@papicandela/mcx-core 0.2.2 → 0.2.6

package/dist/index.js

@@ -32,80 +32,132 @@ function generateNetworkIsolationCode(policy) {
   if (policy.mode === "blocked") {
     return `
 // Network isolation: BLOCKED
-const __original_fetch = globalThis.fetch;
-globalThis.fetch = async function(url, options) {
-  throw new Error('Network access is blocked in sandbox. Use adapters instead.');
-};
+(function() {
+  const blockedFetch = async function() {
+    throw new Error('Network access is blocked in sandbox. Use adapters instead.');
+  };
+  Object.defineProperty(globalThis, 'fetch', {
+    value: blockedFetch,
+    writable: false,
+    configurable: false
+  });
+})();
 
 // Block XMLHttpRequest
-globalThis.XMLHttpRequest = class {
-  constructor() {
-    throw new Error('XMLHttpRequest is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'XMLHttpRequest', {
+  value: class {
+    constructor() {
+      throw new Error('XMLHttpRequest is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 
 // Block WebSocket
-globalThis.WebSocket = class {
-  constructor(url) {
-    throw new Error('WebSocket is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'WebSocket', {
+  value: class {
+    constructor() {
+      throw new Error('WebSocket is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 
 // Block EventSource (SSE)
-globalThis.EventSource = class {
-  constructor(url) {
-    throw new Error('EventSource is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'EventSource', {
+  value: class {
+    constructor() {
+      throw new Error('EventSource is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 `;
   }
   const domainsJson = JSON.stringify(policy.domains);
   return `
 // Network isolation: ALLOWED (whitelist)
-const __allowed_domains = ${domainsJson};
-const __original_fetch = globalThis.fetch;
+(function() {
+  const _domains = ${domainsJson};
+  const _real_fetch = globalThis.fetch;
 
-function __isUrlAllowed(url) {
-  try {
-    const hostname = new URL(url).hostname;
-    return __allowed_domains.some(d => hostname === d || hostname.endsWith('.' + d));
-  } catch {
-    return false;
+  // Block private/link-local IPs to prevent DNS rebinding attacks
+  function _isPrivateIp(hostname) {
+    return /^(localhost|127\\.|10\\.|192\\.168\\.|172\\.(1[6-9]|2\\d|3[01])\\.|169\\.254\\.|\\[::1\\]|\\[fc|\\[fd)/.test(hostname);
   }
-}
 
-globalThis.fetch = async function(url, options) {
-  const urlStr = typeof url === 'string' ? url : url instanceof URL ? url.toString() : url.url;
-  if (!__isUrlAllowed(urlStr)) {
-    const hostname = new URL(urlStr).hostname;
-    throw new Error(\`Network access blocked: \${hostname} not in allowed domains: \${__allowed_domains.join(', ')}\`);
+  function _isUrlAllowed(url) {
+    try {
+      const parsed = new URL(url);
+      // Only allow http/https protocols
+      if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return false;
+      const hostname = parsed.hostname;
+      if (!hostname || _isPrivateIp(hostname)) return false;
+      return _domains.some(d => d && (hostname === d || hostname.endsWith('.' + d)));
+    } catch {
+      return false;
+    }
   }
-  return __original_fetch(url, options);
-};
+
+  const whitelistedFetch = async function(url, options) {
+    // Safely extract URL string from various input types
+    let urlStr;
+    try {
+      if (typeof url === 'string') urlStr = url;
+      else if (url instanceof URL) urlStr = url.toString();
+      else if (url && typeof url.url === 'string') urlStr = url.url;
+      else throw new Error('Invalid URL type');
+    } catch {
+      throw new Error('Network access blocked: could not determine request URL.');
+    }
+    if (!_isUrlAllowed(urlStr)) {
+      throw new Error('Network access blocked: domain not in allowed list.');
+    }
+    return _real_fetch(url, options);
+  };
+
+  Object.defineProperty(globalThis, 'fetch', {
+    value: whitelistedFetch,
+    writable: false,
+    configurable: false
+  });
+})();
 
 // Block XMLHttpRequest (not easily whitelistable)
-globalThis.XMLHttpRequest = class {
-  constructor() {
-    throw new Error('XMLHttpRequest is blocked. Use fetch() with allowed domains.');
-  }
-};
+Object.defineProperty(globalThis, 'XMLHttpRequest', {
+  value: class {
+    constructor() {
+      throw new Error('XMLHttpRequest is blocked. Use fetch() with allowed domains.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 
-// Block WebSocket (would need separate whitelist)
-globalThis.WebSocket = class {
-  constructor(url) {
-    if (!__isUrlAllowed(url)) {
-      throw new Error('WebSocket blocked: domain not in allowed list.');
+// Block WebSocket - opaque error to prevent allowlist enumeration
+Object.defineProperty(globalThis, 'WebSocket', {
+  value: class {
+    constructor() {
+      throw new Error('WebSocket is not supported in sandbox.');
     }
-    throw new Error('WebSocket not supported in sandbox even for allowed domains.');
-  }
-};
+  },
+  writable: false,
+  configurable: false
+});
 
 // Block EventSource
-globalThis.EventSource = class {
-  constructor(url) {
-    throw new Error('EventSource is blocked in sandbox.');
-  }
-};
+Object.defineProperty(globalThis, 'EventSource', {
+  value: class {
+    constructor() {
+      throw new Error('EventSource is blocked in sandbox.');
+    }
+  },
+  writable: false,
+  configurable: false
+});
 `;
 }
 
@@ -5587,24 +5639,31 @@ function isLiteralTrue(node) {
     return false;
   return node.type === "Literal" && node.value === true;
 }
-function hasBreak(node) {
+function hasExitStatement(node) {
   if (node.type === "BreakStatement")
     return true;
+  if (node.type === "ReturnStatement")
+    return true;
+  if (node.type === "ThrowStatement")
+    return true;
   if (node.type === "WhileStatement" || node.type === "ForStatement" || node.type === "ForInStatement" || node.type === "ForOfStatement" || node.type === "DoWhileStatement" || node.type === "SwitchStatement") {
     return false;
   }
+  if (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") {
+    return false;
+  }
   for (const key of Object.keys(node)) {
     const child = node[key];
     if (child && typeof child === "object") {
       if (Array.isArray(child)) {
         for (const item of child) {
           if (item && typeof item === "object" && "type" in item) {
-            if (hasBreak(item))
+            if (hasExitStatement(item))
               return true;
           }
         }
       } else if ("type" in child) {
-        if (hasBreak(child))
+        if (hasExitStatement(child))
           return true;
       }
     }
@@ -5614,25 +5673,35 @@ function hasBreak(node) {
 var rule = {
   name: "no-infinite-loop",
   severity: "error",
-  description: "Disallow infinite loops without break statements",
-  visits: ["WhileStatement", "ForStatement"],
+  description: "Disallow infinite loops without exit statements",
+  visits: ["WhileStatement", "ForStatement", "DoWhileStatement"],
   visitors: {
     WhileStatement(node, context) {
       const whileNode = node;
-      if (isLiteralTrue(whileNode.test) && !hasBreak(whileNode.body)) {
+      if (isLiteralTrue(whileNode.test) && !hasExitStatement(whileNode.body)) {
         context.report({
           severity: "error",
-          message: "Infinite loop: while(true) without break",
+          message: "Infinite loop: while(true) without break/return/throw",
           line: context.getLine(node)
         });
       }
     },
     ForStatement(node, context) {
       const forNode = node;
-      if (!forNode.test && !hasBreak(forNode.body)) {
+      if (!forNode.test && !hasExitStatement(forNode.body)) {
+        context.report({
+          severity: "error",
+          message: "Infinite loop: for(;;) without break/return/throw",
+          line: context.getLine(node)
+        });
+      }
+    },
+    DoWhileStatement(node, context) {
+      const doWhileNode = node;
+      if (isLiteralTrue(doWhileNode.test) && !hasExitStatement(doWhileNode.body)) {
         context.report({
           severity: "error",
-          message: "Infinite loop: for(;;) without break",
+          message: "Infinite loop: do...while(true) without break/return/throw",
           line: context.getLine(node)
         });
       }
@@ -5938,49 +6007,100 @@ var EVAL_NAME = "ev" + "al";
 var FUNC_CONSTRUCTOR = "Func" + "tion";
 var REQUIRE_NAME = "req" + "uire";
 var PROCESS_NAME = "pro" + "cess";
+var DANGEROUS_GLOBALS = ["globalThis", "self", "window"];
+function isConstructorOnFunction(node) {
+  const prop = node.property;
+  const isConstructorAccess = !node.computed && prop.type === "Identifier" && prop.name === "constructor" || node.computed && prop.type === "Literal" && prop.value === "constructor";
+  if (!isConstructorAccess)
+    return false;
+  const obj = node.object;
+  if (obj.type === "FunctionExpression" || obj.type === "ArrowFunctionExpression") {
+    return true;
+  }
+  if (obj.type === "CallExpression") {
+    const call = obj;
+    if (call.callee.type === "MemberExpression") {
+      const callee = call.callee;
+      if (callee.object.type === "Identifier" && callee.object.name === "Object" && callee.property.type === "Identifier" && callee.property.name === "getPrototypeOf") {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 var rule5 = {
   name: "no-dangerous-globals",
   severity: "warn",
-  description: "Warn about dangerous globals not available in sandbox",
-  visits: ["CallExpression", "NewExpression", "Identifier", "MemberExpression"],
+  description: "Block dangerous globals that could escape sandbox",
+  visits: ["CallExpression", "NewExpression", "MemberExpression"],
   visitors: {
     CallExpression(node, context) {
       const callExpr = node;
-      if (callExpr.callee.type === "Identifier" && callExpr.callee.name === EVAL_NAME) {
+      const calleeName = callExpr.callee.type === "Identifier" ? callExpr.callee.name : null;
+      if (calleeName === EVAL_NAME) {
         context.report({
-          severity: "warn",
-          message: `${EVAL_NAME}() is not available in sandbox`,
+          severity: "error",
+          message: `${EVAL_NAME}() is blocked in sandbox - potential code injection`,
           line: context.getLine(node)
         });
         return;
       }
-      if (callExpr.callee.type === "Identifier" && callExpr.callee.name === REQUIRE_NAME) {
+      if (calleeName === FUNC_CONSTRUCTOR) {
         context.report({
-          severity: "warn",
-          message: `${REQUIRE_NAME}() is not available in sandbox - use adapters instead`,
+          severity: "error",
+          message: `${FUNC_CONSTRUCTOR}() is blocked in sandbox - potential code injection`,
           line: context.getLine(node)
         });
         return;
       }
-    },
-    NewExpression(node, context) {
-      const newExpr = node;
-      if (newExpr.callee.type === "Identifier" && newExpr.callee.name === FUNC_CONSTRUCTOR) {
+      if (calleeName === REQUIRE_NAME) {
         context.report({
-          severity: "warn",
-          message: `${FUNC_CONSTRUCTOR} constructor is not recommended in sandbox`,
+          severity: "error",
+          message: `${REQUIRE_NAME}() is blocked in sandbox - could access dangerous modules`,
           line: context.getLine(node)
         });
+        return;
+      }
+      if (callExpr.callee.type === "MemberExpression") {
+        if (isConstructorOnFunction(callExpr.callee)) {
+          context.report({
+            severity: "error",
+            message: `Accessing .constructor on functions is blocked - potential sandbox escape`,
+            line: context.getLine(node)
+          });
+          return;
+        }
       }
     },
-    Identifier(node, context) {
-      const identifier = node;
-      if (identifier.name === PROCESS_NAME) {
+    NewExpression(node, context) {
+      const newExpr = node;
+      if (newExpr.callee.type === "Identifier" && newExpr.callee.name === FUNC_CONSTRUCTOR) {
         context.report({
-          severity: "warn",
-          message: `'${PROCESS_NAME}' is not available in sandbox`,
+          severity: "error",
+          message: `${FUNC_CONSTRUCTOR} constructor is blocked in sandbox - potential code injection`,
           line: context.getLine(node)
         });
+        return;
+      }
+      if (newExpr.callee.type === "MemberExpression") {
+        if (isConstructorOnFunction(newExpr.callee)) {
+          context.report({
+            severity: "error",
+            message: `Accessing .constructor on functions is blocked - potential sandbox escape`,
+            line: context.getLine(node)
+          });
+          return;
+        }
+      }
+      if (newExpr.callee.type === "MemberExpression") {
+        const member = newExpr.callee;
+        if (member.object.type === "Identifier" && DANGEROUS_GLOBALS.includes(member.object.name) && member.property.type === "Identifier" && member.property.name === FUNC_CONSTRUCTOR) {
+          context.report({
+            severity: "error",
+            message: `${FUNC_CONSTRUCTOR} constructor is blocked in sandbox - potential code injection`,
+            line: context.getLine(node)
+          });
+        }
       }
     },
     MemberExpression(node, context) {
@@ -5991,6 +6111,14 @@ var rule5 = {
           message: `'${PROCESS_NAME}' is not available in sandbox`,
           line: context.getLine(node)
         });
+        return;
+      }
+      if (memberExpr.object.type === "Identifier" && DANGEROUS_GLOBALS.includes(memberExpr.object.name) && memberExpr.property.type === "Identifier" && memberExpr.property.name === FUNC_CONSTRUCTOR) {
+        context.report({
+          severity: "error",
+          message: `Accessing ${FUNC_CONSTRUCTOR} via globals is blocked - potential sandbox escape`,
+          line: context.getLine(node)
+        });
       }
     }
   }
@@ -6130,7 +6258,7 @@ function analyze(code, config = {}) {
   const errors = findings.filter((f) => f.severity === "error");
   const elapsed = performance.now() - start;
   if (elapsed > 50) {
-    console.warn(`[mcx-analyzer] Exceeded 50ms budget: ${elapsed.toFixed(1)}ms`);
+    console.error(`[mcx-analyzer] Exceeded 50ms budget: ${elapsed.toFixed(1)}ms`);
   }
   return { warnings, errors, elapsed };
 }
@@ -6210,14 +6338,17 @@ class BunWorkerSandbox {
       const url = URL.createObjectURL(blob);
       const worker = new Worker(url);
       let resolved = false;
+      let timeoutId;
       const cleanup = () => {
         if (!resolved) {
           resolved = true;
+          if (timeoutId)
+            clearTimeout(timeoutId);
           worker.terminate();
           URL.revokeObjectURL(url);
         }
       };
-      const timeoutId = setTimeout(() => {
+      timeoutId = setTimeout(() => {
         if (!resolved) {
           cleanup();
           resolve({
@@ -6229,6 +6360,8 @@ class BunWorkerSandbox {
         }
       }, this.config.timeout);
       worker.onmessage = async (event) => {
+        if (resolved)
+          return;
         const { type, ...data2 } = event.data;
         if (type === "ready") {
           worker.postMessage({ type: "execute", data: { code: normalizedCode } });
@@ -6246,7 +6379,6 @@ class BunWorkerSandbox {
             worker.postMessage({ type: "adapter_result", data: { id, error } });
           }
         } else if (type === "result") {
-          clearTimeout(timeoutId);
           cleanup();
           resolve({
             success: data2.success,
@@ -6258,7 +6390,6 @@ class BunWorkerSandbox {
         }
       };
       worker.onerror = (error) => {
-        clearTimeout(timeoutId);
         cleanup();
         resolve({
           success: false,
@@ -6287,11 +6418,27 @@ class BunWorkerSandbox {
       const pendingCalls = new Map();
       let callId = 0;
 
+      // Safe stringify that handles BigInt and circular refs
+      const safeStr = (val) => {
+        if (typeof val !== 'object' || val === null) return String(val);
+        try {
+          const seen = new WeakSet();
+          return JSON.stringify(val, (k, v) => {
+            if (typeof v === 'bigint') return v.toString() + 'n';
+            if (typeof v === 'object' && v !== null) {
+              if (seen.has(v)) return '[Circular]';
+              seen.add(v);
+            }
+            return v;
+          });
+        } catch { return String(val); }
+      };
+
       const console = {
-        log: (...args) => logs.push(args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
-        warn: (...args) => logs.push('[WARN] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
-        error: (...args) => logs.push('[ERROR] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
-        info: (...args) => logs.push('[INFO] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' ')),
+        log: (...args) => logs.push(args.map(safeStr).join(' ')),
+        warn: (...args) => logs.push('[WARN] ' + args.map(safeStr).join(' ')),
+        error: (...args) => logs.push('[ERROR] ' + args.map(safeStr).join(' ')),
+        info: (...args) => logs.push('[INFO] ' + args.map(safeStr).join(' ')),
       };
       globalThis.console = console;
 
@@ -6341,25 +6488,73 @@ class BunWorkerSandbox {
         return arr.slice(0, n);
       };
 
+      // SECURITY: Reserved keys that must not be overwritten by user-provided variables/globals
+      const RESERVED_KEYS = new Set([
+        'onmessage', 'postMessage', 'close', 'terminate', 'self',
+        'constructor', 'prototype', '__proto__',
+        'pendingCalls', 'callId', 'logs', 'console', 'adapters',
+        'fetch', 'XMLHttpRequest', 'WebSocket', 'EventSource',
+        'pick', 'table', 'count', 'sum', 'first', 'safeStr'
+      ]);
+
       self.onmessage = async (event) => {
         const { type, data } = event.data;
 
         if (type === 'init') {
           const { variables, adapterMethods, globals } = data;
 
+          // Inject user variables (skip reserved keys to prevent internal state corruption)
           for (const [key, value] of Object.entries(variables || {})) {
+            if (RESERVED_KEYS.has(key)) {
+              logs.push('[WARN] Skipped reserved variable key: ' + key);
+              continue;
+            }
             globalThis[key] = value;
           }
 
+          // Inject sandbox globals (skip reserved keys)
           for (const [key, value] of Object.entries(globals || {})) {
+            if (RESERVED_KEYS.has(key)) {
+              logs.push('[WARN] Skipped reserved globals key: ' + key);
+              continue;
+            }
             globalThis[key] = value;
           }
 
-          globalThis.adapters = {};
+          // Levenshtein distance for fuzzy matching
+          const levenshtein = (a, b) => {
+            if (a.length === 0) return b.length;
+            if (b.length === 0) return a.length;
+            const matrix = [];
+            for (let i = 0; i <= b.length; i++) matrix[i] = [i];
+            for (let j = 0; j <= a.length; j++) matrix[0][j] = j;
+            for (let i = 1; i <= b.length; i++) {
+              for (let j = 1; j <= a.length; j++) {
+                matrix[i][j] = b[i-1] === a[j-1]
+                  ? matrix[i-1][j-1]
+                  : Math.min(matrix[i-1][j-1] + 1, matrix[i][j-1] + 1, matrix[i-1][j] + 1);
+              }
+            }
+            return matrix[b.length][a.length];
+          };
+
+          // Find similar method names
+          const findSimilar = (name, methods, maxDist = 3) => {
+            const normalized = name.toLowerCase().replace(/[-_]/g, '');
+            return methods
+              .map(m => ({ method: m, dist: levenshtein(normalized, m.toLowerCase().replace(/[-_]/g, '')) }))
+              .filter(x => x.dist <= maxDist)
+              .sort((a, b) => a.dist - b.dist)
+              .slice(0, 3)
+              .map(x => x.method);
+          };
+
+          // Create adapter proxies with helpful error messages
+          const adaptersObj = {};
           for (const [adapterName, methods] of Object.entries(adapterMethods)) {
-            const adapterObj = {};
+            const methodsImpl = {};
             for (const methodName of methods) {
-              adapterObj[methodName] = async (...args) => {
+              methodsImpl[methodName] = async (...args) => {
                 const id = ++callId;
                 return new Promise((resolve, reject) => {
                   pendingCalls.set(id, { resolve, reject });
@@ -6373,9 +6568,33 @@ class BunWorkerSandbox {
                 });
               };
             }
-            globalThis.adapters[adapterName] = adapterObj;
-            globalThis[adapterName] = adapterObj;
+
+            // Use Proxy to intercept undefined method calls
+            const adapterProxy = new Proxy(methodsImpl, {
+              get(target, prop) {
+                if (prop in target) return target[prop];
+                if (typeof prop === 'symbol') return undefined;
+                const similar = findSimilar(String(prop), methods);
+                const suggestion = similar.length > 0
+                  ? '. Did you mean: ' + similar.join(', ') + '?'
+                  : '. Available: ' + methods.slice(0, 5).join(', ') + (methods.length > 5 ? '...' : '');
+                throw new Error(adapterName + '.' + String(prop) + ' is not a function' + suggestion);
+              }
+            });
+
+            adaptersObj[adapterName] = adapterProxy;
+            // Also expose at top level but as non-writable
+            Object.defineProperty(globalThis, adapterName, {
+              value: adapterProxy,
+              writable: false,
+              configurable: false
+            });
           }
+          Object.defineProperty(globalThis, 'adapters', {
+            value: adaptersObj,
+            writable: false,
+            configurable: false
+          });
 
           self.postMessage({ type: 'ready' });
         }
@@ -6398,10 +6617,12 @@ class BunWorkerSandbox {
             const result = await fn();
             self.postMessage({ type: 'result', success: true, value: result, logs });
           } catch (err) {
+            // Truncate stack to 5 lines to prevent context bloat
+            const stack = err.stack ? err.stack.split('\\n').slice(0, 5).join('\\n') : undefined;
             self.postMessage({
               type: 'result',
               success: false,
-              error: { name: err.name, message: err.message, stack: err.stack },
+              error: { name: err.name, message: err.message, stack },
               logs
             });
           }
@@ -10411,12 +10632,12 @@ function createParameterValidator(params) {
       default:
         schema = exports_external.unknown();
     }
-    if (param.default !== undefined) {
-      schema = schema.default(param.default);
-    }
     if (!param.required) {
       schema = schema.optional();
     }
+    if (param.default !== undefined) {
+      schema = schema.default(param.default);
+    }
     shape[param.name] = schema;
   }
   return exports_external.object(shape);
@@ -10559,7 +10780,10 @@ var DEFAULT_CONFIG2 = {
     timeout: 5000,
     memoryLimit: 128,
     allowAsync: true,
-    globals: {}
+    globals: {},
+    networkPolicy: DEFAULT_NETWORK_POLICY,
+    normalizeCode: true,
+    analysis: DEFAULT_ANALYSIS_CONFIG
   },
   adaptersDir: "./adapters",
   skillsDir: "./skills"
@@ -10653,21 +10877,22 @@ function generateTypes(adapters, options = {}) {
     const safeName = sanitizeIdentifier(adapter.name);
     for (const [toolName, tool] of Object.entries(adapter.tools)) {
       if (tool.parameters && Object.keys(tool.parameters).length > 0) {
-        const inputTypeName = `${capitalize(safeName)}_${capitalize(toolName)}_Input`;
+        const safeToolNameForType = sanitizeIdentifier(toolName);
+        const inputTypeName = `${capitalize(safeName)}_${capitalize(safeToolNameForType)}_Input`;
         lines.push(generateInputInterface(inputTypeName, tool.parameters, includeDescriptions));
         lines.push("");
       }
     }
     if (includeDescriptions && adapter.description) {
-      lines.push(`/** ${adapter.description} */`);
+      lines.push(`/** ${sanitizeJSDoc(adapter.description)} */`);
     }
     lines.push(`declare const ${safeName}: {`);
     for (const [toolName, tool] of Object.entries(adapter.tools)) {
       const safeToolName = sanitizeIdentifier(toolName);
       const hasParams = tool.parameters && Object.keys(tool.parameters).length > 0;
-      const inputTypeName = `${capitalize(safeName)}_${capitalize(toolName)}_Input`;
+      const inputTypeName = `${capitalize(safeName)}_${capitalize(safeToolName)}_Input`;
       if (includeDescriptions && tool.description) {
-        lines.push(`  /** ${tool.description} */`);
+        lines.push(`  /** ${sanitizeJSDoc(tool.description)} */`);
       }
       const paramStr = hasParams ? `params: ${inputTypeName}` : "";
       const returnType = asyncResults ? "Promise<unknown>" : "unknown";
@@ -10680,21 +10905,64 @@ function generateTypes(adapters, options = {}) {
 `).trim();
 }
 function generateTypesSummary(adapters) {
-  return adapters.map((adapter) => {
-    const methods = Object.keys(adapter.tools).join(", ");
-    return `${adapter.name}: { ${methods} }`;
-  }).join(`
+  const byDomain = new Map;
+  for (const adapter of adapters) {
+    const domain = inferDomain(adapter);
+    if (!byDomain.has(domain)) {
+      byDomain.set(domain, []);
+    }
+    byDomain.get(domain).push(adapter);
+  }
+  if (byDomain.size <= 1 || adapters.length < 4) {
+    return adapters.map((adapter) => {
+      const count = Object.keys(adapter.tools).length;
+      return `- ${adapter.name} (${count} methods)`;
+    }).join(`
+`);
+  }
+  const lines = [];
+  for (const [domain, domainAdapters] of byDomain) {
+    const adapterList = domainAdapters.map((a) => `${a.name}(${Object.keys(a.tools).length})`).join(", ");
+    lines.push(`[${domain}] ${adapterList}`);
+  }
+  return lines.join(`
 `);
 }
+function inferDomain(adapter) {
+  if (adapter.domain)
+    return adapter.domain;
+  const name = adapter.name.toLowerCase();
+  const desc = (adapter.description || "").toLowerCase();
+  const combined = `${name} ${desc}`;
+  const domains = {
+    payments: ["stripe", "paypal", "square", "payment", "checkout", "billing", "invoice"],
+    database: ["supabase", "postgres", "mysql", "mongodb", "redis", "database", "sql", "query"],
+    email: ["sendgrid", "mailgun", "postmark", "email", "smtp", "mail"],
+    storage: ["s3", "cloudflare", "storage", "blob", "file", "upload"],
+    auth: ["auth", "oauth", "login", "jwt", "clerk", "auth0"],
+    ai: ["openai", "anthropic", "claude", "gpt", "llm", "ai", "ml"],
+    messaging: ["slack", "discord", "telegram", "twilio", "sms", "chat"],
+    crm: ["hubspot", "salesforce", "crm", "customer"],
+    analytics: ["analytics", "metrics", "tracking", "mixpanel", "amplitude"],
+    devtools: ["github", "gitlab", "jira", "linear", "chrome", "devtools", "ci", "cd"]
+  };
+  for (const [domain, keywords2] of Object.entries(domains)) {
+    if (keywords2.some((k) => combined.includes(k))) {
+      return domain;
+    }
+  }
+  return "general";
+}
 function generateInputInterface(typeName, parameters, includeDescriptions) {
   const lines = [`interface ${typeName} {`];
   for (const [paramName, param] of Object.entries(parameters)) {
+    const safeParamName = sanitizeIdentifier(paramName);
     if (includeDescriptions && param.description) {
-      lines.push(`  /** ${param.description} */`);
+      lines.push(`  /** ${sanitizeJSDoc(param.description)} */`);
     }
     const tsType = paramTypeToTS(param.type);
-    const optional = param.required === false ? "?" : "";
-    lines.push(`  ${paramName}${optional}: ${tsType};`);
+    const optional = param.required === true ? "" : "?";
+    lines.push(`  ${safeParamName}${optional}: ${tsType};`);
   }
   lines.push("}");
   return lines.join(`
@@ -10767,6 +11035,9 @@ function sanitizeIdentifier(name) {
 function capitalize(str) {
   return str.charAt(0).toUpperCase() + str.slice(1);
 }
+function sanitizeJSDoc(text) {
+  return text.replace(/\*\//g, "* /").replace(/[\r\n]+/g, " ");
+}
 // src/executor.ts
 import { pathToFileURL } from "node:url";
 class MCXExecutor {
@@ -10823,7 +11094,7 @@ class MCXExecutor {
   }
   registerAdapter(adapter) {
     if (this.adapters.has(adapter.name)) {
-      console.warn(`Adapter "${adapter.name}" is being overwritten`);
+      console.error(`[MCX] Adapter "${adapter.name}" is being overwritten`);
     }
     this.adapters.set(adapter.name, adapter);
   }
@@ -10838,7 +11109,7 @@ class MCXExecutor {
   }
   registerSkill(skill) {
     if (this.skills.has(skill.name)) {
-      console.warn(`Skill "${skill.name}" is being overwritten`);
+      console.error(`[MCX] Skill "${skill.name}" is being overwritten`);
     }
     this.skills.set(skill.name, skill);
   }
@@ -10905,12 +11176,15 @@ class MCXExecutor {
         };
       } catch (error) {
         const err = error instanceof Error ? error : new Error(String(error));
+        const stack = err.stack ? err.stack.split(`
+`).slice(0, 5).join(`
+`) : undefined;
         return {
           success: false,
           error: {
             name: err.name,
             message: err.message,
-            stack: err.stack
+            stack
           },
           logs: [],
           executionTime: performance.now() - startTime
@@ -10976,6 +11250,7 @@ export {
   normalizeCode,
   mergeConfigs,
   isUrlAllowed,
+  inferDomain,
   generateTypesSummary,
   generateTypes,
   formatFindings,