid_url: unsupported protocol ${parsed.protocol}`);
+  }
+  return parsed;
+}
+function normalize_hostname(hostname) {
+  if (hostname.startsWith("[") === true && hostname.endsWith("]") === true) {
+    return hostname.slice(1, -1);
+  }
+  return hostname;
+}
+async function resolve_public_ip(raw_hostname) {
+  const hostname = normalize_hostname(raw_hostname);
+  if (private_urls_allowed() === true) {
+    if (net.isIP(hostname) !== 0) {
+      return hostname;
+    }
+    const hit = await dns.lookup(hostname);
+    return hit.address;
+  }
+  if (hostname === "localhost" || hostname.endsWith(".localhost") || hostname.endsWith(".local")) {
+    throw new Error(`blocked_url: ${hostname}`);
+  }
+  if (net.isIP(hostname) !== 0) {
+    if (is_blocked_ip(hostname) === true) {
+      throw new Error(`blocked_url: ${hostname}`);
+    }
+    return hostname;
+  }
+  const records = await dns.lookup(hostname, { all: true, verbatim: true });
+  if (records.length === 0) {
+    throw new Error(`blocked_url: ${hostname}`);
+  }
+  for (const record of records) {
+    if (is_blocked_ip(record.address) === true) {
+      throw new Error(`blocked_url: ${hostname}`);
+    }
+  }
+  return records[0]?.address ?? hostname;
+}
+function pinned_lookup(ip) {
+  const family = net.isIPv6(ip) === true ? 6 : 4;
+  return ((_hostname, options, callback) => {
+    const cb = typeof options === "function" ? options : callback;
+    const opts = typeof options === "function" ? void 0 : options;
+    if (typeof cb !== "function") {
+      return;
+    }
+    if (opts !== void 0 && opts.all === true) {
+      cb(null, [{ address: ip, family }]);
+      return;
+    }
+    cb(null, ip, family);
+  });
+}
+function request_headers(init) {
+  const headers = {};
+  new Headers(init?.headers).forEach((value, key) => {
+    headers[key] = value;
+  });
+  return headers;
+}
+function request_body(init) {
+  const body = init?.body;
+  if (body === void 0 || body === null) {
+    return void 0;
+  }
+  if (typeof body === "string" || body instanceof Uint8Array) {
+    return body;
+  }
+  throw new Error("blocked_url: unsupported_body");
+}
+function pinned_http_fetch(url, ip, init) {
+  const lib = url.protocol === "https:" ? https : http;
+  const method = (init.method ?? "GET").toUpperCase();
+  const headers = request_headers(init);
+  const body = request_body(init);
+  return new Promise((resolve, reject) => {
+    const req = lib.request(
+      {
+        protocol: url.protocol,
+        hostname: url.hostname,
+        port: url.port.length > 0 ? Number(url.port) : void 0,
+        path: `${url.pathname}${url.search}`,
+        method,
+        headers,
+        lookup: pinned_lookup(ip)
+      },
+      (incoming) => {
+        const chunks = [];
+        incoming.on("data", (chunk) => {
+          chunks.push(chunk);
+        });
+        incoming.on("end", () => {
+          const status = incoming.statusCode ?? 0;
+          const response_headers = new Headers();
+          for (const [key, value] of Object.entries(incoming.headers)) {
+            if (typeof value === "string") {
+              response_headers.set(key, value);
+            } else if (Array.isArray(value) === true) {
+              for (const part of value) {
+                response_headers.append(key, part);
+              }
+            }
+          }
+          resolve(new Response(Buffer.concat(chunks), { status, headers: response_headers }));
+        });
+      }
+    );
+    req.on("error", reject);
+    const signal = init.signal;
+    if (signal !== void 0 && signal !== null) {
+      if (signal.aborted === true) {
+        req.destroy(new Error("aborted"));
+        return;
+      }
+      signal.addEventListener(
+        "abort",
+        () => {
+          req.destroy(new Error("aborted"));
+        },
+        { once: true }
+      );
+    }
+    if (body !== void 0) {
+      req.write(body);
+    }
+    req.end();
+  });
+}
+function redirect_target(current, response) {
+  if (REDIRECT_STATUSES.has(response.status) === false) {
+    return void 0;
+  }
+  const location = response.headers.get("location");
+  if (location === null || location.length === 0) {
+    return void 0;
+  }
+  return new URL(location, current);
+}
+async function safe_fetch(raw_url, init) {
+  let current = parse_http_url(raw_url);
+  let request_init = { ...init ?? {}, redirect: "manual" };
+  for (let hop = 0; hop < MAX_REDIRECTS; hop += 1) {
+    const ip = await resolve_public_ip(current.hostname);
+    const response = fetch_override !== void 0 ? await fetch_override(current.href, { ...request_init, redirect: "manual" }) : await pinned_http_fetch(current, ip, request_init);
+    const next = redirect_target(current, response);
+    if (next === void 0) {
+      return response;
+    }
+    current = next;
+    request_init = { ...request_init, method: "GET", body: void 0 };
+  }
+  throw new Error("blocked_url: too_many_redirects");
+}
+
 // src/tools/builtin/fetch_url.ts
 var DEFAULT_MAX_CHARS = 2e4;
 var MAX_MAX_CHARS = 1e5;
@@ -136,15 +423,7 @@ function clamp_int_arg(args, key, fallback, max) {
   return Math.min(max, Math.max(1, Math.floor(optional_number_arg(args, key, fallback))));
 }
 function valid_http_url(raw) {
-  let parsed;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    throw new Error(`invalid_url: ${raw}`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`invalid_url: unsupported protocol ${parsed.protocol}`);
-  }
+  parse_http_url(raw);
 }
 function compose_abort_signal(timeout_ms, external) {
   const timeout_signal = AbortSignal.timeout(timeout_ms);
@@ -155,8 +434,7 @@ async function run_fetch_url(args, external) {
   valid_http_url(url);
   const max_chars = clamp_int_arg(args, "max_chars", DEFAULT_MAX_CHARS, MAX_MAX_CHARS);
   const timeout_ms = clamp_int_arg(args, "timeout_ms", DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
-  const response = await fetch(url, {
-    redirect: "follow",
+  const response = await safe_fetch(url, {
     headers: { "user-agent": USER_AGENT },
     signal: compose_abort_signal(timeout_ms, external)
   });
@@ -618,10 +896,11 @@ function replacement_for(content, old_string, new_string, replace_all) {
   if (replace_all === true) {
     return content.split(old_string).join(new_string);
   }
-  return content.replace(old_string, new_string);
+  return content.replace(old_string, () => new_string);
 }
 async function apply_edit(work_dir, target, old_string, new_string, replace_all) {
-  const file_path = resolve_safe_path(work_dir, target);
+  const file_path = resolve_safe_path(work_dir, target, true);
+  assert_file_tool_access(work_dir, file_path, "write");
   let content;
   try {
     content = await readFile(file_path, "utf8");
@@ -650,9 +929,12 @@ var edit_file_tool = {
   execute: async (args, context) => capture_errors(async () => {
     const target = require_string_arg(args, "path");
     const old_string = require_string_arg(args, "old_string");
-    const new_string = require_string_arg(args, "new_string");
+    const new_raw = args["new_string"];
+    if (typeof new_raw !== "string") {
+      throw new Error("missing_arg: new_string");
+    }
     const replace_all = optional_boolean_arg(args, "replace_all", false);
-    const result = await apply_edit(context.work_dir, target, old_string, new_string, replace_all);
+    const result = await apply_edit(context.work_dir, target, old_string, new_raw, replace_all);
     return { ok: true, output: result.output };
   })
 };
@@ -812,7 +1094,7 @@ async function scan_dir(frame, matcher) {
     return { files, dirs };
   }
   for (const entry of entries) {
-    if (SKIP_DIRS.has(entry.name) === true) {
+    if (SKIP_DIRS.has(entry.name) === true || entry.isSymbolicLink() === true) {
       continue;
     }
     const full = path5.join(frame.dir, entry.name);
@@ -824,13 +1106,25 @@ async function scan_dir(frame, matcher) {
   }
   return { files, dirs };
 }
-async function search_file(frame, relative_root, regex, collected, max_results) {
-  const size = await file_size(frame.dir);
-  const lines = await read_if_text(frame.dir, size);
+function guard_grep_target(work_dir, absolute) {
+  const relative = path5.relative(work_dir, absolute);
+  const safe = resolve_safe_path(work_dir, relative);
+  assert_file_tool_access(work_dir, safe, "read");
+  return safe;
+}
+async function search_file(frame, work_dir, relative_root, regex, collected, max_results) {
+  let safe;
+  try {
+    safe = guard_grep_target(work_dir, frame.dir);
+  } catch {
+    return false;
+  }
+  const size = await file_size(safe);
+  const lines = await read_if_text(safe, size);
   if (lines === void 0) {
     return false;
   }
-  const relative = path5.relative(relative_root, frame.dir);
+  const relative = path5.relative(relative_root, safe);
   for (const hit of match_lines(lines, regex)) {
     collected.push(`${relative}:${hit.line_no}: ${hit.text}`);
     if (collected.length >= max_results) {
@@ -839,7 +1133,7 @@ async function search_file(frame, relative_root, regex, collected, max_results)
   }
   return false;
 }
-async function search_tree(root, regex, matcher, max_results) {
+async function search_tree(root, work_dir, regex, matcher, max_results) {
   const collected = [];
   const stack = [{ dir: root, name: root }];
   while (stack.length > 0 && collected.length < max_results) {
@@ -849,7 +1143,7 @@ async function search_tree(root, regex, matcher, max_results) {
     }
     const found = await scan_dir(frame, matcher);
     for (const file of found.files) {
-      const hit_cap = await search_file(file, root, regex, collected, max_results);
+      const hit_cap = await search_file(file, work_dir, root, regex, collected, max_results);
       if (hit_cap === true) {
         break;
       }
@@ -869,13 +1163,20 @@ function finalize_output(matches, max_results) {
   }
   return matches.join("\n");
 }
-function search_file_direct(file_path, regex, collected, max_results) {
-  return search_file({ dir: file_path, name: path5.basename(file_path) }, path5.dirname(file_path), regex, collected, max_results);
+function search_file_direct(file_path, work_dir, regex, collected, max_results) {
+  return search_file(
+    { dir: file_path, name: path5.basename(file_path) },
+    work_dir,
+    path5.dirname(file_path),
+    regex,
+    collected,
+    max_results
+  );
 }
-async function collect_file_matches(root, regex, matcher, max_results) {
+async function collect_file_matches(root, work_dir, regex, matcher, max_results) {
   const collected = [];
   if (matcher(path5.basename(root)) === true) {
-    await search_file_direct(root, regex, collected, max_results);
+    await search_file_direct(root, work_dir, regex, collected, max_results);
   }
   return collected;
 }
@@ -892,9 +1193,10 @@ async function run_grep(args, work_dir) {
   }
   const matcher = glob.length > 0 ? glob_matcher(glob) : () => true;
   const root = resolve_safe_path(work_dir, target);
+  assert_file_tool_access(work_dir, root, "read");
   const root_stat = await stat(root);
   const cap = max_results + 1;
-  const matches = root_stat.isDirectory() === true ? await search_tree(root, regex, matcher, cap) : await collect_file_matches(root, regex, matcher, cap);
+  const matches = root_stat.isDirectory() === true ? await search_tree(root, work_dir, regex, matcher, cap) : await collect_file_matches(root, work_dir, regex, matcher, cap);
   return finalize_output(matches, max_results);
 }
 var grep_files_tool = {
@@ -966,7 +1268,6 @@ async function run_http(args, external) {
   const init = {
     method,
     headers: read_headers(args),
-    redirect: "follow",
     signal: compose_abort_signal(timeout_ms, external)
   };
   if (method !== "GET" && method !== "HEAD") {
@@ -975,7 +1276,7 @@ async function run_http(args, external) {
       init.body = body;
     }
   }
-  const response = await fetch(url, init);
+  const response = await safe_fetch(url, init);
   const content_type = response.headers.get("content-type") ?? "unknown";
   const text = await response.text();
   const sections = [
@@ -1187,6 +1488,7 @@ function slice_lines2(content, offset, limit) {
 }
 async function read_target(args, work_dir, target) {
   const file_path = resolve_safe_path(work_dir, target);
+  assert_file_tool_access(work_dir, file_path, "read");
   const content = await readFile3(file_path, "utf8");
   const offset = optional_number_arg(args, "offset", 1);
   const limit = optional_number_arg(args, "limit", Number.MAX_SAFE_INTEGER);
@@ -1211,78 +1513,47 @@ var read_file_tool = {
 };
 
 // src/tools/builtin/run_tests.ts
+import { spawn as spawn2 } from "child_process";
+
+// src/tools/builtin/terminal.ts
 import { spawn } from "child_process";
-var MAX_OUTPUT_CHARS = 2e3;
-var DEFAULT_TEST_COMMAND = "node node_modules/vitest/vitest.mjs run";
-var parameters12 = {
-  type: "object",
-  properties: {
-    filter: {
-      type: "string",
-      description: "Optional test-file filter appended to the test command (e.g. a vitest file filter)"
-    }
-  },
-  additionalProperties: false
+
+// src/gateway/token_env.ts
+var DEFAULT_GATEWAY_TOKEN_ENVS = {
+  webhook: "LICH_GATEWAY_TOKEN",
+  telegram: "LICH_TELEGRAM_BOT_TOKEN",
+  discord: "LICH_DISCORD_BOT_TOKEN",
+  twitch: "LICH_TWITCH_OAUTH_TOKEN"
 };
-var busy = false;
-var run_test_command = default_runner;
-function default_runner(command, cwd, on_chunk) {
-  const child = spawn("bash", ["-lc", command], {
-    cwd,
-    env: process.env,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  child.stdout?.on("data", (chunk) => on_chunk("stdout", chunk));
-  child.stderr?.on("data", (chunk) => on_chunk("stderr", chunk));
-  return new Promise((resolve) => {
-    child.on("close", (code) => resolve({ exit_code: code ?? -1 }));
-    child.on("error", () => resolve({ exit_code: -1 }));
-  });
+var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function is_env_var_name(value) {
+  return ENV_VAR_NAME.test(value) === true;
 }
-function shell_quote(token) {
-  return `'${token.replaceAll("'", "'\\''")}'`;
+function platform_token_env(config, platform) {
+  const named = config.gateway?.token_envs[platform];
+  if (named !== void 0 && named.length > 0) {
+    return is_env_var_name(named) === true ? named : "";
+  }
+  return DEFAULT_GATEWAY_TOKEN_ENVS[platform] ?? "";
 }
-function build_command(filter, env) {
-  const base = optional_string_arg(env, "LICH_TEST_COMMAND", DEFAULT_TEST_COMMAND);
-  return filter === void 0 ? base : `${base} ${shell_quote(filter)}`;
+function read_platform_token(config, platform) {
+  const key = platform_token_env(config, platform);
+  if (is_env_var_name(key) === false) {
+    return void 0;
+  }
+  const value = process.env[key];
+  if (typeof value !== "string" || value.length === 0) {
+    return void 0;
+  }
+  return value;
 }
-var run_tests_tool = {
-  name: "run_tests",
-  description: "Run the project's test suite via LICH_TEST_COMMAND (default: vitest) in work_dir and report a structured pass/fail result with clamped output.",
-  parameters: parameters12,
-  timeout_ms: 6e5,
-  execute: async (args, context) => capture_errors(async () => {
-    if (busy === true) {
-      return { ok: false, output: "", error: "run_tests_busy" };
-    }
-    busy = true;
-    try {
-      const filter = optional_string_arg(args, "filter", "");
-      const command = build_command(filter === "" ? void 0 : filter, context.env);
-      const streams = { stdout: "", stderr: "" };
-      const on_chunk = (stream, chunk) => {
-        streams[stream] = streams[stream] + chunk.toString("utf8");
-      };
-      const outcome = await run_test_command(command, context.work_dir, on_chunk);
-      const ok = outcome.exit_code === 0;
-      return {
-        ok,
-        output: clamp_output(`${streams.stdout}${streams.stderr}
-[exit ${outcome.exit_code}]`, MAX_OUTPUT_CHARS),
-        ...ok ? {} : { error: "tests_failed" }
-      };
-    } finally {
-      busy = false;
-    }
-  })
-};
 
 // src/tools/builtin/terminal.ts
-import { spawn as spawn2 } from "child_process";
 var MAX_STREAM_CHARS = 5e4;
 var DEFAULT_TIMEOUT_MS3 = 6e4;
 var MAX_TIMEOUT_MS3 = 3e5;
-var parameters13 = {
+var PROVIDER_KEY_ENVS = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY", "LICH_API_KEY"];
+var parameters12 = {
   type: "object",
   properties: {
     command: { type: "string", description: "Shell command to run via bash -lc" },
@@ -1303,6 +1574,21 @@ function stream_chunk(current, chunk) {
 function clamp_timeout(raw) {
   return Math.min(MAX_TIMEOUT_MS3, Math.max(1, Math.floor(raw)));
 }
+function scrub_spawn_env(process_env, context_env) {
+  const drop = /* @__PURE__ */ new Set([...Object.values(DEFAULT_GATEWAY_TOKEN_ENVS), ...PROVIDER_KEY_ENVS]);
+  const merged = { ...process_env, ...context_env };
+  const scrubbed = {};
+  for (const [name, value] of Object.entries(merged)) {
+    if (value === void 0) {
+      continue;
+    }
+    if (drop.has(name) === true || SECRET_PATTERN.test(name) === true) {
+      continue;
+    }
+    scrubbed[name] = value;
+  }
+  return scrubbed;
+}
 function wire_kill(child, timeout_signal, external) {
   timeout_signal.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
   external?.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
@@ -1316,7 +1602,10 @@ function wait_close(child) {
 async function run_command(command, work_dir, env, timeout_ms, external) {
   const stdout = { text: "" };
   const stderr = { text: "" };
-  const child = spawn2("bash", ["-lc", command], { cwd: work_dir, env: { ...process.env, ...env } });
+  const child = spawn("bash", ["-lc", command], {
+    cwd: work_dir,
+    env: scrub_spawn_env(process.env, env)
+  });
   child.stdout.on("data", (chunk) => stream_chunk(stdout, chunk));
   child.stderr.on("data", (chunk) => stream_chunk(stderr, chunk));
   const close_promise = wait_close(child);
@@ -1354,7 +1643,7 @@ function terminal_result(outcome) {
 var terminal_tool = {
   name: "terminal",
   description: "Run a shell command with bash -lc and capture combined stdout/stderr plus the exit code.",
-  parameters: parameters13,
+  parameters: parameters12,
   timeout_ms: MAX_TIMEOUT_MS3,
   execute: async (args, context) => capture_errors(async () => {
     const command = require_string_arg(args, "command");
@@ -1364,6 +1653,75 @@ var terminal_tool = {
   })
 };
 
+// src/tools/builtin/run_tests.ts
+var MAX_OUTPUT_CHARS = 2e3;
+var DEFAULT_TEST_COMMAND = "node node_modules/vitest/vitest.mjs run";
+var parameters13 = {
+  type: "object",
+  properties: {
+    filter: {
+      type: "string",
+      description: "Optional test-file filter appended to the test command (e.g. a vitest file filter)"
+    }
+  },
+  additionalProperties: false
+};
+var busy = false;
+var run_test_command = default_runner;
+function default_runner(command, cwd, on_chunk) {
+  const child = spawn2("bash", ["-lc", command], {
+    cwd,
+    env: scrub_spawn_env(process.env, {}),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  child.stdout?.on("data", (chunk) => on_chunk("stdout", chunk));
+  child.stderr?.on("data", (chunk) => on_chunk("stderr", chunk));
+  return new Promise((resolve) => {
+    child.on("close", (code) => resolve({ exit_code: code ?? -1 }));
+    child.on("error", () => resolve({ exit_code: -1 }));
+  });
+}
+function shell_quote(token) {
+  return `'${token.replaceAll("'", "'\\''")}'`;
+}
+function build_command(filter, env) {
+  const base = optional_string_arg(env, "LICH_TEST_COMMAND", DEFAULT_TEST_COMMAND);
+  return filter === void 0 ? base : `${base} ${shell_quote(filter)}`;
+}
+var run_tests_tool = {
+  name: "run_tests",
+  description: "Run the project's test suite via LICH_TEST_COMMAND (default: vitest) in work_dir and report a structured pass/fail result with clamped output.",
+  parameters: parameters13,
+  timeout_ms: 6e5,
+  execute: async (args, context) => capture_errors(async () => {
+    if (busy === true) {
+      return { ok: false, output: "", error: "run_tests_busy" };
+    }
+    busy = true;
+    try {
+      const filter = optional_string_arg(args, "filter", "");
+      if (filter.startsWith("-") === true) {
+        return { ok: false, output: "", error: "invalid_filter: must not start with -" };
+      }
+      const command = build_command(filter === "" ? void 0 : filter, context.env);
+      const streams = { stdout: "", stderr: "" };
+      const on_chunk = (stream, chunk) => {
+        streams[stream] = streams[stream] + chunk.toString("utf8");
+      };
+      const outcome = await run_test_command(command, context.work_dir, on_chunk);
+      const ok = outcome.exit_code === 0;
+      return {
+        ok,
+        output: clamp_output(`${streams.stdout}${streams.stderr}
+[exit ${outcome.exit_code}]`, MAX_OUTPUT_CHARS),
+        ...ok ? {} : { error: "tests_failed" }
+      };
+    } finally {
+      busy = false;
+    }
+  })
+};
+
 // src/tools/builtin/web_search.ts
 var DEFAULT_MAX_RESULTS4 = 8;
 var MAX_RESULTS = 20;
@@ -1490,7 +1848,8 @@ function read_content_arg(args) {
   return content;
 }
 async function write_target(work_dir, target, content) {
-  const file_path = resolve_safe_path(work_dir, target);
+  const file_path = resolve_safe_path(work_dir, target, true);
+  assert_file_tool_access(work_dir, file_path, "write");
   await mkdir(path7.dirname(file_path), { recursive: true });
   await writeFile2(file_path, content, "utf8");
   return `wrote ${content.length} chars to ${target}`;
@@ -1882,34 +2241,39 @@ var ProviderError = class extends Error {
 // src/agent/config.ts
 import { z } from "zod";
 
-// src/gateway/token_env.ts
-var DEFAULT_GATEWAY_TOKEN_ENVS = {
-  webhook: "LICH_GATEWAY_TOKEN",
-  telegram: "LICH_TELEGRAM_BOT_TOKEN",
-  discord: "LICH_DISCORD_BOT_TOKEN",
-  twitch: "LICH_TWITCH_OAUTH_TOKEN"
-};
-var ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function is_env_var_name(value) {
-  return ENV_VAR_NAME.test(value) === true;
+// src/gateway/access.ts
+var PUBLIC_PLATFORMS = /* @__PURE__ */ new Set(["telegram", "discord", "twitch"]);
+var DEFAULT_GATEWAY_TOOLS_ENABLED = [
+  "read_file",
+  "list_dir",
+  "grep_files",
+  "fetch_url",
+  "web_search",
+  "docs_read",
+  "docs_search"
+];
+function gateway_tools_enabled(config) {
+  return config.gateway?.tools_enabled ?? DEFAULT_GATEWAY_TOOLS_ENABLED;
 }
-function platform_token_env(config, platform) {
-  const named = config.gateway?.token_envs[platform];
-  if (named !== void 0 && named.length > 0) {
-    return is_env_var_name(named) === true ? named : "";
+function is_gateway_sender_allowed(config, platform, chat_id, user_id) {
+  if (PUBLIC_PLATFORMS.has(platform) === false) {
+    return true;
   }
-  return DEFAULT_GATEWAY_TOKEN_ENVS[platform] ?? "";
-}
-function read_platform_token(config, platform) {
-  const key = platform_token_env(config, platform);
-  if (is_env_var_name(key) === false) {
-    return void 0;
+  const users = config.gateway?.allowed_users?.[platform] ?? [];
+  const chats = config.gateway?.allowed_chats?.[platform] ?? [];
+  if (users.length === 0 && chats.length === 0) {
+    return false;
   }
-  const value = process.env[key];
-  if (typeof value !== "string" || value.length === 0) {
-    return void 0;
+  const user_ok = users.length === 0 || users.includes(user_id);
+  const chat_ok = chats.length === 0 || chats.includes(chat_id);
+  return user_ok && chat_ok;
+}
+function check_gateway_sender(config, platform, chat_id, user_id) {
+  if (is_gateway_sender_allowed(config, platform, chat_id, user_id) === true) {
+    return true;
   }
-  return value;
+  logger.warn(`gateway denied ${platform} chat=${chat_id} user=${user_id}`);
+  return false;
 }
 
 // src/mcp/mcp_pin.ts
@@ -2052,10 +2416,17 @@ function refuse_mcp_entry(name, entry) {
 }
 
 // src/agent/config.ts
+var gateway_allowlist = z.record(z.string(), z.array(z.string())).default({});
 var gateway_schema = z.object({
   platforms: z.array(z.enum(["webhook", "telegram", "discord", "twitch"])).default([]),
   /** Env-var names that hold tokens. Never store the secrets themselves. */
-  token_envs: z.record(z.string(), z.string().regex(ENV_VAR_NAME, "invalid env var name")).default({})
+  token_envs: z.record(z.string(), z.string().regex(ENV_VAR_NAME, "invalid env var name")).default({}),
+  /** Per-platform user ids allowed to talk to the bot (default-deny on public platforms). */
+  allowed_users: gateway_allowlist,
+  /** Per-platform chat/channel ids allowed (default-deny on public platforms). */
+  allowed_chats: gateway_allowlist,
+  /** Tool allowlist for the gateway agent; defaults to a read-only safe subset. */
+  tools_enabled: z.union([z.literal("all"), z.array(z.string())]).default([...DEFAULT_GATEWAY_TOOLS_ENABLED])
 }).optional();
 var stdio_mcp_schema = z.object({
   enabled: z.boolean().default(false),
@@ -2134,6 +2505,11 @@ function freeze_config(config) {
   if (config.gateway !== void 0) {
     Object.freeze(config.gateway.platforms);
     Object.freeze(config.gateway.token_envs);
+    Object.freeze(config.gateway.allowed_users);
+    Object.freeze(config.gateway.allowed_chats);
+    if (Array.isArray(config.gateway.tools_enabled) === true) {
+      Object.freeze(config.gateway.tools_enabled);
+    }
     Object.freeze(config.gateway);
   }
   if (config.mcp_servers !== void 0) {
@@ -2614,6 +2990,7 @@ function node_line_child(command, args, env) {
   const queue = create_line_queue();
   let failure;
   const child = spawn3(command, [...args], { stdio: ["pipe", "pipe", "pipe"], env: child_env(env) });
+  child.unref();
   const reader = createInterface({ input: child.stdout });
   reader.on("line", (line) => {
     queue.push(line);
@@ -2658,25 +3035,27 @@ function default_line_spawner(command, args, env) {
 async function open_and_register(registry, name, enabled, session) {
   try {
     register_listed(registry, name, await session.list_tools(), enabled, session);
+    return session;
   } catch (error) {
     session.close();
     const message = error instanceof Error ? error.message : "mcp skipped";
     logger.warn(`mcp ${name} skipped: ${message}`);
+    return void 0;
   }
 }
 async function attach_stdio(registry, name, entry, config, runtime) {
   const planned = plan_stdio(name, entry.command, entry.args, runtime?.env_path ?? process.env.PATH);
   if (typeof planned === "string") {
     logger.warn(`mcp ${name} skipped: ${planned}`);
-    return;
+    return void 0;
   }
   const spawn5 = runtime?.spawn ?? default_line_spawner;
   const session = new McpSession(stdio_pipe(spawn5(planned.command, planned.args, entry.env)));
-  await open_and_register(registry, name, config.tools_enabled, session);
+  return open_and_register(registry, name, config.tools_enabled, session);
 }
 async function attach_http(registry, name, url, config, runtime) {
   const session = new McpSession(http_pipe(url, runtime?.fetch_fn ?? fetch));
-  await open_and_register(registry, name, config.tools_enabled, session);
+  return open_and_register(registry, name, config.tools_enabled, session);
 }
 
 // src/mcp/mcp_tools.ts
@@ -2687,25 +3066,26 @@ function allowlist_wants_mcp(enabled) {
   return enabled.some((name) => name.startsWith("mcp_") === true);
 }
 async function attach_enabled_mcp_tools(registry, config, runtime) {
+  const sessions = [];
   const servers = config.mcp_servers;
   if (servers === void 0 || allowlist_wants_mcp(config.tools_enabled) === false) {
-    return;
+    return sessions;
   }
   for (const [name, entry] of Object.entries(servers)) {
     if (entry.enabled !== true) {
       continue;
     }
     try {
-      if ("url" in entry) {
-        await attach_http(registry, name, entry.url, config, runtime);
-        continue;
+      const session = "url" in entry ? await attach_http(registry, name, entry.url, config, runtime) : await attach_stdio(registry, name, entry, config, runtime);
+      if (session !== void 0) {
+        sessions.push(session);
       }
-      await attach_stdio(registry, name, entry, config, runtime);
     } catch (error) {
       const message = error instanceof Error ? error.message : "mcp skipped";
       logger.warn(`mcp ${name} skipped: ${message}`);
     }
   }
+  return sessions;
 }
 
 // src/plugins/builtin/gatekeeper.plugin.ts
@@ -2912,8 +3292,12 @@ function gatekeeper_hooks(allow_self_commit) {
       if (info.tool_name === "write_file" || info.tool_name === "edit_file") {
         ctx.state?.set("dirty", true);
       } else if (info.tool_name === "run_tests") {
-        ctx.state?.set("tests_ok", true);
-        ctx.state?.set("dirty", false);
+        const filter = info.args["filter"];
+        const filtered = typeof filter === "string" && filter.length > 0;
+        if (filtered === false) {
+          ctx.state?.set("tests_ok", true);
+          ctx.state?.set("dirty", false);
+        }
       } else if (info.tool_name === "git_commit") {
         ctx.state?.set("commits", state_count(ctx, "commits") + 1);
       }
@@ -3055,6 +3439,7 @@ var MAX_ERROR_BODY_CHARS = 500;
 var OVERFLOW_BODY_PATTERN = /context|token|maximum/i;
 var OVERLOADED_STATUS = 529;
 var UNPARSEABLE_ARGS_NOTE = "[unparseable tool arguments]";
+var EMPTY_TEXT_PLACEHOLDER = "(empty)";
 var DEFAULT_MAX_TOKENS = 4096;
 var AnthropicProvider = class {
   name;
@@ -3168,7 +3553,7 @@ function to_anthropic_turns(messages) {
     }
     flush_tool_results(turns, pending_tool_results);
     if (message.role === "user") {
-      turns.push({ role: "user", content: [{ type: "text", text: message.content }] });
+      turns.push({ role: "user", content: [text_block(message.content)] });
     } else {
       turns.push({ role: "assistant", content: assistant_to_blocks(message) });
     }
@@ -3182,11 +3567,14 @@ function flush_tool_results(turns, pending_tool_results) {
   }
   turns.push({ role: "user", content: pending_tool_results.splice(0, pending_tool_results.length) });
 }
+function text_block(text) {
+  return { type: "text", text: text.length > 0 ? text : EMPTY_TEXT_PLACEHOLDER };
+}
 function tool_message_to_block(message) {
   const block = {
     type: "tool_result",
     tool_use_id: message.tool_call_id,
-    content: [{ type: "text", text: message.content }]
+    content: [text_block(message.content)]
   };
   if (message.is_error === true) {
     return { ...block, is_error: true };
@@ -3202,7 +3590,7 @@ function assistant_to_blocks(message) {
     blocks.push({ type: "tool_use", id: tool_call.id, name: tool_call.name, input: tool_call.args });
   }
   if (blocks.length === 0) {
-    blocks.push({ type: "text", text: "" });
+    blocks.push(text_block(""));
   }
   return blocks;
 }
@@ -4046,6 +4434,9 @@ async function chat_with_failover(router, messages, tools, options) {
     if (result.ok === true) {
       return result.value;
     }
+    if (is_abort_failure(result.error, options?.signal) === true) {
+      throw result.error;
+    }
     last_error = result.error;
     log_fail_over(result.error);
   }
@@ -4079,9 +4470,18 @@ async function attempt_provider(provider, messages, tools, options) {
       })
     };
   } catch (error) {
+    if (is_abort_failure(error, options?.signal) === true) {
+      throw error;
+    }
     return { ok: false, error: to_provider_error(error, provider.name) };
   }
 }
+function is_abort_failure(error, signal) {
+  if (signal?.aborted === true) {
+    return true;
+  }
+  return error instanceof Error && error.name === "AbortError";
+}
 function to_provider_error(error, fallback_name) {
   if (error instanceof ProviderError) {
     return error;
@@ -4163,12 +4563,18 @@ function log_compression_failure(error) {
   }
   logger.warn("context compression failed", error);
 }
+function split_keep_recent(non_system, keep_recent) {
+  let cut = Math.max(0, non_system.length - keep_recent);
+  while (cut > 0 && non_system[cut]?.role === "tool") {
+    cut -= 1;
+  }
+  return { recent: non_system.slice(cut), older: non_system.slice(0, cut) };
+}
 async function compress_messages(deps, messages, params) {
   const system_messages = messages.filter((message) => message.role === "system");
   const non_system = messages.filter((message) => message.role !== "system");
   const keep_recent = Math.max(0, params.keep_recent);
-  const recent = non_system.slice(-keep_recent);
-  const older = non_system.slice(0, Math.max(0, non_system.length - recent.length));
+  const { recent, older } = split_keep_recent(non_system, keep_recent);
   if (older.length === 0) {
     return { messages: [...messages], summary_chars: 0 };
   }
@@ -4221,8 +4627,12 @@ function format_tool_result_content(result) {
   }
   return result.output;
 }
-async function run_tool_calls(deps, history, turn, calls, emitter) {
+async function run_tool_calls(deps, history, turn, calls, emitter, signal) {
   for (const call of calls) {
+    if (signal_aborted(signal) === true) {
+      history.push(cancelled_tool_message(call));
+      continue;
+    }
     emitter?.emit({ type: "tool_call_start", turn, call });
     const result = await deps.tools.execute(call.name, call.args, deps.tool_context);
     const tool_message = {
@@ -4237,6 +4647,16 @@ async function run_tool_calls(deps, history, turn, calls, emitter) {
     history.push(tool_message);
     emitter?.emit({ type: "tool_call_end", turn, call, result });
   }
+  return signal_aborted(signal) === true ? "aborted" : "continued";
+}
+function cancelled_tool_message(call) {
+  return {
+    role: "tool",
+    tool_call_id: call.id,
+    name: call.name,
+    content: format_tool_result_content({ ok: false, output: "", error: "cancelled" }),
+    is_error: true
+  };
 }
 async function call_chat(deps, history, params, emitter) {
   try {
@@ -4246,6 +4666,9 @@ async function call_chat(deps, history, params, emitter) {
       signal: params.signal
     });
   } catch (error) {
+    if (signal_aborted(params.signal) === true) {
+      throw error;
+    }
     if (error instanceof ProviderError) {
       logger.error(`provider error kind=${error.kind} provider=${error.provider_name}`, error);
     } else {
@@ -4283,24 +4706,38 @@ async function compress_if_needed(deps, history, params, emitter) {
 function find_last_assistant(messages) {
   return [...messages].reverse().find((message) => message.role === "assistant");
 }
+function signal_aborted(signal) {
+  return signal?.aborted === true;
+}
+function aborted_outcome(history, turns_used, emitter) {
+  emitter?.emit({ type: "error", error: new DOMException("agent loop aborted", "AbortError") });
+  return {
+    messages: history,
+    final: find_last_assistant(history),
+    result: void 0,
+    turns_used,
+    stopped_reason: "aborted"
+  };
+}
 async function run_conversation(deps, messages, params) {
   const history = seed_system_prompt(messages, params.system_prompt);
   const emitter = deps.emitter;
   for (const turn of turn_range(params.max_turns)) {
-    if (params.signal?.aborted === true) {
-      emitter?.emit({ type: "error", error: new DOMException("agent loop aborted", "AbortError") });
-      return {
-        messages: history,
-        final: find_last_assistant(history),
-        result: void 0,
-        turns_used: turn - 1,
-        stopped_reason: "aborted"
-      };
+    if (signal_aborted(params.signal) === true) {
+      return aborted_outcome(history, turn - 1, emitter);
     }
     emitter?.emit({ type: "turn_start", turn });
     await compress_if_needed(deps, history, params, emitter);
     emitter?.emit({ type: "llm_start", turn });
-    const result = await call_chat(deps, history, params, emitter);
+    let result;
+    try {
+      result = await call_chat(deps, history, params, emitter);
+    } catch (error) {
+      if (signal_aborted(params.signal) === true) {
+        return aborted_outcome(history, turn - 1, emitter);
+      }
+      throw error;
+    }
     emitter?.emit({ type: "llm_end", turn, result });
     history.push(result.message);
     const calls = result.message.tool_calls ?? [];
@@ -4309,7 +4746,10 @@ async function run_conversation(deps, messages, params) {
       emitter?.emit({ type: "turn_end", turn });
       return { messages: history, final: result.message, result, turns_used: turn, stopped_reason: "final" };
     }
-    await run_tool_calls(deps, history, turn, calls, emitter);
+    const tool_status = await run_tool_calls(deps, history, turn, calls, emitter, params.signal);
+    if (tool_status === "aborted") {
+      return aborted_outcome(history, turn, emitter);
+    }
   }
   emitter?.emit({ type: "budget_exhausted", turns_used: params.max_turns });
   emitter?.emit({ type: "turn_end", turn: params.max_turns });
@@ -4389,7 +4829,8 @@ var Agent = class {
   executor;
   hook_runner;
   mcp_runtime;
-  mcp_attached = false;
+  mcp_sessions = [];
+  mcp_attach;
   constructor(config, plugins = [], runtime) {
     this.config = config;
     this.mcp_runtime = runtime?.mcp;
@@ -4418,14 +4859,20 @@ var Agent = class {
   async run(options) {
     await this.attach_mcp_once();
     const usage_total = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 };
-    const stop_collecting = this.events.on(collect_usage(usage_total));
+    const run_events = new AgentEmitter();
+    const stop_forwarding = run_events.on((event) => this.events.emit(event));
+    const stop_collecting = run_events.on(collect_usage(usage_total));
     await this.call_plugin_run_start(options.input);
     let outcome;
     try {
       const seed_messages = [...options.history ?? []];
       seed_messages.push({ role: "user", content: options.input });
-      const tool_context = { work_dir: this.config.work_dir, env: tool_env(this.config) };
-      outcome = await run_conversation(this.loop_deps(tool_context), seed_messages, {
+      const tool_context = {
+        work_dir: this.config.work_dir,
+        env: tool_env(this.config),
+        signal: options.signal
+      };
+      outcome = await run_conversation(this.loop_deps(tool_context, run_events), seed_messages, {
         system_prompt: this.config.system_prompt ?? DEFAULT_AGENT_SYSTEM_PROMPT,
         max_turns: this.config.max_turns,
         temperature: this.config.temperature,
@@ -4436,29 +4883,36 @@ var Agent = class {
       });
     } finally {
       stop_collecting();
+      stop_forwarding();
       if (outcome !== void 0) {
         await this.call_plugin_run_end(outcome);
       }
     }
     const session_path = await this.persist_session(outcome, options, usage_total);
-    const full_messages = [...options.history ?? [], ...outcome.messages];
-    return { outcome, messages: full_messages, usage_total, session_path };
+    return { outcome, messages: outcome.messages, usage_total, session_path };
+  }
+  /** Close MCP sessions so stdio children do not keep the event loop alive. */
+  close() {
+    for (const session of this.mcp_sessions) {
+      session.close();
+    }
+    this.mcp_sessions = [];
   }
   /** tools/list once, before the model sees definitions. Empty allowlists never connect. */
   async attach_mcp_once() {
-    if (this.mcp_attached === true) {
-      return;
-    }
-    this.mcp_attached = true;
-    await attach_enabled_mcp_tools(this.registry, this.config, this.mcp_runtime);
+    this.mcp_attach ??= this.do_attach_mcp();
+    await this.mcp_attach;
+  }
+  async do_attach_mcp() {
+    this.mcp_sessions = await attach_enabled_mcp_tools(this.registry, this.config, this.mcp_runtime);
   }
   /** Per-run deps: the built-once ToolContext threads through every tool execution. */
-  loop_deps(tool_context) {
+  loop_deps(tool_context, emitter = this.events) {
     return {
       chat: (messages, tools, chat_options) => this.router.chat_with_failover(messages, tools, chat_options),
       tools: this.executor,
       definitions: () => this.registry.definitions(),
-      emitter: this.events,
+      emitter,
       tool_context
     };
   }
@@ -4513,12 +4967,20 @@ async function create_agent_with_plugins(raw_config) {
 }
 async function run_agent(raw_config, input, options) {
   const agent = await create_agent_with_plugins(raw_config);
-  return agent.run({ input, signal: options?.signal, label: options?.label });
+  try {
+    return await agent.run({ input, signal: options?.signal, label: options?.label });
+  } finally {
+    agent.close();
+  }
 }
 
 export {
   safe_json_parse,
   truncate_text,
+  DEFAULT_GATEWAY_TOKEN_ENVS,
+  is_env_var_name,
+  platform_token_env,
+  read_platform_token,
   logger,
   register_builtin_tools,
   catalog_by_name,
@@ -4530,10 +4992,8 @@ export {
   plugin_errors_summary,
   sleep,
   ProviderError,
-  DEFAULT_GATEWAY_TOKEN_ENVS,
-  is_env_var_name,
-  platform_token_env,
-  read_platform_token,
+  gateway_tools_enabled,
+  check_gateway_sender,
   parse_agent_config,
   AgentEmitter,
   Agent,
@@ -4541,4 +5001,4 @@ export {
   create_agent_with_plugins,
   run_agent
 };
-//# sourceMappingURL=chunk-QVJCIZIF.js.map
+//# sourceMappingURL=chunk-WNFBIX4E.js.map