@moorline/core 0.0.1

package/dist/core/shared/utils/commandRunner.d.ts

@@ -0,0 +1,18 @@
+export interface CommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut?: boolean;
+    signal?: string | null;
+}
+export interface CommandRunOptions {
+    cwd?: string;
+    timeoutMs?: number;
+    env?: Record<string, string | undefined>;
+}
+export interface CommandRunner {
+    run(command: string, args: string[], options?: string | CommandRunOptions): Promise<CommandResult>;
+}
+export declare class ChildProcessRunner implements CommandRunner {
+    run(command: string, args: string[], options?: string | CommandRunOptions): Promise<CommandResult>;
+}

package/dist/core/shared/utils/commandRunner.js

@@ -0,0 +1,51 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const DEFAULT_COMMAND_TIMEOUT_MS = 20_000;
+export class ChildProcessRunner {
+    async run(command, args, options = {}) {
+        const normalized = typeof options === 'string' ? { cwd: options } : options;
+        const timeoutMs = normalized.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
+        try {
+            const result = await execFileAsync(command, args, {
+                cwd: normalized.cwd,
+                env: normalized.env,
+                encoding: 'utf8',
+                maxBuffer: 1024 * 1024 * 8,
+                timeout: timeoutMs,
+                killSignal: 'SIGTERM'
+            });
+            return {
+                exitCode: 0,
+                stdout: result.stdout,
+                stderr: result.stderr
+            };
+        }
+        catch (error) {
+            const failure = error;
+            if (typeof failure.code === 'string' && failure.code === 'ENOENT') {
+                return {
+                    exitCode: 127,
+                    stdout: '',
+                    stderr: `${command} not found`
+                };
+            }
+            if (failure.killed === true && (failure.signal === 'SIGTERM' || failure.code === 'ETIMEDOUT')) {
+                return {
+                    exitCode: 124,
+                    stdout: failure.stdout ?? '',
+                    stderr: `Command timed out after ${timeoutMs}ms: ${command}`,
+                    timedOut: true,
+                    signal: failure.signal ?? null
+                };
+            }
+            return {
+                exitCode: typeof failure.code === 'number' ? failure.code : 1,
+                stdout: failure.stdout ?? '',
+                stderr: failure.stderr ?? failure.message,
+                signal: failure.signal ?? null
+            };
+        }
+    }
+}
+//# sourceMappingURL=commandRunner.js.map

package/dist/core/shared/utils/commandRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandRunner.js","sourceRoot":"","sources":["../../../../../../../src/core/shared/utils/commandRunner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AA4B1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,MAAM,OAAO,kBAAkB;IAC7B,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,UAAsC,EAAE;QACjF,MAAM,UAAU,GAAsB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/F,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,0BAA0B,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE;gBAChD,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC;gBAC1B,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAoB,CAAC;YAErC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClE,OAAO;oBACL,QAAQ,EAAE,GAAG;oBACb,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,GAAG,OAAO,YAAY;iBAC/B,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;gBAC9F,OAAO;oBACL,QAAQ,EAAE,GAAG;oBACb,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;oBAC5B,MAAM,EAAE,2BAA2B,SAAS,OAAO,OAAO,EAAE;oBAC5D,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;iBAC/B,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7D,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO;gBACzC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;aAC/B,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/core/shared/utils/payloadRedaction.d.ts

@@ -0,0 +1,13 @@
+interface RedactPayloadOptions {
+    maxDepth?: number;
+    maxArrayLength?: number;
+    maxObjectKeys?: number;
+    maxStringLength?: number;
+    redactedKeyPatterns?: RegExp[];
+}
+export declare function redactSensitiveText(value: string): string;
+export declare function redactPayloadForLogs(value: unknown, options?: RedactPayloadOptions): unknown;
+export declare function redactPayloadToJson(value: unknown, options?: RedactPayloadOptions & {
+    maxJsonLength?: number;
+}): string;
+export {};

package/dist/core/shared/utils/payloadRedaction.js

@@ -0,0 +1,91 @@
+const DEFAULT_REDACTED_KEY_PATTERNS = [
+    /token/i,
+    /secret/i,
+    /password/i,
+    /authorization/i,
+    /cookie/i,
+    /api[_-]?key/i,
+    /access[_-]?key/i,
+    /credential/i,
+    /bearer/i
+];
+const SENSITIVE_KEY_PATTERN = String.raw `(?:token|secret|password|authorization|cookie|api[_-]?key|access[_-]?key|credential|bearer)`;
+const SENSITIVE_ASSIGNMENT_KEY_PATTERN = String.raw `(?:token|secret|password|cookie|api[_-]?key|access[_-]?key|credential)`;
+const DISCORD_BOT_TOKEN_PATTERN = /[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{20,}/g;
+const JSON_SENSITIVE_VALUE_PATTERN = new RegExp(String.raw `("${SENSITIVE_KEY_PATTERN}"\s*:\s*")([^"]+)(")`, 'gi');
+const ASSIGNMENT_SENSITIVE_VALUE_PATTERN = new RegExp(String.raw `(\b${SENSITIVE_ASSIGNMENT_KEY_PATTERN}\b\s*[:=]\s*)([^\s,;&"']+)`, 'gi');
+const BEARER_VALUE_PATTERN = /\b(Bearer\s+)([A-Za-z0-9._~+/-]+=*)/gi;
+function truncateString(value, maxLength) {
+    if (value.length <= maxLength) {
+        return value;
+    }
+    return `${value.slice(0, Math.max(0, maxLength - 14))}...(truncated)`;
+}
+function shouldRedactKey(key, patterns) {
+    return patterns.some((pattern) => pattern.test(key));
+}
+export function redactSensitiveText(value) {
+    return value
+        .replace(DISCORD_BOT_TOKEN_PATTERN, '[REDACTED]')
+        .replace(JSON_SENSITIVE_VALUE_PATTERN, '$1[REDACTED]$3')
+        .replace(ASSIGNMENT_SENSITIVE_VALUE_PATTERN, '$1[REDACTED]')
+        .replace(BEARER_VALUE_PATTERN, '$1[REDACTED]');
+}
+function redactValue(value, depth, options) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        return truncateString(redactSensitiveText(value), options.maxStringLength);
+    }
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        const trimmed = value.slice(0, options.maxArrayLength).map((entry) => redactValue(entry, depth + 1, options));
+        if (value.length > options.maxArrayLength) {
+            trimmed.push(`[${value.length - options.maxArrayLength} additional entries truncated]`);
+        }
+        return trimmed;
+    }
+    if (typeof value !== 'object') {
+        return String(value);
+    }
+    if (depth >= options.maxDepth) {
+        return '[object truncated]';
+    }
+    const record = value;
+    const keys = Object.keys(record).slice(0, options.maxObjectKeys);
+    const redacted = {};
+    for (const key of keys) {
+        if (shouldRedactKey(key, options.redactedKeyPatterns)) {
+            redacted[key] = '[REDACTED]';
+            continue;
+        }
+        redacted[key] = redactValue(record[key], depth + 1, options);
+    }
+    if (Object.keys(record).length > options.maxObjectKeys) {
+        redacted.__truncatedKeys = Object.keys(record).length - options.maxObjectKeys;
+    }
+    return redacted;
+}
+export function redactPayloadForLogs(value, options = {}) {
+    const resolved = {
+        maxDepth: options.maxDepth ?? 4,
+        maxArrayLength: options.maxArrayLength ?? 10,
+        maxObjectKeys: options.maxObjectKeys ?? 20,
+        maxStringLength: options.maxStringLength ?? 200,
+        redactedKeyPatterns: options.redactedKeyPatterns ?? DEFAULT_REDACTED_KEY_PATTERNS
+    };
+    return redactValue(value, 0, resolved);
+}
+export function redactPayloadToJson(value, options = {}) {
+    const redacted = redactPayloadForLogs(value, options);
+    const json = JSON.stringify(redacted);
+    const maxJsonLength = options.maxJsonLength ?? 4_000;
+    if (json.length <= maxJsonLength) {
+        return json;
+    }
+    return `${json.slice(0, Math.max(0, maxJsonLength - 14))}...(truncated)`;
+}
+//# sourceMappingURL=payloadRedaction.js.map

package/dist/core/shared/utils/payloadRedaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payloadRedaction.js","sourceRoot":"","sources":["../../../../../../../src/core/shared/utils/payloadRedaction.ts"],"names":[],"mappings":"AAAA,MAAM,6BAA6B,GAAG;IACpC,QAAQ;IACR,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,SAAS;CACV,CAAC;AAEF,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAA,6FAA6F,CAAC;AACtI,MAAM,gCAAgC,GAAG,MAAM,CAAC,GAAG,CAAA,wEAAwE,CAAC;AAC5H,MAAM,yBAAyB,GAAG,4DAA4D,CAAC;AAC/F,MAAM,4BAA4B,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,qBAAqB,sBAAsB,EAAE,IAAI,CAAC,CAAC;AAClH,MAAM,kCAAkC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,MAAM,gCAAgC,4BAA4B,EAAE,IAAI,CAAC,CAAC;AAC1I,MAAM,oBAAoB,GAAG,uCAAuC,CAAC;AAUrE,SAAS,cAAc,CAAC,KAAa,EAAE,SAAiB;IACtD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,QAAkB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,KAAK;SACT,OAAO,CAAC,yBAAyB,EAAE,YAAY,CAAC;SAChD,OAAO,CAAC,4BAA4B,EAAE,gBAAgB,CAAC;SACvD,OAAO,CAAC,kCAAkC,EAAE,cAAc,CAAC;SAC3D,OAAO,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,KAAa,EACb,OAAuC;IAEvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9G,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,gCAAgC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;QACvD,QAAQ,CAAC,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAChF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,UAAgC,EAAE;IACrF,MAAM,QAAQ,GAAmC;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;QAC5C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;QAC1C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,GAAG;QAC/C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,6BAA6B;KAClF,CAAC;IACF,OAAO,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAc,EACd,UAA6D,EAAE;IAE/D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC;AAC3E,CAAC"}

package/dist/core/shared/utils/remoteNetworkPolicy.d.ts

@@ -0,0 +1,11 @@
+import { lookup } from 'node:dns/promises';
+export declare function setDnsLookupForTests(fn: typeof lookup): void;
+export declare function resetDnsLookupForTests(): void;
+export declare function isPrivateOrLoopbackAddress(host: string): boolean;
+export declare function validateRemoteUrlTarget(input: {
+    rawUrl: string;
+    allowedProtocols: ReadonlyArray<'http:' | 'https:'>;
+    allowPrivateTargets: boolean;
+    failOnDnsErrors: boolean;
+    sourceLabel: string;
+}): Promise<URL>;

package/dist/core/shared/utils/remoteNetworkPolicy.js

@@ -0,0 +1,137 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+let dnsLookup = lookup;
+export function setDnsLookupForTests(fn) {
+    dnsLookup = fn;
+}
+export function resetDnsLookupForTests() {
+    dnsLookup = lookup;
+}
+function parseIPv4Octets(host) {
+    const segments = host.split('.').map((segment) => Number(segment));
+    if (segments.length !== 4 || segments.some((segment) => !Number.isInteger(segment) || segment < 0 || segment > 255)) {
+        return null;
+    }
+    return [segments[0], segments[1], segments[2], segments[3]];
+}
+function isPrivateOrLoopbackIPv4(host) {
+    const octets = parseIPv4Octets(host);
+    if (!octets) {
+        return false;
+    }
+    const [a, b, c] = octets;
+    return (a === 0 ||
+        a === 10 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        a === 127 ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0 && (c === 0 || c === 2)) ||
+        (a === 192 && b === 88 && c === 99) ||
+        (a === 192 && b === 168) ||
+        (a === 198 && b >= 18 && b <= 19) ||
+        (a === 198 && b === 51 && c === 100) ||
+        (a === 203 && b === 0 && c === 113) ||
+        a >= 224);
+}
+function isPrivateOrLoopbackIPv6(host) {
+    const normalized = host.toLowerCase().split('%')[0] ?? host.toLowerCase();
+    if (normalized === '::' || normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
+        return true;
+    }
+    if (normalized.startsWith('100:') || normalized.startsWith('100::')) {
+        return true;
+    }
+    if (normalized.startsWith('fe8') ||
+        normalized.startsWith('fe9') ||
+        normalized.startsWith('fea') ||
+        normalized.startsWith('feb')) {
+        return true;
+    }
+    if (normalized.startsWith('fc') || normalized.startsWith('fd')) {
+        return true;
+    }
+    if (normalized.startsWith('ff')) {
+        return true;
+    }
+    if (normalized.startsWith('2001:db8:') || normalized === '2001:db8::') {
+        return true;
+    }
+    if (normalized.startsWith('2001:2:') || normalized === '2001:2::') {
+        return true;
+    }
+    if (normalized.startsWith('2001:10:') || normalized === '2001:10::') {
+        return true;
+    }
+    if (normalized.startsWith('64:ff9b:1:') || normalized === '64:ff9b:1::') {
+        return true;
+    }
+    if (normalized.startsWith('::ffff:')) {
+        const mapped = normalized.slice('::ffff:'.length);
+        if (mapped.includes('.')) {
+            return isPrivateOrLoopbackIPv4(mapped);
+        }
+        const parts = mapped.split(':').filter((entry) => entry.length > 0);
+        if (parts.length === 2) {
+            const left = Number.parseInt(parts[0], 16);
+            const right = Number.parseInt(parts[1], 16);
+            if (Number.isInteger(left) && Number.isInteger(right) && left >= 0 && left <= 0xffff && right >= 0 && right <= 0xffff) {
+                const mappedIPv4 = `${(left >> 8) & 0xff}.${left & 0xff}.${(right >> 8) & 0xff}.${right & 0xff}`;
+                return isPrivateOrLoopbackIPv4(mappedIPv4);
+            }
+        }
+        return false;
+    }
+    return false;
+}
+export function isPrivateOrLoopbackAddress(host) {
+    const ipVersion = isIP(host);
+    if (ipVersion === 4) {
+        return isPrivateOrLoopbackIPv4(host);
+    }
+    if (ipVersion === 6) {
+        return isPrivateOrLoopbackIPv6(host);
+    }
+    return false;
+}
+export async function validateRemoteUrlTarget(input) {
+    let parsed;
+    try {
+        parsed = new URL(input.rawUrl);
+    }
+    catch {
+        throw new Error(`${input.sourceLabel} is invalid: ${input.rawUrl}`);
+    }
+    if (!input.allowedProtocols.includes(parsed.protocol)) {
+        throw new Error(`${input.sourceLabel} protocol must be one of ${input.allowedProtocols.join(', ')}: ${input.rawUrl}`);
+    }
+    if (input.allowPrivateTargets) {
+        return parsed;
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (host === 'localhost' || isPrivateOrLoopbackAddress(host)) {
+        throw new Error(`${input.sourceLabel} is blocked by private-network policy: ${input.rawUrl}`);
+    }
+    if (isIP(host) !== 0) {
+        return parsed;
+    }
+    try {
+        const dnsResults = await dnsLookup(host, { all: true, verbatim: true });
+        if (dnsResults.length === 0) {
+            throw new Error('no address records returned');
+        }
+        if (dnsResults.some((entry) => isPrivateOrLoopbackAddress(entry.address))) {
+            throw new Error('resolved to local/private address');
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'resolved to local/private address') {
+            throw new Error(`${input.sourceLabel} resolves to a blocked local/private address: ${input.rawUrl}`);
+        }
+        if (input.failOnDnsErrors) {
+            throw new Error(`${input.sourceLabel} DNS lookup failed for ${host}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return parsed;
+}
+//# sourceMappingURL=remoteNetworkPolicy.js.map

package/dist/core/shared/utils/remoteNetworkPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remoteNetworkPolicy.js","sourceRoot":"","sources":["../../../../../../../src/core/shared/utils/remoteNetworkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,IAAI,SAAS,GAAkB,MAAM,CAAC;AAEtC,MAAM,UAAU,oBAAoB,CAAC,EAAiB;IACpD,SAAS,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,SAAS,GAAG,MAAM,CAAC;AACrB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC;QACpH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACzB,OAAO,CACL,CAAC,KAAK,CAAC;QACP,CAAC,KAAK,EAAE;QACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAClC,CAAC,KAAK,GAAG;QACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;QACpC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;QACnC,CAAC,IAAI,GAAG,CACT,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1E,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;gBACtH,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;gBACjG,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAM7C;IACC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,WAAW,gBAAgB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAA8B,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,WAAW,4BAA4B,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CACrG,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,WAAW,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,WAAW,0CAA0C,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,mCAAmC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,WAAW,iDAAiD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,WAAW,0BAA0B,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAChH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/shared/utils/runtimeMessageUtils.d.ts

@@ -0,0 +1,27 @@
+import type { RuntimeAttachmentPayload } from '../../../types/transport.js';
+export declare function splitRuntimeText(text: string, maxLength: number): string[];
+export declare function validateLocalRuntimeFiles(files: RuntimeAttachmentPayload[] | undefined, allowlistedRoots?: string[]): void;
+export declare function normalizeRuntimeReply(text: string): string;
+export declare function prepareProviderImages(input: {
+    runtimeRoot: string;
+    threadId: string;
+    attachments: RuntimeAttachmentPayload[] | undefined;
+}): Promise<Array<{
+    localPath: string;
+} | {
+    url: string;
+}> | undefined>;
+interface RuntimeImagePruneInput {
+    runtimeRoot: string;
+    threadId?: string;
+    nowMs?: number;
+    ttlMs?: number;
+    maxFilesPerThread?: number;
+}
+interface RuntimeImagePruneStats {
+    scannedThreads: number;
+    removedFiles: number;
+    removedDirectories: number;
+}
+export declare function pruneProviderInputImages(input: RuntimeImagePruneInput): RuntimeImagePruneStats;
+export {};