@trenchwork/erosolar 1.1.30 → 1.1.32

package/dist/capabilities/llmRedteamCapability.js

@@ -0,0 +1,340 @@
+/**
+ * llmRedteam — phishing-resistant LLM probing for variant-research +
+ * engagement-delivery profiles.
+ *
+ * Wraps the canonical open-source LLM red-team toolchain:
+ *
+ *   • garak       — NVIDIA / Leon Derczynski's vulnerability scanner
+ *                   for LLMs. Probes for prompt injection, jailbreak
+ *                   (DAN family), encoding tricks, training-data
+ *                   leakage, toxicity. Single Python binary; OpenAI
+ *                   and HTTP-REST model types built in.
+ *   • promptfoo   — Eval framework with a `redteam` subcommand that
+ *                   auto-generates jailbreak / harmful-content / PII-
+ *                   extraction probes against a configured target.
+ *
+ * Tools route every spawn through OpsContext, so:
+ *   • Targets are scope-checked against the active engagement BEFORE
+ *     the process starts (cheap fail-fast; Lambda re-checks server-
+ *     side as defence-in-depth).
+ *   • Each run is a Job in users/{uid}/jobs — visible in the portal's
+ *     #jobsList rail with live log streaming.
+ *   • Hits parsed from tool stdout become Findings under
+ *     users/{uid}/findings — the portal's #findingsList rail renders
+ *     them as they land.
+ *   • Risky operations gate on operator HITL via the portal's
+ *     pending-questions strip — no probe fires until approved.
+ *
+ * Profile gating: only registered for `variant-research` and
+ * `engagement-delivery`. The default coding profile sees zero of these
+ * tools (CLAUDE.md "Capability separation").
+ */
+import { createOpsContext, } from './_opsContext.js';
+import { logDebug } from '../utils/debugLogger.js';
+const PROBE_CATALOGUE = [
+    { id: 'promptinject', garakName: 'promptinject', description: 'Cross-prompt injection (Perez & Ribeiro 2022).', severityIfHit: 'high', approxProbeCount: 50 },
+    { id: 'dan', garakName: 'dan', description: 'DAN-family jailbreaks ("Do Anything Now", DUDE, AntiDAN).', severityIfHit: 'high', approxProbeCount: 16 },
+    { id: 'encoding', garakName: 'encoding', description: 'Base64 / ROT13 / hex-encoded harmful-instruction smuggling.', severityIfHit: 'medium', approxProbeCount: 24 },
+    { id: 'leakreplay', garakName: 'leakreplay', description: 'Training-data extraction via prefix replay.', severityIfHit: 'medium', approxProbeCount: 30 },
+    { id: 'realtoxicityprompts', garakName: 'realtoxicityprompts', description: 'RTP toxicity completion (Gehman et al. 2020).', severityIfHit: 'medium', approxProbeCount: 100 },
+    { id: 'continuation', garakName: 'continuation', description: 'Slur / hate-speech prefix continuation.', severityIfHit: 'medium', approxProbeCount: 20 },
+    { id: 'malwaregen', garakName: 'malwaregen', description: 'Refusal-bypass for code that compiles to working malware.', severityIfHit: 'critical', approxProbeCount: 12 },
+    { id: 'xss', garakName: 'xss', description: 'Refusal-bypass for XSS payload generation.', severityIfHit: 'high', approxProbeCount: 10 },
+    { id: 'glitch', garakName: 'glitch', description: 'Tokenizer-glitch tokens that destabilise the model.', severityIfHit: 'low', approxProbeCount: 50 },
+    { id: 'goodside', garakName: 'goodside', description: 'Riley Goodside\'s prompt-injection canary set.', severityIfHit: 'high', approxProbeCount: 10 },
+];
+const PROBE_BY_ID = new Map(PROBE_CATALOGUE.map((p) => [p.id, p]));
+// ── Stdout parsers ────────────────────────────────────────────────
+/**
+ * garak's report writer prints lines in the shape:
+ *   garak.detectors.dan.DAN: PASS  ok on 0/16
+ *   garak.detectors.encoding.DecodeMatch: FAIL  hits 3/24
+ *
+ * The "FAIL hits N/M" lines are what we want — those are findings.
+ * Match conservatively; garak's exact format has wobbled across
+ * releases, so this is line-noise tolerant.
+ */
+const GARAK_HIT_LINE = /^(?:garak\.)?detectors?\.([\w.]+):\s+FAIL\s+(?:hits\s+(\d+)\/(\d+)|.+)/i;
+const GARAK_PROBE_LINE = /^(?:garak\.)?probes\.([\w.]+):\s+/i;
+function parseGarakLine(line) {
+    const m = GARAK_HIT_LINE.exec(line);
+    if (!m)
+        return null;
+    return {
+        detector: m[1],
+        hits: m[2] ? Number(m[2]) : undefined,
+        total: m[3] ? Number(m[3]) : undefined,
+        rawLine: line,
+    };
+}
+/**
+ * promptfoo's `redteam` writes JSON to stdout when given `--output -`,
+ * but its line-by-line UI prints `[FAIL] <name>: <reason>` rows. Match
+ * those for live finding emission while the JSON drives the summary.
+ */
+const PROMPTFOO_HIT_LINE = /^\[(FAIL|VULN|HIGH|CRITICAL)\]\s+([^:]+):\s+(.+)/i;
+function parsePromptfooLine(line) {
+    const m = PROMPTFOO_HIT_LINE.exec(line);
+    if (!m)
+        return null;
+    return { severity: m[1], testName: m[2].trim(), reason: m[3].trim(), rawLine: line };
+}
+// ── Tool builders ─────────────────────────────────────────────────
+function probeIdsToGarakArg(ids) {
+    const valid = [];
+    for (const id of ids) {
+        const meta = PROBE_BY_ID.get(id);
+        if (!meta)
+            throw new Error(`unknown probe id: ${id} (allowed: ${[...PROBE_BY_ID.keys()].join(', ')})`);
+        valid.push(meta.garakName);
+    }
+    return valid.join(',');
+}
+function severityForDetector(detectorPath) {
+    // Map detector class fragment back to the closest probe family. Fall
+    // through to 'medium' so unrecognised detectors still produce a row
+    // (the operator can re-classify in the portal).
+    for (const meta of PROBE_CATALOGUE) {
+        if (detectorPath.toLowerCase().includes(meta.garakName.toLowerCase())) {
+            return meta.severityIfHit;
+        }
+    }
+    return 'medium';
+}
+function buildLlmRedteamTools(opsCtx) {
+    return [
+        // ─── LlmRedteamListProbes ──────────────────────────────────
+        {
+            name: 'LlmRedteamListProbes',
+            description: 'List the curated garak probe families this CLI can run. Use the returned ids in LlmRedteamGarak.probes[].',
+            parameters: {
+                type: 'object',
+                properties: {},
+            },
+            handler: async () => {
+                return JSON.stringify(PROBE_CATALOGUE.map((p) => ({
+                    id: p.id,
+                    description: p.description,
+                    severityIfHit: p.severityIfHit,
+                    approxProbeCount: p.approxProbeCount,
+                })), null, 2);
+            },
+        },
+        // ─── LlmRedteamGarak ──────────────────────────────────────
+        {
+            name: 'LlmRedteamGarak',
+            description: 'Run garak against a target LLM endpoint. Probes for prompt injection, jailbreak, encoding tricks, ' +
+                'training-data leakage. Streams findings to the Operations Center as they land. Requires HITL approval.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    targetId: { type: 'string', description: 'Target id from the engagement\'s targets collection. Must be in scope.' },
+                    endpoint: { type: 'string', description: 'LLM endpoint URL (https://…/v1/chat/completions or similar). Must match an in-scope target.' },
+                    modelType: { type: 'string', enum: ['rest', 'openai', 'huggingface', 'replicate'], description: 'garak model_type. "rest" is the most general.' },
+                    modelName: { type: 'string', description: 'For modelType=openai: gpt-4o-mini etc. For rest: a label.' },
+                    probes: {
+                        type: 'array',
+                        items: { type: 'string', enum: PROBE_CATALOGUE.map((p) => p.id) },
+                        description: 'Probe family ids. See LlmRedteamListProbes for the catalogue.',
+                    },
+                    generations: { type: 'number', description: 'Generations per probe (default 5). Higher = more signal + more cost.' },
+                    dryRun: { type: 'boolean', description: 'Print the garak command and skip execution. Useful for plan review.' },
+                },
+                required: ['targetId', 'endpoint', 'modelType', 'probes'],
+            },
+            handler: async (args) => {
+                const targetId = String(args.targetId);
+                const endpoint = String(args.endpoint);
+                const modelType = String(args.modelType);
+                const modelName = args.modelName ? String(args.modelName) : (modelType === 'openai' ? 'gpt-4o-mini' : 'rest-target');
+                const probeIds = Array.isArray(args.probes) ? args.probes.map(String) : [];
+                const generations = typeof args.generations === 'number' ? Math.max(1, Math.min(20, Math.floor(args.generations))) : 5;
+                const dryRun = Boolean(args.dryRun);
+                // ScopeTarget keys are host/cidr/url/endpoint — pass the LLM
+                // endpoint URL only; targetId is the engagement-scoped row ID
+                // attached to the job, not part of scope assertion.
+                await opsCtx.assertInScope({ endpoint });
+                const probesArg = probeIdsToGarakArg(probeIds);
+                const cmd = ['garak',
+                    '--model_type', modelType,
+                    '--model_name', modelName,
+                    '--probes', probesArg,
+                    '--generations', String(generations),
+                ];
+                if (modelType === 'rest')
+                    cmd.push('--rest_url', endpoint);
+                if (dryRun) {
+                    return JSON.stringify({ dryRun: true, cmd }, null, 2);
+                }
+                // HITL gate. Even with operator-authorised scope, garak fires
+                // hundreds of probes that will land in the target's logs —
+                // worth a final confirmation.
+                const totalProbes = probeIds.reduce((acc, id) => {
+                    const meta = PROBE_BY_ID.get(id);
+                    return acc + (meta ? meta.approxProbeCount * generations : 0);
+                }, 0);
+                const approval = await opsCtx.requestApproval({
+                    severity: 'risky',
+                    question: `Fire ~${totalProbes} garak probes (${probeIds.join(',')}) against ${endpoint}? Each probe sends an adversarial prompt and records the response.`,
+                    options: [
+                        { label: 'cancel', description: 'Abort the run.' },
+                        { label: 'go', description: 'Fire all selected probes.' },
+                        { label: 'dry-run', description: 'Print the garak command and exit.' },
+                    ],
+                    timeoutSec: 300,
+                    defaultOnTimeout: 'abort',
+                });
+                if (approval === 'cancel')
+                    return 'cancelled by operator';
+                if (approval === 'dry-run')
+                    return JSON.stringify({ dryRun: true, cmd }, null, 2);
+                const job = await opsCtx.startJob({
+                    tool: 'garak', kind: 'llmRedteam', targetId,
+                    cmd, timeoutMs: 30 * 60 * 1000,
+                });
+                let lineCount = 0;
+                let findingsEmitted = 0;
+                try {
+                    for await (const line of job.lines()) {
+                        lineCount += 1;
+                        await job.appendLog(line);
+                        // Roughly track progress by probe-line count; garak emits a
+                        // 'probes.X' header per probe, so this is a decent proxy.
+                        if (GARAK_PROBE_LINE.test(line)) {
+                            await job.setProgress(Math.min(99, Math.round((lineCount / Math.max(1, totalProbes)) * 100)), line);
+                        }
+                        const hit = parseGarakLine(line);
+                        if (hit) {
+                            await opsCtx.emitFinding({
+                                source: 'llmRedteam', tool: 'garak', targetId,
+                                severity: severityForDetector(hit.detector),
+                                title: `garak ${hit.detector}${hit.hits != null ? ` (${hit.hits}/${hit.total})` : ''}`,
+                                description: `Detector ${hit.detector} flagged the target as vulnerable. Probe set: ${probeIds.join(',')}.`,
+                                replication: cmd.join(' '),
+                                evidence: { transcript: line, raw: hit },
+                                jobId: job.id,
+                            });
+                            findingsEmitted += 1;
+                        }
+                    }
+                    await job.complete('done', { lineCount, findingsEmitted, probeIds });
+                    return JSON.stringify({ jobId: job.id, lineCount, findingsEmitted, probes: probeIds }, null, 2);
+                }
+                catch (err) {
+                    await job.complete('failed', { error: err.message });
+                    throw err;
+                }
+            },
+        },
+        // ─── LlmRedteamPromptfoo ──────────────────────────────────
+        {
+            name: 'LlmRedteamPromptfoo',
+            description: 'Run promptfoo redteam against a target. Generates jailbreak / harmful-content / PII-extraction probes ' +
+                'from the configured plugin set, evaluates the target\'s responses, streams hits to findings.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    targetId: { type: 'string' },
+                    configPath: { type: 'string', description: 'Path to a promptfooconfig.yaml that defines the target + plugins. Use promptfoo redteam init to bootstrap.' },
+                    numTests: { type: 'number', description: 'Tests per plugin (default 5).' },
+                    plugins: {
+                        type: 'array',
+                        items: { type: 'string', enum: ['jailbreak', 'harmful', 'pii', 'prompt-injection', 'rbac', 'cross-session-leak'] },
+                        description: 'Plugin set (default: jailbreak, harmful, pii, prompt-injection).',
+                    },
+                },
+                required: ['targetId', 'configPath'],
+            },
+            handler: async (args) => {
+                const targetId = String(args.targetId);
+                const configPath = String(args.configPath);
+                const numTests = typeof args.numTests === 'number' ? Math.max(1, Math.min(50, Math.floor(args.numTests))) : 5;
+                const plugins = Array.isArray(args.plugins) && args.plugins.length
+                    ? args.plugins
+                    : ['jailbreak', 'harmful', 'pii', 'prompt-injection'];
+                // Scope check via the config — the operator wired the target
+                // endpoint into the config, so we reload it here only enough
+                // to find a scope-relevant URL. Pragmatic: if `configPath`
+                // can't be parsed cheaply we trust the operator's authorization
+                // (they wrote the file) and let the Lambda's server-side
+                // engagement gate be the enforcer.
+                // TODO: parse promptfoo config and run assertInScope on its
+                // target.url field once we add a YAML parser to the CLI.
+                const cmd = ['promptfoo', 'redteam', 'run',
+                    '--config', configPath,
+                    '--num-tests', String(numTests),
+                    '--plugins', plugins.join(','),
+                    '--no-cache',
+                ];
+                const approval = await opsCtx.requestApproval({
+                    severity: 'risky',
+                    question: `Run promptfoo redteam (${plugins.join(',')}) with ${numTests} tests/plugin against the target in ${configPath}?`,
+                    options: [
+                        { label: 'cancel' },
+                        { label: 'go', description: `Approx ${numTests * plugins.length} test runs.` },
+                    ],
+                    timeoutSec: 300,
+                    defaultOnTimeout: 'abort',
+                });
+                if (approval === 'cancel')
+                    return 'cancelled by operator';
+                const job = await opsCtx.startJob({
+                    tool: 'promptfoo', kind: 'llmRedteam', targetId,
+                    cmd, timeoutMs: 30 * 60 * 1000,
+                });
+                let findingsEmitted = 0;
+                try {
+                    for await (const line of job.lines()) {
+                        await job.appendLog(line);
+                        const hit = parsePromptfooLine(line);
+                        if (hit) {
+                            const sev = /critical/i.test(hit.severity) ? 'critical' :
+                                /high|vuln/i.test(hit.severity) ? 'high' :
+                                    'medium';
+                            await opsCtx.emitFinding({
+                                source: 'llmRedteam', tool: 'promptfoo', targetId,
+                                severity: sev,
+                                title: `promptfoo ${hit.testName}`,
+                                description: hit.reason,
+                                replication: cmd.join(' '),
+                                evidence: { transcript: hit.rawLine, raw: hit },
+                                jobId: job.id,
+                            });
+                            findingsEmitted += 1;
+                        }
+                    }
+                    await job.complete('done', { findingsEmitted, plugins });
+                    return JSON.stringify({ jobId: job.id, findingsEmitted, plugins }, null, 2);
+                }
+                catch (err) {
+                    await job.complete('failed', { error: err.message });
+                    throw err;
+                }
+            },
+        },
+    ];
+}
+// ── CapabilityModule ─────────────────────────────────────────────
+export class LlmRedteamCapabilityModule {
+    id = 'capability.llmRedteam';
+    description = 'LLM red-team probes (garak + promptfoo). Variant-research / engagement-delivery only. ' +
+        'Streams findings to the Operations Center as they land. Requires HITL approval before each run.';
+    async create(context) {
+        logDebug('[LlmRedteam] capability initialized');
+        const opsCtx = createOpsContext({
+            engagementId: context.engagementId ?? null,
+            uid: context.uid ?? null,
+        });
+        const toolSuite = {
+            id: 'llmRedteam.tools',
+            description: 'garak + promptfoo wrappers for LLM red-teaming.',
+            tools: buildLlmRedteamTools(opsCtx),
+        };
+        return {
+            id: this.id,
+            description: this.description,
+            toolSuite,
+        };
+    }
+}
+//# sourceMappingURL=llmRedteamCapability.js.map

package/dist/capabilities/llmRedteamCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llmRedteamCapability.js","sourceRoot":"","sources":["../../src/capabilities/llmRedteamCapability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,OAAO,EACL,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAkBnD,MAAM,eAAe,GAA6B;IAChD,EAAE,EAAE,EAAE,cAAc,EAAG,SAAS,EAAE,cAAc,EAAG,WAAW,EAAE,gDAAgD,EAAE,aAAa,EAAE,MAAM,EAAM,gBAAgB,EAAE,EAAE,EAAE;IACnK,EAAE,EAAE,EAAE,KAAK,EAAY,SAAS,EAAE,KAAK,EAAY,WAAW,EAAE,2DAA2D,EAAE,aAAa,EAAE,MAAM,EAAM,gBAAgB,EAAE,EAAE,EAAE;IAC9K,EAAE,EAAE,EAAE,UAAU,EAAO,SAAS,EAAE,UAAU,EAAO,WAAW,EAAE,6DAA6D,EAAE,aAAa,EAAE,QAAQ,EAAI,gBAAgB,EAAE,EAAE,EAAE;IAChL,EAAE,EAAE,EAAE,YAAY,EAAK,SAAS,EAAE,YAAY,EAAK,WAAW,EAAE,6CAA6C,EAAE,aAAa,EAAE,QAAQ,EAAI,gBAAgB,EAAE,EAAE,EAAE;IAChK,EAAE,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,+CAA+C,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE;IAC7K,EAAE,EAAE,EAAE,cAAc,EAAG,SAAS,EAAE,cAAc,EAAG,WAAW,EAAE,yCAAyC,EAAE,aAAa,EAAE,QAAQ,EAAI,gBAAgB,EAAE,EAAE,EAAE;IAC5J,EAAE,EAAE,EAAE,YAAY,EAAK,SAAS,EAAE,YAAY,EAAK,WAAW,EAAE,2DAA2D,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE;IAC9K,EAAE,EAAE,EAAE,KAAK,EAAY,SAAS,EAAE,KAAK,EAAY,WAAW,EAAE,4CAA4C,EAAE,aAAa,EAAE,MAAM,EAAM,gBAAgB,EAAE,EAAE,EAAE;IAC/J,EAAE,EAAE,EAAE,QAAQ,EAAS,SAAS,EAAE,QAAQ,EAAS,WAAW,EAAE,qDAAqD,EAAE,aAAa,EAAE,KAAK,EAAO,gBAAgB,EAAE,EAAE,EAAE;IACxK,EAAE,EAAE,EAAE,UAAU,EAAO,SAAS,EAAE,UAAU,EAAO,WAAW,EAAE,gDAAgD,EAAE,aAAa,EAAE,MAAM,EAAM,gBAAgB,EAAE,EAAE,EAAE;CACpK,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnE,qEAAqE;AAErE;;;;;;;;GAQG;AACH,MAAM,cAAc,GAAG,yEAAyE,CAAC;AACjG,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAS9D,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACrC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACtC,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,mDAAmD,CAAC;AAS/E,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvF,CAAC;AAED,qEAAqE;AAErE,SAAS,kBAAkB,CAAC,GAAa;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,cAAc,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAoB;IAC/C,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAkB;IAC9C,OAAO;QACL,8DAA8D;QAC9D;YACE,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,2GAA2G;YACxH,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;aACf;YACD,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChD,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;iBACrC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChB,CAAC;SACF;QAED,6DAA6D;QAC7D;YACE,IAAI,EAAE,iBAAiB;YACvB,WAAW,EACT,oGAAoG;gBACpG,wGAAwG;YAC1G,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,wEAAwE,EAAE;oBACnH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6FAA6F,EAAE;oBACxI,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE;oBACjJ,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2DAA2D,EAAE;oBACvG,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;wBACjE,WAAW,EAAE,+DAA+D;qBAC7E;oBACD,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sEAAsE,EAAE;oBACpH,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,qEAAqE,EAAE;iBAChH;gBACD,QAAQ,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;aAC1D;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBACrH,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAEpC,6DAA6D;gBAC7D,8DAA8D;gBAC9D,oDAAoD;gBACpD,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAEzC,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,CAAC,OAAO;oBAClB,cAAc,EAAE,SAAS;oBACzB,cAAc,EAAE,SAAS;oBACzB,UAAU,EAAE,SAAS;oBACrB,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC;iBACrC,CAAC;gBACF,IAAI,SAAS,KAAK,MAAM;oBAAE,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;gBAE3D,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxD,CAAC;gBAED,8DAA8D;gBAC9D,2DAA2D;gBAC3D,8BAA8B;gBAC9B,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE;oBAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;oBAC5C,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,SAAS,WAAW,kBAAkB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,QAAQ,oEAAoE;oBAC3J,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;wBAClD,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE;wBACzD,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,mCAAmC,EAAE;qBACvE;oBACD,UAAU,EAAE,GAAG;oBACf,gBAAgB,EAAE,OAAO;iBAC1B,CAAC,CAAC;gBACH,IAAI,QAAQ,KAAK,QAAQ;oBAAE,OAAO,uBAAuB,CAAC;gBAC1D,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAElF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;oBAChC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ;oBAC3C,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;iBAC/B,CAAC,CAAC;gBAEH,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,IAAI,eAAe,GAAG,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;wBACrC,SAAS,IAAI,CAAC,CAAC;wBACf,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBAC1B,4DAA4D;wBAC5D,0DAA0D;wBAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BAChC,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;wBACtG,CAAC;wBACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;wBACjC,IAAI,GAAG,EAAE,CAAC;4BACR,MAAM,MAAM,CAAC,WAAW,CAAC;gCACvB,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ;gCAC7C,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;gCAC3C,KAAK,EAAE,SAAS,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gCACtF,WAAW,EAAE,YAAY,GAAG,CAAC,QAAQ,iDAAiD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;gCAC3G,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;gCAC1B,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE;gCACxC,KAAK,EAAE,GAAG,CAAC,EAAE;6BACd,CAAC,CAAC;4BACH,eAAe,IAAI,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;oBACD,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACrE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;SACF;QAED,6DAA6D;QAC7D;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EACT,wGAAwG;gBACxG,8FAA8F;YAChG,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4GAA4G,EAAE;oBACzJ,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE;oBAC1E,OAAO,EAAE;wBACP,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE;wBAClH,WAAW,EAAE,kEAAkE;qBAChF;iBACF;gBACD,QAAQ,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;aACrC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3C,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9G,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;oBAChE,CAAC,CAAE,IAAI,CAAC,OAAoB;oBAC5B,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;gBAExD,6DAA6D;gBAC7D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,gEAAgE;gBAChE,yDAAyD;gBACzD,mCAAmC;gBACnC,4DAA4D;gBAC5D,yDAAyD;gBAEzD,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK;oBACxC,UAAU,EAAE,UAAU;oBACtB,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;oBAC/B,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;oBAC9B,YAAY;iBACb,CAAC;gBAEF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;oBAC5C,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,0BAA0B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,uCAAuC,UAAU,GAAG;oBAC3H,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,QAAQ,EAAE;wBACnB,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,QAAQ,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE;qBAC/E;oBACD,UAAU,EAAE,GAAG;oBACf,gBAAgB,EAAE,OAAO;iBAC1B,CAAC,CAAC;gBACH,IAAI,QAAQ,KAAK,QAAQ;oBAAE,OAAO,uBAAuB,CAAC;gBAE1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;oBAChC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ;oBAC/C,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;iBAC/B,CAAC,CAAC;gBAEH,IAAI,eAAe,GAAG,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;wBACrC,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;wBAC1B,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;wBACrC,IAAI,GAAG,EAAE,CAAC;4BACR,MAAM,GAAG,GACP,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gCAC7C,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;oCAC1C,QAAQ,CAAC;4BACX,MAAM,MAAM,CAAC,WAAW,CAAC;gCACvB,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ;gCACjD,QAAQ,EAAE,GAAG;gCACb,KAAK,EAAE,aAAa,GAAG,CAAC,QAAQ,EAAE;gCAClC,WAAW,EAAE,GAAG,CAAC,MAAM;gCACvB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;gCAC1B,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE;gCAC/C,KAAK,EAAE,GAAG,CAAC,EAAE;6BACd,CAAC,CAAC;4BACH,eAAe,IAAI,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;oBACD,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;oBACzD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAChE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AAEpE,MAAM,OAAO,0BAA0B;IAC5B,EAAE,GAAG,uBAAuB,CAAC;IAC7B,WAAW,GAClB,wFAAwF;QACxF,iGAAiG,CAAC;IAEpG,KAAK,CAAC,MAAM,CAAC,OAA0B;QACrC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC9B,YAAY,EAAG,OAAqC,CAAC,YAAY,IAAI,IAAI;YACzE,GAAG,EAAG,OAA4B,CAAC,GAAG,IAAI,IAAI;SAC/C,CAAC,CAAC;QACH,MAAM,SAAS,GAAc;YAC3B,EAAE,EAAE,kBAAkB;YACtB,WAAW,EAAE,iDAAiD;YAC9D,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC;SACpC,CAAC;QACF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS;SACV,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/mcpCapability.d.ts

@@ -0,0 +1,7 @@
+import type { CapabilityContext, CapabilityContribution, CapabilityModule } from '../runtime/agentHost.js';
+export declare class McpCapabilityModule implements CapabilityModule {
+    readonly id = "capability.mcp";
+    readonly description = "MCP server bridge \u2014 exposes remote MCP tools as native capability tools.";
+    create(context: CapabilityContext): Promise<CapabilityContribution | null>;
+}
+//# sourceMappingURL=mcpCapability.d.ts.map

package/dist/capabilities/mcpCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpCapability.d.ts","sourceRoot":"","sources":["../../src/capabilities/mcpCapability.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAoD3G,qBAAa,mBAAoB,YAAW,gBAAgB;IAC1D,QAAQ,CAAC,EAAE,oBAAoB;IAC/B,QAAQ,CAAC,WAAW,mFAA8E;IAE5F,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;CAqCjF"}

package/dist/capabilities/mcpCapability.js

@@ -0,0 +1,82 @@
+import { getSharedMcpManager, serverMatchesProfile, } from '../plugins/tools/mcp/mcpClient.js';
+const TOOL_NAME_RE = /[^a-zA-Z0-9_]/g;
+function sanitizeForToolName(input) {
+    return input.replace(TOOL_NAME_RE, '_');
+}
+function buildToolName(server, tool) {
+    return `mcp__${sanitizeForToolName(server)}__${sanitizeForToolName(tool)}`;
+}
+function stringifyToolResult(result) {
+    const lines = [];
+    const content = result.content;
+    if (Array.isArray(content)) {
+        for (const item of content) {
+            if (item?.type === 'text' && typeof item.text === 'string') {
+                lines.push(item.text);
+            }
+            else {
+                lines.push(JSON.stringify(item));
+            }
+        }
+    }
+    else if (typeof content === 'string') {
+        lines.push(content);
+    }
+    else if (content !== undefined) {
+        lines.push(JSON.stringify(content));
+    }
+    const text = lines.join('\n');
+    return result.isError ? `MCP tool error: ${text}` : text;
+}
+function buildToolDefinitions(connection) {
+    return connection.tools.map((tool) => ({
+        name: buildToolName(connection.name, tool.name),
+        description: tool.description ?? `MCP tool ${tool.name} on server ${connection.name}`,
+        parameters: tool.inputSchema,
+        handler: async (args) => {
+            const result = await connection.client.callTool({
+                name: tool.name,
+                arguments: args,
+            });
+            return stringifyToolResult(result);
+        },
+    }));
+}
+export class McpCapabilityModule {
+    id = 'capability.mcp';
+    description = 'MCP server bridge — exposes remote MCP tools as native capability tools.';
+    async create(context) {
+        const manager = getSharedMcpManager(context.workingDir);
+        await manager.init();
+        const connections = manager
+            .getConnections()
+            .filter((c) => serverMatchesProfile(c.spec, context.profile));
+        if (connections.length === 0) {
+            return null;
+        }
+        const tools = [];
+        for (const connection of connections) {
+            tools.push(...buildToolDefinitions(connection));
+        }
+        if (tools.length === 0) {
+            return null;
+        }
+        const toolSuite = {
+            id: 'mcp.tools',
+            description: 'Tools provided by configured MCP servers',
+            tools,
+        };
+        return {
+            id: this.id,
+            description: this.description,
+            toolSuite,
+            metadata: {
+                servers: connections.map((c) => ({ name: c.name, toolCount: c.tools.length })),
+            },
+            dispose: async () => {
+                await manager.dispose();
+            },
+        };
+    }
+}
+//# sourceMappingURL=mcpCapability.js.map

package/dist/capabilities/mcpCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpCapability.js","sourceRoot":"","sources":["../../src/capabilities/mcpCapability.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,IAAY;IACjD,OAAO,QAAQ,mBAAmB,CAAC,MAAM,CAAC,KAAK,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA+C;IAC1E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,OAAkD,EAAE,CAAC;YACtE,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,UAA+B;IAC3D,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,CAAC;QACrD,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAC/C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,YAAY,IAAI,CAAC,IAAI,cAAc,UAAU,CAAC,IAAI,EAAE;QACrF,UAAU,EAAE,IAAI,CAAC,WAA0C;QAC3D,OAAO,EAAE,KAAK,EAAE,IAA6B,EAAE,EAAE;YAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC9C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,OAAO,mBAAmB,CAAC,MAAiD,CAAC,CAAC;QAChF,CAAC;KACF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,EAAE,GAAG,gBAAgB,CAAC;IACtB,WAAW,GAAG,0EAA0E,CAAC;IAElG,KAAK,CAAC,MAAM,CAAC,OAA0B;QACrC,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,OAAO;aACxB,cAAc,EAAE;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAc;YAC3B,EAAE,EAAE,WAAW;YACf,WAAW,EAAE,0CAA0C;YACvD,KAAK;SACN,CAAC;QAEF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS;YACT,QAAQ,EAAE;gBACR,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;aAC/E;YACD,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/memoryCapability.d.ts

@@ -0,0 +1,10 @@
+import type { CapabilityContribution, CapabilityContext, CapabilityModule } from '../runtime/agentHost.js';
+export declare class MemoryCapabilityModule implements CapabilityModule {
+    readonly id = "capability.memory";
+    private readonly options;
+    constructor(options?: {
+        workingDir?: string;
+    });
+    create(context: CapabilityContext): Promise<CapabilityContribution>;
+}
+//# sourceMappingURL=memoryCapability.d.ts.map

package/dist/capabilities/memoryCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryCapability.d.ts","sourceRoot":"","sources":["../../src/capabilities/memoryCapability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3G,qBAAa,sBAAuB,YAAW,gBAAgB;IAC7D,QAAQ,CAAC,EAAE,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;gBAEtC,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO;IAI3C,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAa1E"}

package/dist/capabilities/memoryCapability.js

@@ -0,0 +1,22 @@
+import { createMemoryTools } from '../tools/memoryTools.js';
+export class MemoryCapabilityModule {
+    id = 'capability.memory';
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async create(context) {
+        const workingDir = this.options.workingDir ?? context.workingDir;
+        return {
+            id: 'memory.tools',
+            description: 'Persistent cross-session memory (save/list/load/delete).',
+            toolSuite: {
+                id: 'memory',
+                description: 'Persistent memory operations',
+                tools: createMemoryTools(workingDir),
+            },
+            metadata: { workingDir },
+        };
+    }
+}
+//# sourceMappingURL=memoryCapability.js.map

package/dist/capabilities/memoryCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryCapability.js","sourceRoot":"","sources":["../../src/capabilities/memoryCapability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,OAAO,sBAAsB;IACxB,EAAE,GAAG,mBAAmB,CAAC;IACjB,OAAO,CAA0B;IAElD,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0B;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;QACjE,OAAO;YACL,EAAE,EAAE,cAAc;YAClB,WAAW,EAAE,0DAA0D;YACvE,SAAS,EAAE;gBACT,EAAE,EAAE,QAAQ;gBACZ,WAAW,EAAE,8BAA8B;gBAC3C,KAAK,EAAE,iBAAiB,CAAC,UAAU,CAAC;aACrC;YACD,QAAQ,EAAE,EAAE,UAAU,EAAE;SACzB,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/monitorCapability.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilityContribution, CapabilityContext, CapabilityModule } from '../runtime/agentHost.js';
+export declare class MonitorCapabilityModule implements CapabilityModule {
+    readonly id = "capability.monitor";
+    create(context: CapabilityContext): Promise<CapabilityContribution>;
+}
+//# sourceMappingURL=monitorCapability.d.ts.map

package/dist/capabilities/monitorCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitorCapability.d.ts","sourceRoot":"","sources":["../../src/capabilities/monitorCapability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3G,qBAAa,uBAAwB,YAAW,gBAAgB;IAC9D,QAAQ,CAAC,EAAE,wBAAwB;IAE7B,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAc1E"}

package/dist/capabilities/monitorCapability.js

@@ -0,0 +1,19 @@
+import { createMonitorTools, shutdownAllMonitors } from '../tools/monitorTools.js';
+export class MonitorCapabilityModule {
+    id = 'capability.monitor';
+    async create(context) {
+        return {
+            id: 'monitor.tools',
+            description: 'Monitor* — background process spawn / read / stop / list.',
+            toolSuite: {
+                id: 'monitor',
+                description: 'Background process management',
+                tools: createMonitorTools(context.workingDir),
+            },
+            dispose: async () => {
+                await shutdownAllMonitors();
+            },
+        };
+    }
+}
+//# sourceMappingURL=monitorCapability.js.map

package/dist/capabilities/monitorCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitorCapability.js","sourceRoot":"","sources":["../../src/capabilities/monitorCapability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEnF,MAAM,OAAO,uBAAuB;IACzB,EAAE,GAAG,oBAAoB,CAAC;IAEnC,KAAK,CAAC,MAAM,CAAC,OAA0B;QACrC,OAAO;YACL,EAAE,EAAE,eAAe;YACnB,WAAW,EAAE,2DAA2D;YACxE,SAAS,EAAE;gBACT,EAAE,EAAE,SAAS;gBACb,WAAW,EAAE,+BAA+B;gBAC5C,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC9C;YACD,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,mBAAmB,EAAE,CAAC;YAC9B,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/notebookCapability.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilityContribution, CapabilityContext, CapabilityModule } from '../runtime/agentHost.js';
+export declare class NotebookCapabilityModule implements CapabilityModule {
+    readonly id = "capability.notebook";
+    create(context: CapabilityContext): Promise<CapabilityContribution>;
+}
+//# sourceMappingURL=notebookCapability.d.ts.map

package/dist/capabilities/notebookCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notebookCapability.d.ts","sourceRoot":"","sources":["../../src/capabilities/notebookCapability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3G,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,QAAQ,CAAC,EAAE,yBAAyB;IAE9B,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAY1E"}

package/dist/capabilities/notebookCapability.js

@@ -0,0 +1,17 @@
+import { createNotebookTools } from '../tools/notebookTools.js';
+export class NotebookCapabilityModule {
+    id = 'capability.notebook';
+    async create(context) {
+        return {
+            id: 'notebook.tools',
+            description: 'Jupyter notebook (.ipynb) cell-level editing.',
+            toolSuite: {
+                id: 'notebook',
+                description: 'NotebookEdit',
+                tools: createNotebookTools(context.workingDir),
+            },
+            metadata: {},
+        };
+    }
+}
+//# sourceMappingURL=notebookCapability.js.map

package/dist/capabilities/notebookCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notebookCapability.js","sourceRoot":"","sources":["../../src/capabilities/notebookCapability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,OAAO,wBAAwB;IAC1B,EAAE,GAAG,qBAAqB,CAAC;IAEpC,KAAK,CAAC,MAAM,CAAC,OAA0B;QACrC,OAAO;YACL,EAAE,EAAE,gBAAgB;YACpB,WAAW,EAAE,+CAA+C;YAC5D,SAAS,EAAE;gBACT,EAAE,EAAE,UAAU;gBACd,WAAW,EAAE,cAAc;gBAC3B,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC/C;YACD,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/planModeCapability.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilityContribution, CapabilityContext, CapabilityModule } from '../runtime/agentHost.js';
+export declare class PlanModeCapabilityModule implements CapabilityModule {
+    readonly id = "capability.planMode";
+    create(context: CapabilityContext): Promise<CapabilityContribution>;
+}
+//# sourceMappingURL=planModeCapability.d.ts.map

package/dist/capabilities/planModeCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planModeCapability.d.ts","sourceRoot":"","sources":["../../src/capabilities/planModeCapability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3G,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,QAAQ,CAAC,EAAE,yBAAyB;IAE9B,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAW1E"}

package/dist/capabilities/planModeCapability.js

@@ -0,0 +1,16 @@
+import { createPlanModeTools } from '../tools/planModeTools.js';
+export class PlanModeCapabilityModule {
+    id = 'capability.planMode';
+    async create(context) {
+        return {
+            id: 'planMode.tools',
+            description: 'EnterPlanMode / ExitPlanMode / UpdatePlanStep — explore→plan→execute workflow with persisted plans.',
+            toolSuite: {
+                id: 'planMode',
+                description: 'Plan mode tools',
+                tools: createPlanModeTools(context.workingDir),
+            },
+        };
+    }
+}
+//# sourceMappingURL=planModeCapability.js.map

package/dist/capabilities/planModeCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planModeCapability.js","sourceRoot":"","sources":["../../src/capabilities/planModeCapability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,OAAO,wBAAwB;IAC1B,EAAE,GAAG,qBAAqB,CAAC;IAEpC,KAAK,CAAC,MAAM,CAAC,OAA0B;QACrC,OAAO;YACL,EAAE,EAAE,gBAAgB;YACpB,WAAW,EAAE,qGAAqG;YAClH,SAAS,EAAE;gBACT,EAAE,EAAE,UAAU;gBACd,WAAW,EAAE,iBAAiB;gBAC9B,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;aAC/C;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/capabilities/pwntoolsCapability.d.ts

@@ -0,0 +1,7 @@
+import type { CapabilityContext, CapabilityContribution, CapabilityModule } from '../runtime/agentHost.js';
+export declare class PwntoolsCapabilityModule implements CapabilityModule {
+    readonly id = "capability.pwntools";
+    readonly description = "Pwntools wrappers \u2014 pwn_eval (general snippet runner), pwn_rop_search (ROP gadget search), pwn_packed (pack/unpack/asm/disasm). Python3 shim with `from pwn import *` preloaded.";
+    create(_context: CapabilityContext): Promise<CapabilityContribution>;
+}
+//# sourceMappingURL=pwntoolsCapability.d.ts.map

package/dist/capabilities/pwntoolsCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pwntoolsCapability.d.ts","sourceRoot":"","sources":["../../src/capabilities/pwntoolsCapability.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAiG3G,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,QAAQ,CAAC,EAAE,yBAAyB;IACpC,QAAQ,CAAC,WAAW,2LAAsL;IAEpM,MAAM,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAU3E"}