@molecule/api-ai-tools 1.0.6 → 1.0.8

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-09-13T03:42:47.996Z
+Generated: 2026-09-18T06:57:26.872Z
 -->
 
 # @molecule/api-ai-tools
@@ -68,6 +68,15 @@ interface ExecutionBackend {
   /** The root directory for all operations (e.g. '/workspace' or '/Users/.../project'). */
   readonly projectRoot: string
 
+  /**
+   * Marks backends that operate DIRECTLY on the host filesystem (the local
+   * backend), as opposed to a contained sandbox. Consumers use it to judge
+   * how loud to be about disabled safety guards — a `..` path or symlink
+   * escape on a host backend reaches the operator's real files, while the
+   * same escape in a sandbox stays contained.
+   */
+  readonly hostFs?: boolean
+
   /** Read a file's content as UTF-8 string. */
   readFile(path: string): Promise<string>
 

package/dist/backends/local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/backends/local.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAmDxE"}
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/backends/local.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAsDxE"}

package/dist/backends/local.js

@@ -16,6 +16,9 @@ import { dirname } from 'path';
 export function createLocalBackend(projectRoot) {
     return {
         projectRoot,
+        // Marks this backend as operating directly on the HOST filesystem —
+        // buildTools() uses it to warn loudly when path/symlink guards are off.
+        hostFs: true,
         async readFile(path) {
             return readFile(path, 'utf8');
         },

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAsBnE;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CA8qBxF"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAsBnE;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CA2zBxF"}

package/dist/tools.js

@@ -18,6 +18,21 @@ import { checkBlockedCommand, DEFAULT_SEARCH_EXCLUDED_DIRS, directoryReadHint, i
 export function buildTools(backend, config) {
     const { include, exclude, pathGuards = true, symlinkGuards = false, redactSecrets: doRedact = true, blockDangerousCommands = false, blockCommand, execTimeoutMs = 120_000, commandBudgetMs, searchExcludedDirs, onAfterWrite, onFileDiff, onFileChange, } = config ?? {};
     const root = backend.projectRoot;
+    // A host-filesystem backend with escape guards off is the combination the
+    // audit flagged: `pathGuards` off lets `..` paths out of the workspace,
+    // and `symlinkGuards` off lets a workspace SYMLINK redirect reads/writes
+    // anywhere on the host (npm-workspace layouts are full of such symlinks).
+    // Defaults are deliberately unchanged — but the state must be LOUD, not
+    // silent: one warn per buildTools() call, naming the exact gaps.
+    if (backend.hostFs && (!pathGuards || !symlinkGuards)) {
+        const off = [!pathGuards ? '`pathGuards`' : null, !symlinkGuards ? '`symlinkGuards`' : null]
+            .filter(Boolean)
+            .join(' and ');
+        console.warn(`[ai-tools] ${off} disabled on a LOCAL-HOST backend (root ${backend.projectRoot}) — ` +
+            'model-driven file operations can escape the workspace via `..` paths or symlinks ' +
+            'into the host filesystem. Contained agent runs should use the sandbox backend; ' +
+            'host runs should enable both guards.');
+    }
     // One synchronized excluded-dir set for BOTH search tools (VS Code
     // `search.exclude` semantics). Names are validated defensively — they are
     // interpolated into shell commands, so anything outside the safe charset is
@@ -89,6 +104,102 @@ export function buildTools(backend, config) {
             result = isEnvFilePath(path) ? redactSecrets(result) : redactSecretsInCode(result);
         return result;
     }
+    // ── Empty-read verification ────────────────────────────────────
+    /**
+     * The file's size in bytes as the backend's own shell reports it, or `null`
+     * when that could not be established (the probe failed, timed out, or printed
+     * something unparseable).
+     *
+     * `null` means "I could not look" and is deliberately DISTINCT from `0` ("I
+     * looked and the file is empty") — conflating the two is the very failure this
+     * probe exists to prevent. The last integer in stdout is taken rather than the
+     * whole string, so a consumer that wraps commands in environment sourcing
+     * cannot break the parse with stray output.
+     *
+     * @param path - The already-resolved, symlink-checked path.
+     * @returns The byte count, or null when it could not be determined.
+     */
+    async function probeFileSize(path) {
+        try {
+            const result = await backend.run(`wc -c < ${shellQuote(path)}`, { timeout: 10_000 });
+            if (result.exitCode !== 0)
+                return null;
+            const match = /(\d+)\s*$/.exec(result.stdout);
+            if (!match)
+                return null;
+            const bytes = Number.parseInt(match[1], 10);
+            return Number.isFinite(bytes) ? bytes : null;
+        }
+        catch (_error) {
+            // The probe is the cross-check for an ALREADY-suspect read; if it cannot
+            // run we must report "unverified", never "empty" — returning 0 here would
+            // reintroduce exactly the conflation this function exists to remove.
+            return null;
+        }
+    }
+    /**
+     * Decide what an EMPTY string from `backend.readFile` actually means.
+     *
+     * A backend read can come back empty without throwing: a sandbox exec whose
+     * output stream ends early still reports the process's own exit code, an HTTP
+     * file read can return a 200 with no body, and a concurrent writer can be
+     * observed mid-truncate. Observed in production on 2026-09-16 (X0 rehearsal
+     * 84): several `read_file` calls on two real components returned no content
+     * while an exec shell showed both files present at 3,617 and 25,746 bytes; a
+     * later read of the same paths succeeded, so the failure was transient.
+     *
+     * Returning `{ content: '' }` for that is indistinguishable from a successful
+     * read of an empty file — and a model that believes a file is empty writes it
+     * from scratch, destroying work it never saw. So an empty read is verified
+     * against the file's real size before it is reported as content: genuinely
+     * empty is returned as empty and SAID so; non-empty is retried once and then
+     * reported as a FAILED read; unverifiable is also a failure, never an empty
+     * file.
+     *
+     * @param path - The already-resolved, symlink-checked path.
+     * @param tool - The calling tool's name, for the error message.
+     * @returns The file's real content (possibly empty, with a note), or an error.
+     */
+    async function classifyEmptyRead(path, tool) {
+        const bytes = await probeFileSize(path);
+        if (bytes === 0) {
+            return {
+                content: '',
+                note: `${path} exists and is EMPTY (0 bytes) — that is the file's real content, not a failed read.`,
+            };
+        }
+        if (bytes === null) {
+            return {
+                error: `${tool} obtained NO CONTENT for ${path}, and could not confirm the file's size ` +
+                    `(the \`wc -c ${path}\` probe failed), so this may be a FAILED read rather than an ` +
+                    `empty file. Do NOT write or edit ${path} from memory or from the plan — that would ` +
+                    `overwrite a file you have never seen. Call read_file again, or run \`cat ${path}\` ` +
+                    `with exec_command, and only proceed once you actually have its contents.`,
+            };
+        }
+        // Non-empty on disk: the read failed, and the observed failure is transient —
+        // so retry it once here rather than spending an executor turn on it.
+        try {
+            const retry = await backend.readFile(path);
+            if (typeof retry === 'string' && retry !== '') {
+                return {
+                    content: retry,
+                    note: `The first read of ${path} returned nothing; this content came from an immediate retry.`,
+                };
+            }
+        }
+        catch (_error) {
+            // The retry's own failure adds nothing to the message below — the size
+            // probe is the authoritative fact, and it already said the file has bytes.
+        }
+        return {
+            error: `${tool} obtained NO CONTENT for ${path}, but the file is ${bytes} bytes on disk — the ` +
+                `read FAILED, this is not an empty file (a retry returned nothing either). Do NOT write ` +
+                `or edit ${path} from memory or from the plan — that would overwrite a file you have ` +
+                `never seen. Call read_file again, or run \`cat ${path}\` with exec_command, and only ` +
+                `proceed once you actually have its contents.`,
+        };
+    }
     // ── Diff computation ───────────────────────────────────────────
     /**
      * Compute a lightweight diff summary for telemetry and UI badges.
@@ -134,6 +245,22 @@ export function buildTools(backend, config) {
                 return { error: symlinkErr };
             try {
                 const content = await backend.readFile(path);
+                // A read that produced no usable text is verified against the file's real
+                // size before it can be reported as content (see classifyEmptyRead). The
+                // non-string arm covers a backend whose transport handed back an empty
+                // body as `undefined`; `content.length` below would otherwise raise an
+                // unactionable "Cannot read properties of undefined".
+                if (typeof content !== 'string' || content === '') {
+                    const verdict = await classifyEmptyRead(path, 'read_file');
+                    if ('error' in verdict)
+                        return verdict;
+                    return {
+                        path,
+                        content: sanitizeFileContent(verdict.content, path),
+                        ...(verdict.content === '' ? { empty: true } : {}),
+                        ...(verdict.note ? { note: verdict.note } : {}),
+                    };
+                }
                 if (content.length > MAX_READ_SIZE)
                     return {
                         error: `File too large (${Math.round(content.length / 1024)}KB). Maximum is ${MAX_READ_SIZE / 1024 / 1024}MB.`,
@@ -251,6 +378,15 @@ export function buildTools(backend, config) {
                 return { error: symlinkErr };
             try {
                 let content = await backend.readFile(path);
+                // A transiently-empty read here made every old_string "not found", which
+                // steers the model to re-read and then rewrite a file it never saw. Same
+                // verification as read_file: empty is only believed once it is confirmed.
+                if (typeof content !== 'string' || content === '') {
+                    const verdict = await classifyEmptyRead(path, 'edit_file');
+                    if ('error' in verdict)
+                        return verdict;
+                    content = verdict.content;
+                }
                 const oldContent = content;
                 for (const { old_string: oldString, new_string: newString } of replacements) {
                     // Validate each replacement is well-formed BEFORE touching content. A

package/dist/types.d.ts

@@ -10,6 +10,14 @@
 export interface ExecutionBackend {
     /** The root directory for all operations (e.g. '/workspace' or '/Users/.../project'). */
     readonly projectRoot: string;
+    /**
+     * Marks backends that operate DIRECTLY on the host filesystem (the local
+     * backend), as opposed to a contained sandbox. Consumers use it to judge
+     * how loud to be about disabled safety guards — a `..` path or symlink
+     * escape on a host backend reaches the operator's real files, while the
+     * same escape in a sandbox stays contained.
+     */
+    readonly hostFs?: boolean;
     /** Read a file's content as UTF-8 string. */
     readFile(path: string): Promise<string>;
     /** Write content to a file. Creates parent directories as needed. */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEvC,qEAAqE;IACrE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvD,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvC,mCAAmC;IACnC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;KAAE,CAAC,CAAC,CAAA;IAEnF;;;OAGG;IACH,GAAG,CACD,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAElB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAElB,wEAAwE;IACxE,UAAU,CAAC,EAAE,OAAO,CAAA;IAEpB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,iFAAiF;IACjF,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,2FAA2F;IAC3F,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAE1E;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE7B,uGAAuG;IACvG,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9C,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;IAE3C,wFAAwF;IACxF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAA;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;IACxC,IAAI,EAAE,MAAM,CAAA;CACb;AAED,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IAEjB,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAA;IAEnB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAA;IAEf,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IAEjB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAA;IAE/B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IAEzB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEvC,qEAAqE;IACrE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvD,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEvC,mCAAmC;IACnC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;KAAE,CAAC,CAAC,CAAA;IAEnF;;;OAGG;IACH,GAAG,CACD,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,GACA,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAElB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAElB,wEAAwE;IACxE,UAAU,CAAC,EAAE,OAAO,CAAA;IAEpB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,iFAAiF;IACjF,aAAa,CAAC,EAAE,OAAO,CAAA;IAEvB,2FAA2F;IAC3F,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAE1E;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE7B,uGAAuG;IACvG,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9C,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAA;IAE3C,wFAAwF;IACxF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAA;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;IACxC,IAAI,EAAE,MAAM,CAAA;CACb;AAED,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IAEjB,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAA;IAEnB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAA;IAEf,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IAEjB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAA;IAE/B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B"}

package/dist/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAEE,CAAA;AAyFhD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAsBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBlE;AAID;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9E;AAID,yCAAyC;AACzC,eAAO,MAAM,aAAa,QAAkB,CAAA;AAC5C,8CAA8C;AAC9C,eAAO,MAAM,cAAc,QAAmB,CAAA;AAC9C,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAa,CAAA;AACzC,0BAA0B;AAC1B,eAAO,MAAM,kBAAkB,KAAK,CAAA;AACpC,wBAAwB;AACxB,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,mHAW/B,CAAA;AAEV;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAmBnE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAyBf"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,MAAM,KAAG,MAEE,CAAA;AAyFhD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AA2BD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAID;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9E;AAID,yCAAyC;AACzC,eAAO,MAAM,aAAa,QAAkB,CAAA;AAC5C,8CAA8C;AAC9C,eAAO,MAAM,cAAc,QAAmB,CAAA;AAC9C,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAa,CAAA;AACzC,0BAA0B;AAC1B,eAAO,MAAM,kBAAkB,KAAK,CAAA;AACpC,wBAAwB;AACxB,eAAO,MAAM,gBAAgB,MAAM,CAAA;AAEnC;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,mHAW/B,CAAA;AAEV;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAmBnE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAyBf"}

package/dist/utilities.js

@@ -156,6 +156,9 @@ export function isEnvFilePath(path) {
 // ── Command blocking ──────────────────────────────────────────────────────────
 /**
  * Commands that dump environment variables — blocked to prevent secret leakage.
+ * Also covers reads of `/etc/mol/…` (the molecule platform's secrets dir —
+ * `/etc/mol/env` carries the vault + platform secrets inside a sandbox),
+ * which is an env-dump by another door.
  *
  * `env` counts only when it DUMPS: bare, or with the `-0` / `--null` output
  * flags, followed by the end of the command or a separator / pipe / redirect.
@@ -164,9 +167,11 @@ export function isEnvFilePath(path) {
  * a keyless build still succeeds, and blocking those sent it looking for
  * workarounds (X0 rehearsal 14).
  */
-const BLOCKED_COMMANDS = /(?:^|[;&|`]\s*|(?:sh|bash|zsh|dash)\s+-c\s+['"]?\s*)(?:\/usr\/bin\/)?(?:\benv(?:\s+(?:-0|--null|--))?\s*(?:$|[;&|>)`'"])|\bprintenv\b|\bexport\s*$|\bset\s*$|\bdeclare\s+-x|cat\s+\/etc\/environment|cat\s+\/root\/\.bashrc|cat\s+\/proc\/\d+\/environ|cat\s+\/proc\/self\/environ|strings\s+\/proc|xargs[^;&|\n]*\/proc\/[^;&|\n]*environ|less\s+\/proc|head\s+\/proc|tail\s+\/proc|xxd\s+\/proc|od\s+\/proc|base64\s+\/proc|dd\s[^\n]*\/proc|sed\s[^\n]*\/proc\/[^\n]*environ|awk\s[^\n]*\/proc\/[^\n]*environ|cp\s[^\n]*\/proc\/[^\n]*environ)/i;
+const BLOCKED_COMMANDS = /(?:^|[;&|`]\s*|(?:sh|bash|zsh|dash)\s+-c\s+['"]?\s*)(?:\/usr\/bin\/)?(?:\benv(?:\s+(?:-0|--null|--))?\s*(?:$|[;&|>)`'"])|\bprintenv\b|\bexport\s*$|\bset\s*$|\bdeclare\s+-x|cat\s+\/etc\/environment|cat\s+\/root\/\.bashrc|cat\s+\/proc\/\d+\/environ|cat\s+\/proc\/self\/environ|strings\s+\/proc|xargs[^;&|\n]*\/proc\/[^;&|\n]*environ|less\s+\/proc|head\s+\/proc|tail\s+\/proc|xxd\s+\/proc|od\s+\/proc|base64\s+\/proc|dd\s[^\n]*\/proc|sed\s[^\n]*\/proc\/[^\n]*environ|awk\s[^\n]*\/proc\/[^\n]*environ|cp\s[^\n]*\/proc\/[^\n]*environ|(?:cat|less|head|tail|xxd|od|base64|strings|dd|cp|sed|awk)\s[^\n;&|]*\/etc\/mol(?:\/|\b))/i;
 /** Block shell redirects from /proc environ. */
 const BLOCKED_PROC_REDIRECT = /(?:<\s*\/proc\/(?:\d+|self)\/environ)/i;
+/** Block shell redirects from the molecule platform secrets dir (`/etc/mol`). */
+const BLOCKED_MOL_REDIRECT = /(?:<\s*\/etc\/mol)/i;
 /** Interpreter-based env dumping (python, node, ruby, perl). */
 const BLOCKED_INTERPRETER_ENV = /(?:python[23]?|node|ruby|perl)\s+(?:-e|-c)\s+[^\n]*(?:os\.environ|process\.env|ENV\[|%ENV|ENVIRON)/i;
 /**
@@ -187,6 +192,8 @@ export function checkBlockedCommand(command) {
         return `Command blocked: dumping environment variables is not allowed.${envDumpSteer}`;
     if (BLOCKED_PROC_REDIRECT.test(command))
         return 'Command blocked: /proc/environ access is not allowed.' + envDumpSteer;
+    if (BLOCKED_MOL_REDIRECT.test(command))
+        return 'Command blocked: /etc/mol (platform secrets) access is not allowed.' + envDumpSteer;
     if (BLOCKED_INTERPRETER_ENV.test(command))
         return `Command blocked: dumping the environment from an interpreter is not allowed.${envDumpSteer}`;
     return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-ai-tools",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Shared AI agent tools with backend abstraction for sandbox and local execution",
   "type": "module",
   "main": "dist/index.js",