@papicandela/mcx-core 0.2.2 → 0.2.5

package/dist/index.js

@@ -32,80 +32,132 @@ function generateNetworkIsolationCode(policy) {
   if (policy.mode === "blocked") {
     return `
 // Network isolation: BLOCKED
-const __original_fetch = globalThis.fetch;
-globalThis.fetch = async function(url, options) {
-  throw new Error('Network access is blocked in sandbox. Use adapters instead.');
-};
+(function() {
+  const blockedFetch = async function() {
+    throw new Error('Network access is blocked in sandbox. Use adapters instead.');
+  };
+  Object.defineProperty(globalThis, 'fetch', {
+    value: blockedFetch,
+    writable: false,
+    configurable: false
+  });
+})();
 
 // Block XMLHttpRequest
-globalThis.XMLHttpRequest = class {
-  constructor() {
-    throw new Error('XMLHttpRequest is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'XMLHttpRequest', {
+  value: class {
+    constructor() {
+      throw new Error('XMLHttpRequest is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 
 // Block WebSocket
-globalThis.WebSocket = class {
-  constructor(url) {
-    throw new Error('WebSocket is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'WebSocket', {
+  value: class {
+    constructor() {
+      throw new Error('WebSocket is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 
 // Block EventSource (SSE)
-globalThis.EventSource = class {
-  constructor(url) {
-    throw new Error('EventSource is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'EventSource', {
+  value: class {
+    constructor() {
+      throw new Error('EventSource is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 `;
   }
   const domainsJson = JSON.stringify(policy.domains);
   return `
 // Network isolation: ALLOWED (whitelist)
-const __allowed_domains = ${domainsJson};
-const __original_fetch = globalThis.fetch;
+(function() {
+  const _domains = ${domainsJson};
+  const _real_fetch = globalThis.fetch;
 
-function __isUrlAllowed(url) {
-  try {
-    const hostname = new URL(url).hostname;
-    return __allowed_domains.some(d => hostname === d || hostname.endsWith('.' + d));
-  } catch {
-    return false;
+  // Block private/link-local IPs to prevent DNS rebinding attacks
+  function _isPrivateIp(hostname) {
+    return /^(localhost|127\\.|10\\.|192\\.168\\.|172\\.(1[6-9]|2\\d|3[01])\\.|169\\.254\\.|\\[::1\\]|\\[fc|\\[fd)/.test(hostname);
   }
-}
 
-globalThis.fetch = async function(url, options) {
-  const urlStr = typeof url === 'string' ? url : url instanceof URL ? url.toString() : url.url;
-  if (!__isUrlAllowed(urlStr)) {
-    const hostname = new URL(urlStr).hostname;
-    throw new Error(\`Network access blocked: \${hostname} not in allowed domains: \${__allowed_domains.join(', ')}\`);
+  function _isUrlAllowed(url) {
+    try {
+      const parsed = new URL(url);
+      // Only allow http/https protocols
+      if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return false;
+      const hostname = parsed.hostname;
+      if (!hostname || _isPrivateIp(hostname)) return false;
+      return _domains.some(d => d && (hostname === d || hostname.endsWith('.' + d)));
+    } catch {
+      return false;
+    }
   }
-  return __original_fetch(url, options);
-};
+
+  const whitelistedFetch = async function(url, options) {
+    // Safely extract URL string from various input types
+    let urlStr;
+    try {
+      if (typeof url === 'string') urlStr = url;
+      else if (url instanceof URL) urlStr = url.toString();
+      else if (url && typeof url.url === 'string') urlStr = url.url;
+      else throw new Error('Invalid URL type');
+    } catch {
+      throw new Error('Network access blocked: could not determine request URL.');
+    }
+    if (!_isUrlAllowed(urlStr)) {
+      throw new Error('Network access blocked: domain not in allowed list.');
+    }
+    return _real_fetch(url, options);
+  };
+
+  Object.defineProperty(globalThis, 'fetch', {
+    value: whitelistedFetch,
+    writable: false,
+    configurable: false
+  });
+})();
 
 // Block XMLHttpRequest (not easily whitelistable)
-globalThis.XMLHttpRequest = class {
-  constructor() {
-    throw new Error('XMLHttpRequest is blocked. Use fetch() with allowed domains.');
-  }
-};
+Object.defineProperty(globalThis, 'XMLHttpRequest', {
+  value: class {
+    constructor() {
+      throw new Error('XMLHttpRequest is blocked. Use fetch() with allowed domains.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 
-// Block WebSocket (would need separate whitelist)
-globalThis.WebSocket = class {
-  constructor(url) {
-    if (!__isUrlAllowed(url)) {
-      throw new Error('WebSocket blocked: domain not in allowed list.');
+// Block WebSocket - opaque error to prevent allowlist enumeration
+Object.defineProperty(globalThis, 'WebSocket', {
+  value: class {
+    constructor() {
+      throw new Error('WebSocket is not supported in sandbox.');
     }
-    throw new Error('WebSocket not supported in sandbox even for allowed domains.');
-  }
-};
+  },
+  writable: false,
+  configurable: false
+});
 
 // Block EventSource
-globalThis.EventSource = class {
-  constructor(url) {
-    throw new Error('EventSource is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'EventSource', {
+  value: class {
+    constructor() {
+      throw new Error('EventSource is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 `;
 }
 
@@ -5587,24 +5639,31 @@ function isLiteralTrue(node) {
     return false;
   return node.type === "Literal" && node.value === true;
 }
-function hasBreak(node) {
+function hasExitStatement(node) {
   if (node.type === "BreakStatement")
     return true;
+  if (node.type === "ReturnStatement")
+    return true;
+  if (node.type === "ThrowStatement")
+    return true;
   if (node.type === "WhileStatement" || node.type === "ForStatement" || node.type === "ForInStatement" || node.type === "ForOfStatement" || node.type === "DoWhileStatement" || node.type === "SwitchStatement") {
     return false;
   }
+  if (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") {
+    return false;
+  }
   for (const key of Object.keys(node)) {
     const child = node[key];
     if (child && typeof child === "object") {
       if (Array.isArray(child)) {
         for (const item of child) {
           if (item && typeof item === "object" && "type" in item) {
-            if (hasBreak(item))
+            if (hasExitStatement(item))
               return true;
           }
         }
       } else if ("type" in child) {
-        if (hasBreak(child))
+        if (hasExitStatement(child))
           return true;
       }
     }
@@ -5614,25 +5673,35 @@ function hasBreak(node) {
 var rule = {
   name: "no-infinite-loop",
   severity: "error",
-  description: "Disallow infinite loops without break statements",
-  visits: ["WhileStatement", "ForStatement"],
+  description: "Disallow infinite loops without exit statements",
+  visits: ["WhileStatement", "ForStatement", "DoWhileStatement"],
   visitors: {
     WhileStatement(node, context) {
       const whileNode = node;
-      if (isLiteralTrue(whileNode.test) && !hasBreak(whileNode.body)) {
+      if (isLiteralTrue(whileNode.test) && !hasExitStatement(whileNode.body)) {
         context.report({
           severity: "error",
-          message: "Infinite loop: while(true) without break",
+          message: "Infinite loop: while(true) without break/return/throw",
           line: context.getLine(node)
         });
       }
     },
     ForStatement(node, context) {
       const forNode = node;
-      if (!forNode.test && !hasBreak(forNode.body)) {
+      if (!forNode.test && !hasExitStatement(forNode.body)) {
         context.report({
           severity: "error",
-          message: "Infinite loop: for(;;) without break",
+          message: "Infinite loop: for(;;) without break/return/throw",
+          line: context.getLine(node)
+        });
+      }
+    },
+    DoWhileStatement(node, context) {
+      const doWhileNode = node;
+      if (isLiteralTrue(doWhileNode.test) && !hasExitStatement(doWhileNode.body)) {
+        context.report({
+          severity: "error",
+          message: "Infinite loop: do...while(true) without break/return/throw",
           line: context.getLine(node)
         });
       }
@@ -5938,49 +6007,100 @@ var EVAL_NAME = "ev" + "al";
 var FUNC_CONSTRUCTOR = "Func" + "tion";
 var REQUIRE_NAME = "req" + "uire";
 var PROCESS_NAME = "pro" + "cess";
+var DANGEROUS_GLOBALS = ["globalThis", "self", "window"];
+function isConstructorOnFunction(node) {
+  const prop = node.property;
+  const isConstructorAccess = !node.computed && prop.type === "Identifier" && prop.name === "constructor" || node.computed && prop.type === "Literal" && prop.value === "constructor";
+  if (!isConstructorAccess)
+    return false;
+  const obj = node.object;
+  if (obj.type === "FunctionExpression" || obj.type === "ArrowFunctionExpression") {
+    return true;
+  }
+  if (obj.type === "CallExpression") {
+    const call = obj;
+    if (call.callee.type === "MemberExpression") {
+      const callee = call.callee;
+      if (callee.object.type === "Identifier" && callee.object.name === "Object" && callee.property.type === "Identifier" && callee.property.name === "getPrototypeOf") {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 var rule5 = {
   name: "no-dangerous-globals",
   severity: "warn",
-  description: "Warn about dangerous globals not available in sandbox",
-  visits: ["CallExpression", "NewExpression", "Identifier", "MemberExpression"],
+  description: "Block dangerous globals that could escape sandbox",
+  visits: ["CallExpression", "NewExpression", "MemberExpression"],
   visitors: {
     CallExpression(node, context) {
       const callExpr = node;
-      if (callExpr.callee.type === "Identifier" && callExpr.callee.name === EVAL_NAME) {
+      const calleeName = callExpr.callee.type === "Identifier" ? callExpr.callee.name : null;
+      if (calleeName === EVAL_NAME) {
         context.report({
-          severity: "warn",
-          message: `${EVAL_NAME}() is not available in sandbox`,
+          severity: "error",
+          message: `${EVAL_NAME}() is blocked in sandbox - potential code injection`,
           line: context.getLine(node)
         });
         return;
       }
-      if (callExpr.callee.type === "Identifier" && callExpr.callee.name === REQUIRE_NAME) {
+      if (calleeName === FUNC_CONSTRUCTOR) {
         context.report({
-          severity: "warn",
-          message: `${REQUIRE_NAME}() is not available in sandbox - use adapters instead`,
+          severity: "error",
+          message: `${FUNC_CONSTRUCTOR}() is blocked in sandbox - potential code injection`,
           line: context.getLine(node)
         });
         return;
       }
-    },
-    NewExpression(node, context) {
-      const newExpr = node;
-      if (newExpr.callee.type === "Identifier" && newExpr.callee.name === FUNC_CONSTRUCTOR) {
+      if (calleeName === REQUIRE_NAME) {
         context.report({
-          severity: "warn",
-          message: `${FUNC_CONSTRUCTOR} constructor is not recommended in sandbox`,
+          severity: "error",
+          message: `${REQUIRE_NAME}() is blocked in sandbox - could access dangerous modules`,
           line: context.getLine(node)
         });
+        return;
+      }
+      if (callExpr.callee.type === "MemberExpression") {
+        if (isConstructorOnFunction(callExpr.callee)) {
+          context.report({
+            severity: "error",
+            message: `Accessing .constructor on functions is blocked - potential sandbox escape`,
+            line: context.getLine(node)
+          });
+          return;
+        }
       }
     },
-    Identifier(node, context) {
-      const identifier = node;
-      if (identifier.name === PROCESS_NAME) {
+    NewExpression(node, context) {
+      const newExpr = node;
+      if (newExpr.callee.type === "Identifier" && newExpr.callee.name === FUNC_CONSTRUCTOR) {
         context.report({
-          severity: "warn",
-          message: `'${PROCESS_NAME}' is not available in sandbox`,
+          severity: "error",
+          message: `${FUNC_CONSTRUCTOR} constructor is blocked in sandbox - potential code injection`,
           line: context.getLine(node)
         });
+        return;
+      }
+      if (newExpr.callee.type === "MemberExpression") {
+        if (isConstructorOnFunction(newExpr.callee)) {
+          context.report({
+            severity: "error",
+            message: `Accessing .constructor on functions is blocked - potential sandbox escape`,
+            line: context.getLine(node)
+          });
+          return;
+        }
+      }
+      if (newExpr.callee.type === "MemberExpression") {
+        const member = newExpr.callee;
+        if (member.object.type === "Identifier" && DANGEROUS_GLOBALS.includes(member.object.name) && member.property.type === "Identifier" && member.property.name === FUNC_CONSTRUCTOR) {
+          context.report({
+            severity: "error",
+            message: `${FUNC_CONSTRUCTOR} constructor is blocked in sandbox - potential code injection`,
+            line: context.getLine(node)
+          });
+        }
       }
     },
     MemberExpression(node, context) {
@@ -5991,6 +6111,14 @@ var rule5 = {
           message: `'${PROCESS_NAME}' is not available in sandbox`,
           line: context.getLine(node)
         });
+        return;
+      }
+      if (memberExpr.object.type === "Identifier" && DANGEROUS_GLOBALS.includes(memberExpr.object.name) && memberExpr.property.type === "Identifier" && memberExpr.property.name === FUNC_CONSTRUCTOR) {
+        context.report({
+          severity: "error",
+          message: `Accessing ${FUNC_CONSTRUCTOR} via globals is blocked - potential sandbox escape`,
+          line: context.getLine(node)
+        });
       }
     }
   }
@@ -6130,7 +6258,7 @@ function analyze(code, config = {}) {
   const errors = findings.filter((f) => f.severity === "error");
   const elapsed = performance.now() - start;
   if (elapsed > 50) {
-    console.warn(`[mcx-analyzer] Exceeded 50ms budget: ${elapsed.toFixed(1)}ms`);
+    console.error(`[mcx-analyzer] Exceeded 50ms budget: ${elapsed.toFixed(1)}ms`);
   }
   return { warnings, errors, elapsed };
 }
@@ -6210,14 +6338,17 @@ class BunWorkerSandbox {
       const url = URL.createObjectURL(blob);
       const worker = new Worker(url);
       let resolved = false;
+      let timeoutId;
       const cleanup = () => {
         if (!resolved) {
           resolved = true;
+          if (timeoutId)
+            clearTimeout(timeoutId);
           worker.terminate();
           URL.revokeObjectURL(url);
         }
       };
-      const timeoutId = setTimeout(() => {
+      timeoutId = setTimeout(() => {
         if (!resolved) {
           cleanup();
           resolve({
@@ -6229,6 +6360,8 @@ class BunWorkerSandbox {
         }
       }, this.config.timeout);
       worker.onmessage = async (event) => {
+        if (resolved)
+          return;
         const { type, ...data2 } = event.data;
         if (type === "ready") {
           worker.postMessage({ type: "execute", data: { code: normalizedCode } });
@@ -6246,7 +6379,6 @@ class BunWorkerSandbox {
             worker.postMessage({ type: "adapter_result", data: { id, error } });
           }
         } else if (type === "result") {
-          clearTimeout(timeoutId);
           cleanup();
           resolve({
             success: data2.success,
@@ -6258,7 +6390,6 @@ class BunWorkerSandbox {
         }
       };
       worker.onerror = (error) => {
-        clearTimeout(timeoutId);
         cleanup();
         resolve({
           success: false,
@@ -6287,11 +6418,27 @@ class BunWorkerSandbox {
       const pendingCalls = new Map();
       let callId = 0;
 
+      // Safe stringify that handles BigInt and circular refs
+      const safeStr = (val) => {
+        if (typeof val !== 'object' || val === null) return String(val);
+        try {
+          const seen = new WeakSet();
+          return JSON.stringify(val, (k, v) => {
+            if (typeof v === 'bigint') return v.toString() + 'n';
+            if (typeof v === 'object' && v !== null) {
+              if (seen.has(v)) return '[Circular]';
+              seen.add(v);
+            }
+            return v;
+          });
+        } catch { return String(val); }
+      };
+
       const console = {
-        log: (...args) => logs.push(args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
-        warn: (...args) => logs.push('[WARN] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
-        error: (...args) => logs.push('[ERROR] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
-        info: (...args) => logs.push('[INFO] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
+        log: (...args) => logs.push(args.map(safeStr).join(' ')),
+        warn: (...args) => logs.push('[WARN] ' + args.map(safeStr).join(' ')),
+        error: (...args) => logs.push('[ERROR] ' + args.map(safeStr).join(' ')),
+        info: (...args) => logs.push('[INFO] ' + args.map(safeStr).join(' ')),
       };
       globalThis.console = console;
 
@@ -6341,21 +6488,41 @@ class BunWorkerSandbox {
         return arr.slice(0, n);
       };
 
+      // SECURITY: Reserved keys that must not be overwritten by user-provided variables/globals
+      const RESERVED_KEYS = new Set([
+        'onmessage', 'postMessage', 'close', 'terminate', 'self',
+        'constructor', 'prototype', '__proto__',
+        'pendingCalls', 'callId', 'logs', 'console', 'adapters',
+        'fetch', 'XMLHttpRequest', 'WebSocket', 'EventSource',
+        'pick', 'table', 'count', 'sum', 'first', 'safeStr'
+      ]);
+
       self.onmessage = async (event) => {
         const { type, data } = event.data;
 
         if (type === 'init') {
           const { variables, adapterMethods, globals } = data;
 
+          // Inject user variables (skip reserved keys to prevent internal state corruption)
           for (const [key, value] of Object.entries(variables || {})) {
+            if (RESERVED_KEYS.has(key)) {
+              logs.push('[WARN] Skipped reserved variable key: ' + key);
+              continue;
+            }
             globalThis[key] = value;
           }
 
+          // Inject sandbox globals (skip reserved keys)
           for (const [key, value] of Object.entries(globals || {})) {
+            if (RESERVED_KEYS.has(key)) {
+              logs.push('[WARN] Skipped reserved globals key: ' + key);
+              continue;
+            }
             globalThis[key] = value;
           }
 
-          globalThis.adapters = {};
+          // Create adapter proxies and freeze them to prevent user code modification
+          const adaptersObj = {};
           for (const [adapterName, methods] of Object.entries(adapterMethods)) {
             const adapterObj = {};
             for (const methodName of methods) {
@@ -6373,9 +6540,23 @@ class BunWorkerSandbox {
                 });
               };
             }
-            globalThis.adapters[adapterName] = adapterObj;
-            globalThis[adapterName] = adapterObj;
+            // Freeze individual adapter to prevent method tampering
+            Object.freeze(adapterObj);
+            adaptersObj[adapterName] = adapterObj;
+            // Also expose at top level but as non-writable
+            Object.defineProperty(globalThis, adapterName, {
+              value: adapterObj,
+              writable: false,
+              configurable: false
+            });
           }
+          // Freeze the adapters namespace and make it non-writable
+          Object.freeze(adaptersObj);
+          Object.defineProperty(globalThis, 'adapters', {
+            value: adaptersObj,
+            writable: false,
+            configurable: false
+          });
 
           self.postMessage({ type: 'ready' });
         }
@@ -6398,10 +6579,12 @@ class BunWorkerSandbox {
             const result = await fn();
             self.postMessage({ type: 'result', success: true, value: result, logs });
           } catch (err) {
+            // Truncate stack to 5 lines to prevent context bloat
+            const stack = err.stack ? err.stack.split('\\n').slice(0, 5).join('\\n') : undefined;
             self.postMessage({
               type: 'result',
               success: false,
-              error: { name: err.name, message: err.message, stack: err.stack },
+              error: { name: err.name, message: err.message, stack },
               logs
             });
           }
@@ -10411,12 +10594,12 @@ function createParameterValidator(params) {
       default:
         schema = exports_external.unknown();
     }
-    if (param.default !== undefined) {
-      schema = schema.default(param.default);
-    }
     if (!param.required) {
       schema = schema.optional();
     }
+    if (param.default !== undefined) {
+      schema = schema.default(param.default);
+    }
     shape[param.name] = schema;
   }
   return exports_external.object(shape);
@@ -10559,7 +10742,10 @@ var DEFAULT_CONFIG2 = {
     timeout: 5000,
     memoryLimit: 128,
     allowAsync: true,
-    globals: {}
+    globals: {},
+    networkPolicy: DEFAULT_NETWORK_POLICY,
+    normalizeCode: true,
+    analysis: DEFAULT_ANALYSIS_CONFIG
   },
   adaptersDir: "./adapters",
   skillsDir: "./skills"
@@ -10653,21 +10839,22 @@ function generateTypes(adapters, options = {}) {
     const safeName = sanitizeIdentifier(adapter.name);
     for (const [toolName, tool] of Object.entries(adapter.tools)) {
       if (tool.parameters && Object.keys(tool.parameters).length > 0) {
-        const inputTypeName = `${capitalize(safeName)}_${capitalize(toolName)}_Input`;
+        const safeToolNameForType = sanitizeIdentifier(toolName);
+        const inputTypeName = `${capitalize(safeName)}_${capitalize(safeToolNameForType)}_Input`;
         lines.push(generateInputInterface(inputTypeName, tool.parameters, includeDescriptions));
         lines.push("");
       }
     }
     if (includeDescriptions && adapter.description) {
-      lines.push(`/** ${adapter.description} */`);
+      lines.push(`/** ${sanitizeJSDoc(adapter.description)} */`);
     }
     lines.push(`declare const ${safeName}: {`);
     for (const [toolName, tool] of Object.entries(adapter.tools)) {
       const safeToolName = sanitizeIdentifier(toolName);
       const hasParams = tool.parameters && Object.keys(tool.parameters).length > 0;
-      const inputTypeName = `${capitalize(safeName)}_${capitalize(toolName)}_Input`;
+      const inputTypeName = `${capitalize(safeName)}_${capitalize(safeToolName)}_Input`;
       if (includeDescriptions && tool.description) {
-        lines.push(`  /** ${tool.description} */`);
+        lines.push(`  /** ${sanitizeJSDoc(tool.description)} */`);
       }
       const paramStr = hasParams ? `params: ${inputTypeName}` : "";
       const returnType = asyncResults ? "Promise<unknown>" : "unknown";
@@ -10681,20 +10868,21 @@ function generateTypes(adapters, options = {}) {
 }
 function generateTypesSummary(adapters) {
   return adapters.map((adapter) => {
-    const methods = Object.keys(adapter.tools).join(", ");
-    return `${adapter.name}: { ${methods} }`;
+    const count = Object.keys(adapter.tools).length;
+    return `- ${adapter.name} (${count} methods)`;
   }).join(`
 `);
 }
 function generateInputInterface(typeName, parameters, includeDescriptions) {
   const lines = [`interface ${typeName} {`];
   for (const [paramName, param] of Object.entries(parameters)) {
+    const safeParamName = sanitizeIdentifier(paramName);
     if (includeDescriptions && param.description) {
-      lines.push(`  /** ${param.description} */`);
+      lines.push(`  /** ${sanitizeJSDoc(param.description)} */`);
     }
     const tsType = paramTypeToTS(param.type);
     const optional = param.required === false ? "?" : "";
-    lines.push(`  ${paramName}${optional}: ${tsType};`);
+    lines.push(`  ${safeParamName}${optional}: ${tsType};`);
   }
   lines.push("}");
   return lines.join(`
@@ -10767,6 +10955,9 @@ function sanitizeIdentifier(name) {
 function capitalize(str) {
   return str.charAt(0).toUpperCase() + str.slice(1);
 }
+function sanitizeJSDoc(text) {
+  return text.replace(/\*\//g, "* /").replace(/[\r\n]+/g, " ");
+}
 // src/executor.ts
 import { pathToFileURL } from "node:url";
 class MCXExecutor {
@@ -10823,7 +11014,7 @@ class MCXExecutor {
   }
   registerAdapter(adapter) {
     if (this.adapters.has(adapter.name)) {
-      console.warn(`Adapter "${adapter.name}" is being overwritten`);
+      console.error(`[MCX] Adapter "${adapter.name}" is being overwritten`);
     }
     this.adapters.set(adapter.name, adapter);
   }
@@ -10838,7 +11029,7 @@ class MCXExecutor {
   }
   registerSkill(skill) {
     if (this.skills.has(skill.name)) {
-      console.warn(`Skill "${skill.name}" is being overwritten`);
+      console.error(`[MCX] Skill "${skill.name}" is being overwritten`);
     }
     this.skills.set(skill.name, skill);
   }
@@ -10905,12 +11096,15 @@ class MCXExecutor {
         };
       } catch (error) {
         const err = error instanceof Error ? error : new Error(String(error));
+        const stack = err.stack ? err.stack.split(`
+`).slice(0, 5).join(`
+`) : undefined;
         return {
           success: false,
           error: {
             name: err.name,
             message: err.message,
-            stack: err.stack
+            stack
           },
           logs: [],
           executionTime: performance.now() - startTime