@nodetool-ai/agents 0.7.0-rc.22 → 0.8.1

package/dist/graph-dsl-core.js

@@ -0,0 +1,312 @@
+/**
+ * Graph DSL core — the guest-side implementation of node/edge wiring behind
+ * the free-form `node(type, props)` program `evaluateGraphDsl` runs
+ * (`src/graph-dsl.ts`). A CodeAct action authors graphs the other way, through
+ * the generated wrappers in `@nodetool-ai/sandbox-dsl`; both produce the same
+ * `{nodes, edges}` shape, and both refuse a handle interpolated into a
+ * string.
+ *
+ * `__graphDslBuilder()` returns an instance-based builder: `node(type, props,
+ * {id})` registers a node and returns a ref whose `.output(slot?)` produces a
+ * wiring handle ({__handle, source, sourceHandle}); a handle passed as a
+ * property value becomes an edge immediately. `connect()` refuses ids the
+ * graph does not have, and a handle interpolated into a string throws instead
+ * of silently becoming "[object Object]".
+ */
+/**
+ * The graph normalizer on its own: every shape a caller may hold a graph in —
+ * a builder, a bare `{nodes, edges}`, a workflow record, or what the sandbox
+ * DSL pack's `workflow()` returns — reduced to `{nodes, edges}`. The
+ * `nodetool.workflows` methods take any of them and need nothing else from
+ * this file.
+ */
+export const GRAPH_JSON_PRELUDE = `function __graphJsonOf(source) {
+  if (source && typeof source.toJSON === "function") return source.toJSON();
+  if (source && Array.isArray(source.nodes)) {
+    return { nodes: source.nodes, edges: source.edges || [] };
+  }
+  if (source && source.graph && Array.isArray(source.graph.nodes)) {
+    return { nodes: source.graph.nodes, edges: source.graph.edges || [] };
+  }
+  throw new Error(
+    "expected a graph builder, a {nodes, edges} graph, or a workflow " +
+    "record with a .graph"
+  );
+}
+`;
+export const GRAPH_DSL_CORE_PRELUDE = `${GRAPH_JSON_PRELUDE}
+function __graphDslBuilder() {
+  const nodes = [];
+  const edges = [];
+  const byId = Object.create(null);
+  const counters = Object.create(null);
+
+  const autoId = (hint) => {
+    const last = String(hint).split(".").pop() || "node";
+    const stem = last
+      .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+      .replace(/[^A-Za-z0-9_]/g, "_")
+      .toLowerCase();
+    let id = stem;
+    while (byId[id]) {
+      const n = (counters[stem] = (counters[stem] || 1) + 1);
+      id = stem + "_" + n;
+    }
+    return id;
+  };
+
+  const isHandle = (value) =>
+    value !== null && typeof value === "object" && value.__handle === true;
+
+  const findNestedHandlePath = (value, seen) => {
+    if (value === null || typeof value !== "object") return null;
+    if (seen.indexOf(value) !== -1) return null;
+    seen.push(value);
+    if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        const item = value[i];
+        if (isHandle(item)) return "[" + i + "]";
+        const deeper = findNestedHandlePath(item, seen);
+        if (deeper !== null) return "[" + i + "]" + deeper;
+      }
+      return null;
+    }
+    for (const key of Object.keys(value)) {
+      if (isHandle(value[key])) return "." + key;
+      const deeper = findNestedHandlePath(value[key], seen);
+      if (deeper !== null) return "." + key + deeper;
+    }
+    return null;
+  };
+
+  /**
+   * Classify one non-handle property value for wiring. An array whose every
+   * element is a handle is list fan-in — the same shape the editor produces
+   * when several sources feed one list input — and wires one edge per
+   * element. Anything else holding a handle anywhere inside is refused with
+   * the path named.
+   */
+  const classifyValue = (key, value) => {
+    if (Array.isArray(value)) {
+      let sawHandle = false;
+      let sawLiteral = false;
+      for (const item of value) {
+        if (isHandle(item)) sawHandle = true;
+        else sawLiteral = true;
+      }
+      if (!sawHandle) return "plain";
+      if (sawLiteral) {
+        throw new Error(
+          'Property "' +
+            key +
+            '" mixes wired outputs and literal values in one array. Wire ' +
+            "the whole list — every element an output() handle — or pass " +
+            "plain values only."
+        );
+      }
+      return "fanin";
+    }
+    const nested = findNestedHandlePath(value, []);
+    if (nested !== null) {
+      throw new Error(
+        'Property "' +
+          key +
+          '" holds a node output at "' +
+          key +
+          nested +
+          '". A connection is only made from a handle assigned directly to ' +
+          "a property — one buried in an object is not wired, and the node " +
+          "producing it would be left out of the graph. Give each source " +
+          "its own property."
+      );
+    }
+    return "plain";
+  };
+
+  const makeHandle = (nodeId, slot) => {
+    if (slot !== undefined && (typeof slot !== "string" || slot.length === 0)) {
+      throw new Error("output(slot): slot must be a non-empty string");
+    }
+    const handle = {
+      __handle: true,
+      source: nodeId,
+      sourceHandle: slot || "output"
+    };
+    // Interpolating a handle into a string silently yields "[object
+    // Object]": no edge is created and the node gets that literal text.
+    // Refuse the conversion so the mistake surfaces where it was made.
+    handle[Symbol.toPrimitive] = function () {
+      throw new Error(
+        "Cannot use " +
+          nodeId +
+          ".output() inside a string. A handle wires an edge; it is not text. " +
+          "Pass it as the property value itself — { prompt: " +
+          nodeId +
+          ".output() } — and put any fixed instructions in a separate " +
+          "property (an Agent node's system property). To build one string " +
+          "out of several handles plus fixed text, wire them into a " +
+          'nodetool.text.Template node: { string: "Hi {{name}}, about ' +
+          '{{topic}}", name: a.output(), topic: b.output() } — each extra ' +
+          "property is a dynamic input replacing its {{key}} placeholder."
+      );
+    };
+    return handle;
+  };
+
+  const addEdge = (source, sourceHandle, target, targetHandle) => {
+    const edge = {
+      id: "e" + (edges.length + 1) + "_" + source + "_" + target,
+      source: source,
+      sourceHandle: sourceHandle || "output",
+      target: target,
+      targetHandle: targetHandle
+    };
+    edges.push(edge);
+    return edge;
+  };
+
+  const wireProps = (targetId, props) => {
+    const plain = {};
+    for (const key of Object.keys(props || {})) {
+      const value = props[key];
+      if (isHandle(value)) {
+        addEdge(value.source, value.sourceHandle, targetId, key);
+      } else if (classifyValue(key, value) === "fanin") {
+        for (const handle of value) {
+          addEdge(handle.source, handle.sourceHandle, targetId, key);
+        }
+      } else {
+        plain[key] = value;
+      }
+    }
+    return plain;
+  };
+
+  const makeRef = (raw) => {
+    const ref = {
+      id: raw.id,
+      type: raw.type,
+      properties: raw.properties,
+      output: (slot) => makeHandle(raw.id, slot),
+      set(props) {
+        Object.assign(raw.properties, wireProps(raw.id, props));
+        return ref;
+      }
+    };
+    byId[raw.id] = ref;
+    return ref;
+  };
+
+  const notFound = (id) =>
+    new Error(
+      "Node not found: " + id + ". Known: " + Object.keys(byId).join(", ")
+    );
+
+  const refId = (ref) => {
+    const id = typeof ref === "string" ? ref : ref && ref.id;
+    if (typeof id !== "string" || id.length === 0 || !byId[id]) {
+      throw notFound(typeof id === "string" && id.length > 0 ? id : String(ref));
+    }
+    return id;
+  };
+
+  const g = {
+    nodes: nodes,
+    edges: edges,
+    node(type, properties, opts) {
+      if (typeof type !== "string" || type.length === 0) {
+        throw new Error(
+          "node(type, properties): type must be a non-empty string"
+        );
+      }
+      if (
+        properties !== undefined &&
+        (properties === null ||
+          typeof properties !== "object" ||
+          Array.isArray(properties))
+      ) {
+        throw new Error("node(type, properties): properties must be an object");
+      }
+      const explicit =
+        opts && typeof opts.id === "string" && opts.id.length > 0
+          ? opts.id
+          : undefined;
+      if (explicit && byId[explicit]) {
+        throw new Error('Duplicate node id "' + explicit + '"');
+      }
+      const id = explicit || autoId(type);
+      const raw = { id: id, type: type, properties: {} };
+      nodes.push(raw);
+      const ref = makeRef(raw);
+      Object.assign(raw.properties, wireProps(id, properties));
+      return ref;
+    },
+    connect(source, sourceHandle, target, targetHandle) {
+      const sourceId = refId(source);
+      const targetId = refId(target);
+      if (typeof targetHandle !== "string" || targetHandle.length === 0) {
+        throw new Error(
+          "connect(source, sourceHandle, target, targetHandle): " +
+            "targetHandle must be a non-empty string"
+        );
+      }
+      return addEdge(sourceId, sourceHandle, targetId, targetHandle);
+    },
+    get(id) {
+      const found = byId[id];
+      if (!found) throw notFound(id);
+      return found;
+    },
+    /**
+     * Copy another graph (builder, {nodes, edges}, or workflow record) into
+     * this one. Ids that collide are remapped; returns { idMap, refs } where
+     * refs is keyed by the SOURCE id, so wiring into copied nodes never
+     * needs the remapped name.
+     */
+    copyFrom(source, opts) {
+      const src = __graphJsonOf(source);
+      const prefix = (opts && opts.prefix) || "";
+      const idMap = {};
+      const refs = {};
+      for (const n of src.nodes) {
+        const props = Object.assign(
+          {},
+          n.properties ||
+            (n.data && n.data.properties ? n.data.properties : n.data) ||
+            {}
+        );
+        let id = prefix + n.id;
+        if (byId[id]) id = autoId(id);
+        idMap[n.id] = id;
+        const raw = { id: id, type: n.type, properties: props };
+        nodes.push(raw);
+        refs[n.id] = makeRef(raw);
+      }
+      for (const e of src.edges || []) {
+        if (idMap[e.source] === undefined || idMap[e.target] === undefined) {
+          continue;
+        }
+        addEdge(
+          idMap[e.source],
+          e.sourceHandle || e.source_output,
+          idMap[e.target],
+          e.targetHandle || e.target_input
+        );
+      }
+      return { idMap: idMap, refs: refs };
+    },
+    toJSON() {
+      return {
+        nodes: nodes.map((n) => ({
+          id: n.id,
+          type: n.type,
+          properties: Object.assign({}, n.properties)
+        })),
+        edges: edges.map((e) => Object.assign({}, e))
+      };
+    }
+  };
+  return g;
+}
+`;
+//# sourceMappingURL=graph-dsl-core.js.map

package/dist/graph-dsl-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-dsl-core.js","sourceRoot":"","sources":["../src/graph-dsl-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;CAajC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkR1D,CAAC"}

package/dist/graph-dsl.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Graph DSL — evaluate an LLM-authored workflow program into GraphData.
+ *
+ * The planner LLM writes ONE plain-JavaScript program using the same
+ * handle-wiring semantics as `@nodetool-ai/dsl` (`createNode` / `workflow`):
+ * `node(type, properties)` creates a node, passing `ref.output(slot?)` as a
+ * property value becomes an edge, and `return graph()` collects everything.
+ * The program runs in the QuickJS WebAssembly sandbox — no host access beyond
+ * the two predefined functions — so a malformed or malicious program cannot
+ * touch the host.
+ */
+import type { GraphData } from "@nodetool-ai/protocol";
+/** Wall-clock budget for a graph program. Pure graph building is fast. */
+export declare const GRAPH_DSL_TIMEOUT_MS = 10000;
+export interface EvaluateGraphDslOptions {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+export interface GraphDslResult {
+    graph?: GraphData;
+    error?: string;
+    logs?: string[];
+}
+/**
+ * Run a graph DSL program in the sandbox and return the graph it builds.
+ * Errors (syntax, runtime, wrong return shape) come back as `error` text the
+ * planner can feed to the model for the next round.
+ */
+export declare function evaluateGraphDsl(code: string, options?: EvaluateGraphDslOptions): Promise<GraphDslResult>;
+//# sourceMappingURL=graph-dsl.d.ts.map

package/dist/graph-dsl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-dsl.d.ts","sourceRoot":"","sources":["../src/graph-dsl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAwB,MAAM,uBAAuB,CAAC;AAK7E,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,QAAS,CAAC;AA2B3C,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAiED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,cAAc,CAAC,CAmBzB"}

package/dist/graph-dsl.js

@@ -0,0 +1,116 @@
+/**
+ * Graph DSL — evaluate an LLM-authored workflow program into GraphData.
+ *
+ * The planner LLM writes ONE plain-JavaScript program using the same
+ * handle-wiring semantics as `@nodetool-ai/dsl` (`createNode` / `workflow`):
+ * `node(type, properties)` creates a node, passing `ref.output(slot?)` as a
+ * property value becomes an edge, and `return graph()` collects everything.
+ * The program runs in the QuickJS WebAssembly sandbox — no host access beyond
+ * the two predefined functions — so a malformed or malicious program cannot
+ * touch the host.
+ */
+import { runInSandbox } from "./js-sandbox.js";
+import { GRAPH_DSL_CORE_PRELUDE } from "./graph-dsl-core.js";
+import { isRecord, isString } from "./utils/type-guards.js";
+/** Wall-clock budget for a graph program. Pure graph building is fast. */
+export const GRAPH_DSL_TIMEOUT_MS = 10_000;
+/**
+ * Guest-side prelude defining the DSL surface: the graph DSL core
+ * (`graph-dsl-core.ts` — the wiring, validation, and handle guards) plus the
+ * planner's free-function
+ * form. `node()` registers a node on one implicit builder and returns a ref
+ * whose `.output(slot?)` produces a wiring handle; `graph()` collects the
+ * result (mirroring how `workflow()` in @nodetool-ai/dsl derives edges from
+ * OutputHandle inputs). All created nodes are included — an orphan node is a
+ * validation finding for the planner to fix, not something to silently prune.
+ */
+const GRAPH_DSL_PRELUDE = `${GRAPH_DSL_CORE_PRELUDE}
+const __g = __graphDslBuilder();
+function node(type, properties, id) {
+  return __g.node(
+    type,
+    properties,
+    typeof id === "string" && id.length > 0 ? { id: id } : undefined
+  );
+}
+function graph() {
+  const j = __g.toJSON();
+  return { __graph: true, nodes: j.nodes, edges: j.edges };
+}
+`;
+function asRecord(value) {
+    return isRecord(value)
+        ? value
+        : null;
+}
+/**
+ * Convert the sandbox return value into GraphData, or explain why it isn't
+ * one. The prelude guarantees the shape for programs that end in
+ * `return graph()`; anything else (returning a node ref, a string, nothing)
+ * gets an actionable message instead of a crash downstream.
+ */
+function toGraphData(result) {
+    const record = asRecord(result);
+    if (!record ||
+        record.__graph !== true ||
+        !Array.isArray(record.nodes) ||
+        !Array.isArray(record.edges)) {
+        return {
+            error: "The program must end with `return graph();` — it returned something else."
+        };
+    }
+    const nodes = [];
+    for (const raw of record.nodes) {
+        const n = asRecord(raw);
+        if (!n || !isString(n.id) || !isString(n.type)) {
+            return { error: "Malformed node in graph() result." };
+        }
+        nodes.push({
+            id: n.id,
+            type: n.type,
+            name: n.id,
+            properties: asRecord(n.properties) ?? {}
+        });
+    }
+    const edges = [];
+    for (const raw of record.edges) {
+        const e = asRecord(raw);
+        if (!e ||
+            !isString(e.source) ||
+            !isString(e.sourceHandle) ||
+            !isString(e.target) ||
+            !isString(e.targetHandle)) {
+            return { error: "Malformed edge in graph() result." };
+        }
+        edges.push({
+            source: e.source,
+            sourceHandle: e.sourceHandle,
+            target: e.target,
+            targetHandle: e.targetHandle
+        });
+    }
+    return { graph: { nodes, edges } };
+}
+/**
+ * Run a graph DSL program in the sandbox and return the graph it builds.
+ * Errors (syntax, runtime, wrong return shape) come back as `error` text the
+ * planner can feed to the model for the next round.
+ */
+export async function evaluateGraphDsl(code, options = {}) {
+    if (!code.trim()) {
+        return { error: "Program is empty." };
+    }
+    const run = await runInSandbox({
+        code: `${GRAPH_DSL_PRELUDE}\n${code}`,
+        timeoutMs: options.timeoutMs ?? GRAPH_DSL_TIMEOUT_MS,
+        signal: options.signal
+    });
+    if (!run.success) {
+        return {
+            error: run.error ?? "Program execution failed.",
+            logs: run.logs
+        };
+    }
+    return { ...toGraphData(run.result), logs: run.logs };
+}
+//# sourceMappingURL=graph-dsl.js.map

package/dist/graph-dsl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-dsl.js","sourceRoot":"","sources":["../src/graph-dsl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,GAAG,sBAAsB;;;;;;;;;;;;;CAalD,CAAC;AAaF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,QAAQ,CAAC,KAAK,CAAC;QACpB,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAe;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,IACE,CAAC,MAAM;QACP,MAAM,CAAC,OAAO,KAAK,IAAI;QACvB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5B,CAAC;QACD,OAAO;YACL,KAAK,EACH,2EAA2E;SAC9E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,EAAE;YACV,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxB,IACE,CAAC,CAAC;YACF,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YACnB,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;YACzB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YACnB,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EACzB,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,OAAO,GAA4B,EAAE;IAErC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC;QAC7B,IAAI,EAAE,GAAG,iBAAiB,KAAK,IAAI,EAAE;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,oBAAoB;QACpD,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,2BAA2B;YAC/C,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC"}

package/dist/host-binaries.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Re-export shim: the host binary runner lives in `@nodetool-ai/runtime`.
+ * Import paths into this module keep working; call sites are unchanged.
+ */
+export { runHostBinary, HostBinaryMissingError, MAX_CAPTURED_BYTES, MAX_ARTIFACT_BYTES, maxConcurrentHostBinaries, mimeFromFilename, clampTimeoutSeconds, type HostBinaryResult, type RunHostBinaryOptions } from "@nodetool-ai/runtime";
+//# sourceMappingURL=host-binaries.d.ts.map

package/dist/host-binaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-binaries.d.ts","sourceRoot":"","sources":["../src/host-binaries.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC"}

package/dist/host-binaries.js

@@ -0,0 +1,6 @@
+/**
+ * Re-export shim: the host binary runner lives in `@nodetool-ai/runtime`.
+ * Import paths into this module keep working; call sites are unchanged.
+ */
+export { runHostBinary, HostBinaryMissingError, MAX_CAPTURED_BYTES, MAX_ARTIFACT_BYTES, maxConcurrentHostBinaries, mimeFromFilename, clampTimeoutSeconds } from "@nodetool-ai/runtime";
+//# sourceMappingURL=host-binaries.js.map

package/dist/host-binaries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-binaries.js","sourceRoot":"","sources":["../src/host-binaries.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EAGpB,MAAM,sBAAsB,CAAC"}

package/dist/host-binary-guard.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The boundary around `ffmpeg` and `yt-dlp` — the two capabilities that hand a
+ * model's own strings to a process on the host.
+ *
+ * The argv arrives from guest JavaScript or from an LLM tool call, and the
+ * child runs with the server's identity. In the managed cloud that server also
+ * holds every other tenant's database handle and secret store, so an unbounded
+ * `ffmpeg` is an arbitrary-file reader (`-i /etc/passwd`), an arbitrary-file
+ * writer (`-y ../../app/backend/server.mjs`), and an SSRF client — measured,
+ * not assumed: `ffmpeg -i http://169.254.169.254/…` opens the socket and
+ * reports what came back.
+ *
+ * Three rules, in the order they are cheapest to check:
+ *
+ * 1. **No opener but the filesystem.** Anything naming a protocol or a
+ *    pseudo-file — `://`, `concat:`, `pipe:`, `/dev/…` — is refused, and
+ *    `-protocol_whitelist file,crypto,data` is injected before *every* input
+ *    so a playlist inside the workspace cannot reach the network either.
+ *    ffmpeg applies that option per input, so one copy at the front covers
+ *    only the first `-i` (verified against ffmpeg 6.1).
+ * 2. **Nothing outside the workspace.** Every non-flag argument is resolved
+ *    against the workspace root and refused when it lands outside, symlinks
+ *    resolved. A filter value carries its path inside the token
+ *    (`subtitles=../../etc/x`), and resolving the whole token catches that
+ *    without parsing filter syntax.
+ * 3. **No stdin.** `-nostdin` keeps a child from inheriting and blocking on
+ *    the server's stdin, which outlives any single run.
+ *
+ * The CPU/memory/disk half of the boundary lives in `host-binaries.ts`:
+ * bounded output capture, a concurrency cap, the wall-clock timeout, and the
+ * artifact-size watchdog.
+ */
+/** What every `-i` gets: local files, plus the two openers that read bytes we already hold. */
+export declare const FFMPEG_PROTOCOL_WHITELIST = "file,crypto,data";
+/**
+ * yt-dlp's download ceiling. It is the binary's own `--max-filesize`, which —
+ * unlike ffmpeg's `-fs` — aborts before writing: measured against yt-dlp
+ * 2026.07.04, a 20 MB file under `--max-filesize 1M` produced no output file.
+ */
+export declare const MAX_DOWNLOAD_BYTES: number;
+export interface ArgvRefusal {
+    error: string;
+}
+/**
+ * Refuse argv that reaches past the workspace, or `undefined` when every
+ * argument stays inside it.
+ *
+ * Flags are skipped: a leading `-` is ffmpeg's option marker, so such an
+ * argument is never a path, and a file named `-x` is unusable by ffmpeg
+ * anyway. Everything else — and every path-shaped piece of it, see
+ * {@link pathCandidates} — is resolved against the workspace root, so an
+ * absolute path, a `..` chain, and a path inside a filter token all land
+ * outside it the same way.
+ *
+ * `remedy` is the one sentence the refusal ends on. It defaults to something
+ * true of every host binary; a caller with a way to put the file where the
+ * binary can see it — `ffmpeg`'s `inputs` — names that instead, so the refusal
+ * points at a parameter rather than at an errand the caller cannot run.
+ */
+export declare function confineArgvToWorkspace(argv: readonly string[], workspace: string, remedy?: string): Promise<ArgvRefusal | undefined>;
+/**
+ * The argv actually spawned: `-nostdin`, then the caller's arguments with
+ * `-protocol_whitelist` in front of every input.
+ *
+ * Refuses a caller who sets `-protocol_whitelist` themselves rather than
+ * silently dropping it — the refusal says which flag the host owns.
+ */
+export declare function hardenFfmpegArgv(argv: readonly string[]): {
+    argv: string[];
+} | ArgvRefusal;
+/**
+ * The argv `yt_dlp` spawns.
+ *
+ * Three of these flags are the boundary rather than configuration:
+ *
+ * - **`--ignore-config`** is the one that matters most. yt-dlp reads a
+ *   *portable* config file — `yt-dlp.conf` in its working directory — and its
+ *   working directory is the workspace, which guest code writes freely. A
+ *   guest that writes `--exec "curl … | sh"` into that file and then calls this
+ *   capability gets arbitrary command execution as the server. Reproduced
+ *   against yt-dlp 2026.07.04, and refused with this flag.
+ * - **`--no-exec`** clears any post-processing command from a source
+ *   `--ignore-config` does not cover.
+ * - **`--`** ends the options, so a URL cannot be read as a flag.
+ *
+ * `--max-filesize` is the disk bound, and `--no-playlist` keeps one URL to one
+ * download.
+ */
+export declare function buildYtDlpArgv(options: {
+    url: string;
+    outputFile: string;
+    format?: string;
+    maxBytes?: number;
+}): string[];
+/**
+ * Refuse a value that would arrive as another flag rather than as the value of
+ * the option it follows. `label` names the field in the refusal.
+ */
+export declare function refuseFlagLikeValue(value: string, label: string): ArgvRefusal | undefined;
+//# sourceMappingURL=host-binary-guard.d.ts.map

package/dist/host-binary-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-binary-guard.d.ts","sourceRoot":"","sources":["../src/host-binary-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAMH,+FAA+F;AAC/F,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAsB5D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAyB,CAAC;AAKzD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAiCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,EACjB,MAAM,SAA+D,GACpE,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAuBlC;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,WAAW,CAiBlC;AAGD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,EAAE,CAkBX;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,WAAW,GAAG,SAAS,CAKzB"}