@nitrostack/core 1.0.17 → 1.1.0-beta.0

package/dist/core/transforms/catalog.transform.d.ts

@@ -0,0 +1,40 @@
+import { Tool } from '../tool.js';
+import { ExecutionContext } from '../types.js';
+import { McpTransform, NextToolHandler } from './transform.interface.js';
+export declare abstract class CatalogTransform implements McpTransform {
+    abstract readonly name: string;
+    private static readonly bypassStorage;
+    /**
+     * Catalog reshape (search, code mode) skips itself inside `withBypass` so a
+     * tool can list tools without rebuilding the catalog. Authorization
+     * transforms override this and still filter.
+     */
+    protected honorsBypass(): boolean;
+    /**
+     * Intercepts transformTools. Bypass skips transforms that opt in via
+     * `honorsBypass`. Visibility keeps filtering so a re-entrant list cannot
+     * see hidden tools.
+     */
+    transformTools(tools: Tool[], context?: ExecutionContext): Promise<Tool[]>;
+    /**
+     * Returns true if the current execution context is inside a bypass scope.
+     */
+    static isBypassed(): boolean;
+    /**
+     * Executes an asynchronous or synchronous action with transform bypass enabled.
+     * Handles nested bypass calls idempotently.
+     */
+    static withBypass<T>(fn: () => Promise<T> | T): Promise<T>;
+    /**
+     * Concrete subclass implementation of the transformation logic.
+     */
+    protected abstract applyTransform(tools: Tool[], context?: ExecutionContext): Promise<Tool[]>;
+    resolveTool(name: string, next: NextToolHandler, context?: ExecutionContext): Promise<Tool | undefined>;
+}
+/** Runs async work one-at-a-time for a single transform instance. */
+export declare class RebuildQueue {
+    private tail;
+    enqueue<T>(fn: () => Promise<T>): Promise<T>;
+    drain(): Promise<void>;
+}
+//# sourceMappingURL=catalog.transform.d.ts.map

package/dist/core/transforms/catalog.transform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.transform.d.ts","sourceRoot":"","sources":["../../../src/core/transforms/catalog.transform.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEzE,8BAAsB,gBAAiB,YAAW,YAAY;IAC5D,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAEzE;;;;OAIG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAIjC;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAOhF;;OAEG;IACH,MAAM,CAAC,UAAU,IAAI,OAAO;IAI5B;;;OAGG;WACU,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhE;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,CAC/B,KAAK,EAAE,IAAI,EAAE,EACb,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,EAAE,CAAC;IAEZ,WAAW,CACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;CAG7B;AAED,qEAAqE;AACrE,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAAuC;IAEnD,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAS5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAMvB"}

package/dist/core/transforms/catalog.transform.js

@@ -0,0 +1,52 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+export class CatalogTransform {
+    static bypassStorage = new AsyncLocalStorage();
+    /**
+     * Catalog reshape (search, code mode) skips itself inside `withBypass` so a
+     * tool can list tools without rebuilding the catalog. Authorization
+     * transforms override this and still filter.
+     */
+    honorsBypass() {
+        return true;
+    }
+    /**
+     * Intercepts transformTools. Bypass skips transforms that opt in via
+     * `honorsBypass`. Visibility keeps filtering so a re-entrant list cannot
+     * see hidden tools.
+     */
+    async transformTools(tools, context) {
+        if (CatalogTransform.isBypassed() && this.honorsBypass()) {
+            return tools;
+        }
+        return this.applyTransform(tools, context);
+    }
+    /**
+     * Returns true if the current execution context is inside a bypass scope.
+     */
+    static isBypassed() {
+        return CatalogTransform.bypassStorage.getStore() === true;
+    }
+    /**
+     * Executes an asynchronous or synchronous action with transform bypass enabled.
+     * Handles nested bypass calls idempotently.
+     */
+    static async withBypass(fn) {
+        return CatalogTransform.bypassStorage.run(true, async () => fn());
+    }
+    async resolveTool(name, next, context) {
+        return next(name, context);
+    }
+}
+/** Runs async work one-at-a-time for a single transform instance. */
+export class RebuildQueue {
+    tail = Promise.resolve();
+    enqueue(fn) {
+        const run = this.tail.then(fn);
+        this.tail = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    drain() {
+        return this.tail.then(() => undefined, () => undefined);
+    }
+}
+//# sourceMappingURL=catalog.transform.js.map

package/dist/core/transforms/catalog.transform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.transform.js","sourceRoot":"","sources":["../../../src/core/transforms/catalog.transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAKrD,MAAM,OAAgB,gBAAgB;IAE5B,MAAM,CAAU,aAAa,GAAG,IAAI,iBAAiB,EAAW,CAAC;IAEzE;;;;OAIG;IACO,YAAY;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,OAA0B;QAC5D,IAAI,gBAAgB,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU;QACf,OAAO,gBAAgB,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAI,EAAwB;QACjD,OAAO,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAUD,KAAK,CAAC,WAAW,CACf,IAAY,EACZ,IAAqB,EACrB,OAA0B;QAE1B,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;;AAGH,qEAAqE;AACrE,MAAM,OAAO,YAAY;IACf,IAAI,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,OAAO,CAAI,EAAoB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAClB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CACnB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;CACF"}

package/dist/core/transforms/code-mode/code-mode.transform.d.ts

@@ -0,0 +1,75 @@
+import { CatalogTransform } from '../catalog.transform.js';
+import { NextToolHandler, TransformRegistry } from '../transform.interface.js';
+import { Tool } from '../../tool.js';
+import { ExecutionContext } from '../../types.js';
+import { WorkerPool } from './worker-pool.js';
+import { CodeModeTransformOptions, SandboxExecutionResult } from './types.js';
+/**
+ * CodeModeTransform transforms the MCP server tool catalog by substituting raw tools
+ * with 3 synthetic meta-tools (search, get_schema, execute).
+ *
+ * This reduces context token usage by up to 98% and enables client LLMs to write and execute
+ * multi-step orchestration scripts locally inside an isolated WebAssembly sandbox.
+ */
+export declare class CodeModeTransform extends CatalogTransform {
+    readonly name = "code-mode";
+    private readonly options;
+    private rawTools;
+    private readonly bm25Engine;
+    private workerPool;
+    private cachedTransformedList;
+    private lastCatalogHash;
+    private registry;
+    private syntheticTools;
+    private readonly rebuilds;
+    private disposed;
+    constructor(options?: CodeModeTransformOptions);
+    onRegister(registry: TransformRegistry): void;
+    /**
+     * Resolves a tool for sandbox dispatch and for the search/get_schema meta-tools.
+     *
+     * Goes through the server's resolution chain so downstream authorization transforms
+     * still apply. When no server is attached (standalone use), there is no chain to
+     * consult and the locally indexed catalog is the complete picture.
+     */
+    private isMetaTool;
+    private readonly resolveForSandbox;
+    /**
+     * Returns the subset of `names` the caller is allowed to see, preserving order.
+     * Tools denied by an authorization transform are dropped rather than surfaced.
+     */
+    private filterAuthorized;
+    /**
+     * Transforms raw catalog tools into Code Mode meta-tools plus any alwaysVisible tools.
+     */
+    protected applyTransform(tools: Tool[], context?: ExecutionContext): Promise<Tool[]>;
+    private rebuildCatalog;
+    /**
+     * Resolves this transform's own meta-tools (search, get_schema, execute).
+     *
+     * There is deliberately no fallback to `rawTools`: re-resolving a tool the chain
+     * declined would let a caller reach tools a downstream authorization transform
+     * filtered out. Sandbox dispatch uses {@link resolveForSandbox}, which walks this
+     * same chain.
+     */
+    resolveTool(name: string, next: NextToolHandler, context?: ExecutionContext): Promise<Tool | undefined>;
+    /**
+     * Directly executes a JavaScript code snippet inside the worker pool sandbox.
+     * Throws an error if execution fails.
+     */
+    execute(code: string, context?: ExecutionContext): Promise<SandboxExecutionResult>;
+    private ensurePool;
+    /**
+     * Disposes the underlying worker pool.
+     */
+    dispose(): Promise<void>;
+    /**
+     * Diagnostic access to the worker pool.
+     */
+    getWorkerPool(): WorkerPool | null;
+    /**
+     * Diagnostic access to indexed raw tools.
+     */
+    getRawTools(): Map<string, Tool>;
+}
+//# sourceMappingURL=code-mode.transform.d.ts.map

package/dist/core/transforms/code-mode/code-mode.transform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-mode.transform.d.ts","sourceRoot":"","sources":["../../../../src/core/transforms/code-mode/code-mode.transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAuB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,EAAE,wBAAwB,EAAmB,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAI/F;;;;;;GAMG;AACH,qBAAa,iBAAkB,SAAQ,gBAAgB;IACrD,QAAQ,CAAC,IAAI,eAAe;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAgC;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,eAAe,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,GAAE,wBAA6B;IAkBlD,UAAU,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAI7C;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAUhC;IAEF;;;OAGG;YACW,gBAAgB;IAa9B;;OAEG;cACa,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAO5E,cAAc;IAqE5B;;;;;;;OAOG;IACG,WAAW,CACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAkB5B;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAiB1E,UAAU;IA2BxB;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAS9B;;OAEG;IACH,aAAa,IAAI,UAAU,GAAG,IAAI;IAIlC;;OAEG;IACH,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;CAGjC"}

package/dist/core/transforms/code-mode/code-mode.transform.js

@@ -0,0 +1,226 @@
+import { CatalogTransform, RebuildQueue } from '../catalog.transform.js';
+import { BM25Engine } from '../search/bm25.engine.js';
+import { WorkerPool } from './worker-pool.js';
+import { buildCodeModeTools } from './synthetic-tools.js';
+import { catalogCacheKey } from '../tool-cache-key.js';
+/**
+ * CodeModeTransform transforms the MCP server tool catalog by substituting raw tools
+ * with 3 synthetic meta-tools (search, get_schema, execute).
+ *
+ * This reduces context token usage by up to 98% and enables client LLMs to write and execute
+ * multi-step orchestration scripts locally inside an isolated WebAssembly sandbox.
+ */
+export class CodeModeTransform extends CatalogTransform {
+    name = 'code-mode';
+    options;
+    rawTools = new Map();
+    bm25Engine = new BM25Engine();
+    workerPool = null;
+    cachedTransformedList = null;
+    lastCatalogHash = '';
+    registry = null;
+    syntheticTools = new Map();
+    rebuilds = new RebuildQueue();
+    disposed = false;
+    constructor(options = {}) {
+        super();
+        this.options = {
+            workerPoolSize: options.workerPoolSize ?? 4,
+            memoryLimitMb: options.memoryLimitMb ?? 100,
+            timeoutMs: options.timeoutMs ??
+                options.executionTimeoutMs ??
+                30000,
+            maxToolCalls: options.maxToolCalls ?? 50,
+            allowDestructive: options.allowDestructive ?? false,
+            alwaysVisible: options.alwaysVisible ?? [],
+            searchToolName: options.searchToolName ?? 'search',
+            getSchemaToolName: options.getSchemaToolName ?? 'get_schema',
+            executeToolName: options.executeToolName ?? 'execute',
+        };
+    }
+    onRegister(registry) {
+        this.registry = registry;
+    }
+    /**
+     * Resolves a tool for sandbox dispatch and for the search/get_schema meta-tools.
+     *
+     * Goes through the server's resolution chain so downstream authorization transforms
+     * still apply. When no server is attached (standalone use), there is no chain to
+     * consult and the locally indexed catalog is the complete picture.
+     */
+    isMetaTool(name) {
+        return (name === this.options.searchToolName ||
+            name === this.options.getSchemaToolName ||
+            name === this.options.executeToolName);
+    }
+    resolveForSandbox = async (name, context) => {
+        // Nested execute/search/get_schema calls queue another job on this same pool
+        // and deadlock every worker until the watchdog fires.
+        if (this.isMetaTool(name)) {
+            throw new Error(`callTool('${name}') cannot invoke Code Mode meta-tools`);
+        }
+        if (this.registry) {
+            return this.registry.resolveTool(name, context);
+        }
+        return this.rawTools.get(name);
+    };
+    /**
+     * Returns the subset of `names` the caller is allowed to see, preserving order.
+     * Tools denied by an authorization transform are dropped rather than surfaced.
+     */
+    async filterAuthorized(names, context) {
+        const authorized = [];
+        for (const name of names) {
+            try {
+                const tool = await this.resolveForSandbox(name, context);
+                if (tool)
+                    authorized.push(tool);
+            }
+            catch {
+                // Denied for this session; omit from results.
+            }
+        }
+        return authorized;
+    }
+    /**
+     * Transforms raw catalog tools into Code Mode meta-tools plus any alwaysVisible tools.
+     */
+    async applyTransform(tools, context) {
+        if (this.disposed) {
+            throw new Error('CodeModeTransform is disposed');
+        }
+        return this.rebuilds.enqueue(() => this.rebuildCatalog(tools, context));
+    }
+    async rebuildCatalog(tools, _context) {
+        if (this.disposed) {
+            throw new Error('CodeModeTransform is disposed');
+        }
+        // Index the server's full catalog rather than this session's filtered view, so the
+        // index does not depend on whichever session most recently listed tools. Access
+        // control happens at query time via filterAuthorized, not by omitting from the index.
+        const indexable = this.registry ? [...this.registry.getTools().values()] : tools;
+        // Preserve tools designated as alwaysVisible or visible
+        const alwaysVisibleSet = new Set(this.options.alwaysVisible);
+        const visibleTools = tools.filter((t) => alwaysVisibleSet.has(t.name) ||
+            t.visibility === 'visible' ||
+            t.annotations?.alwaysVisible === true);
+        // Cache key spans both the indexed catalog and this session's passthrough set,
+        // so a list computed for one session is never replayed to another.
+        const currentHash = catalogCacheKey([...indexable].sort((a, b) => a.name.localeCompare(b.name)), visibleTools.map((t) => t.name).sort());
+        if (this.cachedTransformedList && this.lastCatalogHash === currentHash) {
+            return this.cachedTransformedList;
+        }
+        const nextRaw = new Map();
+        for (const t of indexable) {
+            nextRaw.set(t.name, t);
+        }
+        this.rawTools = nextRaw;
+        // Index tools into BM25 search engine
+        this.bm25Engine.indexTools(indexable, currentHash);
+        const pool = await this.ensurePool();
+        const limits = {
+            timeoutMs: this.options.timeoutMs,
+            memoryLimitMb: this.options.memoryLimitMb,
+            maxToolCalls: this.options.maxToolCalls,
+            allowDestructive: this.options.allowDestructive,
+        };
+        const { searchTool, getSchemaTool, executeTool } = buildCodeModeTools(this.bm25Engine, this.rawTools, pool, limits, {
+            searchToolName: this.options.searchToolName,
+            getSchemaToolName: this.options.getSchemaToolName,
+            executeToolName: this.options.executeToolName,
+        }, (names, ctx) => this.filterAuthorized(names, ctx));
+        this.syntheticTools = new Map([searchTool, getSchemaTool, executeTool].map((t) => [t.name, t]));
+        this.lastCatalogHash = currentHash;
+        this.cachedTransformedList = [searchTool, getSchemaTool, executeTool, ...visibleTools];
+        return this.cachedTransformedList;
+    }
+    /**
+     * Resolves this transform's own meta-tools (search, get_schema, execute).
+     *
+     * There is deliberately no fallback to `rawTools`: re-resolving a tool the chain
+     * declined would let a caller reach tools a downstream authorization transform
+     * filtered out. Sandbox dispatch uses {@link resolveForSandbox}, which walks this
+     * same chain.
+     */
+    async resolveTool(name, next, context) {
+        // A business tool named execute/search/get_schema must not shadow the
+        // sandbox meta-tool. Build the catalog once if tools/call arrives first.
+        if (this.isMetaTool(name)) {
+            if (!this.syntheticTools.has(name) && this.registry) {
+                await this.applyTransform([...this.registry.getTools().values()], context);
+            }
+            const synthetic = this.syntheticTools.get(name);
+            if (synthetic)
+                return synthetic;
+        }
+        // Downstream transforms get first refusal, so their guards always run.
+        const resolved = await next(name, context);
+        if (resolved)
+            return resolved;
+        return this.syntheticTools.get(name);
+    }
+    /**
+     * Directly executes a JavaScript code snippet inside the worker pool sandbox.
+     * Throws an error if execution fails.
+     */
+    async execute(code, context) {
+        const pool = await this.rebuilds.enqueue(() => this.ensurePool());
+        const limits = {
+            timeoutMs: this.options.timeoutMs,
+            memoryLimitMb: this.options.memoryLimitMb,
+            maxToolCalls: this.options.maxToolCalls,
+            allowDestructive: this.options.allowDestructive,
+        };
+        const result = await pool.executeScript(code, limits, context);
+        if (!result.success) {
+            throw new Error(result.error || 'Script execution failed');
+        }
+        return result;
+    }
+    async ensurePool() {
+        if (this.disposed) {
+            throw new Error('CodeModeTransform is disposed');
+        }
+        if (!this.workerPool) {
+            const pool = new WorkerPool(this.options.workerPoolSize, this.resolveForSandbox, undefined, this.options.memoryLimitMb);
+            await pool.initialize();
+            if (this.disposed || this.workerPool) {
+                await pool.dispose();
+                if (this.disposed) {
+                    throw new Error('CodeModeTransform is disposed');
+                }
+            }
+            else {
+                this.workerPool = pool;
+            }
+        }
+        if (!this.workerPool) {
+            throw new Error('CodeModeTransform is disposed');
+        }
+        return this.workerPool;
+    }
+    /**
+     * Disposes the underlying worker pool.
+     */
+    async dispose() {
+        this.disposed = true;
+        await this.rebuilds.drain();
+        if (this.workerPool) {
+            await this.workerPool.dispose();
+            this.workerPool = null;
+        }
+    }
+    /**
+     * Diagnostic access to the worker pool.
+     */
+    getWorkerPool() {
+        return this.workerPool;
+    }
+    /**
+     * Diagnostic access to indexed raw tools.
+     */
+    getRawTools() {
+        return new Map(this.rawTools);
+    }
+}
+//# sourceMappingURL=code-mode.transform.js.map

package/dist/core/transforms/code-mode/code-mode.transform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-mode.transform.js","sourceRoot":"","sources":["../../../../src/core/transforms/code-mode/code-mode.transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIzE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAuB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IAC5C,IAAI,GAAG,WAAW,CAAC;IACX,OAAO,CAAqC;IACrD,QAAQ,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC/B,UAAU,GAAqB,IAAI,UAAU,EAAE,CAAC;IACzD,UAAU,GAAsB,IAAI,CAAC;IACrC,qBAAqB,GAAkB,IAAI,CAAC;IAC5C,eAAe,GAAW,EAAE,CAAC;IAC7B,QAAQ,GAA6B,IAAI,CAAC;IAC1C,cAAc,GAAsB,IAAI,GAAG,EAAE,CAAC;IACrC,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IACvC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,UAAoC,EAAE;QAChD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG;YACb,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC3C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,GAAG;YAC3C,SAAS,EACP,OAAO,CAAC,SAAS;gBAChB,OAA2C,CAAC,kBAAkB;gBAC/D,KAAK;YACP,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;YACxC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;YACnD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;YAC1C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,QAAQ;YAClD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,YAAY;YAC5D,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS;SACtD,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAA2B;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,IAAY;QAC7B,OAAO,CACL,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,cAAc;YACpC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACvC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,eAAe,CACtC,CAAC;IACJ,CAAC;IAEgB,iBAAiB,GAAwB,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAChF,6EAA6E;QAC7E,sDAAsD;QACtD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,KAAe,EAAE,OAA0B;QACxE,MAAM,UAAU,GAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACzD,IAAI,IAAI;oBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,OAA0B;QACtE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,QAA2B;QACrE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,mFAAmF;QACnF,gFAAgF;QAChF,sFAAsF;QACtF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAEjF,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,WAAW,EAAE,aAAa,KAAK,IAAI,CACxC,CAAC;QAEF,+EAA+E;QAC/E,mEAAmE;QACnE,MAAM,WAAW,GAAG,eAAe,CACjC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAC3D,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CACvC,CAAC;QAEF,IAAI,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,eAAe,KAAK,WAAW,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgB,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QAExB,sCAAsC;QACtC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAErC,MAAM,MAAM,GAAoB;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YACzC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;SAChD,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACnE,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,QAAQ,EACb,IAAI,EACJ,MAAM,EACN;YACE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;YAC3C,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;SAC9C,EACD,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAClD,CAAC;QAEF,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAC3B,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACjE,CAAC;QAEF,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC;QACnC,IAAI,CAAC,qBAAqB,GAAG,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CACf,IAAY,EACZ,IAAqB,EACrB,OAA0B;QAE1B,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpD,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;QAED,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAA0B;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAoB;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YACzC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;SAChD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,UAAU,CACzB,IAAI,CAAC,OAAO,CAAC,cAAc,EAC3B,IAAI,CAAC,iBAAiB,EACtB,SAAS,EACT,IAAI,CAAC,OAAO,CAAC,aAAa,CAC3B,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/core/transforms/code-mode/destructive-guard.d.ts

@@ -0,0 +1,7 @@
+import { Tool } from '../../tool.js';
+/**
+ * Asserts that a target tool is permitted to execute according to safety policies.
+ * Throws a model-legible safety error if a destructive tool is invoked while allowDestructive is false.
+ */
+export declare function assertToolAllowed(tool: Tool, allowDestructive: boolean): void;
+//# sourceMappingURL=destructive-guard.d.ts.map

package/dist/core/transforms/code-mode/destructive-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive-guard.d.ts","sourceRoot":"","sources":["../../../../src/core/transforms/code-mode/destructive-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAe7E"}

package/dist/core/transforms/code-mode/destructive-guard.js

@@ -0,0 +1,18 @@
+/**
+ * Asserts that a target tool is permitted to execute according to safety policies.
+ * Throws a model-legible safety error if a destructive tool is invoked while allowDestructive is false.
+ */
+export function assertToolAllowed(tool, allowDestructive) {
+    if (allowDestructive)
+        return;
+    // MCP default: omitted destructiveHint means the tool may destroy state.
+    // readOnlyHint opts out. destructiveHint: false opts out explicitly.
+    const legacyDestructive = Boolean(tool.destructive);
+    const hint = tool.annotations?.destructiveHint;
+    const readOnly = tool.annotations?.readOnlyHint === true;
+    const isDestructive = legacyDestructive || hint === true || (hint === undefined && !readOnly);
+    if (isDestructive) {
+        throw new Error(`callTool('${tool.name}') rejected: destructive operations are disabled in Code Mode batch scripts. Set allowDestructive: true to enable.`);
+    }
+}
+//# sourceMappingURL=destructive-guard.js.map

package/dist/core/transforms/code-mode/destructive-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive-guard.js","sourceRoot":"","sources":["../../../../src/core/transforms/code-mode/destructive-guard.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAU,EAAE,gBAAyB;IACrE,IAAI,gBAAgB;QAAE,OAAO;IAE7B,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,iBAAiB,GAAG,OAAO,CAAE,IAAkC,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI,CAAC;IACzD,MAAM,aAAa,GAAG,iBAAiB,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE9F,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,CAAC,IAAI,oHAAoH,CAC3I,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/transforms/code-mode/guest-evaluator.d.ts

@@ -0,0 +1,17 @@
+import { ExecutionLimits, SandboxExecutionResult } from './types.js';
+/**
+ * Memory used by a QuickJS runtime, in megabytes.
+ * Prefers a numeric reading. The text dump is the fallback, and a format
+ * change or a missing API reports 0 rather than failing the script.
+ */
+export declare function memoryUsedMb(runtime: {
+    computeMemoryUsage?: () => unknown;
+    dumpMemoryUsage?: () => string;
+}): number;
+/**
+ * Evaluates JavaScript guest code inside an isolated QuickJS WebAssembly sandbox.
+ * Supports async callTool bridging across IPC/host dispatcher, microtask pumping,
+ * console capturing, circuit breaker enforcement, and 2-tier timeout protection.
+ */
+export declare function evaluateGuestScript(code: string, limits: ExecutionLimits, ipcToolDispatcher: (name: string, args: Record<string, unknown>) => Promise<unknown>): Promise<SandboxExecutionResult>;
+//# sourceMappingURL=guest-evaluator.d.ts.map

package/dist/core/transforms/code-mode/guest-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-evaluator.d.ts","sourceRoot":"","sources":["../../../../src/core/transforms/code-mode/guest-evaluator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAmB,MAAM,YAAY,CAAC;AAmEtF;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE;IACpC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC,GAAG,MAAM,CA2BT;AAID;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GACnF,OAAO,CAAC,sBAAsB,CAAC,CAmLjC"}