@resolveio/server-lib 20.13.11 → 20.14.0

package/methods/ai-terminal.js

@@ -0,0 +1,1200 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadAiTerminalMethods = loadAiTerminalMethods;
+var fs_1 = require("fs");
+var os = require("os");
+var path = require("path");
+var simpl_schema_1 = require("simpl-schema");
+var resolveio_server_app_1 = require("../resolveio-server-app");
+var user_collection_1 = require("../collections/user.collection");
+var ai_terminal_conversation_collection_1 = require("../collections/ai-terminal-conversation.collection");
+var ai_terminal_message_collection_1 = require("../collections/ai-terminal-message.collection");
+var common_1 = require("../util/common");
+var tokenizer_1 = require("../util/tokenizer");
+var openai_client_1 = require("../services/openai-client");
+var codex_client_1 = require("../services/codex-client");
+var openai_usage_ledger_manager_1 = require("../managers/openai-usage-ledger.manager");
+var DEFAULT_MAX_FILE_MB = 50;
+var DEFAULT_MAX_TOTAL_MB = 100;
+var DEFAULT_MAX_ATTACHMENT_CHARS = 12000;
+var DEFAULT_MAX_TOTAL_ATTACHMENT_CHARS = 40000;
+var DEFAULT_CODEX_MODEL = 'gpt-5.2-codex';
+var DEFAULT_CODEX_TIMEOUT_MS = 180000;
+var AI_ASSISTANT_SYSTEM_PROMPT = [
+    'You are the ResolveIO in-app AI assistant running with read-only access to the codebase.',
+    '- Do not provide code snippets, full code, or file contents.',
+    '- Do not modify files, run destructive commands, or access databases.',
+    '- Do not access secrets, credentials, or user data.',
+    '- Do not assist with hacking, bypassing security, or abuse.',
+    '- Prefer high-level explanations and point to file paths or routes.',
+    '- If a request is out of scope, offer to create a support ticket with a short summary.',
+    '- Keep responses concise and use low reasoning effort.'
+].join('\n');
+var assistantCodexClient = null;
+function loadAiTerminalMethods(methodManager) {
+    methodManager.methods({
+        aiTerminalConversationCreate: {
+            check: new simpl_schema_1.default({
+                payload: {
+                    type: Object,
+                    blackbox: true
+                }
+            }),
+            function: function (payload) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var now, doc, result;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                now = new Date();
+                                doc = {
+                                    id_client: normalizeOptionalString(payload.id_client),
+                                    id_app: normalizeOptionalString(payload.id_app),
+                                    title: normalizeOptionalString(payload.title) || 'New Conversation',
+                                    mode: normalizeConversationMode(payload.mode),
+                                    branch_enabled: payload.branch_enabled === true,
+                                    branch_name: normalizeOptionalString(payload.branch_name),
+                                    status: normalizeConversationStatus(payload.status),
+                                    profile_id: normalizeOptionalString(payload.profile_id),
+                                    metadata: payload.metadata || {},
+                                    last_message_at: undefined,
+                                    last_message_id: undefined,
+                                    createdAt: now,
+                                    updatedAt: now
+                                };
+                                return [4 /*yield*/, ai_terminal_conversation_collection_1.AiTerminalConversations.insertOne(doc)];
+                            case 1:
+                                result = _a.sent();
+                                return [2 /*return*/, { id_conversation: result._id }];
+                        }
+                    });
+                });
+            }
+        },
+        aiTerminalConversationUpdate: {
+            check: new simpl_schema_1.default({
+                id_conversation: {
+                    type: String
+                },
+                patch: {
+                    type: Object,
+                    blackbox: true
+                }
+            }),
+            function: function (id_conversation, patch) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var update;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                update = {
+                                    updatedAt: new Date()
+                                };
+                                if (patch.title !== undefined) {
+                                    update.title = normalizeOptionalString(patch.title);
+                                }
+                                if (patch.status !== undefined) {
+                                    update.status = normalizeConversationStatus(patch.status);
+                                }
+                                if (patch.branch_enabled !== undefined) {
+                                    update.branch_enabled = !!patch.branch_enabled;
+                                }
+                                if (patch.branch_name !== undefined) {
+                                    update.branch_name = normalizeOptionalString(patch.branch_name);
+                                }
+                                if (patch.profile_id !== undefined) {
+                                    update.profile_id = normalizeOptionalString(patch.profile_id);
+                                }
+                                if (patch.metadata !== undefined) {
+                                    update.metadata = patch.metadata || {};
+                                }
+                                return [4 /*yield*/, ai_terminal_conversation_collection_1.AiTerminalConversations.updateOne({ _id: id_conversation }, { $set: update })];
+                            case 1:
+                                _a.sent();
+                                return [2 /*return*/, { id_conversation: id_conversation }];
+                        }
+                    });
+                });
+            }
+        },
+        aiTerminalConversationDelete: {
+            check: new simpl_schema_1.default({
+                id_conversation: {
+                    type: String
+                }
+            }),
+            function: function (id_conversation) {
+                return __awaiter(this, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.deleteMany({ id_conversation: id_conversation })];
+                            case 1:
+                                _a.sent();
+                                return [4 /*yield*/, ai_terminal_conversation_collection_1.AiTerminalConversations.deleteOne({ _id: id_conversation })];
+                            case 2:
+                                _a.sent();
+                                return [2 /*return*/, { id_conversation: id_conversation }];
+                        }
+                    });
+                });
+            }
+        },
+        aiTerminalUploadFile: {
+            check: new simpl_schema_1.default({
+                id_conversation: {
+                    type: String
+                },
+                file_name: {
+                    type: String
+                },
+                content_base64: {
+                    type: String
+                },
+                content_type: {
+                    type: String,
+                    optional: true
+                },
+                size: {
+                    type: Number
+                }
+            }),
+            function: function (id_conversation, file_name, content_base64, size, content_type) {
+                return __awaiter(this, void 0, void 0, function () {
+                    var limits, safeName, uploadRoot, targetDir, targetPath, dataBuffer, data;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                limits = resolveUploadLimits();
+                                if (size > limits.maxFileBytes) {
+                                    throw new Error("File exceeds ".concat(limits.maxFileMb, "MB limit."));
+                                }
+                                safeName = sanitizeFilename(file_name);
+                                uploadRoot = resolveUploadRoot();
+                                targetDir = path.join(uploadRoot, id_conversation);
+                                return [4 /*yield*/, fs_1.promises.mkdir(targetDir, { recursive: true })];
+                            case 1:
+                                _a.sent();
+                                targetPath = path.join(targetDir, safeName);
+                                dataBuffer = Buffer.from(content_base64, 'base64');
+                                data = new Uint8Array(dataBuffer);
+                                if (data.byteLength !== size) {
+                                    if (data.byteLength > limits.maxFileBytes) {
+                                        throw new Error("File exceeds ".concat(limits.maxFileMb, "MB limit."));
+                                    }
+                                }
+                                return [4 /*yield*/, fs_1.promises.writeFile(targetPath, data)];
+                            case 2:
+                                _a.sent();
+                                return [2 /*return*/, {
+                                        id_file: (0, common_1.objectIdHexString)(),
+                                        name: safeName,
+                                        size: data.byteLength,
+                                        type: normalizeOptionalString(content_type),
+                                        local_path: targetPath
+                                    }];
+                        }
+                    });
+                });
+            }
+        },
+        aiTerminalRun: {
+            check: new simpl_schema_1.default({
+                payload: {
+                    type: Object,
+                    blackbox: true
+                }
+            }),
+            function: function (payload) {
+                return __awaiter(this, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, executeAiTerminalRun(payload, this)];
+                            case 1: return [2 /*return*/, _a.sent()];
+                        }
+                    });
+                });
+            }
+        },
+        aiCoderTerminalUploadFile: {
+            check: new simpl_schema_1.default({
+                id_conversation: {
+                    type: String
+                },
+                file_name: {
+                    type: String
+                },
+                content_base64: {
+                    type: String
+                },
+                size: {
+                    type: Number
+                },
+                content_type: {
+                    type: String,
+                    optional: true
+                }
+            }),
+            function: function (id_conversation, file_name, content_base64, size, content_type) {
+                return __awaiter(this, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, handleCodexUpload(id_conversation, file_name, content_base64, size, content_type)];
+                            case 1: return [2 /*return*/, _a.sent()];
+                        }
+                    });
+                });
+            }
+        },
+        aiCoderTerminalRunCodex: {
+            check: new simpl_schema_1.default({
+                payload: {
+                    type: Object,
+                    blackbox: true
+                }
+            }),
+            function: function (payload) {
+                return __awaiter(this, void 0, void 0, function () {
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0: return [4 /*yield*/, executeAiAssistantCodexRun(payload, this)];
+                            case 1: return [2 /*return*/, _a.sent()];
+                        }
+                    });
+                });
+            }
+        },
+        aiCoderTerminalDeployTest: {
+            check: new simpl_schema_1.default({
+                id_conversation: {
+                    type: String
+                }
+            }),
+            function: function () {
+                throw new Error('Test deploys are not supported for AI assistant sessions.');
+            }
+        }
+    });
+}
+function executeAiTerminalRun(payload, context) {
+    return __awaiter(this, void 0, void 0, function () {
+        var input, message, isSuperAdmin, guardrailsEnabled, guardrail, conversation_1, now_1, userMsg, assistantMsg, conversation, now, attachments, attachmentData, config, systemPrompt, userPromptTemplate, userPrompt, historyLimit, history, _a, messages, openaiSettings, client, response, usage, idClient, userDoc, assistantDoc, insertResult;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    input = payload || {};
+                    message = normalizeOptionalString(input.message);
+                    if (!message) {
+                        throw new Error('Message is required.');
+                    }
+                    return [4 /*yield*/, resolveIsSuperAdmin(context === null || context === void 0 ? void 0 : context.id_user)];
+                case 1:
+                    isSuperAdmin = _b.sent();
+                    guardrailsEnabled = input.guardrails !== false && !isSuperAdmin;
+                    if (!guardrailsEnabled) return [3 /*break*/, 6];
+                    guardrail = evaluateGuardrails(message);
+                    if (!(guardrail === null || guardrail === void 0 ? void 0 : guardrail.blocked)) return [3 /*break*/, 6];
+                    return [4 /*yield*/, ensureConversation(input, 'openai')];
+                case 2:
+                    conversation_1 = _b.sent();
+                    now_1 = new Date();
+                    userMsg = {
+                        id_conversation: conversation_1._id,
+                        role: 'user',
+                        content: message,
+                        createdAt: now_1,
+                        updatedAt: now_1
+                    };
+                    assistantMsg = {
+                        id_conversation: conversation_1._id,
+                        role: 'assistant',
+                        content: guardrail.response,
+                        metadata: {
+                            blocked: true,
+                            reason: guardrail.reason
+                        },
+                        createdAt: now_1,
+                        updatedAt: now_1
+                    };
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userMsg)];
+                case 3:
+                    _b.sent();
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantMsg)];
+                case 4:
+                    _b.sent();
+                    return [4 /*yield*/, touchConversation(conversation_1._id, now_1)];
+                case 5:
+                    _b.sent();
+                    return [2 /*return*/, {
+                            conversation: conversation_1,
+                            message: assistantMsg,
+                            guardrails: { blocked: true, reason: guardrail.reason }
+                        }];
+                case 6: return [4 /*yield*/, ensureConversation(input, 'openai')];
+                case 7:
+                    conversation = _b.sent();
+                    now = new Date();
+                    attachments = Array.isArray(input.attachments) ? input.attachments : [];
+                    return [4 /*yield*/, readAttachmentContents(attachments)];
+                case 8:
+                    attachmentData = _b.sent();
+                    config = sanitizeConfig(input.config || {});
+                    systemPrompt = normalizeOptionalString(config.system_prompt) || '';
+                    userPromptTemplate = normalizeOptionalString(config.user_prompt_template);
+                    userPrompt = buildUserPrompt(userPromptTemplate, message, attachmentData.promptText);
+                    historyLimit = normalizeHistoryLimit(input.max_history);
+                    if (!(historyLimit > 0)) return [3 /*break*/, 10];
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.find({ id_conversation: conversation._id, role: { $in: ['user', 'assistant'] } }, { sort: { createdAt: 1 }, limit: historyLimit * 2 })];
+                case 9:
+                    _a = _b.sent();
+                    return [3 /*break*/, 11];
+                case 10:
+                    _a = [];
+                    _b.label = 11;
+                case 11:
+                    history = _a;
+                    messages = [];
+                    if (systemPrompt) {
+                        messages.push({ role: 'system', content: systemPrompt });
+                    }
+                    history.forEach(function (entry) {
+                        var role = entry.role === 'assistant' ? 'assistant' : 'user';
+                        var content = normalizeOptionalString(entry.content);
+                        if (content) {
+                            messages.push({ role: role, content: content });
+                        }
+                    });
+                    if (userPrompt) {
+                        messages.push({ role: 'user', content: userPrompt });
+                    }
+                    openaiSettings = resolveOpenAISettings(config);
+                    client = new openai_client_1.OpenAIClient(openaiSettings);
+                    return [4 /*yield*/, client.chat(messages, { timeoutMs: 60000, responseFormat: config.response_format })];
+                case 12:
+                    response = _b.sent();
+                    usage = response.usage || estimateUsage(messages, response.content, openaiSettings.model);
+                    idClient = resolveClientId(conversation, input.id_client);
+                    if (!idClient) return [3 /*break*/, 14];
+                    return [4 /*yield*/, (0, openai_usage_ledger_manager_1.recordOpenAIUsage)({
+                            id_client: idClient,
+                            model: response.model || openaiSettings.model || 'unknown',
+                            input_tokens: usage.inputTokens,
+                            output_tokens: usage.outputTokens,
+                            total_tokens: usage.totalTokens,
+                            category: 'ai-terminal',
+                            id_conversation: conversation._id
+                        })];
+                case 13:
+                    _b.sent();
+                    _b.label = 14;
+                case 14:
+                    userDoc = {
+                        id_conversation: conversation._id,
+                        role: 'user',
+                        content: message,
+                        attachments: attachmentData.attachments,
+                        createdAt: now,
+                        updatedAt: now
+                    };
+                    assistantDoc = {
+                        id_conversation: conversation._id,
+                        role: 'assistant',
+                        content: response.content,
+                        usage: {
+                            model: response.model || openaiSettings.model,
+                            input_tokens: usage.inputTokens,
+                            output_tokens: usage.outputTokens,
+                            total_tokens: usage.totalTokens
+                        },
+                        createdAt: now,
+                        updatedAt: now
+                    };
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userDoc)];
+                case 15:
+                    _b.sent();
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantDoc)];
+                case 16:
+                    insertResult = _b.sent();
+                    return [4 /*yield*/, touchConversation(conversation._id, now, insertResult._id)];
+                case 17:
+                    _b.sent();
+                    if (!(input.delete_files_after_run !== false)) return [3 /*break*/, 19];
+                    return [4 /*yield*/, cleanupAttachments(attachmentData.attachments)];
+                case 18:
+                    _b.sent();
+                    _b.label = 19;
+                case 19: return [2 /*return*/, {
+                        conversation: conversation,
+                        message: assistantDoc,
+                        usage: assistantDoc.usage
+                    }];
+            }
+        });
+    });
+}
+function executeAiAssistantCodexRun(payload, context) {
+    return __awaiter(this, void 0, void 0, function () {
+        var input, message, guardrail, conversation_2, now_2, userMsg, assistantMsg, conversation, now, attachments, attachmentData, historyLimit, history, _a, historyLines, prompt, workspaceRoot, codexClient, runOptions, responseText, assistantContent, userDoc, assistantDoc, insertResult;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    input = payload || {};
+                    message = normalizeOptionalString(input.message);
+                    if (!message) {
+                        throw new Error('Message is required.');
+                    }
+                    if (!(context === null || context === void 0 ? void 0 : context.id_user)) {
+                        throw new Error('Unauthorized.');
+                    }
+                    guardrail = evaluateAssistantGuardrails(message);
+                    if (!(guardrail === null || guardrail === void 0 ? void 0 : guardrail.blocked)) return [3 /*break*/, 5];
+                    return [4 /*yield*/, ensureConversation(input, 'codex')];
+                case 1:
+                    conversation_2 = _b.sent();
+                    now_2 = new Date();
+                    userMsg = {
+                        id_conversation: conversation_2._id,
+                        role: 'user',
+                        content: message,
+                        createdAt: now_2,
+                        updatedAt: now_2
+                    };
+                    assistantMsg = {
+                        id_conversation: conversation_2._id,
+                        role: 'assistant',
+                        content: guardrail.response,
+                        metadata: {
+                            blocked: true,
+                            reason: guardrail.reason
+                        },
+                        createdAt: now_2,
+                        updatedAt: now_2
+                    };
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userMsg)];
+                case 2:
+                    _b.sent();
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantMsg)];
+                case 3:
+                    _b.sent();
+                    return [4 /*yield*/, touchConversation(conversation_2._id, now_2)];
+                case 4:
+                    _b.sent();
+                    return [2 /*return*/, {
+                            conversation: conversation_2,
+                            message: assistantMsg,
+                            guardrails: { blocked: true, reason: guardrail.reason }
+                        }];
+                case 5: return [4 /*yield*/, ensureConversation(input, 'codex')];
+                case 6:
+                    conversation = _b.sent();
+                    now = new Date();
+                    attachments = Array.isArray(input.attachments) ? input.attachments : [];
+                    return [4 /*yield*/, readAttachmentContents(attachments)];
+                case 7:
+                    attachmentData = _b.sent();
+                    historyLimit = normalizeHistoryLimit(input.max_history);
+                    if (!(historyLimit > 0)) return [3 /*break*/, 9];
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.find({ id_conversation: conversation._id, role: { $in: ['user', 'assistant'] } }, { sort: { createdAt: 1 }, limit: historyLimit * 2 })];
+                case 8:
+                    _a = _b.sent();
+                    return [3 /*break*/, 10];
+                case 9:
+                    _a = [];
+                    _b.label = 10;
+                case 10:
+                    history = _a;
+                    historyLines = [];
+                    history.forEach(function (entry) {
+                        var role = entry.role === 'assistant' ? 'Assistant' : 'User';
+                        var content = normalizeOptionalString(entry.content);
+                        if (content) {
+                            historyLines.push("".concat(role, ": ").concat(content));
+                        }
+                    });
+                    prompt = buildAssistantCodexPrompt(message, attachmentData.promptText, historyLines.join('\n'));
+                    return [4 /*yield*/, resolveAssistantWorkspaceRoot()];
+                case 11:
+                    workspaceRoot = _b.sent();
+                    codexClient = getAssistantCodexClient();
+                    runOptions = {
+                        timeoutMs: resolveCodexTimeoutMs(),
+                        threadOptions: {
+                            workingDirectory: workspaceRoot,
+                            sandboxMode: 'read-only',
+                            skipGitRepoCheck: true,
+                            modelReasoningEffort: 'low',
+                            networkAccessEnabled: false,
+                            webSearchMode: 'disabled',
+                            webSearchEnabled: false,
+                            approvalPolicy: 'never'
+                        }
+                    };
+                    return [4 /*yield*/, codexClient.run(prompt, runOptions)];
+                case 12:
+                    responseText = _b.sent();
+                    assistantContent = sanitizeAssistantResponse(responseText);
+                    userDoc = {
+                        id_conversation: conversation._id,
+                        role: 'user',
+                        content: message,
+                        attachments: attachmentData.attachments,
+                        createdAt: now,
+                        updatedAt: now
+                    };
+                    assistantDoc = {
+                        id_conversation: conversation._id,
+                        role: 'assistant',
+                        content: assistantContent,
+                        metadata: {
+                            model: resolveCodexModel()
+                        },
+                        createdAt: now,
+                        updatedAt: now
+                    };
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(userDoc)];
+                case 13:
+                    _b.sent();
+                    return [4 /*yield*/, ai_terminal_message_collection_1.AiTerminalMessages.insertOne(assistantDoc)];
+                case 14:
+                    insertResult = _b.sent();
+                    return [4 /*yield*/, touchConversation(conversation._id, now, insertResult._id)];
+                case 15:
+                    _b.sent();
+                    if (!(input.delete_files_after_run !== false)) return [3 /*break*/, 17];
+                    return [4 /*yield*/, cleanupAttachments(attachmentData.attachments)];
+                case 16:
+                    _b.sent();
+                    _b.label = 17;
+                case 17: return [2 /*return*/, {
+                        conversation: conversation,
+                        message: assistantDoc
+                    }];
+            }
+        });
+    });
+}
+function resolveCodexTimeoutMs() {
+    var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var raw = normalizeOptionalNumber(config['AI_ASSISTANT_CODEX_TIMEOUT_MS'] || process.env.AI_ASSISTANT_CODEX_TIMEOUT_MS);
+    if (raw && raw > 0) {
+        return (0, common_1.round)(raw);
+    }
+    return DEFAULT_CODEX_TIMEOUT_MS;
+}
+function resolveCodexModel() {
+    var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var raw = normalizeOptionalString(config['AI_ASSISTANT_CODEX_MODEL']
+        || process.env.AI_ASSISTANT_CODEX_MODEL
+        || config['AI_TERMINAL_CODEX_MODEL']
+        || process.env.AI_TERMINAL_CODEX_MODEL
+        || config['AI_DASHBOARD_CODEX_MODEL']
+        || process.env.AI_DASHBOARD_CODEX_MODEL);
+    return raw || DEFAULT_CODEX_MODEL;
+}
+function resolveCodexSettings() {
+    var serverConfig = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var apiKey = (serverConfig['OPENAI_API_KEY'] || process.env.OPENAI_API_KEY || '').trim();
+    if (!apiKey) {
+        throw new Error('OpenAI API key missing. Add OPENAI_API_KEY to server config.');
+    }
+    return {
+        apiKey: apiKey,
+        baseUrl: (serverConfig['OPENAI_BASE_URL'] || process.env.OPENAI_BASE_URL || '').trim() || undefined,
+        model: resolveCodexModel(),
+        maxRetries: normalizeOptionalNumber(serverConfig['OPENAI_MAX_RETRIES'] || process.env.OPENAI_MAX_RETRIES),
+        retryDelayMs: normalizeOptionalNumber(serverConfig['OPENAI_RETRY_DELAY_MS'] || process.env.OPENAI_RETRY_DELAY_MS)
+    };
+}
+function getAssistantCodexClient() {
+    if (!assistantCodexClient) {
+        assistantCodexClient = new codex_client_1.CodexClient(resolveCodexSettings());
+    }
+    return assistantCodexClient;
+}
+function resolveAssistantWorkspaceRoot() {
+    return __awaiter(this, void 0, void 0, function () {
+        var config, configured, candidate, stat, _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+                    configured = normalizeOptionalString(config['AI_ASSISTANT_WORKSPACE_ROOT']
+                        || process.env.AI_ASSISTANT_WORKSPACE_ROOT
+                        || config['CODEX_WORKSPACE_ROOT']
+                        || process.env.CODEX_WORKSPACE_ROOT);
+                    candidate = configured || resolveio_server_app_1.ResolveIOServer.getClientDir() || process.cwd();
+                    stat = null;
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, fs_1.promises.stat(candidate)];
+                case 2:
+                    stat = _b.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    _a = _b.sent();
+                    stat = null;
+                    return [3 /*break*/, 4];
+                case 4:
+                    if (!stat || !stat.isDirectory()) {
+                        throw new Error('AI assistant workspace root not found.');
+                    }
+                    return [2 /*return*/, candidate];
+            }
+        });
+    });
+}
+function buildAssistantCodexPrompt(message, attachmentText, historyText) {
+    var trimmedHistory = normalizeOptionalString(historyText);
+    var historyBlock = trimmedHistory ? "\n\nConversation so far:\n".concat(trimmedHistory) : '';
+    return "System:\n".concat(AI_ASSISTANT_SYSTEM_PROMPT).concat(historyBlock, "\n\nUser:\n").concat(message).concat(attachmentText || '').trim();
+}
+function sanitizeAssistantResponse(value) {
+    var raw = normalizeOptionalString(value);
+    if (!raw) {
+        return 'I could not generate a response. Please try again.';
+    }
+    var withoutBlocks = raw.replace(/```[\\s\\S]*?```/g, '').replace(/`([^`]+)`/g, '$1').trim();
+    if (!withoutBlocks) {
+        return 'I can’t share code, but I can point you to files or explain behavior at a high level.';
+    }
+    return withoutBlocks;
+}
+function evaluateAssistantGuardrails(message) {
+    var e_1, _a;
+    var normalized = String(message || '').toLowerCase();
+    var patterns = [
+        {
+            pattern: /\b(show|share|paste|provide|dump|output)\b.*\b(code|snippet|file|function|class|script|sql)\b/i,
+            reason: 'Code sharing is restricted.',
+            response: 'I can’t share code. I can explain behavior and point you to file paths or routes.'
+        },
+        {
+            pattern: /\b(write|generate|create|implement|fix)\b.*\b(code|script|function|class|endpoint|sql)\b/i,
+            reason: 'Code generation is restricted.',
+            response: 'I can’t generate code. I can explain how the feature works and where to look in the project.'
+        },
+        {
+            pattern: /\b(credentials?|passwords?|secrets?|tokens?)\b/i,
+            reason: 'Credentials and secrets are restricted.',
+            response: 'I can’t help with credentials or secrets. If you need access, please contact support.'
+        },
+        {
+            pattern: /\b(delete|drop|truncate)\s+(database|db|schema)\b/i,
+            reason: 'Database operations are restricted.',
+            response: 'I can’t help with database operations. I can explain system behavior or file locations.'
+        },
+        {
+            pattern: /\b(shell|terminal|ssh|sudo|rm\\s+-rf|chmod|chown)\b/i,
+            reason: 'System operations are restricted.',
+            response: 'I can’t help with system operations. I can explain workflows and where to find related code.'
+        },
+        {
+            pattern: /\b(exploit|bypass|malware|phishing|ransomware|ddos|hack)\b/i,
+            reason: 'Security abuse is restricted.',
+            response: 'I can’t assist with that request.'
+        }
+    ];
+    try {
+        for (var patterns_1 = __values(patterns), patterns_1_1 = patterns_1.next(); !patterns_1_1.done; patterns_1_1 = patterns_1.next()) {
+            var entry = patterns_1_1.value;
+            if (entry.pattern.test(normalized)) {
+                return {
+                    blocked: true,
+                    reason: entry.reason,
+                    response: entry.response
+                };
+            }
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (patterns_1_1 && !patterns_1_1.done && (_a = patterns_1.return)) _a.call(patterns_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    return null;
+}
+function resolveOpenAISettings(config) {
+    var serverConfig = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var apiKey = (serverConfig['OPENAI_API_KEY'] || process.env.OPENAI_API_KEY || '').trim();
+    if (!apiKey) {
+        throw new Error('OpenAI API key missing. Add OPENAI_API_KEY to server config.');
+    }
+    return {
+        apiKey: apiKey,
+        baseUrl: (serverConfig['OPENAI_BASE_URL'] || process.env.OPENAI_BASE_URL || '').trim() || undefined,
+        model: normalizeOptionalString(config === null || config === void 0 ? void 0 : config.model) || (serverConfig['OPENAI_MODEL'] || process.env.OPENAI_MODEL || 'gpt-5.1').trim(),
+        temperature: normalizeOptionalNumber(config === null || config === void 0 ? void 0 : config.temperature),
+        maxTokens: normalizeOptionalNumber(config === null || config === void 0 ? void 0 : config.max_tokens),
+        maxRetries: normalizeOptionalNumber(serverConfig['OPENAI_MAX_RETRIES'] || process.env.OPENAI_MAX_RETRIES),
+        retryDelayMs: normalizeOptionalNumber(serverConfig['OPENAI_RETRY_DELAY_MS'] || process.env.OPENAI_RETRY_DELAY_MS)
+    };
+}
+function resolveUploadLimits() {
+    var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var maxFileMb = normalizeOptionalNumber(config['AI_TERMINAL_MAX_FILE_MB'] || process.env.AI_TERMINAL_MAX_FILE_MB) || DEFAULT_MAX_FILE_MB;
+    var maxTotalMb = normalizeOptionalNumber(config['AI_TERMINAL_MAX_TOTAL_MB'] || process.env.AI_TERMINAL_MAX_TOTAL_MB) || DEFAULT_MAX_TOTAL_MB;
+    return {
+        maxFileBytes: (0, common_1.round)(maxFileMb * 1024 * 1024),
+        maxFileMb: maxFileMb,
+        maxTotalBytes: (0, common_1.round)(maxTotalMb * 1024 * 1024),
+        maxTotalMb: maxTotalMb
+    };
+}
+function resolveUploadRoot() {
+    var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var configured = normalizeOptionalString(config['AI_TERMINAL_UPLOAD_ROOT'] || process.env.AI_TERMINAL_UPLOAD_ROOT);
+    if (configured) {
+        return configured;
+    }
+    return path.join(os.tmpdir(), 'resolveio-ai-terminal-uploads');
+}
+function handleCodexUpload(id_conversation, file_name, content_base64, size, content_type) {
+    return __awaiter(this, void 0, void 0, function () {
+        var limits, safeName, uploadRoot, targetDir, targetPath, dataBuffer, data;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    limits = resolveUploadLimits();
+                    if (size > limits.maxFileBytes) {
+                        throw new Error("File exceeds ".concat(limits.maxFileMb, "MB limit."));
+                    }
+                    safeName = sanitizeFilename(file_name);
+                    uploadRoot = resolveUploadRoot();
+                    targetDir = path.join(uploadRoot, id_conversation);
+                    return [4 /*yield*/, fs_1.promises.mkdir(targetDir, { recursive: true })];
+                case 1:
+                    _a.sent();
+                    targetPath = path.join(targetDir, safeName);
+                    dataBuffer = Buffer.from(content_base64, 'base64');
+                    data = new Uint8Array(dataBuffer);
+                    if (data.byteLength > limits.maxFileBytes) {
+                        throw new Error("File exceeds ".concat(limits.maxFileMb, "MB limit."));
+                    }
+                    return [4 /*yield*/, fs_1.promises.writeFile(targetPath, data)];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/, {
+                            id_file: (0, common_1.objectIdHexString)(),
+                            name: safeName,
+                            size: data.byteLength,
+                            type: normalizeOptionalString(content_type),
+                            local_path: targetPath
+                        }];
+            }
+        });
+    });
+}
+function readAttachmentContents(attachments) {
+    return __awaiter(this, void 0, void 0, function () {
+        var limits, totalBytes, totalChars, chunks, cleaned, attachments_1, attachments_1_1, attachment, localPath, safe, stat, ext, name_1, type, readable, content, _a, e_2_1;
+        var e_2, _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    if (!attachments || !attachments.length) {
+                        return [2 /*return*/, { promptText: '', attachments: [] }];
+                    }
+                    limits = resolveAttachmentLimits();
+                    totalBytes = 0;
+                    totalChars = 0;
+                    chunks = [];
+                    cleaned = [];
+                    _c.label = 1;
+                case 1:
+                    _c.trys.push([1, 11, 12, 13]);
+                    attachments_1 = __values(attachments), attachments_1_1 = attachments_1.next();
+                    _c.label = 2;
+                case 2:
+                    if (!!attachments_1_1.done) return [3 /*break*/, 10];
+                    attachment = attachments_1_1.value;
+                    localPath = normalizeOptionalString(attachment.local_path);
+                    if (!localPath) {
+                        return [3 /*break*/, 9];
+                    }
+                    safe = ensurePathUnderRoot(localPath, resolveUploadRoot());
+                    if (!safe) {
+                        return [3 /*break*/, 9];
+                    }
+                    _c.label = 3;
+                case 3:
+                    _c.trys.push([3, 8, , 9]);
+                    return [4 /*yield*/, fs_1.promises.stat(localPath)];
+                case 4:
+                    stat = _c.sent();
+                    if (!stat.isFile()) {
+                        return [3 /*break*/, 9];
+                    }
+                    totalBytes += stat.size;
+                    if (totalBytes > limits.maxTotalBytes) {
+                        return [3 /*break*/, 10];
+                    }
+                    ext = path.extname(localPath).toLowerCase();
+                    name_1 = normalizeOptionalString(attachment.name) || path.basename(localPath);
+                    type = normalizeOptionalString(attachment.type);
+                    readable = isReadableAttachment(type, ext);
+                    content = '';
+                    if (!readable) return [3 /*break*/, 6];
+                    return [4 /*yield*/, fs_1.promises.readFile(localPath, 'utf8')];
+                case 5:
+                    content = _c.sent();
+                    if (content.length > limits.maxAttachmentChars) {
+                        content = content.slice(0, limits.maxAttachmentChars) + '\n[...truncated]';
+                    }
+                    return [3 /*break*/, 7];
+                case 6:
+                    content = "[".concat(name_1, " attached; binary content omitted]");
+                    _c.label = 7;
+                case 7:
+                    totalChars += content.length;
+                    if (totalChars > limits.maxTotalAttachmentChars) {
+                        return [3 /*break*/, 10];
+                    }
+                    chunks.push("File: ".concat(name_1, "\n").concat(content));
+                    cleaned.push({
+                        id: attachment.id,
+                        name: name_1,
+                        type: type,
+                        size: stat.size,
+                        local_path: localPath
+                    });
+                    return [3 /*break*/, 9];
+                case 8:
+                    _a = _c.sent();
+                    return [3 /*break*/, 9];
+                case 9:
+                    attachments_1_1 = attachments_1.next();
+                    return [3 /*break*/, 2];
+                case 10: return [3 /*break*/, 13];
+                case 11:
+                    e_2_1 = _c.sent();
+                    e_2 = { error: e_2_1 };
+                    return [3 /*break*/, 13];
+                case 12:
+                    try {
+                        if (attachments_1_1 && !attachments_1_1.done && (_b = attachments_1.return)) _b.call(attachments_1);
+                    }
+                    finally { if (e_2) throw e_2.error; }
+                    return [7 /*endfinally*/];
+                case 13: return [2 /*return*/, {
+                        promptText: chunks.length ? "\n\nAttachments:\n".concat(chunks.join('\n\n')) : '',
+                        attachments: cleaned
+                    }];
+            }
+        });
+    });
+}
+function resolveAttachmentLimits() {
+    var config = resolveio_server_app_1.ResolveIOServer.getServerConfig() || {};
+    var maxAttachmentChars = normalizeOptionalNumber(config['AI_TERMINAL_MAX_ATTACHMENT_CHARS'] || process.env.AI_TERMINAL_MAX_ATTACHMENT_CHARS)
+        || DEFAULT_MAX_ATTACHMENT_CHARS;
+    var maxTotalAttachmentChars = normalizeOptionalNumber(config['AI_TERMINAL_MAX_TOTAL_ATTACHMENT_CHARS'] || process.env.AI_TERMINAL_MAX_TOTAL_ATTACHMENT_CHARS)
+        || DEFAULT_MAX_TOTAL_ATTACHMENT_CHARS;
+    var limits = resolveUploadLimits();
+    return {
+        maxAttachmentChars: maxAttachmentChars,
+        maxTotalAttachmentChars: maxTotalAttachmentChars,
+        maxTotalBytes: limits.maxTotalBytes
+    };
+}
+function buildUserPrompt(template, inputText, attachmentText) {
+    var data = {
+        input: inputText || '',
+        today: new Date().toISOString().slice(0, 10)
+    };
+    if (template) {
+        return applyTemplate(template, data).trim() + attachmentText;
+    }
+    return "".concat(inputText || '').concat(attachmentText).trim();
+}
+function applyTemplate(template, data) {
+    var output = template;
+    Object.keys(data).forEach(function (key) {
+        var value = data[key] || '';
+        var pattern = new RegExp("{{\\s*".concat(key, "\\s*}}"), 'gi');
+        output = output.replace(pattern, value);
+    });
+    return output;
+}
+function sanitizeConfig(source) {
+    return {
+        mode: normalizeOptionalString(source === null || source === void 0 ? void 0 : source.mode),
+        model: normalizeOptionalString(source === null || source === void 0 ? void 0 : source.model),
+        system_prompt: normalizeOptionalString(source === null || source === void 0 ? void 0 : source.system_prompt),
+        user_prompt_template: normalizeOptionalString(source === null || source === void 0 ? void 0 : source.user_prompt_template),
+        response_format: normalizeOptionalString(source === null || source === void 0 ? void 0 : source.response_format),
+        temperature: normalizeOptionalNumber(source === null || source === void 0 ? void 0 : source.temperature),
+        max_tokens: normalizeOptionalNumber(source === null || source === void 0 ? void 0 : source.max_tokens)
+    };
+}
+function ensureConversation(input, mode) {
+    return __awaiter(this, void 0, void 0, function () {
+        var idConversation, existing, now, doc, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    idConversation = normalizeOptionalString(input.id_conversation);
+                    if (!idConversation) return [3 /*break*/, 2];
+                    return [4 /*yield*/, ai_terminal_conversation_collection_1.AiTerminalConversations.findById(idConversation)];
+                case 1:
+                    existing = _a.sent();
+                    if (existing) {
+                        return [2 /*return*/, existing];
+                    }
+                    _a.label = 2;
+                case 2:
+                    now = new Date();
+                    doc = {
+                        id_client: normalizeOptionalString(input.id_client),
+                        id_app: normalizeOptionalString(input.id_app),
+                        title: 'New Conversation',
+                        mode: mode,
+                        branch_enabled: mode === 'codex',
+                        status: normalizeConversationStatus('active'),
+                        profile_id: normalizeOptionalString(input.profile_id),
+                        metadata: {},
+                        createdAt: now,
+                        updatedAt: now
+                    };
+                    return [4 /*yield*/, ai_terminal_conversation_collection_1.AiTerminalConversations.insertOne(doc)];
+                case 3:
+                    result = _a.sent();
+                    return [2 /*return*/, result];
+            }
+        });
+    });
+}
+function touchConversation(idConversation, timestamp, lastMessageId) {
+    return __awaiter(this, void 0, void 0, function () {
+        var update;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    update = {
+                        updatedAt: timestamp,
+                        last_message_at: timestamp
+                    };
+                    if (lastMessageId) {
+                        update.last_message_id = lastMessageId;
+                    }
+                    return [4 /*yield*/, ai_terminal_conversation_collection_1.AiTerminalConversations.updateOne({ _id: idConversation }, { $set: update })];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    });
+}
+function normalizeOptionalString(value) {
+    var raw = typeof value === 'string' ? value.trim() : '';
+    return raw || '';
+}
+function normalizeConversationMode(value) {
+    var normalized = normalizeOptionalString(value).toLowerCase();
+    if (normalized === 'codex') {
+        return 'codex';
+    }
+    return 'openai';
+}
+function normalizeConversationStatus(value) {
+    var normalized = normalizeOptionalString(value).toLowerCase();
+    if (normalized === 'archived') {
+        return 'archived';
+    }
+    return 'active';
+}
+function normalizeOptionalNumber(value) {
+    var parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function normalizeHistoryLimit(value) {
+    var parsed = Number(value);
+    if (!Number.isFinite(parsed)) {
+        return 12;
+    }
+    return Math.min(Math.max((0, common_1.round)(parsed), 0), 30);
+}
+function resolveClientId(conversation, inputClientId) {
+    return normalizeOptionalString(inputClientId) || normalizeOptionalString(conversation === null || conversation === void 0 ? void 0 : conversation.id_client);
+}
+function estimateUsage(messages, responseText, model) {
+    var inputTokens = (0, tokenizer_1.countChatTokens)(messages, model);
+    var outputTokens = (0, tokenizer_1.countTokens)(responseText || '', model);
+    return {
+        inputTokens: inputTokens,
+        outputTokens: outputTokens,
+        totalTokens: inputTokens + outputTokens
+    };
+}
+function evaluateGuardrails(message) {
+    var e_3, _a;
+    var normalized = String(message || '').toLowerCase();
+    var patterns = [
+        { pattern: /\b(source\s*code|full\s*code|entire\s*code|repo\s*dump|repository|git\s*clone)\b/i, reason: 'Code access is restricted.' },
+        { pattern: /\b(credentials?|passwords?|secrets?|tokens?)\b/i, reason: 'Credentials and secrets are restricted.' },
+        { pattern: /\b(delete|drop)\s+(database|db|schema)\b/i, reason: 'Database operations are restricted.' },
+        { pattern: /\b(shell|terminal|ssh|sudo|rm\s+-rf|chmod|chown)\b/i, reason: 'Server operations are restricted.' },
+        { pattern: /\b(exploit|bypass|malware|phishing|ransomware|ddos)\b/i, reason: 'Security abuse is restricted.' }
+    ];
+    try {
+        for (var patterns_2 = __values(patterns), patterns_2_1 = patterns_2.next(); !patterns_2_1.done; patterns_2_1 = patterns_2.next()) {
+            var entry = patterns_2_1.value;
+            if (entry.pattern.test(normalized)) {
+                return {
+                    blocked: true,
+                    reason: entry.reason,
+                    response: 'I can’t help with that request because it could impact system security or expose protected information. If you need a change, describe the outcome and I can help within approved workflows.'
+                };
+            }
+        }
+    }
+    catch (e_3_1) { e_3 = { error: e_3_1 }; }
+    finally {
+        try {
+            if (patterns_2_1 && !patterns_2_1.done && (_a = patterns_2.return)) _a.call(patterns_2);
+        }
+        finally { if (e_3) throw e_3.error; }
+    }
+    return null;
+}
+function resolveIsSuperAdmin(id_user) {
+    return __awaiter(this, void 0, void 0, function () {
+        var user, _a;
+        var _b;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    if (!id_user) {
+                        return [2 /*return*/, false];
+                    }
+                    _c.label = 1;
+                case 1:
+                    _c.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, user_collection_1.Users.findById(id_user)];
+                case 2:
+                    user = _c.sent();
+                    return [2 /*return*/, !!((_b = user === null || user === void 0 ? void 0 : user.roles) === null || _b === void 0 ? void 0 : _b.super_admin)];
+                case 3:
+                    _a = _c.sent();
+                    return [2 /*return*/, false];
+                case 4: return [2 /*return*/];
+            }
+        });
+    });
+}
+function sanitizeFilename(value) {
+    var trimmed = (value || '').trim();
+    var base = path.basename(trimmed);
+    return base.replace(/[^\w.\-]/g, '_') || "upload_".concat(Date.now());
+}
+function isReadableAttachment(type, ext) {
+    var normalizedType = (type || '').toLowerCase();
+    if (normalizedType.startsWith('text/')) {
+        return true;
+    }
+    if (['application/json', 'application/xml', 'application/csv'].includes(normalizedType)) {
+        return true;
+    }
+    return ['.txt', '.md', '.json', '.csv', '.xml', '.log', '.yml', '.yaml', '.ts', '.tsx', '.js', '.jsx', '.css', '.scss', '.html', '.htm', '.sql'].includes(ext);
+}
+function ensurePathUnderRoot(targetPath, root) {
+    var resolvedRoot = path.resolve(root);
+    var resolvedTarget = path.resolve(targetPath);
+    return resolvedTarget.startsWith(resolvedRoot);
+}
+function cleanupAttachments(attachments) {
+    return __awaiter(this, void 0, void 0, function () {
+        var uploadRoot, removals;
+        var _this = this;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    if (!attachments || !attachments.length) {
+                        return [2 /*return*/];
+                    }
+                    uploadRoot = resolveUploadRoot();
+                    removals = attachments.map(function (attachment) { return __awaiter(_this, void 0, void 0, function () {
+                        var localPath, safe, _a;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0:
+                                    localPath = normalizeOptionalString(attachment.local_path);
+                                    if (!localPath) {
+                                        return [2 /*return*/];
+                                    }
+                                    safe = ensurePathUnderRoot(localPath, uploadRoot);
+                                    if (!safe) {
+                                        return [2 /*return*/];
+                                    }
+                                    _b.label = 1;
+                                case 1:
+                                    _b.trys.push([1, 3, , 4]);
+                                    return [4 /*yield*/, fs_1.promises.rm(localPath, { force: true })];
+                                case 2:
+                                    _b.sent();
+                                    return [3 /*break*/, 4];
+                                case 3:
+                                    _a = _b.sent();
+                                    return [3 /*break*/, 4];
+                                case 4: return [2 /*return*/];
+                            }
+                        });
+                    }); });
+                    return [4 /*yield*/, Promise.all(removals)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    });
+}
+
+//# sourceMappingURL=ai-terminal.js.map