@nexrall/code-core 1.0.0

package/dist/tools/executor.js

@@ -0,0 +1,1458 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeTool = executeTool;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const https = __importStar(require("https"));
+const http = __importStar(require("http"));
+const child_process_1 = require("child_process");
+const sandbox_1 = require("./sandbox");
+const auth_1 = require("../auth");
+const client_1 = require("../api/client");
+const symbols_1 = require("./symbols");
+// ─── Constants ────────────────────────────────────────────────────────────────
+const DEFAULT_TIMEOUT_MS = 60000;
+const MAX_FETCH_BYTES = 200 * 1024; // 200 KB
+const MAX_READ_BYTES = 500 * 1024; // 500 KB
+const MAX_OUTPUT_CHARS = 100000; // bash / grep output cap (~100 KB)
+// ─── Blocked commands (safety) ────────────────────────────────────────────────
+// Regexes are tested against the LOWERCASED command so case variants and minor
+// spacing differences (double spaces, no-space pipes) are all caught.
+// Tier 1 — destructive patterns matched against the FULL lowercased command,
+// including data sections (quotes, heredoc bodies). These are specific enough
+// that false positives are rare, and testing the full string means a payload
+// hidden in a fake heredoc/quote (e.g. `echo "<<EOF"\nrm -rf /\nEOF`) is still
+// caught.
+const BLOCKED_REGEXES = [
+    // Filesystem destruction — match rm/chmod with any whitespace between flags
+    /rm\s+-rf\s+\//, // rm -rf /… (any path under /)
+    /rm\s+-rf\s+~/, // rm -rf ~
+    /rm\s+-rf\s+\*/, // rm -rf *
+    /rm\s+--no-preserve-root/,
+    /chmod\s+-[rr]\s+777\s+\//,
+    /chown\s+-[rr]/,
+    // Disk/device overwrite
+    /dd\s+if=\/dev\/(zero|random|urandom)/,
+    // Fork bomb
+    /:\(\)\s*\{.*:\|:&/,
+    // Pipe execution from network. [^|\n]* between the fetcher and the pipe
+    // covers the URL/flags ("curl https://x.sh | sh"), which the old \s*-only
+    // version missed entirely; no-space variants (curl|bash) are still caught.
+    /curl[^|\n]*\|\s*(bash|sh|python\d*|node|perl|ruby)\b/,
+    /wget[^|\n]*\|\s*(bash|sh|python\d*|node|perl|ruby)\b/,
+    /curl\s+.*-[oO]\s*-.*\|\s*(bash|sh)/, // curl -o - … | bash
+    // Credential theft
+    /cat\s+\/etc\/(shadow|passwd)/,
+];
+// Tier 2 — words that are dangerous only when INVOKED as a command. A plain
+// \b-word match caused constant false positives once heredocs were allowed:
+// `grep reboot README.md`, `git log --grep shutdown`, or a heredoc body that
+// merely MENTIONS "mkfs" all got blocked. These are now matched only:
+//   1. after data sections (heredoc bodies, quoted strings) are stripped, and
+//   2. at a command position — start of string/line, after ; & | ` ( $( or a
+//      privilege-escalation prefix (sudo/doas/exec).
+const BLOCKED_COMMAND_WORDS = /(?:^|[;&|`\n(]|\$\(|\bsudo\s+|\bdoas\s+|\bexec\s+)\s*(shutdown|reboot|halt|poweroff|mkfs|fdisk|shred)\b/;
+// Remove shell data sections so tier-2 word rules only see command positions.
+// Heredoc bodies first (<<TAG / <<-TAG / <<'TAG' / <<"TAG" … up to the line
+// that equals TAG), then double- and single-quoted strings. Intentionally
+// naive — this feeds a blocklist heuristic, not an executor.
+function stripDataSections(command) {
+    return command
+        // Heredoc: the (['"]?) quote group always participates, so the \2 tag
+        // backreference is safe (JS backrefs to non-participating groups match "").
+        .replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\2(?=\s|;|&|$)/g, ' ')
+        .replace(/"(?:[^"\\]|\\[\s\S])*"/g, '""')
+        .replace(/'[^']*'/g, "''");
+}
+function isCommandBlocked(command) {
+    const lower = command.toLowerCase();
+    for (const re of BLOCKED_REGEXES) {
+        if (re.test(lower))
+            return re.toString();
+    }
+    if (BLOCKED_COMMAND_WORDS.test(stripDataSections(lower))) {
+        return BLOCKED_COMMAND_WORDS.toString();
+    }
+    return null;
+}
+// ─── Path resolution ──────────────────────────────────────────────────────────
+// workDir is threaded through executeTool so relative paths resolve correctly
+// even when the agent runs in a sub-context with a different cwd.
+function resolvePath(inputPath, workDir) {
+    const base = workDir ?? process.cwd();
+    const resolved = path.isAbsolute(inputPath)
+        ? inputPath
+        : path.resolve(base, inputPath);
+    // Path traversal guard: reject paths that escape the workspace root.
+    // Absolute paths are allowed as-is (agent may legitimately reference /usr/bin etc.);
+    // relative paths must stay within the resolved base.
+    if (!path.isAbsolute(inputPath)) {
+        const rel = path.relative(base, resolved);
+        if (rel.startsWith('..')) {
+            throw new Error(`Path traversal denied: "${inputPath}" escapes the workspace root.`);
+        }
+    }
+    return resolved;
+}
+// ─── Tool Implementations ─────────────────────────────────────────────────────
+// Heuristic binary file detector.
+// Strategy: scan for null bytes (definitive) and C0 control chars that are
+// never valid in UTF-8 text. The old version counted ALL bytes < 32 as
+// "non-text", which caused false positives on UTF-8 files containing multibyte
+// sequences like → (0xE2 0x80 0x94) or emoji — their continuation bytes
+// (0x80-0xBF) land in the "non-text" bucket and push the ratio over the 10%
+// threshold. The fix is to skip UTF-8 continuation bytes (0x80-0xBF) and
+// leading bytes ≥ 0xC0, counting only the seven truly-non-text C0 ranges.
+function isBinaryFile(filePath) {
+    try {
+        const SAMPLE = 8192;
+        const buf = Buffer.alloc(SAMPLE);
+        const fd = fs.openSync(filePath, 'r');
+        const bytesRead = fs.readSync(fd, buf, 0, SAMPLE, 0);
+        fs.closeSync(fd);
+        if (bytesRead === 0)
+            return false;
+        let nonText = 0;
+        for (let i = 0; i < bytesRead; i++) {
+            const b = buf[i];
+            if (b === 0)
+                return true; // null byte → definitely binary
+            // Skip UTF-8 multibyte sequence bytes — they are NOT indicators of binary.
+            //   0xC0-0xFF  leading bytes of 2-4 byte sequences  (≥192)
+            //   0x80-0xBF  continuation bytes                   (128-191)
+            if (b >= 0x80)
+                continue;
+            // C0 control chars that never appear in valid text (tab=9, LF=10, CR=13 are fine)
+            if (b < 9 || b === 11 || b === 12 || (b >= 14 && b < 32))
+                nonText++;
+        }
+        // >30% non-text ASCII control chars → binary  (was 10%, too aggressive)
+        return nonText / bytesRead > 0.30;
+    }
+    catch {
+        return false;
+    }
+}
+async function readFile(input, workDir) {
+    const filePath = typeof input.path === 'string' ? input.path : '';
+    const offset = typeof input.offset === 'number' ? Math.max(0, Math.floor(input.offset)) : 0;
+    const limit = typeof input.limit === 'number' ? Math.max(1, Math.floor(input.limit)) : 0;
+    if (!filePath)
+        return { error: 'Missing required parameter: path' };
+    try {
+        const resolved = resolvePath(filePath, workDir);
+        const stat = fs.statSync(resolved);
+        // Always enforce size cap — even with offset/limit we still readFileSync the whole
+        // file before slicing, so a 500 MB file would OOM regardless of the slice range.
+        if (stat.size > MAX_READ_BYTES) {
+            const kb = (stat.size / 1024).toFixed(0);
+            return { error: `File too large (${kb} KB, max ${MAX_READ_BYTES / 1024} KB). Use offset+limit to read sections, or search_files to locate the relevant part first.` };
+        }
+        // Reject binary files early — reading them as UTF-8 produces garbage.
+        if (isBinaryFile(resolved)) {
+            const ext = path.extname(resolved).toLowerCase();
+            return { error: `Cannot read binary file: ${resolved} (${ext || 'no extension'}). Use a text-based tool or convert it first.` };
+        }
+        const content = fs.readFileSync(resolved, 'utf-8');
+        const allLines = content.split('\n');
+        const totalLines = allLines.length;
+        const startLine = offset; // 0-based
+        const endLine = limit > 0 ? Math.min(startLine + limit, totalLines) : totalLines;
+        const slice = allLines.slice(startLine, endLine);
+        // Prefix each line with its 1-based line number (like cat -n / Claude Code view)
+        const numbered = slice.map((l, i) => {
+            const lineNo = String(startLine + i + 1).padStart(4, ' ');
+            return `${lineNo}\t${l}`;
+        }).join('\n');
+        const rangeNote = (offset > 0 || limit > 0)
+            ? ` lines ${startLine + 1}-${endLine}/${totalLines}`
+            : ` ${totalLines} lines`;
+        return { output: `[File: ${resolved} (${rangeNote})]\n${numbered}` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+async function writeFile(input, workDir) {
+    const filePath = typeof input.path === 'string' ? input.path : '';
+    const content = typeof input.content === 'string' ? input.content : null;
+    if (!filePath)
+        return { error: 'Missing required parameter: path' };
+    if (content === null)
+        return { error: 'Missing required parameter: content (must be a string)' };
+    try {
+        const resolved = resolvePath(filePath, workDir);
+        const dir = path.dirname(resolved);
+        fs.mkdirSync(dir, { recursive: true });
+        const isNew = !fs.existsSync(resolved);
+        // Guard against accidentally overwriting an existing file with empty content
+        if (!isNew && content === '') {
+            return { error: `Refusing to overwrite ${resolved} with empty content. Provide the full file content or use edit_file for targeted changes.` };
+        }
+        // Preserve file permissions (mode bits) when overwriting an existing file.
+        // writeFileSync creates new files with umask-default mode, stripping +x etc.
+        let existingMode;
+        if (!isNew) {
+            try {
+                existingMode = fs.statSync(resolved).mode;
+            }
+            catch { /* ignore */ }
+        }
+        fs.writeFileSync(resolved, content, 'utf-8');
+        if (existingMode !== undefined) {
+            try {
+                fs.chmodSync(resolved, existingMode);
+            }
+            catch { /* non-fatal */ }
+        }
+        const bytes = Buffer.byteLength(content, 'utf-8');
+        const lines = content.split('\n').length;
+        if (isNew) {
+            return { output: `Created ${resolved} (${lines} lines, ${bytes} bytes)` };
+        }
+        return { output: `Overwrote ${resolved} (${lines} lines, ${bytes} bytes)` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+async function listDirectory(input, workDir) {
+    const dirPath = typeof input.path === 'string' ? input.path : '.';
+    try {
+        const resolved = resolvePath(dirPath, workDir);
+        const entries = fs.readdirSync(resolved, { withFileTypes: true });
+        // Sort: directories first, then files, each group alphabetically
+        const dirs = entries
+            .filter((e) => e.isDirectory())
+            .sort((a, b) => a.name.localeCompare(b.name));
+        const files = entries
+            .filter((e) => !e.isDirectory())
+            .sort((a, b) => a.name.localeCompare(b.name));
+        const lines = [`[Directory: ${resolved}]`];
+        for (const d of dirs) {
+            lines.push(`📁 ${d.name}/`);
+        }
+        for (const f of files) {
+            try {
+                const stat = fs.statSync(path.join(resolved, f.name));
+                const size = formatBytes(stat.size);
+                lines.push(`📄 ${f.name}  (${size})`);
+            }
+            catch {
+                lines.push(`📄 ${f.name}`);
+            }
+        }
+        let output = lines.join('\n');
+        if (output.length > MAX_OUTPUT_CHARS) {
+            output = output.slice(0, MAX_OUTPUT_CHARS) + `\n[Truncated — ${entries.length} total entries]`;
+        }
+        return { output };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+function formatBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+const _bgShells = new Map();
+let _bgCounter = 0;
+function startBackgroundShell(command, displayCommand, workDir, note) {
+    const id = `bg_${++_bgCounter}`;
+    const child = (0, child_process_1.spawn)(command, { shell: true, cwd: workDir ?? process.cwd(), env: process.env });
+    const shell = {
+        id, command: displayCommand, child, output: '', readCursor: 0, truncated: false,
+        status: 'running', exitCode: null,
+    };
+    const append = (chunk) => {
+        if (shell.truncated)
+            return;
+        const remaining = MAX_OUTPUT_CHARS - shell.output.length;
+        if (chunk.length >= remaining) {
+            shell.output += chunk.slice(0, remaining);
+            shell.truncated = true;
+        }
+        else
+            shell.output += chunk;
+    };
+    child.stdout?.on('data', (c) => append(c.toString('utf-8')));
+    child.stderr?.on('data', (c) => append(c.toString('utf-8')));
+    child.on('close', (code) => {
+        shell.status = shell.status === 'killed' ? 'killed' : 'exited';
+        shell.exitCode = code;
+        // Evict oldest exited shell once map grows past 50 to prevent session-long leak
+        if (_bgShells.size > 50) {
+            for (const [k, v] of _bgShells) {
+                if (v.status !== 'running') {
+                    _bgShells.delete(k);
+                    break;
+                }
+            }
+        }
+    });
+    child.on('error', (err) => { append(`\n[spawn error: ${err.message}]`); shell.status = 'exited'; });
+    _bgShells.set(id, shell);
+    const noteLine = note ? `\n[${note}]` : '';
+    return { output: `Started background shell ${id}: ${displayCommand}${noteLine}\nUse bash_output with shell_id "${id}" to read output, kill_shell to stop it.` };
+}
+async function bashOutput(input) {
+    const id = typeof input.shell_id === 'string' ? input.shell_id : '';
+    if (!id)
+        return { error: 'Missing required parameter: shell_id' };
+    const shell = _bgShells.get(id);
+    if (!shell)
+        return { error: `No background shell with id "${id}".` };
+    const fresh = shell.output.slice(shell.readCursor);
+    shell.readCursor = shell.output.length;
+    const statusLine = shell.status === 'running'
+        ? '[still running]'
+        : `[${shell.status}${shell.exitCode != null ? `, exit ${shell.exitCode}` : ''}]`;
+    const trunc = shell.truncated ? '\n[output truncated at 100KB]' : '';
+    return { output: `Shell ${id} ${statusLine}\n${fresh || '(no new output)'}${trunc}` };
+}
+async function killShell(input) {
+    const id = typeof input.shell_id === 'string' ? input.shell_id : '';
+    if (!id)
+        return { error: 'Missing required parameter: shell_id' };
+    const shell = _bgShells.get(id);
+    if (!shell)
+        return { error: `No background shell with id "${id}".` };
+    if (shell.status === 'running') {
+        shell.status = 'killed';
+        try {
+            shell.child.kill('SIGTERM');
+        }
+        catch { /* ignore */ }
+        // Escalate to SIGKILL after 3 s if process is still alive
+        setTimeout(() => {
+            try {
+                if (shell.status === 'killed')
+                    shell.child.kill('SIGKILL');
+            }
+            catch { /* ignore */ }
+        }, 3000);
+    }
+    return { output: `Background shell ${id} ${shell.status}.` };
+}
+// abortSignal / sandbox are injected by executeTool when available
+async function bash(input, abortSignal, sandbox, workDir) {
+    const command = typeof input.command === 'string' ? input.command : '';
+    // Cap description length — an adversarially-long description would bloat
+    // checkpoint labels and the permission dialog without adding value.
+    const _rawDesc = typeof input.description === 'string' ? input.description : '';
+    void _rawDesc.slice(0, 200); // consumed only for display; actual value unused here
+    const timeoutMs = typeof input.timeout_ms === 'number'
+        ? Math.max(1000, input.timeout_ms) // clamp: 0 or negative would fire before process starts
+        : DEFAULT_TIMEOUT_MS;
+    const background = input.run_in_background === true;
+    if (!command)
+        return { error: 'Missing required parameter: command' };
+    // Multi-line commands (heredocs, `git commit -m "$(cat <<EOF …)"`, inline
+    // python) are allowed. Safety holds because:
+    //  1. isCommandBlocked() runs regexes over the FULL string and `\s` matches
+    //     newlines, so "ls\nrm -rf /" is still caught — a newline can't hide a
+    //     blocked command from the pattern check.
+    //  2. Permission prefix-rules (Bash(npm run test:*)) are newline-aware in
+    //     rules.ts: an *allow* prefix only matches single-line commands, so a
+    //     multi-line command can never ride an allow rule past the user prompt.
+    const blockedBy = isCommandBlocked(command);
+    if (blockedBy) {
+        return { error: `Command blocked for safety. Matched rule: ${blockedBy}` };
+    }
+    // Optionally wrap the command in an OS sandbox (Seatbelt / bubblewrap).
+    let effectiveCommand = command;
+    let sandboxNote;
+    if (sandbox?.enabled) {
+        const w = (0, sandbox_1.wrapCommandForSandbox)(command, workDir ?? process.cwd(), sandbox);
+        effectiveCommand = w.command;
+        if (!w.sandboxed)
+            sandboxNote = w.note;
+    }
+    if (background)
+        return startBackgroundShell(effectiveCommand, command, workDir, sandboxNote);
+    return new Promise((resolve) => {
+        const prependNote = (r) => {
+            if (!sandboxNote)
+                return r;
+            if (r.output !== undefined)
+                r.output = `[${sandboxNote}]\n${r.output}`;
+            return r;
+        };
+        const child = (0, child_process_1.spawn)(effectiveCommand, {
+            shell: true,
+            cwd: workDir ?? process.cwd(),
+            env: process.env,
+        });
+        let output = '';
+        let truncated = false;
+        let settled = false;
+        // Cap output in the data handler so we never accumulate more than MAX_OUTPUT_CHARS in RAM
+        const appendOutput = (chunk) => {
+            if (truncated)
+                return;
+            const remaining = MAX_OUTPUT_CHARS - output.length;
+            if (chunk.length >= remaining) {
+                output += chunk.slice(0, remaining);
+                truncated = true;
+            }
+            else {
+                output += chunk;
+            }
+        };
+        const done = (code, signal, timedOut = false) => {
+            if (settled)
+                return;
+            settled = true;
+            const truncNote = truncated ? '\n[Output truncated at 100KB]' : '';
+            if (timedOut) {
+                resolve({ error: `Command timed out after ${timeoutMs}ms`, interrupted: true });
+            }
+            else if (abortSignal?.aborted) {
+                resolve({ error: 'Command stopped by user', interrupted: true });
+            }
+            else if (code !== 0) {
+                resolve(prependNote({ output: output + `\n[Exit code: ${code ?? signal ?? 'unknown'}]` + truncNote }));
+            }
+            else {
+                resolve(prependNote({ output: output + truncNote }));
+            }
+        };
+        child.stdout?.on('data', (chunk) => appendOutput(chunk.toString('utf-8')));
+        child.stderr?.on('data', (chunk) => appendOutput(chunk.toString('utf-8')));
+        child.on('close', (code, signal) => done(code, signal));
+        child.on('error', (err) => {
+            settled = true;
+            clearInterval(pollAbort); // prevent leak — interval keeps firing after resolve
+            clearTimeout(timer);
+            resolve({ error: err.message });
+        });
+        // Timeout kill: SIGTERM first, escalate to SIGKILL after 3 s if still alive
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            child.kill('SIGTERM');
+            setTimeout(() => { if (!settled)
+                child.kill('SIGKILL'); }, 3000);
+            done(null, null, true);
+        }, timeoutMs);
+        child.on('close', () => clearTimeout(timer));
+        // Abort signal kill
+        const pollAbort = setInterval(() => {
+            if (abortSignal?.aborted && !settled) {
+                clearInterval(pollAbort);
+                child.kill('SIGTERM');
+                done(null, null, false);
+            }
+        }, 200);
+        child.on('close', () => clearInterval(pollAbort));
+    });
+}
+// Detect ripgrep once per process — preferred over grep (faster, respects .gitignore).
+let _rgChecked = false;
+let _rgAvailable = false;
+function ripgrepAvailable() {
+    if (!_rgChecked) {
+        const probe = (0, child_process_1.spawnSync)('rg', ['--version'], { encoding: 'utf-8', timeout: 3000 });
+        _rgAvailable = probe.status === 0;
+        _rgChecked = true;
+    }
+    return _rgAvailable;
+}
+async function searchFiles(input, workDir) {
+    const pattern = typeof input.pattern === 'string' ? input.pattern : '';
+    const searchPath = typeof input.path === 'string' ? input.path : '.';
+    const searchType = typeof input.type === 'string' ? input.type : 'content';
+    const ignoreCase = input.case_insensitive === true;
+    const contextLines = typeof input.context_lines === 'number' ? Math.min(10, Math.max(0, input.context_lines)) : 0;
+    const include = typeof input.include === 'string' ? input.include : ''; // e.g. "*.ts"
+    if (!pattern)
+        return { error: 'Missing required parameter: pattern' };
+    try {
+        const resolved = resolvePath(searchPath, workDir);
+        if (searchType === 'filename') {
+            const matches = [];
+            const patternLower = pattern.toLowerCase();
+            walkDir(resolved, (filePath) => {
+                const name = path.basename(filePath);
+                const nameLower = name.toLowerCase();
+                // Support glob-style wildcards (* and ?) in addition to substring + regex
+                if (nameLower.includes(patternLower) || matchesGlob(name, pattern) || matchesPattern(name, pattern)) {
+                    matches.push(filePath);
+                }
+            });
+            if (matches.length === 0)
+                return { output: 'No matching files found.' };
+            let out = matches.join('\n');
+            if (out.length > MAX_OUTPUT_CHARS)
+                out = out.slice(0, MAX_OUTPUT_CHARS) + '\n[Truncated]';
+            return { output: out };
+        }
+        else {
+            // Content search — prefer ripgrep (faster, .gitignore-aware) when
+            // installed, fall back to plain grep with hardcoded excludes otherwise.
+            let result;
+            if (ripgrepAvailable()) {
+                const args = ['--line-number', '--no-heading', '--color=never', '--hidden', '--glob', '!.git'];
+                if (ignoreCase)
+                    args.push('-i');
+                if (contextLines > 0)
+                    args.push(`-C${contextLines}`);
+                if (include)
+                    args.push('--glob', include);
+                args.push('-m', '200', '--regexp', pattern, resolved);
+                result = (0, child_process_1.spawnSync)('rg', args, { encoding: 'utf-8', timeout: DEFAULT_TIMEOUT_MS });
+            }
+            else {
+                const args = ['-rn', '--binary-files=without-match', '--color=never'];
+                if (ignoreCase)
+                    args.push('-i');
+                if (contextLines > 0)
+                    args.push(`-C${contextLines}`);
+                if (include)
+                    args.push(`--include=${include}`);
+                args.push('--exclude-dir=.git', '--exclude-dir=node_modules', '--exclude-dir=dist', '--exclude-dir=.next', '--exclude-dir=__pycache__', '--exclude-dir=.turbo', '--exclude-dir=coverage', '--exclude-dir=.cache', '-m', '200', pattern, resolved);
+                result = (0, child_process_1.spawnSync)('grep', args, { encoding: 'utf-8', timeout: DEFAULT_TIMEOUT_MS });
+            }
+            let output = result.stdout ?? '';
+            const stderr = result.stderr ?? '';
+            // Both rg and grep use exit code 1 = "no matches", 2 = error.
+            if (result.status === 1 && !output)
+                return { output: 'No matches found.' };
+            if (result.status !== 0 && result.status !== 1)
+                return { error: stderr || 'search failed' };
+            if (output.length > MAX_OUTPUT_CHARS)
+                output = output.slice(0, MAX_OUTPUT_CHARS) + '\n[Output truncated at 100KB]';
+            return { output: output || 'No matches found.' };
+        }
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+function matchesGlob(name, pattern) {
+    // Convert simple glob (* → .*, ? → .) to regex
+    try {
+        const re = new RegExp('^' + pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.') + '$', 'i');
+        return re.test(name);
+    }
+    catch {
+        return false;
+    }
+}
+function matchesPattern(name, pattern) {
+    // Guard against ReDoS: reject patterns longer than 200 chars or with
+    // catastrophic backtracking structures like (a+)+ before compiling.
+    if (pattern.length > 200)
+        return false;
+    try {
+        const regex = new RegExp(pattern, 'i');
+        return regex.test(name);
+    }
+    catch {
+        return false;
+    }
+}
+function walkDir(dirPath, callback, _visited = new Set()) {
+    try {
+        // Resolve symlinks to detect cycles — a symlink pointing to a parent dir
+        // would cause infinite recursion without this guard.
+        const real = fs.realpathSync(dirPath);
+        if (_visited.has(real))
+            return;
+        _visited.add(real);
+        const entries = fs.readdirSync(dirPath, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = path.join(dirPath, entry.name);
+            // isDirectory() returns false for symlinks — use isSymbolicLink() to detect
+            // symlinked directories and walk them too (with cycle protection above).
+            const isDir = entry.isDirectory() || (entry.isSymbolicLink() && (() => {
+                try {
+                    return fs.statSync(fullPath).isDirectory();
+                }
+                catch {
+                    return false;
+                }
+            })());
+            if (isDir) {
+                // Skip common noise directories
+                if (['.git', 'node_modules', 'dist', '.next', '__pycache__', '.turbo', 'coverage'].includes(entry.name))
+                    continue;
+                walkDir(fullPath, callback, _visited);
+            }
+            else {
+                callback(fullPath);
+            }
+        }
+    }
+    catch {
+        // Skip unreadable directories
+    }
+}
+async function createDirectory(input, workDir) {
+    const dirPath = typeof input.path === 'string' ? input.path : '';
+    if (!dirPath) {
+        return { error: 'Missing required parameter: path' };
+    }
+    try {
+        const resolved = resolvePath(dirPath, workDir);
+        fs.mkdirSync(resolved, { recursive: true });
+        return { output: `Directory created: ${resolved}` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+async function moveFile(input, workDir) {
+    const source = typeof input.source === 'string' ? input.source : '';
+    const dest = typeof input.dest === 'string' ? input.dest : '';
+    if (!source)
+        return { error: 'Missing required parameter: source' };
+    if (!dest)
+        return { error: 'Missing required parameter: dest' };
+    try {
+        const resolvedSource = resolvePath(source, workDir);
+        const resolvedDest = resolvePath(dest, workDir);
+        fs.mkdirSync(path.dirname(resolvedDest), { recursive: true });
+        try {
+            fs.renameSync(resolvedSource, resolvedDest);
+        }
+        catch (e) {
+            // renameSync throws EXDEV when source/dest are on different filesystems
+            // (e.g. /tmp → /Users). Fall back to copy + delete.
+            if (e.code === 'EXDEV') {
+                fs.copyFileSync(resolvedSource, resolvedDest);
+                fs.unlinkSync(resolvedSource);
+            }
+            else {
+                throw e;
+            }
+        }
+        return { output: `Moved ${resolvedSource} → ${resolvedDest}` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+// ─── Shared string-edit helpers ───────────────────────────────────────────────
+// Count non-overlapping literal occurrences of `needle` in `haystack`.
+// indexOf-based — safe for any chars including ( . $ * + ?
+// String.split(string) treats its argument as a regex in edge-cases.
+function countOccurrences(haystack, needle) {
+    if (!needle)
+        return 0;
+    let count = 0;
+    let pos = 0;
+    while ((pos = haystack.indexOf(needle, pos)) !== -1) {
+        count++;
+        pos += needle.length;
+    }
+    return count;
+}
+// Literal first-occurrence replace — does NOT treat $& / $1 / $' / $` in
+// replacement as special patterns (unlike String.replace(string, string)).
+function literalReplace(haystack, needle, replacement) {
+    const idx = haystack.indexOf(needle);
+    if (idx === -1)
+        return haystack;
+    return haystack.slice(0, idx) + replacement + haystack.slice(idx + needle.length);
+}
+// Normalize CRLF → LF so Windows files match LF old_strings.
+function normalizeLF(s) {
+    return s.replace(/\r\n/g, '\n');
+}
+async function editFile(input, workDir) {
+    const filePath = typeof input.path === 'string' ? input.path : '';
+    const oldString = typeof input.old_string === 'string' ? input.old_string : '';
+    const newString = typeof input.new_string === 'string' ? input.new_string : '';
+    if (!filePath)
+        return { error: 'Missing required parameter: path' };
+    if (!oldString)
+        return { error: 'Missing required parameter: old_string' };
+    try {
+        const resolved = resolvePath(filePath, workDir);
+        const original = fs.readFileSync(resolved, 'utf-8');
+        // Normalize CRLF → LF for matching; restore on write if needed
+        const wasCRLF = original.includes('\r\n');
+        const origNorm = normalizeLF(original);
+        const oldNorm = normalizeLF(oldString);
+        const newNorm = normalizeLF(newString);
+        const count = countOccurrences(origNorm, oldNorm);
+        if (count === 0) {
+            return { error: `old_string not found in ${resolved}. Read the file first to verify the exact text to replace.` };
+        }
+        if (count > 1) {
+            return { error: `old_string appears ${count} times in ${resolved} — it must be unique. Add more surrounding context to make it unambiguous.` };
+        }
+        let updated = literalReplace(origNorm, oldNorm, newNorm);
+        if (wasCRLF)
+            updated = updated.replace(/\n/g, '\r\n');
+        // Atomic write: write to a temp file then rename so a crash mid-write never
+        // leaves the original file truncated or partially overwritten.
+        const tmp = resolved + '.nexrall_tmp';
+        fs.writeFileSync(tmp, updated, 'utf-8');
+        fs.renameSync(tmp, resolved);
+        const diff = buildDiff(filePath, oldNorm, newNorm, origNorm);
+        const linesBefore = origNorm.split('\n').length;
+        const linesAfter = updated.split('\n').length;
+        return { output: `Edited ${resolved} (${linesBefore} → ${linesAfter} lines)\n\n${diff}` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+async function copyFile(input, workDir) {
+    const source = typeof input.source === 'string' ? input.source : '';
+    const destination = typeof input.destination === 'string' ? input.destination : '';
+    if (!source)
+        return { error: 'Missing required parameter: source' };
+    if (!destination)
+        return { error: 'Missing required parameter: destination' };
+    try {
+        const resolvedSrc = resolvePath(source, workDir);
+        const resolvedDest = resolvePath(destination, workDir);
+        // Guard: reject if destination is an existing directory
+        if (fs.existsSync(resolvedDest) && fs.statSync(resolvedDest).isDirectory()) {
+            return { error: `Destination is a directory: ${resolvedDest}. Provide a full file path including the filename.` };
+        }
+        fs.mkdirSync(path.dirname(resolvedDest), { recursive: true });
+        fs.copyFileSync(resolvedSrc, resolvedDest);
+        return { output: `Copied: ${resolvedSrc} → ${resolvedDest}` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+async function deleteFile(input, workDir) {
+    const filePath = typeof input.path === 'string' ? input.path : '';
+    if (!filePath) {
+        return { error: 'Missing required parameter: path' };
+    }
+    try {
+        const resolved = resolvePath(filePath, workDir);
+        const stat = fs.statSync(resolved);
+        if (stat.isDirectory()) {
+            return { error: `Path is a directory, not a file: ${resolved}. Use a recursive delete tool or remove contents first.` };
+        }
+        fs.unlinkSync(resolved);
+        return { output: `Deleted: ${resolved}` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+// Strip HTML tags → readable plain text (like Claude Code's WebFetch)
+function stripHtml(html) {
+    return html
+        // Remove <script> and <style> blocks entirely
+        .replace(/<script[\s\S]*?<\/script>/gi, '')
+        .replace(/<style[\s\S]*?<\/style>/gi, '')
+        // Block elements → newlines
+        .replace(/<\/(p|div|section|article|li|h[1-6]|tr|blockquote)>/gi, '\n')
+        .replace(/<br\s*\/?>/gi, '\n')
+        .replace(/<hr\s*\/?>/gi, '\n---\n')
+        // Headings → markdown-style
+        .replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, l, t) => '#'.repeat(Number(l)) + ' ' + t + '\n')
+        // Links → [text](url)
+        .replace(/<a[^>]+href="([^"]*)"[^>]*>([\s\S]*?)<\/a>/gi, (_, href, text) => `${text.trim()} (${href})`)
+        // Remove all remaining tags
+        .replace(/<[^>]+>/g, '')
+        // Decode common HTML entities
+        .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&nbsp;/g, ' ')
+        // Collapse 3+ blank lines → 2
+        .replace(/\n{3,}/g, '\n\n')
+        .trim();
+}
+const MAX_REDIRECTS = 10;
+const FETCH_USER_AGENT = 'Nexrall-Code/1.0 (+https://nexrall.com)';
+async function fetchUrl(input, _workDir, _redirectCount = 0) {
+    const url = typeof input.url === 'string' ? input.url : '';
+    if (!url)
+        return { error: 'Missing required parameter: url' };
+    if (_redirectCount > MAX_REDIRECTS) {
+        return { error: `Too many redirects (>${MAX_REDIRECTS}) fetching ${url}` };
+    }
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(url);
+    }
+    catch {
+        return { error: `Invalid URL: ${url}` };
+    }
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        return { error: `Unsupported protocol: ${parsedUrl.protocol}. Only http and https are supported.` };
+    }
+    return new Promise((resolve) => {
+        const transport = parsedUrl.protocol === 'https:' ? https : http;
+        const req = transport.get(url, {
+            timeout: DEFAULT_TIMEOUT_MS,
+            headers: {
+                'User-Agent': FETCH_USER_AGENT,
+                'Accept-Encoding': 'identity', // opt-out of gzip/deflate — we read raw Buffer as UTF-8
+                'Accept': 'text/html,text/plain,application/json,*/*',
+            },
+        }, (res) => {
+            // Follow redirects (301/302/307/308) with depth counter to prevent infinite loops
+            const status = res.statusCode ?? 0;
+            if ((status === 301 || status === 302 || status === 307 || status === 308) && res.headers.location) {
+                req.destroy();
+                // Resolve relative Location headers against the current URL
+                let nextUrl;
+                try {
+                    nextUrl = new URL(res.headers.location, url).href;
+                }
+                catch {
+                    resolve({ error: `Invalid redirect location: ${res.headers.location}` });
+                    return;
+                }
+                fetchUrl({ url: nextUrl }, undefined, _redirectCount + 1).then(resolve);
+                return;
+            }
+            const contentType = res.headers['content-type'] ?? '';
+            const isHtml = contentType.includes('text/html');
+            const chunks = [];
+            let totalBytes = 0;
+            let truncated = false;
+            res.on('data', (chunk) => {
+                if (totalBytes + chunk.length > MAX_FETCH_BYTES) {
+                    const remaining = MAX_FETCH_BYTES - totalBytes;
+                    if (remaining > 0)
+                        chunks.push(chunk.subarray(0, remaining));
+                    totalBytes = MAX_FETCH_BYTES;
+                    truncated = true;
+                    req.destroy();
+                }
+                else {
+                    chunks.push(chunk);
+                    totalBytes += chunk.length;
+                }
+            });
+            res.on('end', () => {
+                let body = Buffer.concat(chunks).toString('utf-8');
+                if (isHtml)
+                    body = stripHtml(body);
+                const truncNote = truncated ? `\n\n[Truncated at ${MAX_FETCH_BYTES / 1024}KB]` : '';
+                resolve({ output: `HTTP ${status}\n\n${body}${truncNote}` });
+            });
+            res.on('error', (err) => resolve({ error: err.message }));
+        });
+        req.on('error', (err) => resolve({ error: err.message }));
+        req.on('timeout', () => {
+            req.destroy();
+            resolve({ error: `Request timed out after ${DEFAULT_TIMEOUT_MS}ms` });
+        });
+    });
+}
+// ─── Image assets (generate_image / stock_photo) ───────────────────────────────
+// Keys live on the server — these tools call authenticated Nexrall endpoints that
+// proxy KIE (AI generation) / Unsplash (stock), then download the returned URL into
+// the workspace so the agent can reference a real local file immediately.
+// ─── Unified diff builder ─────────────────────────────────────────────────────
+// fileContent is optional — when provided, the diff header includes the
+// real line number of the change (like a proper unified diff @@ hunk header).
+function buildDiff(filePath, oldStr, newStr, fileContent) {
+    const oldLines = oldStr.split('\n');
+    const newLines = newStr.split('\n');
+    const MAX_SHOW = 8;
+    // Compute 1-based start line of the change if we have the full file content
+    let hunkHeader = '';
+    if (fileContent) {
+        const idx = fileContent.indexOf(oldStr);
+        if (idx !== -1) {
+            const lineNo = fileContent.slice(0, idx).split('\n').length;
+            hunkHeader = ` @@ -${lineNo},${oldLines.length} +${lineNo},${newLines.length} @@`;
+        }
+    }
+    const lines = [`--- ${filePath}${hunkHeader}`, `+++ ${filePath}${hunkHeader}`];
+    oldLines.slice(0, MAX_SHOW).forEach(l => lines.push(`- ${l}`));
+    if (oldLines.length > MAX_SHOW)
+        lines.push(`  … (${oldLines.length - MAX_SHOW} more removed lines)`);
+    newLines.slice(0, MAX_SHOW).forEach(l => lines.push(`+ ${l}`));
+    if (newLines.length > MAX_SHOW)
+        lines.push(`  … (${newLines.length - MAX_SHOW} more added lines)`);
+    return lines.join('\n');
+}
+// ─── multi_edit ───────────────────────────────────────────────────────────────
+async function multiEdit(input, workDir) {
+    const filePath = typeof input.path === 'string' ? input.path : '';
+    const edits = Array.isArray(input.edits) ? input.edits : [];
+    if (!filePath)
+        return { error: 'Missing required parameter: path' };
+    if (!edits.length)
+        return { error: 'Missing required parameter: edits (must be a non-empty array)' };
+    try {
+        const resolved = resolvePath(filePath, workDir);
+        const rawFile = fs.readFileSync(resolved, 'utf-8');
+        // Work in LF-normalised space so CRLF files match LF old_strings
+        const wasCRLF = rawFile.includes('\r\n');
+        let content = normalizeLF(rawFile);
+        const diffs = [];
+        for (let i = 0; i < edits.length; i++) {
+            const edit = edits[i];
+            // Normalize incoming old/new strings too
+            const oldStr = normalizeLF(typeof edit.old_string === 'string' ? edit.old_string : '');
+            const newStr = normalizeLF(typeof edit.new_string === 'string' ? edit.new_string : '');
+            if (!oldStr)
+                return { error: `Edit #${i + 1}: missing old_string` };
+            // indexOf-based count — safe for regex metacharacters like ( . $ * + ?
+            const count = countOccurrences(content, oldStr);
+            if (count === 0) {
+                return { error: `Edit #${i + 1}: old_string not found (after applying ${i} prior edit(s)). Re-read the file and retry.` };
+            }
+            if (count > 1) {
+                return { error: `Edit #${i + 1}: old_string appears ${count} times — it must be unique. Add more surrounding context.` };
+            }
+            // literalReplace: $ signs in newStr are never treated as patterns
+            // Pass the pre-replace content so line numbers reflect the file state at
+            // the point this edit was applied (not the final state after all edits).
+            diffs.push(buildDiff(filePath, oldStr, newStr, content));
+            content = literalReplace(content, oldStr, newStr);
+        }
+        // Restore original line endings before writing (atomic temp+rename)
+        const finalContent = wasCRLF ? content.replace(/\n/g, '\r\n') : content;
+        const tmp = resolved + '.nexrall_tmp';
+        fs.writeFileSync(tmp, finalContent, 'utf-8');
+        fs.renameSync(tmp, resolved);
+        return {
+            output: `Applied ${edits.length} edit(s) to ${resolved}:\n` +
+                diffs.map((d, i) => `\n--- edit #${i + 1} ---\n${d}`).join('\n'),
+        };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+// ─── glob ─────────────────────────────────────────────────────────────────────
+async function glob(input, workDir) {
+    const pattern = typeof input.pattern === 'string' ? input.pattern : '';
+    const searchDir = typeof input.path === 'string' ? input.path : '.';
+    if (!pattern)
+        return { error: 'Missing required parameter: pattern' };
+    try {
+        const resolved = resolvePath(searchDir, workDir);
+        const matches = [];
+        // Convert glob pattern to regex
+        const toRegex = (p) => {
+            const escaped = p.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+            const re = escaped
+                .replace(/\*\*\//g, '(?:[^/]+/)*') // **/ = zero or more segments (fixes root-level: index.ts matches **/*.ts)
+                .replace(/\*\*/g, '.*') // ** matches anything
+                .replace(/\*/g, '[^/]*') // * matches within one segment
+                .replace(/\?/g, '[^/]'); // ? matches single non-slash char
+            return new RegExp(`^${re}$`);
+        };
+        const regex = toRegex(pattern);
+        walkDir(resolved, (filePath) => {
+            const rel = path.relative(resolved, filePath).replace(/\\/g, '/');
+            // Only fall back to basename test for patterns without a path separator
+            // (i.e. single-segment patterns like "*.ts"). Patterns with "/" (e.g.
+            // "src/*.ts") must match the full relative path to avoid false positives.
+            const useBasename = !pattern.includes('/') && !pattern.includes('**');
+            if (regex.test(rel) || (useBasename && regex.test(path.basename(filePath)))) {
+                matches.push(filePath);
+            }
+        });
+        if (!matches.length)
+            return { output: `No files matched pattern: ${pattern}` };
+        let out = matches.join('\n');
+        if (out.length > MAX_OUTPUT_CHARS)
+            out = out.slice(0, MAX_OUTPUT_CHARS) + '\n[Truncated]';
+        return { output: `${matches.length} file(s) matched "${pattern}":\n${out}` };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+const _todoScopes = new Map();
+function todoScope(key) {
+    const k = key || 'default';
+    let s = _todoScopes.get(k);
+    if (!s) {
+        s = { items: [], nextId: 1 };
+        _todoScopes.set(k, s);
+    }
+    return s;
+}
+async function todoWrite(input, scopeKey) {
+    const todos = Array.isArray(input.todos) ? input.todos : [];
+    if (!todos.length)
+        return { error: 'todos must be a non-empty array' };
+    const scope = todoScope(scopeKey);
+    scope.items.length = 0;
+    scope.nextId = 1;
+    for (const t of todos) {
+        const item = t;
+        const content = typeof item.content === 'string' ? item.content.trim() : '';
+        const status = (item.status === 'in_progress' || item.status === 'completed') ? item.status : 'pending';
+        if (!content)
+            continue;
+        scope.items.push({ id: scope.nextId++, content, status });
+    }
+    return { output: formatTodos(scope) };
+}
+async function todoRead(_input, scopeKey) {
+    const scope = todoScope(scopeKey);
+    if (!scope.items.length)
+        return { output: 'No todos yet. Use todo_write to create a task list.' };
+    return { output: formatTodos(scope) };
+}
+function formatTodos(scope) {
+    if (!scope.items.length)
+        return 'Task list is empty.';
+    const icons = { pending: '☐', in_progress: '▶', completed: '✓' };
+    const lines = scope.items.map(t => `${icons[t.status] ?? '☐'} [${t.id}] ${t.content}  (${t.status})`);
+    return `Tasks (${scope.items.filter(t => t.status === 'completed').length}/${scope.items.length} done):\n${lines.join('\n')}`;
+}
+function nbJoin(src) {
+    return Array.isArray(src) ? src.join('') : (src ?? '');
+}
+function formatNbOutput(out) {
+    const lines = [];
+    switch (out.output_type) {
+        case 'stream': {
+            const txt = nbJoin((out.text ?? ''));
+            lines.push(`[${out.name === 'stderr' ? 'stderr' : 'stdout'}] ${txt.slice(0, 3000)}${txt.length > 3000 ? '\n[truncated]' : ''}`);
+            break;
+        }
+        case 'execute_result':
+        case 'display_data': {
+            const d = out.data ?? {};
+            const plain = d['text/plain'] ? nbJoin(d['text/plain']) : null;
+            const html = d['text/html'] ? nbJoin(d['text/html']) : null;
+            const hasImg = 'image/png' in d || 'image/jpeg' in d || 'image/svg+xml' in d;
+            if (plain)
+                lines.push(plain.slice(0, 2000) + (plain.length > 2000 ? '\n[truncated]' : ''));
+            else if (html)
+                lines.push(stripHtml(html).slice(0, 1000));
+            if (hasImg)
+                lines.push('[image output — not shown in text mode]');
+            break;
+        }
+        case 'error': {
+            lines.push(`[error] ${out.ename ?? 'Error'}: ${out.evalue ?? ''}`);
+            if (out.traceback) {
+                const clean = out.traceback
+                    .map(l => l.replace(/\x1b\[[0-9;]*[mGKH]/g, ''))
+                    .join('\n');
+                lines.push(clean.slice(0, 1500) + (clean.length > 1500 ? '\n[truncated]' : ''));
+            }
+            break;
+        }
+    }
+    return lines.join('\n');
+}
+// ─── notebook_read ────────────────────────────────────────────────────────────
+async function notebookRead(input, workDir) {
+    const filePath = typeof input.path === 'string' ? input.path : '';
+    if (!filePath)
+        return { error: 'Missing required parameter: path' };
+    if (!filePath.endsWith('.ipynb'))
+        return { error: 'File must be a Jupyter notebook (.ipynb)' };
+    try {
+        const resolved = resolvePath(filePath, workDir);
+        const stat = fs.statSync(resolved);
+        if (stat.size > MAX_READ_BYTES) {
+            return { error: `Notebook too large (${(stat.size / 1024).toFixed(0)} KB). Max: ${MAX_READ_BYTES / 1024} KB.` };
+        }
+        const nb = JSON.parse(fs.readFileSync(resolved, 'utf-8'));
+        if (!Array.isArray(nb.cells))
+            return { error: 'Invalid notebook: missing cells array.' };
+        const lines = [`[Notebook: ${resolved} — ${nb.cells.length} cells, nbformat ${nb.nbformat}]`];
+        nb.cells.forEach((cell, i) => {
+            const src = nbJoin(cell.source);
+            const execLabel = cell.cell_type === 'code'
+                ? (cell.execution_count != null ? ` (exec #${cell.execution_count})` : ' (not executed)')
+                : '';
+            lines.push('');
+            lines.push(`${'─'.repeat(60)}`);
+            lines.push(`Cell ${i} [${cell.cell_type}]${execLabel}`);
+            lines.push('─'.repeat(60));
+            lines.push(src || '(empty)');
+            if (cell.cell_type === 'code' && cell.outputs?.length) {
+                lines.push('');
+                lines.push('▶ Output:');
+                cell.outputs.forEach(o => {
+                    const formatted = formatNbOutput(o);
+                    if (formatted)
+                        lines.push(formatted);
+                });
+            }
+        });
+        let output = lines.join('\n');
+        if (output.length > MAX_OUTPUT_CHARS) {
+            output = output.slice(0, MAX_OUTPUT_CHARS) + '\n\n[Notebook output truncated at 100KB]';
+        }
+        return { output };
+    }
+    catch (err) {
+        if (err instanceof SyntaxError)
+            return { error: `Notebook is not valid JSON: ${err.message}` };
+        return { error: err.message };
+    }
+}
+// ─── notebook_edit ────────────────────────────────────────────────────────────
+async function notebookEdit(input, workDir) {
+    const filePath = typeof input.path === 'string' ? input.path : '';
+    const editType = typeof input.edit_type === 'string' ? input.edit_type : '';
+    // Accept cell_index as number OR numeric string (model sometimes sends "0" as string)
+    const rawIdx = input.cell_index;
+    const cellIndex = typeof rawIdx === 'number' ? Math.floor(rawIdx)
+        : typeof rawIdx === 'string' && rawIdx.trim() !== '' ? parseInt(rawIdx, 10)
+            : -1;
+    const source = typeof input.source === 'string' ? input.source : null;
+    const cellType = (typeof input.cell_type === 'string' ? input.cell_type : 'code');
+    if (!filePath)
+        return { error: 'Missing required parameter: path' };
+    if (!editType)
+        return { error: 'Missing required parameter: edit_type — must be "replace", "insert", or "delete"' };
+    if (!['replace', 'insert', 'delete'].includes(editType)) {
+        return { error: `Invalid edit_type: "${editType}". Must be one of: replace, insert, delete` };
+    }
+    try {
+        const resolved = resolvePath(filePath, workDir);
+        const nb = JSON.parse(fs.readFileSync(resolved, 'utf-8'));
+        if (!Array.isArray(nb.cells))
+            return { error: 'Invalid notebook: missing cells array.' };
+        const n = nb.cells.length;
+        const save = () => fs.writeFileSync(resolved, JSON.stringify(nb, null, 1) + '\n', 'utf-8');
+        if (editType === 'replace') {
+            if (cellIndex < 0 || cellIndex >= n)
+                return { error: `cell_index ${cellIndex} out of range (0–${n - 1})` };
+            if (source === null)
+                return { error: 'Missing required parameter: source (required for replace)' };
+            const cell = nb.cells[cellIndex];
+            cell.source = source;
+            if (cell.cell_type === 'code') {
+                cell.outputs = [];
+                cell.execution_count = null;
+            }
+            save();
+            return { output: `Replaced source of cell ${cellIndex} in ${resolved}.${cell.cell_type === 'code' ? ' Outputs cleared.' : ''}` };
+        }
+        if (editType === 'delete') {
+            if (cellIndex < 0 || cellIndex >= n)
+                return { error: `cell_index ${cellIndex} out of range (0–${n - 1})` };
+            const removed = nb.cells.splice(cellIndex, 1)[0];
+            save();
+            return { output: `Deleted cell ${cellIndex} [${removed.cell_type}] from ${resolved}. Notebook now has ${nb.cells.length} cells.` };
+        }
+        // insert: inserts AFTER cell_index, or at end if -1
+        if (source === null)
+            return { error: 'Missing required parameter: source (required for insert)' };
+        const insertAt = cellIndex >= 0 ? Math.min(cellIndex + 1, n) : n;
+        const newCell = {
+            cell_type: cellType,
+            source,
+            metadata: {},
+            ...(cellType === 'code' ? { execution_count: null, outputs: [] } : {}),
+        };
+        nb.cells.splice(insertAt, 0, newCell);
+        save();
+        return { output: `Inserted new ${cellType} cell at index ${insertAt} in ${resolved}. Notebook now has ${nb.cells.length} cells.` };
+    }
+    catch (err) {
+        if (err instanceof SyntaxError)
+            return { error: `Notebook is not valid JSON: ${err.message}` };
+        return { error: err.message };
+    }
+}
+// ─── Image tools — proxied through api.nexrall.com so API keys never leave the server ────
+const VALID_ASPECT_RATIOS = new Set(['1:1', '9:16', '16:9', '3:4', '4:3', '3:2', '2:3', '5:4', '4:5', '21:9', 'auto']);
+// Minimal HTTPS helpers (mirrors the Node built-in pattern used by fetchUrl above).
+// We avoid `node-fetch` here because executor.ts targets both Node 18+ (global fetch)
+// and older runtimes; using `https` directly is always safe.
+function _httpsPost(url, body, headers, timeoutMs = 30000) {
+    return new Promise((resolve, reject) => {
+        const u = new URL(url);
+        const chunks = [];
+        const req = https.request({ hostname: u.hostname, path: u.pathname + u.search, method: 'POST', headers: { ...headers, 'Content-Length': Buffer.byteLength(body) }, timeout: timeoutMs }, (res) => {
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf-8') }));
+        });
+        req.on('timeout', () => { req.destroy(); reject(new Error(`Request timed out after ${timeoutMs}ms`)); });
+        req.on('error', reject);
+        req.write(body);
+        req.end();
+    });
+}
+function _httpsGet(url, headers, timeoutMs = 20000) {
+    return new Promise((resolve, reject) => {
+        const u = new URL(url);
+        const transport = u.protocol === 'https:' ? https : http;
+        const chunks = [];
+        const req = transport.get({ hostname: u.hostname, path: u.pathname + u.search, headers, timeout: timeoutMs }, (res) => {
+            // Follow redirects once
+            if ((res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 307 || res.statusCode === 308) && res.headers.location) {
+                req.destroy();
+                _httpsGet(new URL(res.headers.location, url).href, headers, timeoutMs).then(resolve, reject);
+                return;
+            }
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks), contentType: res.headers['content-type'] ?? '' }));
+        });
+        req.on('timeout', () => { req.destroy(); reject(new Error(`Download timed out after ${timeoutMs}ms`)); });
+        req.on('error', reject);
+    });
+}
+/**
+ * generate_image — generate an AI image via KIE (google/nano-banana) and save it to
+ * a workspace-relative path. The backend holds the KIE key and charges a fixed fee
+ * ($0.10) from the user's wallet on success.
+ *
+ * { prompt, path, aspect_ratio? }
+ */
+async function generateImage(input, workDir) {
+    const prompt = typeof input.prompt === 'string' ? input.prompt.trim() : '';
+    const relPath = typeof input.path === 'string' ? input.path.trim() : '';
+    const aspectRatio = typeof input.aspect_ratio === 'string' && VALID_ASPECT_RATIOS.has(input.aspect_ratio)
+        ? input.aspect_ratio : '1:1';
+    if (!prompt)
+        return { error: 'Missing required parameter: prompt' };
+    if (!relPath)
+        return { error: 'Missing required parameter: path' };
+    const token = (0, auth_1.getToken)();
+    if (!token)
+        return { error: 'Not authenticated. Run `nexrall-code login` first.' };
+    // 1. Request the backend to generate the image (async task + poll handled server-side).
+    //    Backend may take up to ~2.5 min — use a 170s timeout with room to spare.
+    let imageUrl;
+    let cost;
+    let balance;
+    try {
+        const r = await _httpsPost(`${client_1.API_BASE}/api/code/assets/generate`, JSON.stringify({ prompt, aspect_ratio: aspectRatio }), { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` }, 170000);
+        let json = {};
+        try {
+            json = JSON.parse(r.body);
+        }
+        catch (_) { }
+        if (r.status !== 200)
+            return { error: json.error || `Server error ${r.status}` };
+        imageUrl = json.url ?? '';
+        cost = json.cost;
+        balance = json.balance;
+        if (!imageUrl)
+            return { error: 'Image generation succeeded but no URL was returned.' };
+    }
+    catch (err) {
+        return { error: `generate_image failed: ${err.message}` };
+    }
+    // 2. Download the image URL into the workspace.
+    const destPath = resolvePath(relPath, workDir);
+    try {
+        fs.mkdirSync(path.dirname(destPath), { recursive: true });
+    }
+    catch (_) { }
+    try {
+        const dl = await _httpsGet(imageUrl, { 'User-Agent': FETCH_USER_AGENT }, 60000);
+        if (dl.status !== 200)
+            return { error: `Failed to download generated image (HTTP ${dl.status}).` };
+        fs.writeFileSync(destPath, dl.body);
+        const kb = (dl.body.length / 1024).toFixed(1);
+        const costNote = cost != null ? ` ($${cost.toFixed(2)} charged` + (balance != null ? `, balance $${balance.toFixed(2)})` : ')') : '';
+        return { output: `Generated and saved image to ${destPath} (${kb} KB)${costNote}.` };
+    }
+    catch (err) {
+        return { error: `Failed to save image to ${destPath}: ${err.message}` };
+    }
+}
+/**
+ * stock_photo — search Unsplash for real photos and optionally download the top result
+ * into the workspace. Free — no wallet charge.
+ *
+ * { query, path?, count?, orientation? }
+ */
+async function stockPhoto(input, workDir) {
+    const query = typeof input.query === 'string' ? input.query.trim() : '';
+    const relPath = typeof input.path === 'string' ? input.path.trim() : '';
+    const count = typeof input.count === 'number' ? Math.min(Math.max(Math.floor(input.count), 1), 10) : 3;
+    const orientation = typeof input.orientation === 'string' ? input.orientation : '';
+    if (!query)
+        return { error: 'Missing required parameter: query' };
+    const token = (0, auth_1.getToken)();
+    if (!token)
+        return { error: 'Not authenticated. Run `nexrall-code login` first.' };
+    // 1. Search via the backend proxy (Unsplash key lives on the server).
+    let photos;
+    try {
+        const u = new URL(`${client_1.API_BASE}/api/code/assets/stock`);
+        u.searchParams.set('query', query);
+        u.searchParams.set('count', String(count));
+        if (orientation)
+            u.searchParams.set('orientation', orientation);
+        const r = await _httpsGet(u.toString(), { Authorization: `Bearer ${token}` });
+        let json = {};
+        try {
+            json = JSON.parse(r.body.toString('utf-8'));
+        }
+        catch (_) { }
+        if (r.status !== 200)
+            return { error: json.error || `Server error ${r.status}` };
+        photos = (json.photos ?? []);
+        if (!photos.length)
+            return { output: `No stock photos found for "${query}".` };
+    }
+    catch (err) {
+        return { error: `stock_photo search failed: ${err.message}` };
+    }
+    // 2a. If path given — download the top result into the workspace.
+    if (relPath) {
+        const top = photos[0];
+        if (!top?.url)
+            return { error: 'No usable photo URL returned from Unsplash.' };
+        const destPath = resolvePath(relPath, workDir);
+        try {
+            fs.mkdirSync(path.dirname(destPath), { recursive: true });
+        }
+        catch (_) { }
+        try {
+            const dl = await _httpsGet(top.url, { 'User-Agent': FETCH_USER_AGENT });
+            if (dl.status !== 200)
+                return { error: `Failed to download photo (HTTP ${dl.status}).` };
+            fs.writeFileSync(destPath, dl.body);
+            const kb = (dl.body.length / 1024).toFixed(1);
+            const credit = top.credit ? ` — Photo by ${top.credit} on Unsplash` : '';
+            return { output: `Downloaded "${top.alt || query}" to ${destPath} (${kb} KB).${credit}` };
+        }
+        catch (err) {
+            return { error: `Failed to save photo to ${destPath}: ${err.message}` };
+        }
+    }
+    // 2b. No path — return candidate URLs so the agent can pick.
+    const lines = photos.map((p, i) => `${i + 1}. ${p.url}${p.width && p.height ? ` (${p.width}×${p.height})` : ''}${p.alt ? ` — ${p.alt}` : ''}${p.credit ? ` · Photo by ${p.credit} on Unsplash` : ''}`);
+    return { output: `Found ${photos.length} photo(s) for "${query}":\n${lines.join('\n')}` };
+}
+// ─── Memory tools ─────────────────────────────────────────────────────────────
+const MEMORY_FILE = path.join(os.homedir(), '.nexrall', 'memory.md');
+async function memoryWrite(input) {
+    const content = typeof input.content === 'string' ? input.content.trim() : '';
+    if (!content)
+        return { error: 'content is required' };
+    const dir = path.dirname(MEMORY_FILE);
+    fs.mkdirSync(dir, { recursive: true });
+    // Dedup: skip if an entry with the same first 60 chars already exists.
+    // The old check used full substring match which blocked "React + TypeScript"
+    // if "React" was already stored. Now we only deduplicate near-identical entries.
+    if (fs.existsSync(MEMORY_FILE)) {
+        const existing = fs.readFileSync(MEMORY_FILE, 'utf-8').toLowerCase();
+        const fingerprint = content.toLowerCase().slice(0, 60);
+        if (existing.includes(fingerprint)) {
+            return { output: `Memory already recorded (skipped duplicate): ${content}` };
+        }
+    }
+    const timestamp = new Date().toISOString().slice(0, 10);
+    const entry = `\n- [${timestamp}] ${content}`;
+    fs.appendFileSync(MEMORY_FILE, entry, 'utf-8');
+    return { output: `Memory saved: ${content}` };
+}
+async function memoryRead(_input) {
+    try {
+        if (!fs.existsSync(MEMORY_FILE))
+            return { output: 'No memories saved yet.' };
+        const content = fs.readFileSync(MEMORY_FILE, 'utf-8').trim();
+        return { output: content || 'No memories saved yet.' };
+    }
+    catch (err) {
+        return { error: err.message };
+    }
+}
+// ─── Tool Dispatch ────────────────────────────────────────────────────────────
+const TOOL_MAP = {
+    read_file: readFile,
+    write_file: writeFile,
+    list_directory: listDirectory,
+    bash: bash,
+    search_files: searchFiles,
+    glob: glob,
+    create_directory: createDirectory,
+    edit_file: editFile,
+    multi_edit: multiEdit,
+    copy_file: copyFile,
+    move_file: moveFile,
+    delete_file: deleteFile,
+    fetch_url: fetchUrl,
+    generate_image: generateImage,
+    stock_photo: stockPhoto,
+    todo_write: todoWrite,
+    todo_read: todoRead,
+    notebook_read: notebookRead,
+    notebook_edit: notebookEdit,
+    memory_write: memoryWrite,
+    memory_read: memoryRead,
+    bash_output: bashOutput,
+    kill_shell: killShell,
+    // LSP-lite fallback (regex-based). In VS Code these names are intercepted by
+    // executeExternalTool (real language server) BEFORE reaching this executor,
+    // so this fallback only serves the CLI / headless environments.
+    get_symbols: symbols_1.getSymbols,
+    get_workspace_symbols: symbols_1.getWorkspaceSymbols,
+};
+// Tools that accept a workDir for correct relative-path resolution.
+// TOOL_MAP stores the base signatures; executeTool injects workDir at call time.
+const WORKDIR_TOOLS = new Set([
+    'read_file', 'write_file', 'list_directory', 'search_files', 'glob',
+    'create_directory', 'edit_file', 'multi_edit', 'copy_file', 'move_file',
+    'delete_file', 'notebook_read', 'notebook_edit',
+    'generate_image', 'stock_photo',
+    'get_symbols', 'get_workspace_symbols',
+]);
+async function executeTool(name, input, abortSignal, sandbox, workDir, agentScope) {
+    if (!TOOL_MAP[name])
+        return { error: `Unknown tool: ${name}` };
+    try {
+        if (name === 'bash')
+            return await bash(input, abortSignal, sandbox, workDir);
+        // Todo tools are scoped per agent (top-level vs each sub-agent) so
+        // concurrent sub-agents don't clobber each other's task lists.
+        if (name === 'todo_write')
+            return await todoWrite(input, agentScope);
+        if (name === 'todo_read')
+            return await todoRead(input, agentScope);
+        // Inject workDir into all file-system tools so relative paths resolve
+        // against the workspace root rather than process.cwd().
+        if (WORKDIR_TOOLS.has(name)) {
+            return await TOOL_MAP[name](input, workDir);
+        }
+        return await TOOL_MAP[name](input);
+    }
+    catch (err) {
+        return { error: `Unexpected error in tool ${name}: ${err.message}` };
+    }
+}
+//# sourceMappingURL=executor.js.map