@waishnav/devspace 1.0.0

package/dist/db/schema.js

@@ -0,0 +1,29 @@
+import { index, primaryKey, sqliteTable, text } from "drizzle-orm/sqlite-core";
+export const workspaceSessions = sqliteTable("workspace_sessions", {
+    id: text("id").primaryKey(),
+    root: text("root").notNull(),
+    status: text("status").notNull().default("active"),
+    mode: text("mode").notNull().default("checkout"),
+    sourceRoot: text("source_root"),
+    baseRef: text("base_ref"),
+    baseSha: text("base_sha"),
+    managed: text("managed").notNull().default("false"),
+    createdAt: text("created_at").notNull(),
+    lastUsedAt: text("last_used_at").notNull(),
+}, (table) => [
+    index("workspace_sessions_root_idx").on(table.root, table.lastUsedAt),
+    index("workspace_sessions_status_idx").on(table.status, table.lastUsedAt),
+]);
+export const loadedAgentFiles = sqliteTable("loaded_agent_files", {
+    workspaceSessionId: text("workspace_session_id")
+        .notNull()
+        .references(() => workspaceSessions.id, { onDelete: "cascade" }),
+    path: text("path").notNull(),
+    contentHash: text("content_hash").notNull(),
+    content: text("content").notNull(),
+    loadedAt: text("loaded_at").notNull(),
+    lastSeenAt: text("last_seen_at").notNull(),
+}, (table) => [
+    primaryKey({ columns: [table.workspaceSessionId, table.path] }),
+    index("loaded_agent_files_path_idx").on(table.path),
+]);

package/dist/git-worktrees.js

@@ -0,0 +1,134 @@
+import { randomBytes } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdir, realpath, rm, stat } from "node:fs/promises";
+import { basename, join, relative, resolve } from "node:path";
+import { assertAllowedPath, isPathInsideRoot } from "./roots.js";
+const execFileAsync = promisify(execFile);
+export class GitWorktreeError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "GitWorktreeError";
+    }
+}
+export async function createManagedWorktree(input) {
+    const sourcePath = assertAllowedPath(input.sourcePath, input.config.allowedRoots);
+    try {
+        const sourceStats = await stat(sourcePath);
+        if (!sourceStats.isDirectory()) {
+            throw new GitWorktreeError("GIT_REPOSITORY_NOT_FOUND", `Cannot open workspace in worktree mode because the source path is not a directory: ${input.sourcePath}`);
+        }
+    }
+    catch (error) {
+        if (error instanceof GitWorktreeError)
+            throw error;
+        throw new GitWorktreeError("GIT_REPOSITORY_NOT_FOUND", `Cannot open workspace in worktree mode because the source path does not exist: ${input.sourcePath}`);
+    }
+    const sourceRoot = await resolveGitRoot(sourcePath, input.config.allowedRoots);
+    const baseRef = input.baseRef ?? "HEAD";
+    const baseSha = await resolveBaseCommit(sourceRoot, baseRef);
+    const dirtySource = (await git(["status", "--porcelain=v1"], sourceRoot)).trim().length > 0;
+    const worktreePath = managedWorktreePath({
+        worktreeRoot: input.config.worktreeRoot,
+        repoRoot: sourceRoot,
+    });
+    await mkdir(input.config.worktreeRoot, { recursive: true });
+    assertAllowedPath(worktreePath, [input.config.worktreeRoot]);
+    try {
+        await git(["worktree", "add", "--detach", worktreePath, baseSha], sourceRoot);
+    }
+    catch (error) {
+        await rm(worktreePath, { recursive: true, force: true });
+        const message = error instanceof Error ? error.message : String(error);
+        throw new GitWorktreeError("GIT_WORKTREE_CREATE_FAILED", `Git failed to create the managed worktree. ${message}`);
+    }
+    return {
+        sourceRoot,
+        path: worktreePath,
+        baseRef,
+        baseSha,
+        dirtySource,
+        detached: true,
+        managed: true,
+    };
+}
+async function resolveGitRoot(path, allowedRoots) {
+    try {
+        const output = await git(["rev-parse", "--show-toplevel"], path);
+        return await assertGitRootAllowed(output.trim(), allowedRoots);
+    }
+    catch (error) {
+        if (isGitUnavailable(error)) {
+            throw new GitWorktreeError("GIT_NOT_AVAILABLE", "Cannot open workspace in worktree mode because Git is not available on this machine.");
+        }
+        throw new GitWorktreeError("GIT_REPOSITORY_NOT_FOUND", `Cannot open workspace in worktree mode because this path is not inside a Git repository: ${path}. Use mode=\"checkout\" to work directly in this directory, or initialize Git and create an initial commit first.`);
+    }
+}
+async function assertGitRootAllowed(gitRoot, allowedRoots) {
+    try {
+        return assertAllowedPath(gitRoot, allowedRoots);
+    }
+    catch {
+        const canonicalGitRoot = await realpath(gitRoot);
+        for (const allowedRoot of allowedRoots) {
+            const canonicalAllowedRoot = await realpath(allowedRoot).catch(() => undefined);
+            if (!canonicalAllowedRoot || !isPathInsideRoot(canonicalGitRoot, canonicalAllowedRoot)) {
+                continue;
+            }
+            const logicalGitRoot = resolve(allowedRoot, relative(canonicalAllowedRoot, canonicalGitRoot));
+            return assertAllowedPath(logicalGitRoot, allowedRoots);
+        }
+        return assertAllowedPath(canonicalGitRoot, allowedRoots);
+    }
+}
+async function resolveBaseCommit(sourceRoot, baseRef) {
+    try {
+        return (await git(["rev-parse", "--verify", `${baseRef}^{commit}`], sourceRoot)).trim();
+    }
+    catch (error) {
+        if (baseRef === "HEAD") {
+            throw new GitWorktreeError("GIT_REPOSITORY_HAS_NO_COMMITS", "Cannot open workspace in worktree mode because the repository has no commits yet. Create an initial commit first, or use mode=\"checkout\".");
+        }
+        throw new GitWorktreeError("GIT_INVALID_BASE_REF", `Cannot open workspace in worktree mode because baseRef ${JSON.stringify(baseRef)} does not resolve to a commit.`);
+    }
+}
+function managedWorktreePath(input) {
+    const repoName = sanitizePathSegment(basename(input.repoRoot)) || "repo";
+    const worktreeId = randomBytes(4).toString("hex");
+    return join(input.worktreeRoot, `${repoName}-${worktreeId}`);
+}
+function sanitizePathSegment(value) {
+    return value
+        .replace(/[^a-zA-Z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 80);
+}
+async function git(args, cwd) {
+    try {
+        const { stdout } = await execFileAsync("git", args, {
+            cwd,
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        return stdout;
+    }
+    catch (error) {
+        if (isGitUnavailable(error))
+            throw error;
+        const stderr = typeof error === "object" && error && "stderr" in error
+            ? String(error.stderr ?? "").trim()
+            : "";
+        const stdout = typeof error === "object" && error && "stdout" in error
+            ? String(error.stdout ?? "").trim()
+            : "";
+        const details = stderr || stdout || (error instanceof Error ? error.message : String(error));
+        throw new Error(details);
+    }
+}
+function isGitUnavailable(error) {
+    return Boolean(typeof error === "object" &&
+        error &&
+        "code" in error &&
+        error.code === "ENOENT");
+}

package/dist/git.js

@@ -0,0 +1,41 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export async function git(cwd, args, options = {}) {
+    const { stdout, stderr } = await execFileAsync("git", args, {
+        cwd,
+        env: options.env ? { ...process.env, ...options.env } : process.env,
+        maxBuffer: options.maxBuffer ?? 10 * 1024 * 1024,
+    });
+    return { stdout, stderr };
+}
+export async function getGitEligibility(cwd) {
+    try {
+        await git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+    }
+    catch {
+        return {
+            ok: false,
+            reason: "not_git",
+            message: "workspace is not inside a git repository",
+        };
+    }
+    const gitRoot = (await git(cwd, ["rev-parse", "--show-toplevel"])).stdout.trim();
+    try {
+        await git(gitRoot, ["rev-parse", "--verify", "--quiet", "HEAD^{commit}"]);
+    }
+    catch {
+        return {
+            ok: false,
+            gitRoot,
+            reason: "no_head",
+            message: "repository has no HEAD commit",
+        };
+    }
+    return { ok: true, gitRoot };
+}
+export function safeWorkspaceRefSegment(workspaceId) {
+    const safe = workspaceId.replace(/[^A-Za-z0-9._-]/g, "-");
+    return safe.length > 0 ? safe : createHash("sha256").update(workspaceId).digest("hex").slice(0, 16);
+}

package/dist/logger.js

@@ -0,0 +1,69 @@
+const LEVEL_WEIGHT = {
+    silent: 0,
+    error: 1,
+    warn: 2,
+    info: 3,
+    debug: 4,
+};
+export function shouldLog(config, level) {
+    return LEVEL_WEIGHT[config.level] >= LEVEL_WEIGHT[level];
+}
+export function logEvent(config, level, event, fields = {}) {
+    if (!shouldLog(config, level))
+        return;
+    const entry = {
+        ts: new Date().toISOString(),
+        level,
+        event,
+        ...fields,
+    };
+    const line = config.format === "pretty" ? formatPretty(entry) : JSON.stringify(entry);
+    if (level === "error") {
+        console.error(line);
+    }
+    else if (level === "warn") {
+        console.warn(line);
+    }
+    else {
+        console.log(line);
+    }
+}
+export function requestIp(req, trustProxy) {
+    if (trustProxy) {
+        const cfConnectingIp = firstHeaderValue(req.header("cf-connecting-ip"));
+        if (cfConnectingIp)
+            return cfConnectingIp;
+        const forwardedFor = firstHeaderValue(req.header("x-forwarded-for"));
+        if (forwardedFor)
+            return forwardedFor;
+    }
+    return req.ip ?? req.socket.remoteAddress;
+}
+export function requestPath(req) {
+    return req.path || req.url.split("?")[0] || req.url;
+}
+export function sessionIdPrefix(sessionId) {
+    return sessionId ? sessionId.slice(0, 8) : undefined;
+}
+export function commandPreview(command) {
+    const normalized = command.replace(/\s+/g, " ").trim();
+    return normalized.length > 120 ? `${normalized.slice(0, 117)}...` : normalized;
+}
+function firstHeaderValue(value) {
+    return value?.split(",")[0]?.trim() || undefined;
+}
+function formatPretty(entry) {
+    const ts = String(entry.ts);
+    const level = String(entry.level).toUpperCase();
+    const event = String(entry.event);
+    const rest = Object.entries(entry)
+        .filter(([key, value]) => !["ts", "level", "event"].includes(key) && value !== undefined)
+        .map(([key, value]) => `${key}=${formatPrettyValue(value)}`)
+        .join(" ");
+    return rest ? `${ts} ${level} ${event} ${rest}` : `${ts} ${level} ${event}`;
+}
+function formatPrettyValue(value) {
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    return JSON.stringify(value);
+}

package/dist/oauth-provider.js

@@ -0,0 +1,266 @@
+import { timingSafeEqual, randomBytes, randomUUID, createHash } from "node:crypto";
+import { AccessDeniedError, InvalidGrantError, InvalidRequestError, InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+const CODE_TTL_MS = 5 * 60 * 1000;
+function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+function safeEquals(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.byteLength !== right.byteLength)
+        return false;
+    return timingSafeEqual(left, right);
+}
+function htmlEscape(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function formHtml(params) {
+    const scopeText = params.scopes.length > 0 ? params.scopes.join(" ") : "devspace";
+    const resourceText = params.resource?.href ?? "DevSpace MCP endpoint";
+    const error = params.error
+        ? `<p class="error">${htmlEscape(params.error)}</p>`
+        : "";
+    const hiddenFields = Object.entries(params.fields)
+        .filter((entry) => entry[1] !== undefined)
+        .map(([name, value]) => `        <input type="hidden" name="${htmlEscape(name)}" value="${htmlEscape(value)}" />`)
+        .join("\n");
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Connect DevSpace</title>
+    <style>
+      body { font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; margin: 0; background: #0f172a; color: #e2e8f0; }
+      main { max-width: 440px; margin: 12vh auto; padding: 32px; background: #111827; border: 1px solid #334155; border-radius: 18px; box-shadow: 0 24px 80px rgba(0,0,0,.35); }
+      h1 { margin: 0 0 12px; font-size: 28px; }
+      p { line-height: 1.5; color: #cbd5e1; }
+      dl { padding: 16px; background: #020617; border-radius: 12px; }
+      dt { color: #94a3b8; font-size: 12px; text-transform: uppercase; letter-spacing: .06em; }
+      dd { margin: 4px 0 12px; word-break: break-word; }
+      label { display: block; margin: 18px 0 8px; font-weight: 600; }
+      input { box-sizing: border-box; width: 100%; padding: 12px 14px; border-radius: 10px; border: 1px solid #475569; background: #020617; color: #e2e8f0; font-size: 16px; }
+      button { margin-top: 18px; width: 100%; border: 0; border-radius: 10px; padding: 12px 14px; font-weight: 700; color: #020617; background: #38bdf8; cursor: pointer; }
+      .error { color: #fecaca; background: #7f1d1d; border-radius: 10px; padding: 10px 12px; }
+      .warning { color: #fde68a; }
+    </style>
+  </head>
+  <body>
+    <main>
+      <h1>Connect DevSpace</h1>
+      <p class="warning">Only approve this if you are intentionally connecting your own ChatGPT or MCP client to this local machine.</p>
+      ${error}
+      <dl>
+        <dt>Client</dt><dd>${htmlEscape(params.clientName)}</dd>
+        <dt>Scope</dt><dd>${htmlEscape(scopeText)}</dd>
+        <dt>Resource</dt><dd>${htmlEscape(resourceText)}</dd>
+      </dl>
+      <form method="post">
+${hiddenFields}
+        <label for="owner_token">Owner password</label>
+        <input id="owner_token" name="owner_token" type="password" autocomplete="current-password" autofocus required />
+        <button type="submit">Authorize DevSpace</button>
+      </form>
+    </main>
+  </body>
+</html>`;
+}
+function requestedScopesAllowed(requested, supported) {
+    return requested.every((scope) => supported.includes(scope));
+}
+function redirectHostAllowed(redirectUri, allowedHosts) {
+    let parsed;
+    try {
+        parsed = new URL(redirectUri);
+    }
+    catch {
+        return false;
+    }
+    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname))
+        return true;
+    return allowedHosts.includes(parsed.hostname);
+}
+export class InMemoryOAuthClientsStore {
+    allowedRedirectHosts;
+    clients = new Map();
+    constructor(allowedRedirectHosts) {
+        this.allowedRedirectHosts = allowedRedirectHosts;
+    }
+    getClient(clientId) {
+        return this.clients.get(clientId);
+    }
+    registerClient(client) {
+        if (!client.redirect_uris.every((uri) => redirectHostAllowed(uri, this.allowedRedirectHosts))) {
+            throw new InvalidRequestError("Client redirect_uri is not allowed for this DevSpace server");
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const registered = {
+            ...client,
+            client_id: `devspace-${randomUUID()}`,
+            client_id_issued_at: now,
+            token_endpoint_auth_method: client.token_endpoint_auth_method ?? "none",
+            grant_types: client.grant_types ?? ["authorization_code", "refresh_token"],
+            response_types: client.response_types ?? ["code"],
+        };
+        this.clients.set(registered.client_id, registered);
+        return registered;
+    }
+}
+export class SingleUserOAuthProvider {
+    config;
+    clientsStore;
+    codes = new Map();
+    accessTokens = new Map();
+    refreshTokens = new Map();
+    resourceServerUrl;
+    constructor(config, resourceServerUrl) {
+        this.config = config;
+        this.resourceServerUrl = resourceUrlFromServerUrl(resourceServerUrl);
+        this.clientsStore = new InMemoryOAuthClientsStore(config.allowedRedirectHosts);
+    }
+    async authorize(client, params, res) {
+        if (!params.resource || !checkResourceAllowed({ requestedResource: params.resource, configuredResource: this.resourceServerUrl })) {
+            throw new InvalidRequestError("Invalid or missing OAuth resource");
+        }
+        if (!requestedScopesAllowed(params.scopes ?? [], this.config.scopes)) {
+            throw new InvalidRequestError("Requested scope is not supported");
+        }
+        if (res.req.method !== "POST") {
+            res.status(200).setHeader("Content-Type", "text/html; charset=utf-8");
+            res.send(formHtml({
+                clientName: client.client_name ?? client.client_id,
+                scopes: params.scopes ?? this.config.scopes,
+                resource: params.resource,
+                fields: authorizationFormFields(client, params),
+            }));
+            return;
+        }
+        const providedToken = String(res.req.body?.owner_token ?? "");
+        if (!safeEquals(providedToken, this.config.ownerToken)) {
+            res.status(401).setHeader("Content-Type", "text/html; charset=utf-8");
+            res.send(formHtml({
+                error: "The Owner password was not accepted.",
+                clientName: client.client_name ?? client.client_id,
+                scopes: params.scopes ?? this.config.scopes,
+                resource: params.resource,
+                fields: authorizationFormFields(client, params),
+            }));
+            return;
+        }
+        const code = `code-${randomUUID()}`;
+        this.codes.set(code, {
+            clientId: client.client_id,
+            params,
+            expiresAtMs: Date.now() + CODE_TTL_MS,
+        });
+        const redirectUrl = new URL(params.redirectUri);
+        redirectUrl.searchParams.set("code", code);
+        if (params.state !== undefined)
+            redirectUrl.searchParams.set("state", params.state);
+        res.redirect(302, redirectUrl.href);
+    }
+    async challengeForAuthorizationCode(client, authorizationCode) {
+        const record = this.validCodeRecord(client, authorizationCode);
+        return record.params.codeChallenge;
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
+        const record = this.validCodeRecord(client, authorizationCode);
+        if (redirectUri && redirectUri !== record.params.redirectUri) {
+            throw new InvalidGrantError("redirect_uri does not match the authorization request");
+        }
+        if (resource && !checkResourceAllowed({ requestedResource: resource, configuredResource: this.resourceServerUrl })) {
+            throw new InvalidGrantError("Invalid resource");
+        }
+        this.codes.delete(authorizationCode);
+        return this.issueTokens(client.client_id, record.params.scopes ?? this.config.scopes, record.params.resource);
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const record = this.refreshTokens.get(hashToken(refreshToken));
+        if (!record || record.clientId !== client.client_id || record.expiresAt < Math.floor(Date.now() / 1000)) {
+            throw new InvalidGrantError("Invalid refresh token");
+        }
+        if (resource && !checkResourceAllowed({ requestedResource: resource, configuredResource: this.resourceServerUrl })) {
+            throw new InvalidGrantError("Invalid resource");
+        }
+        const requestedScopes = scopes ?? record.scopes;
+        if (!requestedScopes.every((scope) => record.scopes.includes(scope))) {
+            throw new AccessDeniedError("Refresh token cannot grant requested scopes");
+        }
+        this.refreshTokens.delete(hashToken(refreshToken));
+        return this.issueTokens(client.client_id, requestedScopes, resource ?? record.resource);
+    }
+    async verifyAccessToken(token) {
+        const record = this.accessTokens.get(hashToken(token));
+        if (!record || record.expiresAt < Math.floor(Date.now() / 1000)) {
+            throw new InvalidTokenError("Invalid or expired access token");
+        }
+        return {
+            token,
+            clientId: record.clientId,
+            scopes: record.scopes,
+            expiresAt: record.expiresAt,
+            resource: record.resource,
+        };
+    }
+    async revokeToken(_client, request) {
+        const hashed = hashToken(request.token);
+        this.accessTokens.delete(hashed);
+        this.refreshTokens.delete(hashed);
+    }
+    validCodeRecord(client, authorizationCode) {
+        const record = this.codes.get(authorizationCode);
+        if (!record || record.clientId !== client.client_id || record.expiresAtMs < Date.now()) {
+            throw new InvalidGrantError("Invalid authorization code");
+        }
+        return record;
+    }
+    issueTokens(clientId, scopes, resource) {
+        const now = Math.floor(Date.now() / 1000);
+        const accessToken = randomToken();
+        const refreshToken = randomToken();
+        const accessExpiresAt = now + this.config.accessTokenTtlSeconds;
+        const refreshExpiresAt = now + this.config.refreshTokenTtlSeconds;
+        this.accessTokens.set(hashToken(accessToken), {
+            token: accessToken,
+            clientId,
+            scopes,
+            expiresAt: accessExpiresAt,
+            resource,
+        });
+        this.refreshTokens.set(hashToken(refreshToken), {
+            token: refreshToken,
+            clientId,
+            scopes,
+            expiresAt: refreshExpiresAt,
+            resource,
+        });
+        return {
+            access_token: accessToken,
+            token_type: "bearer",
+            expires_in: this.config.accessTokenTtlSeconds,
+            refresh_token: refreshToken,
+            scope: scopes.join(" "),
+        };
+    }
+}
+function authorizationFormFields(client, params) {
+    return {
+        response_type: "code",
+        client_id: client.client_id,
+        redirect_uri: params.redirectUri,
+        code_challenge: params.codeChallenge,
+        code_challenge_method: "S256",
+        scope: params.scopes?.join(" "),
+        state: params.state,
+        resource: params.resource?.href,
+    };
+}
+function hashToken(token) {
+    return createHash("sha256").update(token).digest("base64url");
+}

package/dist/pi-tools.js

@@ -0,0 +1,81 @@
+import { createBashTool, createEditTool, createFindTool, createGrepTool, createLsTool, createReadTool, createWriteTool, } from "@earendil-works/pi-coding-agent";
+import { resolveAllowedPath } from "./roots.js";
+function toMcpContent(result) {
+    return result.content.map((content) => {
+        if (content.type === "text") {
+            return { type: "text", text: content.text };
+        }
+        return {
+            type: "image",
+            data: content.data,
+            mimeType: content.mimeType,
+        };
+    });
+}
+function formatToolError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return [{ type: "text", text: message }];
+}
+async function runTool(execute, input, context) {
+    try {
+        const result = await execute(input);
+        return {
+            content: toMcpContent(result),
+            details: result.details,
+        };
+    }
+    catch (error) {
+        return { content: formatToolError(error), isError: true };
+    }
+}
+export async function readFileTool(input, context) {
+    const path = resolveAllowedPath(input.path, context.cwd, context.readRoots ?? [context.root]);
+    const tool = createReadTool(context.cwd);
+    return runTool((params) => tool.execute("read_file", params), {
+        path,
+        offset: input.offset,
+        limit: input.limit,
+    }, context);
+}
+export async function writeFileTool(input, context) {
+    const path = resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createWriteTool(context.cwd);
+    return runTool((params) => tool.execute("write_file", params), {
+        path,
+        content: input.content,
+    }, context);
+}
+export async function editFileTool(input, context) {
+    const path = resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createEditTool(context.cwd);
+    return runTool((params) => tool.execute("edit_file", params), {
+        path,
+        edits: input.edits,
+    }, context);
+}
+export async function grepFilesTool(input, context) {
+    if (input.path)
+        resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createGrepTool(context.cwd);
+    return runTool((params) => tool.execute("grep_files", params), input, context);
+}
+export async function findFilesTool(input, context) {
+    if (input.path)
+        resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createFindTool(context.cwd);
+    return runTool((params) => tool.execute("find_files", params), input, context);
+}
+export async function listDirectoryTool(input, context) {
+    if (input.path)
+        resolveAllowedPath(input.path, context.cwd, [context.root]);
+    const tool = createLsTool(context.cwd);
+    return runTool((params) => tool.execute("list_directory", params), input, context);
+}
+export async function runShellTool(input, context) {
+    const tool = createBashTool(context.cwd);
+    const timeout = input.timeout === undefined ? 30 : Math.min(input.timeout, 300);
+    return runTool((params) => tool.execute("run_shell", params), {
+        command: input.command,
+        timeout,
+    }, context);
+}