@revealui/ai 0.2.8 → 0.2.9

package/dist/tools/{cms → admin}/media-tools.js

@@ -1,5 +1,5 @@
 /**
- * CMS Media Tools
+ * Admin Media Tools
  * Tools for managing media files (images, videos, documents)
  */
 import { z } from 'zod/v4';
@@ -9,7 +9,7 @@ import { z } from 'zod/v4';
  */
 export const listMediaTool = {
     name: 'list_media',
-    description: 'Get a list of media files from the CMS media library. Use this to browse uploaded images, videos, and documents.',
+    description: 'Get a list of media files from the admin media library. Use this to browse uploaded images, videos, and documents.',
     parameters: z.object({
         page: z.number().optional().describe('Page number for pagination (default: 1)'),
         limit: z.number().optional().describe('Number of results per page (default: 10)'),
@@ -63,7 +63,7 @@ export const getMediaTool = {
  */
 export const uploadMediaTool = {
     name: 'upload_media',
-    description: 'Upload a new media file (image, video, or document) to the CMS. The file should be provided as a base64-encoded string.',
+    description: 'Upload a new media file (image, video, or document) to the admin. The file should be provided as a base64-encoded string.',
     parameters: z.object({
         filename: z.string().describe('The filename (e.g., "logo.png")'),
         mimeType: z.string().describe('The MIME type (e.g., "image/png", "image/jpeg")'),
@@ -93,7 +93,7 @@ export const uploadMediaTool = {
  */
 export const deleteMediaTool = {
     name: 'delete_media',
-    description: 'Delete a media file from the CMS media library. This removes both the database record and the file from storage. This action is permanent.',
+    description: 'Delete a media file from the admin media library. This removes both the database record and the file from storage. This action is permanent.',
     parameters: z.object({
         id: z.string().describe('The media file ID to delete'),
     }),

package/dist/tools/{cms → admin}/user-tools.d.ts

@@ -1,5 +1,5 @@
 /**
- * CMS User Tools
+ * Admin User Tools
  * Tools for user management and authentication
  */
 import type { Tool } from '../base.js';

package/dist/tools/admin/user-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-tools.d.ts","sourceRoot":"","sources":["../../../src/tools/admin/user-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,IAoBhC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,IAiC3B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,IAsC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,IAsC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,IAuB5B,CAAC"}

package/dist/tools/{cms → admin}/user-tools.js

@@ -1,5 +1,5 @@
 /**
- * CMS User Tools
+ * Admin User Tools
  * Tools for user management and authentication
  */
 import { z } from 'zod/v4';

package/dist/tools/coding/file-edit.d.ts

@@ -1,5 +1,5 @@
 /**
- * file_edit — Surgical string replacement in a file
+ * file_edit  -  Surgical string replacement in a file
  */
 import type { Tool } from '../base.js';
 export declare const fileEditTool: Tool;

package/dist/tools/coding/file-edit.js

@@ -1,5 +1,5 @@
 /**
- * file_edit — Surgical string replacement in a file
+ * file_edit  -  Surgical string replacement in a file
  */
 import { readFileSync, writeFileSync } from 'node:fs';
 import { z } from 'zod/v4';
@@ -23,7 +23,7 @@ export const fileEditTool = {
             return { success: false, error: check.reason };
         }
         if (old_text === new_text) {
-            return { success: false, error: 'old_text and new_text are identical — nothing to change' };
+            return { success: false, error: 'old_text and new_text are identical  -  nothing to change' };
         }
         const resolvedPath = resolveSafePath(path, config);
         try {

package/dist/tools/coding/file-glob.d.ts

@@ -1,5 +1,5 @@
 /**
- * file_glob — Fast file pattern matching with picomatch-style globs
+ * file_glob  -  Fast file pattern matching with picomatch-style globs
  */
 import type { Tool } from '../base.js';
 export declare const fileGlobTool: Tool;

package/dist/tools/coding/file-glob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-glob.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/file-glob.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AA+DnD,eAAO,MAAM,YAAY,EAAE,IAgE1B,CAAC"}
+{"version":3,"file":"file-glob.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/file-glob.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAgEnD,eAAO,MAAM,YAAY,EAAE,IAgE1B,CAAC"}

package/dist/tools/coding/file-glob.js

@@ -1,5 +1,5 @@
 /**
- * file_glob — Fast file pattern matching with picomatch-style globs
+ * file_glob  -  Fast file pattern matching with picomatch-style globs
  */
 import { readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
@@ -8,6 +8,7 @@ import { getSafetyConfig } from './safety.js';
 /** Simple glob matcher supporting *, **, and ? */
 function matchGlob(pattern, filePath) {
     const regex = pattern
+        .replace(/\\/g, '\\\\')
         .replace(/\./g, '\\.')
         .replace(/\*\*/g, '⟨GLOBSTAR⟩')
         .replace(/\*/g, '[^/]*')

package/dist/tools/coding/file-grep.d.ts

@@ -1,5 +1,5 @@
 /**
- * file_grep — Regex content search across files
+ * file_grep  -  Regex content search across files
  */
 import type { Tool } from '../base.js';
 export declare const fileGrepTool: Tool;

package/dist/tools/coding/file-grep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-grep.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/file-grep.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAiGnD,eAAO,MAAM,YAAY,EAAE,IA0H1B,CAAC"}
+{"version":3,"file":"file-grep.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/file-grep.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAkGnD,eAAO,MAAM,YAAY,EAAE,IA0H1B,CAAC"}

package/dist/tools/coding/file-grep.js

@@ -1,5 +1,5 @@
 /**
- * file_grep — Regex content search across files
+ * file_grep  -  Regex content search across files
  */
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
@@ -8,6 +8,7 @@ import { getSafetyConfig } from './safety.js';
 /** Simple glob test for file filtering */
 function matchesGlob(filePath, glob) {
     const regex = glob
+        .replace(/\\/g, '\\\\')
         .replace(/\./g, '\\.')
         .replace(/\*\*/g, '⟨GLOBSTAR⟩')
         .replace(/\*/g, '[^/]*')

package/dist/tools/coding/file-read.d.ts

@@ -1,5 +1,5 @@
 /**
- * file_read — Read file contents with line numbers
+ * file_read  -  Read file contents with line numbers
  */
 import type { Tool } from '../base.js';
 export declare const fileReadTool: Tool;

package/dist/tools/coding/file-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-read.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/file-read.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAGnD,eAAO,MAAM,YAAY,EAAE,IAkE1B,CAAC"}
+{"version":3,"file":"file-read.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/file-read.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAGnD,eAAO,MAAM,YAAY,EAAE,IAsE1B,CAAC"}

package/dist/tools/coding/file-read.js

@@ -1,7 +1,7 @@
 /**
- * file_read — Read file contents with line numbers
+ * file_read  -  Read file contents with line numbers
  */
-import { readFileSync, statSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { z } from 'zod/v4';
 import { getSafetyConfig, resolveSafePath, validatePath } from './safety.js';
 export const fileReadTool = {
@@ -24,14 +24,20 @@ export const fileReadTool = {
         const maxLines = limit ?? 2000;
         const startLine = (offset ?? 1) - 1; // Convert to 0-based
         try {
-            const stat = statSync(resolvedPath);
-            if (stat.isDirectory()) {
-                return {
-                    success: false,
-                    error: `${path} is a directory, not a file. Use file_glob to list directory contents.`,
-                };
+            // Read first, then check if directory (avoids TOCTOU race between stat and read)
+            let raw;
+            try {
+                raw = readFileSync(resolvedPath, 'utf8');
+            }
+            catch (readErr) {
+                if (readErr.code === 'EISDIR') {
+                    return {
+                        success: false,
+                        error: `${path} is a directory, not a file. Use file_glob to list directory contents.`,
+                    };
+                }
+                throw readErr;
             }
-            const raw = readFileSync(resolvedPath, 'utf8');
             const allLines = raw.split('\n');
             const totalLines = allLines.length;
             const sliced = allLines.slice(startLine, startLine + maxLines);

package/dist/tools/coding/file-write.d.ts

@@ -1,5 +1,5 @@
 /**
- * file_write — Write entire file contents
+ * file_write  -  Write entire file contents
  */
 import type { Tool } from '../base.js';
 export declare const fileWriteTool: Tool;

package/dist/tools/coding/file-write.js

@@ -1,5 +1,5 @@
 /**
- * file_write — Write entire file contents
+ * file_write  -  Write entire file contents
  */
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';

package/dist/tools/coding/git-ops.d.ts

@@ -1,5 +1,5 @@
 /**
- * git_ops — Git operations wrapper (status, diff, log, blame)
+ * git_ops  -  Git operations wrapper (status, diff, log, blame)
  */
 import type { Tool } from '../base.js';
 export declare const gitOpsTool: Tool;

package/dist/tools/coding/git-ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-ops.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/git-ops.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAyBnD,eAAO,MAAM,UAAU,EAAE,IA4FxB,CAAC"}
+{"version":3,"file":"git-ops.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/git-ops.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAuBnD,eAAO,MAAM,UAAU,EAAE,IA4FxB,CAAC"}

package/dist/tools/coding/git-ops.js

@@ -1,15 +1,14 @@
 /**
- * git_ops — Git operations wrapper (status, diff, log, blame)
+ * git_ops  -  Git operations wrapper (status, diff, log, blame)
  */
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { z } from 'zod/v4';
 import { getSafetyConfig } from './safety.js';
 const GIT_OPERATIONS = ['status', 'diff', 'diff_full', 'log', 'blame', 'show', 'branch'];
 /** Max output per git command */
 const MAX_OUTPUT = 50_000;
 function runGit(args, cwd) {
-    const cmd = `git ${args.join(' ')}`;
-    return execSync(cmd, {
+    return execFileSync('git', args, {
         cwd,
         timeout: 15_000,
         maxBuffer: MAX_OUTPUT,
@@ -17,7 +16,6 @@ function runGit(args, cwd) {
         env: {
             ...process.env,
             GIT_TERMINAL_PROMPT: '0',
-            // Prevent pager from blocking
             GIT_PAGER: 'cat',
         },
     }).trim();
@@ -25,7 +23,7 @@ function runGit(args, cwd) {
 export const gitOpsTool = {
     name: 'git_ops',
     label: 'Git Operations',
-    description: 'Run read-only git operations: status, diff (summary), diff_full (full patch), log, blame, show, branch. Safe operations only — no push, commit, reset, or checkout.',
+    description: 'Run read-only git operations: status, diff (summary), diff_full (full patch), log, blame, show, branch. Safe operations only  -  no push, commit, reset, or checkout.',
     parameters: z.object({
         operation: z.enum(GIT_OPERATIONS).describe('Git operation to perform'),
         args: z
@@ -57,7 +55,7 @@ export const gitOpsTool = {
                     output = runGit(['diff', '--stat', ...args], config.projectRoot);
                     break;
                 case 'diff_full':
-                    // Full patch content for code review — hunks per file
+                    // Full patch content for code review  -  hunks per file
                     output = runGit(['diff', '--no-color', '-U3', ...args], config.projectRoot);
                     break;
                 case 'log':

package/dist/tools/coding/index.d.ts

@@ -20,7 +20,7 @@ export { testRunnerTool } from './test-runner.js';
  * Configuration for the coding tools factory
  */
 export interface CodingToolsConfig {
-    /** Project root directory — all file operations sandboxed here */
+    /** Project root directory  -  all file operations sandboxed here */
     projectRoot: string;
     /** Additional directories to allow (e.g., /tmp for scratch files) */
     allowedPaths?: string[];

package/dist/tools/coding/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAevC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,KAAK,CACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,WAAW,GACX,WAAW,GACX,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,aAAa,GACb,UAAU,CACb,CAAC;CACH;AAgBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,EAAE,CAmBnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAevC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,KAAK,CACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,WAAW,GACX,WAAW,GACX,YAAY,GACZ,SAAS,GACT,iBAAiB,GACjB,aAAa,GACb,UAAU,CACb,CAAC;CACH;AAgBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,EAAE,CAmBnE"}

package/dist/tools/coding/lint-fix.d.ts

@@ -1,5 +1,5 @@
 /**
- * lint_fix — Run linter and optionally auto-fix issues
+ * lint_fix  -  Run linter and optionally auto-fix issues
  *
  * Detects the linter (Biome, ESLint) and runs it with machine-parseable
  * output. Returns structured diagnostic counts and details.

package/dist/tools/coding/lint-fix.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lint-fix.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/lint-fix.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAwMnD,eAAO,MAAM,WAAW,EAAE,IAqHzB,CAAC"}
+{"version":3,"file":"lint-fix.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/lint-fix.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AA6MnD,eAAO,MAAM,WAAW,EAAE,IAqHzB,CAAC"}

package/dist/tools/coding/lint-fix.js

@@ -1,11 +1,11 @@
 /**
- * lint_fix — Run linter and optionally auto-fix issues
+ * lint_fix  -  Run linter and optionally auto-fix issues
  *
  * Detects the linter (Biome, ESLint) and runs it with machine-parseable
  * output. Returns structured diagnostic counts and details.
  */
 import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod/v4';
 import { getSafetyConfig } from './safety.js';
@@ -22,7 +22,7 @@ function detectLinter(projectRoot) {
     const pkgPath = join(projectRoot, 'package.json');
     if (existsSync(pkgPath)) {
         try {
-            const pkg = JSON.parse(execSync(`cat "${pkgPath}"`, { encoding: 'utf8', timeout: 5000 }));
+            const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
             const deps = {
                 ...pkg.dependencies,
                 ...pkg.devDependencies,
@@ -38,8 +38,12 @@ function detectLinter(projectRoot) {
     }
     return 'unknown';
 }
+/** Validate that a file argument is safe for shell use (no metacharacters) */
+function isSafeShellArg(arg) {
+    return /^[\w./@-]+$/.test(arg);
+}
 function buildCommand(linter, file, fix) {
-    const target = file ?? '.';
+    const target = file && isSafeShellArg(file) ? file : '.';
     switch (linter) {
         case 'biome':
             return fix ? `npx biome check --write ${target}` : `npx biome check ${target}`;

package/dist/tools/coding/project-context.d.ts

@@ -1,5 +1,5 @@
 /**
- * project_context — Query the harness content layer for relevant project rules and skills
+ * project_context  -  Query the harness content layer for relevant project rules and skills
  */
 import type { Tool } from '../base.js';
 export declare const projectContextTool: Tool;

package/dist/tools/coding/project-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-context.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/project-context.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAuFnD,eAAO,MAAM,kBAAkB,EAAE,IAkDhC,CAAC"}
+{"version":3,"file":"project-context.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/project-context.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAyFnD,eAAO,MAAM,kBAAkB,EAAE,IAkDhC,CAAC"}

package/dist/tools/coding/project-context.js

@@ -1,7 +1,7 @@
 /**
- * project_context — Query the harness content layer for relevant project rules and skills
+ * project_context  -  Query the harness content layer for relevant project rules and skills
  */
-import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod/v4';
 import { getSafetyConfig } from './safety.js';
@@ -28,27 +28,28 @@ function searchContent(projectRoot, query, scope) {
         }
         for (const entry of entries) {
             const fullPath = join(dir, entry);
-            try {
-                const stat = statSync(fullPath);
-                if (stat.isDirectory()) {
-                    // Check for skill directories with SKILL.md
-                    const skillPath = join(fullPath, 'SKILL.md');
-                    try {
-                        const content = readFileSync(skillPath, 'utf8');
-                        if (matchesQuery(content, queryTerms)) {
-                            results.push({
-                                id: entry,
-                                type: 'skill',
-                                path: skillPath.replace(`${projectRoot}/`, ''),
-                                content,
-                            });
-                        }
-                    }
-                    catch {
-                        // Not a skill directory, skip
+            // Try reading as skill directory first, then as markdown file
+            // (avoids TOCTOU race between stat and read)
+            if (!entry.includes('.')) {
+                // Likely a directory, check for SKILL.md
+                const skillPath = join(fullPath, 'SKILL.md');
+                try {
+                    const content = readFileSync(skillPath, 'utf8');
+                    if (matchesQuery(content, queryTerms)) {
+                        results.push({
+                            id: entry,
+                            type: 'skill',
+                            path: skillPath.replace(`${projectRoot}/`, ''),
+                            content,
+                        });
                     }
                 }
-                else if (entry.endsWith('.md')) {
+                catch {
+                    // Not a skill directory or not readable, skip
+                }
+            }
+            if (entry.endsWith('.md')) {
+                try {
                     const content = readFileSync(fullPath, 'utf8');
                     if (matchesQuery(content, queryTerms)) {
                         results.push({
@@ -59,9 +60,9 @@ function searchContent(projectRoot, query, scope) {
                         });
                     }
                 }
-            }
-            catch {
-                // Directory not readable or does not exist — skip silently
+                catch {
+                    // Not readable, skip
+                }
             }
         }
     }

package/dist/tools/coding/safety.d.ts

@@ -3,7 +3,7 @@
  * Path sandboxing and command denylist for secure tool execution
  */
 export interface SafetyConfig {
-    /** Project root directory — all file operations are sandboxed here */
+    /** Project root directory  -  all file operations are sandboxed here */
     projectRoot: string;
     /** Additional directories to allow (e.g., /tmp for scratch files) */
     allowedPaths?: string[];

package/dist/tools/coding/safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAiDD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAE9E;AAMD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAapC;AAQD,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAE1D;AAED,wBAAgB,eAAe,IAAI,YAAY,CAK9C"}
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/safety.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,0DAA0D;IAC1D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAiDD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA0BpC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAE9E;AAMD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,YAAY,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAapC;AAQD,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAE1D;AAED,wBAAgB,eAAe,IAAI,YAAY,CAK9C"}

package/dist/tools/coding/shell-exec.d.ts

@@ -1,5 +1,5 @@
 /**
- * shell_exec — Sandboxed shell command execution
+ * shell_exec  -  Sandboxed shell command execution
  */
 import type { Tool } from '../base.js';
 export declare const shellExecTool: Tool;

package/dist/tools/coding/shell-exec.js

@@ -1,5 +1,5 @@
 /**
- * shell_exec — Sandboxed shell command execution
+ * shell_exec  -  Sandboxed shell command execution
  */
 import { execSync } from 'node:child_process';
 import { z } from 'zod/v4';

package/dist/tools/coding/test-runner.d.ts

@@ -1,5 +1,5 @@
 /**
- * test_runner — Run tests and return structured results
+ * test_runner  -  Run tests and return structured results
  *
  * Detects the test framework (Vitest, Jest, Mocha) and runs tests with
  * machine-parseable output. Returns structured pass/fail/skip counts

package/dist/tools/coding/test-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-runner.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/test-runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AAqJnD,eAAO,MAAM,cAAc,EAAE,IA0G5B,CAAC"}
+{"version":3,"file":"test-runner.d.ts","sourceRoot":"","sources":["../../../src/tools/coding/test-runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,YAAY,CAAC;AA2JnD,eAAO,MAAM,cAAc,EAAE,IA0G5B,CAAC"}

package/dist/tools/coding/test-runner.js

@@ -1,12 +1,12 @@
 /**
- * test_runner — Run tests and return structured results
+ * test_runner  -  Run tests and return structured results
  *
  * Detects the test framework (Vitest, Jest, Mocha) and runs tests with
  * machine-parseable output. Returns structured pass/fail/skip counts
  * and failure details.
  */
 import { execSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod/v4';
 import { getSafetyConfig } from './safety.js';
@@ -19,8 +19,7 @@ function detectFramework(projectRoot) {
     if (!existsSync(pkgPath))
         return 'unknown';
     try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const pkg = JSON.parse(execSync(`cat "${pkgPath}"`, { encoding: 'utf8', timeout: 5000 }));
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
         const deps = {
             ...pkg.dependencies,
             ...pkg.devDependencies,
@@ -37,12 +36,18 @@ function detectFramework(projectRoot) {
     }
     return 'unknown';
 }
+/** Validate that an argument is safe for shell use (no metacharacters) */
+function isSafeShellArg(arg) {
+    return /^[\w./@-]+$/.test(arg);
+}
 function buildCommand(framework, file, grep) {
-    const fileArg = file ? ` ${file}` : '';
-    const grepArg = grep ? ` -t "${grep}"` : '';
+    const safeFile = file && isSafeShellArg(file) ? file : undefined;
+    const fileArg = safeFile ? ` ${safeFile}` : '';
+    const safeGrep = grep && isSafeShellArg(grep) ? grep : undefined;
+    const grepArg = safeGrep ? ` -t "${safeGrep}"` : '';
     switch (framework) {
         case 'vitest':
-            return `npx vitest run${fileArg}${grep ? ` --reporter=verbose` : ''} --no-color`;
+            return `npx vitest run${fileArg}${safeGrep ? ` --reporter=verbose` : ''} --no-color`;
         case 'jest':
             return `npx jest${fileArg}${grepArg} --no-color --forceExit`;
         case 'mocha':

package/dist/tools/deduplicator.js

@@ -22,7 +22,7 @@ function stableStringify(obj) {
 }
 /**
  * Compute a stable cache key for a (toolName, params) pair.
- * Uses a simple djb2-style hash — no crypto dep required.
+ * Uses a simple djb2-style hash  -  no crypto dep required.
  */
 function hashKey(toolName, params) {
     const raw = `${toolName}::${stableStringify(params)}`;

package/dist/tools/document-summarizer.js

@@ -32,7 +32,7 @@ export function createDocumentSummarizerTool(_db, llmClient) {
                 }
                 const fullContent = chunks.map((c) => c.content).join('\n\n');
                 const estimatedTokens = Math.ceil(fullContent.length / CHARS_PER_TOKEN);
-                // Short document — return directly without LLM call
+                // Short document  -  return directly without LLM call
                 if (estimatedTokens <= SHORT_DOCUMENT_TOKENS) {
                     return {
                         success: true,
@@ -45,7 +45,7 @@ export function createDocumentSummarizerTool(_db, llmClient) {
                         metadata: { executionTime: Date.now() - start },
                     };
                 }
-                // Long document — summarize with LLM
+                // Long document  -  summarize with LLM
                 const focusInstruction = focusQuestion
                     ? `Focus especially on answering: "${focusQuestion}"`
                     : '';

package/dist/tools/memory/store-memory.d.ts

@@ -3,7 +3,7 @@
  *
  * Explicit memory storage tool that agents must call to persist information
  * to long-term episodic memory. Agents are never auto-enrolled into memory
- * writes — they must invoke this tool with a clear reason.
+ * writes  -  they must invoke this tool with a clear reason.
  *
  * GDPR rationale: Requiring explicit intent aligns with the data minimisation
  * principle (GDPR Art. 5(1)(c)) and purpose limitation principle (Art. 5(1)(b)).

package/dist/tools/memory/store-memory.js

@@ -3,7 +3,7 @@
  *
  * Explicit memory storage tool that agents must call to persist information
  * to long-term episodic memory. Agents are never auto-enrolled into memory
- * writes — they must invoke this tool with a clear reason.
+ * writes  -  they must invoke this tool with a clear reason.
  *
  * GDPR rationale: Requiring explicit intent aligns with the data minimisation
  * principle (GDPR Art. 5(1)(c)) and purpose limitation principle (Art. 5(1)(b)).
@@ -36,7 +36,7 @@ export function createStoreMemoryTool(memory, agentId) {
         name: 'store_memory',
         description: 'Explicitly store important information in long-term memory for future sessions. ' +
             'Only call this when information is genuinely valuable to retain. ' +
-            'Provide a clear reason — this is required for privacy compliance.',
+            'Provide a clear reason  -  this is required for privacy compliance.',
         parameters: StoreMemoryParamsSchema,
         async execute(params) {
             const { content, tags, reason } = StoreMemoryParamsSchema.parse(params);

package/dist/tools/ticket-tools.d.ts

@@ -1,12 +1,12 @@
 /**
  * Ticket Mutation Tools
  *
- * Tools that allow an agent to update ticket state as it works —
+ * Tools that allow an agent to update ticket state as it works  -
  * closing a ticket when done, moving it between columns, and writing
  * its results back as a comment.
  *
  * These are injected by createTicketTools() and are always paired with
- * CMS tools so agents can act on content AND report back through the ticket.
+ * admin tools so agents can act on content AND report back through the ticket.
  */
 import type { Tool } from './base.js';
 /**

package/dist/tools/ticket-tools.js

@@ -1,12 +1,12 @@
 /**
  * Ticket Mutation Tools
  *
- * Tools that allow an agent to update ticket state as it works —
+ * Tools that allow an agent to update ticket state as it works  -
  * closing a ticket when done, moving it between columns, and writing
  * its results back as a comment.
  *
  * These are injected by createTicketTools() and are always paired with
- * CMS tools so agents can act on content AND report back through the ticket.
+ * admin tools so agents can act on content AND report back through the ticket.
  */
 import { z } from 'zod/v4';
 export function createTicketTools(ticketId, client) {
@@ -41,7 +41,7 @@ export function createTicketTools(ticketId, client) {
     };
     const addCommentTool = {
         name: 'add_ticket_comment',
-        description: 'Write a comment on the current ticket. Use this to report what you did, what changed in the CMS, or why you could not complete the task.',
+        description: 'Write a comment on the current ticket. Use this to report what you did, what changed in the admin, or why you could not complete the task.',
         parameters: z.object({
             text: z.string().min(1).describe('The comment text to add to the ticket'),
         }),