@nexus-cortex/executors 4.26.0

package/dist/utils/GitPolicy.js

@@ -0,0 +1,166 @@
+/**
+ * GitPolicy — single source of truth for git/PR access control + safe subprocess wiring.
+ *
+ * Used by PRAgentTool, WorkspaceManagerTool, and the server's /v1/pr/* routes so that
+ * repo/action allow-listing, input validation, and token handling are consistent and
+ * defined in exactly one place.
+ *
+ * Security posture:
+ *  - Validation (repo/branch/prNumber regexes) is ALWAYS enforced — there is no opt-out.
+ *    Combined with execFile (no shell), this closes the shell/argument-injection class.
+ *  - The repo/action allow-list is opt-in defense-in-depth. Unset GIT_ALLOWED_REPOS means
+ *    "allow all" so existing single-user setups keep working after an upgrade;
+ *    multi-tenant/shared deployments set it to restrict. (No startup warning — the
+ *    trade-off is documented in .env.example so the TUI/CLI don't print noise on launch.)
+ *  - The auth token is exposed to gh/git ONLY through the subprocess environment
+ *    (GH_TOKEN / GITHUB_TOKEN). It is never interpolated into argv or a clone URL.
+ *
+ * Env vars (see SettingsSchema.ts / .env.example):
+ *  - GIT_ALLOWED_REPOS    comma list of owner/repo, supports `owner/*` and `*`. Default `*`.
+ *  - GIT_ALLOWED_ACTIONS  comma list of actions. Default: all actions allowed.
+ *  - GIT_AUTH_TOKEN       token for gh/git, injected into the subprocess env only.
+ *  - GIT_HOST             GitHub (Enterprise) host, default `github.com`.
+ */
+export const ALL_GIT_ACTIONS = [
+    'review',
+    'list',
+    'create',
+    'post-review',
+    'clone',
+    'worktree',
+    'diff',
+    'cleanup',
+    'status',
+];
+// First char must be alphanumeric (blocks leading `-` argument injection on both halves);
+// remainder limited to word chars, dot, dash. No slashes beyond the single owner/repo one,
+// no shell metacharacters, no whitespace.
+const REPO_RE = /^[A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*$/;
+// Conservative git ref-name rule: no leading dash, no `..`, no whitespace or shell/ref
+// metacharacters. Allows nested refs like `feature/foo-bar`.
+const BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+export class GitPolicy {
+    /** Parsed allow-list patterns: `*`, `owner/*`, or exact `owner/repo`. */
+    repoPatterns;
+    /** Allowed actions, or null when all actions are permitted. */
+    actions;
+    token;
+    host;
+    constructor(cfg = {}) {
+        const reposRaw = (cfg.allowedRepos ?? '').trim();
+        if (reposRaw === '' || reposRaw === '*') {
+            // Unset / `*` = all repos permitted. The trade-off (and how to restrict it) is
+            // documented in `.env.example` under GIT_ALLOWED_REPOS — no startup warning so the
+            // TUI/CLI don't print noise on every launch.
+            this.repoPatterns = ['*'];
+        }
+        else {
+            this.repoPatterns = reposRaw
+                .split(',')
+                .map((p) => p.trim().toLowerCase())
+                .filter(Boolean);
+        }
+        const actionsRaw = (cfg.allowedActions ?? '').trim();
+        this.actions =
+            actionsRaw === '' || actionsRaw === '*'
+                ? null
+                : new Set(actionsRaw
+                    .split(',')
+                    .map((a) => a.trim().toLowerCase())
+                    .filter(Boolean));
+        this.token = cfg.token && cfg.token.trim() !== '' ? cfg.token.trim() : undefined;
+        this.host = (cfg.host && cfg.host.trim() !== '' ? cfg.host.trim() : 'github.com').toLowerCase();
+    }
+    /** Build a policy from environment variables (defaults to process.env). */
+    static fromEnv(env = process.env) {
+        return new GitPolicy({
+            allowedRepos: env.GIT_ALLOWED_REPOS,
+            allowedActions: env.GIT_ALLOWED_ACTIONS,
+            token: env.GIT_AUTH_TOKEN,
+            host: env.GIT_HOST,
+        });
+    }
+    /**
+     * Validate a repo string: format first (blocks injection), then the allow-list.
+     * Returns an error message, or null when the repo is acceptable.
+     */
+    validateRepo(repo) {
+        if (typeof repo !== 'string' || repo.trim() === '') {
+            return 'repo is required and must be a string in "owner/repo" format';
+        }
+        const value = repo.trim();
+        if (!REPO_RE.test(value)) {
+            return `repo "${value}" is not a valid "owner/repo" identifier (only letters, digits, ., _, - allowed; no shell metacharacters)`;
+        }
+        if (!this.isRepoAllowed(value)) {
+            return `repo "${value}" is not in the GIT_ALLOWED_REPOS allow-list`;
+        }
+        return null;
+    }
+    /** True if the (already format-valid) repo matches the allow-list. */
+    isRepoAllowed(repo) {
+        const value = repo.trim().toLowerCase();
+        for (const pattern of this.repoPatterns) {
+            if (pattern === '*')
+                return true;
+            if (pattern === value)
+                return true;
+            if (pattern.endsWith('/*')) {
+                const owner = pattern.slice(0, -2);
+                if (value.startsWith(owner + '/'))
+                    return true;
+            }
+        }
+        return false;
+    }
+    /** Validate a branch / ref name. Returns an error message or null. */
+    validateBranch(name) {
+        if (name === undefined || name === null || name === '')
+            return null; // optional
+        if (typeof name !== 'string' || !BRANCH_RE.test(name) || name.includes('..')) {
+            return `branch "${String(name)}" is not a valid git ref name`;
+        }
+        return null;
+    }
+    /** Validate a PR number (must be a positive integer). Returns an error message or null. */
+    validatePrNumber(n) {
+        const num = typeof n === 'string' && /^\d+$/.test(n) ? Number(n) : n;
+        if (!Number.isInteger(num) || num <= 0) {
+            return `prNumber "${String(n)}" must be a positive integer`;
+        }
+        return null;
+    }
+    /** Coerce a validated PR number to an integer (call only after validatePrNumber passes). */
+    prNumber(n) {
+        return typeof n === 'string' ? Number(n) : n;
+    }
+    isActionAllowed(action) {
+        return this.actions === null || this.actions.has(action);
+    }
+    /** Returns an error message if the action is blocked, else null. */
+    assertAction(action) {
+        return this.isActionAllowed(action)
+            ? null
+            : `action "${action}" is not in the GIT_ALLOWED_ACTIONS allow-list`;
+    }
+    /**
+     * Subprocess environment with the auth token + host injected for gh/git.
+     * The token rides in env only — never on argv or in a URL.
+     */
+    subprocessEnv(base = process.env) {
+        const env = { ...base };
+        if (this.token) {
+            env.GH_TOKEN = this.token;
+            env.GITHUB_TOKEN = this.token;
+        }
+        if (this.host && this.host !== 'github.com') {
+            env.GH_HOST = this.host;
+        }
+        return env;
+    }
+    /** HTTPS clone URL for an `owner/repo`, host-aware. No token embedded. */
+    cloneUrl(repo) {
+        return `https://${this.host}/${repo}.git`;
+    }
+}
+//# sourceMappingURL=GitPolicy.js.map

package/dist/utils/GitPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitPolicy.js","sourceRoot":"","sources":["../../src/utils/GitPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAaH,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC1C,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,aAAa;IACb,OAAO;IACP,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;CACT,CAAC;AAaF,0FAA0F;AAC1F,2FAA2F;AAC3F,0CAA0C;AAC1C,MAAM,OAAO,GAAG,0CAA0C,CAAC;AAC3D,uFAAuF;AACvF,6DAA6D;AAC7D,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAElD,MAAM,OAAO,SAAS;IACpB,yEAAyE;IACxD,YAAY,CAAW;IACxC,+DAA+D;IAC9C,OAAO,CAAqB;IACpC,KAAK,CAAU;IACf,IAAI,CAAS;IAEtB,YAAY,MAAuB,EAAE;QACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACxC,+EAA+E;YAC/E,mFAAmF;YACnF,6CAA6C;YAC7C,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,GAAG,QAAQ;iBACzB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;iBAClC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO;YACV,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG;gBACrC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,GAAG,CACL,UAAU;qBACP,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;qBAClC,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;QAER,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;IAClG,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,OAAO,CAAC,MAAyB,OAAO,CAAC,GAAG;QACjD,OAAO,IAAI,SAAS,CAAC;YACnB,YAAY,EAAE,GAAG,CAAC,iBAAiB;YACnC,cAAc,EAAE,GAAG,CAAC,mBAAmB;YACvC,KAAK,EAAE,GAAG,CAAC,cAAc;YACzB,IAAI,EAAE,GAAG,CAAC,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,IAAa;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,OAAO,8DAA8D,CAAC;QACxE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,KAAK,2GAA2G,CAAC;QACnI,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,SAAS,KAAK,8CAA8C,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,aAAa,CAAC,IAAY;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,IAAI,OAAO,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,cAAc,CAAC,IAAa;QAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,WAAW;QAChF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,OAAO,WAAW,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2FAA2F;IAC3F,gBAAgB,CAAC,CAAU;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,aAAa,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,QAAQ,CAAC,CAAU;QACjB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAY,CAAC;IAC3D,CAAC;IAED,eAAe,CAAC,MAAiB;QAC/B,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,oEAAoE;IACpE,YAAY,CAAC,MAAiB;QAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,WAAW,MAAM,gDAAgD,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAA0B,OAAO,CAAC,GAAG;QACjD,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;YAC1B,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5C,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0EAA0E;IAC1E,QAAQ,CAAC,IAAY;QACnB,OAAO,WAAW,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC;IAC5C,CAAC;CACF"}

package/dist/utils/GitUtils.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Git Utility Functions
+ *
+ * Helpers for detecting git repositories and working with git commands.
+ */
+/**
+ * Checks if a directory is within a git repository
+ * @param directory The directory to check
+ * @returns true if the directory is in a git repository, false otherwise
+ */
+export declare function isGitRepository(directory: string): boolean;
+/**
+ * Finds the root directory of a git repository
+ * @param directory Starting directory to search from
+ * @returns The git repository root path, or null if not in a git repository
+ */
+export declare function findGitRoot(directory: string): string | null;
+//# sourceMappingURL=GitUtils.d.ts.map

package/dist/utils/GitUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitUtils.d.ts","sourceRoot":"","sources":["../../src/utils/GitUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyB5D"}

package/dist/utils/GitUtils.js

@@ -0,0 +1,62 @@
+/**
+ * Git Utility Functions
+ *
+ * Helpers for detecting git repositories and working with git commands.
+ */
+import fs from 'fs';
+import path from 'path';
+/**
+ * Checks if a directory is within a git repository
+ * @param directory The directory to check
+ * @returns true if the directory is in a git repository, false otherwise
+ */
+export function isGitRepository(directory) {
+    try {
+        let currentDir = path.resolve(directory);
+        while (true) {
+            const gitDir = path.join(currentDir, '.git');
+            // Check if .git exists (either as directory or file for worktrees)
+            if (fs.existsSync(gitDir)) {
+                return true;
+            }
+            const parentDir = path.dirname(currentDir);
+            // If we've reached the root directory, stop searching
+            if (parentDir === currentDir) {
+                break;
+            }
+            currentDir = parentDir;
+        }
+        return false;
+    }
+    catch (_error) {
+        // If any filesystem error occurs, assume not a git repo
+        return false;
+    }
+}
+/**
+ * Finds the root directory of a git repository
+ * @param directory Starting directory to search from
+ * @returns The git repository root path, or null if not in a git repository
+ */
+export function findGitRoot(directory) {
+    try {
+        let currentDir = path.resolve(directory);
+        while (true) {
+            const gitDir = path.join(currentDir, '.git');
+            if (fs.existsSync(gitDir)) {
+                return currentDir;
+            }
+            const parentDir = path.dirname(currentDir);
+            // If we've reached the root directory, stop searching
+            if (parentDir === currentDir) {
+                break;
+            }
+            currentDir = parentDir;
+        }
+        return null;
+    }
+    catch (_error) {
+        return null;
+    }
+}
+//# sourceMappingURL=GitUtils.js.map

package/dist/utils/GitUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitUtils.js","sourceRoot":"","sources":["../../src/utils/GitUtils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAC;QACH,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE7C,mEAAmE;YACnE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAE3C,sDAAsD;YACtD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM;YACR,CAAC;YAED,UAAU,GAAG,SAAS,CAAC;QACzB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,wDAAwD;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,CAAC;QACH,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEzC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE7C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAE3C,sDAAsD;YACtD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7B,MAAM;YACR,CAAC;YAED,UAAU,GAAG,SAAS,CAAC;QACzB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/utils/SandboxRegistry.d.ts

@@ -0,0 +1,110 @@
+/**
+ * SandboxRegistry - File-based persistent sandbox tracking
+ *
+ * Maintains a registry of all active sandboxes with file persistence.
+ * Survives server restarts and enables stateless mode to discover existing sandboxes.
+ *
+ * Architecture:
+ * - Single source of truth: .addon-tools/registry.json
+ * - Atomic writes with temp file + rename
+ * - Auto-recovery: validates PIDs and ports on load
+ * - Thread-safe: file locking for concurrent access
+ */
+export interface SandboxRegistryEntry {
+    id: string;
+    name: string;
+    port: number;
+    url: string;
+    pid?: number;
+    mode: 'oneshot' | 'dev' | 'persistent';
+    startTime: string;
+    lastActivity: string;
+    path: string;
+    metadata?: Record<string, any>;
+}
+export interface SandboxRegistryData {
+    version: string;
+    sandboxes: Record<string, SandboxRegistryEntry>;
+}
+export declare class SandboxRegistry {
+    private static instance;
+    private registryPath;
+    private registryDir;
+    private data;
+    private saveDebounceTimer;
+    private constructor();
+    /**
+     * Get singleton instance
+     */
+    static getInstance(baseDir?: string): SandboxRegistry;
+    /**
+     * Initialize registry (load from disk or create new)
+     */
+    initialize(): Promise<void>;
+    /**
+     * Load registry from disk
+     */
+    private load;
+    /**
+     * Save registry to disk (atomic write)
+     */
+    private save;
+    /**
+     * Save with debouncing (prevents excessive disk writes)
+     */
+    private debouncedSave;
+    /**
+     * Register a new sandbox
+     */
+    register(entry: SandboxRegistryEntry): Promise<void>;
+    /**
+     * Update an existing sandbox
+     */
+    update(id: string, updates: Partial<SandboxRegistryEntry>): Promise<void>;
+    /**
+     * Remove a sandbox from registry
+     */
+    unregister(id: string): Promise<void>;
+    /**
+     * Get a sandbox by ID
+     */
+    get(id: string): SandboxRegistryEntry | undefined;
+    /**
+     * Get sandbox by name (returns first match)
+     */
+    getByName(name: string): SandboxRegistryEntry | undefined;
+    /**
+     * Get all sandboxes
+     */
+    getAll(): SandboxRegistryEntry[];
+    /**
+     * Check if a sandbox exists
+     */
+    has(id: string): boolean;
+    /**
+     * Clean stale entries (processes that no longer exist)
+     */
+    private cleanStaleEntries;
+    /**
+     * Check if a process is alive
+     */
+    private isProcessAlive;
+    /**
+     * Get registry statistics
+     */
+    getStats(): {
+        total: number;
+        byMode: Record<string, number>;
+        oldestSandbox?: SandboxRegistryEntry;
+        newestSandbox?: SandboxRegistryEntry;
+    };
+    /**
+     * Export registry for debugging
+     */
+    export(): SandboxRegistryData;
+    /**
+     * Clear all sandboxes (dangerous - use with caution!)
+     */
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=SandboxRegistry.d.ts.map

package/dist/utils/SandboxRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxRegistry.d.ts","sourceRoot":"","sources":["../../src/utils/SandboxRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,YAAY,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CACjD;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,iBAAiB,CAA+B;IAExD,OAAO;IASP;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,eAAe;IAUrD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAajC;;OAEG;YACW,IAAI;IAiBlB;;OAEG;YACW,IAAI;IAelB;;OAEG;IACH,OAAO,CAAC,aAAa;IAUrB;;OAEG;IACG,QAAQ,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAe/E;;OAEG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3C;;OAEG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAIjD;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAIzD;;OAEG;IACH,MAAM,IAAI,oBAAoB,EAAE;IAIhC;;OAEG;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB;;OAEG;YACW,iBAAiB;IAqB/B;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;IACH,QAAQ,IAAI;QACV,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,aAAa,CAAC,EAAE,oBAAoB,CAAC;QACrC,aAAa,CAAC,EAAE,oBAAoB,CAAC;KACtC;IAoBD;;OAEG;IACH,MAAM,IAAI,mBAAmB;IAI7B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/dist/utils/SandboxRegistry.js

@@ -0,0 +1,220 @@
+/**
+ * SandboxRegistry - File-based persistent sandbox tracking
+ *
+ * Maintains a registry of all active sandboxes with file persistence.
+ * Survives server restarts and enables stateless mode to discover existing sandboxes.
+ *
+ * Architecture:
+ * - Single source of truth: .addon-tools/registry.json
+ * - Atomic writes with temp file + rename
+ * - Auto-recovery: validates PIDs and ports on load
+ * - Thread-safe: file locking for concurrent access
+ */
+import { promises as fs } from 'fs';
+import { join } from 'path';
+import { existsSync } from 'fs';
+export class SandboxRegistry {
+    static instance;
+    registryPath;
+    registryDir;
+    data;
+    saveDebounceTimer = null;
+    constructor(baseDir) {
+        this.registryDir = join(baseDir, '.addon-tools');
+        this.registryPath = join(this.registryDir, 'registry.json');
+        this.data = {
+            version: '1.0.0',
+            sandboxes: {}
+        };
+    }
+    /**
+     * Get singleton instance
+     */
+    static getInstance(baseDir) {
+        if (!SandboxRegistry.instance) {
+            if (!baseDir) {
+                throw new Error('SandboxRegistry: baseDir required for first initialization');
+            }
+            SandboxRegistry.instance = new SandboxRegistry(baseDir);
+        }
+        return SandboxRegistry.instance;
+    }
+    /**
+     * Initialize registry (load from disk or create new)
+     */
+    async initialize() {
+        // Ensure directory exists
+        await fs.mkdir(this.registryDir, { recursive: true });
+        // Load existing registry or create new
+        if (existsSync(this.registryPath)) {
+            await this.load();
+            await this.cleanStaleEntries();
+        }
+        else {
+            await this.save();
+        }
+    }
+    /**
+     * Load registry from disk
+     */
+    async load() {
+        try {
+            const content = await fs.readFile(this.registryPath, 'utf-8');
+            const loaded = JSON.parse(content);
+            // Validate version compatibility
+            if (loaded.version !== this.data.version) {
+                console.warn(`⚠  SandboxRegistry: Version mismatch (expected ${this.data.version}, got ${loaded.version})`);
+            }
+            this.data = loaded;
+        }
+        catch (error) {
+            console.error(`[ERROR] Failed to load sandbox registry: ${error.message}`);
+            // Keep empty registry
+        }
+    }
+    /**
+     * Save registry to disk (atomic write)
+     */
+    async save() {
+        try {
+            const tempPath = `${this.registryPath}.tmp`;
+            const content = JSON.stringify(this.data, null, 2);
+            // Write to temp file
+            await fs.writeFile(tempPath, content, 'utf-8');
+            // Atomic rename
+            await fs.rename(tempPath, this.registryPath);
+        }
+        catch (error) {
+            console.error(`[ERROR] Failed to save sandbox registry: ${error.message}`);
+        }
+    }
+    /**
+     * Save with debouncing (prevents excessive disk writes)
+     */
+    debouncedSave() {
+        if (this.saveDebounceTimer) {
+            clearTimeout(this.saveDebounceTimer);
+        }
+        this.saveDebounceTimer = setTimeout(() => {
+            this.save();
+            this.saveDebounceTimer = null;
+        }, 1000); // Save after 1s of inactivity
+    }
+    /**
+     * Register a new sandbox
+     */
+    async register(entry) {
+        this.data.sandboxes[entry.id] = entry;
+        await this.save();
+    }
+    /**
+     * Update an existing sandbox
+     */
+    async update(id, updates) {
+        const existing = this.data.sandboxes[id];
+        if (!existing) {
+            throw new Error(`Sandbox ${id} not found in registry`);
+        }
+        this.data.sandboxes[id] = {
+            ...existing,
+            ...updates,
+            lastActivity: new Date().toISOString()
+        };
+        this.debouncedSave();
+    }
+    /**
+     * Remove a sandbox from registry
+     */
+    async unregister(id) {
+        delete this.data.sandboxes[id];
+        await this.save();
+    }
+    /**
+     * Get a sandbox by ID
+     */
+    get(id) {
+        return this.data.sandboxes[id];
+    }
+    /**
+     * Get sandbox by name (returns first match)
+     */
+    getByName(name) {
+        return Object.values(this.data.sandboxes).find(s => s.name === name);
+    }
+    /**
+     * Get all sandboxes
+     */
+    getAll() {
+        return Object.values(this.data.sandboxes);
+    }
+    /**
+     * Check if a sandbox exists
+     */
+    has(id) {
+        return id in this.data.sandboxes;
+    }
+    /**
+     * Clean stale entries (processes that no longer exist)
+     */
+    async cleanStaleEntries() {
+        const staleIds = [];
+        for (const [id, entry] of Object.entries(this.data.sandboxes)) {
+            // Check if process still exists
+            if (entry.pid && !this.isProcessAlive(entry.pid)) {
+                console.log(` Cleaning stale sandbox: ${entry.name} (PID ${entry.pid} not found)`);
+                staleIds.push(id);
+            }
+        }
+        // Remove stale entries
+        for (const id of staleIds) {
+            delete this.data.sandboxes[id];
+        }
+        if (staleIds.length > 0) {
+            await this.save();
+        }
+    }
+    /**
+     * Check if a process is alive
+     */
+    isProcessAlive(pid) {
+        try {
+            // Send signal 0 to check if process exists
+            process.kill(pid, 0);
+            return true;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    /**
+     * Get registry statistics
+     */
+    getStats() {
+        const sandboxes = this.getAll();
+        const byMode = {};
+        for (const sandbox of sandboxes) {
+            byMode[sandbox.mode] = (byMode[sandbox.mode] || 0) + 1;
+        }
+        const sorted = sandboxes.sort((a, b) => new Date(a.startTime).getTime() - new Date(b.startTime).getTime());
+        return {
+            total: sandboxes.length,
+            byMode,
+            oldestSandbox: sorted[0],
+            newestSandbox: sorted[sorted.length - 1]
+        };
+    }
+    /**
+     * Export registry for debugging
+     */
+    export() {
+        return JSON.parse(JSON.stringify(this.data));
+    }
+    /**
+     * Clear all sandboxes (dangerous - use with caution!)
+     */
+    async clear() {
+        this.data.sandboxes = {};
+        await this.save();
+    }
+}
+//# sourceMappingURL=SandboxRegistry.js.map

package/dist/utils/SandboxRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SandboxRegistry.js","sourceRoot":"","sources":["../../src/utils/SandboxRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAoBhC,MAAM,OAAO,eAAe;IAClB,MAAM,CAAC,QAAQ,CAAkB;IACjC,YAAY,CAAS;IACrB,WAAW,CAAS;IACpB,IAAI,CAAsB;IAC1B,iBAAiB,GAA0B,IAAI,CAAC;IAExD,YAAoB,OAAe;QACjC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG;YACV,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,OAAgB;QACjC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,CAAC;YACD,eAAe,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,0BAA0B;QAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,uCAAuC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;YAE1D,iCAAiC;YACjC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,IAAI,CAAC,OAAO,SAAS,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;YAC9G,CAAC;YAED,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACrB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3E,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,YAAY,MAAM,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAEnD,qBAAqB;YACrB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/C,gBAAgB;YAChB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,8BAA8B;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,KAA2B;QACxC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;QACtC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAsC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;YACxB,GAAG,QAAQ;YACX,GAAG,OAAO;YACV,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,EAAU;QACZ,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,gCAAgC;YAChC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC;gBACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAW;QAChC,IAAI,CAAC;YACH,2CAA2C;YAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QAMN,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAE1C,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAClE,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,MAAM;YACN,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;YACxB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;SACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF"}

package/dist/utils/SchemaValidator.d.ts

@@ -0,0 +1,21 @@
+/**
+ * JSON Schema Validator
+ *
+ * Simple validator for tool parameters using JSON Schema
+ */
+import type { ToolSchema } from '@nexus-cortex/types';
+/**
+ * Validate parameters against JSON Schema
+ *
+ * @param schema JSON Schema definition
+ * @param params Parameters to validate (mutated in-place for type coercion)
+ * @returns Error message if invalid, null if valid
+ */
+export declare function validateSchema(schema: ToolSchema, params: any): string | null;
+/**
+ * Schema Validator class (Gemini-CLI-compatible validation patterns)
+ */
+export declare class SchemaValidator {
+    static validate(schema: ToolSchema, params: any): string | null;
+}
+//# sourceMappingURL=SchemaValidator.d.ts.map

package/dist/utils/SchemaValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SchemaValidator.d.ts","sourceRoot":"","sources":["../../src/utils/SchemaValidator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAiD7E;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;CAGhE"}