@octocodeai/octocode-engine 16.5.0

package/dist/security/regexes/payments-commerce.js

@@ -0,0 +1,197 @@
+export const paymentProviderPatterns = [
+    {
+        name: 'stripeSecretKey',
+        description: 'Stripe secret key - live and test (sk_*, rk_*)',
+        regex: /\b[rs]k_(?:live|test)_[a-zA-Z0-9]{20,247}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'stripeWebhookSecret',
+        description: 'Stripe webhook signing secret',
+        regex: /\bwhsec_[a-zA-Z0-9]{32,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'stripePublishableKey',
+        description: 'Stripe publishable key (can indicate key pair presence)',
+        regex: /\bpk_(?:live|test)_[a-zA-Z0-9]{20,247}\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'paypalAccessToken',
+        description: 'PayPal access token',
+        regex: /\bA21AA[a-zA-Z0-9_-]{50,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'paypalBraintreeAccessToken',
+        description: 'PayPal Braintree access token',
+        regex: /\baccess_token\$(?:production|sandbox)\$[0-9a-z]{16}\$[0-9a-f]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'squareAccessToken',
+        description: 'Square access token (all formats)',
+        regex: /\b(?:EAAAE[A-Za-z0-9_-]{94,}|sq0[a-z]?atp-[0-9A-Za-z\-_]{22,26})\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'squareOauthSecret',
+        description: 'Square OAuth secret',
+        regex: /\bsq0csp-[0-9A-Za-z\-_]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'squareApplicationId',
+        description: 'Square application ID',
+        regex: /\bsq0ids-[a-zA-Z0-9_-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'shopifyPrivateAppPassword',
+        description: 'Shopify private app password',
+        regex: /\bshppa_[a-fA-F0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'shopifyAccessToken',
+        description: 'Shopify access token',
+        regex: /\bshpat_[a-fA-F0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'shopifyWebhookToken',
+        description: 'Shopify webhook token',
+        regex: /\bshpwh_[a-fA-F0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'adyenApiKey',
+        description: 'Adyen API key',
+        regex: /\bAQE[a-zA-Z0-9]{70,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'razorpayApiKey',
+        description: 'Razorpay API key',
+        regex: /\brzp_(?:test|live)_[a-zA-Z0-9]{14}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'flutterwaveKeys',
+        description: 'Flutterwave API keys',
+        regex: /\bFLW(?:PUBK|SECK)_(?:TEST|LIVE)-[a-h0-9]{32}-X\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'coinbaseAccessToken',
+        description: 'Coinbase access token',
+        regex: /\b['"]?(?:coinbase)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9_-]{64}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'krakenAccessToken',
+        description: 'Kraken access token',
+        regex: /\b['"]?(?:kraken)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9/=_+-]{80,90}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'kucoinAccessToken',
+        description: 'Kucoin access token',
+        regex: /\b['"]?(?:kucoin)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{24}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'kucoinSecretKey',
+        description: 'Kucoin secret key',
+        regex: /\b['"]?(?:kucoin)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'bittrexAccessKey',
+        description: 'Bittrex access key',
+        regex: /\b['"]?(?:bittrex)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{32}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'binanceApiKey',
+        description: 'Binance API key',
+        regex: /\b['"]?(?:binance)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[A-Za-z0-9]{64}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'bybitApiKey',
+        description: 'Bybit API key',
+        regex: /\b['"]?(?:bybit)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[A-Za-z0-9]{18,24}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'gocardlessApiToken',
+        description: 'GoCardless API token',
+        regex: /\blive_[a-z0-9\-_=]{40}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'plaidApiToken',
+        description: 'Plaid API token',
+        regex: /\baccess-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'plaidClientId',
+        description: 'Plaid client ID',
+        regex: /\b['"]?(?:PLAID|plaid)_?(?:CLIENT|client)_?(?:ID|id)['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{24}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'lemonSqueezyApiKey',
+        description: 'Lemon Squeezy API key',
+        regex: /\b['"]?(?:LEMONSQUEEZY|LEMON_SQUEEZY|lemonsqueezy)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?eyJ[a-zA-Z0-9_-]{100,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'paddleApiKey',
+        description: 'Paddle API key',
+        regex: /\b['"]?(?:PADDLE|paddle)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?pdl_(?:live|sdbx)_[a-zA-Z0-9]{40,}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'mollieApiKey',
+        description: 'Mollie API key',
+        regex: /\b(?:live|test)_[a-zA-Z0-9]{30,}\b/g,
+        matchAccuracy: 'medium',
+        fileContext: /mollie/i,
+    },
+];
+export const ecommerceContentPatterns = [
+    {
+        name: 'shopifyStorefrontAccessToken',
+        description: 'Shopify storefront API access token',
+        regex: /\bshpatf_[0-9a-f]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'woocommerceConsumerKey',
+        description: 'WooCommerce consumer key',
+        regex: /\bck_[a-f0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'woocommerceConsumerSecret',
+        description: 'WooCommerce consumer secret',
+        regex: /\bcs_[a-f0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'contentfulAccessToken',
+        description: 'Contentful access token',
+        regex: /\bCFPAT-[0-9a-zA-Z]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'mailchimpEcommerceApiKey',
+        description: 'MailChimp E-commerce API key',
+        regex: /\b[0-9a-f]{32}-[a-z]{2,3}[0-9]{1,2}\b/g,
+        matchAccuracy: 'high',
+    },
+];

package/dist/security/regexes/types.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from '../types.js';
+export type { SensitiveDataPattern };

package/dist/security/regexes/types.js

@@ -0,0 +1 @@
+export {};

package/dist/security/regexes/vcs.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const versionControlPatterns: SensitiveDataPattern[];

package/dist/security/regexes/vcs.js

@@ -0,0 +1,105 @@
+export const versionControlPatterns = [
+    {
+        name: 'gitlabPersonalAccessToken',
+        description: 'GitLab personal access token',
+        regex: /\bglpat-[A-Za-z0-9_-]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabDeployToken',
+        description: 'GitLab deploy token',
+        regex: /\bgldt-[A-Za-z0-9_-]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabRunnerToken',
+        description: 'GitLab runner registration token',
+        regex: /\bglrt-[A-Za-z0-9_-]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabCiJobToken',
+        description: 'GitLab CI/CD job token',
+        regex: /\bglcbt-[0-9a-zA-Z]{1,5}_[0-9a-zA-Z_-]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabPipelineTriggerToken',
+        description: 'GitLab pipeline trigger token',
+        regex: /\bglptt-[0-9a-f]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'bitbucketAppPassword',
+        description: 'Bitbucket app password',
+        regex: /\bATBB[a-zA-Z0-9]{24}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'githubTokens',
+        description: 'GitHub personal access token (classic)',
+        regex: /\b((?:ghp|gho|ghu|ghs|ghr|github_pat)_[a-zA-Z0-9_]{36,255})\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'githubFineGrainedToken',
+        description: 'GitHub fine-grained personal access token',
+        regex: /\bgithub_pat_[A-Za-z0-9_]{82}\b/g,
+        matchAccuracy: 'high',
+        fileContext: /(?:\.env|config|settings|secrets)/i,
+    },
+    {
+        name: 'githubAppInstallationToken',
+        description: 'GitHub App installation token',
+        regex: /\bghs_[0-9a-zA-Z]{37}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabScimToken',
+        description: 'GitLab SCIM token',
+        regex: /\bglsoat-[0-9a-zA-Z_-]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabFeatureFlagToken',
+        description: 'GitLab feature flag client token',
+        regex: /\bglffct-[0-9a-zA-Z_-]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabFeedToken',
+        description: 'GitLab feed token',
+        regex: /\bglft-[0-9a-zA-Z_-]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabIncomingMailToken',
+        description: 'GitLab incoming mail token',
+        regex: /\bglimt-[0-9a-zA-Z_-]{25}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabK8sAgentToken',
+        description: 'GitLab Kubernetes agent token',
+        regex: /\bglagent-[0-9a-zA-Z_-]{50}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabOAuthAppSecret',
+        description: 'GitLab OAuth application secret',
+        regex: /\bgloas-[0-9a-zA-Z_-]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gitlabSessionCookie',
+        description: 'GitLab session cookie',
+        regex: /_gitlab_session=[0-9a-z]{32}/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'bitbucketRepoToken',
+        description: 'Bitbucket repository access token',
+        regex: /\bATCTT3[a-zA-Z0-9]{24}\b/g,
+        matchAccuracy: 'high',
+    },
+];

package/dist/security/registry.d.ts

@@ -0,0 +1,48 @@
+import type { SensitiveDataPattern } from './types.js';
+export interface ISecurityRegistry {
+    readonly extraSecretPatterns: readonly SensitiveDataPattern[];
+    readonly extraAllowedCommands: readonly string[];
+    readonly extraAllowedRoots: readonly string[];
+    readonly extraIgnoredPathPatterns: readonly RegExp[];
+    readonly extraIgnoredFilePatterns: readonly RegExp[];
+    readonly version: number;
+    readonly frozen: boolean;
+    addSecretPatterns(patterns: SensitiveDataPattern[]): void;
+    addAllowedCommands(commands: string[]): void;
+    addAllowedRoots(roots: string[]): void;
+    addIgnoredPathPatterns(patterns: RegExp[]): void;
+    addIgnoredFilePatterns(patterns: RegExp[]): void;
+    freeze(): void;
+    reset(): void;
+}
+export declare class SecurityRegistry implements ISecurityRegistry {
+    private _extraSecretPatterns;
+    private _extraAllowedCommands;
+    private _extraAllowedRoots;
+    private _extraIgnoredPathPatterns;
+    private _extraIgnoredFilePatterns;
+    private _version;
+    private _frozen;
+    private _frozenSecretPatterns;
+    private _frozenAllowedCommands;
+    private _frozenAllowedRoots;
+    private _frozenIgnoredPathPatterns;
+    private _frozenIgnoredFilePatterns;
+    get frozen(): boolean;
+    private _assertMutable;
+    private _invalidateFrozenCaches;
+    get version(): number;
+    get extraSecretPatterns(): readonly SensitiveDataPattern[];
+    get extraAllowedCommands(): readonly string[];
+    get extraAllowedRoots(): readonly string[];
+    get extraIgnoredPathPatterns(): readonly RegExp[];
+    get extraIgnoredFilePatterns(): readonly RegExp[];
+    addSecretPatterns(patterns: SensitiveDataPattern[]): void;
+    addAllowedCommands(commands: string[]): void;
+    addAllowedRoots(roots: string[]): void;
+    addIgnoredPathPatterns(patterns: RegExp[]): void;
+    addIgnoredFilePatterns(patterns: RegExp[]): void;
+    freeze(): void;
+    reset(): void;
+}
+export declare const securityRegistry: SecurityRegistry;

package/dist/security/registry.js

@@ -0,0 +1,156 @@
+import { normalizeCommandName } from './commandUtils.js';
+const REDOS_TIMEOUT_MS = 50;
+const REDOS_TEST_INPUT = 'a'.repeat(100);
+function isReDoSSafe(regex) {
+    const start = performance.now();
+    try {
+        regex.test(REDOS_TEST_INPUT);
+    }
+    catch {
+        return false;
+    }
+    return performance.now() - start < REDOS_TIMEOUT_MS;
+}
+export class SecurityRegistry {
+    _extraSecretPatterns = [];
+    _extraAllowedCommands = [];
+    _extraAllowedRoots = [];
+    _extraIgnoredPathPatterns = [];
+    _extraIgnoredFilePatterns = [];
+    _version = 0;
+    _frozen = false;
+    _frozenSecretPatterns = null;
+    _frozenAllowedCommands = null;
+    _frozenAllowedRoots = null;
+    _frozenIgnoredPathPatterns = null;
+    _frozenIgnoredFilePatterns = null;
+    get frozen() {
+        return this._frozen;
+    }
+    _assertMutable() {
+        if (this._frozen) {
+            throw new Error('SecurityRegistry is frozen — call reset() to unfreeze before mutating');
+        }
+    }
+    _invalidateFrozenCaches() {
+        this._frozenSecretPatterns = null;
+        this._frozenAllowedCommands = null;
+        this._frozenAllowedRoots = null;
+        this._frozenIgnoredPathPatterns = null;
+        this._frozenIgnoredFilePatterns = null;
+    }
+    get version() {
+        return this._version;
+    }
+    get extraSecretPatterns() {
+        return (this._frozenSecretPatterns ??= Object.freeze([
+            ...this._extraSecretPatterns,
+        ]));
+    }
+    get extraAllowedCommands() {
+        return (this._frozenAllowedCommands ??= Object.freeze([
+            ...this._extraAllowedCommands,
+        ]));
+    }
+    get extraAllowedRoots() {
+        return (this._frozenAllowedRoots ??= Object.freeze([
+            ...this._extraAllowedRoots,
+        ]));
+    }
+    get extraIgnoredPathPatterns() {
+        return (this._frozenIgnoredPathPatterns ??= Object.freeze([
+            ...this._extraIgnoredPathPatterns,
+        ]));
+    }
+    get extraIgnoredFilePatterns() {
+        return (this._frozenIgnoredFilePatterns ??= Object.freeze([
+            ...this._extraIgnoredFilePatterns,
+        ]));
+    }
+    addSecretPatterns(patterns) {
+        this._assertMutable();
+        for (const p of patterns) {
+            if (!p.name || !p.regex) {
+                throw new Error('Each pattern must have a name and regex');
+            }
+            if (!isReDoSSafe(p.regex)) {
+                throw new Error(`Pattern '${p.name}' failed ReDoS safety check — regex may cause catastrophic backtracking`);
+            }
+            if (!this._extraSecretPatterns.some(e => e.name === p.name)) {
+                this._extraSecretPatterns.push(p);
+            }
+        }
+        this._invalidateFrozenCaches();
+        this._version++;
+    }
+    addAllowedCommands(commands) {
+        this._assertMutable();
+        for (const cmd of commands) {
+            if (typeof cmd !== 'string' || cmd.trim() === '') {
+                throw new Error('Each command must be a non-empty string');
+            }
+            const normalized = normalizeCommandName(cmd);
+            if (!this._extraAllowedCommands.includes(normalized)) {
+                this._extraAllowedCommands.push(normalized);
+            }
+        }
+        this._invalidateFrozenCaches();
+        this._version++;
+    }
+    addAllowedRoots(roots) {
+        this._assertMutable();
+        for (const root of roots) {
+            if (typeof root !== 'string' || root.trim() === '') {
+                throw new Error('Each root must be a non-empty string');
+            }
+            if (!this._extraAllowedRoots.includes(root)) {
+                this._extraAllowedRoots.push(root);
+            }
+        }
+        this._invalidateFrozenCaches();
+        this._version++;
+    }
+    addIgnoredPathPatterns(patterns) {
+        this._assertMutable();
+        for (const p of patterns) {
+            if (!isReDoSSafe(p)) {
+                throw new Error(`Path pattern /${p.source}/ failed ReDoS safety check`);
+            }
+            if (!this._extraIgnoredPathPatterns.some(e => e.source === p.source)) {
+                this._extraIgnoredPathPatterns.push(p);
+            }
+        }
+        this._invalidateFrozenCaches();
+        this._version++;
+    }
+    addIgnoredFilePatterns(patterns) {
+        this._assertMutable();
+        for (const p of patterns) {
+            if (!isReDoSSafe(p)) {
+                throw new Error(`File pattern /${p.source}/ failed ReDoS safety check`);
+            }
+            if (!this._extraIgnoredFilePatterns.some(e => e.source === p.source)) {
+                this._extraIgnoredFilePatterns.push(p);
+            }
+        }
+        this._invalidateFrozenCaches();
+        this._version++;
+    }
+    freeze() {
+        this._frozen = true;
+    }
+    reset() {
+        this._frozen = false;
+        this._extraSecretPatterns = [];
+        this._extraAllowedCommands = [];
+        this._extraAllowedRoots = [];
+        this._extraIgnoredPathPatterns = [];
+        this._extraIgnoredFilePatterns = [];
+        this._invalidateFrozenCaches();
+        this._version++;
+    }
+}
+const GLOBAL_KEY = '__octocode_security_registry__';
+export const securityRegistry = globalThis[GLOBAL_KEY] ??
+    (globalThis[GLOBAL_KEY] =
+        new SecurityRegistry());

package/dist/security/securityConstants.d.ts

@@ -0,0 +1,3 @@
+export declare const ALLOWED_COMMANDS: readonly ["rg", "ls", "find", "grep", "git"];
+export declare const DANGEROUS_PATTERNS: readonly [RegExp, RegExp, RegExp];
+export declare const PATTERN_DANGEROUS_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp];

package/dist/security/securityConstants.js

@@ -0,0 +1,12 @@
+export const ALLOWED_COMMANDS = ['rg', 'ls', 'find', 'grep', 'git'];
+export const DANGEROUS_PATTERNS = [
+    /[;&|`$(){}[\]<>]/, // Shell metacharacters
+    /\${/,
+    /\$\(/,
+];
+export const PATTERN_DANGEROUS_PATTERNS = [
+    /\${/,
+    /\$\(/,
+    /`/, // Backtick substitution
+    /;/,
+];

package/dist/security/types.d.ts

@@ -0,0 +1,35 @@
+export interface SensitiveDataPattern {
+    name: string;
+    description: string;
+    regex: RegExp;
+    fileContext?: RegExp;
+    matchAccuracy?: 'high' | 'medium';
+}
+export interface SanitizationResult {
+    content: string;
+    hasSecrets: boolean;
+    secretsDetected: string[];
+    warnings: string[];
+}
+export interface ValidationResult {
+    sanitizedParams: Record<string, unknown>;
+    isValid: boolean;
+    hasSecrets: boolean;
+    warnings: string[];
+}
+export interface PathValidationResult {
+    isValid: boolean;
+    error?: string;
+    sanitizedPath?: string;
+}
+export interface ToolResult {
+    content: Array<{
+        type: string;
+        text?: string;
+    }>;
+    isError?: boolean;
+}
+export interface ISanitizer {
+    sanitizeContent(content: string, filePath?: string): SanitizationResult;
+    validateInputParameters(params: Record<string, unknown>): ValidationResult;
+}

package/dist/security/types.js

@@ -0,0 +1 @@
+export {};

package/dist/security/withSecurityValidation.d.ts

@@ -0,0 +1,21 @@
+import type { ISanitizer, ToolResult } from './types.js';
+export interface SecurityDepsConfig {
+    sanitizer?: ISanitizer;
+    defaultTimeoutMs?: number;
+    logToolCall?: (toolName: string, repos: string[], goal?: string, rGoal?: string, reasoning?: string) => Promise<void>;
+    logSessionError?: (toolName: string, errorCode: string) => Promise<void>;
+    isLoggingEnabled?: () => boolean;
+}
+export declare function configureSecurity(deps: SecurityDepsConfig): void;
+export declare function withSecurityValidation<T extends Record<string, unknown>, TAuth = unknown>(toolName: string, toolHandler: (sanitizedArgs: T, authInfo?: TAuth, sessionId?: string) => Promise<ToolResult>, options?: {
+    timeoutMs?: number;
+}): (args: unknown, extra: {
+    authInfo?: TAuth;
+    sessionId?: string;
+    signal?: AbortSignal;
+}) => Promise<ToolResult>;
+export declare function withBasicSecurityValidation<T extends object>(toolHandler: (sanitizedArgs: T) => Promise<ToolResult>, toolName?: string, options?: {
+    timeoutMs?: number;
+}): (args: unknown, extra?: {
+    signal?: AbortSignal;
+}) => Promise<ToolResult>;