@pellux/goodvibes-sdk 0.25.10 → 0.25.12

package/dist/_internal/platform/tools/exec/schema.js

@@ -119,6 +119,7 @@ export const EXEC_TOOL_SCHEMA = {
                 // cmd or cmd_base64 required — validated at runtime
             },
             minItems: 1,
+            maxItems: 10,
         },
         parallel: {
             type: 'boolean',

package/dist/_internal/platform/tools/fetch/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/fetch/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAsF,MAAM,aAAa,CAAC;AAClI,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAUxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAK/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;CACtE;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAMD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,eAAe,CAAK;IAE5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAOtE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAiBxC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;CA8DpF;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5G;AA+UD,wBAAgB,eAAe,CAC7B,IAAI,GAAE,gBAAqB,EAC3B,OAAO,sBAA4B,GAClC,IAAI,CAiCN"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/fetch/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAsF,MAAM,aAAa,CAAC;AAClI,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAUxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAM/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC;CACtE;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AASD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAiC;IAC/D,OAAO,CAAC,eAAe,CAAK;IAE5B,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAOtE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAiBxC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC;CAkFpF;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5G;AA8dD,wBAAgB,eAAe,CAC7B,IAAI,GAAE,gBAAqB,EAC3B,OAAO,sBAA4B,GAClC,IAAI,CAiCN"}

package/dist/_internal/platform/tools/fetch/runtime.js

@@ -6,7 +6,11 @@ import { applyExtract, sniffContentType } from './extract.js';
 import { summarizeError } from '../../utils/error-display.js';
 import { instrumentedFetch } from '../../utils/fetch-with-timeout.js';
 import { toRecord } from '../../utils/record-coerce.js';
+import { mapWithConcurrency } from '../../utils/concurrency.js';
 const MAX_CACHE_SIZE = 500;
+const MAX_FETCH_URLS = 20;
+const MAX_PARALLEL_FETCHES = 5;
+const MAX_REDIRECTS = 10;
 const DEFAULT_TIMEOUT_MS = 30_000;
 export class FetchRuntimeService {
     responseCache = new Map();
@@ -43,6 +47,21 @@ export class FetchRuntimeService {
         const cacheTtlSeconds = input.cache_ttl_seconds ?? 0;
         const rateLimitMs = input.rate_limit_ms ?? 0;
         const maxContentLength = input.max_content_length;
+        if (input.urls.length > MAX_FETCH_URLS) {
+            return {
+                success: false,
+                summary: {
+                    total: input.urls.length,
+                    succeeded: 0,
+                    failed: input.urls.length,
+                    total_ms: 0,
+                },
+                results: [{
+                        url: input.urls[0]?.url ?? '',
+                        error: `Too many URLs: maximum ${MAX_FETCH_URLS} per fetch call`,
+                    }],
+            };
+        }
         const sanitizeMode = resolveSanitizeMode(input.sanitize_mode);
         const trustTierConfig = {
             trustedHosts: input.trusted_hosts,
@@ -63,7 +82,7 @@ export class FetchRuntimeService {
             if (rateLimitMs > 0) {
                 logger.debug('fetch tool: rate_limit_ms is ignored in parallel mode; set parallel: false to enforce rate limiting');
             }
-            results = await Promise.all(input.urls.map((urlInput) => fetchOne(urlInput, fetchOpts, this)));
+            results = await mapWithConcurrency(input.urls, MAX_PARALLEL_FETCHES, (urlInput) => fetchOne(urlInput, fetchOpts, this));
         }
         else {
             results = [];
@@ -149,16 +168,25 @@ function encodeFormBodyData(bodyData) {
     }
     return params.toString();
 }
-async function fetchOneRaw(urlInput, headers, method, body, effectiveUrl) {
+async function fetchOneRaw(urlInput, headers, method, body, effectiveUrl, trustTierConfig, sanitizationEnabled) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), urlInput.timeout_ms ?? DEFAULT_TIMEOUT_MS);
     try {
-        const response = await instrumentedFetch(effectiveUrl, {
-            method,
-            headers: Object.keys(headers).length > 0 ? headers : undefined,
-            body,
-            signal: controller.signal,
-        });
+        const response = sanitizationEnabled
+            ? await fetchWithValidatedRedirects({
+                url: effectiveUrl,
+                method,
+                headers,
+                body,
+                signal: controller.signal,
+                trustTierConfig,
+            })
+            : await instrumentedFetch(effectiveUrl, {
+                method,
+                headers: Object.keys(headers).length > 0 ? headers : undefined,
+                body,
+                signal: controller.signal,
+            });
         clearTimeout(timer);
         return response;
     }
@@ -167,6 +195,69 @@ async function fetchOneRaw(urlInput, headers, method, body, effectiveUrl) {
         throw err;
     }
 }
+async function fetchWithValidatedRedirects(input) {
+    let currentUrl = input.url;
+    let currentMethod = input.method;
+    let currentBody = input.body;
+    let currentHeaders = { ...input.headers };
+    for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+        const response = await instrumentedFetch(currentUrl, {
+            method: currentMethod,
+            headers: Object.keys(currentHeaders).length > 0 ? currentHeaders : undefined,
+            body: currentBody,
+            signal: input.signal,
+            redirect: 'manual',
+        });
+        if (!isRedirectStatus(response.status))
+            return response;
+        const location = response.headers.get('location');
+        if (!location)
+            return response;
+        if (redirectCount === MAX_REDIRECTS) {
+            throw new Error(`Too many redirects after ${MAX_REDIRECTS} hops`);
+        }
+        const nextUrl = new URL(location, currentUrl).toString();
+        const nextHost = extractHostname(nextUrl);
+        if (nextHost !== null) {
+            const trustResult = classifyHostTrustTier(nextHost, input.trustTierConfig);
+            emitHostTrustTier(nextHost, nextUrl, trustResult);
+            if (trustResult.tier === 'blocked') {
+                if (trustResult.isSsrf)
+                    emitSsrfDeny(nextHost, nextUrl, trustResult.reason);
+                throw new Error(`Redirect blocked: ${trustResult.reason}`);
+            }
+        }
+        if (shouldRewriteRedirectToGet(response.status, currentMethod)) {
+            currentMethod = 'GET';
+            currentBody = undefined;
+            currentHeaders = removeContentHeaders(currentHeaders);
+        }
+        if (new URL(nextUrl).origin !== new URL(currentUrl).origin) {
+            currentHeaders = removeCredentialHeaders(currentHeaders);
+        }
+        currentUrl = nextUrl;
+    }
+    throw new Error(`Too many redirects after ${MAX_REDIRECTS} hops`);
+}
+function isRedirectStatus(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function shouldRewriteRedirectToGet(status, method) {
+    const upper = method.toUpperCase();
+    return status === 303 || ((status === 301 || status === 302) && upper === 'POST');
+}
+function removeContentHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).filter(([key]) => {
+        const normalized = key.toLowerCase();
+        return normalized !== 'content-type' && normalized !== 'content-length';
+    }));
+}
+function removeCredentialHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).filter(([key]) => {
+        const normalized = key.toLowerCase();
+        return normalized !== 'authorization' && normalized !== 'cookie' && normalized !== 'proxy-authorization';
+    }));
+}
 function prepareFetchHeaders(urlInput) {
     const headers = { ...(urlInput.headers ?? {}) };
     if (urlInput.auth) {
@@ -269,28 +360,22 @@ async function fetchOne(urlInput, opts, runtime) {
     const { headers, body: requestBody } = await prepareFetchRequest(urlInput, deps);
     const startTime = performance.now();
     try {
-        let response = await fetchOneRaw(urlInput, headers, method, requestBody, effectiveUrl);
+        let response = await fetchOneRaw(urlInput, headers, method, requestBody, effectiveUrl, trustTierConfig, sanitizationEnabled);
         const retryOnAuth = urlInput.retry_on_auth ?? (urlInput.service !== undefined);
         if (response.status === 401 && retryOnAuth && urlInput.service && !(requestBody instanceof FormData)) {
             const refreshedHeaders = await deps.serviceRegistry?.resolveAuth(urlInput.service);
             if (refreshedHeaders) {
                 const retryHeaders = { ...headers };
                 Object.assign(retryHeaders, refreshedHeaders);
-                response = await fetchOneRaw(urlInput, retryHeaders, method, requestBody, effectiveUrl);
+                response = await fetchOneRaw(urlInput, retryHeaders, method, requestBody, effectiveUrl, trustTierConfig, sanitizationEnabled);
             }
         }
         const durationMs = Math.round(performance.now() - startTime);
         let contentType = response.headers.get('content-type') ?? '';
-        let rawBody = await response.text();
+        const bodyResult = await readResponseText(response, effectiveMaxContent);
+        let rawBody = bodyResult.text;
         contentType = sniffContentType(contentType, rawBody);
-        let truncated = false;
-        if (effectiveMaxContent !== undefined) {
-            const buf = Buffer.from(rawBody, 'utf-8');
-            if (buf.length > effectiveMaxContent) {
-                rawBody = buf.subarray(0, effectiveMaxContent).toString('utf-8');
-                truncated = true;
-            }
-        }
+        const truncated = bodyResult.truncated;
         const byteSize = Buffer.byteLength(rawBody, 'utf-8');
         const result = buildFetchResultBase(urlInput, response, durationMs);
         if (verbosity === 'count_only') {
@@ -358,6 +443,42 @@ async function fetchOne(urlInput, opts, runtime) {
         return { url: urlInput.url, error: message, duration_ms: durationMs };
     }
 }
+async function readResponseText(response, maxBytes) {
+    if (maxBytes === undefined || maxBytes <= 0 || !response.body) {
+        return { text: await response.text(), truncated: false };
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let total = 0;
+    let text = '';
+    let truncated = false;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const remaining = maxBytes - total;
+            if (remaining <= 0) {
+                truncated = true;
+                await reader.cancel('Response body limit reached').catch(() => { });
+                break;
+            }
+            const chunk = value.byteLength > remaining ? value.subarray(0, remaining) : value;
+            text += decoder.decode(chunk, { stream: true });
+            total += chunk.byteLength;
+            if (value.byteLength > remaining) {
+                truncated = true;
+                await reader.cancel('Response body limit reached').catch(() => { });
+                break;
+            }
+        }
+        text += decoder.decode();
+        return { text, truncated };
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
 function cacheSuccessfulGet(runtime, cacheTtlSeconds, method, key, result) {
     if (cacheTtlSeconds > 0 && method === 'GET') {
         runtime.cacheSet(key, { data: result, timestamp: Date.now(), ttl: cacheTtlSeconds });

package/dist/_internal/platform/tools/fetch/schema.d.ts

@@ -122,6 +122,7 @@ export declare const FETCH_TOOL_SCHEMA: {
                 readonly required: readonly ["url"];
             };
             readonly minItems: 1;
+            readonly maxItems: 20;
         };
         readonly extract: {
             readonly type: "string";

package/dist/_internal/platform/tools/fetch/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/fetch/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqKpB,CAAC;AAEX,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,UAAU,GACV,UAAU,GACV,aAAa,GACb,OAAO,GACP,UAAU,GACV,YAAY,GACZ,QAAQ,GACR,KAAK,GACL,SAAS,CAAC;AAEd,+BAA+B;AAC/B,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/E,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1E,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IAClD,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE7C,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/fetch/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsKpB,CAAC;AAEX,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,MAAM,GACN,MAAM,GACN,UAAU,GACV,UAAU,GACV,aAAa,GACb,OAAO,GACP,UAAU,GACV,YAAY,GACZ,QAAQ,GACR,KAAK,GACL,SAAS,CAAC;AAEd,+BAA+B;AAC/B,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE/E,oCAAoC;AACpC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1E,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IAClD,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sFAAsF;IACtF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE7C,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B"}

package/dist/_internal/platform/tools/fetch/schema.js

@@ -113,6 +113,7 @@ export const FETCH_TOOL_SCHEMA = {
                 required: ['url'],
             },
             minItems: 1,
+            maxItems: 20,
         },
         extract: {
             type: 'string',

package/dist/_internal/platform/tools/find/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/find/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AASjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,IAAI,EAC3D,OAAO,qBAA2B,GACjC,IAAI,CAuEN"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/find/executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AASjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAOjD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,GAAG,IAAI,EAC3D,OAAO,qBAA2B,GACjC,IAAI,CA0EN"}

package/dist/_internal/platform/tools/find/executor.js

@@ -7,6 +7,9 @@ import { executeStructuralQuery } from './structural.js';
 import { executeSymbolsQuery } from './symbols.js';
 import { FindRuntimeService } from './shared.js';
 import { summarizeError } from '../../utils/error-display.js';
+import { mapWithConcurrency } from '../../utils/concurrency.js';
+const MAX_FIND_QUERIES = 20;
+const MAX_PARALLEL_FIND_QUERIES = 5;
 export function createFindTool(projectRoot, featureFlags, runtime = new FindRuntimeService()) {
     if (typeof projectRoot !== 'string' || projectRoot.trim().length === 0) {
         throw new Error('createFindTool requires projectRoot');
@@ -18,6 +21,9 @@ export function createFindTool(projectRoot, featureFlags, runtime = new FindRunt
                 if (!Array.isArray(args.queries) || args.queries.length === 0) {
                     return { success: false, error: 'Missing or empty "queries" array' };
                 }
+                if (args.queries.length > MAX_FIND_QUERIES) {
+                    return { success: false, error: `Too many queries: maximum ${MAX_FIND_QUERIES} per find call` };
+                }
                 const input = args;
                 const output = input.output ?? {};
                 const parallel = input.parallel !== false;
@@ -48,7 +54,7 @@ export function createFindTool(projectRoot, featureFlags, runtime = new FindRunt
                 };
                 let pairs;
                 if (parallel) {
-                    pairs = await Promise.all(input.queries.map(runQuery));
+                    pairs = await mapWithConcurrency(input.queries, MAX_PARALLEL_FIND_QUERIES, runQuery);
                 }
                 else {
                     pairs = [];

package/dist/_internal/platform/tools/find/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/find/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,cAwQxB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/find/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,cA0QxB,CAAC"}

package/dist/_internal/platform/tools/find/schema.js

@@ -186,6 +186,8 @@ export const findSchema = {
                         },
                     },
                 },
+                minItems: 1,
+                maxItems: 20,
             },
             output: {
                 type: 'object',

package/dist/_internal/platform/tools/read/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/read/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAIjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAUhE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpE,qBAAa,QAAS,YAAW,IAAI;IACnC,QAAQ,CAAC,UAAU,EAAE,cAAc,CASjC;IAEF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsD;gBAGrF,YAAY,EAAE,YAAY,EAC1B,SAAS,CAAC,EAAE,cAAc,EAC1B,gBAAgB,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,YAAY,CAAC;IAOlE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAa9F,QAAQ;CAuHvB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/read/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAIjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAWhE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAKpE,qBAAa,QAAS,YAAW,IAAI;IACnC,QAAQ,CAAC,UAAU,EAAE,cAAc,CASjC;IAEF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAsD;gBAGrF,YAAY,EAAE,YAAY,EAC1B,SAAS,CAAC,EAAE,cAAc,EAC1B,gBAAgB,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,YAAY,CAAC;IAOlE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAgB9F,QAAQ;CAwHvB"}

package/dist/_internal/platform/tools/read/index.js

@@ -6,6 +6,9 @@ import { CodeIntelligence } from '../../intelligence/facade.js';
 import { logger } from '../../utils/logger.js';
 import { summarizeError } from '../../utils/error-display.js';
 import { paginateFiles, readOneFile, } from './file-readers.js';
+import { mapWithConcurrency } from '../../utils/concurrency.js';
+const MAX_READ_FILES = 50;
+const MAX_PARALLEL_READ_FILES = 8;
 export class ReadTool {
     definition = {
         name: 'read',
@@ -28,6 +31,9 @@ export class ReadTool {
         if (!Array.isArray(args.files) || args.files.length === 0) {
             return { success: false, error: 'Missing or empty "files" array' };
         }
+        if (args.files.length > MAX_READ_FILES) {
+            return { success: false, error: `Too many files: maximum ${MAX_READ_FILES} per read call` };
+        }
         try {
             return await this._execute(args);
         }
@@ -63,7 +69,7 @@ export class ReadTool {
                 .map(({ f }) => f.path);
             paginationInfo = { page, total_pages: totalPages, pending_files: pendingFiles };
         }
-        const results = await Promise.all(filesToProcess.map((f) => readOneFile(f, globalExtract, format, includeLineNumbers, maxPerItem, this.fileCache, this.projectIndex, globalImageMode, globalMaxImageSize, this.codeIntelligence)));
+        const results = await mapWithConcurrency(filesToProcess, MAX_PARALLEL_READ_FILES, (f) => readOneFile(f, globalExtract, format, includeLineNumbers, maxPerItem, this.fileCache, this.projectIndex, globalImageMode, globalMaxImageSize, this.codeIntelligence));
         if (maxTokens !== undefined) {
             let usedTokens = 0;
             for (const r of results) {

package/dist/_internal/platform/tools/read/schema.d.ts

@@ -55,6 +55,7 @@ export declare const READ_TOOL_SCHEMA: {
                 readonly required: readonly ["path"];
             };
             readonly minItems: 1;
+            readonly maxItems: 50;
         };
         readonly extract: {
             readonly type: "string";

package/dist/_internal/platform/tools/read/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/read/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkHnB,CAAC;AAEX,kDAAkD;AAClD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;AAE9E,+BAA+B;AAC/B,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,SAAS,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,YAAY,CAAC;QACtB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/read/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmHnB,CAAC;AAEX,kDAAkD;AAClD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;AAE9E,+BAA+B;AAC/B,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,SAAS,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE;QACP,MAAM,CAAC,EAAE,YAAY,CAAC;QACtB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/_internal/platform/tools/read/schema.js

@@ -53,6 +53,7 @@ export const READ_TOOL_SCHEMA = {
                 required: ['path'],
             },
             minItems: 1,
+            maxItems: 50,
         },
         extract: {
             type: 'string',

package/dist/_internal/platform/tools/shared/process-manager.d.ts

@@ -19,6 +19,7 @@ export interface BackgroundProcess {
      * Null if the process completed normally or SIGKILL was never scheduled.
      */
     killDeadline: number | null;
+    completedAt?: number;
 }
 export interface SpawnOptions {
     /** Abort the process if it hasn't completed within this many ms. Default: 60000. */
@@ -76,5 +77,6 @@ export declare class ProcessManager {
      * Returns a BgCommandResult if the command was handled, null otherwise.
      */
     handleCommand(cmd: string): BgCommandResult | null;
+    private pruneCompletedProcesses;
 }
 //# sourceMappingURL=process-manager.d.ts.map

package/dist/_internal/platform/tools/shared/process-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-manager.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/shared/process-manager.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;GAKG;AAIH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAID,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,MAAM,CAAmD;IAIjE,OAAO,CAAC,KAAK;IAMb;;;;;;;;;;OAUG;IACG,KAAK,CACT,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,eAAe,CAAC;IA2F3B,iFAAiF;IACjF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIpD,kEAAkE;IAClE,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IASrE;;;OAGG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAczB,yEAAyE;IACzE,IAAI,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IASvE;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;CAmDnD"}
+{"version":3,"file":"process-manager.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/shared/process-manager.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;GAKG;AAIH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAQD,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,UAAU,CAAwC;IAC1D,OAAO,CAAC,MAAM,CAAmD;IAIjE,OAAO,CAAC,KAAK;IAMb;;;;;;;;;;OAUG;IACG,KAAK,CACT,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,CAAC,EAAE,YAAY,GAClB,OAAO,CAAC,eAAe,CAAC;IAkG3B,iFAAiF;IACjF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAKpD,kEAAkE;IAClE,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAUrE;;;OAGG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAczB,yEAAyE;IACzE,IAAI,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAUvE;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAqDlD,OAAO,CAAC,uBAAuB;CAWhC"}

package/dist/_internal/platform/tools/shared/process-manager.js

@@ -1,4 +1,7 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
+const MAX_PROCESS_OUTPUT_BYTES = 256 * 1024;
+const MAX_COMPLETED_PROCESSES = 100;
+const COMPLETED_PROCESS_TTL_MS = 30 * 60 * 1000;
 // ─── ProcessManager ───────────────────────────────────────────────────────────
 export class ProcessManager {
     _counter = 0;
@@ -35,6 +38,7 @@ export class ProcessManager {
             done: false,
             killDeadline: null,
         };
+        this.pruneCompletedProcesses();
         this._processes.set(id, entry);
         const cleanEnv = Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined));
         const mergedEnv = { ...cleanEnv, ...env };
@@ -58,15 +62,18 @@ export class ProcessManager {
         // Cast stdout/stderr to ReadableStream — Bun guarantees these are ReadableStream
         // when stdout/stderr is set to 'pipe', but the return type is a union.
         const collectionPromise = (async () => {
-            const [stdoutText, stderrText] = await Promise.all([
-                new Response(proc.stdout).text(),
-                new Response(proc.stderr).text(),
+            const [stdoutText, stderrText, exitCode] = await Promise.all([
+                readProcessStream(proc.stdout),
+                readProcessStream(proc.stderr),
+                proc.exited,
             ]);
             entry.stdout.push(stdoutText);
             entry.stderr.push(stderrText);
-            entry.exitCode = await proc.exited;
+            entry.exitCode = exitCode;
             entry.done = true;
+            entry.completedAt = Date.now();
             this._procs.delete(id);
+            this.pruneCompletedProcesses();
         })();
         // Timeout watchdog: SIGTERM → wait grace → SIGKILL
         const timeoutHandle = setTimeout(async () => {
@@ -77,7 +84,7 @@ export class ProcessManager {
             }
             catch { /* already exited */ }
             entry.killDeadline = Date.now() + sigtermGraceMs;
-            await new Promise((r) => setTimeout(r, sigtermGraceMs));
+            await sleep(sigtermGraceMs);
             if (!entry.done) {
                 try {
                     proc.kill('SIGKILL');
@@ -85,13 +92,16 @@ export class ProcessManager {
                 catch { /* already exited */ }
             }
         }, timeoutMs);
+        timeoutHandle.unref?.();
         // Reject the spawn promise if the process errors immediately (ENOENT/EACCES
         // on the child process level) — the outer try/catch handles Bun.spawn throws;
         // this handles async failures surfaced via proc.exited rejecting.
         void collectionPromise.catch(() => {
             clearTimeout(timeoutHandle);
             entry.done = true;
+            entry.completedAt = Date.now();
             this._procs.delete(id);
+            this.pruneCompletedProcesses();
         });
         // Clear the timeout watchdog once the process completes naturally
         void collectionPromise.then(() => {
@@ -109,10 +119,12 @@ export class ProcessManager {
     }
     /** Get the status record for a background process, or undefined if not found. */
     getStatus(id) {
+        this.pruneCompletedProcesses();
         return this._processes.get(id);
     }
     /** Get the accumulated stdout/stderr for a background process. */
     getOutput(id) {
+        this.pruneCompletedProcesses();
         const entry = this._processes.get(id);
         if (!entry)
             return undefined;
@@ -143,6 +155,7 @@ export class ProcessManager {
     }
     /** List all tracked background processes with their status summaries. */
     list() {
+        this.pruneCompletedProcesses();
         return Array.from(this._processes.values()).map((e) => ({
             id: e.id,
             pid: e.pid,
@@ -155,6 +168,7 @@ export class ProcessManager {
      * Returns a BgCommandResult if the command was handled, null otherwise.
      */
     handleCommand(cmd) {
+        this.pruneCompletedProcesses();
         // bg_status <id>
         const statusMatch = cmd.match(/^bg_status\s+(\S+)$/);
         if (statusMatch) {
@@ -201,4 +215,52 @@ export class ProcessManager {
         }
         return null;
     }
+    pruneCompletedProcesses(now = Date.now()) {
+        const completed = [...this._processes.values()]
+            .filter((entry) => entry.done)
+            .sort((a, b) => (b.completedAt ?? b.startTime) - (a.completedAt ?? a.startTime));
+        for (let i = 0; i < completed.length; i++) {
+            const entry = completed[i];
+            const completedAt = entry.completedAt ?? entry.startTime;
+            if (now - completedAt <= COMPLETED_PROCESS_TTL_MS && i < MAX_COMPLETED_PROCESSES)
+                continue;
+            this._processes.delete(entry.id);
+        }
+    }
+}
+async function readProcessStream(stream) {
+    const reader = stream.getReader();
+    const decoder = new TextDecoder();
+    let total = 0;
+    let output = '';
+    let truncated = false;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const remaining = MAX_PROCESS_OUTPUT_BYTES - total;
+            if (remaining > 0) {
+                const chunk = value.byteLength > remaining ? value.subarray(0, remaining) : value;
+                output += decoder.decode(chunk, { stream: true });
+                total += chunk.byteLength;
+            }
+            if (value.byteLength > remaining) {
+                truncated = true;
+            }
+        }
+        output += decoder.decode();
+        return truncated
+            ? `${output}\n[goodvibes: output truncated after ${MAX_PROCESS_OUTPUT_BYTES} bytes]\n`
+            : output;
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref?.();
+    });
 }

package/dist/_internal/platform/tools/write/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/write/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAGjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAkV7E,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChC,aAAa,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;CAC5D,GAAG,IAAI,CAmPP"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/tools/write/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,sBAAsB,CAAC;AAGjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAIxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AA+S7E,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChC,aAAa,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;CAC5D,GAAG,IAAI,CAmPP"}

package/dist/_internal/platform/tools/write/index.js

@@ -1,5 +1,5 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, copyFileSync, unlinkSync, realpathSync } from 'node:fs';
-import { dirname, extname, join, relative, resolve } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, copyFileSync, unlinkSync } from 'node:fs';
+import { dirname, extname, join, relative } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { WRITE_SCHEMA } from './schema.js';
 import { runValidators, formatValidatorFailure } from '../shared/validators.js';
@@ -10,6 +10,7 @@ import { AutoHealer } from '../shared/auto-heal.js';
 import { isNotebookFile } from '../../utils/notebook.js';
 import { logger } from '../../utils/logger.js';
 import { summarizeError } from '../../utils/error-display.js';
+import { resolveAndValidatePath } from '../../utils/path-safety.js';
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -31,40 +32,6 @@ function buildBackupPath(resolvedPath, projectRoot) {
     const rel = relative(projectRoot, resolvedPath);
     return join(projectRoot, '.goodvibes', '.backups', `${rel}.${Date.now()}`);
 }
-function nearestExistingPath(path) {
-    let current = path;
-    while (!existsSync(current)) {
-        const parent = dirname(current);
-        if (parent === current)
-            return current;
-        current = parent;
-    }
-    return current;
-}
-function isInsideRoot(root, candidate) {
-    const rel = relative(root, candidate);
-    return rel === '' || (!rel.startsWith('..') && !rel.includes('/..') && !rel.startsWith('/'));
-}
-function resolveAndValidatePath(inputPath, projectRoot) {
-    const root = realpathSync(resolve(projectRoot));
-    const resolved = resolve(root, inputPath);
-    const rel = relative(root, resolved);
-    if (rel.startsWith('..') || rel.includes('/..')) {
-        throw new Error(`Path '${inputPath}' is outside the project root`);
-    }
-    const existingPath = nearestExistingPath(resolved);
-    const realExistingPath = realpathSync(existingPath);
-    if (!isInsideRoot(root, realExistingPath)) {
-        throw new Error(`Path '${inputPath}' is outside the project root`);
-    }
-    if (existsSync(resolved)) {
-        const realTargetPath = realpathSync(resolved);
-        if (!isInsideRoot(root, realTargetPath)) {
-            throw new Error(`Path '${inputPath}' is outside the project root`);
-        }
-    }
-    return resolved;
-}
 /** Module-level constant — avoids re-allocating the Set on every validation call. */
 const VALID_CELL_TYPES = new Set(['code', 'markdown', 'raw']);
 /**

package/dist/_internal/platform/utils/concurrency.d.ts

@@ -0,0 +1,3 @@
+/** Run async work with a fixed concurrency cap while preserving input order. */
+export declare function mapWithConcurrency<T, R>(items: readonly T[], limit: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/_internal/platform/utils/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/utils/concurrency.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,EAAE,CAAC,CAmBd"}

package/dist/_internal/platform/utils/concurrency.js

@@ -0,0 +1,17 @@
+/** Run async work with a fixed concurrency cap while preserving input order. */
+export async function mapWithConcurrency(items, limit, worker) {
+    const concurrency = Math.max(1, Math.floor(limit));
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    async function runWorker() {
+        for (;;) {
+            const index = nextIndex++;
+            if (index >= items.length)
+                return;
+            results[index] = await worker(items[index], index);
+        }
+    }
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, () => runWorker());
+    await Promise.all(workers);
+    return results;
+}