@within-7/minto 0.4.1 → 0.4.2

package/dist/tools/TeamDeleteTool/TeamDeleteTool.js

@@ -0,0 +1,151 @@
+import { Box, Text } from "ink";
+import * as React from "react";
+import { z } from "zod";
+import { rmSync, existsSync } from "fs";
+import { execFileSync } from "child_process";
+import { join } from "path";
+import { homedir } from "os";
+import { FallbackToolUseRejectedMessage } from "../../components/FallbackToolUseRejectedMessage.js";
+import { createToolErrorResult } from "../../utils/tooling/toolError.js";
+import {
+  isAgentTeamsEnabled,
+  getActiveTeams,
+  disbandTeam
+} from "../../services/agentTeams/index.js";
+import { DESCRIPTION, PROMPT } from "./prompt.js";
+import { getTheme } from "../../utils/theme.js";
+import { debug as debugLogger } from "../../utils/debugLogger.js";
+const inputSchema = z.strictObject({});
+const TeamDeleteTool = {
+  name: "TeamDelete",
+  async description() {
+    return DESCRIPTION;
+  },
+  async prompt() {
+    return PROMPT;
+  },
+  inputSchema,
+  userFacingName() {
+    return "Delete Team";
+  },
+  async isEnabled() {
+    return isAgentTeamsEnabled();
+  },
+  isReadOnly() {
+    return false;
+  },
+  isConcurrencySafe() {
+    return false;
+  },
+  needsPermissions() {
+    return false;
+  },
+  renderToolUseMessage() {
+    return null;
+  },
+  renderToolUseRejectedMessage() {
+    return /* @__PURE__ */ React.createElement(FallbackToolUseRejectedMessage, null);
+  },
+  renderToolResultMessage(output) {
+    if (!output) {
+      return /* @__PURE__ */ React.createElement(Box, { flexDirection: "row" }, /* @__PURE__ */ React.createElement(Text, null, "\xA0\xA0\u23BF \xA0"), /* @__PURE__ */ React.createElement(Text, null, "Team deleted"));
+    }
+    const color = output.success ? getTheme().success : getTheme().error;
+    return /* @__PURE__ */ React.createElement(Box, { flexDirection: "row" }, /* @__PURE__ */ React.createElement(Text, null, "\xA0\xA0\u23BF \xA0"), /* @__PURE__ */ React.createElement(Text, { color }, output.message));
+  },
+  renderResultForAssistant(result) {
+    return JSON.stringify(result);
+  },
+  async *call() {
+    try {
+      const teams = getActiveTeams();
+      if (teams.length === 0) {
+        yield {
+          type: "result",
+          data: { success: false, message: "No active team to delete" },
+          resultForAssistant: JSON.stringify({
+            success: false,
+            message: "No active team to delete."
+          })
+        };
+        return;
+      }
+      const team = teams[0];
+      const workingMembers = team.members.filter(
+        (m) => m.status === "working" && m.name !== "team-lead"
+      );
+      if (workingMembers.length > 0) {
+        const names = workingMembers.map((m) => m.name).join(", ");
+        yield {
+          type: "result",
+          data: {
+            success: false,
+            message: `TeamDelete failed: team still has ${workingMembers.length} working member(s): ${names}. Send shutdown_request first, or wait for them to finish, then call TeamDelete.`
+          },
+          resultForAssistant: JSON.stringify({
+            success: false,
+            message: `TeamDelete blocked by working members: ${names}. Send shutdown_request or wait for them to finish.`
+          })
+        };
+        return;
+      }
+      for (const member of team.members) {
+        if (member.worktreePath) {
+          try {
+            if (existsSync(member.worktreePath)) {
+              execFileSync(
+                "git",
+                ["worktree", "remove", member.worktreePath, "--force"],
+                {
+                  stdio: "pipe",
+                  timeout: 1e4
+                }
+              );
+            }
+          } catch {
+          }
+        }
+      }
+      for (const member of team.members) {
+        if (member.tmuxPaneId && member.tmuxPaneId !== "in-process" && member.tmuxPaneId !== "unknown") {
+          try {
+            execFileSync("tmux", ["kill-pane", "-t", member.tmuxPaneId], {
+              stdio: "pipe",
+              timeout: 5e3
+            });
+          } catch {
+            debugLogger.info("TEAM_DELETE_PANE_CLEANUP_SKIP", {
+              memberId: member.id,
+              paneId: member.tmuxPaneId
+            });
+          }
+        }
+      }
+      disbandTeam(team.name);
+      const teamsDir = join(homedir(), ".minto", "teams", team.name);
+      const tasksDir = join(homedir(), ".minto", "tasks", team.name);
+      if (existsSync(teamsDir)) {
+        rmSync(teamsDir, { recursive: true, force: true });
+      }
+      if (existsSync(tasksDir)) {
+        rmSync(tasksDir, { recursive: true, force: true });
+      }
+      const result = {
+        success: true,
+        message: `Team "${team.name}" disbanded`,
+        team_name: team.name
+      };
+      yield {
+        type: "result",
+        data: result,
+        resultForAssistant: this.renderResultForAssistant(result)
+      };
+    } catch (error) {
+      yield createToolErrorResult(error, "Error deleting team");
+    }
+  }
+};
+export {
+  TeamDeleteTool
+};
+//# sourceMappingURL=TeamDeleteTool.js.map

package/dist/tools/TeamDeleteTool/TeamDeleteTool.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/tools/TeamDeleteTool/TeamDeleteTool.tsx"],
+  "sourcesContent": ["import { Box, Text } from 'ink'\nimport * as React from 'react'\nimport { z } from 'zod'\nimport { rmSync, existsSync } from 'fs'\nimport { execFileSync } from 'child_process'\nimport { join } from 'path'\nimport { homedir } from 'os'\nimport { FallbackToolUseRejectedMessage } from '@components/FallbackToolUseRejectedMessage'\nimport { createToolErrorResult } from '@utils/tooling/toolError'\nimport { Tool } from '@tool'\nimport {\n  isAgentTeamsEnabled,\n  getActiveTeams,\n  disbandTeam,\n} from '@services/agentTeams'\nimport { DESCRIPTION, PROMPT } from './prompt'\nimport { getTheme } from '@utils/theme'\nimport { debug as debugLogger } from '@utils/debugLogger'\n\nconst inputSchema = z.strictObject({})\n\nexport const TeamDeleteTool = {\n  name: 'TeamDelete',\n  async description() {\n    return DESCRIPTION\n  },\n  async prompt() {\n    return PROMPT\n  },\n  inputSchema,\n  userFacingName() {\n    return 'Delete Team'\n  },\n  async isEnabled() {\n    return isAgentTeamsEnabled()\n  },\n  isReadOnly() {\n    return false\n  },\n  isConcurrencySafe() {\n    return false\n  },\n  needsPermissions() {\n    return false\n  },\n  renderToolUseMessage() {\n    return null\n  },\n  renderToolUseRejectedMessage() {\n    return <FallbackToolUseRejectedMessage />\n  },\n  renderToolResultMessage(output: { success: boolean; message: string }) {\n    if (!output) {\n      return (\n        <Box flexDirection=\"row\">\n          <Text>&nbsp;&nbsp;\u23BF &nbsp;</Text>\n          <Text>Team deleted</Text>\n        </Box>\n      )\n    }\n    const color = output.success ? getTheme().success : getTheme().error\n    return (\n      <Box flexDirection=\"row\">\n        <Text>&nbsp;&nbsp;\u23BF &nbsp;</Text>\n        <Text color={color}>{output.message}</Text>\n      </Box>\n    )\n  },\n  renderResultForAssistant(result: {\n    success: boolean\n    message: string\n    team_name?: string\n  }) {\n    return JSON.stringify(result)\n  },\n  async *call() {\n    try {\n      const teams = getActiveTeams()\n      if (teams.length === 0) {\n        yield {\n          type: 'result' as const,\n          data: { success: false, message: 'No active team to delete' },\n          resultForAssistant: JSON.stringify({\n            success: false,\n            message: 'No active team to delete.',\n          }),\n        }\n        return\n      }\n\n      const team = teams[0]!\n\n      // Only block on teammates that are actively working (mid-query).\n      // Idle/stopped teammates are safe to force-stop \u2014 disbandTeam() handles cleanup.\n      const workingMembers = team.members.filter(\n        m => m.status === 'working' && m.name !== 'team-lead',\n      )\n      if (workingMembers.length > 0) {\n        const names = workingMembers.map(m => m.name).join(', ')\n        yield {\n          type: 'result' as const,\n          data: {\n            success: false,\n            message: `TeamDelete failed: team still has ${workingMembers.length} working member(s): ${names}. Send shutdown_request first, or wait for them to finish, then call TeamDelete.`,\n          },\n          resultForAssistant: JSON.stringify({\n            success: false,\n            message: `TeamDelete blocked by working members: ${names}. Send shutdown_request or wait for them to finish.`,\n          }),\n        }\n        return\n      }\n\n      // Clean up git worktrees for each member\n      for (const member of team.members) {\n        if (member.worktreePath) {\n          try {\n            if (existsSync(member.worktreePath)) {\n              execFileSync(\n                'git',\n                ['worktree', 'remove', member.worktreePath, '--force'],\n                {\n                  stdio: 'pipe',\n                  timeout: 10000,\n                },\n              )\n            }\n          } catch {\n            /* best-effort worktree cleanup */\n          }\n        }\n      }\n\n      // Kill tmux panes for members that have them.\n      // This must happen BEFORE disbandTeam() which clears the active registry.\n      // Panes may already be gone (agent finished), so each kill is wrapped in try/catch.\n      for (const member of team.members) {\n        if (\n          member.tmuxPaneId &&\n          member.tmuxPaneId !== 'in-process' &&\n          member.tmuxPaneId !== 'unknown'\n        ) {\n          try {\n            execFileSync('tmux', ['kill-pane', '-t', member.tmuxPaneId], {\n              stdio: 'pipe',\n              timeout: 5000,\n            })\n          } catch {\n            // Pane may have already exited \u2014 best-effort cleanup\n            debugLogger.info('TEAM_DELETE_PANE_CLEANUP_SKIP', {\n              memberId: member.id,\n              paneId: member.tmuxPaneId,\n            })\n          }\n        }\n      }\n\n      // Disband the team (clears from active registry)\n      disbandTeam(team.name)\n\n      // Clean up directories\n      const teamsDir = join(homedir(), '.minto', 'teams', team.name)\n      const tasksDir = join(homedir(), '.minto', 'tasks', team.name)\n\n      if (existsSync(teamsDir)) {\n        rmSync(teamsDir, { recursive: true, force: true })\n      }\n      if (existsSync(tasksDir)) {\n        rmSync(tasksDir, { recursive: true, force: true })\n      }\n\n      const result = {\n        success: true,\n        message: `Team \"${team.name}\" disbanded`,\n        team_name: team.name,\n      }\n\n      yield {\n        type: 'result' as const,\n        data: result,\n        resultForAssistant: this.renderResultForAssistant(result),\n      }\n    } catch (error) {\n      yield createToolErrorResult(error, 'Error deleting team')\n    }\n  },\n} satisfies Tool\n"],
+  "mappings": "AAAA,SAAS,KAAK,YAAY;AAC1B,YAAY,WAAW;AACvB,SAAS,SAAS;AAClB,SAAS,QAAQ,kBAAkB;AACnC,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AACrB,SAAS,eAAe;AACxB,SAAS,sCAAsC;AAC/C,SAAS,6BAA6B;AAEtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,cAAc;AACpC,SAAS,gBAAgB;AACzB,SAAS,SAAS,mBAAmB;AAErC,MAAM,cAAc,EAAE,aAAa,CAAC,CAAC;AAE9B,MAAM,iBAAiB;AAAA,EAC5B,MAAM;AAAA,EACN,MAAM,cAAc;AAClB,WAAO;AAAA,EACT;AAAA,EACA,MAAM,SAAS;AACb,WAAO;AAAA,EACT;AAAA,EACA;AAAA,EACA,iBAAiB;AACf,WAAO;AAAA,EACT;AAAA,EACA,MAAM,YAAY;AAChB,WAAO,oBAAoB;AAAA,EAC7B;AAAA,EACA,aAAa;AACX,WAAO;AAAA,EACT;AAAA,EACA,oBAAoB;AAClB,WAAO;AAAA,EACT;AAAA,EACA,mBAAmB;AACjB,WAAO;AAAA,EACT;AAAA,EACA,uBAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EACA,+BAA+B;AAC7B,WAAO,oCAAC,oCAA+B;AAAA,EACzC;AAAA,EACA,wBAAwB,QAA+C;AACrE,QAAI,CAAC,QAAQ;AACX,aACE,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,qBAAoB,GAC1B,oCAAC,YAAK,cAAY,CACpB;AAAA,IAEJ;AACA,UAAM,QAAQ,OAAO,UAAU,SAAS,EAAE,UAAU,SAAS,EAAE;AAC/D,WACE,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,qBAAoB,GAC1B,oCAAC,QAAK,SAAe,OAAO,OAAQ,CACtC;AAAA,EAEJ;AAAA,EACA,yBAAyB,QAItB;AACD,WAAO,KAAK,UAAU,MAAM;AAAA,EAC9B;AAAA,EACA,OAAO,OAAO;AACZ,QAAI;AACF,YAAM,QAAQ,eAAe;AAC7B,UAAI,MAAM,WAAW,GAAG;AACtB,cAAM;AAAA,UACJ,MAAM;AAAA,UACN,MAAM,EAAE,SAAS,OAAO,SAAS,2BAA2B;AAAA,UAC5D,oBAAoB,KAAK,UAAU;AAAA,YACjC,SAAS;AAAA,YACT,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,CAAC;AAIpB,YAAM,iBAAiB,KAAK,QAAQ;AAAA,QAClC,OAAK,EAAE,WAAW,aAAa,EAAE,SAAS;AAAA,MAC5C;AACA,UAAI,eAAe,SAAS,GAAG;AAC7B,cAAM,QAAQ,eAAe,IAAI,OAAK,EAAE,IAAI,EAAE,KAAK,IAAI;AACvD,cAAM;AAAA,UACJ,MAAM;AAAA,UACN,MAAM;AAAA,YACJ,SAAS;AAAA,YACT,SAAS,qCAAqC,eAAe,MAAM,uBAAuB,KAAK;AAAA,UACjG;AAAA,UACA,oBAAoB,KAAK,UAAU;AAAA,YACjC,SAAS;AAAA,YACT,SAAS,0CAA0C,KAAK;AAAA,UAC1D,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAGA,iBAAW,UAAU,KAAK,SAAS;AACjC,YAAI,OAAO,cAAc;AACvB,cAAI;AACF,gBAAI,WAAW,OAAO,YAAY,GAAG;AACnC;AAAA,gBACE;AAAA,gBACA,CAAC,YAAY,UAAU,OAAO,cAAc,SAAS;AAAA,gBACrD;AAAA,kBACE,OAAO;AAAA,kBACP,SAAS;AAAA,gBACX;AAAA,cACF;AAAA,YACF;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAKA,iBAAW,UAAU,KAAK,SAAS;AACjC,YACE,OAAO,cACP,OAAO,eAAe,gBACtB,OAAO,eAAe,WACtB;AACA,cAAI;AACF,yBAAa,QAAQ,CAAC,aAAa,MAAM,OAAO,UAAU,GAAG;AAAA,cAC3D,OAAO;AAAA,cACP,SAAS;AAAA,YACX,CAAC;AAAA,UACH,QAAQ;AAEN,wBAAY,KAAK,iCAAiC;AAAA,cAChD,UAAU,OAAO;AAAA,cACjB,QAAQ,OAAO;AAAA,YACjB,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAGA,kBAAY,KAAK,IAAI;AAGrB,YAAM,WAAW,KAAK,QAAQ,GAAG,UAAU,SAAS,KAAK,IAAI;AAC7D,YAAM,WAAW,KAAK,QAAQ,GAAG,UAAU,SAAS,KAAK,IAAI;AAE7D,UAAI,WAAW,QAAQ,GAAG;AACxB,eAAO,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACnD;AACA,UAAI,WAAW,QAAQ,GAAG;AACxB,eAAO,UAAU,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACnD;AAEA,YAAM,SAAS;AAAA,QACb,SAAS;AAAA,QACT,SAAS,SAAS,KAAK,IAAI;AAAA,QAC3B,WAAW,KAAK;AAAA,MAClB;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,QACN,oBAAoB,KAAK,yBAAyB,MAAM;AAAA,MAC1D;AAAA,IACF,SAAS,OAAO;AACd,YAAM,sBAAsB,OAAO,qBAAqB;AAAA,IAC1D;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/tools/TeamDeleteTool/prompt.js

@@ -0,0 +1,16 @@
+const PROMPT = `Remove team and task directories when the swarm work is complete.
+
+This operation:
+- Removes the team directory (\`~/.minto/teams/{team-name}/\`)
+- Removes the task directory (\`~/.minto/tasks/{team-name}/\`)
+- Clears team context from the current session
+
+**IMPORTANT**: TeamDelete will fail if the team still has active members. Gracefully terminate teammates first, then call TeamDelete after all teammates have shut down.
+
+Use this when all teammates have finished their work and you want to clean up the team resources. The team name is automatically determined from the current session's team context.`;
+const DESCRIPTION = `Remove team and task directories when the swarm work is complete`;
+export {
+  DESCRIPTION,
+  PROMPT
+};
+//# sourceMappingURL=prompt.js.map

package/dist/tools/TeamDeleteTool/prompt.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/tools/TeamDeleteTool/prompt.ts"],
+  "sourcesContent": ["export const PROMPT = `Remove team and task directories when the swarm work is complete.\n\nThis operation:\n- Removes the team directory (\\`~/.minto/teams/{team-name}/\\`)\n- Removes the task directory (\\`~/.minto/tasks/{team-name}/\\`)\n- Clears team context from the current session\n\n**IMPORTANT**: TeamDelete will fail if the team still has active members. Gracefully terminate teammates first, then call TeamDelete after all teammates have shut down.\n\nUse this when all teammates have finished their work and you want to clean up the team resources. The team name is automatically determined from the current session's team context.`\n\nexport const DESCRIPTION = `Remove team and task directories when the swarm work is complete`\n"],
+  "mappings": "AAAO,MAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWf,MAAM,cAAc;",
+  "names": []
+}

package/dist/tools/URLFetcherTool/URLFetcherTool.js

@@ -4,6 +4,7 @@ import { z } from "zod";
 import fetch from "node-fetch";
 import { Cost } from "../../components/Cost.js";
 import { FallbackToolUseRejectedMessage } from "../../components/FallbackToolUseRejectedMessage.js";
+import { DefaultToolResultFallback } from "../../components/messages/DefaultToolResultFallback.js";
 import { DESCRIPTION, TOOL_NAME_FOR_PROMPT } from "./prompt.js";
 import { convertHtmlToMarkdown } from "./htmlToMarkdown.js";
 import { urlCache } from "./cache.js";
@@ -19,6 +20,55 @@ function normalizeUrl(url) {
   }
   return url;
 }
+function isPrivateOrReservedURL(url) {
+  try {
+    const parsed = new URL(url);
+    const hostname = parsed.hostname;
+    if (/^(127\.|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(hostname))
+      return true;
+    if (hostname === "::1" || hostname === "[::1]") return true;
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) return true;
+    if (hostname === "169.254.169.254" || hostname === "metadata.google.internal")
+      return true;
+    if (hostname.startsWith("169.254.")) return true;
+    if (hostname === "0.0.0.0") return true;
+    const ipv4MappedMatch = hostname.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+    if (ipv4MappedMatch) {
+      return isPrivateOrReservedURL(`http://${ipv4MappedMatch[1]}/`);
+    }
+    if (/^\d+$/.test(hostname)) {
+      const decimal = parseInt(hostname, 10);
+      if (!isNaN(decimal) && decimal >= 0 && decimal <= 4294967295) {
+        const a = decimal >>> 24 & 255;
+        const b = decimal >>> 16 & 255;
+        const c = decimal >>> 8 & 255;
+        const d = decimal & 255;
+        return isPrivateOrReservedURL(`http://${a}.${b}.${c}.${d}/`);
+      }
+    }
+    if (/^0x[0-9a-fA-F]+$/.test(hostname)) {
+      const hex = parseInt(hostname, 16);
+      if (!isNaN(hex) && hex >= 0 && hex <= 4294967295) {
+        const a = hex >>> 24 & 255;
+        const b = hex >>> 16 & 255;
+        const c = hex >>> 8 & 255;
+        const d = hex & 255;
+        return isPrivateOrReservedURL(`http://${a}.${b}.${c}.${d}/`);
+      }
+    }
+    const shortIpParts = hostname.split(".");
+    if (shortIpParts.length >= 2 && shortIpParts.length <= 3 && shortIpParts.every((p) => /^\d+$/.test(p))) {
+      const first = parseInt(shortIpParts[0], 10);
+      if (first === 127 || first === 10 || first === 0 || first === 169) {
+        return true;
+      }
+    }
+    if (!["http:", "https:"].includes(parsed.protocol)) return true;
+    return false;
+  } catch {
+    return true;
+  }
+}
 const URLFetcherTool = {
   name: TOOL_NAME_FOR_PROMPT,
   async description() {
@@ -47,7 +97,7 @@ const URLFetcherTool = {
   },
   renderToolResultMessage(output) {
     if (!output) {
-      return /* @__PURE__ */ React.createElement(Box, { justifyContent: "space-between", width: "100%" }, /* @__PURE__ */ React.createElement(Box, { flexDirection: "row" }, /* @__PURE__ */ React.createElement(Text, null, "\xA0\xA0\u23BF \xA0URL fetch completed")));
+      return /* @__PURE__ */ React.createElement(DefaultToolResultFallback, { toolName: "URL fetch" });
     }
     const statusText = output.fromCache ? "from cache" : "fetched";
     return /* @__PURE__ */ React.createElement(Box, { justifyContent: "space-between", width: "100%" }, /* @__PURE__ */ React.createElement(Box, { flexDirection: "row" }, /* @__PURE__ */ React.createElement(Text, null, "\xA0\xA0\u23BF \xA0Content "), /* @__PURE__ */ React.createElement(Text, { bold: true }, statusText, " "), /* @__PURE__ */ React.createElement(Text, null, "and analyzed")), /* @__PURE__ */ React.createElement(Cost, { costUSD: 0, durationMs: 0, debug: false }));
@@ -60,6 +110,19 @@ const URLFetcherTool = {
   },
   async *call({ url, prompt }, {}) {
     const normalizedUrl = normalizeUrl(url);
+    if (isPrivateOrReservedURL(normalizedUrl)) {
+      const output = {
+        url: normalizedUrl,
+        fromCache: false,
+        aiAnalysis: ""
+      };
+      yield {
+        type: "result",
+        resultForAssistant: `Error: URL ${normalizedUrl} targets a private or reserved network address and has been blocked for security reasons.`,
+        data: output
+      };
+      return;
+    }
     try {
       let content;
       let fromCache = false;
@@ -70,20 +133,47 @@ const URLFetcherTool = {
       } else {
         const abortController = new AbortController();
         const timeout = setTimeout(() => abortController.abort(), 3e4);
-        const response = await fetch(normalizedUrl, {
-          method: "GET",
-          headers: {
-            "User-Agent": "Mozilla/5.0 (compatible; URLFetcher/1.0)",
-            Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
-            "Accept-Language": "en-US,en;q=0.5",
-            "Accept-Encoding": "gzip, deflate",
-            Connection: "keep-alive",
-            "Upgrade-Insecure-Requests": "1"
-          },
-          signal: abortController.signal,
-          redirect: "follow"
-        });
+        const MAX_REDIRECTS = 5;
+        let currentUrl = normalizedUrl;
+        let response = null;
+        for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount++) {
+          response = await fetch(currentUrl, {
+            method: "GET",
+            headers: {
+              "User-Agent": "Mozilla/5.0 (compatible; URLFetcher/1.0)",
+              Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+              "Accept-Language": "en-US,en;q=0.5",
+              "Accept-Encoding": "gzip, deflate",
+              Connection: "keep-alive",
+              "Upgrade-Insecure-Requests": "1"
+            },
+            signal: abortController.signal,
+            redirect: "manual"
+          });
+          if (response.status < 300 || response.status >= 400) {
+            break;
+          }
+          const locationHeader = response.headers.get("location");
+          if (!locationHeader) {
+            throw new Error(
+              `Redirect ${response.status} with no Location header`
+            );
+          }
+          const redirectUrl = new URL(locationHeader, currentUrl).toString();
+          if (isPrivateOrReservedURL(redirectUrl)) {
+            throw new Error(
+              `Redirect to ${redirectUrl} blocked: targets a private or reserved network address`
+            );
+          }
+          if (redirectCount === MAX_REDIRECTS) {
+            throw new Error(`Too many redirects (max ${MAX_REDIRECTS})`);
+          }
+          currentUrl = redirectUrl;
+        }
         clearTimeout(timeout);
+        if (!response) {
+          throw new Error("No response received");
+        }
         if (!response.ok) {
           throw new Error(`HTTP ${response.status}: ${response.statusText}`);
         }
@@ -138,6 +228,7 @@ User request: ${prompt}`;
   }
 };
 export {
-  URLFetcherTool
+  URLFetcherTool,
+  isPrivateOrReservedURL
 };
 //# sourceMappingURL=URLFetcherTool.js.map

package/dist/tools/URLFetcherTool/URLFetcherTool.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/tools/URLFetcherTool/URLFetcherTool.tsx"],
-  "sourcesContent": ["import { Box, Text } from 'ink'\nimport React from 'react'\nimport { z } from 'zod'\nimport fetch from 'node-fetch'\nimport { Cost } from '@components/Cost'\nimport { FallbackToolUseRejectedMessage } from '@components/FallbackToolUseRejectedMessage'\nimport { Tool, ToolUseContext } from '@tool'\nimport { DESCRIPTION, TOOL_NAME_FOR_PROMPT } from './prompt'\nimport { convertHtmlToMarkdown } from './htmlToMarkdown'\nimport { urlCache } from './cache'\nimport { queryQuick } from '@services/claude'\nimport { formatUrl, truncateText } from '@utils/format'\n\nconst inputSchema = z.strictObject({\n  url: z.string().url().describe('The URL to fetch content from'),\n  prompt: z.string().describe('The prompt to run on the fetched content'),\n})\n\ntype Input = z.infer<typeof inputSchema>\ntype Output = {\n  url: string\n  fromCache: boolean\n  aiAnalysis: string\n}\n\nfunction normalizeUrl(url: string): string {\n  // Auto-upgrade HTTP to HTTPS\n  if (url.startsWith('http://')) {\n    return url.replace('http://', 'https://')\n  }\n  return url\n}\n\nexport const URLFetcherTool = {\n  name: TOOL_NAME_FOR_PROMPT,\n  async description() {\n    return DESCRIPTION\n  },\n  userFacingName: () => 'URL Fetcher',\n  inputSchema,\n  isReadOnly: () => true,\n  isConcurrencySafe: () => true,\n  async isEnabled() {\n    return true\n  },\n  needsPermissions() {\n    return false\n  },\n  async prompt() {\n    return DESCRIPTION\n  },\n  renderToolUseMessage({ url, prompt }: Input) {\n    const displayUrl = formatUrl(url, 40)\n    const displayPrompt = truncateText(prompt, 30)\n    return `${displayUrl} \u00B7 \"${displayPrompt}\"`\n  },\n  renderToolUseRejectedMessage() {\n    return <FallbackToolUseRejectedMessage />\n  },\n  renderToolResultMessage(output: Output) {\n    // Guard against undefined or null output\n    if (!output) {\n      return (\n        <Box justifyContent=\"space-between\" width=\"100%\">\n          <Box flexDirection=\"row\">\n            <Text>&nbsp;&nbsp;\u23BF &nbsp;URL fetch completed</Text>\n          </Box>\n        </Box>\n      )\n    }\n\n    const statusText = output.fromCache ? 'from cache' : 'fetched'\n\n    return (\n      <Box justifyContent=\"space-between\" width=\"100%\">\n        <Box flexDirection=\"row\">\n          <Text>&nbsp;&nbsp;\u23BF &nbsp;Content </Text>\n          <Text bold>{statusText} </Text>\n          <Text>and analyzed</Text>\n        </Box>\n        <Cost costUSD={0} durationMs={0} debug={false} />\n      </Box>\n    )\n  },\n  renderResultForAssistant(output: Output) {\n    if (!output.aiAnalysis.trim()) {\n      return `No content could be analyzed from URL: ${output.url}`\n    }\n\n    return output.aiAnalysis\n  },\n  async *call({ url, prompt }: Input, {}: ToolUseContext) {\n    const normalizedUrl = normalizeUrl(url)\n\n    try {\n      let content: string\n      let fromCache = false\n\n      // Check cache first\n      const cachedContent = urlCache.get(normalizedUrl)\n      if (cachedContent) {\n        content = cachedContent\n        fromCache = true\n      } else {\n        // Fetch from URL with AbortController for timeout\n        const abortController = new AbortController()\n        const timeout = setTimeout(() => abortController.abort(), 30000)\n\n        const response = await fetch(normalizedUrl, {\n          method: 'GET',\n          headers: {\n            'User-Agent': 'Mozilla/5.0 (compatible; URLFetcher/1.0)',\n            Accept:\n              'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',\n            'Accept-Language': 'en-US,en;q=0.5',\n            'Accept-Encoding': 'gzip, deflate',\n            Connection: 'keep-alive',\n            'Upgrade-Insecure-Requests': '1',\n          },\n          signal: abortController.signal,\n          redirect: 'follow',\n        })\n\n        clearTimeout(timeout)\n\n        if (!response.ok) {\n          throw new Error(`HTTP ${response.status}: ${response.statusText}`)\n        }\n\n        const contentType = response.headers.get('content-type') || ''\n        if (\n          !contentType.includes('text/') &&\n          !contentType.includes('application/')\n        ) {\n          throw new Error(`Unsupported content type: ${contentType}`)\n        }\n\n        const html = await response.text()\n        content = convertHtmlToMarkdown(html)\n\n        // Cache the result\n        urlCache.set(normalizedUrl, content)\n        fromCache = false\n      }\n\n      // Truncate content if too large (keep within reasonable token limits)\n      const maxContentLength = 50000 // ~15k tokens approximately\n      const truncatedContent =\n        content.length > maxContentLength\n          ? content.substring(0, maxContentLength) +\n            '\\n\\n[Content truncated due to length]'\n          : content\n\n      // AI Analysis - always performed fresh, even with cached content\n      const systemPrompt = [\n        \"You are analyzing web content based on a user's specific request.\",\n        'The content has been extracted from a webpage and converted to markdown.',\n        \"Provide a focused response that directly addresses the user's prompt.\",\n      ]\n\n      const userPrompt = `Here is the content from ${normalizedUrl}:\n\n${truncatedContent}\n\nUser request: ${prompt}`\n\n      const aiResponse = await queryQuick({\n        systemPrompt,\n        userPrompt,\n        enablePromptCaching: false,\n      })\n\n      const output: Output = {\n        url: normalizedUrl,\n        fromCache,\n        aiAnalysis:\n          aiResponse.message.content[0]?.text || 'Unable to analyze content',\n      }\n\n      yield {\n        type: 'result' as const,\n        resultForAssistant: this.renderResultForAssistant(output),\n        data: output,\n      }\n    } catch (error: any) {\n      const output: Output = {\n        url: normalizedUrl,\n        fromCache: false,\n        aiAnalysis: '',\n      }\n\n      yield {\n        type: 'result' as const,\n        resultForAssistant: `Error processing URL ${normalizedUrl}: ${error.message}`,\n        data: output,\n      }\n    }\n  },\n} satisfies Tool\n"],
-  "mappings": "AAAA,SAAS,KAAK,YAAY;AAC1B,OAAO,WAAW;AAClB,SAAS,SAAS;AAClB,OAAO,WAAW;AAClB,SAAS,YAAY;AACrB,SAAS,sCAAsC;AAE/C,SAAS,aAAa,4BAA4B;AAClD,SAAS,6BAA6B;AACtC,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,WAAW,oBAAoB;AAExC,MAAM,cAAc,EAAE,aAAa;AAAA,EACjC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,+BAA+B;AAAA,EAC9D,QAAQ,EAAE,OAAO,EAAE,SAAS,0CAA0C;AACxE,CAAC;AASD,SAAS,aAAa,KAAqB;AAEzC,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,WAAO,IAAI,QAAQ,WAAW,UAAU;AAAA,EAC1C;AACA,SAAO;AACT;AAEO,MAAM,iBAAiB;AAAA,EAC5B,MAAM;AAAA,EACN,MAAM,cAAc;AAClB,WAAO;AAAA,EACT;AAAA,EACA,gBAAgB,MAAM;AAAA,EACtB;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,mBAAmB,MAAM;AAAA,EACzB,MAAM,YAAY;AAChB,WAAO;AAAA,EACT;AAAA,EACA,mBAAmB;AACjB,WAAO;AAAA,EACT;AAAA,EACA,MAAM,SAAS;AACb,WAAO;AAAA,EACT;AAAA,EACA,qBAAqB,EAAE,KAAK,OAAO,GAAU;AAC3C,UAAM,aAAa,UAAU,KAAK,EAAE;AACpC,UAAM,gBAAgB,aAAa,QAAQ,EAAE;AAC7C,WAAO,GAAG,UAAU,UAAO,aAAa;AAAA,EAC1C;AAAA,EACA,+BAA+B;AAC7B,WAAO,oCAAC,oCAA+B;AAAA,EACzC;AAAA,EACA,wBAAwB,QAAgB;AAEtC,QAAI,CAAC,QAAQ;AACX,aACE,oCAAC,OAAI,gBAAe,iBAAgB,OAAM,UACxC,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,wCAAuC,CAC/C,CACF;AAAA,IAEJ;AAEA,UAAM,aAAa,OAAO,YAAY,eAAe;AAErD,WACE,oCAAC,OAAI,gBAAe,iBAAgB,OAAM,UACxC,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,6BAA4B,GAClC,oCAAC,QAAK,MAAI,QAAE,YAAW,GAAC,GACxB,oCAAC,YAAK,cAAY,CACpB,GACA,oCAAC,QAAK,SAAS,GAAG,YAAY,GAAG,OAAO,OAAO,CACjD;AAAA,EAEJ;AAAA,EACA,yBAAyB,QAAgB;AACvC,QAAI,CAAC,OAAO,WAAW,KAAK,GAAG;AAC7B,aAAO,0CAA0C,OAAO,GAAG;AAAA,IAC7D;AAEA,WAAO,OAAO;AAAA,EAChB;AAAA,EACA,OAAO,KAAK,EAAE,KAAK,OAAO,GAAU,CAAC,GAAmB;AACtD,UAAM,gBAAgB,aAAa,GAAG;AAEtC,QAAI;AACF,UAAI;AACJ,UAAI,YAAY;AAGhB,YAAM,gBAAgB,SAAS,IAAI,aAAa;AAChD,UAAI,eAAe;AACjB,kBAAU;AACV,oBAAY;AAAA,MACd,OAAO;AAEL,cAAM,kBAAkB,IAAI,gBAAgB;AAC5C,cAAM,UAAU,WAAW,MAAM,gBAAgB,MAAM,GAAG,GAAK;AAE/D,cAAM,WAAW,MAAM,MAAM,eAAe;AAAA,UAC1C,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,cAAc;AAAA,YACd,QACE;AAAA,YACF,mBAAmB;AAAA,YACnB,mBAAmB;AAAA,YACnB,YAAY;AAAA,YACZ,6BAA6B;AAAA,UAC/B;AAAA,UACA,QAAQ,gBAAgB;AAAA,UACxB,UAAU;AAAA,QACZ,CAAC;AAED,qBAAa,OAAO;AAEpB,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,IAAI,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE;AAAA,QACnE;AAEA,cAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,YACE,CAAC,YAAY,SAAS,OAAO,KAC7B,CAAC,YAAY,SAAS,cAAc,GACpC;AACA,gBAAM,IAAI,MAAM,6BAA6B,WAAW,EAAE;AAAA,QAC5D;AAEA,cAAM,OAAO,MAAM,SAAS,KAAK;AACjC,kBAAU,sBAAsB,IAAI;AAGpC,iBAAS,IAAI,eAAe,OAAO;AACnC,oBAAY;AAAA,MACd;AAGA,YAAM,mBAAmB;AACzB,YAAM,mBACJ,QAAQ,SAAS,mBACb,QAAQ,UAAU,GAAG,gBAAgB,IACrC,0CACA;AAGN,YAAM,eAAe;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,aAAa,4BAA4B,aAAa;AAAA;AAAA,EAEhE,gBAAgB;AAAA;AAAA,gBAEF,MAAM;AAEhB,YAAM,aAAa,MAAM,WAAW;AAAA,QAClC;AAAA,QACA;AAAA,QACA,qBAAqB;AAAA,MACvB,CAAC;AAED,YAAM,SAAiB;AAAA,QACrB,KAAK;AAAA,QACL;AAAA,QACA,YACE,WAAW,QAAQ,QAAQ,CAAC,GAAG,QAAQ;AAAA,MAC3C;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,KAAK,yBAAyB,MAAM;AAAA,QACxD,MAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAY;AACnB,YAAM,SAAiB;AAAA,QACrB,KAAK;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,MACd;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,wBAAwB,aAAa,KAAK,MAAM,OAAO;AAAA,QAC3E,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { Box, Text } from 'ink'\nimport React from 'react'\nimport { z } from 'zod'\nimport fetch from 'node-fetch'\nimport { Cost } from '@components/Cost'\nimport { FallbackToolUseRejectedMessage } from '@components/FallbackToolUseRejectedMessage'\nimport { DefaultToolResultFallback } from '@components/messages/DefaultToolResultFallback'\nimport { Tool, ToolUseContext } from '@tool'\nimport { DESCRIPTION, TOOL_NAME_FOR_PROMPT } from './prompt'\nimport { convertHtmlToMarkdown } from './htmlToMarkdown'\nimport { urlCache } from './cache'\nimport { queryQuick } from '@services/claude'\nimport { formatUrl, truncateText } from '@utils/format'\n\nconst inputSchema = z.strictObject({\n  url: z.string().url().describe('The URL to fetch content from'),\n  prompt: z.string().describe('The prompt to run on the fetched content'),\n})\n\ntype Input = z.infer<typeof inputSchema>\ntype Output = {\n  url: string\n  fromCache: boolean\n  aiAnalysis: string\n}\n\nfunction normalizeUrl(url: string): string {\n  // Auto-upgrade HTTP to HTTPS\n  if (url.startsWith('http://')) {\n    return url.replace('http://', 'https://')\n  }\n  return url\n}\n\n/**\n * SSRF protection: block requests to private/reserved network addresses.\n * Prevents server-side request forgery attacks targeting internal services,\n * cloud metadata endpoints, and localhost.\n */\nexport function isPrivateOrReservedURL(url: string): boolean {\n  try {\n    const parsed = new URL(url)\n    const hostname = parsed.hostname\n    // Block private IPv4 ranges\n    if (/^(127\\.|10\\.|192\\.168\\.|172\\.(1[6-9]|2\\d|3[01])\\.)/.test(hostname))\n      return true\n    // Block IPv6 loopback\n    if (hostname === '::1' || hostname === '[::1]') return true\n    // Block localhost\n    if (hostname === 'localhost' || hostname.endsWith('.localhost')) return true\n    // Block cloud metadata endpoints\n    if (\n      hostname === '169.254.169.254' ||\n      hostname === 'metadata.google.internal'\n    )\n      return true\n    // Block link-local\n    if (hostname.startsWith('169.254.')) return true\n    // Block 0.0.0.0 (binds to all interfaces, often resolves to localhost)\n    if (hostname === '0.0.0.0') return true\n    // Block IPv4-mapped IPv6 addresses (::ffff:127.0.0.1, ::ffff:10.x.x.x, etc.)\n    const ipv4MappedMatch = hostname.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/i)\n    if (ipv4MappedMatch) {\n      // Recursively check the embedded IPv4 address\n      return isPrivateOrReservedURL(`http://${ipv4MappedMatch[1]}/`)\n    }\n    // Block decimal IP addresses (e.g., 2130706433 = 127.0.0.1)\n    if (/^\\d+$/.test(hostname)) {\n      const decimal = parseInt(hostname, 10)\n      if (!isNaN(decimal) && decimal >= 0 && decimal <= 0xffffffff) {\n        const a = (decimal >>> 24) & 0xff\n        const b = (decimal >>> 16) & 0xff\n        const c = (decimal >>> 8) & 0xff\n        const d = decimal & 0xff\n        return isPrivateOrReservedURL(`http://${a}.${b}.${c}.${d}/`)\n      }\n    }\n    // Block hex IP addresses (e.g., 0x7f000001 = 127.0.0.1)\n    if (/^0x[0-9a-fA-F]+$/.test(hostname)) {\n      const hex = parseInt(hostname, 16)\n      if (!isNaN(hex) && hex >= 0 && hex <= 0xffffffff) {\n        const a = (hex >>> 24) & 0xff\n        const b = (hex >>> 16) & 0xff\n        const c = (hex >>> 8) & 0xff\n        const d = hex & 0xff\n        return isPrivateOrReservedURL(`http://${a}.${b}.${c}.${d}/`)\n      }\n    }\n    // Block short-form IPs (e.g., 127.1 = 127.0.0.1, 127.0.1 = 127.0.0.1)\n    const shortIpParts = hostname.split('.')\n    if (\n      shortIpParts.length >= 2 &&\n      shortIpParts.length <= 3 &&\n      shortIpParts.every(p => /^\\d+$/.test(p))\n    ) {\n      // Short-form IPs: the last part fills the remaining octets\n      // e.g., 127.1 \u2192 127.0.0.1, 10.1 \u2192 10.0.0.1\n      const first = parseInt(shortIpParts[0], 10)\n      if (first === 127 || first === 10 || first === 0 || first === 169) {\n        return true\n      }\n    }\n    // Block non-HTTP(S) schemes\n    if (!['http:', 'https:'].includes(parsed.protocol)) return true\n    return false\n  } catch {\n    return true // Block malformed URLs\n  }\n}\n\nexport const URLFetcherTool = {\n  name: TOOL_NAME_FOR_PROMPT,\n  async description() {\n    return DESCRIPTION\n  },\n  userFacingName: () => 'URL Fetcher',\n  inputSchema,\n  isReadOnly: () => true,\n  isConcurrencySafe: () => true,\n  async isEnabled() {\n    return true\n  },\n  needsPermissions() {\n    return false\n  },\n  async prompt() {\n    return DESCRIPTION\n  },\n  renderToolUseMessage({ url, prompt }: Input) {\n    const displayUrl = formatUrl(url, 40)\n    const displayPrompt = truncateText(prompt, 30)\n    return `${displayUrl} \u00B7 \"${displayPrompt}\"`\n  },\n  renderToolUseRejectedMessage() {\n    return <FallbackToolUseRejectedMessage />\n  },\n  renderToolResultMessage(output: Output) {\n    // Guard against undefined or null output\n    if (!output) {\n      return <DefaultToolResultFallback toolName=\"URL fetch\" />\n    }\n\n    const statusText = output.fromCache ? 'from cache' : 'fetched'\n\n    return (\n      <Box justifyContent=\"space-between\" width=\"100%\">\n        <Box flexDirection=\"row\">\n          <Text>&nbsp;&nbsp;\u23BF &nbsp;Content </Text>\n          <Text bold>{statusText} </Text>\n          <Text>and analyzed</Text>\n        </Box>\n        <Cost costUSD={0} durationMs={0} debug={false} />\n      </Box>\n    )\n  },\n  renderResultForAssistant(output: Output) {\n    if (!output.aiAnalysis.trim()) {\n      return `No content could be analyzed from URL: ${output.url}`\n    }\n\n    return output.aiAnalysis\n  },\n  async *call({ url, prompt }: Input, {}: ToolUseContext) {\n    const normalizedUrl = normalizeUrl(url)\n\n    // SSRF protection: block private/reserved URLs\n    if (isPrivateOrReservedURL(normalizedUrl)) {\n      const output: Output = {\n        url: normalizedUrl,\n        fromCache: false,\n        aiAnalysis: '',\n      }\n      yield {\n        type: 'result' as const,\n        resultForAssistant: `Error: URL ${normalizedUrl} targets a private or reserved network address and has been blocked for security reasons.`,\n        data: output,\n      }\n      return\n    }\n\n    try {\n      let content: string\n      let fromCache = false\n\n      // Check cache first\n      const cachedContent = urlCache.get(normalizedUrl)\n      if (cachedContent) {\n        content = cachedContent\n        fromCache = true\n      } else {\n        // Fetch from URL with AbortController for timeout\n        // Use manual redirect handling to validate each redirect target against SSRF\n        const abortController = new AbortController()\n        const timeout = setTimeout(() => abortController.abort(), 30000)\n\n        const MAX_REDIRECTS = 5\n        let currentUrl = normalizedUrl\n        let response: Awaited<ReturnType<typeof fetch>> | null = null\n\n        for (\n          let redirectCount = 0;\n          redirectCount <= MAX_REDIRECTS;\n          redirectCount++\n        ) {\n          response = await fetch(currentUrl, {\n            method: 'GET',\n            headers: {\n              'User-Agent': 'Mozilla/5.0 (compatible; URLFetcher/1.0)',\n              Accept:\n                'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',\n              'Accept-Language': 'en-US,en;q=0.5',\n              'Accept-Encoding': 'gzip, deflate',\n              Connection: 'keep-alive',\n              'Upgrade-Insecure-Requests': '1',\n            },\n            signal: abortController.signal,\n            redirect: 'manual',\n          })\n\n          // If not a redirect, break out\n          if (response.status < 300 || response.status >= 400) {\n            break\n          }\n\n          // Handle redirect: validate the Location header\n          const locationHeader = response.headers.get('location')\n          if (!locationHeader) {\n            throw new Error(\n              `Redirect ${response.status} with no Location header`,\n            )\n          }\n\n          // Resolve relative redirects against the current URL\n          const redirectUrl = new URL(locationHeader, currentUrl).toString()\n\n          // SSRF check on redirect target\n          if (isPrivateOrReservedURL(redirectUrl)) {\n            throw new Error(\n              `Redirect to ${redirectUrl} blocked: targets a private or reserved network address`,\n            )\n          }\n\n          if (redirectCount === MAX_REDIRECTS) {\n            throw new Error(`Too many redirects (max ${MAX_REDIRECTS})`)\n          }\n\n          currentUrl = redirectUrl\n        }\n\n        clearTimeout(timeout)\n\n        if (!response) {\n          throw new Error('No response received')\n        }\n\n        if (!response.ok) {\n          throw new Error(`HTTP ${response.status}: ${response.statusText}`)\n        }\n\n        const contentType = response.headers.get('content-type') || ''\n        if (\n          !contentType.includes('text/') &&\n          !contentType.includes('application/')\n        ) {\n          throw new Error(`Unsupported content type: ${contentType}`)\n        }\n\n        const html = await response.text()\n        content = convertHtmlToMarkdown(html)\n\n        // Cache the result\n        urlCache.set(normalizedUrl, content)\n        fromCache = false\n      }\n\n      // Truncate content if too large (keep within reasonable token limits)\n      const maxContentLength = 50000 // ~15k tokens approximately\n      const truncatedContent =\n        content.length > maxContentLength\n          ? content.substring(0, maxContentLength) +\n            '\\n\\n[Content truncated due to length]'\n          : content\n\n      // AI Analysis - always performed fresh, even with cached content\n      const systemPrompt = [\n        \"You are analyzing web content based on a user's specific request.\",\n        'The content has been extracted from a webpage and converted to markdown.',\n        \"Provide a focused response that directly addresses the user's prompt.\",\n      ]\n\n      const userPrompt = `Here is the content from ${normalizedUrl}:\n\n${truncatedContent}\n\nUser request: ${prompt}`\n\n      const aiResponse = await queryQuick({\n        systemPrompt,\n        userPrompt,\n        enablePromptCaching: false,\n      })\n\n      const output: Output = {\n        url: normalizedUrl,\n        fromCache,\n        aiAnalysis:\n          aiResponse.message.content[0]?.text || 'Unable to analyze content',\n      }\n\n      yield {\n        type: 'result' as const,\n        resultForAssistant: this.renderResultForAssistant(output),\n        data: output,\n      }\n    } catch (error: any) {\n      const output: Output = {\n        url: normalizedUrl,\n        fromCache: false,\n        aiAnalysis: '',\n      }\n\n      yield {\n        type: 'result' as const,\n        resultForAssistant: `Error processing URL ${normalizedUrl}: ${error.message}`,\n        data: output,\n      }\n    }\n  },\n} satisfies Tool\n"],
+  "mappings": "AAAA,SAAS,KAAK,YAAY;AAC1B,OAAO,WAAW;AAClB,SAAS,SAAS;AAClB,OAAO,WAAW;AAClB,SAAS,YAAY;AACrB,SAAS,sCAAsC;AAC/C,SAAS,iCAAiC;AAE1C,SAAS,aAAa,4BAA4B;AAClD,SAAS,6BAA6B;AACtC,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,WAAW,oBAAoB;AAExC,MAAM,cAAc,EAAE,aAAa;AAAA,EACjC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,+BAA+B;AAAA,EAC9D,QAAQ,EAAE,OAAO,EAAE,SAAS,0CAA0C;AACxE,CAAC;AASD,SAAS,aAAa,KAAqB;AAEzC,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,WAAO,IAAI,QAAQ,WAAW,UAAU;AAAA,EAC1C;AACA,SAAO;AACT;AAOO,SAAS,uBAAuB,KAAsB;AAC3D,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,UAAM,WAAW,OAAO;AAExB,QAAI,qDAAqD,KAAK,QAAQ;AACpE,aAAO;AAET,QAAI,aAAa,SAAS,aAAa,QAAS,QAAO;AAEvD,QAAI,aAAa,eAAe,SAAS,SAAS,YAAY,EAAG,QAAO;AAExE,QACE,aAAa,qBACb,aAAa;AAEb,aAAO;AAET,QAAI,SAAS,WAAW,UAAU,EAAG,QAAO;AAE5C,QAAI,aAAa,UAAW,QAAO;AAEnC,UAAM,kBAAkB,SAAS,MAAM,gCAAgC;AACvE,QAAI,iBAAiB;AAEnB,aAAO,uBAAuB,UAAU,gBAAgB,CAAC,CAAC,GAAG;AAAA,IAC/D;AAEA,QAAI,QAAQ,KAAK,QAAQ,GAAG;AAC1B,YAAM,UAAU,SAAS,UAAU,EAAE;AACrC,UAAI,CAAC,MAAM,OAAO,KAAK,WAAW,KAAK,WAAW,YAAY;AAC5D,cAAM,IAAK,YAAY,KAAM;AAC7B,cAAM,IAAK,YAAY,KAAM;AAC7B,cAAM,IAAK,YAAY,IAAK;AAC5B,cAAM,IAAI,UAAU;AACpB,eAAO,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;AAAA,MAC7D;AAAA,IACF;AAEA,QAAI,mBAAmB,KAAK,QAAQ,GAAG;AACrC,YAAM,MAAM,SAAS,UAAU,EAAE;AACjC,UAAI,CAAC,MAAM,GAAG,KAAK,OAAO,KAAK,OAAO,YAAY;AAChD,cAAM,IAAK,QAAQ,KAAM;AACzB,cAAM,IAAK,QAAQ,KAAM;AACzB,cAAM,IAAK,QAAQ,IAAK;AACxB,cAAM,IAAI,MAAM;AAChB,eAAO,uBAAuB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;AAAA,MAC7D;AAAA,IACF;AAEA,UAAM,eAAe,SAAS,MAAM,GAAG;AACvC,QACE,aAAa,UAAU,KACvB,aAAa,UAAU,KACvB,aAAa,MAAM,OAAK,QAAQ,KAAK,CAAC,CAAC,GACvC;AAGA,YAAM,QAAQ,SAAS,aAAa,CAAC,GAAG,EAAE;AAC1C,UAAI,UAAU,OAAO,UAAU,MAAM,UAAU,KAAK,UAAU,KAAK;AACjE,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,OAAO,QAAQ,EAAG,QAAO;AAC3D,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,iBAAiB;AAAA,EAC5B,MAAM;AAAA,EACN,MAAM,cAAc;AAClB,WAAO;AAAA,EACT;AAAA,EACA,gBAAgB,MAAM;AAAA,EACtB;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,mBAAmB,MAAM;AAAA,EACzB,MAAM,YAAY;AAChB,WAAO;AAAA,EACT;AAAA,EACA,mBAAmB;AACjB,WAAO;AAAA,EACT;AAAA,EACA,MAAM,SAAS;AACb,WAAO;AAAA,EACT;AAAA,EACA,qBAAqB,EAAE,KAAK,OAAO,GAAU;AAC3C,UAAM,aAAa,UAAU,KAAK,EAAE;AACpC,UAAM,gBAAgB,aAAa,QAAQ,EAAE;AAC7C,WAAO,GAAG,UAAU,UAAO,aAAa;AAAA,EAC1C;AAAA,EACA,+BAA+B;AAC7B,WAAO,oCAAC,oCAA+B;AAAA,EACzC;AAAA,EACA,wBAAwB,QAAgB;AAEtC,QAAI,CAAC,QAAQ;AACX,aAAO,oCAAC,6BAA0B,UAAS,aAAY;AAAA,IACzD;AAEA,UAAM,aAAa,OAAO,YAAY,eAAe;AAErD,WACE,oCAAC,OAAI,gBAAe,iBAAgB,OAAM,UACxC,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,6BAA4B,GAClC,oCAAC,QAAK,MAAI,QAAE,YAAW,GAAC,GACxB,oCAAC,YAAK,cAAY,CACpB,GACA,oCAAC,QAAK,SAAS,GAAG,YAAY,GAAG,OAAO,OAAO,CACjD;AAAA,EAEJ;AAAA,EACA,yBAAyB,QAAgB;AACvC,QAAI,CAAC,OAAO,WAAW,KAAK,GAAG;AAC7B,aAAO,0CAA0C,OAAO,GAAG;AAAA,IAC7D;AAEA,WAAO,OAAO;AAAA,EAChB;AAAA,EACA,OAAO,KAAK,EAAE,KAAK,OAAO,GAAU,CAAC,GAAmB;AACtD,UAAM,gBAAgB,aAAa,GAAG;AAGtC,QAAI,uBAAuB,aAAa,GAAG;AACzC,YAAM,SAAiB;AAAA,QACrB,KAAK;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,MACd;AACA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,cAAc,aAAa;AAAA,QAC/C,MAAM;AAAA,MACR;AACA;AAAA,IACF;AAEA,QAAI;AACF,UAAI;AACJ,UAAI,YAAY;AAGhB,YAAM,gBAAgB,SAAS,IAAI,aAAa;AAChD,UAAI,eAAe;AACjB,kBAAU;AACV,oBAAY;AAAA,MACd,OAAO;AAGL,cAAM,kBAAkB,IAAI,gBAAgB;AAC5C,cAAM,UAAU,WAAW,MAAM,gBAAgB,MAAM,GAAG,GAAK;AAE/D,cAAM,gBAAgB;AACtB,YAAI,aAAa;AACjB,YAAI,WAAqD;AAEzD,iBACM,gBAAgB,GACpB,iBAAiB,eACjB,iBACA;AACA,qBAAW,MAAM,MAAM,YAAY;AAAA,YACjC,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,cAAc;AAAA,cACd,QACE;AAAA,cACF,mBAAmB;AAAA,cACnB,mBAAmB;AAAA,cACnB,YAAY;AAAA,cACZ,6BAA6B;AAAA,YAC/B;AAAA,YACA,QAAQ,gBAAgB;AAAA,YACxB,UAAU;AAAA,UACZ,CAAC;AAGD,cAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AACnD;AAAA,UACF;AAGA,gBAAM,iBAAiB,SAAS,QAAQ,IAAI,UAAU;AACtD,cAAI,CAAC,gBAAgB;AACnB,kBAAM,IAAI;AAAA,cACR,YAAY,SAAS,MAAM;AAAA,YAC7B;AAAA,UACF;AAGA,gBAAM,cAAc,IAAI,IAAI,gBAAgB,UAAU,EAAE,SAAS;AAGjE,cAAI,uBAAuB,WAAW,GAAG;AACvC,kBAAM,IAAI;AAAA,cACR,eAAe,WAAW;AAAA,YAC5B;AAAA,UACF;AAEA,cAAI,kBAAkB,eAAe;AACnC,kBAAM,IAAI,MAAM,2BAA2B,aAAa,GAAG;AAAA,UAC7D;AAEA,uBAAa;AAAA,QACf;AAEA,qBAAa,OAAO;AAEpB,YAAI,CAAC,UAAU;AACb,gBAAM,IAAI,MAAM,sBAAsB;AAAA,QACxC;AAEA,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,IAAI,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE;AAAA,QACnE;AAEA,cAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,YACE,CAAC,YAAY,SAAS,OAAO,KAC7B,CAAC,YAAY,SAAS,cAAc,GACpC;AACA,gBAAM,IAAI,MAAM,6BAA6B,WAAW,EAAE;AAAA,QAC5D;AAEA,cAAM,OAAO,MAAM,SAAS,KAAK;AACjC,kBAAU,sBAAsB,IAAI;AAGpC,iBAAS,IAAI,eAAe,OAAO;AACnC,oBAAY;AAAA,MACd;AAGA,YAAM,mBAAmB;AACzB,YAAM,mBACJ,QAAQ,SAAS,mBACb,QAAQ,UAAU,GAAG,gBAAgB,IACrC,0CACA;AAGN,YAAM,eAAe;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,aAAa,4BAA4B,aAAa;AAAA;AAAA,EAEhE,gBAAgB;AAAA;AAAA,gBAEF,MAAM;AAEhB,YAAM,aAAa,MAAM,WAAW;AAAA,QAClC;AAAA,QACA;AAAA,QACA,qBAAqB;AAAA,MACvB,CAAC;AAED,YAAM,SAAiB;AAAA,QACrB,KAAK;AAAA,QACL;AAAA,QACA,YACE,WAAW,QAAQ,QAAQ,CAAC,GAAG,QAAQ;AAAA,MAC3C;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,KAAK,yBAAyB,MAAM;AAAA,QACxD,MAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAY;AACnB,YAAM,SAAiB;AAAA,QACrB,KAAK;AAAA,QACL,WAAW;AAAA,QACX,YAAY;AAAA,MACd;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,wBAAwB,aAAa,KAAK,MAAM,OAAO;AAAA,QAC3E,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/tools/URLFetcherTool/prompt.js

@@ -12,14 +12,15 @@ Capabilities:
 
 Limitations:
 - Cannot bypass bot detection or CAPTCHAs on protected sites
-- May fail on sites with aggressive anti-scraping measures
+- Frequently fails on sites with anti-scraping measures (weather sites, news sites, etc.)
 - Cannot access authenticated/private content
 
 Usage notes:
 - The URL must be a fully-formed valid URL (e.g., https://example.com)
 - HTTP URLs will be automatically upgraded to HTTPS
 - The prompt should describe what information you want to extract
-- If this tool fails due to access restrictions, consider trying MCP scraping tools (mcp__*__scrape_*) which may have better success`;
+- IMPORTANT: If MCP scraping tools are available in <available-deferred-tools> (e.g. mcp__BrightData__scrape_as_markdown, mcp__BrightData__scrape_as_html), use ToolSearch to load them and prefer them \u2014 they bypass bot detection and handle protected sites reliably
+- Only use this built-in fetcher when no MCP scraping tools are available, or for simple unprotected pages`;
 export {
   DESCRIPTION,
   TOOL_NAME_FOR_PROMPT

package/dist/tools/URLFetcherTool/prompt.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/tools/URLFetcherTool/prompt.ts"],
-  "sourcesContent": ["export const TOOL_NAME_FOR_PROMPT = 'WebFetch'\nexport const DESCRIPTION = `- Built-in URL fetcher that retrieves and analyzes web content\n- Takes a URL and a prompt as input\n- Fetches the URL content, converts HTML to markdown\n- Processes the content with the prompt using a small, fast model\n\nCapabilities:\n- Fetch and analyze public web pages\n- Extract specific information based on prompt\n- Automatic redirect handling\n- 15-minute cache for repeated access\n\nLimitations:\n- Cannot bypass bot detection or CAPTCHAs on protected sites\n- May fail on sites with aggressive anti-scraping measures\n- Cannot access authenticated/private content\n\nUsage notes:\n- The URL must be a fully-formed valid URL (e.g., https://example.com)\n- HTTP URLs will be automatically upgraded to HTTPS\n- The prompt should describe what information you want to extract\n- If this tool fails due to access restrictions, consider trying MCP scraping tools (mcp__*__scrape_*) which may have better success`\n"],
-  "mappings": "AAAO,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "sourcesContent": ["export const TOOL_NAME_FOR_PROMPT = 'WebFetch'\nexport const DESCRIPTION = `- Built-in URL fetcher that retrieves and analyzes web content\n- Takes a URL and a prompt as input\n- Fetches the URL content, converts HTML to markdown\n- Processes the content with the prompt using a small, fast model\n\nCapabilities:\n- Fetch and analyze public web pages\n- Extract specific information based on prompt\n- Automatic redirect handling\n- 15-minute cache for repeated access\n\nLimitations:\n- Cannot bypass bot detection or CAPTCHAs on protected sites\n- Frequently fails on sites with anti-scraping measures (weather sites, news sites, etc.)\n- Cannot access authenticated/private content\n\nUsage notes:\n- The URL must be a fully-formed valid URL (e.g., https://example.com)\n- HTTP URLs will be automatically upgraded to HTTPS\n- The prompt should describe what information you want to extract\n- IMPORTANT: If MCP scraping tools are available in <available-deferred-tools> (e.g. mcp__BrightData__scrape_as_markdown, mcp__BrightData__scrape_as_html), use ToolSearch to load them and prefer them \u2014 they bypass bot detection and handle protected sites reliably\n- Only use this built-in fetcher when no MCP scraping tools are available, or for simple unprotected pages`\n"],
+  "mappings": "AAAO,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
   "names": []
 }

package/dist/tools/WebSearchTool/WebSearchTool.js

@@ -3,6 +3,7 @@ import React from "react";
 import { z } from "zod";
 import { Cost } from "../../components/Cost.js";
 import { FallbackToolUseRejectedMessage } from "../../components/FallbackToolUseRejectedMessage.js";
+import { DefaultToolResultFallback } from "../../components/messages/DefaultToolResultFallback.js";
 import { DESCRIPTION, TOOL_NAME_FOR_PROMPT } from "./prompt.js";
 import { searchProviders } from "./searchProviders.js";
 const inputSchema = z.strictObject({
@@ -34,7 +35,7 @@ const WebSearchTool = {
   },
   renderToolResultMessage(output) {
     if (!output) {
-      return /* @__PURE__ */ React.createElement(Box, { justifyContent: "space-between", width: "100%" }, /* @__PURE__ */ React.createElement(Box, { flexDirection: "row" }, /* @__PURE__ */ React.createElement(Text, null, "\xA0\xA0\u23BF \xA0Search completed")));
+      return /* @__PURE__ */ React.createElement(DefaultToolResultFallback, { toolName: "Search" });
     }
     const resultsLength = output.results?.length ?? 0;
     const durationMs = output.durationMs ?? 0;

package/dist/tools/WebSearchTool/WebSearchTool.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/tools/WebSearchTool/WebSearchTool.tsx"],
-  "sourcesContent": ["import { Box, Text } from 'ink'\nimport React from 'react'\nimport { z } from 'zod'\nimport { Cost } from '@components/Cost'\nimport { FallbackToolUseRejectedMessage } from '@components/FallbackToolUseRejectedMessage'\nimport { Tool, ToolUseContext } from '@tool'\nimport { DESCRIPTION, TOOL_NAME_FOR_PROMPT } from './prompt'\nimport { SearchResult, searchProviders } from './searchProviders'\n\nconst inputSchema = z.strictObject({\n  query: z.string().describe('The search query'),\n})\n\ntype Input = z.infer<typeof inputSchema>\ntype Output = {\n  durationMs: number\n  results: SearchResult[]\n}\n\nexport const WebSearchTool = {\n  name: TOOL_NAME_FOR_PROMPT,\n  async description() {\n    return DESCRIPTION\n  },\n  userFacingName: () => 'Web Search',\n  inputSchema,\n  isReadOnly: () => true,\n  isConcurrencySafe: () => true,\n  async isEnabled() {\n    return true\n  },\n  needsPermissions() {\n    return false\n  },\n  async prompt() {\n    return DESCRIPTION\n  },\n  renderToolUseMessage({ query }: Input) {\n    return `Searching for: \"${query}\" using DuckDuckGo`\n  },\n  renderToolUseRejectedMessage() {\n    return <FallbackToolUseRejectedMessage />\n  },\n  renderToolResultMessage(output: Output) {\n    // Guard against undefined or null output\n    if (!output) {\n      return (\n        <Box justifyContent=\"space-between\" width=\"100%\">\n          <Box flexDirection=\"row\">\n            <Text>&nbsp;&nbsp;\u23BF &nbsp;Search completed</Text>\n          </Box>\n        </Box>\n      )\n    }\n\n    const resultsLength = output.results?.length ?? 0\n    const durationMs = output.durationMs ?? 0\n\n    return (\n      <Box justifyContent=\"space-between\" width=\"100%\">\n        <Box flexDirection=\"row\">\n          <Text>&nbsp;&nbsp;\u23BF &nbsp;Found </Text>\n          <Text bold>{resultsLength} </Text>\n          <Text>\n            {resultsLength === 1 ? 'result' : 'results'} using DuckDuckGo\n          </Text>\n        </Box>\n        <Cost costUSD={0} durationMs={durationMs} debug={false} />\n      </Box>\n    )\n  },\n  renderResultForAssistant(output: Output) {\n    if (output.results.length === 0) {\n      return `No results found using DuckDuckGo.`\n    }\n\n    let result = `Found ${output.results.length} search results using DuckDuckGo:\\n\\n`\n\n    output.results.forEach((item, index) => {\n      result += `${index + 1}. **${item.title}**\\n`\n      result += `   ${item.snippet}\\n`\n      result += `   Link: ${item.link}\\n\\n`\n    })\n\n    result += `You can reference these results to provide current, accurate information to the user.`\n    return result\n  },\n  async *call({ query }: Input, {}: ToolUseContext) {\n    const start = Date.now()\n\n    try {\n      const searchResults = await searchProviders.duckduckgo.search(query)\n\n      const output: Output = {\n        results: searchResults,\n        durationMs: Date.now() - start,\n      }\n\n      yield {\n        type: 'result' as const,\n        resultForAssistant: this.renderResultForAssistant(output),\n        data: output,\n      }\n    } catch (error: any) {\n      const output: Output = {\n        results: [],\n        durationMs: Date.now() - start,\n      }\n      yield {\n        type: 'result' as const,\n        resultForAssistant: `An error occurred during web search with DuckDuckGo: ${error.message}`,\n        data: output,\n      }\n    }\n  },\n} satisfies Tool\n"],
-  "mappings": "AAAA,SAAS,KAAK,YAAY;AAC1B,OAAO,WAAW;AAClB,SAAS,SAAS;AAClB,SAAS,YAAY;AACrB,SAAS,sCAAsC;AAE/C,SAAS,aAAa,4BAA4B;AAClD,SAAuB,uBAAuB;AAE9C,MAAM,cAAc,EAAE,aAAa;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,SAAS,kBAAkB;AAC/C,CAAC;AAQM,MAAM,gBAAgB;AAAA,EAC3B,MAAM;AAAA,EACN,MAAM,cAAc;AAClB,WAAO;AAAA,EACT;AAAA,EACA,gBAAgB,MAAM;AAAA,EACtB;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,mBAAmB,MAAM;AAAA,EACzB,MAAM,YAAY;AAChB,WAAO;AAAA,EACT;AAAA,EACA,mBAAmB;AACjB,WAAO;AAAA,EACT;AAAA,EACA,MAAM,SAAS;AACb,WAAO;AAAA,EACT;AAAA,EACA,qBAAqB,EAAE,MAAM,GAAU;AACrC,WAAO,mBAAmB,KAAK;AAAA,EACjC;AAAA,EACA,+BAA+B;AAC7B,WAAO,oCAAC,oCAA+B;AAAA,EACzC;AAAA,EACA,wBAAwB,QAAgB;AAEtC,QAAI,CAAC,QAAQ;AACX,aACE,oCAAC,OAAI,gBAAe,iBAAgB,OAAM,UACxC,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,qCAAoC,CAC5C,CACF;AAAA,IAEJ;AAEA,UAAM,gBAAgB,OAAO,SAAS,UAAU;AAChD,UAAM,aAAa,OAAO,cAAc;AAExC,WACE,oCAAC,OAAI,gBAAe,iBAAgB,OAAM,UACxC,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,2BAA0B,GAChC,oCAAC,QAAK,MAAI,QAAE,eAAc,GAAC,GAC3B,oCAAC,YACE,kBAAkB,IAAI,WAAW,WAAU,mBAC9C,CACF,GACA,oCAAC,QAAK,SAAS,GAAG,YAAwB,OAAO,OAAO,CAC1D;AAAA,EAEJ;AAAA,EACA,yBAAyB,QAAgB;AACvC,QAAI,OAAO,QAAQ,WAAW,GAAG;AAC/B,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,SAAS,OAAO,QAAQ,MAAM;AAAA;AAAA;AAE3C,WAAO,QAAQ,QAAQ,CAAC,MAAM,UAAU;AACtC,gBAAU,GAAG,QAAQ,CAAC,OAAO,KAAK,KAAK;AAAA;AACvC,gBAAU,MAAM,KAAK,OAAO;AAAA;AAC5B,gBAAU,YAAY,KAAK,IAAI;AAAA;AAAA;AAAA,IACjC,CAAC;AAED,cAAU;AACV,WAAO;AAAA,EACT;AAAA,EACA,OAAO,KAAK,EAAE,MAAM,GAAU,CAAC,GAAmB;AAChD,UAAM,QAAQ,KAAK,IAAI;AAEvB,QAAI;AACF,YAAM,gBAAgB,MAAM,gBAAgB,WAAW,OAAO,KAAK;AAEnE,YAAM,SAAiB;AAAA,QACrB,SAAS;AAAA,QACT,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,KAAK,yBAAyB,MAAM;AAAA,QACxD,MAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAY;AACnB,YAAM,SAAiB;AAAA,QACrB,SAAS,CAAC;AAAA,QACV,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AACA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,wDAAwD,MAAM,OAAO;AAAA,QACzF,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { Box, Text } from 'ink'\nimport React from 'react'\nimport { z } from 'zod'\nimport { Cost } from '@components/Cost'\nimport { FallbackToolUseRejectedMessage } from '@components/FallbackToolUseRejectedMessage'\nimport { DefaultToolResultFallback } from '@components/messages/DefaultToolResultFallback'\nimport { Tool, ToolUseContext } from '@tool'\nimport { DESCRIPTION, TOOL_NAME_FOR_PROMPT } from './prompt'\nimport { SearchResult, searchProviders } from './searchProviders'\n\nconst inputSchema = z.strictObject({\n  query: z.string().describe('The search query'),\n})\n\ntype Input = z.infer<typeof inputSchema>\ntype Output = {\n  durationMs: number\n  results: SearchResult[]\n}\n\nexport const WebSearchTool = {\n  name: TOOL_NAME_FOR_PROMPT,\n  async description() {\n    return DESCRIPTION\n  },\n  userFacingName: () => 'Web Search',\n  inputSchema,\n  isReadOnly: () => true,\n  isConcurrencySafe: () => true,\n  async isEnabled() {\n    return true\n  },\n  needsPermissions() {\n    return false\n  },\n  async prompt() {\n    return DESCRIPTION\n  },\n  renderToolUseMessage({ query }: Input) {\n    return `Searching for: \"${query}\" using DuckDuckGo`\n  },\n  renderToolUseRejectedMessage() {\n    return <FallbackToolUseRejectedMessage />\n  },\n  renderToolResultMessage(output: Output) {\n    // Guard against undefined or null output\n    if (!output) {\n      return <DefaultToolResultFallback toolName=\"Search\" />\n    }\n\n    const resultsLength = output.results?.length ?? 0\n    const durationMs = output.durationMs ?? 0\n\n    return (\n      <Box justifyContent=\"space-between\" width=\"100%\">\n        <Box flexDirection=\"row\">\n          <Text>&nbsp;&nbsp;\u23BF &nbsp;Found </Text>\n          <Text bold>{resultsLength} </Text>\n          <Text>\n            {resultsLength === 1 ? 'result' : 'results'} using DuckDuckGo\n          </Text>\n        </Box>\n        <Cost costUSD={0} durationMs={durationMs} debug={false} />\n      </Box>\n    )\n  },\n  renderResultForAssistant(output: Output) {\n    if (output.results.length === 0) {\n      return `No results found using DuckDuckGo.`\n    }\n\n    let result = `Found ${output.results.length} search results using DuckDuckGo:\\n\\n`\n\n    output.results.forEach((item, index) => {\n      result += `${index + 1}. **${item.title}**\\n`\n      result += `   ${item.snippet}\\n`\n      result += `   Link: ${item.link}\\n\\n`\n    })\n\n    result += `You can reference these results to provide current, accurate information to the user.`\n    return result\n  },\n  async *call({ query }: Input, {}: ToolUseContext) {\n    const start = Date.now()\n\n    try {\n      const searchResults = await searchProviders.duckduckgo.search(query)\n\n      const output: Output = {\n        results: searchResults,\n        durationMs: Date.now() - start,\n      }\n\n      yield {\n        type: 'result' as const,\n        resultForAssistant: this.renderResultForAssistant(output),\n        data: output,\n      }\n    } catch (error: any) {\n      const output: Output = {\n        results: [],\n        durationMs: Date.now() - start,\n      }\n      yield {\n        type: 'result' as const,\n        resultForAssistant: `An error occurred during web search with DuckDuckGo: ${error.message}`,\n        data: output,\n      }\n    }\n  },\n} satisfies Tool\n"],
+  "mappings": "AAAA,SAAS,KAAK,YAAY;AAC1B,OAAO,WAAW;AAClB,SAAS,SAAS;AAClB,SAAS,YAAY;AACrB,SAAS,sCAAsC;AAC/C,SAAS,iCAAiC;AAE1C,SAAS,aAAa,4BAA4B;AAClD,SAAuB,uBAAuB;AAE9C,MAAM,cAAc,EAAE,aAAa;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,SAAS,kBAAkB;AAC/C,CAAC;AAQM,MAAM,gBAAgB;AAAA,EAC3B,MAAM;AAAA,EACN,MAAM,cAAc;AAClB,WAAO;AAAA,EACT;AAAA,EACA,gBAAgB,MAAM;AAAA,EACtB;AAAA,EACA,YAAY,MAAM;AAAA,EAClB,mBAAmB,MAAM;AAAA,EACzB,MAAM,YAAY;AAChB,WAAO;AAAA,EACT;AAAA,EACA,mBAAmB;AACjB,WAAO;AAAA,EACT;AAAA,EACA,MAAM,SAAS;AACb,WAAO;AAAA,EACT;AAAA,EACA,qBAAqB,EAAE,MAAM,GAAU;AACrC,WAAO,mBAAmB,KAAK;AAAA,EACjC;AAAA,EACA,+BAA+B;AAC7B,WAAO,oCAAC,oCAA+B;AAAA,EACzC;AAAA,EACA,wBAAwB,QAAgB;AAEtC,QAAI,CAAC,QAAQ;AACX,aAAO,oCAAC,6BAA0B,UAAS,UAAS;AAAA,IACtD;AAEA,UAAM,gBAAgB,OAAO,SAAS,UAAU;AAChD,UAAM,aAAa,OAAO,cAAc;AAExC,WACE,oCAAC,OAAI,gBAAe,iBAAgB,OAAM,UACxC,oCAAC,OAAI,eAAc,SACjB,oCAAC,YAAK,2BAA0B,GAChC,oCAAC,QAAK,MAAI,QAAE,eAAc,GAAC,GAC3B,oCAAC,YACE,kBAAkB,IAAI,WAAW,WAAU,mBAC9C,CACF,GACA,oCAAC,QAAK,SAAS,GAAG,YAAwB,OAAO,OAAO,CAC1D;AAAA,EAEJ;AAAA,EACA,yBAAyB,QAAgB;AACvC,QAAI,OAAO,QAAQ,WAAW,GAAG;AAC/B,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,SAAS,OAAO,QAAQ,MAAM;AAAA;AAAA;AAE3C,WAAO,QAAQ,QAAQ,CAAC,MAAM,UAAU;AACtC,gBAAU,GAAG,QAAQ,CAAC,OAAO,KAAK,KAAK;AAAA;AACvC,gBAAU,MAAM,KAAK,OAAO;AAAA;AAC5B,gBAAU,YAAY,KAAK,IAAI;AAAA;AAAA;AAAA,IACjC,CAAC;AAED,cAAU;AACV,WAAO;AAAA,EACT;AAAA,EACA,OAAO,KAAK,EAAE,MAAM,GAAU,CAAC,GAAmB;AAChD,UAAM,QAAQ,KAAK,IAAI;AAEvB,QAAI;AACF,YAAM,gBAAgB,MAAM,gBAAgB,WAAW,OAAO,KAAK;AAEnE,YAAM,SAAiB;AAAA,QACrB,SAAS;AAAA,QACT,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,KAAK,yBAAyB,MAAM;AAAA,QACxD,MAAM;AAAA,MACR;AAAA,IACF,SAAS,OAAY;AACnB,YAAM,SAAiB;AAAA,QACrB,SAAS,CAAC;AAAA,QACV,YAAY,KAAK,IAAI,IAAI;AAAA,MAC3B;AACA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,oBAAoB,wDAAwD,MAAM,OAAO;AAAA,QACzF,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/tools/WebSearchTool/prompt.js

@@ -4,18 +4,19 @@ const DESCRIPTION = `- Built-in web search using DuckDuckGo
 - Returns search result information formatted as search result blocks
 
 Capabilities:
-- Quick searches for general information
+- Quick searches for general information in English
 - Current events, news, and real-time data
 - No authentication required
 
 Limitations:
-- Uses DuckDuckGo which may have limited results for some queries
-- May not work well for region-specific or non-English content
+- Uses DuckDuckGo which has limited results for many queries
+- Poor coverage for region-specific, non-English, or Chinese content
 - Cannot bypass bot detection on restricted sites
 
 Usage notes:
 - Search queries should be specific and well-targeted for best results
-- If this tool returns no results or fails, consider trying MCP search tools (mcp__*) which may have broader coverage`;
+- IMPORTANT: If MCP search tools are available in <available-deferred-tools> (e.g. mcp__BrightData__search_engine), use ToolSearch to load them and prefer them \u2014 especially for non-English, regional, or specialized content where DuckDuckGo has poor coverage
+- Only use this built-in search when no MCP search tools are available`;
 export {
   DESCRIPTION,
   TOOL_NAME_FOR_PROMPT

package/dist/tools/WebSearchTool/prompt.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/tools/WebSearchTool/prompt.ts"],
-  "sourcesContent": ["export const TOOL_NAME_FOR_PROMPT = 'WebSearch'\nexport const DESCRIPTION = `- Built-in web search using DuckDuckGo\n- Provides up-to-date information for current events and recent data\n- Returns search result information formatted as search result blocks\n\nCapabilities:\n- Quick searches for general information\n- Current events, news, and real-time data\n- No authentication required\n\nLimitations:\n- Uses DuckDuckGo which may have limited results for some queries\n- May not work well for region-specific or non-English content\n- Cannot bypass bot detection on restricted sites\n\nUsage notes:\n- Search queries should be specific and well-targeted for best results\n- If this tool returns no results or fails, consider trying MCP search tools (mcp__*) which may have broader coverage`\n"],
-  "mappings": "AAAO,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
+  "sourcesContent": ["export const TOOL_NAME_FOR_PROMPT = 'WebSearch'\nexport const DESCRIPTION = `- Built-in web search using DuckDuckGo\n- Provides up-to-date information for current events and recent data\n- Returns search result information formatted as search result blocks\n\nCapabilities:\n- Quick searches for general information in English\n- Current events, news, and real-time data\n- No authentication required\n\nLimitations:\n- Uses DuckDuckGo which has limited results for many queries\n- Poor coverage for region-specific, non-English, or Chinese content\n- Cannot bypass bot detection on restricted sites\n\nUsage notes:\n- Search queries should be specific and well-targeted for best results\n- IMPORTANT: If MCP search tools are available in <available-deferred-tools> (e.g. mcp__BrightData__search_engine), use ToolSearch to load them and prefer them \u2014 especially for non-English, regional, or specialized content where DuckDuckGo has poor coverage\n- Only use this built-in search when no MCP search tools are available`\n"],
+  "mappings": "AAAO,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;",
   "names": []
 }