@probelabs/visor 0.1.49 → 0.1.50

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-process.env.VISOR_VERSION = '0.1.49';
+process.env.VISOR_VERSION = '0.1.50';
 /******/ (() => { // webpackBootstrap
 /******/ 	var __webpack_modules__ = ({
 
@@ -94138,11 +94138,12 @@ ${prContext}
      */
     formatPRContext(prInfo) {
         // Check if this is an issue (not a PR)
-        const isIssue = prInfo.isIssue === true;
+        const prContextInfo = prInfo;
+        const isIssue = prContextInfo.isIssue === true;
         // Check if we should include code context (diffs)
-        const isPRContext = prInfo.isPRContext === true;
+        const isPRContext = prContextInfo.isPRContext === true;
         // In PR context, always include diffs. Otherwise check the flag.
-        const includeCodeContext = isPRContext || prInfo.includeCodeContext !== false;
+        const includeCodeContext = isPRContext || prContextInfo.includeCodeContext !== false;
         // Log the decision for transparency
         const log = this.config.debug ? console.error : () => { };
         if (isPRContext) {
@@ -94486,12 +94487,16 @@ ${prInfo.fullDiff ? this.escapeXml(prInfo.fullDiff) : ''}
             if (this.config.provider) {
                 // Map claude-code to anthropic for ProbeAgent compatibility
                 // Map bedrock to anthropic temporarily until ProbeAgent adds bedrock type
-                options.provider =
-                    this.config.provider === 'claude-code'
-                        ? 'anthropic'
-                        : this.config.provider === 'bedrock'
-                            ? 'anthropic'
-                            : this.config.provider;
+                const providerOverride = this.config.provider === 'claude-code' || this.config.provider === 'bedrock'
+                    ? 'anthropic'
+                    : this.config.provider === 'anthropic' ||
+                        this.config.provider === 'openai' ||
+                        this.config.provider === 'google'
+                        ? this.config.provider
+                        : undefined;
+                if (providerOverride) {
+                    options.provider = providerOverride;
+                }
             }
             if (this.config.model) {
                 options.model = this.config.model;
@@ -95230,7 +95235,6 @@ class CheckExecutionEngine {
                     const result = await tasks[taskIndex]();
                     results[taskIndex] = { status: 'fulfilled', value: result };
                     // Check if we should stop due to fail-fast
-                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
                     if (failFast && this.shouldFailFast(result)) {
                         shouldStop = true;
                         break;
@@ -95263,7 +95267,11 @@ class CheckExecutionEngine {
         // Store config for use in filtering
         this.config = config;
         // Determine where to send log messages based on output format
-        const logFn = outputFormat === 'json' || outputFormat === 'sarif' ? console.error : console.log;
+        const logFn = outputFormat === 'json' || outputFormat === 'sarif'
+            ? debug
+                ? console.error
+                : () => { }
+            : console.log;
         // Only output debug messages if debug mode is enabled
         if (debug) {
             logFn(`🔧 Debug: executeReviewChecks called with checks: ${JSON.stringify(checks)}`);
@@ -95385,7 +95393,11 @@ class CheckExecutionEngine {
      */
     async executeGroupedChecks(prInfo, checks, timeout, config, outputFormat, debug, maxParallelism, failFast, tagFilter) {
         // Determine where to send log messages based on output format
-        const logFn = outputFormat === 'json' || outputFormat === 'sarif' ? console.error : console.log;
+        const logFn = outputFormat === 'json' || outputFormat === 'sarif'
+            ? debug
+                ? console.error
+                : () => { }
+            : console.log;
         // Only output debug messages if debug mode is enabled
         if (debug) {
             logFn(`🔧 Debug: executeGroupedChecks called with checks: ${JSON.stringify(checks)}`);
@@ -95465,6 +95477,7 @@ class CheckExecutionEngine {
             // Pass any provider-specific config
             ...checkConfig,
         };
+        providerConfig.forEach = checkConfig.forEach;
         const result = await provider.execute(prInfo, providerConfig);
         // Render the check content using the appropriate template
         const content = await this.renderCheckContent(checkName, result, checkConfig, prInfo);
@@ -95490,6 +95503,7 @@ class CheckExecutionEngine {
      */
     async convertReviewSummaryToGroupedResults(reviewSummary, checks, config, prInfo) {
         const groupedResults = {};
+        const contentMap = reviewSummary.__contents;
         // Process each check individually
         for (const checkName of checks) {
             const checkConfig = config?.checks?.[checkName];
@@ -95502,6 +95516,10 @@ class CheckExecutionEngine {
                 issues: checkIssues,
                 debug: reviewSummary.debug,
             };
+            if (contentMap?.[checkName]) {
+                const summaryWithContent = checkSummary;
+                summaryWithContent.content = contentMap[checkName];
+            }
             // Render content for this check
             const content = await this.renderCheckContent(checkName, checkSummary, checkConfig, prInfo);
             const checkResult = {
@@ -95583,6 +95601,10 @@ class CheckExecutionEngine {
      * Render check content using the appropriate template
      */
     async renderCheckContent(checkName, reviewSummary, checkConfig, _prInfo) {
+        const directContent = reviewSummary.content;
+        if (typeof directContent === 'string' && directContent.trim()) {
+            return directContent.trim();
+        }
         // Import the liquid template system
         const { Liquid } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(48694)));
         const fs = await Promise.resolve().then(() => __importStar(__nccwpck_require__(91943)));
@@ -95768,6 +95790,7 @@ class CheckExecutionEngine {
                     const provider = this.providerRegistry.getProviderOrThrow(providerType);
                     this.setProviderWebhookContext(provider);
                     // Create provider config for this specific check
+                    const extendedCheckConfig = checkConfig;
                     const providerConfig = {
                         type: providerType,
                         prompt: checkConfig.prompt,
@@ -95778,9 +95801,11 @@ class CheckExecutionEngine {
                         checkName: checkName, // Add checkName for sessionID
                         eventContext: prInfo.eventContext, // Pass event context for templates
                         transform: checkConfig.transform,
-                        level: checkConfig.level,
-                        message: checkConfig.message,
+                        transform_js: checkConfig.transform_js,
+                        level: extendedCheckConfig.level,
+                        message: extendedCheckConfig.message,
                         env: checkConfig.env,
+                        forEach: checkConfig.forEach,
                         ai: {
                             timeout: timeout || 600000,
                             debug: debug,
@@ -95797,9 +95822,10 @@ class CheckExecutionEngine {
                             const depResult = results.get(depId);
                             dependencyResults.set(depId, depResult);
                             // Check if this dependency has forEach enabled
-                            if (depResult.isForEach && depResult.forEachItems) {
+                            const depForEachResult = depResult;
+                            if (depForEachResult.isForEach && Array.isArray(depForEachResult.forEachItems)) {
                                 isForEachDependent = true;
-                                forEachItems = depResult.forEachItems;
+                                forEachItems = depForEachResult.forEachItems;
                                 forEachParentName = depId;
                             }
                         }
@@ -95836,17 +95862,22 @@ class CheckExecutionEngine {
                         log(`🔄 Debug: Check "${checkName}" depends on forEach check "${forEachParentName}", executing ${forEachItems.length} times`);
                         const allIssues = [];
                         const allOutputs = [];
-                        // Execute check for each item in the forEach array
-                        for (let itemIndex = 0; itemIndex < forEachItems.length; itemIndex++) {
-                            const item = forEachItems[itemIndex];
+                        const aggregatedContents = [];
+                        const itemTasks = forEachItems.map((item, itemIndex) => async () => {
                             // Create modified dependency results with current item
                             const forEachDependencyResults = new Map();
                             for (const [depName, depResult] of dependencyResults) {
                                 if (depName === forEachParentName) {
-                                    // Replace the entire forEach parent result with just the current item
-                                    // This ensures that outputs.fetch-tickets contains the individual item
-                                    const modifiedResult = item;
+                                    const modifiedResult = {
+                                        issues: [],
+                                        output: item,
+                                    };
                                     forEachDependencyResults.set(depName, modifiedResult);
+                                    const rawResult = {
+                                        issues: [],
+                                        output: forEachItems,
+                                    };
+                                    forEachDependencyResults.set(`${depName}-raw`, rawResult);
                                 }
                                 else {
                                     forEachDependencyResults.set(depName, depResult);
@@ -95854,24 +95885,49 @@ class CheckExecutionEngine {
                             }
                             log(`🔄 Debug: Executing check "${checkName}" for item ${itemIndex + 1}/${forEachItems.length}`);
                             const itemResult = await provider.execute(prInfo, providerConfig, forEachDependencyResults, sessionInfo);
-                            // Collect issues from each iteration
+                            return { index: itemIndex, itemResult };
+                        });
+                        const forEachConcurrency = Math.max(1, Math.min(forEachItems.length, effectiveMaxParallelism));
+                        if (debug && forEachConcurrency > 1) {
+                            log(`🔄 Debug: Limiting forEach concurrency for check "${checkName}" to ${forEachConcurrency}`);
+                        }
+                        const forEachResults = await this.executeWithLimitedParallelism(itemTasks, forEachConcurrency, false);
+                        for (const result of forEachResults) {
+                            if (result.status === 'rejected') {
+                                throw result.reason;
+                            }
+                            const { itemResult } = result.value;
                             if (itemResult.issues) {
                                 allIssues.push(...itemResult.issues);
                             }
-                            // Collect outputs from each iteration
-                            if (itemResult.output) {
-                                allOutputs.push(itemResult.output);
+                            const resultWithOutput = itemResult;
+                            if (resultWithOutput.output !== undefined) {
+                                allOutputs.push(resultWithOutput.output);
+                            }
+                            const itemContent = resultWithOutput.content;
+                            if (typeof itemContent === 'string' && itemContent.trim()) {
+                                aggregatedContents.push(itemContent.trim());
                             }
                         }
+                        const finalOutput = allOutputs.length > 0 ? allOutputs : undefined;
                         finalResult = {
                             issues: allIssues,
-                            output: allOutputs.length > 0 ? allOutputs : undefined,
+                            ...(finalOutput !== undefined ? { output: finalOutput } : {}),
                         };
+                        if (aggregatedContents.length > 0) {
+                            finalResult.content =
+                                aggregatedContents.join('\n');
+                        }
                         log(`🔄 Debug: Completed forEach execution for check "${checkName}", total issues: ${allIssues.length}`);
                     }
                     else {
                         // Normal single execution
                         finalResult = await provider.execute(prInfo, providerConfig, dependencyResults, sessionInfo);
+                        if (process.env.DEBUG && checkConfig.forEach) {
+                            const finalResultWithOutput = finalResult;
+                            const outputPreview = JSON.stringify(finalResultWithOutput.output).slice(0, 200);
+                            console.log(`🔧 Debug: Check "${checkName}" provider returned:`, outputPreview);
+                        }
                         log(`🔧 Debug: Completed check: ${checkName}, issues found: ${(finalResult.issues || []).length}`);
                     }
                     // Add group, schema, template info and timestamp to issues from config
@@ -95913,28 +95969,39 @@ class CheckExecutionEngine {
                 if (result.status === 'fulfilled' && result.value.result && !result.value.error) {
                     const reviewResult = result.value.result;
                     // Handle forEach logic - process array outputs
-                    if (checkConfig?.forEach && reviewResult.output) {
-                        let outputArray = reviewResult.output;
-                        // Ensure output is an array
-                        if (!Array.isArray(outputArray)) {
-                            // Try to parse as JSON if it's a string
-                            if (typeof outputArray === 'string') {
-                                try {
-                                    const parsed = JSON.parse(outputArray);
-                                    outputArray = Array.isArray(parsed) ? parsed : [parsed];
-                                }
-                                catch {
-                                    outputArray = [outputArray];
-                                }
+                    const reviewSummaryWithOutput = reviewResult;
+                    if (checkConfig?.forEach && reviewSummaryWithOutput.output !== undefined) {
+                        if (process.env.DEBUG) {
+                            console.log(`🔧 Debug: Raw output for forEach check ${checkName}:`, Array.isArray(reviewSummaryWithOutput.output)
+                                ? `array(${reviewSummaryWithOutput.output.length})`
+                                : typeof reviewSummaryWithOutput.output);
+                        }
+                        const rawOutput = reviewSummaryWithOutput.output;
+                        let normalizedOutput;
+                        if (Array.isArray(rawOutput)) {
+                            normalizedOutput = rawOutput;
+                        }
+                        else if (typeof rawOutput === 'string') {
+                            try {
+                                const parsed = JSON.parse(rawOutput);
+                                normalizedOutput = Array.isArray(parsed) ? parsed : [parsed];
                             }
-                            else {
-                                outputArray = [outputArray];
+                            catch {
+                                normalizedOutput = [rawOutput];
                             }
                         }
-                        log(`🔄 Debug: Check "${checkName}" has forEach enabled, processing ${outputArray.length} items`);
+                        else if (rawOutput === undefined || rawOutput === null) {
+                            normalizedOutput = [];
+                        }
+                        else {
+                            normalizedOutput = [rawOutput];
+                        }
+                        if (process.env.DEBUG) {
+                            console.log(`🔧 Debug: Check "${checkName}" forEach output:`, JSON.stringify(normalizedOutput).slice(0, 200));
+                        }
                         // Store the array for iteration by dependent checks
-                        reviewResult.forEachItems = outputArray;
-                        reviewResult.isForEach = true;
+                        reviewSummaryWithOutput.forEachItems = normalizedOutput;
+                        reviewSummaryWithOutput.isForEach = true;
                     }
                     results.set(checkName, reviewResult);
                 }
@@ -96177,6 +96244,7 @@ class CheckExecutionEngine {
     aggregateDependencyAwareResults(results, dependencyGraph, debug, stoppedEarly) {
         const aggregatedIssues = [];
         const debugInfo = [];
+        const contentMap = {};
         // Add execution plan info
         const stats = dependency_resolver_1.DependencyResolver.getExecutionStats(dependencyGraph);
         const executionInfo = [
@@ -96209,9 +96277,16 @@ class CheckExecutionEngine {
                 }
                 // Issues are already prefixed and enriched with group/schema info
                 aggregatedIssues.push(...(result.issues || []));
+                const resultSummary = result;
+                const resultContent = resultSummary.content;
+                if (typeof resultContent === 'string' && resultContent.trim()) {
+                    contentMap[checkName] = resultContent.trim();
+                }
             }
         }
-        console.error(`🔧 Debug: Aggregated ${aggregatedIssues.length} issues from ${results.size} dependency-aware checks`);
+        if (debug) {
+            console.error(`🔧 Debug: Aggregated ${aggregatedIssues.length} issues from ${results.size} dependency-aware checks`);
+        }
         // Apply issue suppression filtering
         const suppressionEnabled = this.config?.output?.suppressionEnabled !== false;
         const issueFilter = new issue_filter_1.IssueFilter(suppressionEnabled);
@@ -96253,10 +96328,14 @@ class CheckExecutionEngine {
                 };
             }
         }
-        return {
+        const summary = {
             issues: filteredIssues,
             debug: aggregatedDebug,
         };
+        if (Object.keys(contentMap).length > 0) {
+            summary.__contents = contentMap;
+        }
+        return summary;
     }
     /**
      * Aggregate results from parallel check execution (legacy method)
@@ -96326,7 +96405,9 @@ class CheckExecutionEngine {
                 });
             }
         });
-        console.error(`🔧 Debug: Aggregated ${aggregatedIssues.length} issues from ${results.length} checks`);
+        if (debug) {
+            console.error(`🔧 Debug: Aggregated ${aggregatedIssues.length} issues from ${results.length} checks`);
+        }
         // Apply issue suppression filtering
         const suppressionEnabled = this.config?.output?.suppressionEnabled !== false;
         const issueFilter = new issue_filter_1.IssueFilter(suppressionEnabled);
@@ -96546,14 +96627,36 @@ class CheckExecutionEngine {
     /**
      * Check if a task result should trigger fail-fast behavior
      */
+    isFailFastCandidate(value) {
+        if (typeof value !== 'object' || value === null) {
+            return false;
+        }
+        const candidate = value;
+        if (candidate.error !== undefined && typeof candidate.error !== 'string') {
+            return false;
+        }
+        if (candidate.result !== undefined) {
+            if (typeof candidate.result !== 'object' || candidate.result === null) {
+                return false;
+            }
+            const issues = candidate.result.issues;
+            if (issues !== undefined && !Array.isArray(issues)) {
+                return false;
+            }
+        }
+        return true;
+    }
     shouldFailFast(result) {
-        // If the result has an error property, it's a failed check
-        if (result?.error) {
+        if (!this.isFailFastCandidate(result)) {
+            return false;
+        }
+        if (result.error) {
             return true;
         }
         // If the result has a result with critical or error issues, it should fail fast
-        if (result?.result?.issues) {
-            return (result.result.issues || []).some((issue) => issue.severity === 'error' || issue.severity === 'critical');
+        const issues = result.result?.issues;
+        if (Array.isArray(issues)) {
+            return issues.some(issue => issue?.severity === 'error' || issue?.severity === 'critical');
         }
         return false;
     }
@@ -96939,6 +97042,9 @@ async function main() {
         const filteredArgv = process.argv.filter(arg => arg !== '--cli');
         // Parse arguments using the CLI class
         const options = cli.parseArgs(filteredArgv);
+        const explicitChecks = options.checks.length > 0
+            ? new Set(options.checks.map(check => check.toString()))
+            : null;
         // Set environment variables early for proper logging in all modules
         process.env.VISOR_OUTPUT_FORMAT = options.output;
         process.env.VISOR_DEBUG = options.debug ? 'true' : 'false';
@@ -96992,7 +97098,7 @@ async function main() {
                 .catch(() => configManager.getDefaultConfig());
         }
         // Determine checks to run and validate check types early
-        const checksToRun = options.checks.length > 0 ? options.checks : Object.keys(config.checks || {});
+        let checksToRun = options.checks.length > 0 ? options.checks : Object.keys(config.checks || {});
         // Validate that all requested checks exist in the configuration
         const availableChecks = Object.keys(config.checks || {});
         const invalidChecks = checksToRun.filter(check => !availableChecks.includes(check));
@@ -97000,8 +97106,28 @@ async function main() {
             console.error(`❌ Error: No configuration found for check: ${invalidChecks[0]}`);
             process.exit(1);
         }
+        // Include dependencies of requested checks
+        const checksWithDependencies = new Set(checksToRun);
+        const addDependencies = (checkName) => {
+            const checkConfig = config.checks?.[checkName];
+            if (checkConfig?.depends_on) {
+                for (const dep of checkConfig.depends_on) {
+                    if (!checksWithDependencies.has(dep)) {
+                        checksWithDependencies.add(dep);
+                        addDependencies(dep); // Recursively add dependencies of dependencies
+                    }
+                }
+            }
+        };
+        // Add all dependencies
+        for (const check of checksToRun) {
+            addDependencies(check);
+        }
+        // Update checksToRun to include dependencies
+        checksToRun = Array.from(checksWithDependencies);
         // Use stderr for status messages when outputting formatted results to stdout
-        const logFn = console.error;
+        // Suppress all status messages when outputting JSON to avoid breaking parsers
+        const logFn = options.output === 'json' ? () => { } : console.error;
         // Determine if we should include code context (diffs)
         // In CLI mode (local), we do smart detection. PR mode always includes context.
         const isPRContext = false; // This is CLI mode, not GitHub Action
@@ -97047,14 +97173,14 @@ async function main() {
             console.error('❌ Error: Not a git repository. Run "git init" to initialize a repository.');
             process.exit(1);
         }
+        logFn('🔍 Visor - AI-powered code review tool');
+        logFn(`Configuration version: ${config.version}`);
+        logFn(`Configuration source: ${options.configPath || 'default search locations'}`);
         // Check if there are any changes to analyze (only when code context is needed)
         if (includeCodeContext && repositoryInfo.files.length === 0) {
             console.error('❌ Error: No changes to analyze. Make some file changes first.');
             process.exit(1);
         }
-        logFn('🔍 Visor - AI-powered code review tool');
-        logFn(`Configuration version: ${config.version}`);
-        logFn(`Configuration source: ${options.configPath || 'default search locations'}`);
         // Show registered providers if in debug mode
         if (options.debug) {
             const { CheckProviderRegistry } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(57140)));
@@ -97077,26 +97203,52 @@ async function main() {
         // Convert repository info to PRInfo format
         const prInfo = analyzer.toPRInfo(repositoryInfo, includeCodeContext);
         // Store the includeCodeContext flag in prInfo for downstream use
-        prInfo.includeCodeContext = includeCodeContext;
+        const prInfoWithContext = prInfo;
+        prInfoWithContext.includeCodeContext = includeCodeContext;
         // Execute checks with proper parameters
         const groupedResults = await engine.executeGroupedChecks(prInfo, checksToRun, options.timeout, config, options.output, options.debug || false, options.maxParallelism, options.failFast, tagFilter);
+        const shouldFilterResults = explicitChecks && explicitChecks.size > 0 && !explicitChecks.has('all');
+        const groupedResultsToUse = shouldFilterResults
+            ? Object.fromEntries(Object.entries(groupedResults)
+                .map(([group, checkResults]) => [
+                group,
+                checkResults.filter(check => explicitChecks.has(check.checkName)),
+            ])
+                .filter(([, checkResults]) => checkResults.length > 0))
+            : groupedResults;
+        if (shouldFilterResults) {
+            for (const [group, checkResults] of Object.entries(groupedResults)) {
+                for (const check of checkResults) {
+                    if (check.issues && check.issues.length > 0 && !explicitChecks.has(check.checkName)) {
+                        if (!groupedResultsToUse[group]) {
+                            groupedResultsToUse[group] = [];
+                        }
+                        const alreadyIncluded = groupedResultsToUse[group].some(existing => existing.checkName === check.checkName);
+                        if (!alreadyIncluded) {
+                            groupedResultsToUse[group].push(check);
+                        }
+                    }
+                }
+            }
+        }
+        const executedCheckNames = Array.from(new Set(Object.values(groupedResultsToUse).flatMap((checks) => checks.map(check => check.checkName))));
         // Format output based on format type
         let output;
         if (options.output === 'json') {
-            output = JSON.stringify(groupedResults, null, 2);
+            output = JSON.stringify(groupedResultsToUse, null, 2);
         }
         else if (options.output === 'sarif') {
             // Build analysis result and format as SARIF
             const analysisResult = {
                 repositoryInfo,
                 reviewSummary: {
-                    issues: Object.values(groupedResults)
+                    issues: Object.values(groupedResultsToUse)
                         .flatMap((r) => r.map((check) => check.issues || []).flat())
                         .flat(),
                 },
                 executionTime: 0,
                 timestamp: new Date().toISOString(),
-                checksExecuted: checksToRun,
+                checksExecuted: executedCheckNames,
             };
             output = output_formatters_1.OutputFormatters.formatAsSarif(analysisResult);
         }
@@ -97105,13 +97257,13 @@ async function main() {
             const analysisResult = {
                 repositoryInfo,
                 reviewSummary: {
-                    issues: Object.values(groupedResults)
+                    issues: Object.values(groupedResultsToUse)
                         .flatMap((r) => r.map((check) => check.issues || []).flat())
                         .flat(),
                 },
                 executionTime: 0,
                 timestamp: new Date().toISOString(),
-                checksExecuted: checksToRun,
+                checksExecuted: executedCheckNames,
             };
             output = output_formatters_1.OutputFormatters.formatAsMarkdown(analysisResult);
         }
@@ -97120,19 +97272,19 @@ async function main() {
             const analysisResult = {
                 repositoryInfo,
                 reviewSummary: {
-                    issues: Object.values(groupedResults)
+                    issues: Object.values(groupedResultsToUse)
                         .flatMap((r) => r.map((check) => check.issues || []).flat())
                         .flat(),
                 },
                 executionTime: 0,
                 timestamp: new Date().toISOString(),
-                checksExecuted: checksToRun,
+                checksExecuted: executedCheckNames,
             };
             output = output_formatters_1.OutputFormatters.formatAsTable(analysisResult, { showDetails: true });
         }
         console.log(output);
         // Check for critical issues
-        const allResults = Object.values(groupedResults).flat();
+        const allResults = Object.values(groupedResultsToUse).flat();
         const criticalCount = allResults.reduce((sum, result) => {
             const issues = result.issues || [];
             return (sum + issues.filter((issue) => issue.severity === 'critical').length);
@@ -102243,8 +102395,10 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
             }
         }
         // Validate check-level MCP servers if present
-        if (cfg.ai_mcp_servers) {
-            if (!this.validateMcpServers(cfg.ai_mcp_servers)) {
+        const checkLevelMcpServers = cfg
+            .ai_mcp_servers;
+        if (checkLevelMcpServers) {
+            if (!this.validateMcpServers(checkLevelMcpServers)) {
                 return false;
             }
         }
@@ -102262,10 +102416,10 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
                 return false;
             }
             const config = serverConfig;
-            if (!config.command || typeof config.command !== 'string') {
+            if (typeof config.command !== 'string') {
                 return false;
             }
-            if (config.args && !Array.isArray(config.args)) {
+            if (config.args !== undefined && !Array.isArray(config.args)) {
                 return false;
             }
         }
@@ -102504,9 +102658,10 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
             outputs: dependencyResults
                 ? Object.fromEntries(Array.from(dependencyResults.entries()).map(([checkName, result]) => [
                     checkName,
-                    // If the result has a direct output field, use it directly
-                    // Otherwise, expose the entire result
-                    result.output !== undefined ? result.output : result,
+                    (() => {
+                        const summary = result;
+                        return summary.output !== undefined ? summary.output : summary;
+                    })(),
                 ]))
                 : {},
         };
@@ -102532,7 +102687,7 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
                     return tools;
                 }
                 const createSdkMcpServer = mcpModule.createSdkMcpServer || mcpModule.default?.createSdkMcpServer;
-                if (createSdkMcpServer) {
+                if (typeof createSdkMcpServer === 'function') {
                     for (const [serverName, serverConfig] of Object.entries(aiConfig.mcpServers)) {
                         try {
                             // Create MCP server instance
@@ -102543,8 +102698,8 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
                                 env: { ...process.env, ...serverConfig.env },
                             });
                             // Add server tools to available tools
-                            const serverTools = await server.listTools();
-                            tools.push(...serverTools.map((tool) => ({
+                            const serverTools = (await server.listTools());
+                            tools.push(...serverTools.map(tool => ({
                                 name: tool.name,
                                 server: serverName,
                             })));
@@ -102615,7 +102770,7 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
         // Setup MCP tools from multiple configuration levels
         const mcpServers = {};
         // 1. Start with global MCP servers (from visor config root)
-        const globalConfig = config; // Cast to access potential global config
+        const globalConfig = config;
         if (globalConfig.ai_mcp_servers) {
             Object.assign(mcpServers, globalConfig.ai_mcp_servers);
         }
@@ -102932,6 +103087,9 @@ const liquidjs_1 = __nccwpck_require__(48694);
 const promises_1 = __importDefault(__nccwpck_require__(91943));
 const path_1 = __importDefault(__nccwpck_require__(16928));
 const claude_code_types_1 = __nccwpck_require__(21710);
+function isClaudeCodeConstructor(value) {
+    return typeof value === 'function';
+}
 /**
  * Error thrown when Claude Code SDK is not installed
  */
@@ -103026,8 +103184,8 @@ class ClaudeCodeCheckProvider extends check_provider_interface_1.CheckProvider {
         if (!claudeCodeModule) {
             throw new ClaudeCodeSDKNotInstalledError();
         }
-        const ClaudeCode = claudeCodeModule.ClaudeCode || claudeCodeModule.default?.ClaudeCode;
-        if (!ClaudeCode) {
+        const ClaudeCodeCtor = claudeCodeModule.ClaudeCode || claudeCodeModule.default?.ClaudeCode;
+        if (!isClaudeCodeConstructor(ClaudeCodeCtor)) {
             throw new Error('ClaudeCode class not found in @anthropic/claude-code-sdk');
         }
         // Initialize with API key from environment
@@ -103036,7 +103194,7 @@ class ClaudeCodeCheckProvider extends check_provider_interface_1.CheckProvider {
             throw new ClaudeCodeAPIKeyMissingError();
         }
         try {
-            const client = new ClaudeCode({
+            const client = new ClaudeCodeCtor({
                 apiKey,
             });
             this.claudeCodeClient = client;
@@ -103067,7 +103225,7 @@ class ClaudeCodeCheckProvider extends check_provider_interface_1.CheckProvider {
                     return tools;
                 }
                 const createSdkMcpServer = mcpModule.createSdkMcpServer || mcpModule.default?.createSdkMcpServer;
-                if (createSdkMcpServer) {
+                if (typeof createSdkMcpServer === 'function') {
                     for (const [serverName, serverConfig] of Object.entries(config.mcpServers)) {
                         try {
                             // Create MCP server instance
@@ -103078,8 +103236,8 @@ class ClaudeCodeCheckProvider extends check_provider_interface_1.CheckProvider {
                                 env: { ...process.env, ...serverConfig.env },
                             });
                             // Add server tools to available tools
-                            const serverTools = await server.listTools();
-                            tools.push(...serverTools.map((tool) => ({
+                            const serverTools = (await server.listTools());
+                            tools.push(...serverTools.map(tool => ({
                                 name: tool.name,
                                 server: serverName,
                             })));
@@ -103303,7 +103461,10 @@ class ClaudeCodeCheckProvider extends check_provider_interface_1.CheckProvider {
                     checkName,
                     // If the result has a direct output field, use it directly
                     // Otherwise, expose the entire result
-                    result.output !== undefined ? result.output : result,
+                    (() => {
+                        const summary = result;
+                        return summary.output !== undefined ? summary.output : summary;
+                    })(),
                 ]))
                 : {},
         };
@@ -103385,7 +103546,6 @@ class ClaudeCodeCheckProvider extends check_provider_interface_1.CheckProvider {
             }
             // Parse the response
             const result = this.parseStructuredResponse(response.content);
-            // Add debug information if needed by casting to any
             result.debug = {
                 prompt: processedPrompt,
                 rawResponse: response.content,
@@ -103399,7 +103559,7 @@ class ClaudeCodeCheckProvider extends check_provider_interface_1.CheckProvider {
                 errors: [],
                 checksExecuted: [config.checkName || 'claude-code-check'],
                 parallelExecution: false,
-                timestamp: Date.now(),
+                timestamp: new Date().toISOString(),
                 // Claude Code specific debug info
                 sessionId: response.session_id,
                 turnCount: response.turn_count,
@@ -103652,11 +103812,17 @@ class CommandCheckProvider extends check_provider_interface_1.CheckProvider {
             outputs: this.buildOutputContext(dependencyResults),
             env: this.getSafeEnvironmentVariables(),
         };
+        if (process.env.DEBUG) {
+            console.log('🔧 Debug: Template outputs keys:', Object.keys(templateContext.outputs || {}));
+        }
         try {
             // Render the command with Liquid templates if needed
             let renderedCommand = command;
             if (command.includes('{{') || command.includes('{%')) {
-                renderedCommand = await this.liquid.parseAndRender(command, templateContext);
+                renderedCommand = await this.renderCommandTemplate(command, templateContext);
+            }
+            if (process.env.DEBUG) {
+                console.log('🔧 Debug: Rendered command:', renderedCommand);
             }
             // Prepare environment variables - convert all to strings
             const scriptEnv = {};
@@ -103687,16 +103853,18 @@ class CommandCheckProvider extends check_provider_interface_1.CheckProvider {
             if (stderr && process.env.DEBUG) {
                 console.error(`Command stderr: ${stderr}`);
             }
-            // Try to parse output as JSON
-            let output = stdout.trim();
+            // Keep raw output for transforms
+            const rawOutput = stdout.trim();
+            // Try to parse output as JSON for default behavior
+            let output = rawOutput;
             try {
                 // Attempt to parse as JSON
-                const parsed = JSON.parse(stdout.trim());
+                const parsed = JSON.parse(rawOutput);
                 output = parsed;
             }
             catch {
                 // If not JSON, keep as string
-                output = stdout.trim();
+                output = rawOutput;
             }
             // Apply transform if specified (Liquid or JavaScript)
             let finalOutput = output;
@@ -103705,7 +103873,7 @@ class CommandCheckProvider extends check_provider_interface_1.CheckProvider {
                 try {
                     const transformContext = {
                         ...templateContext,
-                        output,
+                        output: output, // Use parsed output for Liquid (object if JSON, string otherwise)
                     };
                     const rendered = await this.liquid.parseAndRender(transform, transformContext);
                     // Try to parse the transformed result as JSON
@@ -103734,21 +103902,55 @@ class CommandCheckProvider extends check_provider_interface_1.CheckProvider {
             // Then apply JavaScript transform if present
             if (transformJs) {
                 try {
+                    // For transform_js, always use raw string output so JSON.parse() works as expected
                     const jsContext = {
-                        output: finalOutput,
+                        output: rawOutput, // Always use raw string for JavaScript transform
                         pr: templateContext.pr,
                         files: templateContext.files,
                         outputs: templateContext.outputs,
                         env: templateContext.env,
-                        // Helper functions
-                        JSON: JSON,
                     };
                     // Compile and execute the JavaScript expression
-                    const exec = this.sandbox.compile(`
-            const { output, pr, files, outputs, env, JSON } = scope;
-            return (${transformJs.trim()});
-          `);
+                    // Use direct property access instead of destructuring to avoid syntax issues
+                    const trimmedTransform = transformJs.trim();
+                    let transformExpression;
+                    if (/return\s+/.test(trimmedTransform)) {
+                        transformExpression = `(() => {\n${trimmedTransform}\n})()`;
+                    }
+                    else {
+                        const lines = trimmedTransform.split('\n');
+                        if (lines.length > 1) {
+                            const lastLine = lines[lines.length - 1].trim();
+                            const remaining = lines.slice(0, -1).join('\n');
+                            if (lastLine && !lastLine.includes('}') && !lastLine.includes('{')) {
+                                const returnTarget = lastLine.replace(/;$/, '');
+                                transformExpression = `(() => {\n${remaining}\nreturn ${returnTarget};\n})()`;
+                            }
+                            else {
+                                transformExpression = `(${trimmedTransform})`;
+                            }
+                        }
+                        else {
+                            transformExpression = `(${trimmedTransform})`;
+                        }
+                    }
+                    const code = `
+            const output = scope.output;
+            const pr = scope.pr;
+            const files = scope.files;
+            const outputs = scope.outputs;
+            const env = scope.env;
+            return ${transformExpression};
+          `;
+                    if (process.env.DEBUG) {
+                        console.log('🔧 Debug: JavaScript transform code:', code);
+                        console.log('🔧 Debug: JavaScript context:', jsContext);
+                    }
+                    const exec = this.sandbox.compile(code);
                     finalOutput = exec({ scope: jsContext }).run();
+                    if (process.env.DEBUG) {
+                        console.log('🔧 Debug: transform_js result:', JSON.stringify(finalOutput).slice(0, 200));
+                    }
                 }
                 catch (error) {
                     return {
@@ -103765,12 +103967,57 @@ class CommandCheckProvider extends check_provider_interface_1.CheckProvider {
                     };
                 }
             }
-            // Return the output as part of the review summary
-            // The output will be available to dependent checks
-            return {
-                issues: [],
-                output: finalOutput,
+            // Extract structured issues when the command returns them (skip for forEach parents)
+            let issues = [];
+            let outputForDependents = finalOutput;
+            let content;
+            let extracted = null;
+            const trimmedRawOutput = typeof rawOutput === 'string' ? rawOutput.trim() : undefined;
+            const commandConfig = config;
+            const isForEachParent = commandConfig.forEach === true;
+            if (!isForEachParent) {
+                extracted = this.extractIssuesFromOutput(finalOutput);
+                if (!extracted && typeof finalOutput === 'string') {
+                    // Attempt to parse string output as JSON and extract issues again
+                    try {
+                        const parsed = JSON.parse(finalOutput);
+                        extracted = this.extractIssuesFromOutput(parsed);
+                        if (extracted) {
+                            issues = extracted.issues;
+                            outputForDependents = extracted.remainingOutput;
+                        }
+                    }
+                    catch {
+                        // Ignore JSON parse errors – leave output as-is
+                    }
+                }
+                else if (extracted) {
+                    issues = extracted.issues;
+                    outputForDependents = extracted.remainingOutput;
+                }
+                if (!issues.length && this.shouldTreatAsTextOutput(trimmedRawOutput)) {
+                    content = trimmedRawOutput;
+                }
+                else if (issues.length && typeof extracted?.remainingOutput === 'string') {
+                    const trimmed = extracted.remainingOutput.trim();
+                    if (trimmed) {
+                        content = trimmed;
+                    }
+                }
+            }
+            if (!content && this.shouldTreatAsTextOutput(trimmedRawOutput) && !isForEachParent) {
+                content = trimmedRawOutput;
+            }
+            // Return the output and issues as part of the review summary so dependent checks can use them
+            const result = {
+                issues,
+                output: outputForDependents,
+                ...(content ? { content } : {}),
             };
+            if (process.env.DEBUG && transformJs) {
+                console.log(`🔧 Debug: Command provider returning output:`, JSON.stringify(result.output).slice(0, 200));
+            }
+            return result;
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
@@ -103796,7 +104043,8 @@ class CommandCheckProvider extends check_provider_interface_1.CheckProvider {
         for (const [checkName, result] of dependencyResults) {
             // If the result has a direct output field, use it directly
             // Otherwise, expose the entire result as-is
-            outputs[checkName] = result.output !== undefined ? result.output : result;
+            const summary = result;
+            outputs[checkName] = summary.output !== undefined ? summary.output : summary;
         }
         return outputs;
     }
@@ -103838,6 +104086,190 @@ class CommandCheckProvider extends check_provider_interface_1.CheckProvider {
             'Optional: Transform template for processing output',
         ];
     }
+    extractIssuesFromOutput(output) {
+        if (output === null || output === undefined) {
+            return null;
+        }
+        // If output is already a string, do not treat it as issues here (caller may try parsing JSON)
+        if (typeof output === 'string') {
+            return null;
+        }
+        if (Array.isArray(output)) {
+            const issues = this.normalizeIssueArray(output);
+            if (issues) {
+                return { issues, remainingOutput: undefined };
+            }
+            return null;
+        }
+        if (typeof output === 'object') {
+            const record = output;
+            if (Array.isArray(record.issues)) {
+                const issues = this.normalizeIssueArray(record.issues);
+                if (!issues) {
+                    return null;
+                }
+                const remaining = { ...record };
+                delete remaining.issues;
+                const remainingKeys = Object.keys(remaining);
+                const remainingOutput = remainingKeys.length > 0 ? remaining : undefined;
+                return {
+                    issues,
+                    remainingOutput,
+                };
+            }
+            const singleIssue = this.normalizeIssue(record);
+            if (singleIssue) {
+                return { issues: [singleIssue], remainingOutput: undefined };
+            }
+        }
+        return null;
+    }
+    shouldTreatAsTextOutput(value) {
+        if (!value) {
+            return false;
+        }
+        const trimmed = value.trim();
+        if (!trimmed) {
+            return false;
+        }
+        // Heuristic: consider it JSON-like if it starts with { or [ and ends with } or ]
+        const startsJson = (trimmed.startsWith('{') && trimmed.endsWith('}')) ||
+            (trimmed.startsWith('[') && trimmed.endsWith(']'));
+        return !startsJson;
+    }
+    normalizeIssueArray(values) {
+        const normalized = [];
+        for (const value of values) {
+            const issue = this.normalizeIssue(value);
+            if (!issue) {
+                return null;
+            }
+            normalized.push(issue);
+        }
+        return normalized;
+    }
+    normalizeIssue(raw) {
+        if (!raw || typeof raw !== 'object') {
+            return null;
+        }
+        const data = raw;
+        const message = this.toTrimmedString(data.message || data.text || data.description || data.summary);
+        if (!message) {
+            return null;
+        }
+        const allowedSeverities = new Set(['info', 'warning', 'error', 'critical']);
+        const severityRaw = this.toTrimmedString(data.severity || data.level || data.priority);
+        let severity = 'warning';
+        if (severityRaw) {
+            const lower = severityRaw.toLowerCase();
+            if (allowedSeverities.has(lower)) {
+                severity = lower;
+            }
+            else if (['fatal', 'high'].includes(lower)) {
+                severity = 'error';
+            }
+            else if (['medium', 'moderate'].includes(lower)) {
+                severity = 'warning';
+            }
+            else if (['low', 'minor'].includes(lower)) {
+                severity = 'info';
+            }
+        }
+        const allowedCategories = new Set([
+            'security',
+            'performance',
+            'style',
+            'logic',
+            'documentation',
+        ]);
+        const categoryRaw = this.toTrimmedString(data.category || data.type || data.group);
+        let category = 'logic';
+        if (categoryRaw && allowedCategories.has(categoryRaw.toLowerCase())) {
+            category = categoryRaw.toLowerCase();
+        }
+        const file = this.toTrimmedString(data.file || data.path || data.filename) || 'system';
+        const line = this.toNumber(data.line || data.startLine || data.lineNumber) ?? 0;
+        const endLine = this.toNumber(data.endLine || data.end_line || data.stopLine);
+        const suggestion = this.toTrimmedString(data.suggestion);
+        const replacement = this.toTrimmedString(data.replacement);
+        const ruleId = this.toTrimmedString(data.ruleId || data.rule || data.id || data.check) || 'command';
+        return {
+            file,
+            line,
+            endLine: endLine ?? undefined,
+            ruleId,
+            message,
+            severity,
+            category,
+            suggestion: suggestion || undefined,
+            replacement: replacement || undefined,
+        };
+    }
+    toTrimmedString(value) {
+        if (typeof value === 'string') {
+            const trimmed = value.trim();
+            return trimmed.length > 0 ? trimmed : null;
+        }
+        if (value !== null && value !== undefined && typeof value.toString === 'function') {
+            const converted = String(value).trim();
+            return converted.length > 0 ? converted : null;
+        }
+        return null;
+    }
+    toNumber(value) {
+        if (value === null || value === undefined) {
+            return null;
+        }
+        const num = Number(value);
+        if (Number.isFinite(num)) {
+            return Math.trunc(num);
+        }
+        return null;
+    }
+    async renderCommandTemplate(template, context) {
+        try {
+            return await this.liquid.parseAndRender(template, context);
+        }
+        catch (error) {
+            if (process.env.DEBUG) {
+                console.warn('🔧 Debug: Liquid rendering failed, falling back to JS evaluation:', error);
+            }
+            return this.renderWithJsExpressions(template, context);
+        }
+    }
+    renderWithJsExpressions(template, context) {
+        const scope = {
+            pr: context.pr,
+            files: context.files,
+            outputs: context.outputs,
+            env: context.env,
+        };
+        const expressionRegex = /\{\{\s*([^{}]+?)\s*\}\}/g;
+        return template.replace(expressionRegex, (_match, expr) => {
+            const expression = String(expr).trim();
+            if (!expression) {
+                return '';
+            }
+            try {
+                const evalCode = `
+          const pr = scope.pr;
+          const files = scope.files;
+          const outputs = scope.outputs;
+          const env = scope.env;
+          return (${expression});
+        `;
+                const evaluator = this.sandbox.compile(evalCode);
+                const result = evaluator({ scope }).run();
+                return result === undefined || result === null ? '' : String(result);
+            }
+            catch (evaluationError) {
+                if (process.env.DEBUG) {
+                    console.warn('🔧 Debug: Failed to evaluate expression:', expression, evaluationError);
+                }
+                return '';
+            }
+        });
+    }
 }
 exports.CommandCheckProvider = CommandCheckProvider;
 
@@ -104542,7 +104974,8 @@ class LogCheckProvider extends check_provider_interface_1.CheckProvider {
                     issues: result.issues || [],
                 };
                 // Add outputs namespace for accessing dependency results directly
-                outputs[checkName] = result.output !== undefined ? result.output : result;
+                const summary = result;
+                outputs[checkName] = summary.output !== undefined ? summary.output : summary;
             }
             context.dependencies = dependencies;
             context.outputs = outputs;
@@ -105248,16 +105681,16 @@ class ConfigLoader {
         const outputFormat = process.env.VISOR_OUTPUT_FORMAT;
         const logFn = outputFormat === 'json' || outputFormat === 'sarif' ? console.error : console.log;
         logFn(`⬇️  Fetching remote configuration from: ${url}`);
+        const controller = new AbortController();
+        const timeoutMs = this.options.timeout ?? 30000;
+        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
         try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), this.options.timeout || 30000);
             const response = await fetch(url, {
                 signal: controller.signal,
                 headers: {
                     'User-Agent': 'Visor/1.0',
                 },
             });
-            clearTimeout(timeoutId);
             if (!response.ok) {
                 throw new Error(`Failed to fetch config: ${response.status} ${response.statusText}`);
             }
@@ -105281,12 +105714,15 @@ class ConfigLoader {
         catch (error) {
             if (error instanceof Error) {
                 if (error.name === 'AbortError') {
-                    throw new Error(`Timeout fetching configuration from ${url} (${this.options.timeout}ms)`);
+                    throw new Error(`Timeout fetching configuration from ${url} (${timeoutMs}ms)`);
                 }
                 throw new Error(`Failed to fetch remote configuration from ${url}: ${error.message}`);
             }
             throw error;
         }
+        finally {
+            clearTimeout(timeoutId);
+        }
     }
     /**
      * Load bundled default configuration
@@ -125875,7 +126311,7 @@ function createMessagePreview(message, charsPerSide = 200) {
   const end = message.substring(message.length - charsPerSide);
   return `${start}...${end}`;
 }
-var import_zod, searchSchema, querySchema, extractSchema, delegateSchema, attemptCompletionSchema, searchToolDefinition, queryToolDefinition, extractToolDefinition, delegateToolDefinition, attemptCompletionToolDefinition, searchDescription, queryDescription, extractDescription, delegateDescription, DEFAULT_VALID_TOOLS;
+var import_zod, searchSchema, querySchema, extractSchema, delegateSchema, bashSchema, attemptCompletionSchema, searchToolDefinition, queryToolDefinition, extractToolDefinition, delegateToolDefinition, attemptCompletionToolDefinition, bashToolDefinition, searchDescription, queryDescription, extractDescription, delegateDescription, bashDescription, DEFAULT_VALID_TOOLS;
 var init_common = __esm({
   "src/tools/common.js"() {
     "use strict";
@@ -125907,6 +126343,12 @@ var init_common = __esm({
     delegateSchema = import_zod.z.object({
       task: import_zod.z.string().describe("The task to delegate to a subagent. Be specific about what needs to be accomplished.")
     });
+    bashSchema = import_zod.z.object({
+      command: import_zod.z.string().describe("The bash command to execute"),
+      workingDirectory: import_zod.z.string().optional().describe("Directory to execute the command in (optional)"),
+      timeout: import_zod.z.number().optional().describe("Command timeout in milliseconds (optional)"),
+      env: import_zod.z.record(import_zod.z.string()).optional().describe("Additional environment variables (optional)")
+    });
     attemptCompletionSchema = {
       // Custom validation that requires result parameter but allows direct XML response
       safeParse: (params) => {
@@ -126129,11 +126571,67 @@ Usage Example:
 <attempt_completion>
 I have refactored the search module according to the requirements and verified the tests pass. The module now uses the new BM25 ranking algorithm and has improved error handling.
 </attempt_completion>
+`;
+    bashToolDefinition = `
+## bash
+Description: Execute bash commands for system exploration and development tasks. This tool has built-in security with allow/deny lists. By default, only safe read-only commands are allowed for code exploration.
+
+Parameters:
+- command: (required) The bash command to execute
+- workingDirectory: (optional) Directory to execute the command in
+- timeout: (optional) Command timeout in milliseconds
+- env: (optional) Additional environment variables as an object
+
+Security: Commands are filtered through allow/deny lists for safety:
+- Allowed by default: ls, cat, git status, npm list, find, grep, etc.
+- Denied by default: rm -rf, sudo, npm install, dangerous system commands
+
+Usage Examples:
+
+<examples>
+
+User: What files are in the src directory?
+<bash>
+<command>ls -la src/</command>
+</bash>
+
+User: Show me the git status
+<bash>
+<command>git status</command>
+</bash>
+
+User: Find all TypeScript files
+<bash>
+<command>find . -name "*.ts" -type f</command>
+</bash>
+
+User: Check installed npm packages
+<bash>
+<command>npm list --depth=0</command>
+</bash>
+
+User: Search for TODO comments in code
+<bash>
+<command>grep -r "TODO" src/</command>
+</bash>
+
+User: Show recent git commits
+<bash>
+<command>git log --oneline -10</command>
+</bash>
+
+User: Check system info
+<bash>
+<command>uname -a</command>
+</bash>
+
+</examples>
 `;
     searchDescription = "Search code in the repository using Elasticsearch-like query syntax. Use this tool first for any code-related questions.";
     queryDescription = "Search code using ast-grep structural pattern matching. Use this tool to find specific code structures like functions, classes, or methods.";
     extractDescription = "Extract code blocks from files based on file paths and optional line numbers. Use this tool to see complete context after finding relevant files.";
     delegateDescription = "Automatically delegate big distinct tasks to specialized probe subagents within the agentic loop. Used by AI agents to break down complex requests into focused, parallel tasks.";
+    bashDescription = "Execute bash commands for system exploration and development tasks. Secure by default with built-in allow/deny lists.";
     DEFAULT_VALID_TOOLS = [
       "search",
       "query",
@@ -126187,7 +126685,7 @@ async function delegate({ task, timeout = 300, debug = false, currentIteration =
       console.error(`[DELEGATE] Using binary at: ${binaryPath}`);
       console.error(`[DELEGATE] Command args: ${args.join(" ")}`);
     }
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve4, reject) => {
       const delegationSpan = tracer ? tracer.createDelegationSpan(sessionId, task) : null;
       const process2 = (0, import_child_process5.spawn)(binaryPath, args, {
         stdio: ["pipe", "pipe", "pipe"],
@@ -126252,7 +126750,7 @@ async function delegate({ task, timeout = 300, debug = false, currentIteration =
               delegationSpan.end();
             }
           }
-          resolve2(response);
+          resolve4(response);
         } else {
           const errorMessage = stderr.trim() || `Delegate process failed with exit code ${code}`;
           if (debug) {
@@ -126448,10 +126946,10 @@ var init_vercel = __esm({
             let extractOptions = { path: extractPath };
             if (input_content) {
               const { writeFileSync: writeFileSync2, unlinkSync } = await Promise.resolve(/* import() */).then(__nccwpck_require__.t.bind(__nccwpck_require__, 79896, 23));
-              const { join: join2 } = await Promise.resolve(/* import() */).then(__nccwpck_require__.t.bind(__nccwpck_require__, 16928, 23));
+              const { join: join3 } = await Promise.resolve(/* import() */).then(__nccwpck_require__.t.bind(__nccwpck_require__, 16928, 23));
               const { tmpdir } = await Promise.resolve(/* import() */).then(__nccwpck_require__.t.bind(__nccwpck_require__, 70857, 23));
               const { randomUUID: randomUUID5 } = await Promise.resolve(/* import() */).then(__nccwpck_require__.t.bind(__nccwpck_require__, 76982, 23));
-              tempFilePath = join2(tmpdir(), `probe-extract-${randomUUID5()}.txt`);
+              tempFilePath = join3(tmpdir(), `probe-extract-${randomUUID5()}.txt`);
               writeFileSync2(tempFilePath, input_content);
               if (debug) {
                 console.error(`Created temporary file for input content: ${tempFilePath}`);
@@ -126528,6 +127026,1248 @@ var init_vercel = __esm({
   }
 });
 
+// src/agent/bashDefaults.js
+var DEFAULT_ALLOW_PATTERNS, DEFAULT_DENY_PATTERNS;
+var init_bashDefaults = __esm({
+  "src/agent/bashDefaults.js"() {
+    "use strict";
+    DEFAULT_ALLOW_PATTERNS = [
+      // Basic navigation and listing
+      "ls",
+      "dir",
+      "pwd",
+      "cd",
+      "cd:*",
+      // File reading commands
+      "cat",
+      "cat:*",
+      "head",
+      "head:*",
+      "tail",
+      "tail:*",
+      "less",
+      "more",
+      "view",
+      // File information and metadata
+      "file",
+      "file:*",
+      "stat",
+      "stat:*",
+      "wc",
+      "wc:*",
+      "du",
+      "du:*",
+      "df",
+      "df:*",
+      "realpath",
+      "realpath:*",
+      // Search and find commands (read-only) - find restricted to safe operations
+      "find",
+      "find:-name:*",
+      "find:-type:*",
+      "find:-size:*",
+      "find:-mtime:*",
+      "find:-newer:*",
+      "find:-path:*",
+      "find:-iname:*",
+      "find:-maxdepth:*",
+      "find:-mindepth:*",
+      "find:-print",
+      "grep",
+      "grep:*",
+      "egrep",
+      "egrep:*",
+      "fgrep",
+      "fgrep:*",
+      "rg",
+      "rg:*",
+      "ag",
+      "ag:*",
+      "ack",
+      "ack:*",
+      "which",
+      "which:*",
+      "whereis",
+      "whereis:*",
+      "locate",
+      "locate:*",
+      "type",
+      "type:*",
+      "command",
+      "command:*",
+      // Tree and structure visualization
+      "tree",
+      "tree:*",
+      // Git read-only operations
+      "git:status",
+      "git:log",
+      "git:log:*",
+      "git:diff",
+      "git:diff:*",
+      "git:show",
+      "git:show:*",
+      "git:branch",
+      "git:branch:*",
+      "git:tag",
+      "git:tag:*",
+      "git:describe",
+      "git:describe:*",
+      "git:remote",
+      "git:remote:*",
+      "git:config:*",
+      "git:blame",
+      "git:blame:*",
+      "git:shortlog",
+      "git:reflog",
+      "git:ls-files",
+      "git:ls-tree",
+      "git:rev-parse",
+      "git:rev-list",
+      "git:--version",
+      "git:help",
+      "git:help:*",
+      // Package managers (information only)
+      "npm:list",
+      "npm:ls",
+      "npm:view",
+      "npm:info",
+      "npm:show",
+      "npm:outdated",
+      "npm:audit",
+      "npm:--version",
+      "yarn:list",
+      "yarn:info",
+      "yarn:--version",
+      "pnpm:list",
+      "pnpm:--version",
+      "pip:list",
+      "pip:show",
+      "pip:--version",
+      "pip3:list",
+      "pip3:show",
+      "pip3:--version",
+      "gem:list",
+      "gem:--version",
+      "bundle:list",
+      "bundle:show",
+      "bundle:--version",
+      "composer:show",
+      "composer:--version",
+      // Language and runtime versions
+      "node:--version",
+      "node:-v",
+      "python:--version",
+      "python:-V",
+      "python3:--version",
+      "python3:-V",
+      "ruby:--version",
+      "ruby:-v",
+      "go:version",
+      "go:env",
+      "go:list",
+      "go:mod:graph",
+      "rustc:--version",
+      "cargo:--version",
+      "cargo:tree",
+      "cargo:metadata",
+      "java:--version",
+      "java:-version",
+      "javac:--version",
+      "mvn:--version",
+      "gradle:--version",
+      "php:--version",
+      "dotnet:--version",
+      "dotnet:list",
+      // Database client versions (connection info only)
+      "psql:--version",
+      "mysql:--version",
+      "redis-cli:--version",
+      "mongo:--version",
+      "sqlite3:--version",
+      // System information
+      "uname",
+      "uname:*",
+      "hostname",
+      "whoami",
+      "id",
+      "groups",
+      "date",
+      "cal",
+      "uptime",
+      "w",
+      "users",
+      "sleep",
+      "sleep:*",
+      // Environment and shell
+      "env",
+      "printenv",
+      "echo",
+      "echo:*",
+      "printf",
+      "printf:*",
+      "export",
+      "export:*",
+      "set",
+      "unset",
+      // Process information (read-only)
+      "ps",
+      "ps:*",
+      "pgrep",
+      "pgrep:*",
+      "jobs",
+      "top:-n:1",
+      // Network information (read-only)
+      "ifconfig",
+      "ip:addr",
+      "ip:link",
+      "hostname:-I",
+      "ping:-c:*",
+      "traceroute",
+      "nslookup",
+      "dig",
+      // Text processing and utilities (awk removed - too powerful)
+      "sed:-n:*",
+      "cut",
+      "cut:*",
+      "sort",
+      "sort:*",
+      "uniq",
+      "uniq:*",
+      "tr",
+      "tr:*",
+      "column",
+      "column:*",
+      "paste",
+      "paste:*",
+      "join",
+      "join:*",
+      "comm",
+      "comm:*",
+      "diff",
+      "diff:*",
+      "cmp",
+      "cmp:*",
+      "patch:--dry-run:*",
+      // Hashing and encoding (read-only)
+      "md5sum",
+      "md5sum:*",
+      "sha1sum",
+      "sha1sum:*",
+      "sha256sum",
+      "sha256sum:*",
+      "base64",
+      "base64:-d",
+      "od",
+      "od:*",
+      "hexdump",
+      "hexdump:*",
+      // Archive and compression (list/view only)
+      "tar:-tf:*",
+      "tar:-tzf:*",
+      "unzip:-l:*",
+      "zip:-l:*",
+      "gzip:-l:*",
+      "gunzip:-l:*",
+      // Help and documentation
+      "man",
+      "man:*",
+      "--help",
+      "help",
+      "info",
+      "info:*",
+      "whatis",
+      "whatis:*",
+      "apropos",
+      "apropos:*",
+      // Make (dry run and info)
+      "make:-n",
+      "make:--dry-run",
+      "make:-p",
+      "make:--print-data-base",
+      // Docker (read-only operations)
+      "docker:ps",
+      "docker:images",
+      "docker:version",
+      "docker:info",
+      "docker:logs:*",
+      "docker:inspect:*",
+      // Test runners (list/info only)
+      "jest:--listTests",
+      "mocha:--help",
+      "pytest:--collect-only"
+    ];
+    DEFAULT_DENY_PATTERNS = [
+      // Dangerous file operations
+      "rm:-rf",
+      "rm:-f:/",
+      "rm:/",
+      "rm:-rf:*",
+      "rmdir",
+      "chmod:777",
+      "chmod:-R:777",
+      "chown",
+      "chgrp",
+      "dd",
+      "dd:*",
+      "shred",
+      "shred:*",
+      // Dangerous find operations that can execute arbitrary commands
+      "find:-exec:*",
+      "find:*:-exec:*",
+      "find:-execdir:*",
+      "find:*:-execdir:*",
+      "find:-ok:*",
+      "find:*:-ok:*",
+      "find:-okdir:*",
+      "find:*:-okdir:*",
+      // Powerful scripting tools that can execute arbitrary commands
+      "awk",
+      "awk:*",
+      "perl",
+      "perl:*",
+      "python:-c:*",
+      "node:-e:*",
+      // System administration and modification
+      "sudo:*",
+      "su",
+      "su:*",
+      "passwd",
+      "adduser",
+      "useradd",
+      "userdel",
+      "usermod",
+      "groupadd",
+      "groupdel",
+      "visudo",
+      // Package installation and removal
+      "npm:install",
+      "npm:i",
+      "npm:uninstall",
+      "npm:publish",
+      "npm:unpublish",
+      "npm:link",
+      "npm:update",
+      "yarn:install",
+      "yarn:add",
+      "yarn:remove",
+      "yarn:upgrade",
+      "pnpm:install",
+      "pnpm:add",
+      "pnpm:remove",
+      "pip:install",
+      "pip:uninstall",
+      "pip:upgrade",
+      "pip3:install",
+      "pip3:uninstall",
+      "pip3:upgrade",
+      "gem:install",
+      "gem:uninstall",
+      "gem:update",
+      "bundle:install",
+      "bundle:update",
+      "composer:install",
+      "composer:update",
+      "composer:remove",
+      "apt:*",
+      "apt-get:*",
+      "yum:*",
+      "dnf:*",
+      "zypper:*",
+      "brew:install",
+      "brew:uninstall",
+      "brew:upgrade",
+      "conda:install",
+      "conda:remove",
+      "conda:update",
+      // Service and system control
+      "systemctl:*",
+      "service:*",
+      "chkconfig:*",
+      "initctl:*",
+      "upstart:*",
+      // Network operations that could be dangerous
+      "curl:-d:*",
+      "curl:--data:*",
+      "curl:-X:POST:*",
+      "curl:-X:PUT:*",
+      "wget:-O:/",
+      "wget:--post-data:*",
+      "ssh",
+      "ssh:*",
+      "scp",
+      "scp:*",
+      "sftp",
+      "sftp:*",
+      "rsync:*",
+      "nc",
+      "nc:*",
+      "netcat",
+      "netcat:*",
+      "telnet",
+      "telnet:*",
+      "ftp",
+      "ftp:*",
+      // Process control and termination
+      "kill",
+      "kill:*",
+      "killall",
+      "killall:*",
+      "pkill",
+      "pkill:*",
+      "nohup:*",
+      "disown:*",
+      // System control and shutdown
+      "shutdown",
+      "shutdown:*",
+      "reboot",
+      "halt",
+      "poweroff",
+      "init",
+      "telinit",
+      // Kernel and module operations
+      "insmod",
+      "insmod:*",
+      "rmmod",
+      "rmmod:*",
+      "modprobe",
+      "modprobe:*",
+      "sysctl:-w:*",
+      // Dangerous git operations
+      "git:push",
+      "git:push:*",
+      "git:force",
+      "git:reset:--hard:*",
+      "git:clean:-fd",
+      "git:rm:*",
+      "git:commit",
+      "git:merge",
+      "git:rebase",
+      "git:cherry-pick",
+      "git:stash:drop",
+      // File system mounting and partitioning
+      "mount",
+      "mount:*",
+      "umount",
+      "umount:*",
+      "fdisk",
+      "fdisk:*",
+      "parted",
+      "parted:*",
+      "mkfs",
+      "mkfs:*",
+      "fsck",
+      "fsck:*",
+      // Cron and scheduling
+      "crontab",
+      "crontab:*",
+      "at",
+      "at:*",
+      "batch",
+      "batch:*",
+      // Compression with potential overwrite
+      "tar:-xf:*",
+      "unzip",
+      "unzip:*",
+      "gzip:*",
+      "gunzip:*",
+      // Build and compilation that might modify files
+      "make",
+      "make:install",
+      "make:clean",
+      "cargo:build",
+      "cargo:install",
+      "npm:run:build",
+      "yarn:build",
+      "mvn:install",
+      "gradle:build",
+      // Docker operations that could modify state
+      "docker:run",
+      "docker:run:*",
+      "docker:exec",
+      "docker:exec:*",
+      "docker:build",
+      "docker:build:*",
+      "docker:pull",
+      "docker:push",
+      "docker:rm",
+      "docker:rmi",
+      "docker:stop",
+      "docker:start",
+      // Database operations
+      "mysql:-e:DROP",
+      "psql:-c:DROP",
+      "redis-cli:FLUSHALL",
+      "mongo:--eval:*",
+      // Text editors that could modify files
+      "vi",
+      "vi:*",
+      "vim",
+      "vim:*",
+      "nano",
+      "nano:*",
+      "emacs",
+      "emacs:*",
+      "sed:-i:*",
+      "perl:-i:*",
+      // Potentially dangerous utilities
+      "eval",
+      "eval:*",
+      "exec",
+      "exec:*",
+      "source",
+      "source:*",
+      "bash:-c:*",
+      "sh:-c:*",
+      "zsh:-c:*"
+    ];
+  }
+});
+
+// src/agent/bashCommandUtils.js
+function parseSimpleCommand(command) {
+  if (!command || typeof command !== "string") {
+    return {
+      success: false,
+      error: "Command must be a non-empty string",
+      command: null,
+      args: [],
+      isComplex: false
+    };
+  }
+  const trimmed = command.trim();
+  if (!trimmed) {
+    return {
+      success: false,
+      error: "Command cannot be empty",
+      command: null,
+      args: [],
+      isComplex: false
+    };
+  }
+  const complexPatterns = [
+    /\|/,
+    // Pipes
+    /&&/,
+    // Logical AND
+    /\|\|/,
+    // Logical OR
+    /(?<!\\);/,
+    // Command separator (but not escaped \;)
+    /&$/,
+    // Background execution
+    /\$\(/,
+    // Command substitution $()
+    /`/,
+    // Command substitution ``
+    />/,
+    // Redirection >
+    /</,
+    // Redirection <
+    /\*\*/,
+    // Glob patterns (potentially dangerous)
+    /^\s*\{.*,.*\}|\{.*\.\.\.*\}/
+    // Brace expansion like {a,b} or {1..10} (but not find {} placeholders)
+  ];
+  for (const pattern of complexPatterns) {
+    if (pattern.test(trimmed)) {
+      return {
+        success: false,
+        error: "Complex shell commands with pipes, operators, or redirections are not supported for security reasons",
+        command: null,
+        args: [],
+        isComplex: true,
+        detected: pattern.toString()
+      };
+    }
+  }
+  const args = [];
+  let current = "";
+  let inQuotes = false;
+  let quoteChar = "";
+  let escaped = false;
+  for (let i3 = 0; i3 < trimmed.length; i3++) {
+    const char = trimmed[i3];
+    const nextChar = i3 + 1 < trimmed.length ? trimmed[i3 + 1] : "";
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\" && !inQuotes) {
+      escaped = true;
+      continue;
+    }
+    if (!inQuotes && (char === '"' || char === "'")) {
+      inQuotes = true;
+      quoteChar = char;
+    } else if (inQuotes && char === quoteChar) {
+      inQuotes = false;
+      quoteChar = "";
+    } else if (!inQuotes && char === " ") {
+      if (current.trim()) {
+        args.push(current.trim());
+        current = "";
+      }
+    } else {
+      current += char;
+    }
+  }
+  if (current.trim()) {
+    args.push(current.trim());
+  }
+  if (inQuotes) {
+    return {
+      success: false,
+      error: `Unclosed quote in command: ${quoteChar}`,
+      command: null,
+      args: [],
+      isComplex: false
+    };
+  }
+  if (args.length === 0) {
+    return {
+      success: false,
+      error: "No command found after parsing",
+      command: null,
+      args: [],
+      isComplex: false
+    };
+  }
+  const [baseCommand, ...commandArgs] = args;
+  return {
+    success: true,
+    error: null,
+    command: baseCommand,
+    args: commandArgs,
+    fullArgs: args,
+    isComplex: false,
+    original: command
+  };
+}
+function isComplexCommand(command) {
+  const result = parseSimpleCommand(command);
+  return result.isComplex;
+}
+function parseCommand(command) {
+  const result = parseSimpleCommand(command);
+  if (!result.success) {
+    return {
+      command: "",
+      args: [],
+      error: result.error,
+      isComplex: result.isComplex
+    };
+  }
+  return {
+    command: result.command,
+    args: result.args,
+    error: null,
+    isComplex: result.isComplex
+  };
+}
+function parseCommandForExecution(command) {
+  const result = parseSimpleCommand(command);
+  if (!result.success) {
+    return null;
+  }
+  return result.fullArgs;
+}
+var init_bashCommandUtils = __esm({
+  "src/agent/bashCommandUtils.js"() {
+    "use strict";
+  }
+});
+
+// src/agent/bashPermissions.js
+function matchesPattern(parsedCommand, pattern) {
+  if (!parsedCommand || !pattern) return false;
+  const { command, args } = parsedCommand;
+  if (!command) return false;
+  const patternParts = pattern.split(":");
+  const commandName = patternParts[0];
+  if (commandName === "*") {
+    return true;
+  } else if (commandName !== command) {
+    return false;
+  }
+  if (patternParts.length === 1) {
+    return true;
+  }
+  for (let i3 = 1; i3 < patternParts.length; i3++) {
+    const patternArg = patternParts[i3];
+    const argIndex = i3 - 1;
+    if (patternArg === "*") {
+      continue;
+    }
+    if (argIndex >= args.length) {
+      return false;
+    }
+    const actualArg = args[argIndex];
+    if (patternArg !== actualArg) {
+      return false;
+    }
+  }
+  return true;
+}
+function matchesAnyPattern(parsedCommand, patterns) {
+  if (!patterns || patterns.length === 0) return false;
+  return patterns.some((pattern) => matchesPattern(parsedCommand, pattern));
+}
+var BashPermissionChecker;
+var init_bashPermissions = __esm({
+  "src/agent/bashPermissions.js"() {
+    "use strict";
+    init_bashDefaults();
+    init_bashCommandUtils();
+    BashPermissionChecker = class {
+      /**
+       * Create a permission checker
+       * @param {Object} config - Configuration options
+       * @param {string[]} [config.allow] - Additional allow patterns
+       * @param {string[]} [config.deny] - Additional deny patterns
+       * @param {boolean} [config.disableDefaultAllow] - Disable default allow list
+       * @param {boolean} [config.disableDefaultDeny] - Disable default deny list
+       * @param {boolean} [config.debug] - Enable debug logging
+       */
+      constructor(config = {}) {
+        this.debug = config.debug || false;
+        this.allowPatterns = [];
+        if (!config.disableDefaultAllow) {
+          this.allowPatterns.push(...DEFAULT_ALLOW_PATTERNS);
+          if (this.debug) {
+            console.log(`[BashPermissions] Added ${DEFAULT_ALLOW_PATTERNS.length} default allow patterns`);
+          }
+        }
+        if (config.allow && Array.isArray(config.allow)) {
+          this.allowPatterns.push(...config.allow);
+          if (this.debug) {
+            console.log(`[BashPermissions] Added ${config.allow.length} custom allow patterns:`, config.allow);
+          }
+        }
+        this.denyPatterns = [];
+        if (!config.disableDefaultDeny) {
+          this.denyPatterns.push(...DEFAULT_DENY_PATTERNS);
+          if (this.debug) {
+            console.log(`[BashPermissions] Added ${DEFAULT_DENY_PATTERNS.length} default deny patterns`);
+          }
+        }
+        if (config.deny && Array.isArray(config.deny)) {
+          this.denyPatterns.push(...config.deny);
+          if (this.debug) {
+            console.log(`[BashPermissions] Added ${config.deny.length} custom deny patterns:`, config.deny);
+          }
+        }
+        if (this.debug) {
+          console.log(`[BashPermissions] Total patterns - Allow: ${this.allowPatterns.length}, Deny: ${this.denyPatterns.length}`);
+        }
+      }
+      /**
+       * Check if a simple command is allowed (rejects complex commands for security)
+       * @param {string} command - Command to check
+       * @returns {Object} Permission result
+       */
+      check(command) {
+        if (!command || typeof command !== "string") {
+          return {
+            allowed: false,
+            reason: "Invalid or empty command",
+            command
+          };
+        }
+        if (isComplexCommand(command)) {
+          return {
+            allowed: false,
+            reason: "Complex shell commands with pipes, operators, or redirections are not supported for security reasons",
+            command,
+            isComplex: true
+          };
+        }
+        const parsed = parseCommand(command);
+        if (parsed.error) {
+          return {
+            allowed: false,
+            reason: parsed.error,
+            command
+          };
+        }
+        if (!parsed.command) {
+          return {
+            allowed: false,
+            reason: "No valid command found",
+            command
+          };
+        }
+        if (this.debug) {
+          console.log(`[BashPermissions] Checking simple command: "${command}"`);
+          console.log(`[BashPermissions] Parsed: ${parsed.command} with args: [${parsed.args.join(", ")}]`);
+        }
+        if (matchesAnyPattern(parsed, this.denyPatterns)) {
+          const matchedPatterns = this.denyPatterns.filter((pattern) => matchesPattern(parsed, pattern));
+          return {
+            allowed: false,
+            reason: `Command matches deny pattern: ${matchedPatterns[0]}`,
+            command,
+            parsed,
+            matchedPatterns
+          };
+        }
+        if (this.allowPatterns.length > 0) {
+          if (!matchesAnyPattern(parsed, this.allowPatterns)) {
+            return {
+              allowed: false,
+              reason: "Command not in allow list",
+              command,
+              parsed
+            };
+          }
+        }
+        const result = {
+          allowed: true,
+          command,
+          parsed,
+          isComplex: false
+        };
+        if (this.debug) {
+          console.log(`[BashPermissions] ALLOWED - command passed all checks`);
+        }
+        return result;
+      }
+      /**
+       * Get configuration summary
+       * @returns {Object} Configuration info
+       */
+      getConfig() {
+        return {
+          allowPatterns: this.allowPatterns.length,
+          denyPatterns: this.denyPatterns.length,
+          totalPatterns: this.allowPatterns.length + this.denyPatterns.length
+        };
+      }
+    };
+  }
+});
+
+// src/agent/bashExecutor.js
+async function executeBashCommand(command, options = {}) {
+  const {
+    workingDirectory = process.cwd(),
+    timeout = 12e4,
+    // 2 minutes default
+    env = {},
+    maxBuffer = 10 * 1024 * 1024,
+    // 10MB
+    debug = false
+  } = options;
+  let cwd = workingDirectory;
+  try {
+    cwd = (0, import_path4.resolve)(cwd);
+    if (!(0, import_fs.existsSync)(cwd)) {
+      throw new Error(`Working directory does not exist: ${cwd}`);
+    }
+  } catch (error2) {
+    return {
+      success: false,
+      error: `Invalid working directory: ${error2.message}`,
+      stdout: "",
+      stderr: "",
+      exitCode: 1,
+      command,
+      workingDirectory: cwd,
+      duration: 0
+    };
+  }
+  const startTime = Date.now();
+  if (debug) {
+    console.log(`[BashExecutor] Executing command: "${command}"`);
+    console.log(`[BashExecutor] Working directory: "${cwd}"`);
+    console.log(`[BashExecutor] Timeout: ${timeout}ms`);
+  }
+  return new Promise((resolve4, reject) => {
+    const processEnv = {
+      ...process.env,
+      ...env
+    };
+    const args = parseCommandForExecution(command);
+    if (!args || args.length === 0) {
+      resolve4({
+        success: false,
+        error: "Failed to parse command",
+        stdout: "",
+        stderr: "",
+        exitCode: 1,
+        command,
+        workingDirectory: cwd,
+        duration: Date.now() - startTime
+      });
+      return;
+    }
+    const [cmd, ...cmdArgs] = args;
+    const child = (0, import_child_process6.spawn)(cmd, cmdArgs, {
+      cwd,
+      env: processEnv,
+      stdio: ["ignore", "pipe", "pipe"],
+      // stdin ignored, capture stdout/stderr
+      shell: false,
+      // For security
+      windowsHide: true
+    });
+    let stdout = "";
+    let stderr = "";
+    let killed = false;
+    let timeoutHandle;
+    if (timeout > 0) {
+      timeoutHandle = setTimeout(() => {
+        if (!killed) {
+          killed = true;
+          child.kill("SIGTERM");
+          setTimeout(() => {
+            if (child.exitCode === null) {
+              child.kill("SIGKILL");
+            }
+          }, 5e3);
+        }
+      }, timeout);
+    }
+    child.stdout.on("data", (data2) => {
+      const chunk = data2.toString();
+      if (stdout.length + chunk.length <= maxBuffer) {
+        stdout += chunk;
+      } else {
+        if (!killed) {
+          killed = true;
+          child.kill("SIGTERM");
+        }
+      }
+    });
+    child.stderr.on("data", (data2) => {
+      const chunk = data2.toString();
+      if (stderr.length + chunk.length <= maxBuffer) {
+        stderr += chunk;
+      } else {
+        if (!killed) {
+          killed = true;
+          child.kill("SIGTERM");
+        }
+      }
+    });
+    child.on("close", (code, signal) => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+      const duration = Date.now() - startTime;
+      if (debug) {
+        console.log(`[BashExecutor] Command completed - Code: ${code}, Signal: ${signal}, Duration: ${duration}ms`);
+        console.log(`[BashExecutor] Stdout length: ${stdout.length}, Stderr length: ${stderr.length}`);
+      }
+      let success = true;
+      let error2 = "";
+      if (killed) {
+        success = false;
+        if (stdout.length + stderr.length > maxBuffer) {
+          error2 = `Command output exceeded maximum buffer size (${maxBuffer} bytes)`;
+        } else {
+          error2 = `Command timed out after ${timeout}ms`;
+        }
+      } else if (code !== 0) {
+        success = false;
+        error2 = `Command exited with code ${code}`;
+      }
+      resolve4({
+        success,
+        error: error2,
+        stdout: stdout.trim(),
+        stderr: stderr.trim(),
+        exitCode: code,
+        signal,
+        command,
+        workingDirectory: cwd,
+        duration,
+        killed
+      });
+    });
+    child.on("error", (error2) => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+      if (debug) {
+        console.log(`[BashExecutor] Spawn error:`, error2);
+      }
+      resolve4({
+        success: false,
+        error: `Failed to execute command: ${error2.message}`,
+        stdout: "",
+        stderr: "",
+        exitCode: 1,
+        command,
+        workingDirectory: cwd,
+        duration: Date.now() - startTime
+      });
+    });
+  });
+}
+function formatExecutionResult(result, includeMetadata = false) {
+  if (!result) {
+    return "No result available";
+  }
+  let output = "";
+  if (includeMetadata) {
+    output += `Command: ${result.command}
+`;
+    output += `Working directory: ${result.workingDirectory}
+`;
+    output += `Duration: ${result.duration}ms
+`;
+    output += `Exit Code: ${result.exitCode}
+`;
+    if (result.signal) {
+      output += `Signal: ${result.signal}
+`;
+    }
+    output += "\n";
+  }
+  if (result.stdout) {
+    if (includeMetadata) {
+      output += "--- STDOUT ---\n";
+    }
+    output += result.stdout;
+    if (includeMetadata && result.stderr) {
+      output += "\n";
+    }
+  }
+  if (result.stderr) {
+    if (includeMetadata) {
+      if (result.stdout) output += "\n";
+      output += "--- STDERR ---\n";
+    } else if (result.stdout) {
+      output += "\n--- STDERR ---\n";
+    }
+    output += result.stderr;
+  }
+  if (!result.success && result.error && !result.stderr) {
+    if (output) output += "\n";
+    output += `Error: ${result.error}`;
+  }
+  if (!result.success && result.exitCode !== void 0 && result.exitCode !== 0) {
+    if (output) output += "\n";
+    output += `Exit code: ${result.exitCode}`;
+  }
+  return output || (result.success ? "Command completed successfully (no output)" : "Command failed (no output)");
+}
+function validateExecutionOptions(options = {}) {
+  const errors = [];
+  const warnings = [];
+  if (options.timeout !== void 0) {
+    if (typeof options.timeout !== "number" || options.timeout < 0) {
+      errors.push("timeout must be a non-negative number");
+    } else if (options.timeout > 6e5) {
+      warnings.push("timeout is very high (>10 minutes)");
+    }
+  }
+  if (options.maxBuffer !== void 0) {
+    if (typeof options.maxBuffer !== "number" || options.maxBuffer < 1024) {
+      errors.push("maxBuffer must be at least 1024 bytes");
+    } else if (options.maxBuffer > 100 * 1024 * 1024) {
+      warnings.push("maxBuffer is very high (>100MB)");
+    }
+  }
+  if (options.workingDirectory) {
+    if (typeof options.workingDirectory !== "string") {
+      errors.push("workingDirectory must be a string");
+    } else if (!(0, import_fs.existsSync)(options.workingDirectory)) {
+      errors.push(`workingDirectory does not exist: ${options.workingDirectory}`);
+    }
+  }
+  if (options.env && typeof options.env !== "object") {
+    errors.push("env must be an object");
+  }
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}
+var import_child_process6, import_path4, import_fs;
+var init_bashExecutor = __esm({
+  "src/agent/bashExecutor.js"() {
+    "use strict";
+    import_child_process6 = __nccwpck_require__(35317);
+    import_path4 = __nccwpck_require__(16928);
+    import_fs = __nccwpck_require__(79896);
+    init_bashCommandUtils();
+  }
+});
+
+// src/tools/bash.js
+var import_ai2, import_path5, bashTool;
+var init_bash = __esm({
+  "src/tools/bash.js"() {
+    "use strict";
+    import_ai2 = __nccwpck_require__(86619);
+    import_path5 = __nccwpck_require__(16928);
+    init_bashPermissions();
+    init_bashExecutor();
+    bashTool = (options = {}) => {
+      const {
+        bashConfig = {},
+        debug = false,
+        defaultPath,
+        allowedFolders = []
+      } = options;
+      const permissionChecker = new BashPermissionChecker({
+        allow: bashConfig.allow,
+        deny: bashConfig.deny,
+        disableDefaultAllow: bashConfig.disableDefaultAllow,
+        disableDefaultDeny: bashConfig.disableDefaultDeny,
+        debug
+      });
+      const getDefaultWorkingDirectory = () => {
+        if (bashConfig.workingDirectory) {
+          return bashConfig.workingDirectory;
+        }
+        if (defaultPath) {
+          return defaultPath;
+        }
+        if (allowedFolders && allowedFolders.length > 0) {
+          return allowedFolders[0];
+        }
+        return process.cwd();
+      };
+      return (0, import_ai2.tool)({
+        name: "bash",
+        description: `Execute bash commands for system exploration and development tasks.
+
+Security: This tool has built-in security with allow/deny lists. By default, only safe read-only commands are allowed for code exploration.
+
+Parameters:
+- command: (required) The bash command to execute
+- workingDirectory: (optional) Directory to execute command in
+- timeout: (optional) Command timeout in milliseconds
+- env: (optional) Additional environment variables
+
+Examples of allowed commands by default:
+- File exploration: ls, cat, head, tail, find, grep
+- Git operations: git status, git log, git diff, git show
+- Package info: npm list, pip list, cargo --version
+- System info: whoami, pwd, uname, date
+
+Dangerous commands are blocked by default (rm -rf, sudo, npm install, etc.)`,
+        inputSchema: {
+          type: "object",
+          properties: {
+            command: {
+              type: "string",
+              description: "The bash command to execute"
+            },
+            workingDirectory: {
+              type: "string",
+              description: "Directory to execute the command in (optional)"
+            },
+            timeout: {
+              type: "number",
+              description: "Command timeout in milliseconds (optional)",
+              minimum: 1e3,
+              maximum: 6e5
+            },
+            env: {
+              type: "object",
+              description: "Additional environment variables (optional)",
+              additionalProperties: {
+                type: "string"
+              }
+            }
+          },
+          required: ["command"],
+          additionalProperties: false
+        },
+        execute: async ({ command, workingDirectory, timeout, env }) => {
+          try {
+            if (command === null || command === void 0 || typeof command !== "string") {
+              return "Error: Command is required and must be a string";
+            }
+            if (command.trim().length === 0) {
+              return "Error: Command cannot be empty";
+            }
+            const permissionResult = permissionChecker.check(command.trim());
+            if (!permissionResult.allowed) {
+              if (debug) {
+                console.log(`[BashTool] Permission denied for command: "${command}"`);
+                console.log(`[BashTool] Reason: ${permissionResult.reason}`);
+              }
+              return `Permission denied: ${permissionResult.reason}
+
+This command is not allowed by the current security policy. 
+
+Common reasons:
+1. The command is in the deny list (potentially dangerous)
+2. The command is not in the allow list (not a recognized safe command)
+
+If you believe this command should be allowed, you can:
+- Use the --bash-allow option to add specific patterns
+- Use the --no-default-bash-deny flag to remove default restrictions (not recommended)
+
+For code exploration, try these safe alternatives:
+- ls, cat, head, tail for file operations
+- find, grep, rg for searching
+- git status, git log, git show for git operations
+- npm list, pip list for package information`;
+            }
+            const workingDir = workingDirectory || getDefaultWorkingDirectory();
+            if (allowedFolders && allowedFolders.length > 0) {
+              const resolvedWorkingDir = (0, import_path5.resolve)(workingDir);
+              const isAllowed = allowedFolders.some((folder) => {
+                const resolvedFolder = (0, import_path5.resolve)(folder);
+                return resolvedWorkingDir.startsWith(resolvedFolder);
+              });
+              if (!isAllowed) {
+                return `Error: Working directory "${workingDir}" is not within allowed folders: ${allowedFolders.join(", ")}`;
+              }
+            }
+            const executionOptions = {
+              workingDirectory: workingDir,
+              timeout: timeout || bashConfig.timeout || 12e4,
+              env: { ...bashConfig.env, ...env },
+              maxBuffer: bashConfig.maxBuffer,
+              debug
+            };
+            const validation = validateExecutionOptions(executionOptions);
+            if (!validation.valid) {
+              return `Error: Invalid execution options: ${validation.errors.join(", ")}`;
+            }
+            if (validation.warnings.length > 0 && debug) {
+              console.log("[BashTool] Warnings:", validation.warnings);
+            }
+            if (debug) {
+              console.log(`[BashTool] Executing command: "${command}"`);
+              console.log(`[BashTool] Working directory: "${workingDir}"`);
+              console.log(`[BashTool] Timeout: ${executionOptions.timeout}ms`);
+            }
+            const result = await executeBashCommand(command.trim(), executionOptions);
+            if (debug) {
+              console.log(`[BashTool] Command completed - Success: ${result.success}, Duration: ${result.duration}ms`);
+            }
+            const formattedResult = formatExecutionResult(result, debug);
+            if (!result.success) {
+              let errorInfo = `
+
+Command failed with exit code ${result.exitCode}`;
+              if (result.killed) {
+                errorInfo += ` (${result.error})`;
+              }
+              return formattedResult + errorInfo;
+            }
+            return formattedResult;
+          } catch (error2) {
+            if (debug) {
+              console.error("[BashTool] Execution error:", error2);
+            }
+            return `Error executing bash command: ${error2.message}`;
+          }
+        }
+      });
+    };
+  }
+});
+
 // src/tools/langchain.js
 function createSearchTool() {
   return {
@@ -126745,6 +128485,10 @@ __export(tools_exports, {
   DEFAULT_SYSTEM_MESSAGE: () => DEFAULT_SYSTEM_MESSAGE,
   attemptCompletionSchema: () => attemptCompletionSchema,
   attemptCompletionToolDefinition: () => attemptCompletionToolDefinition,
+  bashDescription: () => bashDescription,
+  bashSchema: () => bashSchema,
+  bashTool: () => bashTool,
+  bashToolDefinition: () => bashToolDefinition,
   createExtractTool: () => createExtractTool,
   createQueryTool: () => createQueryTool,
   createSearchTool: () => createSearchTool,
@@ -126765,16 +128509,19 @@ var init_tools = __esm({
   "src/tools/index.js"() {
     "use strict";
     init_vercel();
+    init_bash();
     init_langchain();
     init_common();
     init_system_message();
     init_vercel();
+    init_bash();
     init_system_message();
     tools = {
       searchTool: searchTool(),
       queryTool: queryTool(),
       extractTool: extractTool(),
       delegateTool: delegateTool(),
+      bashTool: bashTool(),
       DEFAULT_SYSTEM_MESSAGE
     };
   }
@@ -126787,10 +128534,10 @@ async function listFilesByLevel(options) {
     maxFiles = 100,
     respectGitignore = true
   } = options;
-  if (!import_fs.default.existsSync(directory)) {
+  if (!import_fs2.default.existsSync(directory)) {
     throw new Error(`Directory does not exist: ${directory}`);
   }
-  const gitDirExists = import_fs.default.existsSync(import_path4.default.join(directory, ".git"));
+  const gitDirExists = import_fs2.default.existsSync(import_path6.default.join(directory, ".git"));
   if (gitDirExists && respectGitignore) {
     try {
       return await listFilesUsingGit(directory, maxFiles);
@@ -126805,8 +128552,8 @@ async function listFilesUsingGit(directory, maxFiles) {
   const { stdout } = await execAsync4("git ls-files", { cwd: directory });
   const files = stdout.split("\n").filter(Boolean);
   const sortedFiles = files.sort((a3, b3) => {
-    const depthA = a3.split(import_path4.default.sep).length;
-    const depthB = b3.split(import_path4.default.sep).length;
+    const depthA = a3.split(import_path6.default.sep).length;
+    const depthB = b3.split(import_path6.default.sep).length;
     return depthA - depthB;
   });
   return sortedFiles.slice(0, maxFiles);
@@ -126821,19 +128568,19 @@ async function listFilesByLevelManually(directory, maxFiles, respectGitignore) {
   while (queue.length > 0 && result.length < maxFiles) {
     const { dir, level } = queue.shift();
     try {
-      const entries = import_fs.default.readdirSync(dir, { withFileTypes: true });
+      const entries = import_fs2.default.readdirSync(dir, { withFileTypes: true });
       const files = entries.filter((entry) => entry.isFile());
       for (const file of files) {
         if (result.length >= maxFiles) break;
-        const filePath = import_path4.default.join(dir, file.name);
-        const relativePath = import_path4.default.relative(directory, filePath);
+        const filePath = import_path6.default.join(dir, file.name);
+        const relativePath = import_path6.default.relative(directory, filePath);
         if (shouldIgnore(relativePath, ignorePatterns)) continue;
         result.push(relativePath);
       }
       const dirs = entries.filter((entry) => entry.isDirectory());
       for (const subdir of dirs) {
-        const subdirPath = import_path4.default.join(dir, subdir.name);
-        const relativeSubdirPath = import_path4.default.relative(directory, subdirPath);
+        const subdirPath = import_path6.default.join(dir, subdir.name);
+        const relativeSubdirPath = import_path6.default.relative(directory, subdirPath);
         if (shouldIgnore(relativeSubdirPath, ignorePatterns)) continue;
         if (subdir.name === "node_modules" || subdir.name === ".git") continue;
         queue.push({ dir: subdirPath, level: level + 1 });
@@ -126845,12 +128592,12 @@ async function listFilesByLevelManually(directory, maxFiles, respectGitignore) {
   return result;
 }
 function loadGitignorePatterns(directory) {
-  const gitignorePath = import_path4.default.join(directory, ".gitignore");
-  if (!import_fs.default.existsSync(gitignorePath)) {
+  const gitignorePath = import_path6.default.join(directory, ".gitignore");
+  if (!import_fs2.default.existsSync(gitignorePath)) {
     return [];
   }
   try {
-    const content = import_fs.default.readFileSync(gitignorePath, "utf8");
+    const content = import_fs2.default.readFileSync(gitignorePath, "utf8");
     return content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
   } catch (error2) {
     console.error(`Warning: Could not read .gitignore: ${error2.message}`);
@@ -126868,15 +128615,15 @@ function shouldIgnore(filePath, ignorePatterns) {
   }
   return false;
 }
-var import_fs, import_path4, import_util5, import_child_process6, execAsync4;
+var import_fs2, import_path6, import_util5, import_child_process7, execAsync4;
 var init_file_lister = __esm({
   "src/utils/file-lister.js"() {
     "use strict";
-    import_fs = __toESM(__nccwpck_require__(79896), 1);
-    import_path4 = __toESM(__nccwpck_require__(16928), 1);
+    import_fs2 = __toESM(__nccwpck_require__(79896), 1);
+    import_path6 = __toESM(__nccwpck_require__(16928), 1);
     import_util5 = __nccwpck_require__(39023);
-    import_child_process6 = __nccwpck_require__(35317);
-    execAsync4 = (0, import_util5.promisify)(import_child_process6.exec);
+    import_child_process7 = __nccwpck_require__(35317);
+    execAsync4 = (0, import_util5.promisify)(import_child_process7.exec);
   }
 });
 
@@ -129031,7 +130778,7 @@ var require_headStream = __commonJS({
       if ((0, stream_type_check_1.isReadableStream)(stream)) {
         return (0, headStream_browser_1.headStream)(stream, bytes);
       }
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve4, reject) => {
         const collector = new Collector();
         collector.limit = bytes;
         stream.pipe(collector);
@@ -129042,7 +130789,7 @@ var require_headStream = __commonJS({
         collector.on("error", reject);
         collector.on("finish", function() {
           const bytes2 = new Uint8Array(Buffer.concat(this.buffers));
-          resolve2(bytes2);
+          resolve4(bytes2);
         });
       });
     };
@@ -129300,21 +131047,21 @@ var require_dist_cjs15 = __commonJS({
       let sendBody = true;
       if (expect === "100-continue") {
         sendBody = await Promise.race([
-          new Promise((resolve2) => {
-            timeoutId = Number(timing.setTimeout(() => resolve2(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+          new Promise((resolve4) => {
+            timeoutId = Number(timing.setTimeout(() => resolve4(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
           }),
-          new Promise((resolve2) => {
+          new Promise((resolve4) => {
             httpRequest.on("continue", () => {
               timing.clearTimeout(timeoutId);
-              resolve2(true);
+              resolve4(true);
             });
             httpRequest.on("response", () => {
               timing.clearTimeout(timeoutId);
-              resolve2(false);
+              resolve4(false);
             });
             httpRequest.on("error", () => {
               timing.clearTimeout(timeoutId);
-              resolve2(false);
+              resolve4(false);
             });
           })
         ]);
@@ -129350,13 +131097,13 @@ var require_dist_cjs15 = __commonJS({
       constructor(options) {
         this.socketWarningTimestamp = 0;
         this.metadata = { handlerProtocol: "http/1.1" };
-        this.configProvider = new Promise((resolve2, reject) => {
+        this.configProvider = new Promise((resolve4, reject) => {
           if (typeof options === "function") {
             options().then((_options) => {
-              resolve2(this.resolveDefaultConfig(_options));
+              resolve4(this.resolveDefaultConfig(_options));
             }).catch(reject);
           } else {
-            resolve2(this.resolveDefaultConfig(options));
+            resolve4(this.resolveDefaultConfig(options));
           }
         });
       }
@@ -129440,7 +131187,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         return new Promise((_resolve, _reject) => {
           let writeRequestBodyPromise = void 0;
           const timeouts = [];
-          const resolve2 = /* @__PURE__ */ __name(async (arg) => {
+          const resolve4 = /* @__PURE__ */ __name(async (arg) => {
             await writeRequestBodyPromise;
             timeouts.forEach(timing.clearTimeout);
             _resolve(arg);
@@ -129510,7 +131257,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
               headers: getTransformedHeaders(res.headers),
               body: res
             });
-            resolve2({ response: httpResponse });
+            resolve4({ response: httpResponse });
           });
           req.on("error", (err) => {
             if (NODEJS_TIMEOUT_ERROR_CODES.includes(err.code)) {
@@ -129699,13 +131446,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       constructor(options) {
         this.metadata = { handlerProtocol: "h2" };
         this.connectionManager = new NodeHttp2ConnectionManager({});
-        this.configProvider = new Promise((resolve2, reject) => {
+        this.configProvider = new Promise((resolve4, reject) => {
           if (typeof options === "function") {
             options().then((opts) => {
-              resolve2(opts || {});
+              resolve4(opts || {});
             }).catch(reject);
           } else {
-            resolve2(options || {});
+            resolve4(options || {});
           }
         });
       }
@@ -129738,7 +131485,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         return new Promise((_resolve, _reject) => {
           let fulfilled = false;
           let writeRequestBodyPromise = void 0;
-          const resolve2 = /* @__PURE__ */ __name(async (arg) => {
+          const resolve4 = /* @__PURE__ */ __name(async (arg) => {
             await writeRequestBodyPromise;
             _resolve(arg);
           }, "resolve");
@@ -129794,7 +131541,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
               body: req
             });
             fulfilled = true;
-            resolve2({ response: httpResponse });
+            resolve4({ response: httpResponse });
             if (disableConcurrentStreams) {
               session.close();
               this.connectionManager.deleteSession(authority, session);
@@ -129883,7 +131630,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       if (isReadableStreamInstance(stream)) {
         return collectReadableStream(stream);
       }
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve4, reject) => {
         const collector = new Collector();
         stream.pipe(collector);
         stream.on("error", (err) => {
@@ -129893,7 +131640,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         collector.on("error", reject);
         collector.on("finish", function() {
           const bytes = new Uint8Array(Buffer.concat(this.bufferedBytes));
-          resolve2(bytes);
+          resolve4(bytes);
         });
       });
     }, "streamCollector");
@@ -129958,7 +131705,7 @@ var require_dist_cjs16 = __commonJS({
     }
     __name(createRequest, "createRequest");
     function requestTimeout(timeoutInMs = 0) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve4, reject) => {
         if (timeoutInMs) {
           setTimeout(() => {
             const timeoutError = new Error(`Request did not complete within ${timeoutInMs} ms`);
@@ -130085,7 +131832,7 @@ var require_dist_cjs16 = __commonJS({
         ];
         if (abortSignal) {
           raceOfPromises.push(
-            new Promise((resolve2, reject) => {
+            new Promise((resolve4, reject) => {
               const onAbort = /* @__PURE__ */ __name(() => {
                 const abortError = new Error("Request aborted");
                 abortError.name = "AbortError";
@@ -130153,7 +131900,7 @@ var require_dist_cjs16 = __commonJS({
     }
     __name(collectStream, "collectStream");
     function readToBase64(blob) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve4, reject) => {
         const reader = new FileReader();
         reader.onloadend = () => {
           if (reader.readyState !== 2) {
@@ -130162,7 +131909,7 @@ var require_dist_cjs16 = __commonJS({
           const result = reader.result ?? "";
           const commaIndex = result.indexOf(",");
           const dataOffset = commaIndex > -1 ? commaIndex + 1 : result.length;
-          resolve2(result.substring(dataOffset));
+          resolve4(result.substring(dataOffset));
         };
         reader.onabort = () => reject(new Error("Read aborted"));
         reader.onerror = () => reject(reader.error);
@@ -130649,9 +132396,10 @@ var TypeRegistry;
 var init_TypeRegistry = __esm({
   "node_modules/@smithy/core/dist-es/submodules/schema/TypeRegistry.js"() {
     TypeRegistry = class _TypeRegistry {
-      constructor(namespace, schemas = /* @__PURE__ */ new Map()) {
+      constructor(namespace, schemas = /* @__PURE__ */ new Map(), exceptions = /* @__PURE__ */ new Map()) {
         this.namespace = namespace;
         this.schemas = schemas;
+        this.exceptions = exceptions;
       }
       static for(namespace) {
         if (!_TypeRegistry.registries.has(namespace)) {
@@ -130661,8 +132409,7 @@ var init_TypeRegistry = __esm({
       }
       register(shapeId, schema) {
         const qualifiedName = this.normalizeShapeId(shapeId);
-        const registry = _TypeRegistry.for(this.getNamespace(shapeId));
-        registry.schemas.set(qualifiedName, schema);
+        this.schemas.set(qualifiedName, schema);
       }
       getSchema(shapeId) {
         const id = this.normalizeShapeId(shapeId);
@@ -130671,6 +132418,12 @@ var init_TypeRegistry = __esm({
         }
         return this.schemas.get(id);
       }
+      registerError(errorSchema, ctor) {
+        this.exceptions.set(errorSchema, ctor);
+      }
+      getErrorCtor(errorSchema) {
+        return this.exceptions.get(errorSchema);
+      }
       getBaseException() {
         for (const [id, schema] of this.schemas.entries()) {
           if (id.startsWith("smithy.ts.sdk.synthetic.") && id.endsWith("ServiceException")) {
@@ -130682,9 +132435,9 @@ var init_TypeRegistry = __esm({
       find(predicate) {
         return [...this.schemas.values()].find(predicate);
       }
-      destroy() {
-        _TypeRegistry.registries.delete(this.namespace);
+      clear() {
         this.schemas.clear();
+        this.exceptions.clear();
       }
       normalizeShapeId(shapeId) {
         if (shapeId.includes("#")) {
@@ -130832,7 +132585,7 @@ var init_ErrorSchema = __esm({
       traits,
       memberNames,
       memberList,
-      ctor
+      ctor: null
     });
   }
 });
@@ -131801,11 +133554,11 @@ function __metadata(metadataKey, metadataValue) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve2) {
-      resolve2(value);
+    return value instanceof P ? value : new P(function(resolve4) {
+      resolve4(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve2, reject) {
+  return new (P || (P = Promise))(function(resolve4, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -131821,7 +133574,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve4(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -132012,14 +133765,14 @@ function __asyncValues(o3) {
   }, i3);
   function verb(n3) {
     i3[n3] = o3[n3] && function(v3) {
-      return new Promise(function(resolve2, reject) {
-        v3 = o3[n3](v3), settle(resolve2, reject, v3.done, v3.value);
+      return new Promise(function(resolve4, reject) {
+        v3 = o3[n3](v3), settle(resolve4, reject, v3.done, v3.value);
       });
     };
   }
-  function settle(resolve2, reject, d3, v3) {
+  function settle(resolve4, reject, d3, v3) {
     Promise.resolve(v3).then(function(v4) {
-      resolve2({ value: v4, done: d3 });
+      resolve4({ value: v4, done: d3 });
     }, reject);
   }
 }
@@ -136990,16 +138743,18 @@ var init_SmithyRpcV2CborProtocol = __esm({
           if (dataObject.Message) {
             dataObject.message = dataObject.Message;
           }
-          const baseExceptionSchema = TypeRegistry.for("smithy.ts.sdk.synthetic." + namespace).getBaseException();
+          const synthetic = TypeRegistry.for("smithy.ts.sdk.synthetic." + namespace);
+          const baseExceptionSchema = synthetic.getBaseException();
           if (baseExceptionSchema) {
-            const ErrorCtor = baseExceptionSchema.ctor;
-            throw Object.assign(new ErrorCtor({ name: errorName }), errorMetadata, dataObject);
+            const ErrorCtor2 = synthetic.getErrorCtor(baseExceptionSchema);
+            throw Object.assign(new ErrorCtor2({ name: errorName }), errorMetadata, dataObject);
           }
           throw Object.assign(new Error(errorName), errorMetadata, dataObject);
         }
         const ns = NormalizedSchema.of(errorSchema);
+        const ErrorCtor = registry.getErrorCtor(errorSchema);
         const message = dataObject.message ?? dataObject.Message ?? "Unknown";
-        const exception = new errorSchema.ctor(message);
+        const exception = new ErrorCtor(message);
         const output = {};
         for (const [name14, member] of ns.structIterator()) {
           output[name14] = this.deserializer.readValue(member, dataObject[name14]);
@@ -142665,7 +144420,7 @@ var require_dist_cjs37 = __commonJS({
         );
       }
       waitForReady(socket, connectionTimeout) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve4, reject) => {
           const timeout = setTimeout(() => {
             this.removeNotUsableSockets(socket.url);
             reject({
@@ -142676,7 +144431,7 @@ var require_dist_cjs37 = __commonJS({
           }, connectionTimeout);
           socket.onopen = () => {
             clearTimeout(timeout);
-            resolve2();
+            resolve4();
           };
         });
       }
@@ -142685,10 +144440,10 @@ var require_dist_cjs37 = __commonJS({
         let socketErrorOccurred = false;
         let reject = /* @__PURE__ */ __name(() => {
         }, "reject");
-        let resolve2 = /* @__PURE__ */ __name(() => {
+        let resolve4 = /* @__PURE__ */ __name(() => {
         }, "resolve");
         socket.onmessage = (event) => {
-          resolve2({
+          resolve4({
             done: false,
             value: new Uint8Array(event.data)
           });
@@ -142704,7 +144459,7 @@ var require_dist_cjs37 = __commonJS({
           if (streamError) {
             reject(streamError);
           } else {
-            resolve2({
+            resolve4({
               done: true,
               value: void 0
               // unchecked because done=true.
@@ -142715,7 +144470,7 @@ var require_dist_cjs37 = __commonJS({
           [Symbol.asyncIterator]: () => ({
             next: /* @__PURE__ */ __name(() => {
               return new Promise((_resolve, _reject) => {
-                resolve2 = _resolve;
+                resolve4 = _resolve;
                 reject = _reject;
               });
             }, "next")
@@ -143238,13 +144993,13 @@ var require_dist_cjs42 = __commonJS({
         ...data2.default && { default: data2.default }
       }
     ), "getConfigData");
-    var import_path9 = __nccwpck_require__(16928);
+    var import_path11 = __nccwpck_require__(16928);
     var import_getHomeDir = require_getHomeDir();
     var ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    var getConfigFilepath = /* @__PURE__ */ __name(() => process.env[ENV_CONFIG_PATH] || (0, import_path9.join)((0, import_getHomeDir.getHomeDir)(), ".aws", "config"), "getConfigFilepath");
+    var getConfigFilepath = /* @__PURE__ */ __name(() => process.env[ENV_CONFIG_PATH] || (0, import_path11.join)((0, import_getHomeDir.getHomeDir)(), ".aws", "config"), "getConfigFilepath");
     var import_getHomeDir2 = require_getHomeDir();
     var ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    var getCredentialsFilepath = /* @__PURE__ */ __name(() => process.env[ENV_CREDENTIALS_PATH] || (0, import_path9.join)((0, import_getHomeDir2.getHomeDir)(), ".aws", "credentials"), "getCredentialsFilepath");
+    var getCredentialsFilepath = /* @__PURE__ */ __name(() => process.env[ENV_CREDENTIALS_PATH] || (0, import_path11.join)((0, import_getHomeDir2.getHomeDir)(), ".aws", "credentials"), "getCredentialsFilepath");
     var import_getHomeDir3 = require_getHomeDir();
     var prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/;
     var profileNameBlockList = ["__proto__", "profile __proto__"];
@@ -143302,11 +145057,11 @@ var require_dist_cjs42 = __commonJS({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = (0, import_path9.join)(homeDir, filepath.slice(2));
+        resolvedFilepath = (0, import_path11.join)(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = (0, import_path9.join)(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = (0, import_path11.join)(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         (0, import_slurpFile.slurpFile)(resolvedConfigFilepath, {
@@ -143961,7 +145716,7 @@ var require_dist_cjs46 = __commonJS({
         this.refillTokenBucket();
         if (amount > this.currentCapacity) {
           const delay = (amount - this.currentCapacity) / this.fillRate * 1e3;
-          await new Promise((resolve2) => _DefaultRateLimiter.setTimeoutFn(resolve2, delay));
+          await new Promise((resolve4) => _DefaultRateLimiter.setTimeoutFn(resolve4, delay));
         }
         this.currentCapacity = this.currentCapacity - amount;
       }
@@ -144352,7 +146107,7 @@ var require_dist_cjs47 = __commonJS({
               const delayFromResponse = getDelayFromRetryAfterHeader(err.$response);
               const delay = Math.max(delayFromResponse || 0, delayFromDecider);
               totalDelay += delay;
-              await new Promise((resolve2) => setTimeout(resolve2, delay));
+              await new Promise((resolve4) => setTimeout(resolve4, delay));
               continue;
             }
             if (!err.$metadata) {
@@ -144512,7 +146267,7 @@ var require_dist_cjs47 = __commonJS({
             attempts = retryToken.getRetryCount();
             const delay = retryToken.getRetryDelay();
             totalRetryDelay += delay;
-            await new Promise((resolve2) => setTimeout(resolve2, delay));
+            await new Promise((resolve4) => setTimeout(resolve4, delay));
           }
         }
       } else {
@@ -144855,7 +146610,7 @@ var require_dist_cjs49 = __commonJS({
     var import_buffer = __nccwpck_require__(20181);
     var import_http = __nccwpck_require__(58611);
     function httpRequest(options) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve4, reject) => {
         const req = (0, import_http.request)({
           method: "GET",
           ...options,
@@ -144884,7 +146639,7 @@ var require_dist_cjs49 = __commonJS({
             chunks.push(chunk);
           });
           res.on("end", () => {
-            resolve2(import_buffer.Buffer.concat(chunks));
+            resolve4(import_buffer.Buffer.concat(chunks));
             req.destroy();
           });
         });
@@ -145319,7 +147074,7 @@ var require_retry_wrapper = __commonJS({
           try {
             return await toRetry();
           } catch (e3) {
-            await new Promise((resolve2) => setTimeout(resolve2, delayMs));
+            await new Promise((resolve4) => setTimeout(resolve4, delayMs));
           }
         }
         return await toRetry();
@@ -145763,7 +147518,7 @@ var require_dist_cjs53 = __commonJS({
       calculateBodyLength: () => calculateBodyLength3
     });
     module2.exports = __toCommonJS2(index_exports2);
-    var import_fs7 = __nccwpck_require__(79896);
+    var import_fs8 = __nccwpck_require__(79896);
     var calculateBodyLength3 = /* @__PURE__ */ __name((body) => {
       if (!body) {
         return 0;
@@ -145777,9 +147532,9 @@ var require_dist_cjs53 = __commonJS({
       } else if (typeof body.start === "number" && typeof body.end === "number") {
         return body.end + 1 - body.start;
       } else if (typeof body.path === "string" || Buffer.isBuffer(body.path)) {
-        return (0, import_fs7.lstatSync)(body.path).size;
+        return (0, import_fs8.lstatSync)(body.path).size;
       } else if (typeof body.fd === "number") {
-        return (0, import_fs7.fstatSync)(body.fd).size;
+        return (0, import_fs8.fstatSync)(body.fd).size;
       }
       throw new Error(`Body Length computation failed for ${body}`);
     }, "calculateBodyLength");
@@ -147817,8 +149572,8 @@ var require_dist_cjs57 = __commonJS({
       }
     }, "validateTokenKey");
     var import_shared_ini_file_loader = require_dist_cjs42();
-    var import_fs7 = __nccwpck_require__(79896);
-    var { writeFile } = import_fs7.promises;
+    var import_fs8 = __nccwpck_require__(79896);
+    var { writeFile } = import_fs8.promises;
     var writeSSOTokenToFile = /* @__PURE__ */ __name((id, ssoToken) => {
       const tokenFilepath = (0, import_shared_ini_file_loader.getSSOTokenFilepath)(id);
       const tokenString = JSON.stringify(ssoToken, null, 2);
@@ -149460,7 +151215,7 @@ var require_dist_cjs59 = __commonJS({
     module2.exports = __toCommonJS2(index_exports2);
     var import_property_provider2 = require_dist_cjs24();
     var import_shared_ini_file_loader = require_dist_cjs42();
-    var import_child_process8 = __nccwpck_require__(35317);
+    var import_child_process9 = __nccwpck_require__(35317);
     var import_util7 = __nccwpck_require__(39023);
     var import_client7 = (init_client(), __toCommonJS(client_exports));
     var getValidatedProcessCredentials = /* @__PURE__ */ __name((profileName, data2, profiles) => {
@@ -149497,7 +151252,7 @@ var require_dist_cjs59 = __commonJS({
       if (profiles[profileName]) {
         const credentialProcess = profile["credential_process"];
         if (credentialProcess !== void 0) {
-          const execPromise = (0, import_util7.promisify)(import_shared_ini_file_loader.externalDataInterceptor?.getTokenRecord?.().exec ?? import_child_process8.exec);
+          const execPromise = (0, import_util7.promisify)(import_shared_ini_file_loader.externalDataInterceptor?.getTokenRecord?.().exec ?? import_child_process9.exec);
           try {
             const { stdout } = await execPromise(credentialProcess);
             let data2;
@@ -150236,7 +151991,7 @@ var require_dist_cjs64 = __commonJS({
         streamEnded = true;
       });
       while (!generationEnded) {
-        const value = await new Promise((resolve2) => setTimeout(() => resolve2(records.shift()), 0));
+        const value = await new Promise((resolve4) => setTimeout(() => resolve4(records.shift()), 0));
         if (value) {
           yield value;
         }
@@ -153613,16 +155368,16 @@ function prepareTools(mode) {
   }
   const toolWarnings = [];
   const bedrockTools = [];
-  for (const tool2 of tools2) {
-    if (tool2.type === "provider-defined") {
-      toolWarnings.push({ type: "unsupported-tool", tool: tool2 });
+  for (const tool3 of tools2) {
+    if (tool3.type === "provider-defined") {
+      toolWarnings.push({ type: "unsupported-tool", tool: tool3 });
     } else {
       bedrockTools.push({
         toolSpec: {
-          name: tool2.name,
-          description: tool2.description,
+          name: tool3.name,
+          description: tool3.description,
           inputSchema: {
-            json: tool2.parameters
+            json: tool3.parameters
           }
         }
       });
@@ -154633,8 +156388,8 @@ function checkAttemptCompleteRecovery(cleanedXmlString, validTools = []) {
 function hasOtherToolTags(xmlString, validTools = []) {
   const defaultTools = ["search", "query", "extract", "listFiles", "searchFiles", "implement", "attempt_completion"];
   const toolsToCheck = validTools.length > 0 ? validTools : defaultTools;
-  for (const tool2 of toolsToCheck) {
-    if (tool2 !== "attempt_completion" && xmlString.includes(`<${tool2}`)) {
+  for (const tool3 of toolsToCheck) {
+    if (tool3 !== "attempt_completion" && xmlString.includes(`<${tool3}`)) {
       return true;
     }
   }
@@ -154662,12 +156417,16 @@ var init_xmlParsingUtils = __esm({
 
 // src/agent/tools.js
 function createTools(configOptions) {
-  return {
+  const tools2 = {
     searchTool: searchTool(configOptions),
     queryTool: queryTool(configOptions),
     extractTool: extractTool(configOptions),
     delegateTool: delegateTool(configOptions)
   };
+  if (configOptions.enableBash) {
+    tools2.bashTool = bashTool(configOptions);
+  }
+  return tools2;
 }
 function parseXmlToolCallWithThinking(xmlString, validTools) {
   const { cleanedXmlString, recoveryResult } = processXmlWithThinkingAndRecovery(xmlString, validTools);
@@ -154811,26 +156570,33 @@ function createWrappedTools(baseTools) {
       baseTools.delegateTool.execute
     );
   }
+  if (baseTools.bashTool) {
+    wrappedTools.bashToolInstance = wrapToolWithEmitter(
+      baseTools.bashTool,
+      "bash",
+      baseTools.bashTool.execute
+    );
+  }
   return wrappedTools;
 }
-var import_child_process7, import_util6, import_crypto4, import_events, import_fs2, import_fs3, import_path5, import_glob, toolCallEmitter, activeToolExecutions, wrapToolWithEmitter, listFilesTool, searchFilesTool, listFilesToolInstance, searchFilesToolInstance;
+var import_child_process8, import_util6, import_crypto4, import_events, import_fs3, import_fs4, import_path7, import_glob, toolCallEmitter, activeToolExecutions, wrapToolWithEmitter, listFilesTool, searchFilesTool, listFilesToolInstance, searchFilesToolInstance;
 var init_probeTool = __esm({
   "src/agent/probeTool.js"() {
     "use strict";
     init_index();
-    import_child_process7 = __nccwpck_require__(35317);
+    import_child_process8 = __nccwpck_require__(35317);
     import_util6 = __nccwpck_require__(39023);
     import_crypto4 = __nccwpck_require__(76982);
     import_events = __nccwpck_require__(24434);
-    import_fs2 = __toESM(__nccwpck_require__(79896), 1);
-    import_fs3 = __nccwpck_require__(79896);
-    import_path5 = __toESM(__nccwpck_require__(16928), 1);
+    import_fs3 = __toESM(__nccwpck_require__(79896), 1);
+    import_fs4 = __nccwpck_require__(79896);
+    import_path7 = __toESM(__nccwpck_require__(16928), 1);
     import_glob = __nccwpck_require__(21363);
     toolCallEmitter = new import_events.EventEmitter();
     activeToolExecutions = /* @__PURE__ */ new Map();
-    wrapToolWithEmitter = (tool2, toolName, baseExecute) => {
+    wrapToolWithEmitter = (tool3, toolName, baseExecute) => {
       return {
-        ...tool2,
+        ...tool3,
         // Spread schema, description etc.
         execute: async (params) => {
           const debug = process.env.DEBUG === "1";
@@ -154912,9 +156678,9 @@ var init_probeTool = __esm({
       execute: async (params) => {
         const { directory = ".", workingDirectory } = params;
         const baseCwd = workingDirectory || process.cwd();
-        const secureBaseDir = import_path5.default.resolve(baseCwd);
-        const targetDir = import_path5.default.resolve(secureBaseDir, directory);
-        if (!targetDir.startsWith(secureBaseDir + import_path5.default.sep) && targetDir !== secureBaseDir) {
+        const secureBaseDir = import_path7.default.resolve(baseCwd);
+        const targetDir = import_path7.default.resolve(secureBaseDir, directory);
+        if (!targetDir.startsWith(secureBaseDir + import_path7.default.sep) && targetDir !== secureBaseDir) {
           throw new Error("Path traversal attempt detected. Access denied.");
         }
         try {
@@ -154937,9 +156703,9 @@ var init_probeTool = __esm({
           throw new Error("Pattern is required for file search");
         }
         const baseCwd = workingDirectory || process.cwd();
-        const secureBaseDir = import_path5.default.resolve(baseCwd);
-        const targetDir = import_path5.default.resolve(secureBaseDir, directory);
-        if (!targetDir.startsWith(secureBaseDir + import_path5.default.sep) && targetDir !== secureBaseDir) {
+        const secureBaseDir = import_path7.default.resolve(baseCwd);
+        const targetDir = import_path7.default.resolve(secureBaseDir, directory);
+        if (!targetDir.startsWith(secureBaseDir + import_path7.default.sep) && targetDir !== secureBaseDir) {
           throw new Error("Path traversal attempt detected. Access denied.");
         }
         try {
@@ -154971,7 +156737,7 @@ function createMockProvider() {
       provider: "mock",
       // Mock the doGenerate method used by Vercel AI SDK
       doGenerate: async ({ messages, tools: tools2 }) => {
-        await new Promise((resolve2) => setTimeout(resolve2, 10));
+        await new Promise((resolve4) => setTimeout(resolve4, 10));
         return {
           text: "This is a mock response for testing",
           toolCalls: [],
@@ -155546,7 +157312,7 @@ ${decodedContent}
             }
             if (needsQuoting(content)) {
               wasFixed = true;
-              const safeContent = content.replace(/"/g, "'");
+              const safeContent = content.replace(/"/g, "&quot;").replace(/'/g, "&#39;");
               return `["${safeContent}"]`;
             }
             return match;
@@ -155559,7 +157325,7 @@ ${decodedContent}
             }
             if (needsQuoting(content)) {
               wasFixed = true;
-              const safeContent = content.replace(/"/g, "'");
+              const safeContent = content.replace(/"/g, "&quot;").replace(/'/g, "&#39;");
               return `{"${safeContent}"}`;
             }
             return match;
@@ -155729,7 +157495,7 @@ ${fixedContent}
               }
               if (needsQuoting(content)) {
                 wasFixed = true;
-                const safeContent = content.replace(/"/g, "'");
+                const safeContent = content.replace(/"/g, "&quot;").replace(/'/g, "&#39;");
                 return `["${safeContent}"]`;
               }
               return match;
@@ -155742,7 +157508,7 @@ ${fixedContent}
               }
               if (needsQuoting(content)) {
                 wasFixed = true;
-                const safeContent = content.replace(/"/g, "'");
+                const safeContent = content.replace(/"/g, "&quot;").replace(/'/g, "&#39;");
                 return `{"${safeContent}"}`;
               }
               return match;
@@ -156142,11 +157908,11 @@ function loadMCPConfigurationFromPath(configPath) {
   if (!configPath) {
     throw new Error("Config path is required");
   }
-  if (!(0, import_fs4.existsSync)(configPath)) {
+  if (!(0, import_fs5.existsSync)(configPath)) {
     throw new Error(`MCP configuration file not found: ${configPath}`);
   }
   try {
-    const content = (0, import_fs4.readFileSync)(configPath, "utf8");
+    const content = (0, import_fs5.readFileSync)(configPath, "utf8");
     const config = JSON.parse(content);
     if (process.env.DEBUG === "1") {
       console.error(`[MCP] Loaded configuration from: ${configPath}`);
@@ -156161,19 +157927,19 @@ function loadMCPConfiguration() {
     // Environment variable path
     process.env.MCP_CONFIG_PATH,
     // Local project paths
-    (0, import_path6.join)(process.cwd(), ".mcp", "config.json"),
-    (0, import_path6.join)(process.cwd(), "mcp.config.json"),
+    (0, import_path8.join)(process.cwd(), ".mcp", "config.json"),
+    (0, import_path8.join)(process.cwd(), "mcp.config.json"),
     // Home directory paths
-    (0, import_path6.join)((0, import_os3.homedir)(), ".config", "probe", "mcp.json"),
-    (0, import_path6.join)((0, import_os3.homedir)(), ".mcp", "config.json"),
+    (0, import_path8.join)((0, import_os3.homedir)(), ".config", "probe", "mcp.json"),
+    (0, import_path8.join)((0, import_os3.homedir)(), ".mcp", "config.json"),
     // Claude-style config location
-    (0, import_path6.join)((0, import_os3.homedir)(), "Library", "Application Support", "Claude", "mcp_config.json")
+    (0, import_path8.join)((0, import_os3.homedir)(), "Library", "Application Support", "Claude", "mcp_config.json")
   ].filter(Boolean);
   let config = null;
   for (const configPath of configPaths) {
-    if ((0, import_fs4.existsSync)(configPath)) {
+    if ((0, import_fs5.existsSync)(configPath)) {
       try {
-        const content = (0, import_fs4.readFileSync)(configPath, "utf8");
+        const content = (0, import_fs5.readFileSync)(configPath, "utf8");
         config = JSON.parse(content);
         if (process.env.DEBUG === "1") {
           console.error(`[MCP] Loaded configuration from: ${configPath}`);
@@ -156269,22 +158035,22 @@ function parseEnabledServers(config) {
   }
   return servers;
 }
-var import_fs4, import_path6, import_os3, import_url4, __filename4, __dirname4, DEFAULT_CONFIG;
+var import_fs5, import_path8, import_os3, import_url4, __filename4, __dirname4, DEFAULT_CONFIG;
 var init_config = __esm({
   "src/agent/mcp/config.js"() {
     "use strict";
-    import_fs4 = __nccwpck_require__(79896);
-    import_path6 = __nccwpck_require__(16928);
+    import_fs5 = __nccwpck_require__(79896);
+    import_path8 = __nccwpck_require__(16928);
     import_os3 = __nccwpck_require__(70857);
     import_url4 = __nccwpck_require__(87016);
     __filename4 = (0, import_url4.fileURLToPath)("file:///");
-    __dirname4 = (0, import_path6.dirname)(__filename4);
+    __dirname4 = (0, import_path8.dirname)(__filename4);
     DEFAULT_CONFIG = {
       mcpServers: {
         // Example probe server configuration
         "probe-local": {
           command: "node",
-          args: [(0, import_path6.join)(__dirname4, "../../../examples/chat/mcpServer.js")],
+          args: [(0, import_path8.join)(__dirname4, "../../../examples/chat/mcpServer.js")],
           transport: "stdio",
           enabled: false
         },
@@ -156441,12 +158207,12 @@ var init_client2 = __esm({
           });
           const toolsResponse = await client.listTools();
           if (toolsResponse && toolsResponse.tools) {
-            for (const tool2 of toolsResponse.tools) {
-              const qualifiedName = `${name14}_${tool2.name}`;
+            for (const tool3 of toolsResponse.tools) {
+              const qualifiedName = `${name14}_${tool3.name}`;
               this.tools.set(qualifiedName, {
-                ...tool2,
+                ...tool3,
                 serverName: name14,
-                originalName: tool2.name
+                originalName: tool3.name
               });
               if (this.debug) {
                 console.error(`[MCP]   Registered tool: ${qualifiedName}`);
@@ -156468,20 +158234,20 @@ var init_client2 = __esm({
        * @param {Object} args - Tool arguments
        */
       async callTool(toolName, args) {
-        const tool2 = this.tools.get(toolName);
-        if (!tool2) {
+        const tool3 = this.tools.get(toolName);
+        if (!tool3) {
           throw new Error(`Unknown tool: ${toolName}`);
         }
-        const clientInfo = this.clients.get(tool2.serverName);
+        const clientInfo = this.clients.get(tool3.serverName);
         if (!clientInfo) {
-          throw new Error(`Server ${tool2.serverName} not connected`);
+          throw new Error(`Server ${tool3.serverName} not connected`);
         }
         try {
           if (this.debug) {
             console.error(`[MCP] Calling ${toolName} with args:`, args);
           }
           const result = await clientInfo.client.callTool({
-            name: tool2.originalName,
+            name: tool3.originalName,
             arguments: args
           });
           return result;
@@ -156496,11 +158262,11 @@ var init_client2 = __esm({
        */
       getTools() {
         const tools2 = {};
-        for (const [name14, tool2] of this.tools.entries()) {
+        for (const [name14, tool3] of this.tools.entries()) {
           tools2[name14] = {
-            description: tool2.description,
-            inputSchema: tool2.inputSchema,
-            serverName: tool2.serverName
+            description: tool3.description,
+            inputSchema: tool3.inputSchema,
+            serverName: tool3.serverName
           };
         }
         return tools2;
@@ -156511,10 +158277,10 @@ var init_client2 = __esm({
        */
       getVercelTools() {
         const tools2 = {};
-        for (const [name14, tool2] of this.tools.entries()) {
+        for (const [name14, tool3] of this.tools.entries()) {
           tools2[name14] = {
-            description: tool2.description,
-            inputSchema: tool2.inputSchema,
+            description: tool3.description,
+            inputSchema: tool3.inputSchema,
             execute: async (args) => {
               const result = await this.callTool(name14, args);
               if (result.content && result.content[0]) {
@@ -156551,9 +158317,9 @@ var init_client2 = __esm({
 });
 
 // src/agent/mcp/xmlBridge.js
-function mcpToolToXmlDefinition(name14, tool2) {
-  const description = tool2.description || "MCP tool";
-  const inputSchema = tool2.inputSchema || tool2.parameters || {};
+function mcpToolToXmlDefinition(name14, tool3) {
+  const description = tool3.description || "MCP tool";
+  const inputSchema = tool3.inputSchema || tool3.parameters || {};
   let paramDocs = "";
   if (inputSchema.properties) {
     paramDocs = "\n\nParameters (provide as JSON object):";
@@ -156713,8 +158479,8 @@ var init_xmlBridge = __esm({
           const result = await this.mcpManager.initialize(mcpConfigs);
           const vercelTools = this.mcpManager.getVercelTools();
           this.mcpTools = vercelTools;
-          for (const [name14, tool2] of Object.entries(vercelTools)) {
-            this.xmlDefinitions[name14] = mcpToolToXmlDefinition(name14, tool2);
+          for (const [name14, tool3] of Object.entries(vercelTools)) {
+            this.xmlDefinitions[name14] = mcpToolToXmlDefinition(name14, tool3);
           }
           if (this.debug) {
             console.error(`[MCP] Loaded ${Object.keys(vercelTools).length} MCP tools from ${result.connected} server(s)`);
@@ -156751,12 +158517,12 @@ var init_xmlBridge = __esm({
         if (this.debug) {
           console.error(`[MCP] Executing MCP tool: ${toolName} with params:`, params);
         }
-        const tool2 = this.mcpTools[toolName];
-        if (!tool2) {
+        const tool3 = this.mcpTools[toolName];
+        if (!tool3) {
           throw new Error(`Unknown MCP tool: ${toolName}`);
         }
         try {
-          const result = await tool2.execute(params);
+          const result = await tool3.execute(params);
           return {
             success: true,
             toolName,
@@ -156808,7 +158574,7 @@ var ProbeAgent_exports = {};
 __export(ProbeAgent_exports, {
   ProbeAgent: () => ProbeAgent
 });
-var import_anthropic, import_openai, import_google, import_ai2, import_crypto5, import_events2, import_fs5, import_promises, import_path7, MAX_TOOL_ITERATIONS, MAX_HISTORY_MESSAGES, SUPPORTED_IMAGE_EXTENSIONS, MAX_IMAGE_FILE_SIZE, ProbeAgent;
+var import_anthropic, import_openai, import_google, import_ai3, import_crypto5, import_events2, import_fs6, import_promises, import_path9, MAX_TOOL_ITERATIONS, MAX_HISTORY_MESSAGES, SUPPORTED_IMAGE_EXTENSIONS, MAX_IMAGE_FILE_SIZE, ProbeAgent;
 var init_ProbeAgent = __esm({
   "src/agent/ProbeAgent.js"() {
     "use strict";
@@ -156816,12 +158582,12 @@ var init_ProbeAgent = __esm({
     import_openai = __nccwpck_require__(87635);
     import_google = __nccwpck_require__(30260);
     init_dist3();
-    import_ai2 = __nccwpck_require__(86619);
+    import_ai3 = __nccwpck_require__(86619);
     import_crypto5 = __nccwpck_require__(76982);
     import_events2 = __nccwpck_require__(24434);
-    import_fs5 = __nccwpck_require__(79896);
+    import_fs6 = __nccwpck_require__(79896);
     import_promises = __nccwpck_require__(91943);
-    import_path7 = __nccwpck_require__(16928);
+    import_path9 = __nccwpck_require__(16928);
     init_tokenCounter();
     init_tools2();
     init_common();
@@ -156865,6 +158631,8 @@ var init_ProbeAgent = __esm({
         this.outline = !!options.outline;
         this.maxResponseTokens = options.maxResponseTokens || parseInt(process.env.MAX_RESPONSE_TOKENS || "0", 10) || null;
         this.disableMermaidValidation = !!options.disableMermaidValidation;
+        this.enableBash = !!options.enableBash;
+        this.bashConfig = options.bashConfig || {};
         if (options.allowedFolders && Array.isArray(options.allowedFolders)) {
           this.allowedFolders = options.allowedFolders;
         } else if (options.path) {
@@ -156908,7 +158676,9 @@ var init_ProbeAgent = __esm({
           debug: this.debug,
           defaultPath: this.allowedFolders.length > 0 ? this.allowedFolders[0] : process.cwd(),
           allowedFolders: this.allowedFolders,
-          outline: this.outline
+          outline: this.outline,
+          enableBash: this.enableBash,
+          bashConfig: this.bashConfig
         };
         const baseTools = createTools(configOptions);
         const wrappedTools = createWrappedTools(baseTools);
@@ -156920,6 +158690,9 @@ var init_ProbeAgent = __esm({
           listFiles: listFilesToolInstance,
           searchFiles: searchFilesToolInstance
         };
+        if (this.enableBash && wrappedTools.bashToolInstance) {
+          this.toolImplementations.bash = wrappedTools.bashToolInstance;
+        }
         this.wrappedTools = wrappedTools;
       }
       /**
@@ -157106,13 +158879,13 @@ var init_ProbeAgent = __esm({
           const allowedDirs = this.allowedFolders && this.allowedFolders.length > 0 ? this.allowedFolders : [process.cwd()];
           let absolutePath;
           let isPathAllowed = false;
-          if ((0, import_path7.isAbsolute)(imagePath)) {
+          if ((0, import_path9.isAbsolute)(imagePath)) {
             absolutePath = imagePath;
-            isPathAllowed = allowedDirs.some((dir) => absolutePath.startsWith((0, import_path7.resolve)(dir)));
+            isPathAllowed = allowedDirs.some((dir) => absolutePath.startsWith((0, import_path9.resolve)(dir)));
           } else {
             for (const dir of allowedDirs) {
-              const resolvedPath3 = (0, import_path7.resolve)(dir, imagePath);
-              if (resolvedPath3.startsWith((0, import_path7.resolve)(dir))) {
+              const resolvedPath3 = (0, import_path9.resolve)(dir, imagePath);
+              if (resolvedPath3.startsWith((0, import_path9.resolve)(dir))) {
                 absolutePath = resolvedPath3;
                 isPathAllowed = true;
                 break;
@@ -157607,7 +159380,7 @@ You are working with a repository located at: ${searchDirectory}
             try {
               const executeAIRequest = async () => {
                 const messagesForAI = this.prepareMessagesWithImages(currentMessages);
-                const result = await (0, import_ai2.streamText)({
+                const result = await (0, import_ai3.streamText)({
                   model: this.provider(this.model),
                   messages: messagesForAI,
                   maxTokens: maxResponseTokens,
@@ -158284,12 +160057,12 @@ function initializeSimpleTelemetryFromOptions(options) {
   });
   return telemetry;
 }
-var import_fs6, import_path8, SimpleTelemetry, SimpleAppTracer;
+var import_fs7, import_path10, SimpleTelemetry, SimpleAppTracer;
 var init_simpleTelemetry = __esm({
   "src/agent/simpleTelemetry.js"() {
     "use strict";
-    import_fs6 = __nccwpck_require__(79896);
-    import_path8 = __nccwpck_require__(16928);
+    import_fs7 = __nccwpck_require__(79896);
+    import_path10 = __nccwpck_require__(16928);
     SimpleTelemetry = class {
       constructor(options = {}) {
         this.serviceName = options.serviceName || "probe-agent";
@@ -158303,11 +160076,11 @@ var init_simpleTelemetry = __esm({
       }
       initializeFileExporter() {
         try {
-          const dir = (0, import_path8.dirname)(this.filePath);
-          if (!(0, import_fs6.existsSync)(dir)) {
-            (0, import_fs6.mkdirSync)(dir, { recursive: true });
+          const dir = (0, import_path10.dirname)(this.filePath);
+          if (!(0, import_fs7.existsSync)(dir)) {
+            (0, import_fs7.mkdirSync)(dir, { recursive: true });
           }
-          this.stream = (0, import_fs6.createWriteStream)(this.filePath, { flags: "a" });
+          this.stream = (0, import_fs7.createWriteStream)(this.filePath, { flags: "a" });
           this.stream.on("error", (error2) => {
             console.error(`[SimpleTelemetry] Stream error: ${error2.message}`);
           });
@@ -158368,20 +160141,20 @@ var init_simpleTelemetry = __esm({
       }
       async flush() {
         if (this.stream) {
-          return new Promise((resolve2) => {
-            this.stream.once("drain", resolve2);
+          return new Promise((resolve4) => {
+            this.stream.once("drain", resolve4);
             if (!this.stream.writableNeedDrain) {
-              resolve2();
+              resolve4();
             }
           });
         }
       }
       async shutdown() {
         if (this.stream) {
-          return new Promise((resolve2) => {
+          return new Promise((resolve4) => {
             this.stream.end(() => {
               console.log(`[SimpleTelemetry] File stream closed: ${this.filePath}`);
-              resolve2();
+              resolve4();
             });
           });
         }
@@ -158508,6 +160281,9 @@ __export(index_exports, {
   SimpleTelemetry: () => SimpleTelemetry,
   attemptCompletionSchema: () => attemptCompletionSchema,
   attemptCompletionToolDefinition: () => attemptCompletionToolDefinition,
+  bashSchema: () => bashSchema,
+  bashTool: () => bashTool,
+  bashToolDefinition: () => bashToolDefinition,
   delegate: () => delegate,
   delegateSchema: () => delegateSchema,
   delegateTool: () => delegateTool,
@@ -158544,6 +160320,7 @@ var init_index = __esm({
     init_system_message();
     init_common();
     init_vercel();
+    init_bash();
     init_ProbeAgent();
     init_simpleTelemetry();
   }