@stratusagent/tool-fs 0.6.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stratus Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,114 @@
+# @stratusagent/tool-fs
+
+The `fs` toolset: an agent reads, lists, and searches inside directories you
+chose, and writes only with the permission engine's blessing.
+
+This is a **plugin** — it contributes a toolset, and nothing loads it unless
+your config says so. See [`plugins.md`](../../docs/architecture/plugins.md)
+for what that means.
+
+## Install and enable
+
+```bash
+npm install @stratusagent/tool-fs
+```
+
+```jsonc
+// ~/.stratus/config.json
+{
+  "plugins": {
+    "@stratusagent/tool-fs": {
+      "enabled": true,
+      "roots": ["~/notes"],
+      "agents": {
+        "ava":  { "roots": ["~/work/ava"] },
+        "juno": { "roots": ["~/work/juno", "~/shared"] }
+      }
+    }
+  }
+}
+```
+
+Read from a **trusted** config only — `~/.stratus/config.json`, or a file you
+passed with `--config`. A project-local `stratus.config.json` ships in any
+repository somebody clones, and cannot decide which code runs in your daemon.
+
+Installing the plugin grants no agent anything. The soul's allowlist is the
+second gate, and the per-identity one:
+
+```markdown
+---
+id: ava
+tools: [fs.read, fs.search]     # or fs.* for the whole toolset
+---
+```
+
+## Risk model
+
+| Tool | Risk | What approval mode does |
+| --- | --- | --- |
+| `fs.read` | `safe` | Runs unattended. Nothing outside the agent's roots is readable, which is what makes reading safe rather than merely convenient. |
+| `fs.list` | `safe` | Runs unattended. Symlinks are listed as symlinks and never followed. |
+| `fs.search` | `safe` | Runs unattended. Matches **literal text** (optionally `wholeWord`), never a regular expression — see below. Given a directory it walks it without following symlinks, skipping `.git`, `node_modules`, and files over 1 MB; given a file it searches that file and no others. |
+| `fs.write` | `gated` | `interactive` asks at the terminal, `remote` asks in Slack, `headless` refuses. Writing where other people read is the thing worth a person's attention. |
+
+## Settings
+
+| Key | Default | What |
+| --- | --- | --- |
+| `roots` | none | Directories this agent may reach. **No roots means no filesystem** — nothing is readable, rather than everything. |
+| `maxBytes` | `64000` | Cap on one `fs.read`, before the `truncated` marker. |
+| `maxMatches` | `100` | Cap on `fs.search` matches. |
+| `maxEntries` | `500` | Cap on `fs.list` entries. |
+
+Every key can be set per agent in the `agents` sub-block, over the defaults
+above it, and `roots` is why the sub-block exists: a flat list would give
+every agent enabling `fs.*` the same roots, which is one agent reading
+another's files.
+
+## `fs.search` takes literal text, not a pattern
+
+A regular expression written by a model is untrusted input compiled into
+V8's backtracking engine and run on the process's only thread. `(a+)+$`
+against a long line does not return in any time worth waiting for, and while
+it runs every session in the daemon is stopped — for a tool classified
+`safe`, which means nobody is watching.
+
+There is no timeout to give a running regex and no way to interrupt one from
+the thread it is on, so the expressive form is gone rather than bounded.
+`wholeWord` covers what it was mostly wanted for. Anything genuinely
+regex-shaped is a `grep` away through
+[`@stratusagent/tool-shell`](../tool-shell), where a human approves the
+command and the executor can kill it.
+
+## The containment rule
+
+Roots are an **access boundary between agents**, so they are resolved on
+every call from `session.agent.id` — never read once when the plugin is
+constructed. A plugin that closed over its roots at setup would hand every
+agent whichever set resolved first.
+
+Containment is decided between **real** paths, not strings:
+
+- The requested path is normalized, then the deepest part of it that exists
+  is canonicalized, and *that* must be inside a canonicalized root. A
+  lexical check would catch `../../.stratus/credentials.json` and miss a
+  symlink inside the root pointing at the same file.
+- For a path that does not exist yet, the canonicalized part is its nearest
+  existing ancestor — which is what makes writing `root/link/planted.txt`
+  through a symlinked `link` a refusal rather than a write into `/etc`.
+- Opens use `O_NOFOLLOW`, and a file that existed at check time is compared
+  by inode after opening, so a name repointed in between fails instead of
+  being followed.
+
+A path inside a root that is not a regular file — a fifo, a socket, a device
+— is refused rather than opened. Opening one of those does not fail, it
+*blocks*, and a tool call that never returns is worse than one that says no.
+The opens carry `O_NONBLOCK` as well, so missing that check would be a
+returned error rather than a turn that never ends.
+
+What this does not do is walk the path one directory at a time holding each
+open — that needs `openat`, which Node does not expose — so a swap of an
+intermediate directory remains possible in principle. The roots you choose
+are the boundary; this module is what stops the ordinary escapes from
+crossing it.

package/dist/index.d.ts

@@ -0,0 +1,26 @@
+import type { JsonObject, Plugin } from '@stratusagent/core';
+export { canonicalRoots, expandHome, openContained, PathOutsideRootError, resolveWithinRoots, } from './paths.ts';
+export interface FsPluginConfig extends JsonObject {
+    /** Directories this agent may reach. Nothing outside them is readable. */
+    roots?: string[];
+    /** Cap on a single read, before truncation. */
+    maxBytes?: number;
+    /** Cap on `fs.search` matches. */
+    maxMatches?: number;
+    /** Cap on `fs.list` entries. */
+    maxEntries?: number;
+}
+/**
+ * The filesystem toolset.
+ *
+ * Reads are `safe` and writes are `gated`, which is the risk model applied
+ * rather than a compromise: reading inside a directory a human chose is
+ * work an agent does on its own, and writing where other people read is the
+ * thing worth a person's attention. The roots are what make the first half
+ * true, so they are an access boundary and not a preference — resolved from
+ * `session.agent.id` on every call.
+ */
+export declare const createFsPlugin: (config?: JsonObject) => Plugin;
+/** The loader's ABI. See `docs/architecture/plugins.md`. */
+export declare const createPlugin: (config?: JsonObject) => Plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,EAAiB,MAAM,oBAAoB,CAAC;AAUvF,OAAO,EACL,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAQpB,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA+XD;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,SAAQ,UAAe,KAAG,MAQvD,CAAC;AAEH,4DAA4D;AAC5D,eAAO,MAAM,YAAY,YAXc,UAAU,KAAQ,MAWf,CAAC"}

package/dist/index.js

@@ -0,0 +1,385 @@
+import { constants } from 'node:fs';
+import { mkdir, readdir, readFile, stat } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { resolvePluginAgentConfig } from '@stratusagent/plugins';
+import { isRealDirectory, openContained, resolveWithinRoots, } from "./paths.js";
+export { canonicalRoots, expandHome, openContained, PathOutsideRootError, resolveWithinRoots, } from "./paths.js";
+/** Defaults chosen so a tool result is something a model can actually read. */
+const DEFAULT_MAX_BYTES = 64_000;
+const DEFAULT_MAX_MATCHES = 100;
+const DEFAULT_MAX_SEARCH_FILE_BYTES = 1_000_000;
+const DEFAULT_MAX_ENTRIES = 500;
+const asStrings = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+const asNumber = (value, fallback) => typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;
+const requireString = (input, key) => {
+    const value = input[key];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new Error(`${key} is required and must be a string.`);
+    }
+    return value;
+};
+/**
+ * What this agent may reach — resolved **per call**, from the session.
+ *
+ * Not a convenience: two agents with different roots is the whole point of
+ * the per-agent block, and a plugin that read its roots once at setup would
+ * hand every agent whichever set happened to be resolved first. That is one
+ * agent reading another's files, and it is the failure this signature
+ * exists to make impossible to write.
+ */
+const settingsFor = (config, session) => {
+    const resolved = resolvePluginAgentConfig(config, session.agent.id);
+    return {
+        roots: asStrings(resolved.roots),
+        maxBytes: asNumber(resolved.maxBytes, DEFAULT_MAX_BYTES),
+        maxMatches: asNumber(resolved.maxMatches, DEFAULT_MAX_MATCHES),
+        maxEntries: asNumber(resolved.maxEntries, DEFAULT_MAX_ENTRIES),
+        home: typeof resolved.home === 'string' ? resolved.home : os.homedir(),
+    };
+};
+/**
+ * Whether a buffer is text, decided the way `grep` decides it: a NUL byte
+ * means binary. Returning a megabyte of mojibake to a model helps nobody,
+ * and returning "this is binary" is an answer it can act on.
+ */
+const looksBinary = (buffer) => buffer.includes(0);
+const relativeTo = (root, target) => path.relative(root, target) || '.';
+const readContained = async (resolved, maxBytes) => {
+    if (resolved.kind === 'directory') {
+        throw new Error(`${resolved.path} is a directory; use fs.list.`);
+    }
+    if (resolved.kind === 'other') {
+        // A FIFO, a socket, a device. Opening one does not fail — it *blocks*,
+        // and a tool call that never returns is worse than one that refuses.
+        throw new Error(`${resolved.path} is not a regular file.`);
+    }
+    // `O_NONBLOCK` alongside the check above, and not instead of it: the check
+    // gives a refusal an agent can read, and this makes the failure mode of
+    // *missing* one a returned error rather than a turn that never ends. It
+    // has no effect on a regular file.
+    const handle = await openContained(resolved, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
+    try {
+        const info = await handle.stat();
+        if (info.isDirectory()) {
+            throw new Error(`${resolved.path} is a directory; use fs.list.`);
+        }
+        const length = Math.min(info.size, maxBytes);
+        const buffer = Buffer.alloc(length);
+        const { bytesRead } = await handle.read(buffer, 0, length, 0);
+        const slice = buffer.subarray(0, bytesRead);
+        if (looksBinary(slice)) {
+            return { content: '', truncated: false, bytes: bytesRead, size: info.size, binary: true };
+        }
+        return {
+            content: slice.toString('utf8'),
+            truncated: info.size > bytesRead,
+            bytes: bytesRead,
+            size: info.size,
+            binary: false,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+};
+const createReadTool = (config) => ({
+    name: 'fs.read',
+    description: 'Read a UTF-8 text file inside one of this agent’s roots.',
+    risk: 'safe',
+    parameters: {
+        type: 'object',
+        properties: {
+            path: { type: 'string', description: 'Absolute, or relative to the agent’s first root.' },
+            maxBytes: { type: 'number', description: 'Stop after this many bytes.' },
+        },
+        required: ['path'],
+    },
+    async execute(input, session) {
+        const settings = settingsFor(config, session);
+        const requested = requireString(input, 'path');
+        const resolved = await resolveWithinRoots(settings.roots, requested, { home: settings.home });
+        const maxBytes = asNumber(input.maxBytes, settings.maxBytes);
+        const result = await readContained(resolved, maxBytes);
+        return {
+            path: relativeTo(resolved.root, resolved.path),
+            absolutePath: resolved.path,
+            ...(result.binary
+                ? { binary: true, bytes: result.size }
+                : {
+                    content: result.content,
+                    bytes: result.bytes,
+                    size: result.size,
+                    // Said outright rather than left for the model to notice: a
+                    // silently clipped file reads as a complete one, and a summary
+                    // written from half a document is confidently wrong.
+                    truncated: result.truncated,
+                }),
+        };
+    },
+});
+const entryKind = (entry) => {
+    if (entry.isSymbolicLink())
+        return 'symlink';
+    if (entry.isDirectory())
+        return 'directory';
+    if (entry.isFile())
+        return 'file';
+    return 'other';
+};
+const createListTool = (config) => ({
+    name: 'fs.list',
+    description: 'List a directory inside one of this agent’s roots.',
+    risk: 'safe',
+    parameters: {
+        type: 'object',
+        properties: {
+            path: { type: 'string', description: 'Defaults to the agent’s first root.' },
+        },
+    },
+    async execute(input, session) {
+        const settings = settingsFor(config, session);
+        const requested = typeof input.path === 'string' && input.path.length > 0 ? input.path : '.';
+        const resolved = await resolveWithinRoots(settings.roots, requested, { home: settings.home });
+        if (!(await isRealDirectory(resolved.path))) {
+            throw new Error(`${requested} is not a directory; use fs.read.`);
+        }
+        const entries = await readdir(resolved.path, { withFileTypes: true });
+        const listed = entries.slice(0, settings.maxEntries);
+        const detailed = await Promise.all(listed.map(async (entry) => {
+            const full = path.join(resolved.path, entry.name);
+            let size;
+            if (entry.isFile()) {
+                try {
+                    size = (await stat(full)).size;
+                }
+                catch {
+                    size = undefined;
+                }
+            }
+            return {
+                name: entry.name,
+                // Symlinks are reported as symlinks and never followed here: a
+                // listing that resolved them would describe files outside the root
+                // as if they were inside it.
+                type: entryKind(entry),
+                ...(size === undefined ? {} : { size }),
+            };
+        }));
+        return {
+            path: relativeTo(resolved.root, resolved.path),
+            entries: detailed,
+            truncated: entries.length > listed.length,
+        };
+    },
+});
+const escapeRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * The matcher for one search.
+ *
+ * Built from an **escaped literal**, always. `fs.search` is `safe` — it
+ * runs unattended, on the process's only thread, with a pattern a model
+ * wrote — and V8's regex engine backtracks: `(a+)+$` against a long line of
+ * `a`s does not return in any time worth waiting for, and while it runs
+ * every session in the daemon is stopped. There is no timeout to give it
+ * and no way to interrupt it on this thread.
+ *
+ * So the expressive form is gone rather than bounded. `wholeWord` covers
+ * the case it was mostly wanted for; anything genuinely regex-shaped is a
+ * `shell.run` away, where a human approves the command and the executor
+ * can kill it.
+ */
+const matcherFor = (query, options) => {
+    const literal = escapeRegExp(query);
+    return new RegExp(options.wholeWord ? `\\b${literal}\\b` : literal, options.caseSensitive ? '' : 'i');
+};
+const walkFiles = async function* (directory, depth = 0) {
+    if (depth > 12) {
+        return;
+    }
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        // Never through a symlink: following one would walk out of the root,
+        // and the containment check only ran on the directory we were given.
+        if (entry.isSymbolicLink()) {
+            continue;
+        }
+        const full = path.join(directory, entry.name);
+        if (entry.isDirectory()) {
+            if (entry.name === '.git' || entry.name === 'node_modules') {
+                continue;
+            }
+            yield* walkFiles(full, depth + 1);
+            continue;
+        }
+        if (entry.isFile()) {
+            yield full;
+        }
+    }
+};
+const createSearchTool = (config) => ({
+    name: 'fs.search',
+    description: 'Search file contents for literal text under one of this agent’s roots.',
+    risk: 'safe',
+    parameters: {
+        type: 'object',
+        properties: {
+            query: { type: 'string', description: 'Literal text to find. Not a regular expression.' },
+            path: { type: 'string', description: 'Where to search. Defaults to the agent’s first root.' },
+            wholeWord: { type: 'boolean', description: 'Match only whole words.' },
+            caseSensitive: { type: 'boolean' },
+            maxMatches: { type: 'number' },
+        },
+        required: ['query'],
+    },
+    async execute(input, session) {
+        const settings = settingsFor(config, session);
+        const query = requireString(input, 'query');
+        const requested = typeof input.path === 'string' && input.path.length > 0 ? input.path : '.';
+        const resolved = await resolveWithinRoots(settings.roots, requested, { home: settings.home });
+        const limit = asNumber(input.maxMatches, settings.maxMatches);
+        const pattern = matcherFor(query, {
+            caseSensitive: input.caseSensitive === true,
+            wholeWord: input.wholeWord === true,
+        });
+        const matches = [];
+        let truncated = false;
+        // A file is searched as itself. Falling back to its parent would answer
+        // a question nobody asked — `{ path: 'notes/today.md' }` coming back
+        // with hits from every other note is a wrong answer, not a generous one.
+        if (resolved.kind === 'other') {
+            // The same trap `fs.read` has: `readFile` on a fifo with no writer
+            // does not fail, it waits — and `fs.search` is `safe`, so it waits
+            // with nobody watching. The walk below cannot hit this (a directory
+            // entry is only yielded when it is a regular file); a path handed to
+            // us directly can.
+            throw new Error(`${resolved.path} is not a regular file.`);
+        }
+        const files = resolved.kind === 'directory'
+            ? walkFiles(resolved.path)
+            : (async function* single() {
+                yield resolved.path;
+            })();
+        for await (const file of files) {
+            if (matches.length >= limit) {
+                truncated = true;
+                break;
+            }
+            let contents;
+            try {
+                const info = await stat(file);
+                if (info.size > DEFAULT_MAX_SEARCH_FILE_BYTES) {
+                    continue;
+                }
+                contents = await readFile(file);
+            }
+            catch {
+                continue;
+            }
+            if (looksBinary(contents)) {
+                continue;
+            }
+            const lines = contents.toString('utf8').split('\n');
+            for (const [index, line] of lines.entries()) {
+                if (!pattern.test(line)) {
+                    continue;
+                }
+                if (matches.length >= limit) {
+                    truncated = true;
+                    break;
+                }
+                matches.push({
+                    path: relativeTo(resolved.root, file),
+                    line: index + 1,
+                    text: line.length > 400 ? `${line.slice(0, 400)}…` : line,
+                });
+            }
+        }
+        return { query, matches, truncated };
+    },
+});
+const createWriteTool = (config) => ({
+    name: 'fs.write',
+    description: 'Write a UTF-8 text file inside one of this agent’s roots.',
+    // Gated, not safe: it acts on the world outside Stratus and outlives the
+    // turn. Reading inside a root a human chose is the thing that does not.
+    risk: 'gated',
+    parameters: {
+        type: 'object',
+        properties: {
+            path: { type: 'string' },
+            content: { type: 'string' },
+            append: { type: 'boolean' },
+        },
+        required: ['path', 'content'],
+    },
+    async execute(input, session) {
+        const settings = settingsFor(config, session);
+        const requested = requireString(input, 'path');
+        const content = typeof input.content === 'string' ? input.content : '';
+        const resolved = await resolveWithinRoots(settings.roots, requested, {
+            home: settings.home,
+            allowMissing: true,
+        });
+        if (!resolved.exists) {
+            // The parent is created only after the resolution above put it inside
+            // a root — `root/link/notes/x.md` through a symlinked `link` never
+            // gets this far, so nothing is created outside the boundary either.
+            await mkdir(path.dirname(resolved.path), { recursive: true });
+        }
+        else if (resolved.kind !== 'file') {
+            // Same reason as the read path: writing into a directory is a mistake
+            // worth naming, and writing into a fifo or a device blocks forever.
+            throw new Error(resolved.kind === 'directory'
+                ? `${resolved.path} is a directory.`
+                : `${resolved.path} is not a regular file.`);
+        }
+        const flags = input.append === true
+            ? constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND
+            : constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC;
+        // O_NOFOLLOW is applied by openContained: a symlink sitting at the
+        // destination must fail rather than write through to its target, which
+        // is the write half of the escape a read-only check would miss.
+        const handle = await openContained(resolved, flags | (constants.O_NONBLOCK ?? 0), 0o644);
+        try {
+            await handle.writeFile(content, 'utf8');
+        }
+        finally {
+            await handle.close();
+        }
+        return {
+            path: relativeTo(resolved.root, resolved.path),
+            absolutePath: resolved.path,
+            bytes: Buffer.byteLength(content, 'utf8'),
+            appended: input.append === true,
+        };
+    },
+});
+/**
+ * The filesystem toolset.
+ *
+ * Reads are `safe` and writes are `gated`, which is the risk model applied
+ * rather than a compromise: reading inside a directory a human chose is
+ * work an agent does on its own, and writing where other people read is the
+ * thing worth a person's attention. The roots are what make the first half
+ * true, so they are an access boundary and not a preference — resolved from
+ * `session.agent.id` on every call.
+ */
+export const createFsPlugin = (config = {}) => ({
+    name: '@stratusagent/tool-fs',
+    setup(context) {
+        context.tools.register(createReadTool(config));
+        context.tools.register(createListTool(config));
+        context.tools.register(createSearchTool(config));
+        context.tools.register(createWriteTool(config));
+    },
+});
+/** The loader's ABI. See `docs/architecture/plugins.md`. */
+export const createPlugin = createFsPlugin;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,GAEnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAChD,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAahC,MAAM,SAAS,GAAG,CAAC,KAA4B,EAAY,EAAE,CAC3D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAElG,MAAM,QAAQ,GAAG,CAAC,KAA4B,EAAE,QAAgB,EAAU,EAAE,CAC1E,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAEtF,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAE,GAAW,EAAU,EAAE;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,oCAAoC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,CAAC,MAAkB,EAAE,OAAgB,EAAE,EAAE;IAC3D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QACxD,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;QAC9D,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;QAC9D,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE;KACvE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;AAEhG,MAAM,aAAa,GAAG,KAAK,EACzB,QAAsB,EACtB,QAAgB,EACgF,EAAE;IAClG,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,+BAA+B,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,+BAA+B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,GAAG,SAAS;YAChC,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,0DAA0D;IACvE,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;YACzF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE;SACzE;QACD,QAAQ,EAAE,CAAC,MAAM,CAAC;KACnB;IACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;QAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAC9C,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,GAAG,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;gBACtC,CAAC,CAAC;oBACE,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,4DAA4D;oBAC5D,+DAA+D;oBAC/D,qDAAqD;oBACrD,SAAS,EAAE,MAAM,CAAC,SAAS;iBAC5B,CAAC;SACP,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,KAA+E,EAAU,EAAE;IAC5G,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,MAAkB,EAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,oDAAoD;IACjE,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qCAAqC,EAAE;SAC7E;KACF;IACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;QAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,mCAAmC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,IAAwB,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,GAAG,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,+DAA+D;gBAC/D,mEAAmE;gBACnE,6BAA6B;gBAC7B,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC;gBACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;aACxC,CAAC;QACJ,CAAC,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAC9C,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;SAC1C,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAQH,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE7F;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,OAAyD,EAAU,EAAE;IACtG,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,MAAM,CACf,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,EAChD,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CACjC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,SAAS,CAAC,EAAE,SAAiB,EAAE,KAAK,GAAG,CAAC;IAC7D,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,MAAkB,EAAQ,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,wEAAwE;IACrF,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iDAAiD,EAAE;YACzF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sDAAsD,EAAE;YAC7F,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACtE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC/B;QACD,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB;IACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;QAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa,KAAK,IAAI;YAC3C,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI;SACpC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,mBAAmB;YACnB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,KAAK,WAAW;YACzC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC1B,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM;gBACrB,MAAM,QAAQ,CAAC,IAAI,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,IAAI,CAAC,IAAI,GAAG,6BAA6B,EAAE,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC5B,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;oBACrC,IAAI,EAAE,KAAK,GAAG,CAAC;oBACf,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;iBAC1D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,MAAkB,EAAQ,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,2DAA2D;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,EAAE,OAAO;IACb,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC5B;QACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;KAC9B;IACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;QAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE;YACnE,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,sEAAsE;YACtE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpC,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAC3B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,kBAAkB;gBACpC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,yBAAyB,CAC9C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI;YACjC,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ;YAC7D,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC/D,mEAAmE;QACnE,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YAC9C,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;YACzC,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI;SAChC,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAqB,EAAE,EAAU,EAAE,CAAC,CAAC;IAClE,IAAI,EAAE,uBAAuB;IAC7B,KAAK,CAAC,OAAO;QACX,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;CACF,CAAC,CAAC;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC"}

package/dist/paths.d.ts

@@ -0,0 +1,75 @@
+import { open } from 'node:fs/promises';
+/** A path that is not inside anything this agent was given. */
+export declare class PathOutsideRootError extends Error {
+    constructor(message: string);
+}
+/** `~` and `~/x` mean the same thing here as they do in a shell. */
+export declare const expandHome: (value: string, home?: string) => string;
+/**
+ * The roots an agent may reach, canonicalized.
+ *
+ * A root can itself be a symlink — `~/work` pointing at a volume is
+ * ordinary — so containment is decided between real paths on both sides.
+ * Comparing a real target against a symlinked root would refuse every
+ * legitimate read; comparing a lexical target against a real root would
+ * accept every escape.
+ */
+export declare const canonicalRoots: (roots: readonly string[], home?: string) => Promise<string[]>;
+export interface ResolvedPath {
+    /** The canonical path to act on. */
+    path: string;
+    /** The canonical root it was found inside. */
+    root: string;
+    /** True when something is already there. */
+    exists: boolean;
+    /**
+     * The file this resolution was decided about, identified by inode rather
+     * than by name — see `openContained`.
+     */
+    identity?: {
+        dev: number;
+        ino: number;
+    };
+    /** What is actually there: a regular file, a directory, or something else. */
+    kind?: 'file' | 'directory' | 'other';
+}
+/**
+ * Resolve a requested path to a real one inside a real root, or refuse it.
+ *
+ * Lexical checks are not enough and this is the reason the whole module
+ * exists: `notes/../../.stratus/credentials.json` is caught by normalizing,
+ * but a *symlink* inside an allowed root pointing at the credential store
+ * is not — the string never leaves the root. So resolution canonicalizes
+ * the deepest part of the path that exists, and requires **that** to be
+ * inside the root.
+ *
+ * For a path that does not exist yet, the canonicalized part is its nearest
+ * existing ancestor, which is what makes the write-through-parent case a
+ * refusal: writing `root/link/passwd` where `link` points at `/etc`
+ * resolves to `/etc`, and `/etc` is not inside the root however innocent
+ * the requested string looks.
+ */
+export declare const resolveWithinRoots: (roots: readonly string[], requested: string, options?: {
+    home?: string;
+    allowMissing?: boolean;
+}) => Promise<ResolvedPath>;
+/**
+ * Open a resolved path without following a symlink, and prove afterwards
+ * that what opened is what was checked.
+ *
+ * Between resolution and open there is a window in which the name can be
+ * repointed at something else — the classic symlink-swap race. Two things
+ * close it as far as this platform allows: `O_NOFOLLOW`, so a name that
+ * *became* a symlink fails instead of being followed, and an inode
+ * comparison after the fact, because a name that was replaced with a
+ * different real file is a different inode even though the string matches.
+ *
+ * What this cannot do is walk the path a directory at a time holding each
+ * one open — that needs `openat`, which Node does not expose. A swap of an
+ * intermediate directory therefore remains possible in principle, which is
+ * why the roots themselves are the boundary and not this function alone.
+ */
+export declare const openContained: (resolved: ResolvedPath, flags: number, mode?: number) => Promise<Awaited<ReturnType<typeof open>>>;
+/** Whether a directory entry is a real directory (never through a symlink). */
+export declare const isRealDirectory: (target: string) => Promise<boolean>;
+//# sourceMappingURL=paths.d.ts.map

package/dist/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,IAAI,EAAkB,MAAM,kBAAkB,CAAC;AAI/D,+DAA+D;AAC/D,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,oEAAoE;AACpE,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,EAAE,aAAmB,KAAG,MAQ/D,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,OAAO,SAAS,MAAM,EAAE,EAAE,aAAmB,KAAG,OAAO,CAAC,MAAM,EAAE,CAapG,CAAC;AAKF,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,SAAS,MAAM,EAAE,EACxB,WAAW,MAAM,EACjB,UAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,KACtD,OAAO,CAAC,YAAY,CAsEtB,CAAC;AAIF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,GACxB,UAAU,YAAY,EACtB,OAAO,MAAM,EACb,OAAO,MAAM,KACZ,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,CAY1C,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,OAAO,CAMrE,CAAC"}

package/dist/paths.js

@@ -0,0 +1,162 @@
+import { constants } from 'node:fs';
+import { lstat, open, realpath, stat } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+/** A path that is not inside anything this agent was given. */
+export class PathOutsideRootError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'PathOutsideRootError';
+    }
+}
+/** `~` and `~/x` mean the same thing here as they do in a shell. */
+export const expandHome = (value, home = os.homedir()) => {
+    if (value === '~') {
+        return home;
+    }
+    if (value.startsWith('~/')) {
+        return path.join(home, value.slice(2));
+    }
+    return value;
+};
+/**
+ * The roots an agent may reach, canonicalized.
+ *
+ * A root can itself be a symlink — `~/work` pointing at a volume is
+ * ordinary — so containment is decided between real paths on both sides.
+ * Comparing a real target against a symlinked root would refuse every
+ * legitimate read; comparing a lexical target against a real root would
+ * accept every escape.
+ */
+export const canonicalRoots = async (roots, home = os.homedir()) => {
+    const resolved = [];
+    for (const root of roots) {
+        const absolute = path.resolve(expandHome(root, home));
+        try {
+            resolved.push(await realpath(absolute));
+        }
+        catch {
+            // A root that does not exist yet grants nothing, rather than
+            // granting its lexical prefix.
+            continue;
+        }
+    }
+    return resolved;
+};
+const contains = (root, candidate) => candidate === root || candidate.startsWith(`${root}${path.sep}`);
+/**
+ * Resolve a requested path to a real one inside a real root, or refuse it.
+ *
+ * Lexical checks are not enough and this is the reason the whole module
+ * exists: `notes/../../.stratus/credentials.json` is caught by normalizing,
+ * but a *symlink* inside an allowed root pointing at the credential store
+ * is not — the string never leaves the root. So resolution canonicalizes
+ * the deepest part of the path that exists, and requires **that** to be
+ * inside the root.
+ *
+ * For a path that does not exist yet, the canonicalized part is its nearest
+ * existing ancestor, which is what makes the write-through-parent case a
+ * refusal: writing `root/link/passwd` where `link` points at `/etc`
+ * resolves to `/etc`, and `/etc` is not inside the root however innocent
+ * the requested string looks.
+ */
+export const resolveWithinRoots = async (roots, requested, options = {}) => {
+    const home = options.home ?? os.homedir();
+    const canonical = await canonicalRoots(roots, home);
+    if (canonical.length === 0) {
+        throw new PathOutsideRootError('No filesystem roots are configured for this agent, so nothing is readable. '
+            + 'Set roots for it under plugins["@stratusagent/tool-fs"].');
+    }
+    const expanded = expandHome(requested, home);
+    // A relative path is relative to the agent's first root, which is what an
+    // agent means by `notes/today.md`. It is normalized before anything else,
+    // so `../` is spent against the root rather than against the daemon's cwd.
+    const absolute = path.isAbsolute(expanded)
+        ? path.normalize(expanded)
+        : path.resolve(canonical[0], expanded);
+    const missing = [];
+    let cursor = absolute;
+    let real;
+    for (;;) {
+        try {
+            real = await realpath(cursor);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                throw error;
+            }
+            const parent = path.dirname(cursor);
+            if (parent === cursor) {
+                break;
+            }
+            missing.unshift(path.basename(cursor));
+            cursor = parent;
+        }
+    }
+    if (real === undefined) {
+        throw new PathOutsideRootError(`Path does not resolve to anything inside an allowed root: ${requested}`);
+    }
+    const root = canonical.find((candidate) => contains(candidate, real));
+    if (!root) {
+        throw new PathOutsideRootError(`Refusing ${requested}: it resolves to ${real}${missing.length > 0 ? `/${missing.join('/')}` : ''}, `
+            + `which is outside every root this agent may reach (${canonical.join(', ')}).`);
+    }
+    if (missing.length > 0) {
+        const resolved = path.join(real, ...missing);
+        if (!options.allowMissing) {
+            const error = new Error(`No such file or directory: ${requested}`);
+            error.code = 'ENOENT';
+            throw error;
+        }
+        return { path: resolved, root, exists: false };
+    }
+    const resolved = real;
+    const info = await lstat(resolved);
+    return {
+        path: resolved,
+        root,
+        exists: true,
+        identity: { dev: info.dev, ino: info.ino },
+        // A realpath never ends at a symlink, so this is what the file is.
+        kind: info.isFile() ? 'file' : info.isDirectory() ? 'directory' : 'other',
+    };
+};
+const O_NOFOLLOW = constants.O_NOFOLLOW ?? 0;
+/**
+ * Open a resolved path without following a symlink, and prove afterwards
+ * that what opened is what was checked.
+ *
+ * Between resolution and open there is a window in which the name can be
+ * repointed at something else — the classic symlink-swap race. Two things
+ * close it as far as this platform allows: `O_NOFOLLOW`, so a name that
+ * *became* a symlink fails instead of being followed, and an inode
+ * comparison after the fact, because a name that was replaced with a
+ * different real file is a different inode even though the string matches.
+ *
+ * What this cannot do is walk the path a directory at a time holding each
+ * one open — that needs `openat`, which Node does not expose. A swap of an
+ * intermediate directory therefore remains possible in principle, which is
+ * why the roots themselves are the boundary and not this function alone.
+ */
+export const openContained = async (resolved, flags, mode) => {
+    const handle = await open(resolved.path, flags | O_NOFOLLOW, mode);
+    if (resolved.identity) {
+        const info = await handle.stat();
+        if (info.dev !== resolved.identity.dev || info.ino !== resolved.identity.ino) {
+            await handle.close();
+            throw new PathOutsideRootError(`Refusing ${resolved.path}: it changed between the containment check and the open.`);
+        }
+    }
+    return handle;
+};
+/** Whether a directory entry is a real directory (never through a symlink). */
+export const isRealDirectory = async (target) => {
+    try {
+        return (await stat(target)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+};
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,+DAA+D;AAC/D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAAU,EAAE;IACvE,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,KAAwB,EAAE,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAAqB,EAAE;IACvG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,+BAA+B;YAC/B,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAW,EAAE,CAC5D,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAkBnE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAAwB,EACxB,SAAiB,EACjB,UAAqD,EAAE,EAChC,EAAE;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,6EAA6E;cAC3E,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAW,EAAE,QAAQ,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,IAAwB,CAAC;IAC7B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAAC,6DAA6D,SAAS,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAc,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,oBAAoB,CAC5B,YAAY,SAAS,oBAAoB,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI;cACnG,qDAAqD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAChF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,8BAA8B,SAAS,EAAE,CAA0B,CAAC;YAC5F,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;YACtB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC;IAEtB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QAC1C,mEAAmE;QACnE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;KAC1E,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,QAAsB,EACtB,KAAa,EACb,IAAa,EAC8B,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC7E,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,oBAAoB,CAC5B,YAAY,QAAQ,CAAC,IAAI,0DAA0D,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;IACxE,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@stratusagent/tool-fs",
+  "version": "0.6.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.13 <23 || >=23.4"
+  },
+  "dependencies": {
+    "@stratusagent/core": "0.6.0",
+    "@stratusagent/plugins": "0.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.6.0",
+    "typescript": "^5.9.3"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stratuslabs/agent.git",
+    "directory": "packages/tool-fs"
+  },
+  "description": "Filesystem tools for Stratus agents: read, list, search, and write inside per-agent roots, with symlink-safe containment",
+  "keywords": [
+    "stratus",
+    "agent",
+    "ai",
+    "llm",
+    "stratus-plugin",
+    "tools",
+    "filesystem"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "stratus": {
+    "pluginVersion": 1,
+    "contributes": {
+      "tools": [
+        {
+          "name": "fs.read",
+          "risk": "safe"
+        },
+        {
+          "name": "fs.list",
+          "risk": "safe"
+        },
+        {
+          "name": "fs.search",
+          "risk": "safe"
+        },
+        {
+          "name": "fs.write",
+          "risk": "gated"
+        }
+      ]
+    },
+    "config": {
+      "type": "object",
+      "properties": {
+        "roots": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "maxBytes": {
+          "type": "integer"
+        },
+        "maxMatches": {
+          "type": "integer"
+        },
+        "maxEntries": {
+          "type": "integer"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc --noEmit --project tsconfig.test.json",
+    "test": "node --test --experimental-strip-types"
+  }
+}