@qduc/term2 0.2.0 → 0.3.0

package/dist/utils/command-safety.js

@@ -0,0 +1,348 @@
+import parse from 'bash-parser';
+import path from 'path';
+import { loggingService } from '../services/logging-service.js';
+// 1. CONSTANTS
+// Note: 'sed' is useful for read-only transformations. We allow it by default
+// but add guards below to prevent in-place edits (-i) and unapproved redirections.
+const ALLOWED_COMMANDS = new Set([
+    'ls',
+    'pwd',
+    'grep',
+    'cat',
+    'echo',
+    'head',
+    'tail',
+    'sed',
+]);
+const BLOCKED_COMMANDS = new Set([
+    // Filesystem
+    'rm',
+    'rmdir',
+    'mkfs',
+    'dd',
+    'mv',
+    'cp',
+    // System
+    'sudo',
+    'su',
+    'chmod',
+    'chown',
+    'shutdown',
+    'reboot',
+    // Network/Web
+    'curl',
+    'wget',
+    'ssh',
+    'scp',
+    'netstat',
+    // Package Managers / installers
+    'apt',
+    'yum',
+    'npm',
+    'yarn',
+    'pnpm',
+    'pip',
+    'gem',
+    // Dangerous wrappers / misc
+    'eval',
+    'exec',
+    'kill',
+    'killall',
+]);
+/* legacy containsDangerousCommand removed — replaced by classifyCommand + path analysis */
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs.
+ */
+export var SafetyStatus;
+(function (SafetyStatus) {
+    SafetyStatus["GREEN"] = "GREEN";
+    SafetyStatus["YELLOW"] = "YELLOW";
+    SafetyStatus["RED"] = "RED";
+})(SafetyStatus || (SafetyStatus = {}));
+// Extract a best-effort string for a word/arg node, including expansions.
+function extractWordText(word) {
+    if (!word)
+        return undefined;
+    if (typeof word === 'string')
+        return word;
+    if (typeof word.text === 'string')
+        return word.text;
+    if (typeof word.value === 'string')
+        return word.value;
+    if (typeof word.content === 'string')
+        return word.content;
+    if (word.parameter)
+        return `$${word.parameter}`;
+    if (Array.isArray(word.parts)) {
+        return word.parts
+            .map((part) => extractWordText(part) ?? '')
+            .join('');
+    }
+    return undefined;
+}
+// 2. PATH ANALYSIS HELPER
+function analyzePathRisk(inputPath) {
+    const candidate = inputPath?.trim();
+    if (!candidate)
+        return SafetyStatus.GREEN;
+    // RED: Explicit home-dotfiles (.ssh, .env, etc.) even before expansion
+    if (candidate.startsWith('~') ||
+        candidate.startsWith('$HOME') ||
+        candidate.startsWith('${HOME}')) {
+        const sliced = candidate.replace(/^~/, '').replace(/^\$\{?HOME\}?/, '');
+        // Check for dotfiles after home prefix
+        if (/^\/\.\w+/.test(sliced) ||
+            sliced.includes('/.ssh') ||
+            sliced.includes('/.env')) {
+            loggingService.security('Path risk: home dotfile', {
+                path: candidate,
+            });
+            return SafetyStatus.RED;
+        }
+    }
+    // RED: Absolute System Paths
+    if (path.isAbsolute(candidate)) {
+        const SYSTEM_PATHS = [
+            '/etc',
+            '/dev',
+            '/proc',
+            '/var',
+            '/usr',
+            '/boot',
+            '/bin',
+        ];
+        if (SYSTEM_PATHS.some(sys => candidate.startsWith(sys))) {
+            loggingService.security('Path risk: absolute system path', {
+                path: candidate,
+            });
+            return SafetyStatus.RED;
+        }
+        // Home dotfiles when absolute
+        if (/^\/(home|Users)\/[^/]+\/\.\w+/.test(candidate) ||
+            candidate.includes('/.ssh') ||
+            candidate.includes('/.gitconfig')) {
+            loggingService.security('Path risk: absolute home dotfile', {
+                path: candidate,
+            });
+            return SafetyStatus.RED;
+        }
+        // Other absolute paths are suspicious -> audit
+        loggingService.security('Path risk: absolute non-system path', {
+            path: candidate,
+        });
+        return SafetyStatus.YELLOW;
+    }
+    // RED: Directory Traversal
+    if (candidate.includes('..')) {
+        loggingService.security('Path risk: directory traversal detected', {
+            path: candidate,
+        });
+        return SafetyStatus.RED;
+    }
+    // Hidden files -> YELLOW
+    const filename = path.basename(candidate);
+    if (filename.startsWith('.')) {
+        loggingService.security('Path risk: hidden file', { path: candidate });
+        return SafetyStatus.YELLOW;
+    }
+    // Sensitive extensions
+    const SENSITIVE_EXTENSIONS = ['.env', '.pem', '.key', '.json'];
+    if (SENSITIVE_EXTENSIONS.some(ext => filename.endsWith(ext))) {
+        loggingService.security('Path risk: sensitive extension', {
+            path: candidate,
+        });
+        return SafetyStatus.YELLOW;
+    }
+    return SafetyStatus.GREEN;
+}
+/**
+ * Classify command into a SafetyStatus (GREEN/YELLOW/RED)
+ */
+export function classifyCommand(commandString) {
+    try {
+        const reasons = [];
+        const truncatedCommand = commandString.substring(0, 200);
+        loggingService.security('Classifying command safety', {
+            command: truncatedCommand,
+        });
+        const ast = parse(commandString, { mode: 'bash' });
+        let worstStatus = SafetyStatus.GREEN;
+        function upgradeStatus(s, reason) {
+            if (worstStatus === SafetyStatus.RED)
+                return;
+            if (s === SafetyStatus.RED)
+                worstStatus = SafetyStatus.RED;
+            else if (s === SafetyStatus.YELLOW &&
+                worstStatus === SafetyStatus.GREEN)
+                worstStatus = SafetyStatus.YELLOW;
+            if (reason)
+                reasons.push(`${s}: ${reason}`);
+        }
+        function traverse(node) {
+            if (!node)
+                return;
+            if (Array.isArray(node))
+                return node.forEach(traverse);
+            if (node.type === 'Command') {
+                const name = node.name?.text ||
+                    (node.name &&
+                        node.name.parts &&
+                        node.name.parts.map((p) => p.text).join(''));
+                if (typeof name === 'string') {
+                    if (BLOCKED_COMMANDS.has(name)) {
+                        upgradeStatus(SafetyStatus.RED, `blocked command: ${name}`);
+                        return;
+                    }
+                    if (!ALLOWED_COMMANDS.has(name)) {
+                        upgradeStatus(SafetyStatus.YELLOW, `unknown or unlisted command: ${name}`);
+                    }
+                }
+                const cmdName = typeof name === 'string' ? name : undefined;
+                if (node.suffix) {
+                    let hasOutputRedirect = false;
+                    let hasInPlaceEdit = false;
+                    // First pass: detect dangerous sed patterns
+                    for (const arg of node.suffix) {
+                        if (arg?.type === 'Redirect') {
+                            // Check if it's an output redirect (>, >>)
+                            const op = arg.op?.text || arg.op;
+                            if (op === '>' || op === '>>') {
+                                hasOutputRedirect = true;
+                            }
+                        }
+                        const argText = extractWordText(arg);
+                        if (argText && argText.startsWith('-')) {
+                            if (cmdName === 'sed' && argText.startsWith('-i')) {
+                                hasInPlaceEdit = true;
+                            }
+                        }
+                    }
+                    // Second pass: classify arguments
+                    for (const arg of node.suffix) {
+                        // Redirects: analyze path risk. For `sed`, only mark output redirects as YELLOW
+                        if (arg?.type === 'Redirect') {
+                            const fileText = extractWordText(arg.file ?? arg);
+                            const op = arg.op?.text || arg.op;
+                            if (cmdName === 'sed' &&
+                                (op === '>' || op === '>>')) {
+                                upgradeStatus(SafetyStatus.YELLOW, `sed with output redirection to ${fileText ?? '<unknown>'}`);
+                            }
+                            const pathStatus = analyzePathRisk(fileText);
+                            upgradeStatus(pathStatus, `redirect to ${fileText ?? '<unknown>'}`);
+                            continue;
+                        }
+                        const argText = extractWordText(arg);
+                        // Flags are normally ignored, but for `sed` the -i flag is dangerous
+                        // because it performs in-place edits. Detect -i and variants (e.g. -i, -i.bak, -i'')
+                        if (argText && argText.startsWith('-')) {
+                            if (cmdName === 'sed' && argText.startsWith('-i')) {
+                                upgradeStatus(SafetyStatus.RED, `sed in-place edit detected: ${argText}`);
+                                continue;
+                            }
+                            continue; // other flags ignored
+                        }
+                        const pathStatus = analyzePathRisk(argText);
+                        // For `sed`, file arguments are only risky if combined with dangerous operations
+                        if (cmdName === 'sed' && argText) {
+                            // If there's an in-place edit or output redirect, path risk matters
+                            // Otherwise, reading files with sed is safe (GREEN)
+                            if (hasInPlaceEdit || hasOutputRedirect) {
+                                if (pathStatus === SafetyStatus.RED)
+                                    upgradeStatus(pathStatus, `sed file argument ${argText}`);
+                                else
+                                    upgradeStatus(SafetyStatus.YELLOW, `sed file argument ${argText}`);
+                            }
+                            else {
+                                // Read-only sed: only escalate if path itself is risky
+                                if (pathStatus !== SafetyStatus.GREEN) {
+                                    upgradeStatus(pathStatus, `sed file argument ${argText}`);
+                                }
+                                // Otherwise GREEN - read-only sed is safe
+                            }
+                            continue;
+                        }
+                        // Unknown/opaque args fall back to YELLOW
+                        if (!argText)
+                            upgradeStatus(SafetyStatus.YELLOW, 'opaque or unparseable argument');
+                        else
+                            upgradeStatus(pathStatus, `argument ${argText}`);
+                    }
+                }
+            }
+            // recurse common shapes
+            if (node.type === 'LogicalExpression') {
+                traverse(node.left);
+                traverse(node.right);
+                return;
+            }
+            if (node.type === 'Pipeline') {
+                (node.commands || []).forEach(traverse);
+                return;
+            }
+            if (node.type === 'Subshell') {
+                traverse(node.list);
+                return;
+            }
+            if (node.type === 'CommandSubstitution') {
+                (node.commands || []).forEach(traverse);
+                return;
+            }
+            if (node.type === 'Script' || node.type === 'Program') {
+                (node.commands || []).forEach(traverse);
+                return;
+            }
+            for (const k of Object.keys(node)) {
+                const v = node[k];
+                if (v && typeof v === 'object')
+                    traverse(v);
+            }
+        }
+        if (ast && ast.commands) {
+            ast.commands.forEach(traverse);
+        }
+        loggingService.security('Command classification result', {
+            command: truncatedCommand,
+            status: worstStatus,
+            reasons,
+        });
+        return worstStatus;
+    }
+    catch (e) {
+        // Fail-safe: unparsable -> audit
+        loggingService.warn('Failed to parse command, classifying as YELLOW', {
+            command: commandString.substring(0, 200),
+            error: e instanceof Error ? e.message : String(e),
+        });
+        return SafetyStatus.YELLOW;
+    }
+}
+/**
+ * Validate command safety using an AST parser.
+ * Returns true when a command requires user approval.
+ * Throws for invalid/empty inputs OR hard-blocked RED classifications.
+ */
+export function validateCommandSafety(command) {
+    if (!command ||
+        typeof command !== 'string' ||
+        command.trim().length === 0) {
+        throw new Error('Command cannot be empty');
+    }
+    loggingService.security('Validating command safety', {
+        command: command.substring(0, 200),
+    });
+    const status = classifyCommand(command);
+    if (status === SafetyStatus.RED) {
+        loggingService.security('Command validation failed: RED (forbidden)', {
+            command: command.substring(0, 200),
+        });
+        throw new Error('Command classified as RED (forbidden)');
+    }
+    loggingService.security('Validation result', {
+        command: command.substring(0, 200),
+        status,
+    });
+    return status === SafetyStatus.YELLOW;
+}
+//# sourceMappingURL=command-safety.js.map

package/dist/utils/command-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-safety.js","sourceRoot":"","sources":["../../source/utils/command-safety.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,aAAa,CAAC;AAChC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAC,cAAc,EAAC,MAAM,gCAAgC,CAAC;AAE9D,eAAe;AACf,8EAA8E;AAC9E,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC7B,IAAI;IACJ,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACR,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC7B,aAAa;IACb,IAAI;IACJ,OAAO;IACP,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,MAAM;IACN,IAAI;IACJ,OAAO;IACP,OAAO;IACP,UAAU;IACV,QAAQ;IACR,cAAc;IACd,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,SAAS;IACT,gCAAgC;IAChC,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,4BAA4B;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;CACZ,CAAC,CAAC;AAEH,2FAA2F;AAE3F;;;;GAIG;AACH,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACpB,+BAAe,CAAA;IACf,iCAAiB,CAAA;IACjB,2BAAW,CAAA;AACf,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,IAAS;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACpD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACtD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IAC1D,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK;aACZ,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC/C,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,0BAA0B;AAC1B,SAAS,eAAe,CAAC,SAA6B;IAClD,MAAM,SAAS,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC;IAE1C,uEAAuE;IACvE,IACI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAC7B,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EACjC,CAAC;QACC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACxE,uCAAuC;QACvC,IACI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YACvB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAC1B,CAAC;YACC,cAAc,CAAC,QAAQ,CAAC,yBAAyB,EAAE;gBAC/C,IAAI,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC;QAC5B,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG;YACjB,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;SACT,CAAC;QACF,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtD,cAAc,CAAC,QAAQ,CAAC,iCAAiC,EAAE;gBACvD,IAAI,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC;QAC5B,CAAC;QACD,8BAA8B;QAC9B,IACI,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/C,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,EACnC,CAAC;YACC,cAAc,CAAC,QAAQ,CAAC,kCAAkC,EAAE;gBACxD,IAAI,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,GAAG,CAAC;QAC5B,CAAC;QACD,+CAA+C;QAC/C,cAAc,CAAC,QAAQ,CAAC,qCAAqC,EAAE;YAC3D,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,2BAA2B;IAC3B,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,QAAQ,CAAC,yCAAyC,EAAE;YAC/D,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,QAAQ,CAAC,wBAAwB,EAAE,EAAC,IAAI,EAAE,SAAS,EAAC,CAAC,CAAC;QACrE,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,uBAAuB;IACvB,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3D,cAAc,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YACtD,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB;IACjD,IAAI,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,cAAc,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAClD,OAAO,EAAE,gBAAgB;SAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,EAAC,IAAI,EAAE,MAAM,EAAC,CAAC,CAAC;QACjD,IAAI,WAAW,GAAiB,YAAY,CAAC,KAAK,CAAC;QAEnD,SAAS,aAAa,CAAC,CAAe,EAAE,MAAe;YACnD,IAAI,WAAW,KAAK,YAAY,CAAC,GAAG;gBAAE,OAAO;YAC7C,IAAI,CAAC,KAAK,YAAY,CAAC,GAAG;gBAAE,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC;iBACtD,IACD,CAAC,KAAK,YAAY,CAAC,MAAM;gBACzB,WAAW,KAAK,YAAY,CAAC,KAAK;gBAElC,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC;YACtC,IAAI,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,SAAS,QAAQ,CAAC,IAAS;YACvB,IAAI,CAAC,IAAI;gBAAE,OAAO;YAElB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAEvD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,GACN,IAAI,CAAC,IAAI,EAAE,IAAI;oBACf,CAAC,IAAI,CAAC,IAAI;wBACN,IAAI,CAAC,IAAI,CAAC,KAAK;wBACf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC7B,aAAa,CACT,YAAY,CAAC,GAAG,EAChB,oBAAoB,IAAI,EAAE,CAC7B,CAAC;wBACF,OAAO;oBACX,CAAC;oBACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC9B,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,gCAAgC,IAAI,EAAE,CACzC,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE5D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBACd,IAAI,iBAAiB,GAAG,KAAK,CAAC;oBAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;oBAE3B,4CAA4C;oBAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC5B,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC3B,2CAA2C;4BAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;4BAClC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gCAC5B,iBAAiB,GAAG,IAAI,CAAC;4BAC7B,CAAC;wBACL,CAAC;wBAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;wBACrC,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BACrC,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gCAChD,cAAc,GAAG,IAAI,CAAC;4BAC1B,CAAC;wBACL,CAAC;oBACL,CAAC;oBAED,kCAAkC;oBAClC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC5B,gFAAgF;wBAChF,IAAI,GAAG,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC3B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;4BAClD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;4BAElC,IACI,OAAO,KAAK,KAAK;gCACjB,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,EAC7B,CAAC;gCACC,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,kCACI,QAAQ,IAAI,WAChB,EAAE,CACL,CAAC;4BACN,CAAC;4BAED,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;4BAC7C,aAAa,CACT,UAAU,EACV,eAAe,QAAQ,IAAI,WAAW,EAAE,CAC3C,CAAC;4BACF,SAAS;wBACb,CAAC;wBAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;wBACrC,qEAAqE;wBACrE,qFAAqF;wBACrF,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;4BACrC,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gCAChD,aAAa,CACT,YAAY,CAAC,GAAG,EAChB,+BAA+B,OAAO,EAAE,CAC3C,CAAC;gCACF,SAAS;4BACb,CAAC;4BACD,SAAS,CAAC,sBAAsB;wBACpC,CAAC;wBAED,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;wBAC5C,iFAAiF;wBACjF,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,EAAE,CAAC;4BAC/B,oEAAoE;4BACpE,oDAAoD;4BACpD,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;gCACtC,IAAI,UAAU,KAAK,YAAY,CAAC,GAAG;oCAC/B,aAAa,CACT,UAAU,EACV,qBAAqB,OAAO,EAAE,CACjC,CAAC;;oCAEF,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,qBAAqB,OAAO,EAAE,CACjC,CAAC;4BACV,CAAC;iCAAM,CAAC;gCACJ,uDAAuD;gCACvD,IAAI,UAAU,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;oCACpC,aAAa,CACT,UAAU,EACV,qBAAqB,OAAO,EAAE,CACjC,CAAC;gCACN,CAAC;gCACD,0CAA0C;4BAC9C,CAAC;4BACD,SAAS;wBACb,CAAC;wBAED,0CAA0C;wBAC1C,IAAI,CAAC,OAAO;4BACR,aAAa,CACT,YAAY,CAAC,MAAM,EACnB,gCAAgC,CACnC,CAAC;;4BACD,aAAa,CAAC,UAAU,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;oBAC1D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC3B,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBACtC,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpD,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,OAAO;YACX,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;QACL,CAAC;QAED,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACrB,GAAG,CAAC,QAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,cAAc,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YACrD,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,WAAW;YACnB,OAAO;SACV,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,iCAAiC;QACjC,cAAc,CAAC,IAAI,CAAC,gDAAgD,EAAE;YAClE,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACxC,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACjD,IACI,CAAC,OAAO;QACR,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACD,cAAc,CAAC,QAAQ,CAAC,2BAA2B,EAAE;QACjD,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,MAAM,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;QAC9B,cAAc,CAAC,QAAQ,CAAC,4CAA4C,EAAE;YAClE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IAED,cAAc,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACzC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QAClC,MAAM;KACT,CAAC,CAAC;IACH,OAAO,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;AAC1C,CAAC"}

package/dist/utils/extract-command-messages.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=extract-command-messages.test.d.ts.map

package/dist/utils/extract-command-messages.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-command-messages.test.d.ts","sourceRoot":"","sources":["../../source/utils/extract-command-messages.test.ts"],"names":[],"mappings":""}

package/dist/utils/extract-command-messages.test.js

@@ -0,0 +1,64 @@
+import test from 'ava';
+import { extractCommandMessages } from './extract-command-messages.js';
+const withStubbedNow = value => {
+    const realNow = Date.now;
+    Date.now = () => value;
+    return () => {
+        Date.now = realNow;
+    };
+};
+test('extracts bash command results from tool call output items', t => {
+    const restore = withStubbedNow(1700000000000);
+    try {
+        const items = [
+            {
+                type: 'tool_call_output_item',
+                output: '{"command":"date","output":"Mon Nov 24","success":true}',
+                rawItem: {
+                    type: 'function_call_result',
+                    name: 'bash',
+                },
+            },
+        ];
+        const messages = extractCommandMessages(items);
+        t.is(messages.length, 1);
+        t.deepEqual(messages[0], {
+            id: '1700000000000-0',
+            sender: 'command',
+            command: 'date',
+            output: 'Mon Nov 24',
+            success: true,
+        });
+    }
+    finally {
+        restore();
+    }
+});
+test('extracts commands from history function_call_result items', t => {
+    const restore = withStubbedNow(1700000000100);
+    try {
+        const items = [
+            {
+                type: 'function_call_result',
+                name: 'bash',
+                output: {
+                    type: 'text',
+                    text: '{"command":"ls","output":"agent.js\\napp.js","success":false}',
+                },
+            },
+        ];
+        const messages = extractCommandMessages(items);
+        t.is(messages.length, 1);
+        t.deepEqual(messages[0], {
+            id: '1700000000100-0',
+            sender: 'command',
+            command: 'ls',
+            output: 'agent.js\napp.js',
+            success: false,
+        });
+    }
+    finally {
+        restore();
+    }
+});
+//# sourceMappingURL=extract-command-messages.test.js.map

package/dist/utils/extract-command-messages.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-command-messages.test.js","sourceRoot":"","sources":["../../source/utils/extract-command-messages.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAC,sBAAsB,EAAC,MAAM,+BAA+B,CAAC;AAErE,MAAM,cAAc,GAAG,KAAK,CAAC,EAAE;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC;IACvB,OAAO,GAAG,EAAE;QACX,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC;IACpB,CAAC,CAAC;AACH,CAAC,CAAC;AAEF,IAAI,CAAC,2DAA2D,EAAE,CAAC,CAAC,EAAE;IACrE,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAE9C,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG;YACb;gBACC,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,yDAAyD;gBACjE,OAAO,EAAE;oBACR,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,MAAM;iBACZ;aACD;SACD,CAAC;QACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE/C,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACxB,EAAE,EAAE,iBAAiB;YACrB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,IAAI;SACb,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,CAAC,CAAC,EAAE;IACrE,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAE9C,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG;YACb;gBACC,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACP,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,+DAA+D;iBACrE;aACD;SACD,CAAC;QACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE/C,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACxB,EAAE,EAAE,iBAAiB;YACrB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE,KAAK;SACd,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC,CAAC,CAAC"}

package/dist/utils/log-truncation.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Truncates base64 image data in log metadata to prevent log overflow.
+ * Specifically targets messages[].content[].image and messages[].content[].image_url.url
+ */
+export declare function sanitizeLogMetadata(meta: Record<string, any>): Record<string, any>;
+export declare function truncateImageData(meta: Record<string, any>): Record<string, any>;
+//# sourceMappingURL=log-truncation.d.ts.map

package/dist/utils/log-truncation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-truncation.d.ts","sourceRoot":"","sources":["../../source/utils/log-truncation.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA8DlF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAEhF"}

package/dist/utils/log-truncation.js

@@ -0,0 +1,66 @@
+const MAX_IMAGE_DATA_LEN = 100;
+/**
+ * Truncates base64 image data in log metadata to prevent log overflow.
+ * Specifically targets messages[].content[].image and messages[].content[].image_url.url
+ */
+export function sanitizeLogMetadata(meta) {
+    if (!meta || typeof meta !== 'object') {
+        return meta;
+    }
+    if (!Array.isArray(meta.messages)) {
+        return meta;
+    }
+    let messagesModified = false;
+    const messages = meta.messages.map((msg) => {
+        if (!msg || typeof msg !== 'object' || !Array.isArray(msg.content)) {
+            return msg;
+        }
+        const newContent = msg.content.map((item) => {
+            if (!item || typeof item !== 'object') {
+                return item;
+            }
+            let itemModified = false;
+            const newItem = { ...item };
+            // Handle "image" property (direct base64)
+            if (typeof newItem.image === 'string' && newItem.image.startsWith('data:image/')) {
+                newItem.image = truncateBase64(newItem.image);
+                itemModified = true;
+            }
+            // Handle OpenAI-style "image_url"
+            if (newItem.image_url && typeof newItem.image_url === 'object' && !Array.isArray(newItem.image_url)) {
+                const imageUrl = newItem.image_url;
+                if (typeof imageUrl.url === 'string' && imageUrl.url.startsWith('data:image/')) {
+                    newItem.image_url = {
+                        ...imageUrl,
+                        url: truncateBase64(imageUrl.url),
+                    };
+                    itemModified = true;
+                }
+            }
+            return itemModified ? newItem : item;
+        });
+        const contentModified = newContent.some((item, index) => item !== msg.content[index]);
+        if (!contentModified) {
+            return msg;
+        }
+        messagesModified = true;
+        return { ...msg, content: newContent };
+    });
+    if (!messagesModified) {
+        return meta;
+    }
+    return {
+        ...meta,
+        messages,
+    };
+}
+export function truncateImageData(meta) {
+    return sanitizeLogMetadata(meta);
+}
+function truncateBase64(data) {
+    if (data.length <= MAX_IMAGE_DATA_LEN) {
+        return data;
+    }
+    return `${data.slice(0, MAX_IMAGE_DATA_LEN)}... (truncated)`;
+}
+//# sourceMappingURL=log-truncation.js.map

package/dist/utils/log-truncation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-truncation.js","sourceRoot":"","sources":["../../source/utils/log-truncation.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAyB;IAC3D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAQ,EAAE,EAAE;QAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;YAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAE5B,0CAA0C;YAC1C,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjF,OAAO,CAAC,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC9C,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YAED,kCAAkC;YAClC,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpG,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;gBACnC,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC/E,OAAO,CAAC,SAAS,GAAG;wBAClB,GAAG,QAAQ;wBACX,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;qBAClC,CAAC;oBACF,YAAY,GAAG,IAAI,CAAC;gBACtB,CAAC;YACH,CAAC;YAED,OAAO,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAS,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC;QACb,CAAC;QAED,gBAAgB,GAAG,IAAI,CAAC;QACxB,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAyB;IACzD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,iBAAiB,CAAC;AAC/D,CAAC"}

package/dist/utils/log-truncation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=log-truncation.test.d.ts.map

package/dist/utils/log-truncation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-truncation.test.d.ts","sourceRoot":"","sources":["../../source/utils/log-truncation.test.ts"],"names":[],"mappings":""}

package/dist/utils/log-truncation.test.js

@@ -0,0 +1,44 @@
+import test from 'ava';
+import { sanitizeLogMetadata } from './log-truncation.js';
+test('sanitizeLogMetadata truncates image payloads in messages content', (t) => {
+    const longBase64 = 'data:image/png;base64,' + 'a'.repeat(10000);
+    const meta = {
+        eventType: 'provider.request.started',
+        messages: [
+            {
+                role: 'user',
+                content: [
+                    { type: 'text', text: 'describe this' },
+                    { type: 'image', image: longBase64 },
+                    { type: 'input_image', image_url: { url: longBase64, detail: 'high' } },
+                ],
+            },
+        ],
+    };
+    const sanitized = sanitizeLogMetadata(meta);
+    const firstMessage = sanitized.messages[0];
+    const directImage = firstMessage.content[1].image;
+    const imageUrl = firstMessage.content[2].image_url.url;
+    t.not(sanitized, meta);
+    t.true(directImage.length < 500);
+    t.true(directImage.endsWith('... (truncated)'));
+    t.true(imageUrl.length < 500);
+    t.true(imageUrl.endsWith('... (truncated)'));
+    t.is(meta.messages[0].content[1].image, longBase64);
+    t.is(meta.messages[0].content[2].image_url.url, longBase64);
+});
+test('sanitizeLogMetadata returns metadata unchanged when there are no truncation targets', (t) => {
+    const meta = {
+        eventType: 'provider.request.started',
+        messages: [
+            {
+                role: 'user',
+                content: [{ type: 'text', text: 'plain text only' }],
+            },
+        ],
+        provider: 'openai',
+    };
+    const sanitized = sanitizeLogMetadata(meta);
+    t.is(sanitized, meta);
+});
+//# sourceMappingURL=log-truncation.test.js.map

package/dist/utils/log-truncation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-truncation.test.js","sourceRoot":"","sources":["../../source/utils/log-truncation.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,IAAI,CAAC,kEAAkE,EAAE,CAAC,CAAC,EAAE,EAAE;IAC7E,MAAM,UAAU,GAAG,wBAAwB,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,0BAA0B;QACrC,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE;oBACvC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;oBACpC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;iBACxE;aACF;SACF;KACF,CAAC;IAEF,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC,GAAG,CAAC;IAExD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,CAAC,CAAC,EAAE,EAAE;IAChG,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,0BAA0B;QACrC,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;aACrD;SACF;QACD,QAAQ,EAAE,QAAQ;KACnB,CAAC;IAEF,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE5C,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC,CAAC,CAAC"}

package/dist/utils/provider-traffic-extractor.repro.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider-traffic-extractor.repro.test.d.ts.map

package/dist/utils/provider-traffic-extractor.repro.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-traffic-extractor.repro.test.d.ts","sourceRoot":"","sources":["../../source/utils/provider-traffic-extractor.repro.test.ts"],"names":[],"mappings":""}

package/dist/utils/provider-traffic-extractor.repro.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-traffic-extractor.repro.test.js","sourceRoot":"","sources":["../../source/utils/provider-traffic-extractor.repro.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,KAAK,CAAC;AACvB,OAAO,EAAE,oCAAoC,EAAE,MAAM,iCAAiC,CAAC;AAEvF,IAAI,CAAC,0EAA0E,EAAE,CAAC,CAAC,EAAE,EAAE;IACrF,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,gCAAgC;YACzC,QAAQ,EAAE,oBAAoB;YAC9B,KAAK,EAAE,cAAc;YACrB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACjD,CAAC;QACF,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,+BAA+B;YACxC,QAAQ,EAAE,oBAAoB;YAC9B,KAAK,EAAE,cAAc;YACrB,IAAI,EAAE,mBAAmB;SAC1B,CAAC;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,OAAO,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,yDAAyD,CAAC,CAAC;IAEnF,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAEhD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,CAAC,CAAC,EAAE,EAAE;IACpF,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,eAAe;YACxB,SAAS,EAAE,0BAA0B;YACrC,QAAQ,EAAE,kBAAkB;YAC5B,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;SAC9C,CAAC;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,OAAO,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,oDAAoD,CAAC,CAAC;IAC9E,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC"}

package/dist/utils/settings-command.d.ts

@@ -1,4 +1,4 @@
-import type { SlashCommand } from '../components/SlashCommandMenu.js';
+import type { SlashCommand } from '../slash-commands.js';
 import type { SettingsService, SettingsWithSources } from '../services/settings-service.js';
 export declare function parseSettingValue(raw: string): any;
 export declare function formatSettingsSummary(settings: SettingsWithSources): string;

package/dist/utils/settings-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-command.d.ts","sourceRoot":"","sources":["../../source/utils/settings-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAM5F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAYlD;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAiF3E;AAED,UAAU,yBAAyB;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,EACpC,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,QAAQ,GACT,EAAE,yBAAyB,GAAG,YAAY,CAgG1C"}
+{"version":3,"file":"settings-command.d.ts","sourceRoot":"","sources":["../../source/utils/settings-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAM5F,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAYlD;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,CAiF3E;AAED,UAAU,yBAAyB;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,CAAC;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,EACpC,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,QAAQ,GACT,EAAE,yBAAyB,GAAG,YAAY,CAiG1C"}

package/dist/utils/settings-command.js

@@ -1,3 +1,4 @@
+import { SETTINGS_RESET_TRIGGER, SETTINGS_TRIGGER } from '../components/Input/triggers.js';
 import { SETTING_KEYS } from '../services/settings-service.js';
 import { getProvider } from '../providers/index.js';
 import { parseModelProviderArg } from './model-provider-arg.js';
@@ -99,6 +100,7 @@ export function createSettingsCommand({ settingsService, addSystemMessage, apply
         name: 'settings',
         description: 'View or modify settings',
         expectsArgs: true,
+        completion: { type: 'settings', trigger: SETTINGS_TRIGGER, resetTrigger: SETTINGS_RESET_TRIGGER },
         action: (args) => {
             const trimmedArgs = args?.trim() ?? '';
             // No args: prompt for setting name with autocomplete