@robota-sdk/agent-core 3.0.0-beta.9 → 3.0.0-beta.90

package/dist/node/node.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./command-executor-wBgBdWXr.cjs"),t=require("./http-executor-CeAAZotH.cjs");let n=require("node:fs"),r=require("node:path"),i=require("node:dns/promises"),a=require("node:net"),o=require("undici/index.js");function s(e){if(typeof e!=`string`)throw TypeError(`executionRoot must be a string`);if(e.trim().length===0)throw TypeError(`executionRoot must be a non-empty string`);if(!(0,r.isAbsolute)(e))throw TypeError(`executionRoot must be an absolute path`);let t;try{t=(0,n.realpathSync)(e)}catch{throw TypeError(`executionRoot must name an existing accessible directory`)}if(!(0,n.statSync)(t).isDirectory())throw TypeError(`executionRoot must name a directory`);try{(0,n.accessSync)(t,n.constants.R_OK|n.constants.X_OK)}catch{throw TypeError(`executionRoot directory must be readable and traversable`)}return t}function c(e){let t=[],i=(0,r.resolve)(e);for(;;)try{return(0,r.join)((0,n.realpathSync)(i),...t)}catch{let n=(0,r.dirname)(i);if(n===i)return(0,r.resolve)(e);t.unshift((0,r.basename)(i)),i=n}}function l(e,t){let n=c(e),i=c(t);return i===n||i.startsWith(n+r.sep)}var u=class extends Error{constructor(e){super(e),this.name=`OwnerOnlyModeError`}};function d(e=process.platform){return e===`win32`?`windows-acl`:`posix-mode`}function f(e,t){let n=(0,r.relative)(e,t);if(n.startsWith(`..`)||(0,r.isAbsolute)(n))throw new u(`withinRoot ${e} is not an ancestor of ${t}, so this call cannot own the path between them.`);let i=n.split(r.sep).filter(e=>e.length>0),a=[e],o=e;for(let e of i)o=(0,r.join)(o,e),a.push(o);return a}function p(e,t,r={}){if(d()!==`posix-mode`)return;let i=(r.readMode??(e=>(0,n.statSync)(e).mode&4095))(e);if(i&63)throw new u(`${t} ${e} is mode 0${i.toString(8)} after being set owner-only; group or other permissions survived, so its contents are readable by another account.`)}function m(e,t={}){let r=t.makeDirectory??((e,t)=>{(0,n.mkdirSync)(e,{recursive:!0,mode:t})}),i=t.setMode??((e,t)=>(0,n.chmodSync)(e,t));r(e,448);let a=t.withinRoot===void 0?[e]:f(t.withinRoot,e);for(let e of a)d()===`posix-mode`&&i(e,448),p(e,`directory`,t)}function h(e,t){m((0,r.dirname)(e));let i=`${e}.${process.pid}.tmp`;(0,n.rmSync)(i,{force:!0}),(0,n.writeFileSync)(i,t,{encoding:`utf8`,mode:384,flag:`wx`});try{p(i,`file`),(0,n.renameSync)(i,e)}catch(e){try{(0,n.unlinkSync)(i)}catch{}throw e}p(e,`file`)}function g(e){if(d()!==`posix-mode`)return;let t;try{t=(0,n.statSync)(e).mode&4095}catch{return}t&63&&((0,n.chmodSync)(e,384),p(e,`file`))}function _(e){let t=(0,a.isIP)(e);return t===4?v(e.split(`.`).map(Number)):t!==6||y(e)}function v(e){let[t=0,n=0,r=0]=e;return t===0||t===10||t===127||t===100&&n>=64&&n<=127||t===169&&n===254||t===172&&n>=16&&n<=31||t===192&&n===0&&r===0||t===192&&n===168||t===198&&(n===18||n===19)||t>=224}function y(e){let t=x(e);if(t===void 0)return!0;let[n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0]=t;return n===0&&r===0&&i===0&&a===0&&o===0&&s===65535||n===100&&r===65435&&i===0&&a===0&&o===0&&s===0?v([c>>8,c&255,l>>8,l&255]):n===0&&r===0&&i===0&&a===0&&o===0&&s===0||(n&65024)==64512||(n&65472)==65152||(n&65472)==65216||(n&65280)==65280}function b(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);if(!n.includes(`.`))return e;if(t<0||(0,a.isIP)(n)!==4)return;let[r=0,i=0,o=0,s=0]=n.split(`.`).map(Number),c=(r<<8|i).toString(16),l=(o<<8|s).toString(16);return`${e.slice(0,t+1)}${c}:${l}`}function x(e){let t=b(e.split(`%`)[0]??e);if(t===void 0)return;let n=t.split(`::`);if(n.length>2)return;let r=e=>e.length===0?[]:e.split(`:`).map(e=>Number.parseInt(e,16)),i=r(n[0]??``),a=n.length===2?r(n[1]??``):[],o=8-i.length-a.length;if(o<0||n.length===1&&o!==0)return;let s=[...i,...Array(o).fill(0),...a];return s.some(e=>Number.isNaN(e)||e<0||e>65535)?void 0:s}const S=3e4,C=5e6,w=new Set([301,302,303,307,308]),T=new Set([`localhost`,`metadata`,`metadata.google.internal`,`metadata.goog`,`instance-data`,`instance-data.ec2.internal`]),E=async e=>(await(0,i.lookup)(e,{all:!0,verbatim:!0})).map(e=>e.address);async function D(e,t={},n=E){let r=e.href;if(e.protocol!==`http:`&&e.protocol!==`https:`)return{reason:`unsupported_scheme`,url:r,message:`Only http(s) URLs may be fetched.`};if(t.allowPrivateAddresses===!0)return;let i=e.hostname.replace(/^\[|\]$/g,``).toLowerCase();if(t.allowedHosts?.includes(i))return;if(T.has(i)||i.endsWith(`.localhost`))return{reason:`metadata_host`,url:r,message:`Destination "${i}" is a loopback or cloud-metadata host and is not reachable from tools.`};let o=(0,a.isIP)(i)?[i]:await O(i,n);if(o===void 0||o.length===0)return{reason:`unresolvable`,url:r,message:`Destination "${i}" did not resolve.`};let s=o.find(_);if(s!==void 0)return{reason:`private_destination`,url:r,message:`Destination "${i}" resolves to ${s}, a private, loopback or link-local address, and is not reachable from tools.`}}async function O(e,t){try{return await t(e)}catch{return}}async function k(e,t,n){n.throwIfAborted();let r;try{return await Promise.race([t(e),new Promise((e,t)=>{r=()=>t(n.reason),n.addEventListener(`abort`,r,{once:!0}),n.aborted&&r()})])}finally{r&&n.removeEventListener(`abort`,r)}}async function A(e,t,n,r,i){let s=e.hostname.replace(/^\[|\]$/g,``).toLowerCase(),c,l=async e=>{let t=await k(e,r.lookup??E,i);if(t.length===0||t.some(e=>(0,a.isIP)(e)===0))throw Error(`Invalid DNS answer`);return c=Object.freeze([...t]),c},u=await D(e,n,l);if(i.throwIfAborted(),u)return u;if(r.fetch){let n=await r.fetch(e.href,{...t,signal:i,redirect:`manual`});return{response:n,close:async()=>{n.body&&!n.body.locked&&await n.body.cancel().catch(()=>void 0)}}}if(c??=(0,a.isIP)(s)?[s]:await O(s,l),i.throwIfAborted(),!c||c.length===0)return{reason:`unresolvable`,url:e.href,message:`Destination did not resolve to valid IP addresses.`};let d=c.map(e=>({address:e,family:(0,a.isIP)(e)})),f=new o.Agent({connections:1,pipelining:0,connect:{lookup:(e,t,n)=>{if(e.toLowerCase()!==s||i.aborted){n(Error(`Connection authority unavailable`),``,4);return}let r=typeof t==`number`?t:t.family,a=d.filter(e=>!r||e.family===r);if(a.length===0){n(Error(`No validated address family`),``,4);return}typeof t==`object`&&t.all?n(null,a):n(null,a[0].address,a[0].family)}}});if(typeof f.dispatch!=`function`||typeof f.destroy!=`function`)throw Error(`Pinned HTTP transport is unavailable in this runtime`);try{return{response:await(0,o.fetch)(e.href,{...t,signal:i,redirect:`manual`,dispatcher:f}),close:async()=>{await f.destroy()}}}catch(e){throw await f.destroy(),e}}async function j(e,t={},n={},r={}){let i=t.maxResponseBytes??C,a=n.maxRedirects??5,o=AbortSignal.timeout(t.timeoutMs??S),s=t.signal?AbortSignal.any([o,t.signal]):o,c=new URL(e),l={...t.headers??{}};for(let e=0;;e+=1){let t=await A(c,{headers:l,signal:s,redirect:`manual`},n,r,s);if(!(`response`in t))return{ok:!1,rejection:t};try{let n=t.response;if(!w.has(n.status))return await P(n,c.href,i,s);let r=n.headers.get(`location`);if(r===null)return{ok:!1,rejection:{reason:`redirect_without_location`,url:c.href,message:`HTTP ${n.status} without a Location header.`}};if(e>=a)return{ok:!1,rejection:{reason:`redirect_limit`,url:c.href,message:`More than ${a} redirects.`}};let o=new URL(r,c);o.origin!==c.origin&&(l=N(l)),c=o}finally{await t.close()}}}async function M(e,t,n={},r={}){let i=t.maxResponseBytes??C,a=AbortSignal.timeout(t.timeoutMs??S),o=t.signal?AbortSignal.any([a,t.signal]):a,s=new URL(e),c=await A(s,{method:`POST`,headers:{...t.headers??{}},body:t.body,signal:o,redirect:`manual`},n,r,o);if(!(`response`in c))return{ok:!1,rejection:c};try{let e=c.response;return e.status>=300&&e.status<400?(await e.body?.cancel().catch(()=>void 0),{ok:!1,rejection:{reason:`redirect_refused`,url:s.href,message:`HTTP ${e.status}: a POST is never redirected.`}}):await P(e,s.href,i,o)}finally{await c.close()}}function N(e){let t={};for(let[n,r]of Object.entries(e))n.toLowerCase()===`user-agent`&&(t[n]=r);return t}async function P(e,t,n,r){let i=e=>({ok:!1,rejection:{reason:`response_too_large`,url:t,message:`Response exceeds ${n} bytes (${e} seen).`}}),a=Number(e.headers.get(`content-length`));if(Number.isFinite(a)&&a>n)return await e.body?.cancel(),i(a);let o=[],s=0;if(!e.body&&typeof e.arrayBuffer==`function`){let t=new Uint8Array(await e.arrayBuffer());if(t.byteLength>n)return i(t.byteLength);o.push(t),s=t.byteLength}else if(e.body){let t=e.body.getReader();for(;;){r.throwIfAborted();let{done:e,value:a}=await t.read();if(e)break;if(s+=a.byteLength,s>n)return await t.cancel(),i(s);o.push(a)}}let c=new Uint8Array(s),l=0;for(let e of o)c.set(e,l),l+=e.byteLength;return{ok:!0,status:e.status,statusText:e.statusText,headers:e.headers,body:c,finalUrl:t}}exports.BLOCKED_HOSTNAMES=T,exports.CommandExecutor=e.t,exports.HttpExecutor=t.t,exports.OWNER_ONLY_DIRECTORY_MODE=448,exports.OWNER_ONLY_FILE_MODE=384,exports.OwnerOnlyModeError=u,exports.canonicalizePath=c,exports.ensureOwnerOnlyDirectory=m,exports.fetchWithEgressPolicy=j,exports.isPathInside=l,exports.isPrivateAddress=_,exports.openEgressExchange=A,exports.ownerOnlyGuarantee=d,exports.postWithEgressPolicy=M,exports.rejectDestination=D,exports.resolveTrustedExecutionRoot=s,exports.tightenExistingFile=g,exports.writeOwnerOnlyFile=h;

package/dist/node/node.d.cts

@@ -0,0 +1,247 @@
+import { c as IHookTypeExecutor, l as IHttpHookDefinition, m as THookOutcome, n as ICommandHookDefinition, s as IHookInput, y as ISubprocessTraceEnv } from "./types-Ge2XB-y-.cjs";
+//#region src/utils/path-containment.d.ts
+/**
+ * Validate an authority root more strictly than candidate-path canonicalization.
+ *
+ * Candidate write paths may have a missing tail, but an authority root must already exist and be a
+ * traversable directory. Keeping the contracts separate prevents a typo in a root from degrading to
+ * a lexical boundary that the caller did not actually select.
+ */
+declare function resolveTrustedExecutionRoot(input: unknown): string;
+/**
+ * Resolve `p` to its canonical form, following symlinks, tolerating a path that does not exist yet.
+ *
+ * `realpathSync` throws on a missing path, but callers legitimately ask about files they are about to
+ * CREATE (a write or an edit). So we walk up to the deepest ancestor that does exist, canonicalize
+ * that, and re-attach the remaining segments — the re-attached tail cannot itself be a symlink,
+ * because it does not exist.
+ */
+declare function canonicalizePath(p: string): string;
+/**
+ * Whether `candidate` is `root` itself or lies beneath it, decided on the CANONICAL form of both.
+ *
+ * Canonicalizing the root as well as the candidate matters: a root that is itself reached through a
+ * symlink (macOS `/tmp` -> `/private/tmp`, or a workspace under a symlinked home) would otherwise
+ * spuriously reject every path inside it.
+ */
+declare function isPathInside(root: string, candidate: string): boolean;
+//#endregion
+//#region src/utils/owner-only-store.d.ts
+/**
+ * SEC-020 (issue #2021) — creating a host directory or file that only its owner can read.
+ *
+ * A host application persists session records, logs, settings and device credentials under a directory
+ * of its own choosing. They carry prompts, model output, tool results and, in the settings case,
+ * provider credentials. On a shared workstation or a CI host, every other local account reads them
+ * unless the mode says otherwise.
+ *
+ * WHERE that directory is belongs to the host, not here — this module knows only what has to be true
+ * of whatever path it is handed, which is what lets it be tested without a filesystem layout.
+ *
+ * ## Why this is one module and not a constant each caller repeats
+ *
+ * `0o600` and `0o700` were already spelled out in five separate files before this existed, and the
+ * repository had already learned — in `guarded-directory.ts`, for a pairing rendezvous — that the
+ * constants are the easy half. The load-bearing part is that **`mkdirSync(path, { mode })` does not
+ * set the mode of a directory that already exists.** `recursive: true` returns successfully and
+ * silently adopts whatever mode is there. A directory left at 0777 by an earlier version, by a
+ * shared CI checkout, or by another local user who pre-created it, becomes ours with no signal.
+ *
+ * Measured under umask 022 before this module existed: a session log directory pre-created at 0777
+ * stayed 0777 through `mkdirSync(dir, { recursive: true, mode: 0o700 })`, and its 0600 records were
+ * then removable and replaceable by any local account.
+ *
+ * The same holds for files. `writeFileSync(path, data, { mode })` applies the mode only when the
+ * file is CREATED; an existing 0644 record keeps 0644 forever, so a store written by an older
+ * version is never repaired by a newer one.
+ *
+ * So: create, then set the mode unconditionally, then VERIFY — and verification is what makes the
+ * first two checkable rather than hopeful. It is also the only step that catches an owner we did not
+ * expect, which `mkdir` and `chmod` between them cannot.
+ *
+ * ## Windows
+ *
+ * `chmodSync` on win32 toggles the read-only attribute and cannot express "owner only"; NTFS ACL
+ * inheritance governs instead, and a user's profile directory is not readable by other unprivileged
+ * accounts by default. The POSIX assertion is therefore not made there, and `ownerOnlyGuarantee()` reports which
+ * guarantee is in force so a caller — and a test — can state the platform's actual claim rather than
+ * assume the POSIX one everywhere. A store directory placed inside a world-writable parent on
+ * Windows is NOT protected by this module, and that is recorded rather than papered over.
+ */
+/** Owner read/write. Nothing for group, nothing for other. */
+declare const OWNER_ONLY_FILE_MODE = 384;
+/** Owner read/write/traverse. The traverse bit is what keeps another account out of the directory. */
+declare const OWNER_ONLY_DIRECTORY_MODE = 448;
+/** Raised when a path cannot be made owner-only. Never swallowed into a weaker mode. */
+declare class OwnerOnlyModeError extends Error {
+  constructor(message: string);
+}
+/**
+ * Which guarantee this platform can actually make.
+ *
+ * `posix-mode` — the mode bits are asserted after every create and every write.
+ * `windows-acl` — inherited NTFS ACLs govern; the POSIX assertion is not made and not claimed.
+ */
+declare function ownerOnlyGuarantee(platform?: string): 'posix-mode' | 'windows-acl';
+/**
+ * Seams for the failure paths, injected for the reason `guarded-directory.ts` states: a filesystem
+ * that silently ignores `chmod` is a real condition — some network and FAT mounts do exactly that —
+ * and it is the ONLY condition the verification step catches that create-then-chmod does not. Without
+ * a seam that case is unreachable from a test, and a guard no test can reach is a guard nobody knows
+ * is there. Measured: with these absent, deleting the verification entirely changed no test result.
+ */
+interface IOwnerOnlyIo {
+  readonly makeDirectory?: (target: string, mode: number) => void;
+  readonly setMode?: (target: string, mode: number) => void;
+  readonly readMode?: (target: string) => number;
+}
+interface IEnsureOwnerOnlyOptions extends IOwnerOnlyIo {
+  /**
+   * An ANCESTOR of `directory` that the caller also owns, tightened along with every segment between
+   * them.
+   *
+   * Needed because `mkdirSync(path, { recursive: true, mode })` applies the mode only to the
+   * directories it CREATES. A store root an older version already made sits at whatever mode it was
+   * given and this call would leave it there — which is the module's own headline defect surviving
+   * one level up, on the very path it exists to protect. Found in review of PR #2224.
+   *
+   * It is a parameter rather than a walk up to some inferred boundary because WHICH ancestors belong
+   * to the caller is the caller's knowledge. This module must not guess that a parent is ours; it
+   * would eventually chmod someone's home directory.
+   */
+  readonly withinRoot?: string;
+}
+/**
+ * Ensure `directory` exists and only its owner can enter it.
+ *
+ * The `chmod` is unconditional because `mkdir` does not touch an existing directory's mode, and the
+ * `stat` afterwards is what turns two hopeful calls into a checked one.
+ */
+declare function ensureOwnerOnlyDirectory(directory: string, options?: IEnsureOwnerOnlyOptions): void;
+/**
+ * Replace `filePath` atomically with content only its owner can read.
+ *
+ * The temp file carries the mode from the moment it is created — writing it at the umask's default
+ * and tightening afterwards leaves a window in which the full content is world-readable on disk, and
+ * `rename` preserves whatever mode the temp file had. The `chmod` after the write is for the case
+ * where the temp path already existed at a wider mode.
+ */
+declare function writeOwnerOnlyFile(filePath: string, content: string): void;
+/**
+ * Tighten a file that already exists — the repair path for a record an older version left at 0644.
+ *
+ * A no-op on a path that does not exist, because "there is nothing to tighten" and "we tightened it"
+ * are the same outcome for the caller, and throwing would make every writer branch on existence.
+ */
+declare function tightenExistingFile(filePath: string): void;
+//#endregion
+//#region src/hooks/executors/command-executor.d.ts
+declare class CommandExecutor implements IHookTypeExecutor {
+  private readonly shellExecutable?;
+  readonly type: "command";
+  constructor(shellExecutable?: string | undefined);
+  /**
+   * `traceEnv` is the prompt's trace for this child, handed separately so it never reaches the
+   * stdin JSON. The child sees `process.env`, then ConversationAgent's value, then the hook's own `env`; a hook
+   * that sets its own `TRACEPARENT` wins and gets the ambient environment unchanged.
+   */
+  execute(definition: ICommandHookDefinition, input: IHookInput, traceEnv?: ISubprocessTraceEnv): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/hooks/executors/http-executor.d.ts
+declare class HttpExecutor implements IHookTypeExecutor {
+  readonly type: "http";
+  execute(definition: IHttpHookDefinition, input: IHookInput): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/utils/ip-address.d.ts
+/**
+ * Address classification for the egress boundary (#2026) — the "is this address public unicast?"
+ * half of `egress-policy.ts`, split out so each module holds one job: that one owns the FETCH
+ * (scheme, redirects, headers, deadline, byte cap), this one owns the ARITHMETIC of an address.
+ *
+ * The awkward part lives here on purpose. A literal destination reaches the policy already
+ * normalized by `URL` (`2130706433`, `0x7f.1` and `[::ffff:7f00:1]` all collapse to one hostname),
+ * but a RESOLVED one does not: `dns.lookup` renders an IPv4-mapped AAAA answer through `inet_ntop`,
+ * which prints the dotted spelling `::ffff:127.0.0.1`. So the expansion below accepts BOTH
+ * spellings rather than trusting any normalizer to have run — on the resolution path an attacker
+ * controls the record. Every "cannot parse" answer is `undefined`/`true`, i.e. NOT public: an
+ * address this module cannot read is never treated as reachable.
+ *
+ * Node-only (`node:net`): reached through `egress-policy.ts`, never the browser barrel.
+ */
+/** True when `ip` (v4 or v6 text) is not a public unicast address. */
+declare function isPrivateAddress(ip: string): boolean;
+//#endregion
+//#region src/utils/egress-policy.d.ts
+type TEgressLookup = (hostname: string) => Promise<readonly string[]>;
+interface IEgressPolicy {
+  /** Exact lowercase hostnames that may be reached even when they resolve to a private address. */
+  readonly allowedHosts?: readonly string[];
+  /** Explicit enterprise opt-out from private/loopback/metadata blocking. Default `false`. */
+  readonly allowPrivateAddresses?: boolean;
+  /** Redirect hops followed before refusing. Default 5. */
+  readonly maxRedirects?: number;
+}
+interface IEgressFetchOptions {
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly signal?: AbortSignal;
+  /** Deadline for the WHOLE exchange, redirects and body included. Default 30 000 ms. */
+  readonly timeoutMs?: number;
+  /** Byte cap enforced on `Content-Length` and again while streaming. Default 5 000 000. */
+  readonly maxResponseBytes?: number;
+}
+interface IEgressDeps {
+  /** Trusted owner/test carrier: this override owns connect-time policy and socket lifetime. */
+  readonly fetch?: typeof globalThis.fetch;
+  readonly lookup?: TEgressLookup;
+}
+type TEgressRejectionReason = 'unsupported_scheme' | 'private_destination' | 'metadata_host' | 'unresolvable' | 'redirect_limit' | 'redirect_without_location' | 'redirect_refused' | 'response_too_large';
+interface IEgressRejection {
+  readonly reason: TEgressRejectionReason;
+  readonly url: string;
+  readonly message: string;
+}
+type TEgressFetchResult = {
+  ok: true;
+  status: number;
+  statusText: string;
+  headers: Headers;
+  body: Uint8Array;
+  finalUrl: string;
+} | {
+  ok: false;
+  rejection: IEgressRejection;
+};
+/** Hostnames that are metadata services or loopback by convention, whatever they resolve to. */
+declare const BLOCKED_HOSTNAMES: ReadonlySet<string>;
+/** Validate ONE destination URL against the policy. `undefined` means it may be reached. */
+declare function rejectDestination(url: URL, policy?: IEgressPolicy, lookup?: TEgressLookup): Promise<IEgressRejection | undefined>;
+interface IEgressExchange {
+  readonly response: Response;
+  close(): Promise<void>;
+}
+/**
+ * Open one manually redirected exchange without buffering its response. A streaming owner supplies
+ * the lifetime/deadline signal and must close the exchange on completion, cancellation and failure.
+ * No ambient dispatcher, second DNS resolution, URL rewrite or transport downgrade is selected.
+ */
+declare function openEgressExchange(url: URL, init: RequestInit, policy: IEgressPolicy, deps: IEgressDeps, signal: AbortSignal): Promise<IEgressExchange | IEgressRejection>;
+/**
+ * Fetch `url` under the egress policy. Policy outcomes are RETURNED (`ok: false`); transport errors
+ * (DNS failure at connect, refused connection, TLS, abort) are THROWN, as `fetch` throws them, so the
+ * caller's own error classification keeps working.
+ */
+declare function fetchWithEgressPolicy(url: string, options?: IEgressFetchOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+interface IEgressPostOptions extends IEgressFetchOptions {
+  /** Sent as-is; a `URLSearchParams` or JSON string, never a stream, so it is never re-sent. */
+  readonly body: string | URLSearchParams;
+}
+/**
+ * POST `url` under the egress policy. The destination is validated as for a GET, but a redirect is
+ * REFUSED (`redirect_refused`), never followed: the body is the caller's to send to this URL alone.
+ */
+declare function postWithEgressPolicy(url: string, options: IEgressPostOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+//#endregion
+export { BLOCKED_HOSTNAMES, CommandExecutor, HttpExecutor, type IEgressDeps, type IEgressExchange, type IEgressFetchOptions, type IEgressPolicy, type IEgressPostOptions, type IEgressRejection, type IOwnerOnlyIo, OWNER_ONLY_DIRECTORY_MODE, OWNER_ONLY_FILE_MODE, OwnerOnlyModeError, type TEgressFetchResult, type TEgressLookup, type TEgressRejectionReason, canonicalizePath, ensureOwnerOnlyDirectory, fetchWithEgressPolicy, isPathInside, isPrivateAddress, openEgressExchange, ownerOnlyGuarantee, postWithEgressPolicy, rejectDestination, resolveTrustedExecutionRoot, tightenExistingFile, writeOwnerOnlyFile };
+//# sourceMappingURL=node.d.cts.map

package/dist/node/node.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.cts","names":[],"sources":["../../src/utils/path-containment.ts","../../src/utils/owner-only-store.ts","../../src/hooks/executors/command-executor.ts","../../src/hooks/executors/http-executor.ts","../../src/utils/ip-address.ts","../../src/utils/egress-policy.ts"],"mappings":";;;;;;;;;iBA2BgB,4BAA4B;;;;;;;;;iBAoC5B,iBAAiB;;;;;;;;iBAwBjB,aAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCjC9B;;cAEA;;cAMA,2BAA2B;EAC1B,YAAA;;;;;;;;iBAYE,mBACd;;;;;;;;UAYe;WACN,iBAAiB,gBAAgB;WACjC,WAAW,gBAAgB;WAC3B,YAAY;;UAGN,gCAAgC;;;;;;;;;;;;;;WActC;;;;;;;;iBAsCK,yBACd,mBACA,UAAS;;;;;;;;;iBA8BK,mBAAmB,kBAAkB;;;;;;;iBA2CrC,oBAAoB;;;cCnIvB,2BAA2B;mBAGT;WAFpB;EAEoB,YAAA;;;;;;EAO7B,QACE,YAAY,wBACZ,OAAO,YACP,WAAW,sBACV,QAAQ;;;;cC1EA,wBAAwB;WAC1B;EAEH,QAAQ,YAAY,qBAAqB,OAAO,aAAa,QAAQ;;;;;;;;;;;;;;;;;;;;iBCP7D,iBAAiB;;;KCWrB,iBAAiB,qBAAqB;UAEjC;;WAEN;;WAEA;;WAEA;;UAGM;WACN,UAAU,SAAS;WACnB,SAAS;;WAET;;WAEA;;UAGM;;WAEN,eAAe,WAAW;WAC1B,SAAS;;KAGR;UAUK;WACN,QAAQ;WACR;WACA;;KAGC;EAEN;EACA;EACA;EACA,SAAS;EACT,MAAM;EACN;;EAEA;EAAW,WAAW;;;cAWf,mBAAmB;;iBAaV,kBACpB,KAAK,KACL,SAAQ,eACR,SAAQ,gBACP,QAAQ;UAmDM;WACN,UAAU;EACnB,SAAS;;;;;;;iBA8BW,mBACpB,KAAK,KACL,MAAM,aACN,QAAQ,eACR,MAAM,aACN,QAAQ,cACP,QAAQ,kBAAkB;;;;;;iBA6EP,sBACpB,aACA,UAAS,qBACT,SAAQ,eACR,OAAM,cACL,QAAQ;UAqDM,2BAA2B;;WAEjC,eAAe;;;;;;iBAOJ,qBACpB,aACA,SAAS,oBACT,SAAQ,eACR,OAAM,cACL,QAAQ"}

package/dist/node/node.d.ts

@@ -0,0 +1,247 @@
+import { c as IHookTypeExecutor, l as IHttpHookDefinition, m as THookOutcome, n as ICommandHookDefinition, s as IHookInput, y as ISubprocessTraceEnv } from "./types-Ge2XB-y-.js";
+//#region src/utils/path-containment.d.ts
+/**
+ * Validate an authority root more strictly than candidate-path canonicalization.
+ *
+ * Candidate write paths may have a missing tail, but an authority root must already exist and be a
+ * traversable directory. Keeping the contracts separate prevents a typo in a root from degrading to
+ * a lexical boundary that the caller did not actually select.
+ */
+declare function resolveTrustedExecutionRoot(input: unknown): string;
+/**
+ * Resolve `p` to its canonical form, following symlinks, tolerating a path that does not exist yet.
+ *
+ * `realpathSync` throws on a missing path, but callers legitimately ask about files they are about to
+ * CREATE (a write or an edit). So we walk up to the deepest ancestor that does exist, canonicalize
+ * that, and re-attach the remaining segments — the re-attached tail cannot itself be a symlink,
+ * because it does not exist.
+ */
+declare function canonicalizePath(p: string): string;
+/**
+ * Whether `candidate` is `root` itself or lies beneath it, decided on the CANONICAL form of both.
+ *
+ * Canonicalizing the root as well as the candidate matters: a root that is itself reached through a
+ * symlink (macOS `/tmp` -> `/private/tmp`, or a workspace under a symlinked home) would otherwise
+ * spuriously reject every path inside it.
+ */
+declare function isPathInside(root: string, candidate: string): boolean;
+//#endregion
+//#region src/utils/owner-only-store.d.ts
+/**
+ * SEC-020 (issue #2021) — creating a host directory or file that only its owner can read.
+ *
+ * A host application persists session records, logs, settings and device credentials under a directory
+ * of its own choosing. They carry prompts, model output, tool results and, in the settings case,
+ * provider credentials. On a shared workstation or a CI host, every other local account reads them
+ * unless the mode says otherwise.
+ *
+ * WHERE that directory is belongs to the host, not here — this module knows only what has to be true
+ * of whatever path it is handed, which is what lets it be tested without a filesystem layout.
+ *
+ * ## Why this is one module and not a constant each caller repeats
+ *
+ * `0o600` and `0o700` were already spelled out in five separate files before this existed, and the
+ * repository had already learned — in `guarded-directory.ts`, for a pairing rendezvous — that the
+ * constants are the easy half. The load-bearing part is that **`mkdirSync(path, { mode })` does not
+ * set the mode of a directory that already exists.** `recursive: true` returns successfully and
+ * silently adopts whatever mode is there. A directory left at 0777 by an earlier version, by a
+ * shared CI checkout, or by another local user who pre-created it, becomes ours with no signal.
+ *
+ * Measured under umask 022 before this module existed: a session log directory pre-created at 0777
+ * stayed 0777 through `mkdirSync(dir, { recursive: true, mode: 0o700 })`, and its 0600 records were
+ * then removable and replaceable by any local account.
+ *
+ * The same holds for files. `writeFileSync(path, data, { mode })` applies the mode only when the
+ * file is CREATED; an existing 0644 record keeps 0644 forever, so a store written by an older
+ * version is never repaired by a newer one.
+ *
+ * So: create, then set the mode unconditionally, then VERIFY — and verification is what makes the
+ * first two checkable rather than hopeful. It is also the only step that catches an owner we did not
+ * expect, which `mkdir` and `chmod` between them cannot.
+ *
+ * ## Windows
+ *
+ * `chmodSync` on win32 toggles the read-only attribute and cannot express "owner only"; NTFS ACL
+ * inheritance governs instead, and a user's profile directory is not readable by other unprivileged
+ * accounts by default. The POSIX assertion is therefore not made there, and `ownerOnlyGuarantee()` reports which
+ * guarantee is in force so a caller — and a test — can state the platform's actual claim rather than
+ * assume the POSIX one everywhere. A store directory placed inside a world-writable parent on
+ * Windows is NOT protected by this module, and that is recorded rather than papered over.
+ */
+/** Owner read/write. Nothing for group, nothing for other. */
+declare const OWNER_ONLY_FILE_MODE = 384;
+/** Owner read/write/traverse. The traverse bit is what keeps another account out of the directory. */
+declare const OWNER_ONLY_DIRECTORY_MODE = 448;
+/** Raised when a path cannot be made owner-only. Never swallowed into a weaker mode. */
+declare class OwnerOnlyModeError extends Error {
+  constructor(message: string);
+}
+/**
+ * Which guarantee this platform can actually make.
+ *
+ * `posix-mode` — the mode bits are asserted after every create and every write.
+ * `windows-acl` — inherited NTFS ACLs govern; the POSIX assertion is not made and not claimed.
+ */
+declare function ownerOnlyGuarantee(platform?: string): 'posix-mode' | 'windows-acl';
+/**
+ * Seams for the failure paths, injected for the reason `guarded-directory.ts` states: a filesystem
+ * that silently ignores `chmod` is a real condition — some network and FAT mounts do exactly that —
+ * and it is the ONLY condition the verification step catches that create-then-chmod does not. Without
+ * a seam that case is unreachable from a test, and a guard no test can reach is a guard nobody knows
+ * is there. Measured: with these absent, deleting the verification entirely changed no test result.
+ */
+interface IOwnerOnlyIo {
+  readonly makeDirectory?: (target: string, mode: number) => void;
+  readonly setMode?: (target: string, mode: number) => void;
+  readonly readMode?: (target: string) => number;
+}
+interface IEnsureOwnerOnlyOptions extends IOwnerOnlyIo {
+  /**
+   * An ANCESTOR of `directory` that the caller also owns, tightened along with every segment between
+   * them.
+   *
+   * Needed because `mkdirSync(path, { recursive: true, mode })` applies the mode only to the
+   * directories it CREATES. A store root an older version already made sits at whatever mode it was
+   * given and this call would leave it there — which is the module's own headline defect surviving
+   * one level up, on the very path it exists to protect. Found in review of PR #2224.
+   *
+   * It is a parameter rather than a walk up to some inferred boundary because WHICH ancestors belong
+   * to the caller is the caller's knowledge. This module must not guess that a parent is ours; it
+   * would eventually chmod someone's home directory.
+   */
+  readonly withinRoot?: string;
+}
+/**
+ * Ensure `directory` exists and only its owner can enter it.
+ *
+ * The `chmod` is unconditional because `mkdir` does not touch an existing directory's mode, and the
+ * `stat` afterwards is what turns two hopeful calls into a checked one.
+ */
+declare function ensureOwnerOnlyDirectory(directory: string, options?: IEnsureOwnerOnlyOptions): void;
+/**
+ * Replace `filePath` atomically with content only its owner can read.
+ *
+ * The temp file carries the mode from the moment it is created — writing it at the umask's default
+ * and tightening afterwards leaves a window in which the full content is world-readable on disk, and
+ * `rename` preserves whatever mode the temp file had. The `chmod` after the write is for the case
+ * where the temp path already existed at a wider mode.
+ */
+declare function writeOwnerOnlyFile(filePath: string, content: string): void;
+/**
+ * Tighten a file that already exists — the repair path for a record an older version left at 0644.
+ *
+ * A no-op on a path that does not exist, because "there is nothing to tighten" and "we tightened it"
+ * are the same outcome for the caller, and throwing would make every writer branch on existence.
+ */
+declare function tightenExistingFile(filePath: string): void;
+//#endregion
+//#region src/hooks/executors/command-executor.d.ts
+declare class CommandExecutor implements IHookTypeExecutor {
+  private readonly shellExecutable?;
+  readonly type: "command";
+  constructor(shellExecutable?: string | undefined);
+  /**
+   * `traceEnv` is the prompt's trace for this child, handed separately so it never reaches the
+   * stdin JSON. The child sees `process.env`, then ConversationAgent's value, then the hook's own `env`; a hook
+   * that sets its own `TRACEPARENT` wins and gets the ambient environment unchanged.
+   */
+  execute(definition: ICommandHookDefinition, input: IHookInput, traceEnv?: ISubprocessTraceEnv): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/hooks/executors/http-executor.d.ts
+declare class HttpExecutor implements IHookTypeExecutor {
+  readonly type: "http";
+  execute(definition: IHttpHookDefinition, input: IHookInput): Promise<THookOutcome>;
+}
+//#endregion
+//#region src/utils/ip-address.d.ts
+/**
+ * Address classification for the egress boundary (#2026) — the "is this address public unicast?"
+ * half of `egress-policy.ts`, split out so each module holds one job: that one owns the FETCH
+ * (scheme, redirects, headers, deadline, byte cap), this one owns the ARITHMETIC of an address.
+ *
+ * The awkward part lives here on purpose. A literal destination reaches the policy already
+ * normalized by `URL` (`2130706433`, `0x7f.1` and `[::ffff:7f00:1]` all collapse to one hostname),
+ * but a RESOLVED one does not: `dns.lookup` renders an IPv4-mapped AAAA answer through `inet_ntop`,
+ * which prints the dotted spelling `::ffff:127.0.0.1`. So the expansion below accepts BOTH
+ * spellings rather than trusting any normalizer to have run — on the resolution path an attacker
+ * controls the record. Every "cannot parse" answer is `undefined`/`true`, i.e. NOT public: an
+ * address this module cannot read is never treated as reachable.
+ *
+ * Node-only (`node:net`): reached through `egress-policy.ts`, never the browser barrel.
+ */
+/** True when `ip` (v4 or v6 text) is not a public unicast address. */
+declare function isPrivateAddress(ip: string): boolean;
+//#endregion
+//#region src/utils/egress-policy.d.ts
+type TEgressLookup = (hostname: string) => Promise<readonly string[]>;
+interface IEgressPolicy {
+  /** Exact lowercase hostnames that may be reached even when they resolve to a private address. */
+  readonly allowedHosts?: readonly string[];
+  /** Explicit enterprise opt-out from private/loopback/metadata blocking. Default `false`. */
+  readonly allowPrivateAddresses?: boolean;
+  /** Redirect hops followed before refusing. Default 5. */
+  readonly maxRedirects?: number;
+}
+interface IEgressFetchOptions {
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly signal?: AbortSignal;
+  /** Deadline for the WHOLE exchange, redirects and body included. Default 30 000 ms. */
+  readonly timeoutMs?: number;
+  /** Byte cap enforced on `Content-Length` and again while streaming. Default 5 000 000. */
+  readonly maxResponseBytes?: number;
+}
+interface IEgressDeps {
+  /** Trusted owner/test carrier: this override owns connect-time policy and socket lifetime. */
+  readonly fetch?: typeof globalThis.fetch;
+  readonly lookup?: TEgressLookup;
+}
+type TEgressRejectionReason = 'unsupported_scheme' | 'private_destination' | 'metadata_host' | 'unresolvable' | 'redirect_limit' | 'redirect_without_location' | 'redirect_refused' | 'response_too_large';
+interface IEgressRejection {
+  readonly reason: TEgressRejectionReason;
+  readonly url: string;
+  readonly message: string;
+}
+type TEgressFetchResult = {
+  ok: true;
+  status: number;
+  statusText: string;
+  headers: Headers;
+  body: Uint8Array;
+  finalUrl: string;
+} | {
+  ok: false;
+  rejection: IEgressRejection;
+};
+/** Hostnames that are metadata services or loopback by convention, whatever they resolve to. */
+declare const BLOCKED_HOSTNAMES: ReadonlySet<string>;
+/** Validate ONE destination URL against the policy. `undefined` means it may be reached. */
+declare function rejectDestination(url: URL, policy?: IEgressPolicy, lookup?: TEgressLookup): Promise<IEgressRejection | undefined>;
+interface IEgressExchange {
+  readonly response: Response;
+  close(): Promise<void>;
+}
+/**
+ * Open one manually redirected exchange without buffering its response. A streaming owner supplies
+ * the lifetime/deadline signal and must close the exchange on completion, cancellation and failure.
+ * No ambient dispatcher, second DNS resolution, URL rewrite or transport downgrade is selected.
+ */
+declare function openEgressExchange(url: URL, init: RequestInit, policy: IEgressPolicy, deps: IEgressDeps, signal: AbortSignal): Promise<IEgressExchange | IEgressRejection>;
+/**
+ * Fetch `url` under the egress policy. Policy outcomes are RETURNED (`ok: false`); transport errors
+ * (DNS failure at connect, refused connection, TLS, abort) are THROWN, as `fetch` throws them, so the
+ * caller's own error classification keeps working.
+ */
+declare function fetchWithEgressPolicy(url: string, options?: IEgressFetchOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+interface IEgressPostOptions extends IEgressFetchOptions {
+  /** Sent as-is; a `URLSearchParams` or JSON string, never a stream, so it is never re-sent. */
+  readonly body: string | URLSearchParams;
+}
+/**
+ * POST `url` under the egress policy. The destination is validated as for a GET, but a redirect is
+ * REFUSED (`redirect_refused`), never followed: the body is the caller's to send to this URL alone.
+ */
+declare function postWithEgressPolicy(url: string, options: IEgressPostOptions, policy?: IEgressPolicy, deps?: IEgressDeps): Promise<TEgressFetchResult>;
+//#endregion
+export { BLOCKED_HOSTNAMES, CommandExecutor, HttpExecutor, type IEgressDeps, type IEgressExchange, type IEgressFetchOptions, type IEgressPolicy, type IEgressPostOptions, type IEgressRejection, type IOwnerOnlyIo, OWNER_ONLY_DIRECTORY_MODE, OWNER_ONLY_FILE_MODE, OwnerOnlyModeError, type TEgressFetchResult, type TEgressLookup, type TEgressRejectionReason, canonicalizePath, ensureOwnerOnlyDirectory, fetchWithEgressPolicy, isPathInside, isPrivateAddress, openEgressExchange, ownerOnlyGuarantee, postWithEgressPolicy, rejectDestination, resolveTrustedExecutionRoot, tightenExistingFile, writeOwnerOnlyFile };
+//# sourceMappingURL=node.d.ts.map

package/dist/node/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","names":[],"sources":["../../src/utils/path-containment.ts","../../src/utils/owner-only-store.ts","../../src/hooks/executors/command-executor.ts","../../src/hooks/executors/http-executor.ts","../../src/utils/ip-address.ts","../../src/utils/egress-policy.ts"],"mappings":";;;;;;;;;iBA2BgB,4BAA4B;;;;;;;;;iBAoC5B,iBAAiB;;;;;;;;iBAwBjB,aAAa,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCjC9B;;cAEA;;cAMA,2BAA2B;EAC1B,YAAA;;;;;;;;iBAYE,mBACd;;;;;;;;UAYe;WACN,iBAAiB,gBAAgB;WACjC,WAAW,gBAAgB;WAC3B,YAAY;;UAGN,gCAAgC;;;;;;;;;;;;;;WActC;;;;;;;;iBAsCK,yBACd,mBACA,UAAS;;;;;;;;;iBA8BK,mBAAmB,kBAAkB;;;;;;;iBA2CrC,oBAAoB;;;cCnIvB,2BAA2B;mBAGT;WAFpB;EAEoB,YAAA;;;;;;EAO7B,QACE,YAAY,wBACZ,OAAO,YACP,WAAW,sBACV,QAAQ;;;;cC1EA,wBAAwB;WAC1B;EAEH,QAAQ,YAAY,qBAAqB,OAAO,aAAa,QAAQ;;;;;;;;;;;;;;;;;;;;iBCP7D,iBAAiB;;;KCWrB,iBAAiB,qBAAqB;UAEjC;;WAEN;;WAEA;;WAEA;;UAGM;WACN,UAAU,SAAS;WACnB,SAAS;;WAET;;WAEA;;UAGM;;WAEN,eAAe,WAAW;WAC1B,SAAS;;KAGR;UAUK;WACN,QAAQ;WACR;WACA;;KAGC;EAEN;EACA;EACA;EACA,SAAS;EACT,MAAM;EACN;;EAEA;EAAW,WAAW;;;cAWf,mBAAmB;;iBAaV,kBACpB,KAAK,KACL,SAAQ,eACR,SAAQ,gBACP,QAAQ;UAmDM;WACN,UAAU;EACnB,SAAS;;;;;;;iBA8BW,mBACpB,KAAK,KACL,MAAM,aACN,QAAQ,eACR,MAAM,aACN,QAAQ,cACP,QAAQ,kBAAkB;;;;;;iBA6EP,sBACpB,aACA,UAAS,qBACT,SAAQ,eACR,OAAM,cACL,QAAQ;UAqDM,2BAA2B;;WAEjC,eAAe;;;;;;iBAOJ,qBACpB,aACA,SAAS,oBACT,SAAQ,eACR,OAAM,cACL,QAAQ"}

package/dist/node/node.js

@@ -0,0 +1,2 @@
+import{t as e}from"./command-executor-D_UBZHxh.js";import{t}from"./http-executor-ADn4locH.js";import{accessSync as n,chmodSync as r,constants as i,mkdirSync as a,realpathSync as o,renameSync as s,rmSync as c,statSync as l,unlinkSync as u,writeFileSync as d}from"node:fs";import{basename as f,dirname as p,isAbsolute as m,join as h,relative as g,resolve as _,sep as v}from"node:path";import{lookup as y}from"node:dns/promises";import{isIP as b}from"node:net";import{Agent as x,fetch as S}from"undici/index.js";function C(e){if(typeof e!=`string`)throw TypeError(`executionRoot must be a string`);if(e.trim().length===0)throw TypeError(`executionRoot must be a non-empty string`);if(!m(e))throw TypeError(`executionRoot must be an absolute path`);let t;try{t=o(e)}catch{throw TypeError(`executionRoot must name an existing accessible directory`)}if(!l(t).isDirectory())throw TypeError(`executionRoot must name a directory`);try{n(t,i.R_OK|i.X_OK)}catch{throw TypeError(`executionRoot directory must be readable and traversable`)}return t}function w(e){let t=[],n=_(e);for(;;)try{return h(o(n),...t)}catch{let r=p(n);if(r===n)return _(e);t.unshift(f(n)),n=r}}function T(e,t){let n=w(e),r=w(t);return r===n||r.startsWith(n+v)}const E=384,D=448;var O=class extends Error{constructor(e){super(e),this.name=`OwnerOnlyModeError`}};function k(e=process.platform){return e===`win32`?`windows-acl`:`posix-mode`}function A(e,t){let n=g(e,t);if(n.startsWith(`..`)||m(n))throw new O(`withinRoot ${e} is not an ancestor of ${t}, so this call cannot own the path between them.`);let r=n.split(v).filter(e=>e.length>0),i=[e],a=e;for(let e of r)a=h(a,e),i.push(a);return i}function j(e,t,n={}){if(k()!==`posix-mode`)return;let r=(n.readMode??(e=>l(e).mode&4095))(e);if(r&63)throw new O(`${t} ${e} is mode 0${r.toString(8)} after being set owner-only; group or other permissions survived, so its contents are readable by another account.`)}function M(e,t={}){let n=t.makeDirectory??((e,t)=>{a(e,{recursive:!0,mode:t})}),i=t.setMode??((e,t)=>r(e,t));n(e,448);let o=t.withinRoot===void 0?[e]:A(t.withinRoot,e);for(let e of o)k()===`posix-mode`&&i(e,448),j(e,`directory`,t)}function N(e,t){M(p(e));let n=`${e}.${process.pid}.tmp`;c(n,{force:!0}),d(n,t,{encoding:`utf8`,mode:384,flag:`wx`});try{j(n,`file`),s(n,e)}catch(e){try{u(n)}catch{}throw e}j(e,`file`)}function P(e){if(k()!==`posix-mode`)return;let t;try{t=l(e).mode&4095}catch{return}t&63&&(r(e,384),j(e,`file`))}function F(e){let t=b(e);return t===4?I(e.split(`.`).map(Number)):t!==6||L(e)}function I(e){let[t=0,n=0,r=0]=e;return t===0||t===10||t===127||t===100&&n>=64&&n<=127||t===169&&n===254||t===172&&n>=16&&n<=31||t===192&&n===0&&r===0||t===192&&n===168||t===198&&(n===18||n===19)||t>=224}function L(e){let t=z(e);if(t===void 0)return!0;let[n=0,r=0,i=0,a=0,o=0,s=0,c=0,l=0]=t;return n===0&&r===0&&i===0&&a===0&&o===0&&s===65535||n===100&&r===65435&&i===0&&a===0&&o===0&&s===0?I([c>>8,c&255,l>>8,l&255]):n===0&&r===0&&i===0&&a===0&&o===0&&s===0||(n&65024)==64512||(n&65472)==65152||(n&65472)==65216||(n&65280)==65280}function R(e){let t=e.lastIndexOf(`:`),n=e.slice(t+1);if(!n.includes(`.`))return e;if(t<0||b(n)!==4)return;let[r=0,i=0,a=0,o=0]=n.split(`.`).map(Number),s=(r<<8|i).toString(16),c=(a<<8|o).toString(16);return`${e.slice(0,t+1)}${s}:${c}`}function z(e){let t=R(e.split(`%`)[0]??e);if(t===void 0)return;let n=t.split(`::`);if(n.length>2)return;let r=e=>e.length===0?[]:e.split(`:`).map(e=>Number.parseInt(e,16)),i=r(n[0]??``),a=n.length===2?r(n[1]??``):[],o=8-i.length-a.length;if(o<0||n.length===1&&o!==0)return;let s=[...i,...Array(o).fill(0),...a];return s.some(e=>Number.isNaN(e)||e<0||e>65535)?void 0:s}const B=3e4,V=5e6,H=new Set([301,302,303,307,308]),U=new Set([`localhost`,`metadata`,`metadata.google.internal`,`metadata.goog`,`instance-data`,`instance-data.ec2.internal`]),W=async e=>(await y(e,{all:!0,verbatim:!0})).map(e=>e.address);async function G(e,t={},n=W){let r=e.href;if(e.protocol!==`http:`&&e.protocol!==`https:`)return{reason:`unsupported_scheme`,url:r,message:`Only http(s) URLs may be fetched.`};if(t.allowPrivateAddresses===!0)return;let i=e.hostname.replace(/^\[|\]$/g,``).toLowerCase();if(t.allowedHosts?.includes(i))return;if(U.has(i)||i.endsWith(`.localhost`))return{reason:`metadata_host`,url:r,message:`Destination "${i}" is a loopback or cloud-metadata host and is not reachable from tools.`};let a=b(i)?[i]:await K(i,n);if(a===void 0||a.length===0)return{reason:`unresolvable`,url:r,message:`Destination "${i}" did not resolve.`};let o=a.find(F);if(o!==void 0)return{reason:`private_destination`,url:r,message:`Destination "${i}" resolves to ${o}, a private, loopback or link-local address, and is not reachable from tools.`}}async function K(e,t){try{return await t(e)}catch{return}}async function q(e,t,n){n.throwIfAborted();let r;try{return await Promise.race([t(e),new Promise((e,t)=>{r=()=>t(n.reason),n.addEventListener(`abort`,r,{once:!0}),n.aborted&&r()})])}finally{r&&n.removeEventListener(`abort`,r)}}async function J(e,t,n,r,i){let a=e.hostname.replace(/^\[|\]$/g,``).toLowerCase(),o,s=async e=>{let t=await q(e,r.lookup??W,i);if(t.length===0||t.some(e=>b(e)===0))throw Error(`Invalid DNS answer`);return o=Object.freeze([...t]),o},c=await G(e,n,s);if(i.throwIfAborted(),c)return c;if(r.fetch){let n=await r.fetch(e.href,{...t,signal:i,redirect:`manual`});return{response:n,close:async()=>{n.body&&!n.body.locked&&await n.body.cancel().catch(()=>void 0)}}}if(o??=b(a)?[a]:await K(a,s),i.throwIfAborted(),!o||o.length===0)return{reason:`unresolvable`,url:e.href,message:`Destination did not resolve to valid IP addresses.`};let l=o.map(e=>({address:e,family:b(e)})),u=new x({connections:1,pipelining:0,connect:{lookup:(e,t,n)=>{if(e.toLowerCase()!==a||i.aborted){n(Error(`Connection authority unavailable`),``,4);return}let r=typeof t==`number`?t:t.family,o=l.filter(e=>!r||e.family===r);if(o.length===0){n(Error(`No validated address family`),``,4);return}typeof t==`object`&&t.all?n(null,o):n(null,o[0].address,o[0].family)}}});if(typeof u.dispatch!=`function`||typeof u.destroy!=`function`)throw Error(`Pinned HTTP transport is unavailable in this runtime`);try{return{response:await S(e.href,{...t,signal:i,redirect:`manual`,dispatcher:u}),close:async()=>{await u.destroy()}}}catch(e){throw await u.destroy(),e}}async function Y(e,t={},n={},r={}){let i=t.maxResponseBytes??V,a=n.maxRedirects??5,o=AbortSignal.timeout(t.timeoutMs??B),s=t.signal?AbortSignal.any([o,t.signal]):o,c=new URL(e),l={...t.headers??{}};for(let e=0;;e+=1){let t=await J(c,{headers:l,signal:s,redirect:`manual`},n,r,s);if(!(`response`in t))return{ok:!1,rejection:t};try{let n=t.response;if(!H.has(n.status))return await Q(n,c.href,i,s);let r=n.headers.get(`location`);if(r===null)return{ok:!1,rejection:{reason:`redirect_without_location`,url:c.href,message:`HTTP ${n.status} without a Location header.`}};if(e>=a)return{ok:!1,rejection:{reason:`redirect_limit`,url:c.href,message:`More than ${a} redirects.`}};let o=new URL(r,c);o.origin!==c.origin&&(l=Z(l)),c=o}finally{await t.close()}}}async function X(e,t,n={},r={}){let i=t.maxResponseBytes??V,a=AbortSignal.timeout(t.timeoutMs??B),o=t.signal?AbortSignal.any([a,t.signal]):a,s=new URL(e),c=await J(s,{method:`POST`,headers:{...t.headers??{}},body:t.body,signal:o,redirect:`manual`},n,r,o);if(!(`response`in c))return{ok:!1,rejection:c};try{let e=c.response;return e.status>=300&&e.status<400?(await e.body?.cancel().catch(()=>void 0),{ok:!1,rejection:{reason:`redirect_refused`,url:s.href,message:`HTTP ${e.status}: a POST is never redirected.`}}):await Q(e,s.href,i,o)}finally{await c.close()}}function Z(e){let t={};for(let[n,r]of Object.entries(e))n.toLowerCase()===`user-agent`&&(t[n]=r);return t}async function Q(e,t,n,r){let i=e=>({ok:!1,rejection:{reason:`response_too_large`,url:t,message:`Response exceeds ${n} bytes (${e} seen).`}}),a=Number(e.headers.get(`content-length`));if(Number.isFinite(a)&&a>n)return await e.body?.cancel(),i(a);let o=[],s=0;if(!e.body&&typeof e.arrayBuffer==`function`){let t=new Uint8Array(await e.arrayBuffer());if(t.byteLength>n)return i(t.byteLength);o.push(t),s=t.byteLength}else if(e.body){let t=e.body.getReader();for(;;){r.throwIfAborted();let{done:e,value:a}=await t.read();if(e)break;if(s+=a.byteLength,s>n)return await t.cancel(),i(s);o.push(a)}}let c=new Uint8Array(s),l=0;for(let e of o)c.set(e,l),l+=e.byteLength;return{ok:!0,status:e.status,statusText:e.statusText,headers:e.headers,body:c,finalUrl:t}}export{U as BLOCKED_HOSTNAMES,e as CommandExecutor,t as HttpExecutor,D as OWNER_ONLY_DIRECTORY_MODE,E as OWNER_ONLY_FILE_MODE,O as OwnerOnlyModeError,w as canonicalizePath,M as ensureOwnerOnlyDirectory,Y as fetchWithEgressPolicy,T as isPathInside,F as isPrivateAddress,J as openEgressExchange,k as ownerOnlyGuarantee,X as postWithEgressPolicy,G as rejectDestination,C as resolveTrustedExecutionRoot,P as tightenExistingFile,N as writeOwnerOnlyFile};
+//# sourceMappingURL=node.js.map