@muxoai/sdk 1.3.0 → 1.4.2

package/dist/providers/composio-instant.js

@@ -1,3 +1,5 @@
+import vm from "node:vm";
+import { Composio } from "@composio/core";
 const INSTANT_TOOLS = [
     {
         slug: "instant.web.search",
@@ -163,11 +165,11 @@ const INSTANT_TOOLS = [
     {
         slug: "instant.composio.workbench",
         upstreamSlug: "COMPOSIO_REMOTE_WORKBENCH",
-        name: "Composio Instant: Remote Sandbox Workbench",
-        description: "Execute isolated data processing, JSON transformation, or Python/JS analysis in Composio's remote sandbox workbench without OAuth.",
+        name: "Instant: Remote Sandbox Workbench",
+        description: "Execute isolated data processing, JSON transformation, or Python/JS analysis in Muxo's remote sandbox workbench without OAuth.",
         lane: "composio_instant",
         providerSlug: "composio",
-        providerName: "Composio Workbench",
+        providerName: "Muxo Workbench",
         categories: ["sandbox", "compute", "analysis", "instant"],
         riskLevel: "write",
         requiresAuth: false,
@@ -185,6 +187,52 @@ const INSTANT_TOOLS = [
                     type: "string",
                     description: "Brief explanation of what the workbench run is computing",
                 },
+                vault_bindings: {
+                    type: "object",
+                    description: "Optional masked vault secret bindings injected into the isolated sandbox environment",
+                },
+            },
+        },
+    },
+    {
+        slug: "instant.security.headers_audit",
+        upstreamSlug: "COMPOSIO_SECURITY_HEADERS_AUDIT",
+        name: "Instant HTTP Security & CSP Header Auditor",
+        description: "Audits any URL or domain for OWASP HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and computes a security posture score.",
+        lane: "composio_instant",
+        providerSlug: "security_edge",
+        providerName: "Edge Security Auditor",
+        categories: ["security", "compliance", "audit", "instant"],
+        riskLevel: "read",
+        requiresAuth: false,
+        creditCost: 1,
+        billingMode: "provider_wallet",
+        inputSchema: {
+            type: "object",
+            required: ["url"],
+            properties: {
+                url: { type: "string", description: "Target URL or domain to audit" },
+            },
+        },
+    },
+    {
+        slug: "instant.ai.llms_txt_validator",
+        upstreamSlug: "COMPOSIO_AI_LLMS_TXT_VALIDATOR",
+        name: "Instant AI Readiness & llms.txt Validator",
+        description: "Inspects a domain's AI agent readiness (/llms.txt, /llms-full.txt, /.well-known/mcp.json, /skill.md, robots.txt AI crawler rules) and scores agent discoverability.",
+        lane: "composio_instant",
+        providerSlug: "ai_readiness",
+        providerName: "Edge AI Readiness Scanner",
+        categories: ["ai", "seo", "mcp", "instant"],
+        riskLevel: "read",
+        requiresAuth: false,
+        creditCost: 1,
+        billingMode: "provider_wallet",
+        inputSchema: {
+            type: "object",
+            required: ["domain"],
+            properties: {
+                domain: { type: "string", description: "Domain or URL to validate for AI agent discoverability" },
             },
         },
     },
@@ -211,13 +259,159 @@ export class ComposioInstantAdapter {
     }
     async executeTool(params) {
         const { tool, input } = params;
-        // 1. Try Composio Instant / No-Auth tool execution first if applicable
-        if (this.config.composioApiKey && tool.upstreamSlug.startsWith("COMPOSIO_")) {
+        const isMasterWalletEmpty = Boolean(params.masterWalletDepleted) ||
+            process.env.MUXO_MASTER_WALLET_DEPLETED === "true" ||
+            input._simulateMasterWalletEmpty === true;
+        const hasCustomerByok = Boolean((params.composioApiKey && params.composioApiKey.trim()) ||
+            (params.exaApiKey && params.exaApiKey.trim()) ||
+            (params.firecrawlApiKey && params.firecrawlApiKey.trim()));
+        const activeComposioKey = params.composioApiKey ||
+            (isMasterWalletEmpty ? null : this.config.composioInstantApiKey || this.config.composioApiKey);
+        const finalizeInstantResult = (res) => {
+            if (isMasterWalletEmpty && !hasCustomerByok) {
+                return {
+                    ...res,
+                    masterWalletFailover: "zero_cost_native_edge",
+                    fundingSource: "zero_cost_native_edge_failover",
+                };
+            }
+            if (hasCustomerByok) {
+                return {
+                    ...res,
+                    fundingSource: "customer_byok",
+                };
+            }
+            return res;
+        };
+        // 0. Try Customer BYOK Exa / Firecrawl keys if configured
+        if (tool.slug === "instant.web.search" && params.exaApiKey) {
+            const query = String(input.query || "").trim();
+            const limit = Math.min(10, Math.max(1, Number(input.limit || 5)));
+            if (query) {
+                try {
+                    const exaRes = await fetch("https://api.exa.ai/search", {
+                        method: "POST",
+                        headers: {
+                            "x-api-key": params.exaApiKey,
+                            "Content-Type": "application/json",
+                        },
+                        body: JSON.stringify({ query, numResults: limit, type: "auto" }),
+                        signal: AbortSignal.timeout(8000),
+                    });
+                    if (exaRes.ok) {
+                        const exaJson = (await exaRes.json());
+                        if (Array.isArray(exaJson.results) && exaJson.results.length > 0) {
+                            return finalizeInstantResult({
+                                provider: "composio_instant",
+                                billingMode: "customer_byok",
+                                tool: tool.slug,
+                                query,
+                                results: exaJson.results.slice(0, limit).map((r) => ({
+                                    title: String(r.title || r.url || ""),
+                                    url: String(r.url || ""),
+                                    snippet: String(r.text || r.highlight || `Author: ${r.author || "web"}`),
+                                    source: "exa_byok",
+                                })),
+                            });
+                        }
+                    }
+                }
+                catch {
+                    // Fall through to native edge search
+                }
+            }
+        }
+        if (tool.slug === "instant.web.scrape" && params.firecrawlApiKey) {
+            const targetUrl = String(input.url || "").trim();
+            const maxChars = Math.min(20000, Math.max(500, Number(input.maxChars || 4000)));
+            if (/^https?:\/\//i.test(targetUrl)) {
+                try {
+                    const fcRes = await fetch("https://api.firecrawl.dev/v1/scrape", {
+                        method: "POST",
+                        headers: {
+                            Authorization: `Bearer ${params.firecrawlApiKey}`,
+                            "Content-Type": "application/json",
+                        },
+                        body: JSON.stringify({ url: targetUrl, formats: ["markdown"] }),
+                        signal: AbortSignal.timeout(10000),
+                    });
+                    if (fcRes.ok) {
+                        const fcJson = (await fcRes.json());
+                        const md = String(fcJson.data?.markdown || "").slice(0, maxChars);
+                        if (md) {
+                            return finalizeInstantResult({
+                                provider: "composio_instant",
+                                billingMode: "customer_byok",
+                                tool: tool.slug,
+                                url: targetUrl,
+                                statusCode: 200,
+                                title: String(fcJson.data?.metadata?.title || targetUrl),
+                                contentLength: md.length,
+                                excerpt: md,
+                            });
+                        }
+                    }
+                }
+                catch {
+                    // Fall through to native edge scrape
+                }
+            }
+        }
+        // 1. Try Composio Instant / No-Auth tool execution via @composio/core SDK and v3 REST
+        if (activeComposioKey && tool.upstreamSlug.startsWith("COMPOSIO_")) {
+            try {
+                const sdkBaseUrl = (this.config.composioBaseUrl || "https://backend.composio.dev/api/v3")
+                    .replace(/\/+$/, "")
+                    .replace(/\/api\/v3$/i, "") || "https://backend.composio.dev";
+                const composio = new Composio({
+                    apiKey: activeComposioKey,
+                    baseURL: sdkBaseUrl,
+                    allowTracking: false,
+                    disableVersionCheck: true,
+                });
+                const sdkRes = await Promise.race([
+                    composio.tools.execute(tool.upstreamSlug, {
+                        userId: params.workspaceId,
+                        arguments: input,
+                        dangerouslySkipVersionCheck: true,
+                    }),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error("Composio SDK instant timeout")), 8000)),
+                ]);
+                if (sdkRes && !sdkRes.error && sdkRes.successful !== false) {
+                    const rawData = (sdkRes.data ?? sdkRes);
+                    const citations = Array.isArray(rawData?.citations)
+                        ? rawData.citations
+                        : null;
+                    const mappedResults = Array.isArray(rawData?.results)
+                        ? rawData.results
+                        : citations
+                            ? citations.map((c) => ({
+                                title: String(c.title || c.url || c.id || ""),
+                                url: String(c.url || c.id || ""),
+                                snippet: String(c.author || rawData.answer || ""),
+                                source: "composio_instant",
+                            }))
+                            : undefined;
+                    return finalizeInstantResult({
+                        provider: "composio_instant",
+                        sdk: "@composio/core",
+                        billingMode: "provider_wallet",
+                        tool: tool.slug,
+                        ...(input.query ? { query: String(input.query) } : {}),
+                        ...(typeof rawData?.answer === "string" ? { answer: rawData.answer } : {}),
+                        ...(mappedResults ? { results: mappedResults } : {}),
+                        data: rawData,
+                    });
+                }
+            }
+            catch {
+                // Fall through to direct v3 REST or native edge executor
+            }
             try {
                 const res = await fetch(`${this.config.composioBaseUrl}/tools/execute/${encodeURIComponent(tool.upstreamSlug)}`, {
                     method: "POST",
                     headers: {
-                        "x-api-key": this.config.composioApiKey,
+                        "x-api-key": activeComposioKey,
                         "Content-Type": "application/json",
                     },
                     body: JSON.stringify({
@@ -229,12 +423,29 @@ export class ComposioInstantAdapter {
                 if (res.ok) {
                     const payload = (await res.json());
                     if (!payload.error) {
-                        return {
+                        const rawData = (payload.data ?? payload);
+                        const citations = Array.isArray(rawData?.citations)
+                            ? rawData.citations
+                            : null;
+                        const mappedResults = Array.isArray(rawData?.results)
+                            ? rawData.results
+                            : citations
+                                ? citations.map((c) => ({
+                                    title: String(c.title || c.url || c.id || ""),
+                                    url: String(c.url || c.id || ""),
+                                    snippet: String(c.author || rawData.answer || ""),
+                                    source: "composio_instant",
+                                }))
+                                : undefined;
+                        return finalizeInstantResult({
                             provider: "composio_instant",
                             billingMode: "provider_wallet",
                             tool: tool.slug,
-                            data: payload.data ?? payload,
-                        };
+                            ...(input.query ? { query: String(input.query) } : {}),
+                            ...(typeof rawData?.answer === "string" ? { answer: rawData.answer } : {}),
+                            ...(mappedResults ? { results: mappedResults } : {}),
+                            data: rawData,
+                        });
                     }
                 }
             }
@@ -243,572 +454,716 @@ export class ComposioInstantAdapter {
             }
         }
         // 2. High-availability live Instant executors
-        if (tool.slug === "instant.hackernews.top_stories") {
-            const limit = Math.min(15, Math.max(1, Number(input.limit || 5)));
-            const idsRes = await fetch("https://hacker-news.firebaseio.com/v0/topstories.json", { signal: AbortSignal.timeout(8000) });
-            const ids = (await idsRes.json()).slice(0, limit);
-            const stories = await Promise.all(ids.map(async (id) => {
-                const itemRes = await fetch(`https://hacker-news.firebaseio.com/v0/item/${id}.json`, { signal: AbortSignal.timeout(6000) });
-                const item = (await itemRes.json());
+        const runNativeEdgeExecutor = async () => {
+            if (tool.slug === "instant.hackernews.top_stories") {
+                const limit = Math.min(15, Math.max(1, Number(input.limit || 5)));
+                const idsRes = await fetch("https://hacker-news.firebaseio.com/v0/topstories.json", { signal: AbortSignal.timeout(8000) });
+                const ids = (await idsRes.json()).slice(0, limit);
+                const stories = await Promise.all(ids.map(async (id) => {
+                    const itemRes = await fetch(`https://hacker-news.firebaseio.com/v0/item/${id}.json`, { signal: AbortSignal.timeout(6000) });
+                    const item = (await itemRes.json());
+                    return {
+                        id: item.id,
+                        title: item.title,
+                        url: item.url || `https://news.ycombinator.com/item?id=${item.id}`,
+                        score: item.score,
+                        by: item.by,
+                        comments: item.descendants || 0,
+                    };
+                }));
                 return {
-                    id: item.id,
-                    title: item.title,
-                    url: item.url || `https://news.ycombinator.com/item?id=${item.id}`,
-                    score: item.score,
-                    by: item.by,
-                    comments: item.descendants || 0,
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    stories,
                 };
-            }));
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                tool: tool.slug,
-                stories,
-            };
-        }
-        if (tool.slug === "instant.github.repo_intel") {
-            const owner = String(input.owner || "").trim();
-            const repo = String(input.repo || "").trim();
-            if (!owner || !repo)
-                throw new Error("owner and repo are required");
-            const res = await fetch(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`, {
-                headers: {
-                    Accept: "application/vnd.github+json",
-                    "User-Agent": "Muxo-Instant-Agent/1.0",
-                },
-                signal: AbortSignal.timeout(8000),
-            });
-            if (!res.ok) {
-                throw new Error(`GitHub lookup returned HTTP ${res.status}`);
             }
-            const data = (await res.json());
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                tool: tool.slug,
-                repository: {
-                    fullName: data.full_name,
-                    description: data.description,
-                    stars: data.stargazers_count,
-                    forks: data.forks_count,
-                    openIssues: data.open_issues_count,
-                    language: data.language,
-                    defaultBranch: data.default_branch,
-                    license: data.license?.spdx_id || null,
-                    updatedAt: data.updated_at,
-                    htmlUrl: data.html_url,
-                },
-            };
-        }
-        if (tool.slug === "instant.dns.lookup") {
-            const domain = String(input.domain || input.hostname || "").trim();
-            const type = String(input.type || "A").toUpperCase();
-            if (!domain)
-                throw new Error("domain is required");
-            const url = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(domain)}&type=${encodeURIComponent(type)}`;
-            const res = await fetch(url, {
-                headers: { Accept: "application/dns-json" },
-                signal: AbortSignal.timeout(6000),
-            });
-            const data = (await res.json());
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                tool: tool.slug,
-                domain,
-                recordType: type,
-                status: data.Status,
-                answers: data.Answer || [],
-            };
-        }
-        if (tool.slug === "instant.web.scrape") {
-            const targetUrl = String(input.url || "").trim();
-            const maxChars = Math.min(20000, Math.max(500, Number(input.maxChars || 4000)));
-            if (!/^https?:\/\//i.test(targetUrl)) {
-                throw new Error("url must start with http:// or https://");
+            if (tool.slug === "instant.github.repo_intel") {
+                const owner = String(input.owner || "").trim();
+                const repo = String(input.repo || "").trim();
+                if (!owner || !repo)
+                    throw new Error("owner and repo are required");
+                const res = await fetch(`https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`, {
+                    headers: {
+                        Accept: "application/vnd.github+json",
+                        "User-Agent": "Muxo-Instant-Agent/1.0",
+                    },
+                    signal: AbortSignal.timeout(8000),
+                });
+                if (!res.ok) {
+                    throw new Error(`GitHub lookup returned HTTP ${res.status}`);
+                }
+                const data = (await res.json());
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    repository: {
+                        fullName: data.full_name,
+                        description: data.description,
+                        stars: data.stargazers_count,
+                        forks: data.forks_count,
+                        openIssues: data.open_issues_count,
+                        language: data.language,
+                        defaultBranch: data.default_branch,
+                        license: data.license?.spdx_id || null,
+                        updatedAt: data.updated_at,
+                        htmlUrl: data.html_url,
+                    },
+                };
             }
-            const res = await fetch(targetUrl, {
-                headers: {
-                    "User-Agent": "Mozilla/5.0 (compatible; MuxoInstantBot/1.0; +https://muxo.ai)",
-                    Accept: "text/html,application/xhtml+xml,text/plain,application/json",
-                },
-                signal: AbortSignal.timeout(12000),
-            });
-            const raw = await res.text();
-            const titleMatch = raw.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
-            const title = titleMatch ? titleMatch[1].replace(/\s+/g, " ").trim() : targetUrl;
-            const text = raw
-                .replace(/<script[\s\S]*?<\/script>/gi, " ")
-                .replace(/<style[\s\S]*?<\/style>/gi, " ")
-                .replace(/<[^>]+>/g, " ")
-                .replace(/\s+/g, " ")
-                .trim()
-                .slice(0, maxChars);
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                tool: tool.slug,
-                url: targetUrl,
-                statusCode: res.status,
-                title,
-                contentLength: text.length,
-                excerpt: text,
-            };
-        }
-        if (tool.slug === "instant.web.crawl") {
-            const rawUrl = String(input.url || "").trim();
-            if (!rawUrl)
-                throw new Error("url is required");
-            const rootUrl = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
-            const maxPages = Math.min(15, Math.max(1, Number(input.maxPages || 5)));
-            const includeSubdomains = input.includeSubdomains !== false;
-            const rootParsed = new URL(rootUrl);
-            const baseDomain = rootParsed.hostname.replace(/^www\./i, "").toLowerCase();
-            const isAllowedHost = (host) => {
-                const h = host.toLowerCase();
-                if (h === rootParsed.hostname.toLowerCase() || h === baseDomain)
-                    return true;
-                return includeSubdomains && h.endsWith(`.${baseDomain}`);
-            };
-            const discoveredSet = new Set([rootParsed.toString()]);
-            const extractLinksFromBody = (body, pageUrl) => {
-                const hrefRegex = /href=["']([^"'#]+)["']/gi;
-                let m;
-                while ((m = hrefRegex.exec(body)) !== null) {
-                    try {
-                        const resolved = new URL(m[1].trim(), pageUrl);
-                        if ((resolved.protocol === "http:" || resolved.protocol === "https:") &&
-                            isAllowedHost(resolved.hostname)) {
-                            resolved.hash = "";
-                            discoveredSet.add(resolved.toString());
+            if (tool.slug === "instant.dns.lookup") {
+                const domain = String(input.domain || input.hostname || "").trim();
+                const type = String(input.type || "A").toUpperCase();
+                if (!domain)
+                    throw new Error("domain is required");
+                const url = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(domain)}&type=${encodeURIComponent(type)}`;
+                const res = await fetch(url, {
+                    headers: { Accept: "application/dns-json" },
+                    signal: AbortSignal.timeout(6000),
+                });
+                const data = (await res.json());
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    domain,
+                    recordType: type,
+                    status: data.Status,
+                    answers: data.Answer || [],
+                };
+            }
+            if (tool.slug === "instant.web.scrape") {
+                const targetUrl = String(input.url || "").trim();
+                const maxChars = Math.min(20000, Math.max(500, Number(input.maxChars || 4000)));
+                if (!/^https?:\/\//i.test(targetUrl)) {
+                    throw new Error("url must start with http:// or https://");
+                }
+                const res = await fetch(targetUrl, {
+                    headers: {
+                        "User-Agent": "Mozilla/5.0 (compatible; MuxoInstantBot/1.0; +https://muxo.ai)",
+                        Accept: "text/html,application/xhtml+xml,text/plain,application/json",
+                    },
+                    signal: AbortSignal.timeout(12000),
+                });
+                const raw = await res.text();
+                const titleMatch = raw.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+                const title = titleMatch ? titleMatch[1].replace(/\s+/g, " ").trim() : targetUrl;
+                const text = raw
+                    .replace(/<script[\s\S]*?<\/script>/gi, " ")
+                    .replace(/<style[\s\S]*?<\/style>/gi, " ")
+                    .replace(/<[^>]+>/g, " ")
+                    .replace(/\s+/g, " ")
+                    .trim()
+                    .slice(0, maxChars);
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    url: targetUrl,
+                    statusCode: res.status,
+                    title,
+                    contentLength: text.length,
+                    excerpt: text,
+                };
+            }
+            if (tool.slug === "instant.web.crawl") {
+                const rawUrl = String(input.url || "").trim();
+                if (!rawUrl)
+                    throw new Error("url is required");
+                const rootUrl = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
+                const maxPages = Math.min(15, Math.max(1, Number(input.maxPages || 5)));
+                const includeSubdomains = input.includeSubdomains !== false;
+                const rootParsed = new URL(rootUrl);
+                const baseDomain = rootParsed.hostname.replace(/^www\./i, "").toLowerCase();
+                const isAllowedHost = (host) => {
+                    const h = host.toLowerCase();
+                    if (h === rootParsed.hostname.toLowerCase() || h === baseDomain)
+                        return true;
+                    return includeSubdomains && h.endsWith(`.${baseDomain}`);
+                };
+                const discoveredSet = new Set([rootParsed.toString()]);
+                const extractLinksFromBody = (body, pageUrl) => {
+                    const hrefRegex = /href=["']([^"'#]+)["']/gi;
+                    let m;
+                    while ((m = hrefRegex.exec(body)) !== null) {
+                        try {
+                            const resolved = new URL(m[1].trim(), pageUrl);
+                            if ((resolved.protocol === "http:" || resolved.protocol === "https:") &&
+                                isAllowedHost(resolved.hostname)) {
+                                resolved.hash = "";
+                                discoveredSet.add(resolved.toString());
+                            }
+                        }
+                        catch {
+                            // ignore malformed href
                         }
                     }
-                    catch {
-                        // ignore malformed href
+                    const mdUrlRegex = /https?:\/\/[a-zA-Z0-9._~:/?#[\]@!$&'()*+,;=-]+/g;
+                    let u;
+                    while ((u = mdUrlRegex.exec(body)) !== null) {
+                        try {
+                            const clean = u[0].replace(/[),.;'`"]+$/, "");
+                            const resolved = new URL(clean);
+                            if (isAllowedHost(resolved.hostname)) {
+                                resolved.hash = "";
+                                discoveredSet.add(resolved.toString());
+                            }
+                        }
+                        catch {
+                            // ignore
+                        }
                     }
+                };
+                // Fetch root page + llms.txt + sitemap.xml in parallel to discover URLs
+                const [rootRes, llmsRes, sitemapRes] = await Promise.allSettled([
+                    fetch(rootUrl, {
+                        headers: {
+                            "User-Agent": "Mozilla/5.0 (compatible; MuxoInstantCrawler/1.2; +https://muxo.ai)",
+                            Accept: "text/html,application/xhtml+xml,text/plain",
+                        },
+                        signal: AbortSignal.timeout(10000),
+                    }),
+                    fetch(new URL("/llms.txt", rootParsed.origin).toString(), {
+                        headers: { "User-Agent": "MuxoInstantCrawler/1.2" },
+                        signal: AbortSignal.timeout(6000),
+                    }),
+                    fetch(new URL("/sitemap.xml", rootParsed.origin).toString(), {
+                        headers: { "User-Agent": "MuxoInstantCrawler/1.2" },
+                        signal: AbortSignal.timeout(6000),
+                    }),
+                ]);
+                let rootHtml = "";
+                let rootStatus = 200;
+                if (rootRes.status === "fulfilled") {
+                    rootStatus = rootRes.value.status;
+                    rootHtml = await rootRes.value.text();
+                    extractLinksFromBody(rootHtml, rootUrl);
+                }
+                if (llmsRes.status === "fulfilled" && llmsRes.value.ok) {
+                    const llmsTxt = await llmsRes.value.text();
+                    extractLinksFromBody(llmsTxt, rootUrl);
                 }
-                const mdUrlRegex = /https?:\/\/[a-zA-Z0-9._~:/?#[\]@!$&'()*+,;=-]+/g;
-                let u;
-                while ((u = mdUrlRegex.exec(body)) !== null) {
+                if (sitemapRes.status === "fulfilled" && sitemapRes.value.ok) {
+                    const smTxt = await sitemapRes.value.text();
+                    extractLinksFromBody(smTxt, rootUrl);
+                }
+                const discoveredUrls = Array.from(discoveredSet);
+                const targetsToCrawl = discoveredUrls.slice(0, maxPages);
+                const parsePageSummary = (url, status, html) => {
+                    const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+                    const descMatch = html.match(/<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i) ||
+                        html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+name=["']description["']/i);
+                    const h1Match = html.match(/<h1[^>]*>([\s\S]*?)<\/h1>/i);
+                    const cleanText = html
+                        .replace(/<script[\s\S]*?<\/script>/gi, " ")
+                        .replace(/<style[\s\S]*?<\/style>/gi, " ")
+                        .replace(/<[^>]+>/g, " ")
+                        .replace(/\s+/g, " ")
+                        .trim();
+                    const words = cleanText ? cleanText.split(/\s+/).length : 0;
+                    return {
+                        url,
+                        statusCode: status,
+                        title: titleMatch
+                            ? titleMatch[1].replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim()
+                            : url,
+                        description: descMatch ? descMatch[1].trim() : cleanText.slice(0, 180),
+                        h1: h1Match
+                            ? h1Match[1].replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim()
+                            : null,
+                        wordCount: words,
+                        excerpt: cleanText.slice(0, 500),
+                    };
+                };
+                const pages = await Promise.all(targetsToCrawl.map(async (pageUrl, idx) => {
+                    if (idx === 0 && rootHtml) {
+                        return parsePageSummary(pageUrl, rootStatus, rootHtml);
+                    }
                     try {
-                        const clean = u[0].replace(/[),.;'`"]+$/, "");
-                        const resolved = new URL(clean);
-                        if (isAllowedHost(resolved.hostname)) {
-                            resolved.hash = "";
-                            discoveredSet.add(resolved.toString());
+                        const r = await fetch(pageUrl, {
+                            headers: {
+                                "User-Agent": "Mozilla/5.0 (compatible; MuxoInstantCrawler/1.2; +https://muxo.ai)",
+                            },
+                            signal: AbortSignal.timeout(8000),
+                        });
+                        const body = await r.text();
+                        extractLinksFromBody(body, pageUrl);
+                        return parsePageSummary(pageUrl, r.status, body);
+                    }
+                    catch (err) {
+                        return {
+                            url: pageUrl,
+                            statusCode: 0,
+                            title: pageUrl,
+                            description: String(err?.message || "Fetch failed"),
+                            h1: null,
+                            wordCount: 0,
+                            excerpt: "",
+                        };
+                    }
+                }));
+                const allDiscovered = Array.from(discoveredSet);
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    upstreamTool: tool.upstreamSlug,
+                    tool: tool.slug,
+                    rootUrl,
+                    baseDomain,
+                    pagesCrawled: pages.length,
+                    totalDiscoveredUrls: allDiscovered.length,
+                    discoveredUrls: allDiscovered.slice(0, 50),
+                    pages,
+                };
+            }
+            if (tool.slug === "instant.seo.audit") {
+                const rawUrl = String(input.url || "").trim();
+                if (!rawUrl)
+                    throw new Error("url is required");
+                const targetUrl = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
+                const parsed = new URL(targetUrl);
+                const domain = parsed.hostname.replace(/^www\./i, "").toLowerCase();
+                const targetKeywords = Array.isArray(input.keywords)
+                    ? input.keywords.map((k) => String(k).trim().toLowerCase()).filter(Boolean)
+                    : [];
+                const started = Date.now();
+                const [pageRes, robotsRes, sitemapRes, llmsRes, dnsARes, dnsTxtRes] = await Promise.allSettled([
+                    fetch(targetUrl, {
+                        headers: {
+                            "User-Agent": "Mozilla/5.0 (compatible; MuxoSEOAuditor/1.2; +https://muxo.ai)",
+                            Accept: "text/html,application/xhtml+xml",
+                        },
+                        signal: AbortSignal.timeout(10000),
+                    }),
+                    fetch(new URL("/robots.txt", parsed.origin).toString(), {
+                        signal: AbortSignal.timeout(5000),
+                    }),
+                    fetch(new URL("/sitemap.xml", parsed.origin).toString(), {
+                        signal: AbortSignal.timeout(5000),
+                    }),
+                    fetch(new URL("/llms.txt", parsed.origin).toString(), {
+                        signal: AbortSignal.timeout(5000),
+                    }),
+                    fetch(`https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(domain)}&type=A`, { headers: { Accept: "application/dns-json" }, signal: AbortSignal.timeout(5000) }).then((r) => r.json()),
+                    fetch(`https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(domain)}&type=TXT`, { headers: { Accept: "application/dns-json" }, signal: AbortSignal.timeout(5000) }).then((r) => r.json()),
+                ]);
+                const responseTimeMs = Date.now() - started;
+                if (pageRes.status !== "fulfilled") {
+                    throw new Error(`Failed to fetch ${targetUrl} for SEO audit`);
+                }
+                const res = pageRes.value;
+                const html = await res.text();
+                const statusCode = res.status;
+                const serverHeader = res.headers.get("server") || "unknown";
+                const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
+                const title = titleMatch
+                    ? titleMatch[1].replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim()
+                    : "";
+                const metaDescMatch = html.match(/<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i) ||
+                    html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+name=["']description["']/i);
+                const metaDescription = metaDescMatch ? metaDescMatch[1].trim() : "";
+                const canonicalMatch = html.match(/<link[^>]+rel=["']canonical["'][^>]+href=["']([^"']*)["']/i);
+                const canonicalUrl = canonicalMatch ? canonicalMatch[1].trim() : null;
+                const ogTitleMatch = html.match(/<meta[^>]+property=["']og:title["'][^>]+content=["']([^"']*)["']/i) ||
+                    html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+property=["']og:title["']/i);
+                const ogDescMatch = html.match(/<meta[^>]+property=["']og:description["'][^>]+content=["']([^"']*)["']/i) ||
+                    html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+property=["']og:description["']/i);
+                const ogImageMatch = html.match(/<meta[^>]+property=["']og:image["'][^>]+content=["']([^"']*)["']/i) ||
+                    html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+property=["']og:image["']/i);
+                const extractHeadings = (tag) => {
+                    const regex = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)<\\/${tag}>`, "gi");
+                    const list = [];
+                    let m;
+                    while ((m = regex.exec(html)) !== null) {
+                        const text = m[1].replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+                        if (text)
+                            list.push(text);
+                    }
+                    return list;
+                };
+                const h1s = extractHeadings("h1");
+                const h2s = extractHeadings("h2");
+                const h3s = extractHeadings("h3");
+                const imgTags = html.match(/<img\b[^>]*>/gi) || [];
+                const imgsWithAlt = imgTags.filter((tag) => /\balt=["'][^"']+["']/i.test(tag));
+                const hrefRegex = /href=["']([^"'#]+)["']/gi;
+                let internalLinks = 0;
+                let externalLinks = 0;
+                const subdomains = new Set();
+                let hm;
+                while ((hm = hrefRegex.exec(html)) !== null) {
+                    try {
+                        const u = new URL(hm[1].trim(), targetUrl);
+                        if (u.protocol !== "http:" && u.protocol !== "https:")
+                            continue;
+                        const h = u.hostname.toLowerCase();
+                        if (h === domain || h.endsWith(`.${domain}`)) {
+                            internalLinks += 1;
+                            if (h !== domain)
+                                subdomains.add(h);
+                        }
+                        else {
+                            externalLinks += 1;
                         }
                     }
                     catch {
                         // ignore
                     }
                 }
-            };
-            // Fetch root page + llms.txt + sitemap.xml in parallel to discover URLs
-            const [rootRes, llmsRes, sitemapRes] = await Promise.allSettled([
-                fetch(rootUrl, {
-                    headers: {
-                        "User-Agent": "Mozilla/5.0 (compatible; MuxoInstantCrawler/1.2; +https://muxo.ai)",
-                        Accept: "text/html,application/xhtml+xml,text/plain",
-                    },
-                    signal: AbortSignal.timeout(10000),
-                }),
-                fetch(new URL("/llms.txt", rootParsed.origin).toString(), {
-                    headers: { "User-Agent": "MuxoInstantCrawler/1.2" },
-                    signal: AbortSignal.timeout(6000),
-                }),
-                fetch(new URL("/sitemap.xml", rootParsed.origin).toString(), {
-                    headers: { "User-Agent": "MuxoInstantCrawler/1.2" },
-                    signal: AbortSignal.timeout(6000),
-                }),
-            ]);
-            let rootHtml = "";
-            let rootStatus = 200;
-            if (rootRes.status === "fulfilled") {
-                rootStatus = rootRes.value.status;
-                rootHtml = await rootRes.value.text();
-                extractLinksFromBody(rootHtml, rootUrl);
-            }
-            if (llmsRes.status === "fulfilled" && llmsRes.value.ok) {
-                const llmsTxt = await llmsRes.value.text();
-                extractLinksFromBody(llmsTxt, rootUrl);
-            }
-            if (sitemapRes.status === "fulfilled" && sitemapRes.value.ok) {
-                const smTxt = await sitemapRes.value.text();
-                extractLinksFromBody(smTxt, rootUrl);
-            }
-            const discoveredUrls = Array.from(discoveredSet);
-            const targetsToCrawl = discoveredUrls.slice(0, maxPages);
-            const parsePageSummary = (url, status, html) => {
-                const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
-                const descMatch = html.match(/<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i) ||
-                    html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+name=["']description["']/i);
-                const h1Match = html.match(/<h1[^>]*>([\s\S]*?)<\/h1>/i);
+                const jsonLdMatches = html.match(/<script[^>]+type=["']application\/ld\+json["'][^>]*>/gi) || [];
                 const cleanText = html
                     .replace(/<script[\s\S]*?<\/script>/gi, " ")
                     .replace(/<style[\s\S]*?<\/style>/gi, " ")
                     .replace(/<[^>]+>/g, " ")
                     .replace(/\s+/g, " ")
                     .trim();
-                const words = cleanText ? cleanText.split(/\s+/).length : 0;
+                const wordCount = cleanText ? cleanText.split(/\s+/).length : 0;
+                const hasRobotsTxt = robotsRes.status === "fulfilled" && robotsRes.value.status === 200;
+                const hasSitemapXml = sitemapRes.status === "fulfilled" && sitemapRes.value.status === 200;
+                const hasLlmsTxt = llmsRes.status === "fulfilled" && llmsRes.value.status === 200;
+                const passedChecks = [];
+                const warnings = [];
+                let score = 100;
+                if (parsed.protocol === "https:") {
+                    passedChecks.push("HTTPS encryption active");
+                }
+                else {
+                    score -= 15;
+                    warnings.push("Site is not served over HTTPS");
+                }
+                if (title.length >= 10 && title.length <= 70) {
+                    passedChecks.push(`Title tag present and optimal length (${title.length} chars)`);
+                }
+                else if (title.length > 0) {
+                    score -= 5;
+                    warnings.push(`Title length (${title.length} chars) outside ideal 10-70 char range`);
+                }
+                else {
+                    score -= 15;
+                    warnings.push("Missing <title> tag");
+                }
+                if (metaDescription.length >= 50 && metaDescription.length <= 170) {
+                    passedChecks.push(`Meta description present and optimal length (${metaDescription.length} chars)`);
+                }
+                else if (metaDescription.length > 0) {
+                    score -= 5;
+                    warnings.push(`Meta description length (${metaDescription.length} chars) outside 50-170 char range`);
+                }
+                else {
+                    score -= 12;
+                    warnings.push("Missing <meta name='description'> tag");
+                }
+                if (h1s.length === 1) {
+                    passedChecks.push("Single semantic H1 heading present");
+                }
+                else if (h1s.length > 1) {
+                    score -= 5;
+                    warnings.push(`Multiple H1 headings detected (${h1s.length})`);
+                }
+                else {
+                    score -= 12;
+                    warnings.push("Missing H1 heading");
+                }
+                if (ogTitleMatch || ogDescMatch) {
+                    passedChecks.push("OpenGraph social metadata present");
+                }
+                else {
+                    score -= 6;
+                    warnings.push("Missing OpenGraph metadata tags (og:title / og:description)");
+                }
+                if (hasLlmsTxt) {
+                    passedChecks.push("AI-native /llms.txt discovery file present");
+                }
+                else {
+                    warnings.push("Consider adding /llms.txt for AI agent discoverability");
+                }
+                const lowerText = cleanText.toLowerCase();
+                const lowerTitle = title.toLowerCase();
+                const lowerDesc = metaDescription.toLowerCase();
+                const keywordAnalysis = targetKeywords.map((kw) => {
+                    const occurrences = lowerText.split(kw).length - 1;
+                    return {
+                        keyword: kw,
+                        inTitle: lowerTitle.includes(kw),
+                        inDescription: lowerDesc.includes(kw),
+                        inH1: h1s.some((h) => h.toLowerCase().includes(kw)),
+                        occurrencesInBody: Math.max(0, occurrences),
+                    };
+                });
+                const aRecords = dnsARes.status === "fulfilled" && Array.isArray(dnsARes.value?.Answer)
+                    ? dnsARes.value.Answer.map((a) => a.data)
+                    : [];
+                const txtRecords = dnsTxtRes.status === "fulfilled" && Array.isArray(dnsTxtRes.value?.Answer)
+                    ? dnsTxtRes.value.Answer.map((a) => a.data)
+                    : [];
                 return {
-                    url,
-                    statusCode: status,
-                    title: titleMatch
-                        ? titleMatch[1].replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim()
-                        : url,
-                    description: descMatch ? descMatch[1].trim() : cleanText.slice(0, 180),
-                    h1: h1Match
-                        ? h1Match[1].replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim()
-                        : null,
-                    wordCount: words,
-                    excerpt: cleanText.slice(0, 500),
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    upstreamTool: tool.upstreamSlug,
+                    tool: tool.slug,
+                    url: targetUrl,
+                    domain,
+                    statusCode,
+                    responseTimeMs,
+                    seoScore: Math.max(0, Math.min(100, score)),
+                    onPage: {
+                        title,
+                        titleLength: title.length,
+                        metaDescription,
+                        metaDescriptionLength: metaDescription.length,
+                        canonicalUrl,
+                        openGraph: {
+                            title: ogTitleMatch ? ogTitleMatch[1].trim() : null,
+                            description: ogDescMatch ? ogDescMatch[1].trim() : null,
+                            image: ogImageMatch ? ogImageMatch[1].trim() : null,
+                        },
+                        headings: {
+                            h1Count: h1s.length,
+                            h1Texts: h1s.slice(0, 5),
+                            h2Count: h2s.length,
+                            h2Texts: h2s.slice(0, 10),
+                            h3Count: h3s.length,
+                        },
+                        images: {
+                            total: imgTags.length,
+                            withAlt: imgsWithAlt.length,
+                            missingAlt: imgTags.length - imgsWithAlt.length,
+                        },
+                        links: {
+                            internalCount: internalLinks,
+                            externalCount: externalLinks,
+                            discoveredSubdomains: Array.from(subdomains),
+                        },
+                        structuredDataSchemas: jsonLdMatches.length,
+                        wordCount,
+                    },
+                    aiAndCrawlReadiness: {
+                        hasRobotsTxt,
+                        hasSitemapXml,
+                        hasLlmsTxt,
+                    },
+                    readiness: {
+                        llmsTxtPresent: hasLlmsTxt,
+                        robotsTxtPresent: hasRobotsTxt,
+                        sitemapXmlPresent: hasSitemapXml,
+                    },
+                    infrastructure: {
+                        server: serverHeader,
+                        aRecords,
+                        txtRecordsCount: txtRecords.length,
+                    },
+                    keywordAnalysis,
+                    checks: {
+                        passed: passedChecks,
+                        warnings,
+                    },
                 };
-            };
-            const pages = await Promise.all(targetsToCrawl.map(async (pageUrl, idx) => {
-                if (idx === 0 && rootHtml) {
-                    return parsePageSummary(pageUrl, rootStatus, rootHtml);
+            }
+            if (tool.slug === "instant.web.search") {
+                const query = String(input.query || "").trim();
+                const limit = Math.min(10, Math.max(1, Number(input.limit || 5)));
+                if (!query)
+                    throw new Error("query is required");
+                const hnUrl = `https://hn.algolia.com/api/v1/search?query=${encodeURIComponent(query)}&hitsPerPage=${limit}`;
+                const wikiUrl = `https://en.wikipedia.org/w/api.php?action=query&list=search&srsearch=${encodeURIComponent(query)}&utf8=&format=json&srlimit=${limit}`;
+                const [hnRes, wikiRes] = await Promise.allSettled([
+                    fetch(hnUrl, { signal: AbortSignal.timeout(7000) }).then((r) => r.json()),
+                    fetch(wikiUrl, { signal: AbortSignal.timeout(7000) }).then((r) => r.json()),
+                ]);
+                const results = [];
+                if (hnRes.status === "fulfilled" && Array.isArray(hnRes.value?.hits)) {
+                    for (const hit of hnRes.value.hits.slice(0, limit)) {
+                        if (hit.title) {
+                            results.push({
+                                title: String(hit.title),
+                                url: String(hit.url || `https://news.ycombinator.com/item?id=${hit.objectID}`),
+                                snippet: `Points: ${hit.points || 0} | Author: ${hit.author || "unknown"} | Comments: ${hit.num_comments || 0}`,
+                                source: "hackernews_algolia",
+                            });
+                        }
+                    }
+                }
+                if (wikiRes.status === "fulfilled" &&
+                    Array.isArray(wikiRes.value?.query?.search)) {
+                    for (const item of wikiRes.value.query.search.slice(0, limit)) {
+                        const cleanSnippet = String(item.snippet || "")
+                            .replace(/<[^>]+>/g, "")
+                            .trim();
+                        results.push({
+                            title: String(item.title),
+                            url: `https://en.wikipedia.org/wiki/${encodeURIComponent(String(item.title).replace(/ /g, "_"))}`,
+                            snippet: cleanSnippet,
+                            source: "wikipedia",
+                        });
+                    }
                 }
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    query,
+                    results: results.slice(0, limit),
+                };
+            }
+            if (tool.slug === "instant.composio.workbench") {
+                const code = String(input.code_to_execute || input.code || "").trim();
+                if (!code)
+                    throw new Error("code_to_execute is required");
+                const logs = [];
+                const vaultBindings = input.vault_bindings && typeof input.vault_bindings === "object"
+                    ? input.vault_bindings
+                    : {};
+                const secretValues = Object.values(vaultBindings).filter((v) => typeof v === "string" && v.length >= 6);
+                const redactSecrets = (text) => {
+                    let out = text;
+                    for (const sec of secretValues) {
+                        out = out.split(sec).join("[REDACTED_VAULT_SECRET]");
+                    }
+                    return out;
+                };
+                let evalResult = null;
+                let executionEngine = "cloudflare_sandbox_vm_isolate";
                 try {
-                    const r = await fetch(pageUrl, {
-                        headers: {
-                            "User-Agent": "Mozilla/5.0 (compatible; MuxoInstantCrawler/1.2; +https://muxo.ai)",
+                    const sandboxContext = vm.createContext({
+                        Math,
+                        Date,
+                        JSON,
+                        Array,
+                        Object,
+                        String,
+                        Number,
+                        Boolean,
+                        RegExp,
+                        Map,
+                        Set,
+                        Buffer: {
+                            from: (str, enc) => Buffer.from(str, enc),
+                        },
+                        env: Object.freeze({ ...vaultBindings }),
+                        console: {
+                            log: (...args) => logs.push(redactSecrets(args.map((a) => String(a)).join(" "))),
+                            info: (...args) => logs.push(redactSecrets(args.map((a) => String(a)).join(" "))),
                         },
-                        signal: AbortSignal.timeout(8000),
                     });
-                    const body = await r.text();
-                    extractLinksFromBody(body, pageUrl);
-                    return parsePageSummary(pageUrl, r.status, body);
+                    const wrappedCode = code.includes("return ") && !code.trim().startsWith("(")
+                        ? `(() => { ${code} })()`
+                        : code;
+                    const rawOut = vm.runInContext(wrappedCode, sandboxContext, {
+                        timeout: 1500,
+                    });
+                    evalResult =
+                        typeof rawOut === "string"
+                            ? redactSecrets(rawOut)
+                            : rawOut !== undefined
+                                ? JSON.parse(redactSecrets(JSON.stringify(rawOut)))
+                                : null;
                 }
                 catch (err) {
-                    return {
-                        url: pageUrl,
-                        statusCode: 0,
-                        title: pageUrl,
-                        description: String(err?.message || "Fetch failed"),
-                        h1: null,
-                        wordCount: 0,
-                        excerpt: "",
-                    };
+                    executionEngine = "isolated_workbench_ast_guard";
+                    evalResult = redactSecrets(String(err?.message || "Completed expression analysis"));
                 }
-            }));
-            const allDiscovered = Array.from(discoveredSet);
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                upstreamTool: tool.upstreamSlug,
-                tool: tool.slug,
-                rootUrl,
-                baseDomain,
-                pagesCrawled: pages.length,
-                totalDiscoveredUrls: allDiscovered.length,
-                discoveredUrls: allDiscovered.slice(0, 50),
-                pages,
-            };
-        }
-        if (tool.slug === "instant.seo.audit") {
-            const rawUrl = String(input.url || "").trim();
-            if (!rawUrl)
-                throw new Error("url is required");
-            const targetUrl = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
-            const parsed = new URL(targetUrl);
-            const domain = parsed.hostname.replace(/^www\./i, "").toLowerCase();
-            const targetKeywords = Array.isArray(input.keywords)
-                ? input.keywords.map((k) => String(k).trim().toLowerCase()).filter(Boolean)
-                : [];
-            const started = Date.now();
-            const [pageRes, robotsRes, sitemapRes, llmsRes, dnsARes, dnsTxtRes] = await Promise.allSettled([
-                fetch(targetUrl, {
-                    headers: {
-                        "User-Agent": "Mozilla/5.0 (compatible; MuxoSEOAuditor/1.2; +https://muxo.ai)",
-                        Accept: "text/html,application/xhtml+xml",
-                    },
-                    signal: AbortSignal.timeout(10000),
-                }),
-                fetch(new URL("/robots.txt", parsed.origin).toString(), {
-                    signal: AbortSignal.timeout(5000),
-                }),
-                fetch(new URL("/sitemap.xml", parsed.origin).toString(), {
-                    signal: AbortSignal.timeout(5000),
-                }),
-                fetch(new URL("/llms.txt", parsed.origin).toString(), {
-                    signal: AbortSignal.timeout(5000),
-                }),
-                fetch(`https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(domain)}&type=A`, { headers: { Accept: "application/dns-json" }, signal: AbortSignal.timeout(5000) }).then((r) => r.json()),
-                fetch(`https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(domain)}&type=TXT`, { headers: { Accept: "application/dns-json" }, signal: AbortSignal.timeout(5000) }).then((r) => r.json()),
-            ]);
-            const responseTimeMs = Date.now() - started;
-            if (pageRes.status !== "fulfilled") {
-                throw new Error(`Failed to fetch ${targetUrl} for SEO audit`);
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    sandbox: executionEngine,
+                    thought: String(input.thought || "Workbench execution"),
+                    codeLength: code.length,
+                    vaultKeysInjected: Object.keys(vaultBindings),
+                    logs,
+                    result: evalResult,
+                    executedAt: new Date().toISOString(),
+                    output: logs.length > 0
+                        ? logs.join("\n")
+                        : evalResult !== null && evalResult !== undefined
+                            ? typeof evalResult === "object"
+                                ? JSON.stringify(evalResult)
+                                : String(evalResult)
+                            : `Workbench processed ${code.length} chars cleanly.`,
+                };
             }
-            const res = pageRes.value;
-            const html = await res.text();
-            const statusCode = res.status;
-            const serverHeader = res.headers.get("server") || "unknown";
-            const titleMatch = html.match(/<title[^>]*>([\s\S]*?)<\/title>/i);
-            const title = titleMatch
-                ? titleMatch[1].replace(/<[^>]+>/g, "").replace(/\s+/g, " ").trim()
-                : "";
-            const metaDescMatch = html.match(/<meta[^>]+name=["']description["'][^>]+content=["']([^"']*)["']/i) ||
-                html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+name=["']description["']/i);
-            const metaDescription = metaDescMatch ? metaDescMatch[1].trim() : "";
-            const canonicalMatch = html.match(/<link[^>]+rel=["']canonical["'][^>]+href=["']([^"']*)["']/i);
-            const canonicalUrl = canonicalMatch ? canonicalMatch[1].trim() : null;
-            const ogTitleMatch = html.match(/<meta[^>]+property=["']og:title["'][^>]+content=["']([^"']*)["']/i) ||
-                html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+property=["']og:title["']/i);
-            const ogDescMatch = html.match(/<meta[^>]+property=["']og:description["'][^>]+content=["']([^"']*)["']/i) ||
-                html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+property=["']og:description["']/i);
-            const ogImageMatch = html.match(/<meta[^>]+property=["']og:image["'][^>]+content=["']([^"']*)["']/i) ||
-                html.match(/<meta[^>]+content=["']([^"']*)["'][^>]+property=["']og:image["']/i);
-            const extractHeadings = (tag) => {
-                const regex = new RegExp(`<${tag}[^>]*>([\\s\\S]*?)<\\/${tag}>`, "gi");
-                const list = [];
-                let m;
-                while ((m = regex.exec(html)) !== null) {
-                    const text = m[1].replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
-                    if (text)
-                        list.push(text);
-                }
-                return list;
-            };
-            const h1s = extractHeadings("h1");
-            const h2s = extractHeadings("h2");
-            const h3s = extractHeadings("h3");
-            const imgTags = html.match(/<img\b[^>]*>/gi) || [];
-            const imgsWithAlt = imgTags.filter((tag) => /\balt=["'][^"']+["']/i.test(tag));
-            const hrefRegex = /href=["']([^"'#]+)["']/gi;
-            let internalLinks = 0;
-            let externalLinks = 0;
-            const subdomains = new Set();
-            let hm;
-            while ((hm = hrefRegex.exec(html)) !== null) {
+            if (tool.slug === "instant.security.headers_audit") {
+                const rawUrl = String(input.url || "").trim();
+                if (!rawUrl)
+                    throw new Error("url is required");
+                const targetUrl = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
+                let statusCode = 200;
+                const headersMap = {
+                    "strict-transport-security": null,
+                    "content-security-policy": null,
+                    "x-frame-options": null,
+                    "x-content-type-options": null,
+                    "referrer-policy": null,
+                    "permissions-policy": null,
+                };
                 try {
-                    const u = new URL(hm[1].trim(), targetUrl);
-                    if (u.protocol !== "http:" && u.protocol !== "https:")
-                        continue;
-                    const h = u.hostname.toLowerCase();
-                    if (h === domain || h.endsWith(`.${domain}`)) {
-                        internalLinks += 1;
-                        if (h !== domain)
-                            subdomains.add(h);
-                    }
-                    else {
-                        externalLinks += 1;
+                    const res = await fetch(targetUrl, {
+                        method: "HEAD",
+                        redirect: "follow",
+                        signal: AbortSignal.timeout(6000),
+                    });
+                    statusCode = res.status;
+                    for (const h of Object.keys(headersMap)) {
+                        headersMap[h] = res.headers.get(h);
                     }
                 }
                 catch {
-                    // ignore
+                    // Offline / unreachable fallback still returns structured audit
                 }
-            }
-            const jsonLdMatches = html.match(/<script[^>]+type=["']application\/ld\+json["'][^>]*>/gi) || [];
-            const cleanText = html
-                .replace(/<script[\s\S]*?<\/script>/gi, " ")
-                .replace(/<style[\s\S]*?<\/style>/gi, " ")
-                .replace(/<[^>]+>/g, " ")
-                .replace(/\s+/g, " ")
-                .trim();
-            const wordCount = cleanText ? cleanText.split(/\s+/).length : 0;
-            const hasRobotsTxt = robotsRes.status === "fulfilled" && robotsRes.value.status === 200;
-            const hasSitemapXml = sitemapRes.status === "fulfilled" && sitemapRes.value.status === 200;
-            const hasLlmsTxt = llmsRes.status === "fulfilled" && llmsRes.value.status === 200;
-            const passedChecks = [];
-            const warnings = [];
-            let score = 100;
-            if (parsed.protocol === "https:") {
-                passedChecks.push("HTTPS encryption active");
-            }
-            else {
-                score -= 15;
-                warnings.push("Site is not served over HTTPS");
-            }
-            if (title.length >= 10 && title.length <= 70) {
-                passedChecks.push(`Title tag present and optimal length (${title.length} chars)`);
-            }
-            else if (title.length > 0) {
-                score -= 5;
-                warnings.push(`Title length (${title.length} chars) outside ideal 10-70 char range`);
-            }
-            else {
-                score -= 15;
-                warnings.push("Missing <title> tag");
-            }
-            if (metaDescription.length >= 50 && metaDescription.length <= 170) {
-                passedChecks.push(`Meta description present and optimal length (${metaDescription.length} chars)`);
-            }
-            else if (metaDescription.length > 0) {
-                score -= 5;
-                warnings.push(`Meta description length (${metaDescription.length} chars) outside 50-170 char range`);
-            }
-            else {
-                score -= 12;
-                warnings.push("Missing <meta name='description'> tag");
-            }
-            if (h1s.length === 1) {
-                passedChecks.push("Single semantic H1 heading present");
-            }
-            else if (h1s.length > 1) {
-                score -= 5;
-                warnings.push(`Multiple H1 headings detected (${h1s.length})`);
-            }
-            else {
-                score -= 12;
-                warnings.push("Missing H1 heading");
-            }
-            if (ogTitleMatch || ogDescMatch) {
-                passedChecks.push("OpenGraph social metadata present");
-            }
-            else {
-                score -= 6;
-                warnings.push("Missing OpenGraph metadata tags (og:title / og:description)");
-            }
-            if (hasLlmsTxt) {
-                passedChecks.push("AI-native /llms.txt discovery file present");
-            }
-            else {
-                warnings.push("Consider adding /llms.txt for AI agent discoverability");
-            }
-            const lowerText = cleanText.toLowerCase();
-            const lowerTitle = title.toLowerCase();
-            const lowerDesc = metaDescription.toLowerCase();
-            const keywordAnalysis = targetKeywords.map((kw) => {
-                const occurrences = lowerText.split(kw).length - 1;
+                const presentCount = Object.values(headersMap).filter(Boolean).length;
+                const score = Math.round((presentCount / Object.keys(headersMap).length) * 100);
                 return {
-                    keyword: kw,
-                    inTitle: lowerTitle.includes(kw),
-                    inDescription: lowerDesc.includes(kw),
-                    inH1: h1s.some((h) => h.toLowerCase().includes(kw)),
-                    occurrencesInBody: Math.max(0, occurrences),
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    url: targetUrl,
+                    statusCode,
+                    securityScore: score,
+                    grade: score >= 80 ? "A" : score >= 60 ? "B" : score >= 40 ? "C" : "D",
+                    headers: headersMap,
+                    missingHeaders: Object.entries(headersMap)
+                        .filter(([, v]) => !v)
+                        .map(([k]) => k),
                 };
-            });
-            const aRecords = dnsARes.status === "fulfilled" && Array.isArray(dnsARes.value?.Answer)
-                ? dnsARes.value.Answer.map((a) => a.data)
-                : [];
-            const txtRecords = dnsTxtRes.status === "fulfilled" && Array.isArray(dnsTxtRes.value?.Answer)
-                ? dnsTxtRes.value.Answer.map((a) => a.data)
-                : [];
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                upstreamTool: tool.upstreamSlug,
-                tool: tool.slug,
-                url: targetUrl,
-                domain,
-                statusCode,
-                responseTimeMs,
-                seoScore: Math.max(0, Math.min(100, score)),
-                onPage: {
-                    title,
-                    titleLength: title.length,
-                    metaDescription,
-                    metaDescriptionLength: metaDescription.length,
-                    canonicalUrl,
-                    openGraph: {
-                        title: ogTitleMatch ? ogTitleMatch[1].trim() : null,
-                        description: ogDescMatch ? ogDescMatch[1].trim() : null,
-                        image: ogImageMatch ? ogImageMatch[1].trim() : null,
-                    },
-                    headings: {
-                        h1Count: h1s.length,
-                        h1Texts: h1s.slice(0, 5),
-                        h2Count: h2s.length,
-                        h2Texts: h2s.slice(0, 10),
-                        h3Count: h3s.length,
-                    },
-                    images: {
-                        total: imgTags.length,
-                        withAlt: imgsWithAlt.length,
-                        missingAlt: imgTags.length - imgsWithAlt.length,
-                    },
-                    links: {
-                        internalCount: internalLinks,
-                        externalCount: externalLinks,
-                        discoveredSubdomains: Array.from(subdomains),
-                    },
-                    structuredDataSchemas: jsonLdMatches.length,
-                    wordCount,
-                },
-                aiAndCrawlReadiness: {
-                    hasRobotsTxt,
-                    hasSitemapXml,
-                    hasLlmsTxt,
-                },
-                readiness: {
-                    llmsTxtPresent: hasLlmsTxt,
-                    robotsTxtPresent: hasRobotsTxt,
-                    sitemapXmlPresent: hasSitemapXml,
-                },
-                infrastructure: {
-                    server: serverHeader,
-                    aRecords,
-                    txtRecordsCount: txtRecords.length,
-                },
-                keywordAnalysis,
-                checks: {
-                    passed: passedChecks,
-                    warnings,
-                },
-            };
-        }
-        if (tool.slug === "instant.web.search") {
-            const query = String(input.query || "").trim();
-            const limit = Math.min(10, Math.max(1, Number(input.limit || 5)));
-            if (!query)
-                throw new Error("query is required");
-            const hnUrl = `https://hn.algolia.com/api/v1/search?query=${encodeURIComponent(query)}&hitsPerPage=${limit}`;
-            const wikiUrl = `https://en.wikipedia.org/w/api.php?action=query&list=search&srsearch=${encodeURIComponent(query)}&utf8=&format=json&srlimit=${limit}`;
-            const [hnRes, wikiRes] = await Promise.allSettled([
-                fetch(hnUrl, { signal: AbortSignal.timeout(7000) }).then((r) => r.json()),
-                fetch(wikiUrl, { signal: AbortSignal.timeout(7000) }).then((r) => r.json()),
-            ]);
-            const results = [];
-            if (hnRes.status === "fulfilled" && Array.isArray(hnRes.value?.hits)) {
-                for (const hit of hnRes.value.hits.slice(0, limit)) {
-                    if (hit.title) {
-                        results.push({
-                            title: String(hit.title),
-                            url: String(hit.url || `https://news.ycombinator.com/item?id=${hit.objectID}`),
-                            snippet: `Points: ${hit.points || 0} | Author: ${hit.author || "unknown"} | Comments: ${hit.num_comments || 0}`,
-                            source: "hackernews_algolia",
+            }
+            if (tool.slug === "instant.ai.llms_txt_validator") {
+                const rawDomain = String(input.domain || "")
+                    .trim()
+                    .replace(/^https?:\/\//i, "")
+                    .replace(/\/.*$/, "");
+                if (!rawDomain)
+                    throw new Error("domain is required");
+                const baseUrl = `https://${rawDomain}`;
+                const probes = ["/llms.txt", "/.well-known/mcp.json", "/skill.md", "/robots.txt"];
+                const probeResults = {};
+                await Promise.all(probes.map(async (path) => {
+                    try {
+                        const r = await fetch(`${baseUrl}${path}`, {
+                            signal: AbortSignal.timeout(4500),
                         });
+                        const txt = r.ok ? await r.text() : "";
+                        probeResults[path] = {
+                            present: r.ok && txt.length > 0,
+                            length: txt.length,
+                        };
                     }
-                }
-            }
-            if (wikiRes.status === "fulfilled" &&
-                Array.isArray(wikiRes.value?.query?.search)) {
-                for (const item of wikiRes.value.query.search.slice(0, limit)) {
-                    const cleanSnippet = String(item.snippet || "")
-                        .replace(/<[^>]+>/g, "")
-                        .trim();
-                    results.push({
-                        title: String(item.title),
-                        url: `https://en.wikipedia.org/wiki/${encodeURIComponent(String(item.title).replace(/ /g, "_"))}`,
-                        snippet: cleanSnippet,
-                        source: "wikipedia",
-                    });
-                }
+                    catch {
+                        probeResults[path] = { present: false, length: 0 };
+                    }
+                }));
+                const foundCount = Object.values(probeResults).filter((p) => p.present).length;
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    domain: rawDomain,
+                    aiReadinessScore: Math.round((foundCount / probes.length) * 100),
+                    endpoints: probeResults,
+                };
             }
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                tool: tool.slug,
-                query,
-                results: results.slice(0, limit),
-            };
-        }
-        if (tool.slug === "instant.composio.workbench") {
-            const code = String(input.code_to_execute || input.code || "").trim();
-            if (!code)
-                throw new Error("code_to_execute is required");
-            return {
-                provider: "composio_instant",
-                billingMode: "provider_wallet",
-                tool: tool.slug,
-                sandbox: "isolated_workbench",
-                thought: String(input.thought || "Workbench execution"),
-                codeLength: code.length,
-                executedAt: new Date().toISOString(),
-                output: `Workbench processed ${code.length} chars cleanly.`,
-            };
-        }
-        throw new Error(`Unsupported Instant tool: ${tool.slug}`);
+            throw new Error(`Unsupported Instant tool: ${tool.slug}`);
+        };
+        return finalizeInstantResult(await runNativeEdgeExecutor());
     }
 }