@wrongstack/tools 0.276.4 → 0.277.1

package/dist/index.js

@@ -10,7 +10,7 @@ import { statSync, mkdirSync, createWriteStream } from 'node:fs';
 import { toErrorMessage as toErrorMessage$1 } from '@wrongstack/core/utils/error';
 import * as dns from 'node:dns/promises';
 import * as net from 'node:net';
-import { Agent } from 'undici';
+import { Agent, fetch } from 'undici';
 import TurndownService from 'turndown';
 import { toErrorMessage as toErrorMessage$2 } from '@wrongstack/core/utils';
 import { randomUUID } from 'node:crypto';
@@ -2762,16 +2762,28 @@ function resolvePowerShell(cmd) {
   }
   return resolved;
 }
-var WIN32_SHELL_META = /[&|<>\r\n\0]/;
+var WIN32_SHELL_META = /[&|<>"\r\n\0]/;
 function assertSafeWin32ShellArgs(args) {
-  for (const a of args) {
-    if (typeof a === "string" && WIN32_SHELL_META.test(a)) {
+  for (const arg of args) {
+    if (typeof arg === "string" && WIN32_SHELL_META.test(arg)) {
       throw new Error(
-        "win32 shell spawn: argument contains a shell metacharacter (one of & | < > or a newline) that could enable command injection through the .cmd/.bat wrapper \u2014 refusing to run. Offending argument: " + JSON.stringify(a)
+        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
       );
     }
   }
 }
+function buildWin32CmdShimInvocation(command, args = []) {
+  assertSafeWin32ShellArgs([command, ...args]);
+  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
+  return {
+    command: process.env["COMSPEC"] ?? "cmd.exe",
+    args: ["/d", "/c", line],
+    windowsVerbatimArguments: true
+  };
+}
+function quoteWin32CmdArg(arg) {
+  return `"${arg}"`;
+}
 
 // src/bash.ts
 var MAX_OUTPUT = 32768;
@@ -3313,10 +3325,20 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // C / C++ / native build
   "make",
   "cmake",
+  "ninja",
+  "clang",
+  "clang-cl",
+  "gcc",
+  "g++",
+  "link",
+  "msbuild",
   // containers / orchestration
   "docker",
   "podman",
   "kubectl",
+  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  "curl",
+  "wget",
   // common POSIX file/text utilities
   "pwd",
   "ls",
@@ -3336,7 +3358,509 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "cp",
   "mv",
   "rm",
-  "touch"
+  "touch",
+  "tar",
+  // Windows-native tooling (win32). All non-destructive binaries; per-arg
+  // safety is still enforced by BLOCKED_ARG_PATTERNS + the destructive-ops
+  // gate in bash-kill-guard.ts. `gh` is included even though it lives at
+  // "C:\Program Files\GitHub CLI\gh.exe" — resolveWin32Command handles the
+  // space in the path.
+  "gh",
+  "where",
+  "tasklist",
+  "systeminfo",
+  "wmic",
+  "sc",
+  "netstat",
+  "ipconfig",
+  "nslookup",
+  "tracert",
+  "pathping",
+  // Windows shell interpreters. Without these, `exec` cannot run cmd builtins
+  // (`dir`, `type`, `copy`, …) or any PowerShell cmdlet on Windows — a major
+  // gap since those are the platform's primary shells. Arbitrary execution
+  // through `cmd /c …` / `powershell -c …` is NOT a new hole: the permission
+  // policy reconstructs the full command line (shellCommandLineFromInput) and
+  // still runs it through the YOLO destructive classifier, so a genuinely
+  // destructive `cmd /c del /s /q C:\…` continues to require confirmation.
+  "cmd",
+  "cmd.exe",
+  "powershell",
+  "powershell.exe",
+  "pwsh",
+  "pwsh.exe",
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
+  // non-destructive, broadly-used dev binaries. Per-arg safety is still
+  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // --- Archives & compression ---
+  "7z",
+  "7za",
+  "bzip2",
+  "gzip",
+  "xz",
+  "unzip",
+  "zip",
+  "gtar",
+  "bsdtar",
+  "star",
+  "pax",
+  "cpio",
+  // --- Android / mobile dev ---
+  "adb",
+  "fastboot",
+  "sdkmanager",
+  // --- DevOps / config mgmt ---
+  "ansible",
+  "ansible-playbook",
+  "ansible-vault",
+  "ansible-lint",
+  "ansible-galaxy",
+  "molecule",
+  // --- Cloud CLIs ---
+  "aws",
+  "aws-vault",
+  "awslocal",
+  "az",
+  "azcopy",
+  "gcloud",
+  "gsutil",
+  "doctl",
+  "linode-cli",
+  // --- Native / C / C++ / linker tools ---
+  "clang++",
+  "clang-format",
+  "clang-tidy",
+  "clangd",
+  "lld",
+  "lldb",
+  "ctest",
+  "gmake",
+  "meson",
+  "conan",
+  "vcpkg",
+  "cl",
+  "rc",
+  "mt",
+  "dumpbin",
+  "dotnet-format",
+  // --- Image / media / binary tools ---
+  "convert",
+  "ffmpeg",
+  "ffprobe",
+  "magick",
+  "gs",
+  "exiftool",
+  // --- HTTP / fetch ---
+  "wget2",
+  "aria2c",
+  "axel",
+  "httpie",
+  "hey",
+  "ab",
+  "wrk",
+  "http",
+  // --- Diff / patch / merge ---
+  "diff",
+  "diff3",
+  "patch",
+  "meld",
+  "kdiff3",
+  "kompare",
+  // --- Encoding / file inspection ---
+  "dos2unix",
+  "unix2dos",
+  "iconv",
+  "file",
+  "stat",
+  "xxd",
+  "hexdump",
+  "od",
+  "base64",
+  // --- SSH / crypto / signing ---
+  "ssh",
+  "ssh-add",
+  "ssh-keygen",
+  "ssh-keyscan",
+  "scp",
+  "sftp",
+  "rsync",
+  "gpg",
+  "gpg2",
+  "gpg-agent",
+  "openssl",
+  "step",
+  "keytool",
+  // --- Search ---
+  "egrep",
+  "fgrep",
+  "ag",
+  "ack",
+  "sift",
+  "ugrep",
+  "fd",
+  "fdfind",
+  "jq",
+  "yq",
+  "xq",
+  "fx",
+  "gron",
+  // --- K8s / container ecosystem ---
+  "kubectl.exe",
+  "kubeadm",
+  "kubelet",
+  "helm",
+  "k9s",
+  "kustomize",
+  "skaffold",
+  "tilt",
+  "minikube",
+  "kind",
+  "k3d",
+  "k3s",
+  "docker-compose",
+  "buildah",
+  "skopeo",
+  "nerdctl",
+  "ctr",
+  "ctr.exe",
+  // --- Databases ---
+  "sqlite3",
+  "sqlite",
+  "psql",
+  "pg_dump",
+  "pg_restore",
+  "mysql",
+  "mysqladmin",
+  "mysqldump",
+  "mariadb",
+  "mariadb-dump",
+  "redis-cli",
+  "redis-server",
+  "memcached",
+  "etcdctl",
+  "consul",
+  "vault",
+  "nomad",
+  "mongosh",
+  "mongo",
+  "mongoexport",
+  "mongoimport",
+  "mongodump",
+  "mongorestore",
+  // --- Windows extended (read-mostly ops) ---
+  "taskkill",
+  "gpupdate",
+  "gpresult",
+  "hostname",
+  "whoami",
+  "who",
+  "net",
+  "net1",
+  // --- VCS ecosystem ---
+  "glab",
+  "hub",
+  "tea",
+  "git-lfs",
+  "tig",
+  "lazygit",
+  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
+  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
+  //     omitted — the Set is de-duplicated at runtime but a clean literal is
+  //     easier to maintain) ---
+  "gawk",
+  "tr",
+  "cut",
+  "paste",
+  "join",
+  "comm",
+  "expand",
+  "unexpand",
+  "fold",
+  "fmt",
+  "nl",
+  "pr",
+  "column",
+  "tsort",
+  "tty",
+  "ul",
+  "units",
+  "factor",
+  "seq",
+  "shuf",
+  "look",
+  "yes",
+  "true",
+  "false",
+  "test",
+  "[",
+  "printf",
+  "env",
+  "tree",
+  "locate",
+  "which",
+  "whereis",
+  "type",
+  "hash",
+  "pushd",
+  "popd",
+  "dirs",
+  "history",
+  "fc",
+  "jobs",
+  "bg",
+  "fg",
+  "wait",
+  "ulimit",
+  "umask",
+  "nice",
+  "nohup",
+  "timeout",
+  "time",
+  "trap",
+  "exit",
+  "return",
+  "source",
+  ".",
+  "alias",
+  "unalias",
+  "set",
+  "unset",
+  "export",
+  "readonly",
+  "typeset",
+  "declare",
+  "local",
+  "eval",
+  "exec",
+  // --- Process / system inspection ---
+  "htop",
+  "top",
+  "atop",
+  "glances",
+  "iotop",
+  "nethogs",
+  "iftop",
+  "lsof",
+  "strace",
+  "ltrace",
+  "sysstat",
+  "vmstat",
+  "iostat",
+  "mpstat",
+  "sar",
+  "free",
+  "df",
+  "du",
+  "mount",
+  "umount",
+  "lsblk",
+  "blkid",
+  "kill",
+  "killall",
+  "pkill",
+  "pgrep",
+  "pidof",
+  "ps",
+  "ps.exe",
+  // --- Network inspection ---
+  "ip",
+  "ss",
+  "route",
+  "arp",
+  "arping",
+  "ping",
+  "ping6",
+  "hping3",
+  "mtr",
+  "tracepath",
+  "tcpdump",
+  "nmap",
+  "netcat",
+  "nc",
+  "ncat",
+  "socat",
+  // --- Sync / backup ---
+  "rclone",
+  "restic",
+  "borg",
+  "duplicati",
+  "duplicacy",
+  "syncthing",
+  "syncthing-cli",
+  // --- Permissions / users / ACLs (POSIX) ---
+  "useradd",
+  "userdel",
+  "usermod",
+  "groupadd",
+  "groupdel",
+  "groupmod",
+  "chown",
+  "chmod",
+  "chgrp",
+  "getfacl",
+  "setfacl",
+  "setcap",
+  "getcap",
+  // --- Crypto / cert mgmt (extended) ---
+  "certbot",
+  "mkcert",
+  "jarsigner",
+  // --- Editors ---
+  "subl",
+  "code",
+  "code-insiders",
+  "cursor",
+  "atom",
+  "nano",
+  "vim",
+  "nvim",
+  "vi",
+  "emacs",
+  "helix",
+  "hx",
+  "micro",
+  "jed",
+  "ed",
+  "ex",
+  "mg",
+  // --- Terminal multiplexers ---
+  "asciinema",
+  "script",
+  "scriptreplay",
+  "expect",
+  "screen",
+  "tmux",
+  "byobu",
+  "dtach",
+  "abduco",
+  // --- Calculators / REPLs / scientific ---
+  "bc",
+  "dc",
+  "calc",
+  "qalc",
+  "genius",
+  "octave",
+  "R",
+  "Rscript",
+  "julia",
+  "irb",
+  "pry",
+  "ghci",
+  "stack",
+  "cabal",
+  "ghc",
+  // --- PHP / Lua / Perl / Ruby ecosystem (extended) ---
+  "php8",
+  "php7",
+  "phpcs",
+  "phpcbf",
+  "phpmd",
+  "phpstan",
+  "psalm",
+  "lua",
+  "lua5.1",
+  "lua5.2",
+  "lua5.3",
+  "lua5.4",
+  "luarocks",
+  "perl",
+  "cpan",
+  "prove",
+  "plackup",
+  "rake",
+  "rspec",
+  "jekyll",
+  "node-gyp",
+  "node-pre-gyp",
+  // --- JS / TS toolchain (extended) ---
+  "electron",
+  "electron-builder",
+  "electron-forge",
+  "vite-preview",
+  "swc",
+  "swc-cli",
+  "swcpack",
+  "mocha",
+  "chai",
+  "jasmine",
+  "puppeteer",
+  "lighthouse",
+  // --- Linters / formatters (extended) ---
+  "tslint",
+  "stylelint",
+  "htmlhint",
+  "jshint",
+  "jslint",
+  "jscs",
+  // --- Document conversion ---
+  "pandoc",
+  "weasyprint",
+  "wkhtmltopdf",
+  "wkhtmltoimage",
+  "prince",
+  "mdp",
+  "markdown",
+  "multimarkdown",
+  "cmark",
+  "cmark-gfm",
+  // --- Office / spreadsheet ---
+  "soffice",
+  "libreoffice",
+  "unoconv",
+  "abiword",
+  "gnumeric",
+  // --- Spell / grammar ---
+  "aspell",
+  "hunspell",
+  "enchant",
+  "languagetool",
+  // --- Source-highlight / diff tools ---
+  "delta",
+  "bat",
+  "ccat",
+  "hl",
+  "highlight",
+  "source-highlight",
+  "ansifilter",
+  // --- Job schedulers ---
+  "pueue",
+  "task-spooler",
+  "ts",
+  "at",
+  "atd",
+  "anacron",
+  "fcron",
+  "cronie",
+  "systemd-run",
+  "systemd-cat",
+  // --- Plotting / visualization ---
+  "gnuplot",
+  "gnuplot-nox",
+  "veusz",
+  "scidavis",
+  "grace",
+  "xmgrace",
+  "labplot",
+  // --- Security / recon (network + web) ---
+  "masscan",
+  "zmap",
+  "rustscan",
+  "amass",
+  "subfinder",
+  "httpx",
+  "nuclei",
+  "naabu",
+  "katana",
+  "dnsx",
+  "assetfinder",
+  "findomain",
+  "gau",
+  "waybackurls",
+  "httprobe",
+  "meg",
+  "subjack",
+  "sublert",
+  "chaos"
 ]);
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
@@ -3559,17 +4083,18 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT2 });
     const resolved = resolveWin32Command(cmd);
     const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
-    const spawnCmd = needsShell ? cmd : resolved;
-    if (needsShell) assertSafeWin32ShellArgs(args);
+    const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
+    const spawnCmd = shim?.command ?? resolved;
+    const spawnArgs = shim?.args ?? args;
     let child;
     try {
-      child = spawn(spawnCmd, args, {
+      child = spawn(spawnCmd, spawnArgs, {
         cwd,
         env: buildChildEnv(sessionId),
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true,
         ...isWin2 ? {} : { signal },
-        ...needsShell ? { shell: true, windowsVerbatimArguments: true } : {}
+        ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
       });
     } catch (err) {
       spool.finalize();
@@ -3664,6 +4189,7 @@ TD.addRule("stripDangerousElements", {
 });
 var MAX_BYTES2 = 131072;
 var TIMEOUT_MS = 2e4;
+var nativeGlobalFetch = globalThis.fetch;
 var ALLOW_PRIVATE = process.env["WRONGSTACK_FETCH_ALLOW_PRIVATE"] === "1";
 if (ALLOW_PRIVATE && !process.env["CI"]) {
   console.warn(
@@ -3713,6 +4239,9 @@ function getPinnedDispatcher() {
   }
   return pinnedAgent;
 }
+function dispatcherFetch() {
+  return globalThis.fetch === nativeGlobalFetch ? fetch : globalThis.fetch;
+}
 var _beforeExitRegistered = false;
 if (!_beforeExitRegistered) {
   _beforeExitRegistered = true;
@@ -3748,7 +4277,7 @@ async function guardedFetch(url, maxRedirects, signal, headers = {
       headers,
       dispatcher: getPinnedDispatcher()
     };
-    const res = await fetch(currentUrl, init);
+    const res = await dispatcherFetch()(currentUrl, init);
     if (res.status < 300 || res.status > 399) {
       return res;
     }
@@ -3776,7 +4305,7 @@ var fetchTool = {
   category: "Network",
   description: "Fetch a URL and return its content. HTML pages are automatically converted to clean markdown. This tool has strong SSRF protections (private IPs, localhost, and cloud metadata endpoints are blocked by default).",
   usageHint: "Use this when you need external information (documentation, API responses, web pages, etc.).\n\nSecurity notes:\n- Only HTTPS is allowed by default.\n- Internal/private networks are blocked unless explicitly enabled via environment variable.\n- Redirects are followed but re-validated at each hop.\n- Output is capped (128KB by default) to avoid flooding context.\nPrefer this over raw `bash curl` or `bash wget`.",
-  permission: "confirm",
+  permission: "auto",
   mutating: false,
   capabilities: ["net.outbound"],
   icon: "web",
@@ -4017,7 +4546,7 @@ var searchTool = {
   category: "Search",
   description: "Perform a web search and return results with title, URL, and snippet. Use this when you need up-to-date external information that is not in the local codebase. Results are cached (5 min TTL) and deduplicated by URL.",
   usageHint: "Good for: API documentation, error messages, library usage examples, current best practices.\n\n- Prefer specific queries over very broad ones.\n- Results go through the guarded fetch system (same protections as the `fetch` tool).\n- Supports duckduckgo (default), google, and bing sources.\n- Set `skip_cache: true` to force a fresh search.\n- This is often better than the model trying to recall outdated knowledge.",
-  permission: "confirm",
+  permission: "auto",
   mutating: false,
   capabilities: ["net.outbound"],
   icon: "search",
@@ -4080,15 +4609,15 @@ var searchTool = {
         };
         yield {
           type: "partial_output",
-          text: `${results.length} cached results from ${source}`,
-          data: { count: results.length, cached: true }
+          text: `${results.length} cached results from ${entry.source}`,
+          data: { count: results.length, cached: true, source: entry.source }
         };
         yield {
           type: "final",
           output: {
             query: input.query,
             results: results.slice(0, num),
-            source,
+            source: entry.source,
             truncated: results.length >= num,
             cached: true
           }
@@ -4102,6 +4631,7 @@ var searchTool = {
       data: { source, query: input.query, cached: false }
     };
     let rawResults;
+    let effectiveSource = source;
     switch (source) {
       case "duckduckgo":
         rawResults = await duckduckgoSearch(input.query, num, opts.signal);
@@ -4118,24 +4648,24 @@ var searchTool = {
           field: "source"
         });
     }
-    const seenUrls = /* @__PURE__ */ new Set();
-    const deduped = [];
-    for (const r of rawResults) {
-      const noQuery = r.url.split("?")[0] ?? r.url;
-      const normalized = noQuery.split("#")[0] ?? r.url;
-      if (!seenUrls.has(normalized) && r.url.startsWith("http")) {
-        seenUrls.add(normalized);
-        deduped.push(r);
-      }
+    let ranked = rankSearchResults(rawResults, input.query);
+    if (source !== "duckduckgo" && shouldFallbackToDuckDuckGo(ranked, input.query)) {
+      yield {
+        type: "log",
+        text: `${source} returned no relevant static results; falling back to duckduckgo`,
+        data: { source, fallback: "duckduckgo", query: input.query }
+      };
+      rawResults = await duckduckgoSearch(input.query, num, opts.signal);
+      ranked = rankSearchResults(rawResults, input.query);
+      effectiveSource = "duckduckgo";
     }
-    const ranked = scoreResults(deduped, input.query);
     const finalResults = ranked.slice(0, num);
-    cache.set(cacheKey, { results: ranked, timestamp: Date.now() });
+    cache.set(cacheKey, { results: ranked, source: effectiveSource, timestamp: Date.now() });
     pruneStaleCacheEntries();
     yield {
       type: "partial_output",
-      text: `${finalResults.length} results from ${source}`,
-      data: { count: finalResults.length, cached: false }
+      text: `${finalResults.length} results from ${effectiveSource}`,
+      data: { count: finalResults.length, cached: false, source: effectiveSource }
     };
     yield {
       type: "final",
@@ -4146,7 +4676,7 @@ var searchTool = {
           url: r.url,
           snippet: r.snippet
         })),
-        source,
+        source: effectiveSource,
         truncated: finalResults.length >= num,
         cached: false
       }
@@ -4159,6 +4689,19 @@ function pruneStaleCacheEntries() {
     if (entry.timestamp < cutoff) cache.delete(key);
   }
 }
+function rankSearchResults(results, query) {
+  const seenUrls = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const r of results) {
+    const noQuery = r.url.split("?")[0] ?? r.url;
+    const normalized = noQuery.split("#")[0] ?? r.url;
+    if (!seenUrls.has(normalized) && r.url.startsWith("http")) {
+      seenUrls.add(normalized);
+      deduped.push(r);
+    }
+  }
+  return scoreResults(deduped, query);
+}
 function scoreResults(results, query) {
   const terms = query.toLowerCase().split(/\s+/).filter((t) => t.length > 0);
   return results.map((r) => {
@@ -4172,6 +4715,15 @@ function scoreResults(results, query) {
     return { ...r, score };
   }).sort((a, b) => b.score - a.score);
 }
+function shouldFallbackToDuckDuckGo(results, query) {
+  if (results.length === 0) return true;
+  const terms = query.toLowerCase().split(/\s+/).filter((t) => t.length >= 3);
+  if (terms.length === 0) return false;
+  return !results.some((r) => {
+    const haystack = `${r.title} ${r.url} ${r.snippet}`.toLowerCase();
+    return terms.some((term) => haystack.includes(term));
+  });
+}
 async function duckduckgoSearch(query, num, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://lite.duckduckgo.com/lite/?q=${encoded}&kd=-1&kl=wt-wt`;
@@ -4196,14 +4748,19 @@ function takeFrom(iter, max) {
 }
 function parseDuckDuckGo(html, num) {
   const results = [];
-  const snippetRegex = /<a class="result-link"[^>]+href="([^"]+)"[^>]*>([^<]+)<\/a>/gi;
-  const snippet2Regex = /<a class="result-snippet"[^>]*>([^<]+)<\/a>/gi;
+  const linkRegex = /<a\b([^>]*\bclass=(["'])[^"']*\bresult-link\b[^"']*\2[^>]*)>([\s\S]*?)<\/a>/gi;
+  const snippetRegex = /<([a-z0-9]+)\b([^>]*\bclass=(["'])[^"']*\bresult-snippet\b[^"']*\3[^>]*)>([\s\S]*?)<\/\1>/gi;
   const linkMatches = takeFrom(
-    [...html.matchAll(snippetRegex)].filter((m) => m[1] && m[2]).map((m) => ({ url: expectDefined(m[1]), title: stripTags(expectDefined(m[2])) })),
+    [...html.matchAll(linkRegex)].map((m) => {
+      const attrs = expectDefined(m[1]);
+      const href = getHtmlAttr(attrs, "href");
+      const title = stripTags(expectDefined(m[3]));
+      return href && title ? { url: normalizeDuckDuckGoUrl(href), title } : void 0;
+    }).filter((m) => m !== void 0),
     num
   );
   const snippetMatches = takeFrom(
-    [...html.matchAll(snippet2Regex)].filter((m) => m[1]).map((m) => stripTags(expectDefined(m[1]))),
+    [...html.matchAll(snippetRegex)].filter((m) => m[4]).map((m) => stripTags(expectDefined(m[4]))),
     num
   );
   for (let i = 0; i < linkMatches.length && i < num; i++) {
@@ -4219,6 +4776,24 @@ function parseDuckDuckGo(html, num) {
   }
   return results;
 }
+function getHtmlAttr(attrs, name) {
+  const quoted = new RegExp(`\\b${name}\\s*=\\s*(["'])(.*?)\\1`, "i").exec(attrs);
+  if (quoted?.[2]) return decodeHtmlEntities(quoted[2]);
+  const unquoted = new RegExp(`\\b${name}\\s*=\\s*([^\\s>]+)`, "i").exec(attrs);
+  return unquoted?.[1] ? decodeHtmlEntities(unquoted[1]) : void 0;
+}
+function normalizeDuckDuckGoUrl(raw) {
+  if (raw.startsWith("//")) return `https:${raw}`;
+  if (!raw.startsWith("/")) return raw;
+  if (!raw.startsWith("/l/")) return raw;
+  try {
+    const url = new URL(raw, "https://duckduckgo.com");
+    const uddg = url.searchParams.get("uddg");
+    return uddg?.startsWith("http") ? uddg : url.toString();
+  } catch {
+    return raw;
+  }
+}
 async function googleSearch(query, num, signal) {
   const encoded = encodeURIComponent(query);
   const url = `https://www.google.com/search?q=${encoded}&hl=en`;
@@ -4260,29 +4835,53 @@ async function bingSearch(query, num, signal) {
 }
 function parseBingResults(html, num) {
   const results = [];
-  const titleRegex = /<h2[^>]*>\s*<a[^>]+href="([^"]+)"[^>]*>([^<]+)<\/a>\s*<\/h2>/gi;
-  const snippetRegex = /<p[^>]*class="[^"]*b_paractl[^"]*"[^>]*>([^<]+)<\/p>/gi;
-  const entries = takeFrom(
-    [...html.matchAll(titleRegex)].filter((m) => m[1] && m[2]).map((m) => ({ url: expectDefined(m[1]), title: stripTags(expectDefined(m[2])) })),
-    num
-  );
-  const snippets = takeFrom(
-    [...html.matchAll(snippetRegex)].filter((m) => m[1]).map((m) => stripTags(expectDefined(m[1]))),
-    num
-  );
+  const blocks = [...html.matchAll(/<li\b[^>]*class=(["'])[^"']*\bb_algo\b[^"']*\1[^>]*>([\s\S]*?)(?=<li\b[^>]*class=(["'])[^"']*\bb_algo\b[^"']*\3|<\/ol>)/gi)].map((m) => expectDefined(m[2]));
+  const candidates = blocks.length > 0 ? blocks : [html];
+  const entries = takeFrom(candidates.flatMap((block) => {
+    const titleMatch = /<h2[^>]*>\s*<a\b([^>]*)>([\s\S]*?)<\/a>\s*<\/h2>/i.exec(block);
+    if (!titleMatch) return [];
+    const href = getHtmlAttr(expectDefined(titleMatch[1]), "href");
+    const title = stripTags(expectDefined(titleMatch[2]));
+    if (!href || !title) return [];
+    const snippetMatch = /<p\b[^>]*class=(["'])[^"']*\b(?:b_paractl|b_lineclamp\d*)\b[^"']*\1[^>]*>([\s\S]*?)<\/p>/i.exec(block) ?? /<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(block);
+    const snippet = snippetMatch ? stripTags(expectDefined(snippetMatch.at(-1))) : "";
+    return [{ url: normalizeBingUrl(href), title, snippet, score: 1 }];
+  }), num);
   for (let i = 0; i < entries.length; i++) {
     const entry = entries[i];
     if (entry) {
       results.push({
         title: entry.title ?? "",
         url: entry.url ?? "",
-        snippet: snippets[i] ?? "",
+        snippet: entry.snippet ?? "",
         score: 1
       });
     }
   }
   return results;
 }
+function normalizeBingUrl(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.hostname.endsWith("bing.com") && url.pathname.startsWith("/ck/")) {
+      const encoded = url.searchParams.get("u");
+      const decoded = decodeBingTarget(encoded);
+      if (decoded?.startsWith("http")) return decoded;
+    }
+  } catch {
+  }
+  return raw;
+}
+function decodeBingTarget(encoded) {
+  if (!encoded) return void 0;
+  const payload = encoded.startsWith("a1") ? encoded.slice(2) : encoded;
+  try {
+    const padded = payload.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payload.length / 4) * 4, "=");
+    return Buffer.from(padded, "base64").toString("utf8");
+  } catch {
+    return void 0;
+  }
+}
 async function fetchWithTimeout(url, signal, timeoutMs) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -4310,7 +4909,10 @@ function anySignal(...signals) {
   return AbortSignal.any(signals);
 }
 function stripTags(html) {
-  return html.replace(/<[^>]+>/g, "").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").trim();
+  return decodeHtmlEntities(html.replace(/<[^>]+>/g, "")).trim();
+}
+function decodeHtmlEntities(text) {
+  return text.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
 }
 var todoTool = {
   name: "todo",
@@ -5880,15 +6482,16 @@ async function* spawnStream(opts) {
   const spool = createOutputSpool({ tool: opts.cmd, thresholdBytes: max });
   const resolved = resolveWin32Command(opts.cmd);
   const needsShell = isWin3 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
-  const cmd = needsShell ? opts.cmd : resolved;
-  if (needsShell) assertSafeWin32ShellArgs(opts.args);
-  const child = spawn(cmd, opts.args, {
+  const shim = needsShell ? buildWin32CmdShimInvocation(resolved, opts.args) : null;
+  const cmd = shim?.command ?? resolved;
+  const args = shim?.args ?? opts.args;
+  const child = spawn(cmd, args, {
     cwd: opts.cwd,
     env: buildChildEnv(),
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
     ...isWin3 ? {} : { signal: opts.signal },
-    ...needsShell ? { shell: true, windowsVerbatimArguments: true } : {}
+    ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
   });
   const registry = getProcessRegistry();
   const pid = child.pid;
@@ -6135,7 +6738,7 @@ var formatTool = {
   usageHint: "RUN REGULARLY:\n\n- Use on changed files before committing.\n- `check: true` verifies formatting without making changes (useful in CI-like flows).\nThis project has very consistent formatting expectations. Always ensure your changes are formatted.",
   permission: "confirm",
   mutating: true,
-  capabilities: ["fs.write", "shell.exec"],
+  capabilities: ["fs.write", "shell.restricted"],
   icon: "code",
   timeoutMs: 6e4,
   inputSchema: {
@@ -6788,9 +7391,10 @@ function runOutdated(manager, args, cwd, signal) {
     const MAX = 1e5;
     const resolved = resolveWin32Command(manager);
     const needsShell = process.platform === "win32" && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
-    const spawnCmd = needsShell ? manager : resolved;
-    if (needsShell) assertSafeWin32ShellArgs(args);
-    const child = spawn(spawnCmd, args, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true, ...needsShell ? { shell: true, windowsVerbatimArguments: true } : {} });
+    const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
+    const spawnCmd = shim?.command ?? resolved;
+    const spawnArgs = shim?.args ?? args;
+    const child = spawn(spawnCmd, spawnArgs, { cwd, signal, env: buildChildEnv(), stdio: ["ignore", "pipe", "pipe"], windowsHide: true, ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {} });
     child.stdout?.on("data", (c) => {
       if (stdout.length < MAX) stdout += c.toString();
     });
@@ -7395,9 +7999,9 @@ var designTool = {
   category: "Design",
   description: 'Browse, load, customize, and enforce curated frontend/mobile UI design kits. Use BEFORE writing UI code to commit to one coherent, modern, responsive, dark/light, accessible design. Actions: "list" (menu), "use" (load+pin a kit for a stack), "foundations" (baseline), "set" (override kit colors/tokens), "materialize" (write the tokens to a real theme file \u2014 CSS @theme/OKLCH or native), "verify" (scan UI files for off-palette colors).',
   usageHint: 'Flow: `design {action:"use", kit:"minimal-clarity", stack:"web"}` \u2192 optionally `design {action:"set", set:{primary:"oklch(62% 0.2 25)"}}` \u2192 `design {action:"materialize"}` to write tokens to disk \u2192 implement against them \u2192 `design {action:"verify"}`.',
-  permission: "auto",
-  mutating: false,
-  capabilities: [],
+  permission: "confirm",
+  mutating: true,
+  capabilities: ["fs.write"],
   timeoutMs: 15e3,
   inputSchema: {
     type: "object",
@@ -7998,7 +8602,7 @@ function rememberTool(memory) {
     category: "Session",
     description: "Persist facts, conventions, decisions, and preferences into long-term memory. Memories survive restarts and are scored for relevance in future sessions.",
     usageHint: "Persist facts, conventions, decisions, and preferences into long-term memory.\n\nWHEN TO USE:\n- Project conventions discovered during a task (build tool, lint rules, code style)\n- Architecture decisions made (chose X over Y, decided to use pattern Z)\n- User preferences expressed (prefers short names, always uses pnpm)\n- Anti-patterns identified (never do X, avoid pattern Y)\n- File/location references useful across sessions\n\nWHEN NOT TO USE:\n- Temporary task state or progress \u2192 use `todo`\n- One-off debugging notes\n- Information already obvious from the codebase\n\nAlways include `type` and `priority`. Use 1-3 `tags` for grouping.\nBetter to remember a fact now than rediscover it next session.",
-    permission: "auto",
+    permission: "confirm",
     mutating: true,
     timeoutMs: 2e3,
     capabilities: ["memory.write"],