@theokit/sdk 5.15.1 → 5.15.3

package/dist/{chunk-BPL5CVZ5.js.map → chunk-VFT63FJF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/persistence/sqlite-session-store.ts"],"names":[],"mappings":";;;AA2BO,IAAM,qBAAN,MAAiD;AAAA,EACrC,QAAA;AAAA,EACT,SAAA;AAAA,EAER,YAAY,OAAA,EAAoC;AAC9C,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AAAA,EAC1B;AAAA,EAEQ,EAAA,GAAkB;AACxB,IAAA,IAAA,CAAK,cAAc,mBAAA,CAAwB;AAAA,MACzC,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,KAAA,EAAO,eAAA;AAAA,MACP,cAAA,EAAgB,KAAA;AAAA,MAChB,MAAA,EAAQ,CAAC,EAAA,KAAO;AACd,QAAA,EAAA,CAAG,IAAA;AAAA,UACD;AAAA,SAEF;AAAA,MACF;AAAA,KACD,CAAA;AACD,IAAA,IAAA,CAAK,SAAA,CAAU,MAAM,MAAM;AACzB,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,MAAM,YAAY,OAAA,EAA2C;AAC3D,IAAA,MAAM,EAAA,GAAK,MAAM,IAAA,CAAK,EAAA,EAAG;AACzB,IAAA,MAAM,OAAO,EAAA,CACV,OAAA,CAAQ,oEAAoE,CAAA,CAC5E,IAAI,OAAO,CAAA;AACd,IAAA,OAAO,IAAA,CAAK,IAAI,CAAC,CAAA,KAAM,KAAK,KAAA,CAAM,CAAA,CAAE,MAAM,CAAkB,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,aAAA,CAAc,OAAA,EAAiB,OAAA,EAAkD;AACrF,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,EAAA,GAAK,MAAM,IAAA,CAAK,EAAA,EAAG;AACzB,IAAA,MAAM,MAAA,GAAS,EAAA,CAAG,OAAA,CAAQ,8DAA8D,CAAA;AACxF,IAAA,EAAA,CAAG,KAAK,iBAAiB,CAAA;AACzB,IAAA,IAAI;AACF,MAAA,KAAA,MAAW,GAAA,IAAO,SAAS,MAAA,CAAO,GAAA,CAAI,SAAS,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAClE,MAAA,EAAA,CAAG,KAAK,QAAQ,CAAA;AAAA,IAClB,SAAS,GAAA,EAAK;AACZ,MAAA,EAAA,CAAG,KAAK,UAAU,CAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,IAAI,IAAA,CAAK,SAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,IAAA,IAAI,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,KAAA,EAAM;AAAA,EACzB;AACF","file":"chunk-BPL5CVZ5.js","sourcesContent":["import type { SessionRecord, SessionStore } from \"../../types/session-store.js\";\nimport { openSqliteResilient, type ResilientSqliteDb } from \"./sqlite-open.js\";\n\n/** Options for {@link SqliteSessionStore}. */\nexport interface SqliteSessionStoreOptions {\n  /** Absolute path of the SQLite file. Parent directories are created. */\n  filePath: string;\n}\n\ninterface Stmt {\n  run(...args: unknown[]): unknown;\n  all(...args: unknown[]): unknown[];\n}\ninterface Db extends ResilientSqliteDb {\n  prepare(sql: string): Stmt;\n}\n\n/**\n * A {@link SessionStore} that keeps the native session records in one SQLite file instead of\n * per-agent JSONL transcripts. Pass it as `local.sessionStore`.\n *\n * Uses `better-sqlite3` when installed, else the built-in `node:sqlite` (Node 22.5+).\n * Appends are one transaction, so a batch lands whole or not at all; order is the\n * autoincrement `seq`. Corruption is NOT silently rebuilt: opening a corrupt file throws.\n *\n * @public\n */\nexport class SqliteSessionStore implements SessionStore {\n  private readonly filePath: string;\n  private dbPromise: Promise<Db> | undefined;\n\n  constructor(options: SqliteSessionStoreOptions) {\n    this.filePath = options.filePath;\n  }\n\n  private db(): Promise<Db> {\n    this.dbPromise ??= openSqliteResilient<Db>({\n      filePath: this.filePath,\n      label: \"session-store\",\n      recoverCorrupt: false,\n      onOpen: (db) => {\n        db.exec(\n          \"CREATE TABLE IF NOT EXISTS session_records (seq INTEGER PRIMARY KEY AUTOINCREMENT, agent_id TEXT NOT NULL, record TEXT NOT NULL);\" +\n            \"CREATE INDEX IF NOT EXISTS session_records_agent ON session_records (agent_id, seq);\",\n        );\n      },\n    });\n    this.dbPromise.catch(() => {\n      this.dbPromise = undefined; // allow retry after a failed open\n    });\n    return this.dbPromise;\n  }\n\n  async readRecords(agentId: string): Promise<SessionRecord[]> {\n    const db = await this.db();\n    const rows = db\n      .prepare(\"SELECT record FROM session_records WHERE agent_id = ? ORDER BY seq\")\n      .all(agentId) as { record: string }[];\n    return rows.map((r) => JSON.parse(r.record) as SessionRecord);\n  }\n\n  async appendRecords(agentId: string, records: readonly SessionRecord[]): Promise<void> {\n    if (records.length === 0) return;\n    const db = await this.db();\n    const insert = db.prepare(\"INSERT INTO session_records (agent_id, record) VALUES (?, ?)\");\n    db.exec(\"BEGIN IMMEDIATE\");\n    try {\n      for (const rec of records) insert.run(agentId, JSON.stringify(rec));\n      db.exec(\"COMMIT\");\n    } catch (err) {\n      db.exec(\"ROLLBACK\");\n      throw err;\n    }\n  }\n\n  async dispose(): Promise<void> {\n    const p = this.dbPromise;\n    this.dbPromise = undefined;\n    if (p) (await p).close();\n  }\n}\n"]}
+{"version":3,"sources":["../src/internal/persistence/sqlite-session-store.ts"],"names":[],"mappings":";;;AA2BO,IAAM,qBAAN,MAAiD;AAAA,EACrC,QAAA;AAAA,EACT,SAAA;AAAA,EAER,YAAY,OAAA,EAAoC;AAC9C,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AAAA,EAC1B;AAAA,EAEQ,EAAA,GAAkB;AACxB,IAAA,IAAA,CAAK,cAAc,mBAAA,CAAwB;AAAA,MACzC,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,KAAA,EAAO,eAAA;AAAA,MACP,cAAA,EAAgB,KAAA;AAAA,MAChB,MAAA,EAAQ,CAAC,EAAA,KAAO;AACd,QAAA,EAAA,CAAG,IAAA;AAAA,UACD;AAAA,SAEF;AAAA,MACF;AAAA,KACD,CAAA;AACD,IAAA,IAAA,CAAK,SAAA,CAAU,MAAM,MAAM;AACzB,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,MAAM,YAAY,OAAA,EAA2C;AAC3D,IAAA,MAAM,EAAA,GAAK,MAAM,IAAA,CAAK,EAAA,EAAG;AACzB,IAAA,MAAM,OAAO,EAAA,CACV,OAAA,CAAQ,oEAAoE,CAAA,CAC5E,IAAI,OAAO,CAAA;AACd,IAAA,OAAO,IAAA,CAAK,IAAI,CAAC,CAAA,KAAM,KAAK,KAAA,CAAM,CAAA,CAAE,MAAM,CAAkB,CAAA;AAAA,EAC9D;AAAA,EAEA,MAAM,aAAA,CAAc,OAAA,EAAiB,OAAA,EAAkD;AACrF,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,EAAA,GAAK,MAAM,IAAA,CAAK,EAAA,EAAG;AACzB,IAAA,MAAM,MAAA,GAAS,EAAA,CAAG,OAAA,CAAQ,8DAA8D,CAAA;AACxF,IAAA,EAAA,CAAG,KAAK,iBAAiB,CAAA;AACzB,IAAA,IAAI;AACF,MAAA,KAAA,MAAW,GAAA,IAAO,SAAS,MAAA,CAAO,GAAA,CAAI,SAAS,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAClE,MAAA,EAAA,CAAG,KAAK,QAAQ,CAAA;AAAA,IAClB,SAAS,GAAA,EAAK;AACZ,MAAA,EAAA,CAAG,KAAK,UAAU,CAAA;AAClB,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,IAAI,IAAA,CAAK,SAAA;AACf,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA;AACjB,IAAA,IAAI,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,KAAA,EAAM;AAAA,EACzB;AACF","file":"chunk-VFT63FJF.js","sourcesContent":["import type { SessionRecord, SessionStore } from \"../../types/session-store.js\";\nimport { openSqliteResilient, type ResilientSqliteDb } from \"./sqlite-open.js\";\n\n/** Options for {@link SqliteSessionStore}. */\nexport interface SqliteSessionStoreOptions {\n  /** Absolute path of the SQLite file. Parent directories are created. */\n  filePath: string;\n}\n\ninterface Stmt {\n  run(...args: unknown[]): unknown;\n  all(...args: unknown[]): unknown[];\n}\ninterface Db extends ResilientSqliteDb {\n  prepare(sql: string): Stmt;\n}\n\n/**\n * A {@link SessionStore} that keeps the native session records in one SQLite file instead of\n * per-agent JSONL transcripts. Pass it as `local.sessionStore`.\n *\n * Uses `better-sqlite3` when installed, else the built-in `node:sqlite` (Node 22.5+).\n * Appends are one transaction, so a batch lands whole or not at all; order is the\n * autoincrement `seq`. Corruption is NOT silently rebuilt: opening a corrupt file throws.\n *\n * @public\n */\nexport class SqliteSessionStore implements SessionStore {\n  private readonly filePath: string;\n  private dbPromise: Promise<Db> | undefined;\n\n  constructor(options: SqliteSessionStoreOptions) {\n    this.filePath = options.filePath;\n  }\n\n  private db(): Promise<Db> {\n    this.dbPromise ??= openSqliteResilient<Db>({\n      filePath: this.filePath,\n      label: \"session-store\",\n      recoverCorrupt: false,\n      onOpen: (db) => {\n        db.exec(\n          \"CREATE TABLE IF NOT EXISTS session_records (seq INTEGER PRIMARY KEY AUTOINCREMENT, agent_id TEXT NOT NULL, record TEXT NOT NULL);\" +\n            \"CREATE INDEX IF NOT EXISTS session_records_agent ON session_records (agent_id, seq);\",\n        );\n      },\n    });\n    this.dbPromise.catch(() => {\n      this.dbPromise = undefined; // allow retry after a failed open\n    });\n    return this.dbPromise;\n  }\n\n  async readRecords(agentId: string): Promise<SessionRecord[]> {\n    const db = await this.db();\n    const rows = db\n      .prepare(\"SELECT record FROM session_records WHERE agent_id = ? ORDER BY seq\")\n      .all(agentId) as { record: string }[];\n    return rows.map((r) => JSON.parse(r.record) as SessionRecord);\n  }\n\n  async appendRecords(agentId: string, records: readonly SessionRecord[]): Promise<void> {\n    if (records.length === 0) return;\n    const db = await this.db();\n    const insert = db.prepare(\"INSERT INTO session_records (agent_id, record) VALUES (?, ?)\");\n    db.exec(\"BEGIN IMMEDIATE\");\n    try {\n      for (const rec of records) insert.run(agentId, JSON.stringify(rec));\n      db.exec(\"COMMIT\");\n    } catch (err) {\n      db.exec(\"ROLLBACK\");\n      throw err;\n    }\n  }\n\n  async dispose(): Promise<void> {\n    const p = this.dbPromise;\n    this.dbPromise = undefined;\n    if (p) (await p).close();\n  }\n}\n"]}

package/dist/{chunk-3KIUY67P.cjs → chunk-VHY6NVCJ.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var chunkSA6K24NB_cjs = require('./chunk-SA6K24NB.cjs');
+var chunkMXJJMP4U_cjs = require('./chunk-MXJJMP4U.cjs');
 var chunkCEGU5AVD_cjs = require('./chunk-CEGU5AVD.cjs');
-var crypto = require('crypto');
-var fs = require('fs');
-var path = require('path');
+var node_crypto = require('node:crypto');
+var node_fs = require('node:fs');
+var node_path = require('node:path');
 
 var PathTraversalError = class extends chunkCEGU5AVD_cjs.ConfigurationError {
   name = "PathTraversalError";
@@ -26,7 +26,7 @@ var ForbiddenPathError = class extends chunkCEGU5AVD_cjs.ConfigurationError {
   }
 };
 function isInside(target, base) {
-  return chunkSA6K24NB_cjs.atOrInsideRoot(target, base);
+  return chunkMXJJMP4U_cjs.atOrInsideRoot(target, base);
 }
 function safePathJoin(base, ...parts) {
   if (base === "") {
@@ -36,8 +36,8 @@ function safePathJoin(base, ...parts) {
   for (const part of parts) {
     rejectNulAndControlChars(part, "path segment");
   }
-  const baseResolved = path.resolve(base);
-  const target = path.resolve(base, ...parts);
+  const baseResolved = node_path.resolve(base);
+  const target = node_path.resolve(base, ...parts);
   if (!isInside(target, baseResolved)) {
     throw new PathTraversalError(parts.join("/"), target);
   }
@@ -56,45 +56,45 @@ function rejectNulAndControlChars(input, role) {
   const label = firstControlCharLabel(input);
   if (label !== void 0) throw new PathTraversalError(`${role}: ${input}`, label);
 }
-function assertNoSymlinkEscape(path$1, base) {
-  rejectNulAndControlChars(path$1, "path");
+function assertNoSymlinkEscape(path, base) {
+  rejectNulAndControlChars(path, "path");
   rejectNulAndControlChars(base, "base");
   let baseResolved;
   try {
-    baseResolved = fs.realpathSync(base);
+    baseResolved = node_fs.realpathSync(base);
   } catch {
-    baseResolved = path.resolve(base);
+    baseResolved = node_path.resolve(base);
   }
-  const resolved = realpathOfDeepestExisting(path$1);
+  const resolved = realpathOfDeepestExisting(path);
   if (resolved === void 0) return;
   if (!isInside(resolved, baseResolved)) {
-    throw new PathTraversalError(`symlink ${path$1}`, resolved);
+    throw new PathTraversalError(`symlink ${path}`, resolved);
   }
 }
-function realpathOfDeepestExisting(path$1) {
+function realpathOfDeepestExisting(path) {
   try {
-    return fs.realpathSync(path$1);
+    return node_fs.realpathSync(path);
   } catch {
   }
   try {
-    const stat = fs.lstatSync(path$1);
+    const stat = node_fs.lstatSync(path);
     if (stat.isSymbolicLink()) {
-      const target = fs.readlinkSync(path$1);
-      const parentReal = realpathOfDeepestExisting(path.dirname(path$1));
-      const parentBase = parentReal ?? path.dirname(path$1);
-      return path.resolve(parentBase, target);
+      const target = node_fs.readlinkSync(path);
+      const parentReal = realpathOfDeepestExisting(node_path.dirname(path));
+      const parentBase = parentReal ?? node_path.dirname(path);
+      return node_path.resolve(parentBase, target);
     }
   } catch {
   }
-  let cursor = path.dirname(path$1);
-  let suffix = path$1.slice(cursor.length);
-  while (cursor !== path.dirname(cursor)) {
+  let cursor = node_path.dirname(path);
+  let suffix = path.slice(cursor.length);
+  while (cursor !== node_path.dirname(cursor)) {
     try {
-      const real = fs.realpathSync(cursor);
-      return path.resolve(real, `.${suffix}`);
+      const real = node_fs.realpathSync(cursor);
+      return node_path.resolve(real, `.${suffix}`);
     } catch {
-      suffix = path$1.slice(path.dirname(cursor).length);
-      cursor = path.dirname(cursor);
+      suffix = path.slice(node_path.dirname(cursor).length);
+      cursor = node_path.dirname(cursor);
     }
   }
   return void 0;
@@ -216,7 +216,7 @@ function safeFilenameForId(id, options) {
   if (lower.length <= maxLen && IDENTIFIER_PATTERN.test(lower)) {
     return lower;
   }
-  return `h-${crypto.createHash("sha256").update(id).digest("hex").slice(0, 16)}`;
+  return `h-${node_crypto.createHash("sha256").update(id).digest("hex").slice(0, 16)}`;
 }
 
 exports.ForbiddenPathError = ForbiddenPathError;
@@ -227,5 +227,5 @@ exports.safeFilenameForId = safeFilenameForId;
 exports.safePathJoin = safePathJoin;
 exports.sanitizeIdentifier = sanitizeIdentifier;
 exports.validateArtifactPath = validateArtifactPath;
-//# sourceMappingURL=chunk-3KIUY67P.cjs.map
-//# sourceMappingURL=chunk-3KIUY67P.cjs.map
+//# sourceMappingURL=chunk-VHY6NVCJ.cjs.map
+//# sourceMappingURL=chunk-VHY6NVCJ.cjs.map

package/dist/chunk-VHY6NVCJ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/security/path-guard.ts"],"names":["ConfigurationError","atOrInsideRoot","resolve","realpathSync","lstatSync","readlinkSync","dirname","createHash"],"mappings":";;;;;;;;AAgCO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,WAAA,CAAY,OAAe,YAAA,EAAsB;AAC/C,IAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,KAAK,CAAA,QAAA,EAAM,YAAY,CAAA,CAAA,EAAI;AAAA,MAC1D,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAYO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,YAAY,IAAA,EAAc;AACxB,IAAA,KAAA;AAAA,MACE,SAAS,IAAI,CAAA,qFAAA,CAAA;AAAA,MACb;AAAA,QACE,IAAA,EAAM;AAAA;AACR,KACF;AAAA,EACF;AACF;AAeA,SAAS,QAAA,CAAS,QAAgB,IAAA,EAAuB;AASvD,EAAA,OAAOC,gCAAA,CAAe,QAAQ,IAAI,CAAA;AACpC;AAUO,SAAS,YAAA,CAAa,SAAiB,KAAA,EAAyB;AACrE,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AAKA,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AACrC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,wBAAA,CAAyB,MAAM,cAAc,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,YAAA,GAAeC,kBAAQ,IAAI,CAAA;AACjC,EAAA,MAAM,MAAA,GAASA,iBAAA,CAAQ,IAAA,EAAM,GAAG,KAAK,CAAA;AACrC,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,EAAQ,YAAY,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,GAAG,GAAG,MAAM,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,MAAA;AACT;AAeA,SAAS,sBAAsB,KAAA,EAAmC;AAChE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA;AAC/B,IAAA,IAAI,SAAS,CAAA,IAAS,IAAA,IAAQ,KAAQ,IAAA,IAAQ,EAAA,IAAS,SAAS,GAAA,EAAM;AACpE,MAAA,OAAO,SAAS,CAAA,GAAO,YAAA,GAAe,mBAAmB,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,CAAA;AAAA,IAC5E;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,wBAAA,CAAyB,OAAe,IAAA,EAAoB;AACnE,EAAA,MAAM,KAAA,GAAQ,sBAAsB,KAAK,CAAA;AACzC,EAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAM,IAAI,kBAAA,CAAmB,GAAG,IAAI,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA,EAAI,KAAK,CAAA;AAClF;AAmBO,SAAS,qBAAA,CAAsB,MAAc,IAAA,EAAoB;AAItE,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AACrC,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AAErC,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAeC,qBAAa,IAAI,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAEN,IAAA,YAAA,GAAeD,kBAAQ,IAAI,CAAA;AAAA,EAC7B;AAQA,EAAA,MAAM,QAAA,GAAW,0BAA0B,IAAI,CAAA;AAC/C,EAAA,IAAI,aAAa,MAAA,EAAW;AAE5B,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,YAAY,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,QAAA,EAAW,IAAI,IAAI,QAAQ,CAAA;AAAA,EAC1D;AACF;AAUA,SAAS,0BAA0B,IAAA,EAAkC;AAEnE,EAAA,IAAI;AACF,IAAA,OAAOC,qBAAa,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAcC,kBAAU,IAAI,CAAA;AAClC,IAAA,IAAI,IAAA,CAAK,gBAAe,EAAG;AACzB,MAAA,MAAM,MAAA,GAASC,qBAAa,IAAI,CAAA;AAGhC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0BC,iBAAA,CAAQ,IAAI,CAAC,CAAA;AAC1D,MAAA,MAAM,UAAA,GAAa,UAAA,IAAcA,iBAAA,CAAQ,IAAI,CAAA;AAC7C,MAAA,OAAOJ,iBAAA,CAAQ,YAAY,MAAM,CAAA;AAAA,IACnC;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAIA,EAAA,IAAI,MAAA,GAASI,kBAAQ,IAAI,CAAA;AACzB,EAAA,IAAI,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,OAAO,MAAA,KAAWA,iBAAA,CAAQ,MAAM,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAOH,qBAAa,MAAM,CAAA;AAEhC,MAAA,OAAOD,iBAAA,CAAQ,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IACnC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAMI,iBAAA,CAAQ,MAAM,EAAE,MAAM,CAAA;AAC1C,MAAA,MAAA,GAASA,kBAAQ,MAAM,CAAA;AAAA,IACzB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,UAAA,uBAAiB,GAAA,CAAI,CAAC,kBAAkB,mBAAA,EAAqB,WAAA,EAAa,WAAW,CAAC,CAAA;AAM5F,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA,EACvC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,kBAAA,GAAqB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAuBnD,SAAS,gBAAgB,KAAA,EAAwB;AAKtD,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,GAAG,EAAE,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CAAE,WAAA,EAAY;AAC9E,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEpC,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AACjE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAElC,EAAA,IAAI,uBAAA,CAAwB,QAAA,CAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAClD,EAAA,IAAI,oBAAoB,QAAA,CAAS,QAAA,CAAS,SAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAChE,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAwB,KAAA,EAAwB;AAEvD,EAAA,IAAI,KAAA,KAAU,gBAAgB,OAAO,KAAA;AACrC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,EAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,UAAU,MAAA,IAAU,KAAA,KAAU,cAAA,IAAkB,KAAA,KAAU,SAAS,OAAO,IAAA;AAC9E,EAAA,OAAO,wBAAA,CAAyB,IAAI,KAAK,CAAA;AAC3C;AAEA,SAAS,oBAAoB,QAAA,EAA2B;AACtD,EAAA,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AACrC,EAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,KAAA,MAAW,UAAU,kBAAA,EAAoB;AACvC,IAAA,IAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,IAAA;AAAA,EACxC;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,kBAAA,GAAqB,yBAAA;AA0BpB,SAAS,qBAAqB,KAAA,EAAqB;AACxD,EAAA,wBAAA,CAAyB,KAAK,CAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,mBAAmB,KAAK,CAAA;AAC3C,EAAA,qBAAA,CAAsB,OAAO,UAAU,CAAA;AACzC;AAEA,SAAS,yBAAyB,KAAA,EAAqB;AACrD,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,YAAY,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACF;AAEA,SAAS,mBAAmB,KAAA,EAAuB;AAGjD,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,KAAK,CAAA,EAAG;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,mBAAmB,OAAO,CAAA;AACvC,MAAA,IAAI,SAAS,OAAA,EAAS;AACtB,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,0BAA0B,CAAA;AAAA,IAChE;AAAA,EACF;AAEA,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACnC;AAEA,SAAS,qBAAA,CAAsB,OAAe,UAAA,EAA0B;AACtE,EAAA,KAAA,MAAW,OAAA,IAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,EAAG;AAC3C,IAAA,IAAI,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,OAAA,EAAS;AAC3C,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,IAChD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,EAChD;AACF;AAuBO,SAAS,kBAAA,CAAmB,OAAe,OAAA,EAAuC;AACvF,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,EAAA;AAClC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,SAAS,MAAA,EAAQ;AAC/C,IAAA,MAAM,IAAIN,oCAAA,CAAmB,CAAA,kCAAA,EAAqC,MAAM,CAAA,IAAA,EAAO,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACvF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAWA,EAAA,MAAM,WAAA,GAAc,sBAAsB,KAAK,CAAA;AAC/C,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,oBAAA,EAAuB,WAAW,CAAA,GAAA,EAAM,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MAC7E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AACnC,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,yCAAA,EAA4C,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACjF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAM,WAAA,EAAY;AAC3B;AAwBO,SAAS,iBAAA,CAAkB,IAAY,OAAA,EAAuC;AACnF,EAAA,IAAI,EAAA,CAAG,WAAW,CAAA,EAAG;AACnB,IAAA,MAAM,IAAIA,qCAAmB,wCAAA,EAA0C;AAAA,MACrE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,GAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,GAAG,WAAA,EAAY;AAC7B,EAAA,IAAI,MAAM,MAAA,IAAU,MAAA,IAAU,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,CAAA,EAAA,EAAKO,sBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,EAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACxE","file":"chunk-VHY6NVCJ.cjs","sourcesContent":["/**\n * Canonical path-guard module (ADRs D79-D81).\n *\n * Three primitives + one typed error:\n *   - `safePathJoin(base, ...parts)` — resolve THEN prefix-check (ADR D80).\n *   - `assertNoSymlinkEscape(path, base)` — `realpathSync` resolves entire\n *     symlink chain (EC-1 fix; Hermes v0.2 #386, #61).\n *   - `sanitizeIdentifier(input, { maxLen })` — strict grammar\n *     `^[a-z0-9][a-z0-9-_]*$` (ADR D81; case-insensitive on input,\n *     lowercase on output).\n *   - `PathTraversalError` — extends ConfigurationError with code\n *     `path_traversal` (ADR D65: no new hierarchy).\n *\n * Wire at all sites where user input becomes a path. CI lint gate\n * `tests/lint/no-unguarded-path-input.test.ts` prevents regression\n * (ADR D85).\n *\n * @internal\n */\n\nimport { createHash } from \"node:crypto\";\nimport { lstatSync, readlinkSync, realpathSync, type Stats } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\n\nimport { ConfigurationError } from \"../../errors.js\";\nimport { atOrInsideRoot } from \"./path-containment.js\";\n\n/**\n * Thrown when a path operation would escape its allowed base directory.\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n */\nexport class PathTraversalError extends ConfigurationError {\n  override readonly name: string = \"PathTraversalError\";\n\n  constructor(input: string, resolvedPath: string) {\n    super(`Path traversal attempt: ${input} → ${resolvedPath}`, {\n      code: \"path_traversal\",\n    });\n  }\n}\n\n/**\n * Thrown when an agent tool is asked to read or write a sensitive path\n * that the blocklist forbids (`.env`, `.git/`, `node_modules/`, `.theo/`,\n * lock files). Distinct from `PathTraversalError` because the path is\n * lexically inside the project — it is just sensitive.\n *\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n * @public\n */\nexport class ForbiddenPathError extends ConfigurationError {\n  override readonly name: string = \"ForbiddenPathError\";\n\n  constructor(path: string) {\n    super(\n      `Path '${path}' is in the sensitive-file blocklist (.env, .git/, node_modules/, .theo/, lock files)`,\n      {\n        code: \"forbidden_path\",\n      },\n    );\n  }\n}\n\n/**\n * Is `target` the same as `base`, or strictly under it?\n *\n * The prefix must not double the separator. `resolve` strips a trailing `sep` from every base\n * EXCEPT the filesystem root, where `resolve(sep) === sep`; there `base + sep` would be `//`, which\n * no absolute path starts with, so a root base rejected EVERY path (#149). Only the root takes that\n * branch — for any other base the prefix is unchanged, so containment is not weakened.\n *\n * Both containment checks in this module go through here: they had the same defect and were fixed\n * one at a time, which is exactly how the two drifted apart in the first place.\n *\n * Both arguments MUST already be resolved absolute paths.\n */\nfunction isInside(target: string, base: string): boolean {\n  // B-117 — compared after symlink resolution, via the shared rule. A prefix test judges a link by\n  // its NAME: `<base>/link/x` where `link` points outside is lexically inside and physically not.\n  // Measured reachable from the plugin manager and the MCP client before this was changed.\n  //\n  // The root itself stays allowed, which `insideRoot` alone does not answer: it returns false for\n  // `target === base` (correct for its own caller, wrong here, where `safePathJoin(base)` with no\n  // parts must return `base`). Kept as an explicit second clause rather than by weakening the\n  // shared rule for everyone.\n  return atOrInsideRoot(target, base);\n}\n\n/**\n * Join `base` with `...parts` and ensure the resolved absolute path stays\n * under `base`. Resolves FIRST, then prefix-checks (ADR D80) — prevents\n * normalized-escape bypasses like `subdir/.\\\\./bar`.\n *\n * Returns the safe absolute path. Throws `PathTraversalError` if escape.\n *\n */\nexport function safePathJoin(base: string, ...parts: string[]): string {\n  if (base === \"\") {\n    throw new Error(\"safePathJoin: base must be non-empty\");\n  }\n  // T5.5 — NUL byte + C0/DEL control char rejection at the boundary.\n  // Apply before path resolution so a malicious input never reaches\n  // `resolve` (which on some platforms behaved unexpectedly with NUL\n  // and in N-API callers historically silently truncated).\n  rejectNulAndControlChars(base, \"base\");\n  for (const part of parts) {\n    rejectNulAndControlChars(part, \"path segment\");\n  }\n  const baseResolved = resolve(base);\n  const target = resolve(base, ...parts);\n  if (!isInside(target, baseResolved)) {\n    throw new PathTraversalError(parts.join(\"/\"), target);\n  }\n  return target;\n}\n\n/**\n * T5.5 — the operator-legible label for the first NUL (`\\x00`), C0 control char (`\\x01-\\x1F`) or\n * DEL (`\\x7F`) in `input`, or `undefined` when it carries none. Centralizes the scan so every\n * public path-guard / sanitize entrypoint shares one definition of \"control character\".\n *\n * Detection is separated from the throw so the two callers can share the scan and the precise\n * diagnostic while each raising the error ITS OWN contract documents (#368) — a path guard reports\n * a traversal, an identifier validator reports an invalid identifier. Before that split both threw\n * `PathTraversalError`, which made an identifier validator's error class depend on the bytes of the\n * input it was handed.\n *\n * @internal\n */\nfunction firstControlCharLabel(input: string): string | undefined {\n  for (let i = 0; i < input.length; i++) {\n    const code = input.charCodeAt(i);\n    if (code === 0x00 || (code >= 0x01 && code <= 0x1f) || code === 0x7f) {\n      return code === 0x00 ? \"<nul-byte>\" : `<control-char-0x${code.toString(16)}>`;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Reject any path-shaped input carrying a NUL or control character, as `PathTraversalError` — the\n * same shape as every other path-shape rejection, so callers do not learn a second error class.\n *\n * @internal\n */\nfunction rejectNulAndControlChars(input: string, role: string): void {\n  const label = firstControlCharLabel(input);\n  if (label !== undefined) throw new PathTraversalError(`${role}: ${input}`, label);\n}\n\n/**\n * Assert that `path` — including every directory component in the chain —\n * stays under `base` after symlink resolution. No-op when nothing on the\n * path exists yet.\n *\n * Two-bug history:\n *   1. **EC-1** (original fix, kept): a multi-level symlink chain A → B → C\n *      must be resolved end-to-end. `realpathSync` does this in 1 syscall.\n *   2. **Defence-in-depth** (added v1.x): the previous implementation only\n *      called `lstatSync(path)` on the terminal component. If an INTERMEDIATE\n *      directory was a symlink (`base/inner-symlink → /outside`), `lstat` on\n *      `base/inner-symlink/file.txt` followed the symlink and reported the\n *      regular file — escape went undetected. Fix: walk up to the nearest\n *      existing ancestor and `realpath` THAT, then re-attach the suffix and\n *      check the result against the canonical base.\n *\n */\nexport function assertNoSymlinkEscape(path: string, base: string): void {\n  // T5.5 — reject NUL / control chars before any FS call (a NUL byte\n  // in the path used to silently truncate at the C boundary on legacy\n  // libc — defense in depth even on modern Node).\n  rejectNulAndControlChars(path, \"path\");\n  rejectNulAndControlChars(base, \"base\");\n  // Canonical base — symlinks in the base path itself are absorbed once here.\n  let baseResolved: string;\n  try {\n    baseResolved = realpathSync(base);\n  } catch {\n    // base doesn't exist as a real directory yet — fall back to lexical resolve.\n    baseResolved = resolve(base);\n  }\n\n  // Find the deepest ancestor of `path` that exists, then realpath it.\n  // Anything from there onward is \"not yet on disk\" and contributes only\n  // its lexical suffix. This covers three cases:\n  //   - path exists (regular file or symlink at any depth) → realpath the full path\n  //   - path doesn't exist but intermediate dir is a symlink → realpath the ancestor\n  //   - nothing on the path exists → no escape risk (return)\n  const resolved = realpathOfDeepestExisting(path);\n  if (resolved === undefined) return; // path has no existing prefix — nothing to attack\n\n  if (!isInside(resolved, baseResolved)) {\n    throw new PathTraversalError(`symlink ${path}`, resolved);\n  }\n}\n\n/**\n * Find the deepest ancestor of `path` that exists on disk, resolve all\n * symlinks in that ancestor via `realpathSync`, and re-attach the\n * lexical suffix. Returns `undefined` when no ancestor exists.\n *\n * Handles dangling symlinks: if the terminal IS a symlink but its target\n * is missing, we still detect escape via `readlinkSync` + parent resolve.\n */\nfunction realpathOfDeepestExisting(path: string): string | undefined {\n  // First try the full path — the common case.\n  try {\n    return realpathSync(path);\n  } catch {\n    // Not resolvable. Two sub-cases.\n  }\n\n  // Sub-case A: terminal is a dangling symlink.\n  try {\n    const stat: Stats = lstatSync(path);\n    if (stat.isSymbolicLink()) {\n      const target = readlinkSync(path);\n      // Resolve target relative to the REAL parent dir, so intermediate\n      // symlinks in the parent chain are absorbed.\n      const parentReal = realpathOfDeepestExisting(dirname(path));\n      const parentBase = parentReal ?? dirname(path);\n      return resolve(parentBase, target);\n    }\n  } catch {\n    // lstat failed too — terminal doesn't exist at all.\n  }\n\n  // Sub-case B: walk up to the nearest existing ancestor, then re-attach\n  // the suffix lexically.\n  let cursor = dirname(path);\n  let suffix = path.slice(cursor.length);\n  while (cursor !== dirname(cursor)) {\n    try {\n      const real = realpathSync(cursor);\n      // Reconstruct: ancestor's realpath + remaining (still-lexical) suffix\n      return resolve(real, `.${suffix}`);\n    } catch {\n      suffix = path.slice(dirname(cursor).length);\n      cursor = dirname(cursor);\n    }\n  }\n  // Reached filesystem root without finding any existing ancestor.\n  return undefined;\n}\n\nconst LOCK_FILES = new Set([\"pnpm-lock.yaml\", \"package-lock.json\", \"yarn.lock\", \"bun.lockb\"]);\n\n// T5.6 — top-level credential dot-dirs / dot-files. Matching against\n// the FIRST path segment (lowercase). Adding any entry here costs a\n// CHANGELOG note + an explicit case-fold test (entries are lowercased\n// at module load).\nconst SENSITIVE_FIRST_SEGMENTS = new Set([\n  \".ssh\",\n  \".aws\",\n  \".docker\",\n  \".kube\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — credential basenames blocked at ANY depth (lowercase). Catches\n// the developer-laptop case where an agent recurses into a subdir.\nconst SENSITIVE_BASENAMES = new Set([\n  \"id_rsa\",\n  \"id_ed25519\",\n  \"id_ecdsa\",\n  \"id_dsa\",\n  \"authorized_keys\",\n  \"known_hosts\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — extension suffixes blocked at ANY depth (lowercase). Covers\n// the entire `*.pem` / `*.key` private-material family.\nconst SENSITIVE_SUFFIXES = [\".pem\", \".key\", \".p12\", \".pfx\"];\n\n/**\n * Decide whether a project-relative path points to a known-sensitive file\n * that a coding agent must not read or write.\n *\n * Universal blocklist (works for any agent operating on a project tree):\n *\n *   - `.env`, `.env.<anything>` — except `.env.example` (template safe to read)\n *   - `.git/` — version control internals\n *   - `node_modules/` — dependency cache (changes don't belong to the user)\n *   - `.theo/` — TheoKit build artefacts / state\n *   - Lock files at any depth: `pnpm-lock.yaml`, `package-lock.json`,\n *     `yarn.lock`, `bun.lockb`\n *\n * Operates on path segments (forward-slash normalized). Cross-platform safe.\n *\n * Use together with `safePathJoin` + `assertNoSymlinkEscape`: the former two\n * defeat traversal, this one defeats reading a file that is lexically inside\n * the project but should not be agent-visible.\n *\n * @public\n */\nexport function isForbiddenPath(input: string): boolean {\n  // T5.6 — lowercase normalization defeats case-only bypass on\n  // case-insensitive filesystems (Windows/macOS-default) where `.ENV`\n  // and `.env` map to the same inode but a case-sensitive string\n  // check passes the former.\n  const normalized = input.replace(/\\\\/g, \"/\").replace(/^\\.\\//, \"\").toLowerCase();\n  if (normalized.length === 0) return false;\n\n  const segments = normalized.split(\"/\").filter((s) => s.length > 0);\n  if (segments.length === 0) return false;\n\n  if (isForbiddenFirstSegment(segments[0]!)) return true;\n  if (isForbiddenBasename(segments[segments.length - 1]!)) return true;\n  return false;\n}\n\nfunction isForbiddenFirstSegment(first: string): boolean {\n  // .env.example is explicitly allowlisted (template safe to read)\n  if (first === \".env.example\") return false;\n  if (first === \".env\") return true;\n  if (/^\\.env\\./.test(first)) return true;\n  if (first === \".git\" || first === \"node_modules\" || first === \".theo\") return true;\n  return SENSITIVE_FIRST_SEGMENTS.has(first);\n}\n\nfunction isForbiddenBasename(basename: string): boolean {\n  if (LOCK_FILES.has(basename)) return true;\n  if (SENSITIVE_BASENAMES.has(basename)) return true;\n  for (const suffix of SENSITIVE_SUFFIXES) {\n    if (basename.endsWith(suffix)) return true;\n  }\n  return false;\n}\n\nconst IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9\\-_]*$/i;\n\n/**\n * T1.4 — validate a relative artifact path string BEFORE it is used to look\n * up a fixture or to fetch from PaaS. Rejects every well-known traversal\n * vector at the boundary, throwing `PathTraversalError`.\n *\n * Vectors rejected:\n *  - classic `..` parent-directory traversal (any segment).\n *  - backslash separators (Windows-style `..\\\\windows`).\n *  - URL-encoded `%2e%2e` / `%2E%2E` (double-decoded traversal).\n *  - NUL byte injection (`\\x00`).\n *  - Windows drive letter prefix (`C:`, `D:\\\\...`).\n *  - Home-tilde expansion (`~/`, `~root/...`).\n *  - Absolute paths starting with `/`.\n *\n * Does NOT touch the filesystem — the call is shape-only. Live symlink\n * traversal protection happens via `assertNoSymlinkEscape` at the FS-resolve\n * boundary.\n *\n * @param input - Caller-supplied artifact path.\n * @throws `PathTraversalError` on any rejection.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function validateArtifactPath(input: string): void {\n  rejectKnownPrefixVectors(input);\n  const normalized = decodeAndNormalize(input);\n  rejectParentTraversal(input, normalized);\n}\n\nfunction rejectKnownPrefixVectors(input: string): void {\n  if (input.includes(\"\\x00\")) {\n    throw new PathTraversalError(input, \"<nul-byte>\");\n  }\n  if (input.startsWith(\"/\") || input.startsWith(\"~\")) {\n    throw new PathTraversalError(input, input);\n  }\n  if (/^[A-Za-z]:[\\\\/]?/.test(input)) {\n    throw new PathTraversalError(input, input);\n  }\n}\n\nfunction decodeAndNormalize(input: string): string {\n  // URL-encoded traversal — 2 passes catches `%252e%252e`.\n  // Malformed sequences (decodeURIComponent throws) are themselves a rejection.\n  let decoded = input;\n  for (let i = 0; i < 2; i += 1) {\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      throw new PathTraversalError(input, \"<malformed-url-encoding>\");\n    }\n  }\n  // Normalize backslash to forward slash before segment-walking.\n  return decoded.replace(/\\\\/g, \"/\");\n}\n\nfunction rejectParentTraversal(input: string, normalized: string): void {\n  for (const segment of normalized.split(\"/\")) {\n    if (segment === \"..\" || segment === \"..%00\") {\n      throw new PathTraversalError(input, normalized);\n    }\n  }\n  // Defense in depth: literal `..` anywhere in the normalized string.\n  if (normalized.includes(\"..\")) {\n    throw new PathTraversalError(input, normalized);\n  }\n}\n\n/**\n * Validate that `input` is a safe path component (skill name, agent ID,\n * namespace, etc.) and return its lowercase form. Strict grammar\n * `^[a-z0-9][a-z0-9-_]*$` rejects path separators, dots, null bytes,\n * whitespace, unicode invisible chars, and any leading `-`/`_`.\n *\n * ONE error class leaves this function: `ConfigurationError` with code\n * `invalid_identifier`, for every rejection — length out of range, a path\n * separator, `..`, a space, a leading `-`, and a NUL / C0 control char / DEL\n * alike. A caller can branch on that code and know it has covered the whole\n * rejection surface.\n *\n * Before #368 the control-char branch threw `PathTraversalError` instead, which\n * made the error CLASS a function of the attacker's bytes; the message still names\n * the offending byte, which is the part that was worth keeping.\n *\n * @param input - User-supplied identifier candidate.\n * @param options.maxLen - Maximum allowed length (default 64).\n * @returns Lowercase form of `input`.\n * @throws `ConfigurationError` with code `invalid_identifier` on every rejection.\n */\nexport function sanitizeIdentifier(input: string, options?: { maxLen?: number }): string {\n  const maxLen = options?.maxLen ?? 64;\n  if (input.length === 0 || input.length > maxLen) {\n    throw new ConfigurationError(`Identifier length out of range (1-${maxLen}): \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  // T5.5 — explicit NUL / control char rejection ahead of the generic pattern check. The\n  // IDENTIFIER_PATTERN regex already excludes these (they are not in `[a-z0-9\\-_]`); naming the\n  // offending byte gives operators a precise diagnostic instead of the generic \"invalid characters\"\n  // message, which is what makes a prompt-injection trace legible (Rule 3).\n  //\n  // #368 — the diagnostic used to arrive as a `PathTraversalError`, because the branch reused\n  // `safePathJoin`'s thrower. That made the error CLASS a function of the attacker's bytes: a\n  // caller branching on the documented `invalid_identifier` rethrew for any input carrying a\n  // control char, so a rejection surfaced as a 500 and the 400/500 split became an oracle. The\n  // detection is shared; the error each contract documents is not.\n  const controlChar = firstControlCharLabel(input);\n  if (controlChar !== undefined) {\n    throw new ConfigurationError(`Identifier contains ${controlChar}: \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  if (!IDENTIFIER_PATTERN.test(input)) {\n    throw new ConfigurationError(`Identifier contains invalid characters: \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  return input.toLowerCase();\n}\n\n/**\n * Convert ANY opaque id (agent id, run id, conversation id, namespace, email,\n * arbitrary string) into a deterministic, filesystem-safe filename component.\n *\n * Unlike {@link sanitizeIdentifier} (which THROWS on non-conforming input),\n * this is a total function: it NEVER throws on a non-empty string. It returns\n * the lowercased id verbatim when it already matches the safe grammar\n * `^[a-z0-9][a-z0-9-_]*$` and fits `maxLen` (so UUIDs, hashes, and slugs stay\n * human-readable), otherwise a deterministic `h-<16 hex>` sha256 token\n * (collision-resistant and always a valid filename). The output charset is\n * always `[a-z0-9_-]`, safe as a literal path segment on every filesystem.\n *\n * @param id - any opaque identifier (must be a non-empty string)\n * @param options.maxLen - max length for the passthrough branch (default 128).\n *   Ids longer than this are hashed; the hash token itself is always short.\n * @throws ConfigurationError (code `invalid_filename_id`) only on empty input.\n *\n * @example\n *   safeFilenameForId(\"550e8400-e29b-41d4-a716-446655440000\") // passthrough\n *   safeFilenameForId(\"user@example.com\")                      // \"h-<16hex>\"\n *\n */\nexport function safeFilenameForId(id: string, options?: { maxLen?: number }): string {\n  if (id.length === 0) {\n    throw new ConfigurationError(\"Filename id must be a non-empty string\", {\n      code: \"invalid_filename_id\",\n    });\n  }\n  const maxLen = options?.maxLen ?? 128;\n  const lower = id.toLowerCase();\n  if (lower.length <= maxLen && IDENTIFIER_PATTERN.test(lower)) {\n    return lower;\n  }\n  return `h-${createHash(\"sha256\").update(id).digest(\"hex\").slice(0, 16)}`;\n}\n"]}

package/dist/{chunk-ZQWRUJHE.js → chunk-WAKGYSQ6.js}

@@ -1,53 +1,53 @@
-import { submit, emitRunEvent } from './chunk-HWMGR3HA.js';
-import { enqueueSessionWrite, hydrateSession, persistTurnToTranscript, flushSessionWrites, appendSessionMessage, getSessionMessages, discardSession, clearSession } from './chunk-VNRNZ3WI.js';
-import { IndexManager } from './chunk-3BBTHFGJ.js';
-import { currentPersonalityContext, warnPersonalitySwitchInsideFork } from './chunk-HJ2LV464.js';
+import { submit, emitRunEvent } from './chunk-GEQLHBJM.js';
+import { enqueueSessionWrite, hydrateSession, persistTurnToTranscript, flushSessionWrites, appendSessionMessage, getSessionMessages, discardSession, clearSession } from './chunk-4OMRDNPY.js';
+import { IndexManager } from './chunk-L5B7EWWH.js';
+import { currentPersonalityContext, warnPersonalitySwitchInsideFork } from './chunk-ZUWVO442.js';
 import { extractCodePlugins, isCodePlugin } from './chunk-2SFBB54R.js';
-import { createOpenAiCompatibleRuntime } from './chunk-VCQ37TC5.js';
-import { persistActiveMemoryTranscript } from './chunk-QK2ERTO3.js';
-import { resolveMaxFacts, writeSessionSummary, resolveMemoryRoot, MEMORY_KINDS, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-LCCT5ZXJ.js';
-import { FsSessionStore } from './chunk-RGVMJU57.js';
-import { discoverProviderPlugins, validateApiKeyShape, getConfiguredBaseUrl, httpRequest, isFixtureApiKey, presentProviderCredentialEnvVars, readTrustArray, buildDefaultSummarizer, shouldUseRealLocalRuntime, parseSseStream, CircuitBreaker, trustFilePath, resolveRunProvider, mergeExplicitApiKey, resolveProviderChain, abortError, tryFirstEvent, relayStream, renderToolResultContentText } from './chunk-26GI3OYA.js';
+import { createOpenAiCompatibleRuntime } from './chunk-TTXRNCXY.js';
+import { persistActiveMemoryTranscript } from './chunk-BH6M2DGV.js';
+import { resolveMaxFacts, writeSessionSummary, resolveMemoryRoot, MEMORY_KINDS, appendFact, readFacts, legacyMemoryJsonPath, memoryMdPath, appendFactToMarkdown } from './chunk-DB5RYCXX.js';
+import { FsSessionStore } from './chunk-P7B64NFK.js';
+import { discoverProviderPlugins, validateApiKeyShape, getConfiguredBaseUrl, httpRequest, isFixtureApiKey, presentProviderCredentialEnvVars, readTrustArray, buildDefaultSummarizer, shouldUseRealLocalRuntime, parseSseStream, CircuitBreaker, trustFilePath, resolveRunProvider, mergeExplicitApiKey, resolveProviderChain, abortError, tryFirstEvent, relayStream, renderToolResultContentText } from './chunk-HFEAU2L2.js';
 import { resolveChildEnv } from './chunk-HKCKOAIO.js';
-import { DEFAULT_MAX_BYTES_PER_FILE, runDiscovery, truncateWithMarker } from './chunk-KCM3RMKR.js';
-import { warnFailureOnce, loadHookConfig, warnOnce } from './chunk-XJ3WU5CZ.js';
-import { getTokens, lockedRefresh, refreshAccessToken, runPkceFlow, setTokens } from './chunk-X7CE7Y5W.js';
-import { readVersionedJson, writeVersionedJson } from './chunk-OLJOI4LK.js';
+import { DEFAULT_MAX_BYTES_PER_FILE, runDiscovery, truncateWithMarker } from './chunk-YUQNHLKN.js';
+import { warnFailureOnce, loadHookConfig, warnOnce } from './chunk-S7IZEVXX.js';
+import { getTokens, lockedRefresh, refreshAccessToken, runPkceFlow, setTokens } from './chunk-LG4JCJEI.js';
+import { readVersionedJson, writeVersionedJson } from './chunk-CN732Z5C.js';
 import { toJsonSchema } from './chunk-7I5Z3UBJ.js';
-import { sanitizeToolInput } from './chunk-FJWQP6EE.js';
-import { withInheritedSubAgentCredentials, subAgentToolsFromDefinitions } from './chunk-VZGE7NAI.js';
+import { sanitizeToolInput } from './chunk-WJ6OGKAO.js';
+import { withInheritedSubAgentCredentials, subAgentToolsFromDefinitions } from './chunk-S5ERB3CH.js';
 import { setAgentFacade } from './chunk-6X6ID4MO.js';
-import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter } from './chunk-2HXTNVLM.js';
-import { withToolWhitelist, checkToolWhitelist } from './chunk-SAGRF4IB.js';
-import { validateArtifactPath, PathTraversalError, safePathJoin } from './chunk-PKRPV3R7.js';
-import { insideRoot, atOrInsideRoot } from './chunk-UKMBRMGT.js';
+import { escapeBlockBody, buildSkillsBlock, discoverSkills, stripSkillFrontmatter } from './chunk-LSURFRJA.js';
+import { withToolWhitelist, checkToolWhitelist } from './chunk-S2CMEJ5F.js';
+import { validateArtifactPath, PathTraversalError, safePathJoin } from './chunk-NO6AG22P.js';
+import { insideRoot, atOrInsideRoot } from './chunk-DGO4LPLP.js';
 import { mapWithConcurrency } from './chunk-ORLTGPOS.js';
-import { expandTilde, defaultBaseDir } from './chunk-XESYJ4JC.js';
+import { expandTilde, defaultBaseDir } from './chunk-3VX7JHJI.js';
 import { withFileLock } from './chunk-FGGVSHDW.js';
 import { withCwdMutex } from './chunk-PPU2D4FZ.js';
-import { sweepStaleAtomicTemps, atomicWriteJson } from './chunk-M4U24U6G.js';
-import { loadSubagents, pluginBundleDirs } from './chunk-WM646HEN.js';
-import { reportUndeclaredSources, theokitConfigRoot, undefinedVariablesIn, getTheokitHome, adapterForConfigPath, adaptersForSurface, projectConfigRoots, pluginBundleRoots } from './chunk-YMVTUV5K.js';
-import { readWorkspaceDir, parseSimpleYaml } from './chunk-Q7UG242V.js';
+import { sweepStaleAtomicTemps, atomicWriteJson } from './chunk-AZK3QM36.js';
+import { loadSubagents, pluginBundleDirs } from './chunk-MTNCJ7MQ.js';
+import { reportUndeclaredSources, theokitConfigRoot, undefinedVariablesIn, getTheokitHome, adapterForConfigPath, adaptersForSurface, projectConfigRoots, pluginBundleRoots } from './chunk-PISZRLES.js';
+import { readWorkspaceDir, parseSimpleYaml } from './chunk-TIYQDJFK.js';
 import { resolveEffectiveContextWindow, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN } from './chunk-SZQFCHU6.js';
-import { isAnthropicFamilyModel } from './chunk-CBBT42VX.js';
+import { isAnthropicFamilyModel } from './chunk-CMDM4VF6.js';
 import { parseModelId } from './chunk-R7WIIPUR.js';
-import { getProviderProfile } from './chunk-YKNBTHMD.js';
-import { getCatalogModelInfo, isPatchedModelKey } from './chunk-RZL2W4C3.js';
+import { getProviderProfile } from './chunk-AQ23NII7.js';
+import { getCatalogModelInfo, isPatchedModelKey } from './chunk-5L7S2VOL.js';
 import { globalSingleton } from './chunk-AGACYRJ2.js';
 import { boundFetch } from './chunk-Q7GYMXVC.js';
 import { AgentRunError, coerceToKnownAgentRunErrorCode, UnknownAgentError, ConfigurationError, AuthenticationError, AgentDisposedError, UnsupportedRunOperationError, TheokitAgentError, NetworkError } from './chunk-TNFOU6SB.js';
 import { diag, resolveApiKey, diagFailure, API_KEY_ENV_VAR, redactSecrets } from './chunk-3OY6H3I7.js';
-import { stat, mkdir, readFile, readdir, access, unlink } from 'fs/promises';
-import { randomUUID, createHash } from 'crypto';
-import { join, dirname, isAbsolute, delimiter, resolve, relative } from 'path';
-import { existsSync, readFileSync, realpathSync, accessSync, constants } from 'fs';
-import { platform } from 'process';
-import { spawn } from 'child_process';
-import { pathToFileURL } from 'url';
+import { stat, mkdir, readFile, readdir, access, unlink } from 'node:fs/promises';
+import { randomUUID, createHash } from 'node:crypto';
+import { join, dirname, isAbsolute, delimiter, resolve, relative } from 'node:path';
+import { existsSync, readFileSync, realpathSync, accessSync, constants } from 'node:fs';
+import { platform } from 'node:process';
+import { spawn } from 'node:child_process';
+import { pathToFileURL } from 'node:url';
 import { z } from 'zod';
-import { createRequire } from 'module';
-import { homedir } from 'os';
+import { createRequire } from 'node:module';
+import { homedir } from 'node:os';
 
 // src/agent-builder.ts
 var AgentBuilder = class {
@@ -163,7 +163,7 @@ async function agentGenerate(agent, agentModel, agentApiKey, agentLocal, input,
   const { output, maxRetries, errorStrategy, ...sendOptions } = options;
   const run = await agent.send(input, sendOptions);
   const result = await run.wait();
-  const { generateObjectImpl, GenerateObjectError } = await import('./generate-object-TBDOBBYW.js');
+  const { generateObjectImpl, GenerateObjectError } = await import('./generate-object-RPBXY2U3.js');
   const answer = structurableAnswerOrThrow(result, GenerateObjectError);
   const { getAgentFacade } = await import('./agent-factory-registry-ZVTABLEY.js');
   const facade = getAgentFacade();
@@ -9844,9 +9844,9 @@ async function* localAgentStreamToCompletion(agent, message, options) {
   return yield* streamToCompletionImpl({ send: (m, o) => agent.send(m, o) }, message, options);
 }
 async function localAgentFork(parent, options) {
-  const { forkAgentImpl } = await import('./fork-agent-S2EPIML7.js');
+  const { forkAgentImpl } = await import('./fork-agent-BHVTALT5.js');
   const { getAgentFacade } = await import('./agent-factory-registry-ZVTABLEY.js');
-  const { withPersonalityContext } = await import('./context-7EBZST3L.js');
+  const { withPersonalityContext } = await import('./context-4XSD2V3G.js');
   const create = getAgentFacade().create;
   return withPersonalityContext(
     { slug: parent.personalitySlugSnapshot, isFork: true },
@@ -11450,7 +11450,7 @@ var Agent = class _Agent {
    * @public
    */
   static async generateObject(options) {
-    const { generateObjectImpl } = await import('./generate-object-TBDOBBYW.js');
+    const { generateObjectImpl } = await import('./generate-object-RPBXY2U3.js');
     return generateObjectImpl(options, {
       create: (opts) => _Agent.create(opts),
       delete: (agentId) => _Agent.delete(agentId)
@@ -11474,7 +11474,7 @@ var Agent = class _Agent {
       delete: (agentId) => _Agent.delete(agentId)
     };
     async function* wrapper() {
-      streamObjectImport ??= import('./stream-object-EKM4WGTI.js');
+      streamObjectImport ??= import('./stream-object-3AU7QDHT.js');
       const { streamObjectImpl } = await streamObjectImport;
       yield* streamObjectImpl(options, deps);
     }
@@ -11498,7 +11498,7 @@ var Agent = class _Agent {
    * @public
    */
   static async batch(prompts, options) {
-    const { batchImpl } = await import('./batch-N2XDYZED.js');
+    const { batchImpl } = await import('./batch-7IGV2OKA.js');
     return batchImpl(prompts, options, { create: (opts) => _Agent.create(opts) });
   }
   /**
@@ -11659,7 +11659,7 @@ var Agent = class _Agent {
    */
   static async compact(agentId, options = {}) {
     const reg = await requireLocalAgent(agentId, "compact");
-    const { compactSessionTranscript, buildDefaultSummarizer: buildDefaultSummarizer2 } = await import('./compact-session-F3J3FMEU.js');
+    const { compactSessionTranscript, buildDefaultSummarizer: buildDefaultSummarizer2 } = await import('./compact-session-ZPEJSTLA.js');
     const { cwd, model, store } = await openLocalStore(reg);
     return enqueueSessionWrite(
       cwd,
@@ -11689,7 +11689,7 @@ var Agent = class _Agent {
    */
   static async injectSessionTurn(agentId, turn) {
     const reg = await requireLocalAgent(agentId, "injectSessionTurn");
-    const { injectSessionTurn } = await import('./inject-session-LC2TROHM.js');
+    const { injectSessionTurn } = await import('./inject-session-OMBJKMVD.js');
     const { cwd, model, store } = await openLocalStore(reg);
     await injectSessionTurn({
       store,
@@ -11719,7 +11719,7 @@ var Agent = class _Agent {
    */
   static async transcript(agentId) {
     const reg = await requireLocalAgent(agentId, "transcript");
-    const { readSessionMessages } = await import('./agent-session-store-22GKA7O4.js');
+    const { readSessionMessages } = await import('./agent-session-store-2LQEPS4H.js');
     const { store } = await openLocalStore(reg);
     return readSessionMessages(store, agentId);
   }
@@ -11740,7 +11740,7 @@ var Agent = class _Agent {
    */
   static async describe(agentId) {
     const agent = await getRegisteredAgentOrThrow(agentId);
-    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-SXETS2F2.js');
+    const { loadSubagents: loadSubagents2 } = await import('./subagents-loader-CPFVLWLH.js');
     const settingSources = agent.options.local?.settingSources;
     const subagents = await loadSubagents2(
       agent.cwd ?? process.cwd(),
@@ -11841,13 +11841,13 @@ async function openLocalStore(reg) {
   const model = reg.model?.id ?? (typeof optModel === "string" ? optModel : optModel?.id) ?? "unknown";
   const injected = reg.options.local?.sessionStore;
   if (injected !== void 0) return { cwd, model, store: injected };
-  const { FsSessionStore: FsSessionStore2 } = await import('./fs-session-store-MYQEVUFL.js');
-  const { defaultBaseDir: defaultBaseDir2, expandTilde: expandTilde2 } = await import('./session-transcript-BSHZYYY6.js');
+  const { FsSessionStore: FsSessionStore2 } = await import('./fs-session-store-EZ32TFGB.js');
+  const { defaultBaseDir: defaultBaseDir2, expandTilde: expandTilde2 } = await import('./session-transcript-GU2VE7JX.js');
   const configuredSessionDir = reg.options.local?.sessionDir ?? reg.options.local?.baseDir;
   const baseDir = configuredSessionDir !== void 0 ? expandTilde2(configuredSessionDir) : defaultBaseDir2();
   return { cwd, model, store: new FsSessionStore2({ baseDir, cwd }) };
 }
 
 export { Agent, AgentBuilder, DEFAULT_AGENTIC_MODEL_ID, MEMORY_EMBEDDING_ADAPTERS, Tool, ToolError, UsageAccumulator, computeCost, generateCronId, getPricingEntry, managedSettingsPathFor, openRouterMemoryEmbeddingProviderAdapter, readManagedSettings, resolveSessionDir };
-//# sourceMappingURL=chunk-ZQWRUJHE.js.map
-//# sourceMappingURL=chunk-ZQWRUJHE.js.map
+//# sourceMappingURL=chunk-WAKGYSQ6.js.map
+//# sourceMappingURL=chunk-WAKGYSQ6.js.map