@vibecontrols/agent 2026.601.30

package/dist/highlights-x6tmsnaa.scm

@@ -0,0 +1,115 @@
+; Query from: https://raw.githubusercontent.com/nvim-treesitter/nvim-treesitter/99ddf573531c4dbe53f743ecbc1595af5eb1d32f/queries/markdown_inline/highlights.scm
+; From MDeiml/tree-sitter-markdown
+(code_span) @markup.raw @nospell
+
+(emphasis) @markup.italic
+
+(strong_emphasis) @markup.strong
+
+(strikethrough) @markup.strikethrough
+
+(shortcut_link
+  (link_text) @nospell)
+
+[
+  (backslash_escape)
+  (hard_line_break)
+] @string.escape
+
+; Conceal codeblock and text style markers
+([
+  (code_span_delimiter)
+  (emphasis_delimiter)
+] @conceal
+  (#set! conceal ""))
+
+; Inline links - style all parts
+(inline_link
+  ["[" "(" ")"] @markup.link)
+
+(inline_link
+  "]" @markup.link.bracket.close)
+
+; Conceal opening bracket
+((inline_link
+  "[" @conceal)
+  (#set! conceal ""))
+
+; Conceal closing bracket with space replacement
+((inline_link
+  "]" @conceal)
+  (#set! conceal " "))
+
+; Conceal image links
+(image
+  [
+    "!"
+    "["
+    "]"
+    "("
+    (link_destination)
+    ")"
+  ] @markup.link
+  (#set! conceal ""))
+
+; Conceal full reference links
+(full_reference_link
+  [
+    "["
+    "]"
+    (link_label)
+  ] @markup.link
+  (#set! conceal ""))
+
+; Conceal collapsed reference links
+(collapsed_reference_link
+  [
+    "["
+    "]"
+  ] @markup.link
+  (#set! conceal ""))
+
+; Conceal shortcut links
+(shortcut_link
+  [
+    "["
+    "]"
+  ] @markup.link
+  (#set! conceal ""))
+
+[
+  (link_destination)
+  (uri_autolink)
+] @markup.link.url @nospell
+
+[
+  (link_label)
+  (link_text)
+  (link_title)
+  (image_description)
+] @markup.link.label
+
+; Replace common HTML entities.
+((entity_reference) @character.special
+  (#eq? @character.special " ")
+  (#set! conceal ""))
+
+((entity_reference) @character.special
+  (#eq? @character.special "<")
+  (#set! conceal "<"))
+
+((entity_reference) @character.special
+  (#eq? @character.special "&gt;")
+  (#set! conceal ">"))
+
+((entity_reference) @character.special
+  (#eq? @character.special "&amp;")
+  (#set! conceal "&"))
+
+((entity_reference) @character.special
+  (#eq? @character.special "&quot;")
+  (#set! conceal "\""))
+
+((entity_reference) @character.special
+  (#any-of? @character.special "&ensp;" "&emsp;")
+  (#set! conceal " "))

package/dist/index-01qzsnwd.js

@@ -0,0 +1,16 @@
+// @bun
+import{Sb as jY}from"./index-d5ysy1yn.js";import{Ub as WY}from"./index-04n4qgvd.js";import{Rc as zY,Sc as A,nd as P,pd as JY}from"./index-g2raeeh4.js";import{Kd as HY,Ld as wY,Nd as V}from"./index-9bqd8veb.js";import{Xd as p}from"./index-0cn9bv8z.js";import{randomBytes as M,createHmac as E,timingSafeEqual as vY}from"crypto";var R=600,n=600,g=M(32),K="p2.";function S(Y){if(!Y.startsWith("/"))return`/${Y}`;return Y.length>1&&Y.endsWith("/")?Y.slice(0,-1):Y}var UY=/^\/terminal\/[A-Za-z0-9_-]{1,128}(?:\/.*)?$/,XY=/^\/ui\/[a-z0-9-]{1,64}(?:\/.*)?$/,NY=/^\/plan\/[A-Za-z0-9_-]{1,128}(?:\/.*)?$/,bY=/^\/git(?:\/.*)?$/,OY="/ws/logs",LY=/^\/code-server(?:\/.*)?$/,CY=/^\/api\/plugins\/[a-z0-9-]{1,64}\/ui(?:\/.*)?$/;function s(Y){if(typeof Y!=="string"||Y.length===0)return!1;if(Y.includes("\x00")||Y.includes(`
+`)||Y.includes("|"))return!1;if(Y.includes(".."))return!1;if(new Set(["/","/api","/api/agent","/api/plugins","/api/profiles","/health","/metrics","/ws","/api/ai","/api/logs"]).has(Y))return!1;if(UY.test(Y))return!0;if(XY.test(Y))return!0;if(NY.test(Y))return!0;if(bY.test(Y))return!0;if(Y===OY)return!0;if(LY.test(Y))return!0;if(CY.test(Y))return!0;return!1}var DY=new Set(["*","GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"]);function KY(Y){if(!Y||Y.length===0)return["*"];let Z=new Set,$=[];for(let Q of Y){if(typeof Q!=="string")continue;let W=Q.toUpperCase();if(!DY.has(W))throw Error(`invalid method: ${Q}`);if(!Z.has(W))Z.add(W),$.push(W)}if($.length===0)return["*"];return $.sort()}function r(Y,Z){if(Y.includes("*"))return!0;return Y.includes(Z.toUpperCase())}var MY=/^[A-Za-z0-9_-]{1,128}$/;function SY(Y){return typeof Y==="string"&&MY.test(Y)}function x(Y,Z,$){return E("sha256",g).update(`${Y}
+${Z}
+${$}`).digest("hex")}var y=new Map;function kY(Y){for(let[Z,$]of y)if($<=Y)y.delete(Z)}function a(Y,Z){let $=Date.parse(Z);if(!Number.isFinite($))return;y.set(Y,$)}function i(Y){return kY(Date.now()),y.has(Y)}function h(Y,Z,$,Q){return E("sha256",g).update(`v2
+${Y}
+${Z}
+${$}
+${Q}`).digest("hex")}function T(Y){return Buffer.from(Y,"utf8").toString("base64").replace(/=+$/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function I(Y){try{let Z=Y.replace(/-/g,"+").replace(/_/g,"/"),$=Z.length%4===0?Z:Z+"=".repeat(4-Z.length%4);return Buffer.from($,"base64").toString("utf8")}catch{return null}}var d=16;function qY(Y){if(Y.length>d)throw Error(`pathPrefixes exceeds maximum count (${Y.length} > ${d})`);let Z=new Set,$=[];for(let Q of Y){if(!Q||typeof Q!=="string")continue;if(Q.includes("..")||Q.includes("\x00"))throw Error("invalid pathPrefix");let W=S(Q);if(!s(W))throw Error(`pathPrefix '${W}' is not an allowed iframe surface`);if(!Z.has(W))Z.add(W),$.push(W)}return $.sort()}function nY(Y,Z=R){if(!Y||typeof Y!=="string")throw Error("pathPrefix is required");if(Y.includes("..")||Y.includes("\x00"))throw Error("invalid pathPrefix");let $=Math.min(Math.max(1,Math.floor(Z||R)),n),Q=S(Y);if(!s(Q))throw Error(`pathPrefix '${Q}' is not an allowed iframe surface`);let W=new Date(Date.now()+$*1000).toISOString(),z=M(16).toString("hex"),J=x(Q,W,z);return{token:`${W}|${z}|${J}`,expiresAt:W}}function sY(Y,Z=R){if(!Y||!Array.isArray(Y.pathPrefixes)||Y.pathPrefixes.length===0)throw Error("pathPrefixes is required");let $=qY(Y.pathPrefixes);if($.length===0)throw Error("pathPrefixes is required");let Q=KY(Y.methods),W=Math.min(Math.max(1,Math.floor(Z||R)),n),z=new Date(Date.now()+W*1000).toISOString(),J=M(16).toString("hex"),j=T(JSON.stringify($)),G=T(JSON.stringify(Q)),H=`${K}${j}.${G}`,w=h(j,G,z,J);return{token:`${z}|${J}|${H}|${w}`,expiresAt:z}}function L(Y,Z){if(Y.length!==Z.length)return!1;try{return vY(Buffer.from(Y,"hex"),Buffer.from(Z,"hex"))}catch{return!1}}function _(Y,Z){let $=S(Z);return Y===$||Y.startsWith(`${$}/`)}function t(Y,Z,$="*"){return FY(Y,Z,$).ok}function FY(Y,Z,$="*"){if(!Y||typeof Y!=="string")return{ok:!1,reason:"missing"};let Q=Y.split("|");if(Q.length===3)return RY(Q,Z);if(Q.length===4)return yY(Q,Z,$);return{ok:!1,reason:"malformed"}}function RY(Y,Z){let[$,Q,W]=Y;if(!$||!Q||!W)return{ok:!1,reason:"malformed"};if(!C($))return{ok:!1,reason:"expired"};let z=Z.split("/").filter(Boolean),J=["/"],j="";for(let G of z)j+=`/${G}`,J.push(j);for(let G of J){let H=x(S(G),$,Q);if(L(H,W)){if(!_(Z,G))return{ok:!1,reason:"path_mismatch"};if(i(Q))return{ok:!1,reason:"replayed"};return a(Q,$),{ok:!0}}}return{ok:!1,reason:"bad_signature"}}function yY(Y,Z,$){let[Q,W,z,J]=Y;if(!Q||!W||!z||!J)return{ok:!1,reason:"malformed"};if(!z.startsWith(K))return{ok:!1,reason:"malformed"};if(!C(Q))return{ok:!1,reason:"expired"};let G=z.slice(K.length).split("."),H=G[0]??"",w=G[1]??T(JSON.stringify(["*"]));if(!H)return{ok:!1,reason:"malformed"};let N=h(H,w,Q,W);if(!L(N,J))return{ok:!1,reason:"bad_signature"};let F=I(H);if(F===null)return{ok:!1,reason:"malformed"};let b;try{b=JSON.parse(F)}catch{return{ok:!1,reason:"malformed"}}if(!Array.isArray(b))return{ok:!1,reason:"malformed"};let O=I(w),D=["*"];if(O!==null)try{let B=JSON.parse(O);if(Array.isArray(B)&&B.every((v)=>typeof v==="string"))D=B}catch{return{ok:!1,reason:"malformed"}}if($!=="*"&&!r(D,$))return{ok:!1,reason:"method_mismatch"};for(let B of b){if(typeof B!=="string")continue;if(_(Z,B)){if(i(W))return{ok:!1,reason:"replayed"};return a(W,Q),{ok:!0}}}return{ok:!1,reason:"path_mismatch"}}function rY(Y,Z,$="*"){if(!Y||typeof Y!=="string")return!1;let Q=Y.split("|");if(Q.length===3){let[W,z,J]=Q;if(!W||!z||!J)return!1;if(!C(W))return!1;let j=Z.split("/").filter(Boolean),G=["/"],H="";for(let w of j)H+=`/${w}`,G.push(H);for(let w of G){let N=x(S(w),W,z);if(L(N,J))return _(Z,w)}return!1}if(Q.length===4){let[W,z,J,j]=Q;if(!W||!z||!J||!j)return!1;if(!J.startsWith(K))return!1;if(!C(W))return!1;let H=J.slice(K.length).split("."),w=H[0]??"",N=H[1]??T(JSON.stringify(["*"]));if(!w)return!1;let F=h(w,N,W,z);if(!L(F,j))return!1;let b=I(w);if(b===null)return!1;let O;try{O=JSON.parse(b)}catch{return!1}if(!Array.isArray(O))return!1;let D=I(N),B=["*"];if(D!==null)try{let v=JSON.parse(D);if(Array.isArray(v)&&v.every((BY)=>typeof BY==="string"))B=v}catch{return!1}if($!=="*"&&!r(B,$))return!1;for(let v of O){if(typeof v!=="string")continue;if(_(Z,v))return!0}return!1}return!1}function C(Y){let Z=Date.parse(Y);return Number.isFinite(Z)&&Date.now()<Z}function c(Y,Z){let $=Y.headers.get("x-vibe-iframe-token")??Y.headers.get("X-Vibe-Iframe-Token");if($)return $;try{let Q=new URL(Y.url).searchParams.get("vt");if(Q)return Q}catch{}return null}var u="tc1|",l=600,TY=600;function e(Y,Z,$){return E("sha256",g).update(`tc1
+${Y}
+${Z}
+${$}`).digest("hex")}function aY(Y,Z=l){if(!SY(Y))throw Error("invalid sid");let $=Math.min(Math.max(1,Math.floor(Z||l)||l),TY),Q=new Date(Date.now()+$*1000).toISOString(),W=M(16).toString("hex"),z=e(Y,Q,W);return{token:`${u}${Q}|${Y}|${W}|${z}`,expiresAt:Q}}function iY(Y,Z){if(!Y||typeof Y!=="string")return!1;if(!Y.startsWith(u))return!1;let Q=Y.slice(u.length).split("|");if(Q.length!==4)return!1;let[W,z,J,j]=Q;if(!W||!z||!J||!j)return!1;if(z!==Z)return!1;if(!C(W))return!1;let G=e(z,W,J);return L(G,j)}function IY(Y,Z){let $;if(Y instanceof Headers)$=Y.get("cookie")??Y.get("Cookie")??void 0;else $=Y.cookie??Y.Cookie??void 0;if(!$)return null;let Q=`vt_term_${Z}`;for(let W of $.split(";")){let z=W.indexOf("=");if(z===-1)continue;if(W.slice(0,z).trim()!==Q)continue;return W.slice(z+1).trim()||null}return null}function tY(Y,Z){return IY(Y.headers,Z)}var f="uc1|",m=600,_Y=600,EY=/^[a-z0-9-]{1,64}$/;function gY(Y){return typeof Y==="string"&&EY.test(Y)}function YY(Y,Z,$){return E("sha256",g).update(`uc1
+${Y}
+${Z}
+${$}`).digest("hex")}function eY(Y,Z=m){if(!gY(Y))throw Error("invalid plugin name");let $=Math.min(Math.max(1,Math.floor(Z||m)||m),_Y),Q=new Date(Date.now()+$*1000).toISOString(),W=M(16).toString("hex"),z=YY(Y,Q,W);return{token:`${f}${Q}|${Y}|${W}|${z}`,expiresAt:Q}}function YZ(Y,Z){if(!Y||typeof Y!=="string")return!1;if(!Y.startsWith(f))return!1;let Q=Y.slice(f.length).split("|");if(Q.length!==4)return!1;let[W,z,J,j]=Q;if(!W||!z||!J||!j)return!1;if(z!==Z)return!1;if(!C(W))return!1;let G=YY(z,W,J);return L(G,j)}function AY(Y,Z){let $;if(Y instanceof Headers)$=Y.get("cookie")??Y.get("Cookie")??void 0;else $=Y.cookie??Y.Cookie??void 0;if(!$)return null;let Q=`vt_ui_${Z}`;for(let W of $.split(";")){let z=W.indexOf("=");if(z===-1)continue;if(W.slice(0,z).trim()!==Q)continue;return W.slice(z+1).trim()||null}return null}function ZZ(Y,Z){return AY(Y.headers,Z)}import{timingSafeEqual as PY}from"crypto";var lY=["/health","/ui","/code-server","/terminal","/plan","/git","/api/agent/status","/api/agent/version","/api/agent/identity","/api/agent/terminal-exchange","/api/agent/ui-exchange","/api/agent/ui-exchange-plugin","/metrics"];function ZY(Y,Z){if(!Z||Z==="/")return!1;let $=Z.endsWith("/")?Z.slice(0,-1):Z;return Y===$||Y.startsWith(`${$}/`)}function mY(Y){let Z=Y.replace(/^\/api\/profiles\/[^/]+/,"/api");return Z==="/api"?"/":Z}function uY(Y){let Z=/^\/api\/profiles\/([^/]+)(?:\/|$)/.exec(Y);if(!Z)return null;let $=Z[1];if(!$)return null;return $}function $Y(Y,Z){let $=[Y],Q=mY(Y);if(Q!==Y)$.push(Q);for(let W of $){if(lY.some((z)=>ZY(W,z)))return!0;if(Z.some((z)=>ZY(W,z)))return!0}return!1}function GY(){let Y=new Uint8Array(32);return crypto.getRandomValues(Y),`vcak_${Buffer.from(Y).toString("base64url")}`}var U=null;function VY(){return`${p()}:static-api-key`}async function BZ(){let Y=process.env.AGENT_API_KEY;if(Y)return U=Y,Y;let Z=VY(),$=await zY(Z);if($)return U=$,$;let Q=P({dir:V().dataDir})["static-api-key"];if(Q){try{await A(Z,Q)}catch(z){V().logger.warn("auth","could not persist legacy api key into secrets backend",{error:String(z)})}return U=Q,Q}let W=GY();return await A(Z,W),U=W,V().logger.info("auth","Generated and persisted new agent API key"),V().audit.emit("agent","apikey.minted",{profile:p(),via:"loadAgentApiKey"}),W}function k(){let Y=process.env.AGENT_API_KEY;if(Y)return Y;if(U!==null)return U;let Z=P()["static-api-key"];if(Z)return U=Z,Z;let $=GY();U=$;try{JY({"static-api-key":$},{dir:V().dataDir,scope:V().name})}catch{}return A(VY(),$).catch(()=>{}),$}function fY(Y){let Z=Y["x-agent-api-key"]??Y["X-Agent-Api-Key"];if(Z)return Z;let $=Y.authorization??Y.Authorization;if($?.startsWith("Bearer "))return $.slice(7);return null}function xY(Y){return!1}function hY(Y,Z){let $=fY(Object.fromEntries(Y.headers.entries()));if($)return $;if(!xY(Z))return null;try{let Q=new URL(Y.url).searchParams.get("apiKey");if(Q)return Q}catch{}return null}function q(Y,Z){let $=Buffer.from(Y),Q=Buffer.from(Z);if($.length!==Q.length)return!1;try{return PY($,Q)}catch{return!1}}function vZ(Y){if(!Y)return!1;return q(Y,k())}async function cY(Y,Z){if(!Y)return!1;let $=uY(Z);if($){let Q=wY.get($);if(Q){try{if(await Q.keyVault.match(Y))return!0}catch{}if($===V().name){try{if(await V().keyVault.match(Y))return!0}catch{}return q(Y,k())}return!1}}try{if(await V().keyVault.match(Y))return!0}catch{}if(q(Y,k()))return!0;if(oY(Y)!==null)return!0;return!1}function oY(Y){if(!Y)return null;if(q(Y,k()))return{name:"default",scopes:new Set(["admin"])};let Z=HY()??V(),$=P({dir:Z.dataDir}),Q=Date.now();for(let W of $.apiKeys??[]){if(!q(Y,W.key))continue;if(W.notBefore){let z=Date.parse(W.notBefore);if(Number.isFinite(z)&&Q<z)return null}if(W.expiresAt){let z=Date.parse(W.expiresAt);if(Number.isFinite(z)&&Q>=z)return null}return{name:W.name,scopes:new Set(W.scopes)}}return null}function UZ(Y,Z){if(!Y)return!1;if(Y.scopes.has("admin"))return!0;return Z.some(($)=>Y.scopes.has($))}var X=null;function o(Y,Z){try{V().audit.emit("auth",Y,Z)}catch{V().logger.warn("auth.audit",Y,Z)}}function pY(Y){let Z=new Set(Y());if(X===null)for(let $ of Z)o("plugin.public_path.declared",{path:$});else{for(let $ of Z)if(!X.has($))o("plugin.public_path.added",{path:$});for(let $ of X)if(!Z.has($))o("plugin.public_path.removed",{path:$})}return X=Z,Z}function XZ(){X=null}function QY(Y){if(!Y)return[];if(X===null)return[...pY(Y)];return[...X]}function NZ(Y){let Z=k();return V().logger.info("auth",`Agent API key: ${Z.substring(0,8)}****${Z.substring(Z.length-4)}`),new WY({name:"plugin/auth"}).decorate("apiKey",Z).derive(async({request:$,path:Q})=>{let W=QY(Y),z;if($Y(Q,W))z=!0;else if(jY($.headers))z=!0;else{let J=c($,Q);if(J&&t(J,Q,$.method))z=!0;else{let j=hY($,Q);z=await cY(j,Q)}}return{isAuthenticated:z}}).onBeforeHandle(({isAuthenticated:$,request:Q,path:W,set:z})=>{let J=QY(Y);if(!$&&!$Y(W,J)){if(c(Q,W))return z.status=401,{error:"invalid iframe token"};return z.status=401,{error:"Unauthorized",message:"Invalid or missing API key"}}}).as("global")}
+export{SY as tb,nY as ub,sY as vb,t as wb,FY as xb,rY as yb,c as zb,aY as Ab,iY as Bb,IY as Cb,tY as Db,gY as Eb,eY as Fb,YZ as Gb,ZZ as Hb,BZ as Ib,k as Jb,fY as Kb,vZ as Lb,oY as Mb,UZ as Nb,XZ as Ob,NZ as Pb};

package/dist/index-0248afsn.js

@@ -0,0 +1,3 @@
+// @bun
+import{K as I}from"./index-2gsarrbn.js";import{Qb as G,Rb as D}from"./index-d5ysy1yn.js";import{Nd as H}from"./index-9bqd8veb.js";var j="prereqs-runner",q="plugin-mgr",v={status:null,install:null,satisfied:!0,pendingSudo:[],noProtocol:!0};function w(z,F){if(!z.apiPrefix)return null;return`${(z.apiPrefix.startsWith("/")?z.apiPrefix:`/${z.apiPrefix}`).replace(/\/+$/,"")}/prereqs${F}`}async function M(z,F,J){let Q=z.handle;if(typeof Q!=="function")return null;let Y=new Request(`http://agent.local${F}`,{method:J,headers:{"x-vc-profile-rewrite":"1",[G]:D()}}),K=await Q.call(z,Y);if(K.status===404)return null;if(!K.ok){let $=await K.text().catch(()=>"");throw Error(`prereqs ${J} ${F} \u2192 ${K.status} ${$}`)}return await K.json()}async function A(z,F,J,Q,Y={}){let K=w(z,"/status"),$=w(z,"/install");if(!K||!$)return v;let W=null;try{W=await M(J,K,"GET")}catch(V){H().logger.warn(j,`${z.name}: prereqs/status call failed`,{error:String(V)})}if(W===null)return v;if(W.satisfied||Y.skipInstall)return await x(Q,F,z.version,{status:W,install:null}),{status:W,install:null,satisfied:W.satisfied,pendingSudo:[],noProtocol:!1};let X=null;try{X=await M(J,$,"POST")}catch(V){H().logger.warn(j,`${z.name}: prereqs/install call failed`,{error:String(V)})}let B=W;try{let V=await M(J,K,"GET");if(V)B=V}catch{}if(await x(Q,F,z.version,{status:B,install:X}),X&&X.installed.length>0){let V=new Map;for(let Z of z.prerequisites??[])V.set(Z.name,Z.kind);I(F,X.installed.map((Z)=>({name:Z,kind:V.get(Z)??"binary"})))}return{status:B,install:X,satisfied:B.satisfied,pendingSudo:X?.pendingSudo??[],noProtocol:!1}}async function x(z,F,J,Q){if(!z)return;let Y=JSON.stringify({lastInstallAt:new Date().toISOString(),lastInstallVersion:J,satisfied:Q.status?.satisfied??!1,missing:Q.status?.missing??[],pendingSudo:Q.install?.pendingSudo??[]});try{await z.setPluginState(q,`prereqs:${F}`,Y)}catch(K){H().logger.warn(j,"Failed to persist prereq state",{packageName:F,error:String(K)})}}async function L(z,F){if(!z)return null;try{let J=await z.getPluginState(q,`prereqs:${F}`);return J?JSON.parse(J):null}catch{return null}}
+export{A as d,L as e};