@wrongstack/tools 0.284.1 → 0.285.0

package/dist/fetch.d.ts

@@ -1,5 +1,4 @@
-import { Tool } from '@wrongstack/core';
-
+import type { Tool } from '@wrongstack/core';
 interface FetchInput {
     url: string;
     format?: 'markdown' | 'text' | 'raw' | undefined;
@@ -10,33 +9,6 @@ interface FetchOutput {
     content_type: string;
     url: string;
 }
-type LookupCallback = (err: NodeJS.ErrnoException | null, address?: string | Array<{
-    address: string | undefined;
-    family: number;
-}>, family?: number | undefined) => void;
-/**
- * DNS lookup used by the undici dispatcher below. It performs the SINGLE name
- * resolution that the TCP connection actually uses, and rejects if any
- * resolved address is private/loopback/link-local. Because the connection
- * reuses exactly this result, there is no DNS-rebinding TOCTOU window between
- * the security check and the connect — closing the gap the old code documented
- * (validate with one dns.lookup, then let fetch re-resolve independently).
- * TLS still validates the certificate against the hostname (SNI is set by
- * undici from the URL), so pinning the IP does not weaken cert checking.
- */
-declare function guardedLookup(hostname: string, options: {
-    all?: boolean | undefined;
-    family?: number | undefined;
-}, callback: LookupCallback): void;
-/**
- * SSRF-guarded fetch with manual, per-hop-revalidated redirects, exported so
- * other builtin tools (e.g. `search`) get the same protections instead of a
- * weaker `redirect: 'follow'`. Every hop is re-checked against private/loopback
- * ranges and the connection is pinned to the validated IP via the undici
- * dispatcher (no DNS-rebinding TOCTOU). `headers` defaults to the plain `fetch`
- * tool's; callers may override (e.g. a browser User-Agent for search engines).
- */
-declare function guardedFetch(url: string, maxRedirects: number, signal: AbortSignal, headers?: Record<string, string>): Promise<Response>;
-declare const fetchTool: Tool<FetchInput, FetchOutput>;
-
-export { fetchTool, guardedFetch, guardedLookup };
+export { guardedFetch, guardedLookup } from './_fetch-guard.js';
+export declare const fetchTool: Tool<FetchInput, FetchOutput>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AA2B9D,UAAU,UAAU;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;CAClD;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAYD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEhE,eAAO,MAAM,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAuLnD,CAAC"}

package/dist/fetch.js

@@ -1,31 +1,17 @@
-import * as dns from 'node:dns/promises';
-import * as net from 'node:net';
-import { isPrivateIPv4, isPrivateIPv6, ToolValidationError, FetchError, ToolError } from '@wrongstack/core';
-import { Agent, fetch } from 'undici';
-import TurndownService from 'turndown';
-
 // src/fetch.ts
-function truncateMiddle(s, max) {
-  if (Buffer.byteLength(s, "utf8") <= max) return s;
-  const half = Math.floor(max / 2);
-  return s.slice(0, half) + `
-\u2026[truncated ${Buffer.byteLength(s, "utf8") - max} bytes from middle]\u2026
-` + s.slice(-half);
-}
+import { FetchError as FetchError2, ToolError, ToolValidationError as ToolValidationError2 } from "@wrongstack/core";
+import TurndownService from "turndown";
 
-// src/fetch.ts
-var TD = new TurndownService({
-  // Use `# Title` for headings, not setext underline style (`Title\n=====`).
-  headingStyle: "atx",
-  // Don't wrap code blocks in <pre> — render them as triple-backtick blocks.
-  codeBlockStyle: "fenced"
-});
-TD.addRule("stripDangerousElements", {
-  filter: ["script", "style", "noscript"],
-  replacement: () => ""
-});
-var MAX_BYTES = 131072;
-var TIMEOUT_MS = 2e4;
+// src/_fetch-guard.ts
+import * as dns from "node:dns/promises";
+import * as net from "node:net";
+import {
+  FetchError,
+  ToolValidationError,
+  isPrivateIPv4,
+  isPrivateIPv6
+} from "@wrongstack/core";
+import { Agent, fetch as undiciFetch } from "undici";
 var nativeGlobalFetch = globalThis.fetch;
 var ALLOW_PRIVATE = process.env["WRONGSTACK_FETCH_ALLOW_PRIVATE"] === "1";
 if (ALLOW_PRIVATE && !process.env["CI"]) {
@@ -33,7 +19,6 @@ if (ALLOW_PRIVATE && !process.env["CI"]) {
     "[WrongStack] WARNING: WRONGSTACK_FETCH_ALLOW_PRIVATE=1 is active \u2014\n  fetch tool can now access private IPs (10.x, 192.168.x, 169.254.x),\n  cloud metadata endpoints, and plaintext HTTP. Use only on isolated networks."
   );
 }
-var combineSignals = (signals) => AbortSignal.any(signals);
 function guardedLookup(hostname, options, callback) {
   dns.lookup(hostname, { all: true }).then((records) => {
     const family = options?.family;
@@ -77,7 +62,7 @@ function getPinnedDispatcher() {
   return pinnedAgent;
 }
 function dispatcherFetch() {
-  return globalThis.fetch === nativeGlobalFetch ? fetch : globalThis.fetch;
+  return globalThis.fetch === nativeGlobalFetch ? undiciFetch : globalThis.fetch;
 }
 var _beforeExitRegistered = false;
 if (!_beforeExitRegistered) {
@@ -137,6 +122,72 @@ async function guardedFetch(url, maxRedirects, signal, headers = {
     currentUrl = new URL(location, currentUrl).toString();
   }
 }
+async function assertNotPrivate(hostname) {
+  if (ALLOW_PRIVATE) return;
+  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    throw new ToolValidationError({
+      message: "fetch: blocked localhost target",
+      field: "url"
+    });
+  }
+  const ipVersion = net.isIP(host);
+  if (ipVersion === 4) {
+    if (isPrivateIPv4(host)) {
+      throw new ToolValidationError({
+        message: `fetch: blocked private/loopback address "${host}"`,
+        field: "url"
+      });
+    }
+  } else if (ipVersion === 6) {
+    if (isPrivateIPv6(host)) {
+      throw new ToolValidationError({
+        message: `fetch: blocked private/loopback address "${host}"`,
+        field: "url"
+      });
+    }
+  } else {
+    try {
+      const records = await dns.lookup(host, { all: true });
+      for (const r of records) {
+        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);
+        if (bad) {
+          throw new ToolValidationError({
+            message: `fetch: resolved to private address ${r.address}`,
+            field: "url"
+          });
+        }
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.startsWith("fetch:")) throw err;
+    }
+  }
+}
+
+// src/_util.ts
+import * as Core from "@wrongstack/core";
+function truncateMiddle(s, max) {
+  if (Buffer.byteLength(s, "utf8") <= max) return s;
+  const half = Math.floor(max / 2);
+  return s.slice(0, half) + `
+\u2026[truncated ${Buffer.byteLength(s, "utf8") - max} bytes from middle]\u2026
+` + s.slice(-half);
+}
+
+// src/fetch.ts
+var TD = new TurndownService({
+  // Use `# Title` for headings, not setext underline style (`Title\n=====`).
+  headingStyle: "atx",
+  // Don't wrap code blocks in <pre> — render them as triple-backtick blocks.
+  codeBlockStyle: "fenced"
+});
+TD.addRule("stripDangerousElements", {
+  filter: ["script", "style", "noscript"],
+  replacement: () => ""
+});
+var MAX_BYTES = 131072;
+var TIMEOUT_MS = 2e4;
+var combineSignals = (signals) => AbortSignal.any(signals);
 var fetchTool = {
   name: "fetch",
   category: "Network",
@@ -192,20 +243,20 @@ var fetchTool = {
   },
   async *executeStream(input, ctx, opts) {
     if (!input?.url) {
-      throw new ToolValidationError({
+      throw new ToolValidationError2({
         message: "fetch: url is required",
         field: "url"
       });
     }
     const u = new URL(input.url);
     if (u.protocol !== "https:" && u.protocol !== "http:") {
-      throw new ToolValidationError({
+      throw new ToolValidationError2({
         message: `fetch: unsupported protocol "${u.protocol}"`,
         field: "url"
       });
     }
     if (u.protocol === "http:" && !ALLOW_PRIVATE) {
-      throw new ToolValidationError({
+      throw new ToolValidationError2({
         message: "fetch: http:// blocked (HTTPS required by default)",
         field: "url"
       });
@@ -229,7 +280,7 @@ var fetchTool = {
       }
       const ct = res.headers.get("content-type") ?? "application/octet-stream";
       if (/^image\/|^audio\/|^video\/|application\/octet-stream/.test(ct)) {
-        throw new FetchError({
+        throw new FetchError2({
           message: `fetch: refusing to read binary content-type "${ct}"`,
           status: res.status,
           context: { url: res.url, contentType: ct }
@@ -294,47 +345,6 @@ var fetchTool = {
     }
   }
 };
-async function assertNotPrivate(hostname) {
-  if (ALLOW_PRIVATE) return;
-  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  if (host === "localhost" || host.endsWith(".localhost")) {
-    throw new ToolValidationError({
-      message: "fetch: blocked localhost target",
-      field: "url"
-    });
-  }
-  const ipVersion = net.isIP(host);
-  if (ipVersion === 4) {
-    if (isPrivateIPv4(host)) {
-      throw new ToolValidationError({
-        message: `fetch: blocked private/loopback address "${host}"`,
-        field: "url"
-      });
-    }
-  } else if (ipVersion === 6) {
-    if (isPrivateIPv6(host)) {
-      throw new ToolValidationError({
-        message: `fetch: blocked private/loopback address "${host}"`,
-        field: "url"
-      });
-    }
-  } else {
-    try {
-      const records = await dns.lookup(host, { all: true });
-      for (const r of records) {
-        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);
-        if (bad) {
-          throw new ToolValidationError({
-            message: `fetch: resolved to private address ${r.address}`,
-            field: "url"
-          });
-        }
-      }
-    } catch (err) {
-      if (err instanceof Error && err.message.startsWith("fetch:")) throw err;
-    }
-  }
-}
 function describeFetchError(err, url, timedOut) {
   if (timedOut) {
     return new ToolError({
@@ -356,7 +366,7 @@ function describeFetchError(err, url, timedOut) {
     cur = cur.cause;
   }
   const detail = parts.length > 0 ? parts.join(" \u2192 ") : "fetch failed";
-  return new FetchError({
+  return new FetchError2({
     message: `fetch: GET ${url} failed \u2014 ${detail}`,
     status: 502,
     context: { url, timedOut: false, transportErrors: parts },
@@ -373,7 +383,9 @@ function prettyJson(s) {
     return s;
   }
 }
-
-export { fetchTool, guardedFetch, guardedLookup };
+export {
+  fetchTool,
+  guardedFetch,
+  guardedLookup
+};
 //# sourceMappingURL=fetch.js.map
-//# sourceMappingURL=fetch.js.map

package/dist/fetch.js.map

@@ -1 +1,7 @@
-{"version":3,"sources":["../src/_util.ts","../src/fetch.ts"],"names":["undiciFetch"],"mappings":";;;;;;;AA2HO,SAAS,cAAA,CAAe,GAAW,GAAA,EAAqB;AAC7D,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,KAAK,OAAO,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,EAAA,OACE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,GACf;AAAA,iBAAA,EAAiB,MAAA,CAAO,UAAA,CAAW,CAAA,EAAG,MAAM,IAAI,GAAG,CAAA;AAAA,CAAA,GACnD,CAAA,CAAE,KAAA,CAAM,CAAC,IAAI,CAAA;AAEjB;;;AChHA,IAAM,EAAA,GAAK,IAAI,eAAA,CAAgB;AAAA;AAAA,EAE7B,YAAA,EAAc,KAAA;AAAA;AAAA,EAEd,cAAA,EAAgB;AAClB,CAAC,CAAA;AAMD,EAAA,CAAG,QAAQ,wBAAA,EAA0B;AAAA,EACnC,MAAA,EAAQ,CAAC,QAAA,EAAU,OAAA,EAAS,UAAU,CAAA;AAAA,EACtC,aAAa,MAAM;AACrB,CAAC,CAAA;AAcD,IAAM,SAAA,GAAY,MAAA;AAClB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,oBAAoB,UAAA,CAAW,KAAA;AAErC,IAAM,aAAA,GAAgB,OAAA,CAAQ,GAAA,CAAI,gCAAgC,CAAA,KAAM,GAAA;AAExE,IAAI,aAAA,IAAiB,CAAC,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,EAAG;AACvC,EAAA,OAAA,CAAQ,IAAA;AAAA,IACN;AAAA,GAGF;AACF;AAGA,IAAM,cAAA,GAAiB,CAAC,OAAA,KAAwC,WAAA,CAAY,IAAI,OAAO,CAAA;AAkBhF,SAAS,aAAA,CACd,QAAA,EACA,OAAA,EACA,QAAA,EACM;AACN,EACG,GAAA,CAAA,MAAA,CAAO,UAAU,EAAE,GAAA,EAAK,MAAM,CAAA,CAC9B,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,IAAA,MAAM,SAAS,OAAA,EAAS,MAAA;AACxB,IAAA,MAAM,QAAA,GACJ,MAAA,KAAW,CAAA,IAAK,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,MAAM,CAAA,GAAI,OAAA;AAC9E,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,GAAS,CAAA,GAAI,QAAA,GAAW,OAAA;AAC9C,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,MAAA,KAAW,CAAA,GAAI,aAAA,CAAc,EAAE,OAAO,CAAA,GAAI,aAAA,CAAc,CAAA,CAAE,OAAO,CAAA;AAC/E,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,QAAA;AAAA,YACE,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,sCAAsC,CAAA,CAAE,OAAO,EAAE,CAAA,EAAG;AAAA,cAC1E,IAAA,EAAM;AAAA,aACP;AAAA,WACH;AACA,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,IAAI,SAAS,GAAA,EAAK;AAChB,MAAA,QAAA;AAAA,QACE,IAAA;AAAA,QACA,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE;AAAA,OAC5D;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,EAAA,CAAG,CAAC,CAAA;AACvB,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,QAAA;AAAA,QACE,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,QAAQ,CAAA,CAAE,CAAA,EAAG,EAAE,IAAA,EAAM,WAAA,EAAa;AAAA,OACrF;AACA,MAAA;AAAA,IACF;AACA,IAAA,QAAA,CAAS,IAAA,EAAM,KAAA,CAAM,OAAA,EAAS,KAAA,CAAM,MAAM,CAAA;AAAA,EAC5C,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,GAAA,KAAQ,QAAA,CAAS,GAA4B,CAAC,CAAA;AAC1D;AAOA,IAAI,WAAA;AACJ,SAAS,mBAAA,GAA6B;AACpC,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,WAAA,GAAc,IAAI,MAAM,EAAE,OAAA,EAAS,EAAE,MAAA,EAAQ,aAAA,IAA0B,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,WAAA;AACT;AAEA,SAAS,eAAA,GAA2C;AAOlD,EAAA,OAAO,UAAA,CAAW,KAAA,KAAU,iBAAA,GACvBA,KAAA,GACD,UAAA,CAAW,KAAA;AACjB;AAKA,IAAI,qBAAA,GAAwB,KAAA;AAC5B,IAAI,CAAC,qBAAA,EAAuB;AAC1B,EAAA,qBAAA,GAAwB,IAAA;AAExB,EAAA,OAAA,CAAQ,EAAA,CAAG,cAAc,MAAM;AAC7B,IAAA,WAAA,EAAa,OAAA,EAAQ;AACrB,IAAA,WAAA,GAAc,MAAA;AAAA,EAChB,CAAC,CAAA;AACH;AAUA,eAAsB,YAAA,CACpB,GAAA,EACA,YAAA,EACA,MAAA,EACA,OAAA,GAAkC;AAAA,EAChC,YAAA,EAAc,0CAAA;AAAA,EACd,MAAA,EAAQ;AACV,CAAA,EACmB;AACnB,EAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,EAAA,IAAI,UAAA,GAAa,GAAA;AACjB,EAAA,WAAS;AAGP,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,UAAU,CAAA;AACjC,IAAA,IAAI,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,MAAA,CAAO,aAAa,OAAA,EAAS;AAC/D,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,CAAA,yCAAA,EAA4C,MAAA,CAAO,QAAQ,CAAA,CAAA,CAAA;AAAA,QACpE,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AACA,IAAA,IAAI,MAAA,CAAO,QAAA,KAAa,OAAA,IAAW,CAAC,aAAA,EAAe;AACjD,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,gEAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AACA,IAAA,MAAM,gBAAA,CAAiB,OAAO,QAAQ,CAAA;AAQtC,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,QAAA,EAAU,QAAA;AAAA,MACV,MAAA;AAAA,MACA,OAAA;AAAA,MACA,YAAY,mBAAA;AAAoB,KAClC;AACA,IAAA,MAAM,GAAA,GAAM,MAAM,eAAA,EAAgB,CAAE,YAAY,IAA4B,CAAA;AAC5E,IAAA,IAAI,GAAA,CAAI,MAAA,GAAS,GAAA,IAAO,GAAA,CAAI,SAAS,GAAA,EAAK;AACxC,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,aAAA,EAAA;AACA,IAAA,IAAI,gBAAgB,YAAA,EAAc;AAChC,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,OAAA,EAAS,mBAAmB,YAAY,CAAA,UAAA,CAAA;AAAA,QACxC,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA,EAAS,EAAE,GAAA,EAAK,UAAA,EAAY,cAAc,aAAA;AAAc,OACzD,CAAA;AAAA,IACH;AACA,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAC3C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,UAAA,CAAW;AAAA,QACnB,OAAA,EAAS,gDAAA;AAAA,QACT,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,OAAA,EAAS,EAAE,GAAA,EAAK,UAAA,EAAY,aAAA;AAAc,OAC3C,CAAA;AAAA,IACH;AACA,IAAA,UAAA,GAAa,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,EAAE,QAAA,EAAS;AAAA,EACtD;AACF;AAEO,IAAM,SAAA,GAA2C;AAAA,EACtD,IAAA,EAAM,OAAA;AAAA,EACN,QAAA,EAAU,SAAA;AAAA,EACV,WAAA,EACE,oNAAA;AAAA,EAEF,SAAA,EACE,+ZAAA;AAAA,EAOF,UAAA,EAAY,MAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,YAAA,EAAc,CAAC,cAAc,CAAA;AAAA,EAC7B,IAAA,EAAM,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKN,UAAA,EAAY,KAAA;AAAA,EACZ,SAAA,EAAW,UAAA;AAAA,EACX,cAAA,EAAgB,SAAA;AAAA,EAChB,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,GAAA,EAAK;AAAA,QACH,IAAA,EAAM,QAAA;AAAA,QACN,WAAA,EAAa;AAAA,OACf;AAAA,MACA,MAAA,EAAQ;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,IAAA,EAAM,CAAC,UAAA,EAAY,MAAA,EAAQ,KAAK,CAAA;AAAA,QAChC,WAAA,EAAa;AAAA;AACf,KACF;AAAA,IACA,QAAA,EAAU,CAAC,KAAK;AAAA,GAClB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,MAAM,gBAAgB,SAAA,CAAU,aAAA;AAChC,IAAA,IAAI,CAAC,aAAA,EAAe;AAClB,MAAA,MAAM,IAAI,SAAA,CAAU;AAAA,QAClB,OAAA,EAAS,yCAAA;AAAA,QACT,IAAA,EAAM,uBAAA;AAAA,QACN,QAAA,EAAU;AAAA,OACX,CAAA;AAAA,IACH;AACA,IAAA,WAAA,MAAiB,EAAA,IAAM,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AACtD,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,MAAM,IAAI,SAAA,CAAU;AAAA,QAClB,OAAA,EAAS,yCAAA;AAAA,QACT,IAAA,EAAM,uBAAA;AAAA,QACN,QAAA,EAAU;AAAA,OACX,CAAA;AAAA,IACH;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAoD;AACnF,IAAA,IAAI,CAAC,OAAO,GAAA,EAAK;AACf,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,wBAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AACA,IAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAA,CAAE,QAAA,KAAa,QAAA,IAAY,CAAA,CAAE,aAAa,OAAA,EAAS;AACrD,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,CAAA,6BAAA,EAAgC,CAAA,CAAE,QAAQ,CAAA,CAAA,CAAA;AAAA,QACnD,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AACA,IAAA,IAAI,CAAA,CAAE,QAAA,KAAa,OAAA,IAAW,CAAC,aAAA,EAAe;AAC5C,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,oDAAA;AAAA,QACT,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AACA,IAAA,MAAM,gBAAA,CAAiB,EAAE,QAAQ,CAAA;AAEjC,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA,IAAA,EAAO,KAAA,CAAM,GAAG,CAAA,CAAA,EAAG;AAE9C,IAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,IAAA,CAAK,KAAA,CAAM,IAAI,SAAA,CAAU;AAAA,MACtD,OAAA,EAAS,eAAA;AAAA,MACT,IAAA,EAAM,cAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACX,CAAC,CAAA,EAAG,UAAU,CAAA;AACf,IAAA,MAAM,WAAW,cAAA,CAAe,CAAC,KAAK,MAAA,EAAQ,IAAA,CAAK,MAAM,CAAC,CAAA;AAE1D,IAAA,IAAI;AACF,MAAA,IAAI,GAAA;AACJ,MAAA,IAAI;AACF,QAAA,GAAA,GAAM,MAAM,YAAA,CAAa,KAAA,CAAM,GAAA,EAAK,GAAG,QAAQ,CAAA;AAAA,MACjD,SAAS,GAAA,EAAK;AAOZ,QAAA,IAAI,IAAA,CAAK,MAAA,CAAO,OAAA,EAAS,MAAM,GAAA;AAC/B,QAAA,MAAM,mBAAmB,GAAA,EAAK,KAAA,CAAM,GAAA,EAAK,IAAA,CAAK,OAAO,OAAO,CAAA;AAAA,MAC9D;AAEA,MAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,0BAAA;AAC9C,MAAA,IAAI,sDAAA,CAAuD,IAAA,CAAK,EAAE,CAAA,EAAG;AACnE,QAAA,MAAM,IAAI,UAAA,CAAW;AAAA,UACnB,OAAA,EAAS,gDAAgD,EAAE,CAAA,CAAA,CAAA;AAAA,UAC3D,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,SAAS,EAAE,GAAA,EAAK,GAAA,CAAI,GAAA,EAAK,aAAa,EAAA;AAAG,SAC1C,CAAA;AAAA,MACH;AAEA,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,KAAA;AAAA,QACN,IAAA,EAAM,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAI,EAAE,CAAA,CAAA;AAAA,QAC9B,MAAM,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,aAAa,EAAA;AAAG,OAC9C;AAEA,MAAA,MAAM,MAAA,GAAS,GAAA,CAAI,IAAA,EAAM,SAAA,EAAU;AACnC,MAAA,IAAI,QAAA,GAAW,CAAA;AACf,MAAA,MAAM,SAAuB,EAAC;AAC9B,MAAA,IAAI,YAAA,GAAe,CAAA;AACnB,MAAA,MAAM,WAAW,CAAA,GAAI,IAAA;AACrB,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,WAAS;AACP,UAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,UAAA,IAAI,IAAA,EAAM;AACV,UAAA,IAAI,CAAC,KAAA,EAAO;AACZ,UAAA,QAAA,IAAY,KAAA,CAAM,UAAA;AAClB,UAAA,YAAA,IAAgB,KAAA,CAAM,UAAA;AACtB,UAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,UAAA,IAAI,gBAAgB,QAAA,EAAU;AAI5B,YAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,OAAO,CAAA;AAClD,YAAA,MAAM;AAAA,cACJ,IAAA,EAAM,gBAAA;AAAA,cACN,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM,EAAE,QAAA;AAAS,aACnB;AACA,YAAA,YAAA,GAAe,CAAA;AAAA,UACjB;AACA,UAAA,IAAI,WAAW,SAAA,EAAW;AAAA,QAC5B;AAAA,MACF;AACA,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,IAAI,CAAC,CAAA,KAAM,MAAA,CAAO,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,CAAE,SAAS,MAAM,CAAA;AAE7E,MAAA,MAAM,SAAS,KAAA,CAAM,MAAA,KAAW,GAAG,QAAA,CAAS,WAAW,IAAI,UAAA,GAAa,MAAA,CAAA;AACxE,MAAA,IAAI,OAAA;AACJ,MAAA,IAAI,MAAA,KAAW,OAAO,OAAA,GAAU,IAAA;AAAA,WAAA,IACvB,MAAA,KAAW,cAAc,EAAA,CAAG,QAAA,CAAS,WAAW,CAAA,EAAG,OAAA,GAAU,EAAA,CAAG,QAAA,CAAS,IAAI,CAAA;AAAA,WAAA,IAC7E,GAAG,QAAA,CAAS,kBAAkB,CAAA,EAAG,OAAA,GAAU,WAAW,IAAI,CAAA;AAAA,WAC9D,OAAA,GAAU,IAAA;AAEf,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,OAAA;AAAA,QACN,MAAA,EAAQ;AAAA,UACN,OAAA,EAAS,cAAA,CAAe,OAAA,EAAS,SAAS,CAAA;AAAA,UAC1C,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,YAAA,EAAc,EAAA;AAAA,UACd,KAAK,GAAA,CAAI;AAAA;AACX,OACF;AAEA,MAAA,GAAA,CAAI,gBAAA,GAAmB;AAAA,QACrB,SAAA,EAAW,CAAA,MAAA,EAAS,IAAA,CAAK,GAAA,EAAK,CAAA,CAAA;AAAA,QAC9B,QAAA,EAAU,OAAA;AAAA,QACV,EAAA,EAAA,iBAAI,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,QAC3B,OAAO,EAAE,GAAA,EAAK,MAAM,GAAA,EAAK,MAAA,EAAQ,MAAM,MAAA,EAAO;AAAA,QAC9C,OAAA,EAAS,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,KAAK,EAAE,CAAA,CAAA,CAAA;AAAA,QAClC,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAe,iBAAiB,QAAA,EAAiC;AAC/D,EAAA,IAAI,aAAA,EAAe;AAEnB,EAAA,MAAM,IAAA,GACJ,QAAA,CAAS,UAAA,CAAW,GAAG,CAAA,IAAK,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,GAAI,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,GAAI,QAAA;AAE/E,EAAA,IAAI,IAAA,KAAS,WAAA,IAAe,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA,EAAG;AACvD,IAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,MAC5B,OAAA,EAAS,iCAAA;AAAA,MACT,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,SAAA,GAAgB,SAAK,IAAI,CAAA;AAC/B,EAAA,IAAI,cAAc,CAAA,EAAG;AACnB,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,4CAA4C,IAAI,CAAA,CAAA,CAAA;AAAA,QACzD,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAAA,EACF,CAAA,MAAA,IAAW,cAAc,CAAA,EAAG;AAC1B,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACvB,MAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,QAC5B,OAAA,EAAS,4CAA4C,IAAI,CAAA,CAAA,CAAA;AAAA,QACzD,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAAA,EACF,CAAA,MAAO;AAOL,IAAA,IAAI;AAEF,MAAA,MAAM,UAAU,MAAU,GAAA,CAAA,MAAA,CAAO,MAAM,EAAE,GAAA,EAAK,MAAM,CAAA;AACpD,MAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,QAAA,MAAM,GAAA,GAAM,CAAA,CAAE,MAAA,KAAW,CAAA,GAAI,aAAA,CAAc,EAAE,OAAO,CAAA,GAAI,aAAA,CAAc,CAAA,CAAE,OAAO,CAAA;AAC/E,QAAA,IAAI,GAAA,EAAK;AACP,UAAA,MAAM,IAAI,mBAAA,CAAoB;AAAA,YAC5B,OAAA,EAAS,CAAA,mCAAA,EAAsC,CAAA,CAAE,OAAO,CAAA,CAAA;AAAA,YACxD,KAAA,EAAO;AAAA,WACR,CAAA;AAAA,QACH;AAAA,MACF;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,KAAA,IAAS,GAAA,CAAI,QAAQ,UAAA,CAAW,QAAQ,GAAG,MAAM,GAAA;AAAA,IAEtE;AAAA,EACF;AACF;AAUA,SAAS,kBAAA,CAAmB,GAAA,EAAc,GAAA,EAAa,QAAA,EAA2C;AAChG,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,OAAO,IAAI,SAAA,CAAU;AAAA,MACnB,OAAA,EAAS,CAAA,WAAA,EAAc,GAAG,CAAA,iBAAA,EAAoB,UAAU,CAAA,EAAA,CAAA;AAAA,MACxD,IAAA,EAAM,cAAA;AAAA,MACN,QAAA,EAAU,OAAA;AAAA,MACV,SAAS,EAAE,GAAA,EAAK,QAAA,EAAU,IAAA,EAAM,WAAW,UAAA,EAAW;AAAA,MACtD,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,EACH;AACA,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAa;AAC9B,EAAA,IAAI,GAAA,GAAe,GAAA;AACnB,EAAA,OAAO,eAAe,KAAA,IAAS,CAAC,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AAC7C,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,MAAM,OAAQ,GAAA,CAA8B,IAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,OAAO,CAAA,EAAG,IAAI,KAAK,GAAA,CAAI,OAAO,KAAK,GAAA,CAAI,OAAA;AAGrD,IAAA,IAAI,KAAA,IAAS,KAAA,KAAU,cAAA,IAAkB,CAAC,KAAA,CAAM,SAAS,KAAK,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA;AACjF,IAAA,GAAA,GAAO,GAAA,CAA4B,KAAA;AAAA,EACrC;AACA,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA,GAAS,IAAI,KAAA,CAAM,IAAA,CAAK,UAAK,CAAA,GAAI,cAAA;AACtD,EAAA,OAAO,IAAI,UAAA,CAAW;AAAA,IACpB,OAAA,EAAS,CAAA,WAAA,EAAc,GAAG,CAAA,eAAA,EAAa,MAAM,CAAA,CAAA;AAAA,IAC7C,MAAA,EAAQ,GAAA;AAAA,IACR,SAAS,EAAE,GAAA,EAAK,QAAA,EAAU,KAAA,EAAO,iBAAiB,KAAA,EAAM;AAAA;AAAA;AAAA;AAAA,IAIxD,KAAA,EAAO;AAAA,GACR,CAAA;AACH;AAEA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,IAAI;AACF,IAAA,OAAO,KAAK,SAAA,CAAU,IAAA,CAAK,MAAM,CAAC,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACF","file":"fetch.js","sourcesContent":["import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` — the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm → yarn → npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root→out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink — macOS `/var`→`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// ─── Command-output normalization (token-saving) ────────────────────────────\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) — never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only — it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `… ⟨repeated ${run}×⟩`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends — the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n…[truncated ${total - kept} bytes]…\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI → collapse\n * carriage-return progress → trim trailing whitespace → collapse identical\n * consecutive lines → squeeze blank-line runs → head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines → 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n","import * as dns from 'node:dns/promises';\nimport * as net from 'node:net';\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport {\n  FetchError,\n  ToolError,\n  ToolValidationError,\n  isPrivateIPv4,\n  isPrivateIPv6,\n} from '@wrongstack/core';\nimport { Agent, fetch as undiciFetch } from 'undici';\nimport TurndownService from 'turndown';\nimport { truncateMiddle } from './_util.js';\n\n/**\n * Singleton Turndown instance for HTML→Markdown conversion.\n * Pre-configured with sensible defaults; code blocks are handled via the\n * default fenced code rule. Reused across all fetch calls.\n */\nconst TD = new TurndownService({\n  // Use `# Title` for headings, not setext underline style (`Title\\n=====`).\n  headingStyle: 'atx',\n  // Don't wrap code blocks in <pre> — render them as triple-backtick blocks.\n  codeBlockStyle: 'fenced',\n});\n\n// Strip <script>/<style>/<noscript> before turndown sees them. The old\n// hand-rolled converter did this via regex; turndown's DOM-based approach\n// may keep their text content unless we remove the elements first.\n// Using turndown's own addRule mechanism keeps the logic co-located.\nTD.addRule('stripDangerousElements', {\n  filter: ['script', 'style', 'noscript'],\n  replacement: () => '',\n});\n\ninterface FetchInput {\n  url: string;\n  format?: 'markdown' | 'text' | 'raw' | undefined;\n}\n\ninterface FetchOutput {\n  content: string;\n  status: number;\n  content_type: string;\n  url: string;\n}\n\nconst MAX_BYTES = 131_072;\nconst TIMEOUT_MS = 20_000;\nconst nativeGlobalFetch = globalThis.fetch;\n\nconst ALLOW_PRIVATE = process.env['WRONGSTACK_FETCH_ALLOW_PRIVATE'] === '1';\n/* v8 ignore next 8 -- module-load-time opt-in warning; gated on an env var not set during tests. */\nif (ALLOW_PRIVATE && !process.env['CI']) {\n  console.warn(\n    '[WrongStack] WARNING: WRONGSTACK_FETCH_ALLOW_PRIVATE=1 is active —\\n' +\n    '  fetch tool can now access private IPs (10.x, 192.168.x, 169.254.x),\\n' +\n    '  cloud metadata endpoints, and plaintext HTTP. Use only on isolated networks.',\n  );\n}\n\n/** Abort when any of the signals abort (Node 22+ — AbortSignal.any shipped in Node 20). */\nconst combineSignals = (signals: AbortSignal[]): AbortSignal => AbortSignal.any(signals);\n\ntype LookupCallback = (\n  err: NodeJS.ErrnoException | null,\n  address?: string | Array<{ address: string | undefined; family: number }>,\n  family?: number | undefined,\n) => void;\n\n/**\n * DNS lookup used by the undici dispatcher below. It performs the SINGLE name\n * resolution that the TCP connection actually uses, and rejects if any\n * resolved address is private/loopback/link-local. Because the connection\n * reuses exactly this result, there is no DNS-rebinding TOCTOU window between\n * the security check and the connect — closing the gap the old code documented\n * (validate with one dns.lookup, then let fetch re-resolve independently).\n * TLS still validates the certificate against the hostname (SNI is set by\n * undici from the URL), so pinning the IP does not weaken cert checking.\n */\nexport function guardedLookup(\n  hostname: string,\n  options: { all?: boolean | undefined; family?: number | undefined },\n  callback: LookupCallback,\n): void {\n  dns\n    .lookup(hostname, { all: true })\n    .then((records) => {\n      const family = options?.family;\n      const byFamily =\n        family === 4 || family === 6 ? records.filter((r) => r.family === family) : records;\n      const list = byFamily.length > 0 ? byFamily : records;\n      if (!ALLOW_PRIVATE) {\n        for (const r of list) {\n          const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n          if (bad) {\n            callback(\n              Object.assign(new Error(`fetch: resolved to private address ${r.address}`), {\n                code: 'EAI_FAIL',\n              }),\n            );\n            return;\n          }\n        }\n      }\n      if (options?.all) {\n        callback(\n          null,\n          list.map((r) => ({ address: r.address, family: r.family })),\n        );\n        return;\n      }\n      const first = list.at(0);\n      if (!first) {\n        callback(\n          Object.assign(new Error(`fetch: no address for ${hostname}`), { code: 'ENOTFOUND' }),\n        );\n        return;\n      }\n      callback(null, first.address, first.family);\n    })\n    .catch((err) => callback(err as NodeJS.ErrnoException));\n}\n\n// Reused across requests; guardedLookup re-validates on every new connection,\n// so connection pooling is safe. Literal-IP targets bypass lookup entirely and\n// are caught by assertNotPrivate's pre-check instead.\n// Destroyed on process exit so long-running processes (eternal autonomy,\n// MCP server mode) don't let the connection pool grow unboundedly.\nlet pinnedAgent: Agent | undefined;\nfunction getPinnedDispatcher(): Agent {\n  if (!pinnedAgent) {\n    pinnedAgent = new Agent({ connect: { lookup: guardedLookup as never } });\n  }\n  return pinnedAgent;\n}\n\nfunction dispatcherFetch(): typeof globalThis.fetch {\n  // Node's built-in global fetch is backed by its own bundled undici version.\n  // Passing an Agent from the workspace's `undici` package to that different\n  // dispatcher ABI fails on recent Node with:\n  //   UND_ERR_INVALID_ARG: invalid onRequestStart method\n  // Use the matching package fetch+Agent pair in real runs, but keep honoring\n  // test/user fetch shims that replace globalThis.fetch after this module loads.\n  return globalThis.fetch === nativeGlobalFetch\n    ? (undiciFetch as unknown as typeof globalThis.fetch)\n    : globalThis.fetch;\n}\n// Clean up the global dispatcher on exit — undici Agents maintain connection\n// pools and DNS caches that should be torn down in long-running processes.\n// Guard against duplicate registration (module reload/HMR would otherwise\n// accumulate listeners).\nlet _beforeExitRegistered = false;\nif (!_beforeExitRegistered) {\n  _beforeExitRegistered = true;\n  /* v8 ignore next 4 -- process 'beforeExit' cleanup; not deterministically triggerable in-test. */\n  process.on('beforeExit', () => {\n    pinnedAgent?.destroy();\n    pinnedAgent = undefined;\n  });\n}\n\n/**\n * SSRF-guarded fetch with manual, per-hop-revalidated redirects, exported so\n * other builtin tools (e.g. `search`) get the same protections instead of a\n * weaker `redirect: 'follow'`. Every hop is re-checked against private/loopback\n * ranges and the connection is pinned to the validated IP via the undici\n * dispatcher (no DNS-rebinding TOCTOU). `headers` defaults to the plain `fetch`\n * tool's; callers may override (e.g. a browser User-Agent for search engines).\n */\nexport async function guardedFetch(\n  url: string,\n  maxRedirects: number,\n  signal: AbortSignal,\n  headers: Record<string, string> = {\n    'user-agent': 'WrongStack/1.0 (+https://wrongstack.com)',\n    accept: 'text/html,application/json;q=0.9,text/plain;q=0.8,*/*;q=0.1',\n  },\n): Promise<Response> {\n  let redirectCount = 0;\n  let currentUrl = url;\n  for (;;) {\n    // Re-validate every hop. A public host can 302 to 169.254.169.254 (cloud metadata),\n    // or DNS can rebind between hops; checking only the initial URL is insufficient.\n    const parsed = new URL(currentUrl);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new ToolValidationError({\n        message: `fetch: redirect to unsupported protocol \"${parsed.protocol}\"`,\n        field: 'url',\n      });\n    }\n    if (parsed.protocol === 'http:' && !ALLOW_PRIVATE) {\n      throw new ToolValidationError({\n        message: 'fetch: redirect to http:// blocked (HTTPS required by default)',\n        field: 'url',\n      });\n    }\n    await assertNotPrivate(parsed.hostname);\n\n    // The dispatcher pins the connection to the IP guardedLookup validated —\n    // no independent re-resolution, so DNS rebinding can't swap in a private\n    // address between check and connect. `dispatcher` is a runtime option of\n    // Node's undici-backed global fetch but isn't in lib.dom's RequestInit, and\n    // our undici Agent's type differs from the @types/node copy — hence the\n    // cast. (Verified: global fetch invokes the Agent's custom lookup.)\n    const init = {\n      redirect: 'manual' as const,\n      signal,\n      headers,\n      dispatcher: getPinnedDispatcher(),\n    };\n    const res = await dispatcherFetch()(currentUrl, init as never as RequestInit);\n    if (res.status < 300 || res.status > 399) {\n      return res;\n    }\n    redirectCount++;\n    if (redirectCount > maxRedirects) {\n      throw new FetchError({\n        message: `fetch: exceeded ${maxRedirects} redirects`,\n        status: res.status,\n        context: { url: currentUrl, maxRedirects, redirectCount },\n      });\n    }\n    const location = res.headers.get('location');\n    if (!location) {\n      throw new FetchError({\n        message: 'fetch: redirect status with no location header',\n        status: res.status,\n        context: { url: currentUrl, redirectCount },\n      });\n    }\n    currentUrl = new URL(location, currentUrl).toString();\n  }\n}\n\nexport const fetchTool: Tool<FetchInput, FetchOutput> = {\n  name: 'fetch',\n  category: 'Network',\n  description:\n    'Fetch a URL and return its content. HTML pages are automatically converted to clean markdown. ' +\n    'This tool has strong SSRF protections (private IPs, localhost, and cloud metadata endpoints are blocked by default).',\n  usageHint:\n    'Use this when you need external information (documentation, API responses, web pages, etc.).\\n\\n' +\n    'Security notes:\\n' +\n    '- Only HTTPS is allowed by default.\\n' +\n    '- Internal/private networks are blocked unless explicitly enabled via environment variable.\\n' +\n    '- Redirects are followed but re-validated at each hop.\\n' +\n    '- Output is capped (128KB by default) to avoid flooding context.\\n' +\n    'Prefer this over raw `bash curl` or `bash wget`.',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['net.outbound'],\n  icon: 'web',\n  // Trust rules for fetch match on the literal URL — declare it explicitly\n  // so a user can trust `https://api.example.com/*` without accidentally\n  // matching that pattern on any other tool that happens to have a `url`\n  // input field.\n  subjectKey: 'url',\n  timeoutMs: TIMEOUT_MS,\n  maxOutputBytes: MAX_BYTES,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      url: {\n        type: 'string',\n        description: 'The target URL (must use https://).',\n      },\n      format: {\n        type: 'string',\n        enum: ['markdown', 'text', 'raw'],\n        description: 'Output format. \"markdown\" is recommended for HTML pages.',\n      },\n    },\n    required: ['url'],\n  },\n  async execute(input, ctx, opts) {\n    let final: FetchOutput | undefined;\n    const executeStream = fetchTool.executeStream;\n    if (!executeStream) {\n      throw new ToolError({\n        message: 'fetchTool: stream execution unavailable',\n        code: 'TOOL_EXECUTION_FAILED',\n        toolName: 'fetch',\n      });\n    }\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) {\n      throw new ToolError({\n        message: 'fetch: stream ended without final event',\n        code: 'TOOL_EXECUTION_FAILED',\n        toolName: 'fetch',\n      });\n    }\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<FetchOutput>> {\n    if (!input?.url) {\n      throw new ToolValidationError({\n        message: 'fetch: url is required',\n        field: 'url',\n      });\n    }\n    const u = new URL(input.url);\n    if (u.protocol !== 'https:' && u.protocol !== 'http:') {\n      throw new ToolValidationError({\n        message: `fetch: unsupported protocol \"${u.protocol}\"`,\n        field: 'url',\n      });\n    }\n    if (u.protocol === 'http:' && !ALLOW_PRIVATE) {\n      throw new ToolValidationError({\n        message: 'fetch: http:// blocked (HTTPS required by default)',\n        field: 'url',\n      });\n    }\n    await assertNotPrivate(u.hostname);\n\n    yield { type: 'log', text: `GET ${input.url}` };\n\n    const ctrl = new AbortController();\n    const timer = setTimeout(() => ctrl.abort(new ToolError({\n      message: 'fetch timeout',\n      code: 'TOOL_TIMEOUT',\n      toolName: 'fetch',\n    })), TIMEOUT_MS);\n    const combined = combineSignals([opts.signal, ctrl.signal]);\n\n    try {\n      let res: Response;\n      try {\n        res = await guardedFetch(input.url, 5, combined);\n      } catch (err) {\n        // A user-initiated cancel propagates unchanged. Our own timeout and any\n        // transport failure get a diagnostic message: undici throws an opaque\n        // `TypeError: fetch failed` whose real reason (ENOTFOUND, ECONNREFUSED,\n        // UND_ERR_CONNECT_TIMEOUT, a TLS/cert error, …) lives only on `.cause`.\n        // Surfacing just `.message` left users with \"fetch failed\" and no clue\n        // why HTTPS broke (see #100), so unwrap the cause chain here.\n        if (opts.signal.aborted) throw err;\n        throw describeFetchError(err, input.url, ctrl.signal.aborted);\n      }\n\n      const ct = res.headers.get('content-type') ?? 'application/octet-stream';\n      if (/^image\\/|^audio\\/|^video\\/|application\\/octet-stream/.test(ct)) {\n        throw new FetchError({\n          message: `fetch: refusing to read binary content-type \"${ct}\"`,\n          status: res.status,\n          context: { url: res.url, contentType: ct },\n        });\n      }\n\n      yield {\n        type: 'log',\n        text: `HTTP ${res.status} ${ct}`,\n        data: { status: res.status, contentType: ct },\n      };\n\n      const reader = res.body?.getReader();\n      let received = 0;\n      const chunks: Uint8Array[] = [];\n      let pendingBytes = 0;\n      const FLUSH_AT = 4 * 1024;\n      if (reader) {\n        for (;;) {\n          const { value, done } = await reader.read();\n          if (done) break;\n          if (!value) continue;\n          received += value.byteLength;\n          pendingBytes += value.byteLength;\n          chunks.push(value);\n          if (pendingBytes >= FLUSH_AT) {\n            // Snapshot recent bytes for the partial_output. Keep it cheap —\n            // don't try to decode UTF-8 boundaries; the TUI just needs a\n            // \"things are happening\" signal.\n            const recent = Buffer.from(value).toString('utf-8');\n            yield {\n              type: 'partial_output',\n              text: recent,\n              data: { received },\n            };\n            pendingBytes = 0;\n          }\n          if (received > MAX_BYTES) break;\n        }\n      }\n      const text = Buffer.concat(chunks.map((c) => Buffer.from(c))).toString('utf8');\n\n      const format = input.format ?? (ct.includes('text/html') ? 'markdown' : 'text');\n      let content: string;\n      if (format === 'raw') content = text;\n      else if (format === 'markdown' && ct.includes('text/html')) content = TD.turndown(text);\n      else if (ct.includes('application/json')) content = prettyJson(text);\n      else content = text;\n\n      yield {\n        type: 'final',\n        output: {\n          content: truncateMiddle(content, MAX_BYTES),\n          status: res.status,\n          content_type: ct,\n          url: res.url,\n        },\n      };\n      // P2 #5: record the network request as a structured side effect.\n      ctx.recordSideEffect?.({\n        toolUseId: `fetch-${Date.now()}`,\n        toolName: 'fetch',\n        ts: new Date().toISOString(),\n        input: { url: input.url, format: input.format },\n        outcome: `HTTP ${res.status} (${ct})`,\n        risk: 'network',\n      });\n    } finally {\n      clearTimeout(timer);\n    }\n  },\n};\n\nasync function assertNotPrivate(hostname: string): Promise<void> {\n  if (ALLOW_PRIVATE) return;\n\n  const host =\n    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n\n  if (host === 'localhost' || host.endsWith('.localhost')) {\n    throw new ToolValidationError({\n      message: 'fetch: blocked localhost target',\n      field: 'url',\n    });\n  }\n\n  const ipVersion = net.isIP(host);\n  if (ipVersion === 4) {\n    if (isPrivateIPv4(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else if (ipVersion === 6) {\n    if (isPrivateIPv6(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else {\n    // Hostname — pre-flight check: resolve and reject if any record is private,\n    // so we fail fast with a clear error before opening a socket. The\n    // authoritative anti-rebinding control is guardedLookup on the pinned\n    // undici dispatcher (see getPinnedDispatcher): it performs the single\n    // resolution the connection actually uses, so there is no TOCTOU between\n    // this check and the connect. Each redirect target is re-checked too.\n    try {\n      // Use dns.lookup for async hostname resolution (matches guardedLookup below).\n      const records = await dns.lookup(host, { all: true });\n      for (const r of records) {\n        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n        if (bad) {\n          throw new ToolValidationError({\n            message: `fetch: resolved to private address ${r.address}`,\n            field: 'url',\n          });\n        }\n      }\n    } catch (err) {\n      if (err instanceof Error && err.message.startsWith('fetch:')) throw err;\n      // DNS failure — let fetch handle it\n    }\n  }\n}\n\n/**\n * Turn an opaque undici `TypeError: fetch failed` into an actionable message by\n * walking its `.cause` chain. undici buries the transport reason (a DNS/socket\n * errno or a TLS handshake failure) one or more `.cause` hops down, so the bare\n * `.message` is always just \"fetch failed\". We join each distinct\n * `code: message` link so the user sees, e.g.,\n * `fetch: GET https://x failed — UND_ERR_CONNECT_TIMEOUT: Connect Timeout Error`.\n */\nfunction describeFetchError(err: unknown, url: string, timedOut: boolean): FetchError | ToolError {\n  if (timedOut) {\n    return new ToolError({\n      message: `fetch: GET ${url} timed out after ${TIMEOUT_MS}ms`,\n      code: 'TOOL_TIMEOUT',\n      toolName: 'fetch',\n      context: { url, timedOut: true, timeoutMs: TIMEOUT_MS },\n      cause: err,\n    });\n  }\n  const parts: string[] = [];\n  const seen = new Set<unknown>();\n  let cur: unknown = err;\n  while (cur instanceof Error && !seen.has(cur)) {\n    seen.add(cur);\n    const code = (cur as NodeJS.ErrnoException).code;\n    const label = code ? `${code}: ${cur.message}` : cur.message;\n    // Skip undici's uninformative top-level \"fetch failed\" wrapper, but keep it\n    // as a fallback if it turns out to be the only thing we have.\n    if (label && label !== 'fetch failed' && !parts.includes(label)) parts.push(label);\n    cur = (cur as { cause?: unknown }).cause;\n  }\n  const detail = parts.length > 0 ? parts.join(' → ') : 'fetch failed';\n  return new FetchError({\n    message: `fetch: GET ${url} failed — ${detail}`,\n    status: 502,\n    context: { url, timedOut: false, transportErrors: parts },\n    // Preserve the original undici / DNS / TLS chain so callers can inspect\n    // it via `err.cause` and structured `instanceof` checks. The flattened\n    // text version stays in the message for human readability.\n    cause: err,\n  });\n}\n\nfunction prettyJson(s: string): string {\n  try {\n    return JSON.stringify(JSON.parse(s), null, 2);\n  } catch {\n    return s;\n  }\n}\n"]}
+{
+  "version": 3,
+  "sources": ["../src/fetch.ts", "../src/_fetch-guard.ts", "../src/_util.ts"],
+  "sourcesContent": ["import type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { FetchError, ToolError, ToolValidationError } from '@wrongstack/core';\nimport TurndownService from 'turndown';\nimport { ALLOW_PRIVATE, assertNotPrivate, guardedFetch } from './_fetch-guard.js';\nimport { truncateMiddle } from './_util.js';\n\n/**\n * Singleton Turndown instance for HTML\u2192Markdown conversion.\n * Pre-configured with sensible defaults; code blocks are handled via the\n * default fenced code rule. Reused across all fetch calls.\n */\nconst TD = new TurndownService({\n  // Use `# Title` for headings, not setext underline style (`Title\\n=====`).\n  headingStyle: 'atx',\n  // Don't wrap code blocks in <pre> \u2014 render them as triple-backtick blocks.\n  codeBlockStyle: 'fenced',\n});\n\n// Strip <script>/<style>/<noscript> before turndown sees them. The old\n// hand-rolled converter did this via regex; turndown's DOM-based approach\n// may keep their text content unless we remove the elements first.\n// Using turndown's own addRule mechanism keeps the logic co-located.\nTD.addRule('stripDangerousElements', {\n  filter: ['script', 'style', 'noscript'],\n  replacement: () => '',\n});\n\ninterface FetchInput {\n  url: string;\n  format?: 'markdown' | 'text' | 'raw' | undefined;\n}\n\ninterface FetchOutput {\n  content: string;\n  status: number;\n  content_type: string;\n  url: string;\n}\n\nconst MAX_BYTES = 131_072;\nconst TIMEOUT_MS = 20_000;\n\n/** Abort when any of the signals abort (Node 22+ \u2014 AbortSignal.any shipped in Node 20). */\nconst combineSignals = (signals: AbortSignal[]): AbortSignal => AbortSignal.any(signals);\n\n// SSRF guard machinery (guardedLookup, the pinned undici dispatcher,\n// guardedFetch, assertNotPrivate) lives in _fetch-guard.ts so the `search`\n// entry can use guardedFetch without bundling the whole fetch tool.\n// Re-exported here to keep this module's historical public API intact.\nexport { guardedFetch, guardedLookup } from './_fetch-guard.js';\n\nexport const fetchTool: Tool<FetchInput, FetchOutput> = {\n  name: 'fetch',\n  category: 'Network',\n  description:\n    'Fetch a URL and return its content. HTML pages are automatically converted to clean markdown. ' +\n    'This tool has strong SSRF protections (private IPs, localhost, and cloud metadata endpoints are blocked by default).',\n  usageHint:\n    'Use this when you need external information (documentation, API responses, web pages, etc.).\\n\\n' +\n    'Security notes:\\n' +\n    '- Only HTTPS is allowed by default.\\n' +\n    '- Internal/private networks are blocked unless explicitly enabled via environment variable.\\n' +\n    '- Redirects are followed but re-validated at each hop.\\n' +\n    '- Output is capped (128KB by default) to avoid flooding context.\\n' +\n    'Prefer this over raw `bash curl` or `bash wget`.',\n  permission: 'auto',\n  mutating: false,\n  capabilities: ['net.outbound'],\n  icon: 'web',\n  // Trust rules for fetch match on the literal URL \u2014 declare it explicitly\n  // so a user can trust `https://api.example.com/*` without accidentally\n  // matching that pattern on any other tool that happens to have a `url`\n  // input field.\n  subjectKey: 'url',\n  timeoutMs: TIMEOUT_MS,\n  maxOutputBytes: MAX_BYTES,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      url: {\n        type: 'string',\n        description: 'The target URL (must use https://).',\n      },\n      format: {\n        type: 'string',\n        enum: ['markdown', 'text', 'raw'],\n        description: 'Output format. \"markdown\" is recommended for HTML pages.',\n      },\n    },\n    required: ['url'],\n  },\n  async execute(input, ctx, opts) {\n    let final: FetchOutput | undefined;\n    const executeStream = fetchTool.executeStream;\n    if (!executeStream) {\n      throw new ToolError({\n        message: 'fetchTool: stream execution unavailable',\n        code: 'TOOL_EXECUTION_FAILED',\n        toolName: 'fetch',\n      });\n    }\n    for await (const ev of executeStream(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) {\n      throw new ToolError({\n        message: 'fetch: stream ended without final event',\n        code: 'TOOL_EXECUTION_FAILED',\n        toolName: 'fetch',\n      });\n    }\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<FetchOutput>> {\n    if (!input?.url) {\n      throw new ToolValidationError({\n        message: 'fetch: url is required',\n        field: 'url',\n      });\n    }\n    const u = new URL(input.url);\n    if (u.protocol !== 'https:' && u.protocol !== 'http:') {\n      throw new ToolValidationError({\n        message: `fetch: unsupported protocol \"${u.protocol}\"`,\n        field: 'url',\n      });\n    }\n    if (u.protocol === 'http:' && !ALLOW_PRIVATE) {\n      throw new ToolValidationError({\n        message: 'fetch: http:// blocked (HTTPS required by default)',\n        field: 'url',\n      });\n    }\n    await assertNotPrivate(u.hostname);\n\n    yield { type: 'log', text: `GET ${input.url}` };\n\n    const ctrl = new AbortController();\n    const timer = setTimeout(() => ctrl.abort(new ToolError({\n      message: 'fetch timeout',\n      code: 'TOOL_TIMEOUT',\n      toolName: 'fetch',\n    })), TIMEOUT_MS);\n    const combined = combineSignals([opts.signal, ctrl.signal]);\n\n    try {\n      let res: Response;\n      try {\n        res = await guardedFetch(input.url, 5, combined);\n      } catch (err) {\n        // A user-initiated cancel propagates unchanged. Our own timeout and any\n        // transport failure get a diagnostic message: undici throws an opaque\n        // `TypeError: fetch failed` whose real reason (ENOTFOUND, ECONNREFUSED,\n        // UND_ERR_CONNECT_TIMEOUT, a TLS/cert error, \u2026) lives only on `.cause`.\n        // Surfacing just `.message` left users with \"fetch failed\" and no clue\n        // why HTTPS broke (see #100), so unwrap the cause chain here.\n        if (opts.signal.aborted) throw err;\n        throw describeFetchError(err, input.url, ctrl.signal.aborted);\n      }\n\n      const ct = res.headers.get('content-type') ?? 'application/octet-stream';\n      if (/^image\\/|^audio\\/|^video\\/|application\\/octet-stream/.test(ct)) {\n        throw new FetchError({\n          message: `fetch: refusing to read binary content-type \"${ct}\"`,\n          status: res.status,\n          context: { url: res.url, contentType: ct },\n        });\n      }\n\n      yield {\n        type: 'log',\n        text: `HTTP ${res.status} ${ct}`,\n        data: { status: res.status, contentType: ct },\n      };\n\n      const reader = res.body?.getReader();\n      let received = 0;\n      const chunks: Uint8Array[] = [];\n      let pendingBytes = 0;\n      const FLUSH_AT = 4 * 1024;\n      if (reader) {\n        for (;;) {\n          const { value, done } = await reader.read();\n          if (done) break;\n          if (!value) continue;\n          received += value.byteLength;\n          pendingBytes += value.byteLength;\n          chunks.push(value);\n          if (pendingBytes >= FLUSH_AT) {\n            // Snapshot recent bytes for the partial_output. Keep it cheap \u2014\n            // don't try to decode UTF-8 boundaries; the TUI just needs a\n            // \"things are happening\" signal.\n            const recent = Buffer.from(value).toString('utf-8');\n            yield {\n              type: 'partial_output',\n              text: recent,\n              data: { received },\n            };\n            pendingBytes = 0;\n          }\n          if (received > MAX_BYTES) break;\n        }\n      }\n      const text = Buffer.concat(chunks.map((c) => Buffer.from(c))).toString('utf8');\n\n      const format = input.format ?? (ct.includes('text/html') ? 'markdown' : 'text');\n      let content: string;\n      if (format === 'raw') content = text;\n      else if (format === 'markdown' && ct.includes('text/html')) content = TD.turndown(text);\n      else if (ct.includes('application/json')) content = prettyJson(text);\n      else content = text;\n\n      yield {\n        type: 'final',\n        output: {\n          content: truncateMiddle(content, MAX_BYTES),\n          status: res.status,\n          content_type: ct,\n          url: res.url,\n        },\n      };\n      // P2 #5: record the network request as a structured side effect.\n      ctx.recordSideEffect?.({\n        toolUseId: `fetch-${Date.now()}`,\n        toolName: 'fetch',\n        ts: new Date().toISOString(),\n        input: { url: input.url, format: input.format },\n        outcome: `HTTP ${res.status} (${ct})`,\n        risk: 'network',\n      });\n    } finally {\n      clearTimeout(timer);\n    }\n  },\n};\n\n/**\n * Turn an opaque undici `TypeError: fetch failed` into an actionable message by\n * walking its `.cause` chain. undici buries the transport reason (a DNS/socket\n * errno or a TLS handshake failure) one or more `.cause` hops down, so the bare\n * `.message` is always just \"fetch failed\". We join each distinct\n * `code: message` link so the user sees, e.g.,\n * `fetch: GET https://x failed \u2014 UND_ERR_CONNECT_TIMEOUT: Connect Timeout Error`.\n */\nfunction describeFetchError(err: unknown, url: string, timedOut: boolean): FetchError | ToolError {\n  if (timedOut) {\n    return new ToolError({\n      message: `fetch: GET ${url} timed out after ${TIMEOUT_MS}ms`,\n      code: 'TOOL_TIMEOUT',\n      toolName: 'fetch',\n      context: { url, timedOut: true, timeoutMs: TIMEOUT_MS },\n      cause: err,\n    });\n  }\n  const parts: string[] = [];\n  const seen = new Set<unknown>();\n  let cur: unknown = err;\n  while (cur instanceof Error && !seen.has(cur)) {\n    seen.add(cur);\n    const code = (cur as NodeJS.ErrnoException).code;\n    const label = code ? `${code}: ${cur.message}` : cur.message;\n    // Skip undici's uninformative top-level \"fetch failed\" wrapper, but keep it\n    // as a fallback if it turns out to be the only thing we have.\n    if (label && label !== 'fetch failed' && !parts.includes(label)) parts.push(label);\n    cur = (cur as { cause?: unknown }).cause;\n  }\n  const detail = parts.length > 0 ? parts.join(' \u2192 ') : 'fetch failed';\n  return new FetchError({\n    message: `fetch: GET ${url} failed \u2014 ${detail}`,\n    status: 502,\n    context: { url, timedOut: false, transportErrors: parts },\n    // Preserve the original undici / DNS / TLS chain so callers can inspect\n    // it via `err.cause` and structured `instanceof` checks. The flattened\n    // text version stays in the message for human readability.\n    cause: err,\n  });\n}\n\nfunction prettyJson(s: string): string {\n  try {\n    return JSON.stringify(JSON.parse(s), null, 2);\n  } catch {\n    return s;\n  }\n}\n", "import * as dns from 'node:dns/promises';\nimport * as net from 'node:net';\nimport {\n  FetchError,\n  ToolValidationError,\n  isPrivateIPv4,\n  isPrivateIPv6,\n} from '@wrongstack/core';\nimport { Agent, fetch as undiciFetch } from 'undici';\n\n/**\n * SSRF guard machinery shared by the `fetch` and `search` tools. Split out of\n * fetch.ts so entries that only need `guardedFetch` (search) don't bundle the\n * whole fetch tool. Everything here is security-critical: the pinned undici\n * dispatcher performs the SINGLE DNS resolution the TCP connection uses, so\n * there is no DNS-rebinding TOCTOU between validation and connect.\n */\n\nconst nativeGlobalFetch = globalThis.fetch;\n\nexport const ALLOW_PRIVATE = process.env['WRONGSTACK_FETCH_ALLOW_PRIVATE'] === '1';\n/* v8 ignore next 8 -- module-load-time opt-in warning; gated on an env var not set during tests. */\nif (ALLOW_PRIVATE && !process.env['CI']) {\n  console.warn(\n    '[WrongStack] WARNING: WRONGSTACK_FETCH_ALLOW_PRIVATE=1 is active \u2014\\n' +\n    '  fetch tool can now access private IPs (10.x, 192.168.x, 169.254.x),\\n' +\n    '  cloud metadata endpoints, and plaintext HTTP. Use only on isolated networks.',\n  );\n}\n\ntype LookupCallback = (\n  err: NodeJS.ErrnoException | null,\n  address?: string | Array<{ address: string | undefined; family: number }>,\n  family?: number | undefined,\n) => void;\n\n/**\n * DNS lookup used by the undici dispatcher below. It performs the SINGLE name\n * resolution that the TCP connection actually uses, and rejects if any\n * resolved address is private/loopback/link-local. Because the connection\n * reuses exactly this result, there is no DNS-rebinding TOCTOU window between\n * the security check and the connect \u2014 closing the gap the old code documented\n * (validate with one dns.lookup, then let fetch re-resolve independently).\n * TLS still validates the certificate against the hostname (SNI is set by\n * undici from the URL), so pinning the IP does not weaken cert checking.\n */\nexport function guardedLookup(\n  hostname: string,\n  options: { all?: boolean | undefined; family?: number | undefined },\n  callback: LookupCallback,\n): void {\n  dns\n    .lookup(hostname, { all: true })\n    .then((records) => {\n      const family = options?.family;\n      const byFamily =\n        family === 4 || family === 6 ? records.filter((r) => r.family === family) : records;\n      const list = byFamily.length > 0 ? byFamily : records;\n      if (!ALLOW_PRIVATE) {\n        for (const r of list) {\n          const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n          if (bad) {\n            callback(\n              Object.assign(new Error(`fetch: resolved to private address ${r.address}`), {\n                code: 'EAI_FAIL',\n              }),\n            );\n            return;\n          }\n        }\n      }\n      if (options?.all) {\n        callback(\n          null,\n          list.map((r) => ({ address: r.address, family: r.family })),\n        );\n        return;\n      }\n      const first = list.at(0);\n      if (!first) {\n        callback(\n          Object.assign(new Error(`fetch: no address for ${hostname}`), { code: 'ENOTFOUND' }),\n        );\n        return;\n      }\n      callback(null, first.address, first.family);\n    })\n    .catch((err) => callback(err as NodeJS.ErrnoException));\n}\n\n// Reused across requests; guardedLookup re-validates on every new connection,\n// so connection pooling is safe. Literal-IP targets bypass lookup entirely and\n// are caught by assertNotPrivate's pre-check instead.\n// Destroyed on process exit so long-running processes (eternal autonomy,\n// MCP server mode) don't let the connection pool grow unboundedly.\nlet pinnedAgent: Agent | undefined;\nfunction getPinnedDispatcher(): Agent {\n  if (!pinnedAgent) {\n    pinnedAgent = new Agent({ connect: { lookup: guardedLookup as never } });\n  }\n  return pinnedAgent;\n}\n\nfunction dispatcherFetch(): typeof globalThis.fetch {\n  // Node's built-in global fetch is backed by its own bundled undici version.\n  // Passing an Agent from the workspace's `undici` package to that different\n  // dispatcher ABI fails on recent Node with:\n  //   UND_ERR_INVALID_ARG: invalid onRequestStart method\n  // Use the matching package fetch+Agent pair in real runs, but keep honoring\n  // test/user fetch shims that replace globalThis.fetch after this module loads.\n  return globalThis.fetch === nativeGlobalFetch\n    ? (undiciFetch as unknown as typeof globalThis.fetch)\n    : globalThis.fetch;\n}\n// Clean up the global dispatcher on exit \u2014 undici Agents maintain connection\n// pools and DNS caches that should be torn down in long-running processes.\n// Guard against duplicate registration (module reload/HMR would otherwise\n// accumulate listeners).\nlet _beforeExitRegistered = false;\nif (!_beforeExitRegistered) {\n  _beforeExitRegistered = true;\n  /* v8 ignore next 4 -- process 'beforeExit' cleanup; not deterministically triggerable in-test. */\n  process.on('beforeExit', () => {\n    pinnedAgent?.destroy();\n    pinnedAgent = undefined;\n  });\n}\n\n/**\n * SSRF-guarded fetch with manual, per-hop-revalidated redirects, exported so\n * other builtin tools (e.g. `search`) get the same protections instead of a\n * weaker `redirect: 'follow'`. Every hop is re-checked against private/loopback\n * ranges and the connection is pinned to the validated IP via the undici\n * dispatcher (no DNS-rebinding TOCTOU). `headers` defaults to the plain `fetch`\n * tool's; callers may override (e.g. a browser User-Agent for search engines).\n */\nexport async function guardedFetch(\n  url: string,\n  maxRedirects: number,\n  signal: AbortSignal,\n  headers: Record<string, string> = {\n    'user-agent': 'WrongStack/1.0 (+https://wrongstack.com)',\n    accept: 'text/html,application/json;q=0.9,text/plain;q=0.8,*/*;q=0.1',\n  },\n): Promise<Response> {\n  let redirectCount = 0;\n  let currentUrl = url;\n  for (;;) {\n    // Re-validate every hop. A public host can 302 to 169.254.169.254 (cloud metadata),\n    // or DNS can rebind between hops; checking only the initial URL is insufficient.\n    const parsed = new URL(currentUrl);\n    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {\n      throw new ToolValidationError({\n        message: `fetch: redirect to unsupported protocol \"${parsed.protocol}\"`,\n        field: 'url',\n      });\n    }\n    if (parsed.protocol === 'http:' && !ALLOW_PRIVATE) {\n      throw new ToolValidationError({\n        message: 'fetch: redirect to http:// blocked (HTTPS required by default)',\n        field: 'url',\n      });\n    }\n    await assertNotPrivate(parsed.hostname);\n\n    // The dispatcher pins the connection to the IP guardedLookup validated \u2014\n    // no independent re-resolution, so DNS rebinding can't swap in a private\n    // address between check and connect. `dispatcher` is a runtime option of\n    // Node's undici-backed global fetch but isn't in lib.dom's RequestInit, and\n    // our undici Agent's type differs from the @types/node copy \u2014 hence the\n    // cast. (Verified: global fetch invokes the Agent's custom lookup.)\n    const init = {\n      redirect: 'manual' as const,\n      signal,\n      headers,\n      dispatcher: getPinnedDispatcher(),\n    };\n    const res = await dispatcherFetch()(currentUrl, init as never as RequestInit);\n    if (res.status < 300 || res.status > 399) {\n      return res;\n    }\n    redirectCount++;\n    if (redirectCount > maxRedirects) {\n      throw new FetchError({\n        message: `fetch: exceeded ${maxRedirects} redirects`,\n        status: res.status,\n        context: { url: currentUrl, maxRedirects, redirectCount },\n      });\n    }\n    const location = res.headers.get('location');\n    if (!location) {\n      throw new FetchError({\n        message: 'fetch: redirect status with no location header',\n        status: res.status,\n        context: { url: currentUrl, redirectCount },\n      });\n    }\n    currentUrl = new URL(location, currentUrl).toString();\n  }\n}\n\nexport async function assertNotPrivate(hostname: string): Promise<void> {\n  if (ALLOW_PRIVATE) return;\n\n  const host =\n    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n\n  if (host === 'localhost' || host.endsWith('.localhost')) {\n    throw new ToolValidationError({\n      message: 'fetch: blocked localhost target',\n      field: 'url',\n    });\n  }\n\n  const ipVersion = net.isIP(host);\n  if (ipVersion === 4) {\n    if (isPrivateIPv4(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else if (ipVersion === 6) {\n    if (isPrivateIPv6(host)) {\n      throw new ToolValidationError({\n        message: `fetch: blocked private/loopback address \"${host}\"`,\n        field: 'url',\n      });\n    }\n  } else {\n    // Hostname \u2014 pre-flight check: resolve and reject if any record is private,\n    // so we fail fast with a clear error before opening a socket. The\n    // authoritative anti-rebinding control is guardedLookup on the pinned\n    // undici dispatcher (see getPinnedDispatcher): it performs the single\n    // resolution the connection actually uses, so there is no TOCTOU between\n    // this check and the connect. Each redirect target is re-checked too.\n    try {\n      // Use dns.lookup for async hostname resolution (matches guardedLookup above).\n      const records = await dns.lookup(host, { all: true });\n      for (const r of records) {\n        const bad = r.family === 4 ? isPrivateIPv4(r.address) : isPrivateIPv6(r.address);\n        if (bad) {\n          throw new ToolValidationError({\n            message: `fetch: resolved to private address ${r.address}`,\n            field: 'url',\n          });\n        }\n      }\n    } catch (err) {\n      if (err instanceof Error && err.message.startsWith('fetch:')) throw err;\n      // DNS failure \u2014 let fetch handle it\n    }\n  }\n}\n", "import { createHash } from 'node:crypto';\nimport * as fsp from 'node:fs/promises';\nimport * as path from 'node:path';\nimport * as Core from '@wrongstack/core';\nimport type { Context } from '@wrongstack/core';\n\n/**\n * sha-256 hex of a UTF-8 string. Used by the file tools to record a content\n * hash alongside the mtime in `ctx.recordRead` \u2014 the hash is the authoritative\n * staleness arbiter for `edit` (mtime has a 2 s tolerance window on Windows).\n */\nexport function sha256hex(content: string): string {\n  return createHash('sha256').update(content, 'utf8').digest('hex');\n}\n/** Detected package manager for a project directory. */\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm';\n\n/**\n * Detect the project's package manager by inspecting lockfiles in `cwd`.\n * Order: pnpm \u2192 yarn \u2192 npm (default). Missing or unreadable directories fall\n * back to `npm` rather than throwing, so a `safeResolve`-checked cwd that\n * happens to be empty never aborts the tool.\n */\nexport async function detectPackageManager(cwd: string): Promise<PackageManager> {\n  const { stat } = await import('node:fs/promises');\n  try {\n    await stat(`${cwd}/pnpm-lock.yaml`);\n    return 'pnpm';\n  } catch {\n    /* not pnpm */\n  }\n  try {\n    await stat(`${cwd}/yarn.lock`);\n    return 'yarn';\n  } catch {\n    /* not yarn */\n  }\n  return 'npm';\n}\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.workingDir ?? ctx.cwd, input);\n}\n\n/**\n * Roots every file tool may always reach, even in restricted mode: the\n * project root and the user-global `~/.wrongstack` directory (config, memory,\n * sessions, skills). `~/.wrongstack` honors the `WRONGSTACK_HOME` override.\n */\nfunction allowedRoots(ctx: Context): string[] {\n  return [path.resolve(ctx.projectRoot), path.resolve(Core.wstackGlobalRoot())];\n}\n\n/** True if `target` is `root` itself or nested inside any of `roots`. */\nfunction isInsideAny(target: string, roots: string[]): boolean {\n  return roots.some((root) => {\n    const rel = path.relative(root, target);\n    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n  });\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const target = path.resolve(absPath);\n  // Unrestricted filesystem access: skip the project-root containment check.\n  if (ctx.allowOutsideProjectRoot) return target;\n  if (isInsideAny(target, allowedRoots(ctx))) return target;\n  throw new Error(`Path \"${absPath}\" is outside project root \"${path.resolve(ctx.projectRoot)}\"`);\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\n/**\n * Defense against in-root\u2192out-of-root symlink escape (CWE-59). `safeResolve`\n * only does a syntactic `../` check, so a symlink that lives *inside* the\n * project root but points outside still passes it. This resolves the path\n * through `fs.realpath` and re-verifies containment against the realpath of\n * the project root (comparing like-for-like, since the root itself may be a\n * symlink \u2014 macOS `/var`\u2192`/private/var`, Windows 8.3 short names). For a path\n * that does not exist yet (e.g. a `write` to a new file) the nearest existing\n * ancestor directory is checked instead. Throws if the real target escapes.\n *\n * Mirrors the per-file guard already used in `replace.ts`/`grep.ts`; applied\n * to single-file `read`/`edit`/`write` it throws (rather than skips) because\n * the caller named exactly one file.\n */\nexport async function assertRealInsideRoot(absPath: string, ctx: Context): Promise<void> {\n  // Unrestricted filesystem access: no symlink-escape check to perform.\n  if (ctx.allowOutsideProjectRoot) return;\n  // Compare like-for-like against the realpath of each always-allowed root\n  // (project root + ~/.wrongstack), since a root may itself be a symlink.\n  const realRoots = await Promise.all(\n    allowedRoots(ctx).map((r) => fsp.realpath(r).catch(() => path.resolve(r))),\n  );\n  let probe = absPath;\n  for (;;) {\n    let real: string;\n    try {\n      real = await fsp.realpath(probe);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === 'ENOENT') {\n        const parent = path.dirname(probe);\n        if (parent === probe) return; // reached fs root without escaping\n        probe = parent;\n        continue;\n      }\n      throw err;\n    }\n    if (isInsideAny(real, realRoots)) return;\n    throw new Error(\n      `Path \"${absPath}\" resolves through a symlink outside project root \"${realRoots[0]}\"`,\n    );\n  }\n}\n\n/** `safeResolve` + symlink realpath containment check. Async. */\nexport async function safeResolveReal(input: string, ctx: Context): Promise<string> {\n  const abs = safeResolve(input, ctx);\n  await assertRealInsideRoot(abs, ctx);\n  return abs;\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n\u2026[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]\u2026\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n\n// \u2500\u2500\u2500 Command-output normalization (token-saving) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Raw process output is full of tokens the model gains nothing from: ANSI\n// escapes, carriage-return progress spam, runs of identical warning lines, and\n// huge tails of build noise. These helpers strip that noise before the output\n// reaches the LLM. They are scoped to COMMAND tools (bash/git/exec and the\n// _spawn-stream consumers) \u2014 never applied to structured/code outputs.\n\n/** Unified byte cap for all command tool output fed to the model. */\nexport const COMMAND_OUTPUT_MAX_BYTES = 32_768;\n\n/** Runs of >= this many identical consecutive lines are collapsed. */\nconst REPEAT_RUN_THRESHOLD = 3;\n\n/**\n * Collapse carriage-return overwrites the way a terminal would: `\\r\\n` becomes\n * `\\n`, and a bare `\\r` (progress redraw) keeps only the text after the LAST\n * `\\r` on its physical line. Without this, a single progress bar that redraws\n * 200 times explodes into 200 lines.\n */\nexport function collapseCarriageReturns(text: string): string {\n  const lf = text.replace(/\\r\\n/g, '\\n');\n  if (!lf.includes('\\r')) return lf;\n  return lf\n    .split('\\n')\n    .map((line) => (line.includes('\\r') ? line.slice(line.lastIndexOf('\\r') + 1) : line))\n    .join('\\n');\n}\n\n/**\n * Collapse a run of `minRun`+ identical consecutive lines into the line once\n * plus a marker. Consecutive-only \u2014 it never reorders or dedups non-adjacent\n * lines, so diffs/source stay intact.\n */\nexport function collapseConsecutiveDuplicates(text: string, minRun = REPEAT_RUN_THRESHOLD): string {\n  const lines = text.split('\\n');\n  const out: string[] = [];\n  let i = 0;\n  while (i < lines.length) {\n    let j = i + 1;\n    while (j < lines.length && lines[j] === lines[i]) j++;\n    const run = j - i;\n    if (run >= minRun) {\n      out.push(lines[i]!, `\u2026 \u27E8repeated ${run}\u00D7\u27E9`);\n    } else {\n      for (let k = i; k < j; k++) out.push(lines[k]!);\n    }\n    i = j;\n  }\n  return out.join('\\n');\n}\n\n/** Largest prefix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeHeadBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(0, mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(0, lo);\n}\n\n/** Largest suffix of `s` whose UTF-8 byte length is <= `maxBytes`. */\nfunction takeTailBytes(s: string, maxBytes: number): string {\n  if (maxBytes <= 0) return '';\n  /* v8 ignore next -- only caller (truncateHeadTail) passes a budget smaller than s; defensive. */\n  if (Buffer.byteLength(s, 'utf8') <= maxBytes) return s;\n  let lo = 0;\n  let hi = s.length;\n  while (lo < hi) {\n    const mid = Math.ceil((lo + hi) / 2);\n    if (Buffer.byteLength(s.slice(s.length - mid), 'utf8') <= maxBytes) lo = mid;\n    else hi = mid - 1;\n  }\n  return s.slice(s.length - lo);\n}\n\n/**\n * Truncate to `maxBytes` keeping BOTH ends \u2014 the head (what ran / early context)\n * and the tail (errors and summaries usually land last), biased ~45/55 toward\n * the tail. The result never exceeds `maxBytes`.\n */\nexport function truncateHeadTail(s: string, maxBytes: number): string {\n  const total = Buffer.byteLength(s, 'utf8');\n  if (total <= maxBytes) return s;\n  // Reserve a fixed allowance for the marker so the final string can't exceed\n  // the cap even though the dropped-byte count's digit width varies.\n  const MARKER_RESERVE = 64;\n  const avail = Math.max(0, maxBytes - MARKER_RESERVE);\n  const headBudget = Math.floor(avail * 0.45);\n  const head = takeHeadBytes(s, headBudget);\n  const tail = takeTailBytes(s, avail - Buffer.byteLength(head, 'utf8'));\n  const kept = Buffer.byteLength(head, 'utf8') + Buffer.byteLength(tail, 'utf8');\n  return `${head}\\n\u2026[truncated ${total - kept} bytes]\u2026\\n${tail}`;\n}\n\n/**\n * Full token-saving pipeline for command tool output: strip ANSI \u2192 collapse\n * carriage-return progress \u2192 trim trailing whitespace \u2192 collapse identical\n * consecutive lines \u2192 squeeze blank-line runs \u2192 head+tail truncate to the cap.\n */\nexport function normalizeCommandOutput(\n  raw: string,\n  opts: { maxBytes?: number | undefined } = {},\n): string {\n  if (!raw) return raw;\n  let text = Core.stripAnsi(raw);\n  text = collapseCarriageReturns(text);\n  text = text.replace(/[ \\t]+$/gm, ''); // trailing whitespace per line\n  text = collapseConsecutiveDuplicates(text);\n  text = text.replace(/\\n{3,}/g, '\\n\\n'); // >=2 blank lines \u2192 1\n  return truncateHeadTail(text, opts.maxBytes ?? COMMAND_OUTPUT_MAX_BYTES);\n}\n"],
+  "mappings": ";AACA,SAAS,cAAAA,aAAY,WAAW,uBAAAC,4BAA2B;AAC3D,OAAO,qBAAqB;;;ACF5B,YAAY,SAAS;AACrB,YAAY,SAAS;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,OAAO,SAAS,mBAAmB;AAU5C,IAAM,oBAAoB,WAAW;AAE9B,IAAM,gBAAgB,QAAQ,IAAI,gCAAgC,MAAM;AAE/E,IAAI,iBAAiB,CAAC,QAAQ,IAAI,IAAI,GAAG;AACvC,UAAQ;AAAA,IACN;AAAA,EAGF;AACF;AAkBO,SAAS,cACd,UACA,SACA,UACM;AACN,EACG,WAAO,UAAU,EAAE,KAAK,KAAK,CAAC,EAC9B,KAAK,CAAC,YAAY;AACjB,UAAM,SAAS,SAAS;AACxB,UAAM,WACJ,WAAW,KAAK,WAAW,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,IAAI;AAC9E,UAAM,OAAO,SAAS,SAAS,IAAI,WAAW;AAC9C,QAAI,CAAC,eAAe;AAClB,iBAAW,KAAK,MAAM;AACpB,cAAM,MAAM,EAAE,WAAW,IAAI,cAAc,EAAE,OAAO,IAAI,cAAc,EAAE,OAAO;AAC/E,YAAI,KAAK;AACP;AAAA,YACE,OAAO,OAAO,IAAI,MAAM,sCAAsC,EAAE,OAAO,EAAE,GAAG;AAAA,cAC1E,MAAM;AAAA,YACR,CAAC;AAAA,UACH;AACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,KAAK;AAChB;AAAA,QACE;AAAA,QACA,KAAK,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,QAAQ,EAAE,OAAO,EAAE;AAAA,MAC5D;AACA;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,GAAG,CAAC;AACvB,QAAI,CAAC,OAAO;AACV;AAAA,QACE,OAAO,OAAO,IAAI,MAAM,yBAAyB,QAAQ,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAAA,MACrF;AACA;AAAA,IACF;AACA,aAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,EAC5C,CAAC,EACA,MAAM,CAAC,QAAQ,SAAS,GAA4B,CAAC;AAC1D;AAOA,IAAI;AACJ,SAAS,sBAA6B;AACpC,MAAI,CAAC,aAAa;AAChB,kBAAc,IAAI,MAAM,EAAE,SAAS,EAAE,QAAQ,cAAuB,EAAE,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,kBAA2C;AAOlD,SAAO,WAAW,UAAU,oBACvB,cACD,WAAW;AACjB;AAKA,IAAI,wBAAwB;AAC5B,IAAI,CAAC,uBAAuB;AAC1B,0BAAwB;AAExB,UAAQ,GAAG,cAAc,MAAM;AAC7B,iBAAa,QAAQ;AACrB,kBAAc;AAAA,EAChB,CAAC;AACH;AAUA,eAAsB,aACpB,KACA,cACA,QACA,UAAkC;AAAA,EAChC,cAAc;AAAA,EACd,QAAQ;AACV,GACmB;AACnB,MAAI,gBAAgB;AACpB,MAAI,aAAa;AACjB,aAAS;AAGP,UAAM,SAAS,IAAI,IAAI,UAAU;AACjC,QAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS;AAC/D,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS,4CAA4C,OAAO,QAAQ;AAAA,QACpE,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,QAAI,OAAO,aAAa,WAAW,CAAC,eAAe;AACjD,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,iBAAiB,OAAO,QAAQ;AAQtC,UAAM,OAAO;AAAA,MACX,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,oBAAoB;AAAA,IAClC;AACA,UAAM,MAAM,MAAM,gBAAgB,EAAE,YAAY,IAA4B;AAC5E,QAAI,IAAI,SAAS,OAAO,IAAI,SAAS,KAAK;AACxC,aAAO;AAAA,IACT;AACA;AACA,QAAI,gBAAgB,cAAc;AAChC,YAAM,IAAI,WAAW;AAAA,QACnB,SAAS,mBAAmB,YAAY;AAAA,QACxC,QAAQ,IAAI;AAAA,QACZ,SAAS,EAAE,KAAK,YAAY,cAAc,cAAc;AAAA,MAC1D,CAAC;AAAA,IACH;AACA,UAAM,WAAW,IAAI,QAAQ,IAAI,UAAU;AAC3C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,WAAW;AAAA,QACnB,SAAS;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,SAAS,EAAE,KAAK,YAAY,cAAc;AAAA,MAC5C,CAAC;AAAA,IACH;AACA,iBAAa,IAAI,IAAI,UAAU,UAAU,EAAE,SAAS;AAAA,EACtD;AACF;AAEA,eAAsB,iBAAiB,UAAiC;AACtE,MAAI,cAAe;AAEnB,QAAM,OACJ,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAE/E,MAAI,SAAS,eAAe,KAAK,SAAS,YAAY,GAAG;AACvD,UAAM,IAAI,oBAAoB;AAAA,MAC5B,SAAS;AAAA,MACT,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,YAAgB,SAAK,IAAI;AAC/B,MAAI,cAAc,GAAG;AACnB,QAAI,cAAc,IAAI,GAAG;AACvB,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS,4CAA4C,IAAI;AAAA,QACzD,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,WAAW,cAAc,GAAG;AAC1B,QAAI,cAAc,IAAI,GAAG;AACvB,YAAM,IAAI,oBAAoB;AAAA,QAC5B,SAAS,4CAA4C,IAAI;AAAA,QACzD,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AAOL,QAAI;AAEF,YAAM,UAAU,MAAU,WAAO,MAAM,EAAE,KAAK,KAAK,CAAC;AACpD,iBAAW,KAAK,SAAS;AACvB,cAAM,MAAM,EAAE,WAAW,IAAI,cAAc,EAAE,OAAO,IAAI,cAAc,EAAE,OAAO;AAC/E,YAAI,KAAK;AACP,gBAAM,IAAI,oBAAoB;AAAA,YAC5B,SAAS,sCAAsC,EAAE,OAAO;AAAA,YACxD,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,QAAQ,EAAG,OAAM;AAAA,IAEtE;AAAA,EACF;AACF;;;AC1PA,YAAY,UAAU;AAwHf,SAAS,eAAe,GAAW,KAAqB;AAC7D,MAAI,OAAO,WAAW,GAAG,MAAM,KAAK,IAAK,QAAO;AAChD,QAAM,OAAO,KAAK,MAAM,MAAM,CAAC;AAC/B,SACE,EAAE,MAAM,GAAG,IAAI,IACf;AAAA,mBAAiB,OAAO,WAAW,GAAG,MAAM,IAAI,GAAG;AAAA,IACnD,EAAE,MAAM,CAAC,IAAI;AAEjB;;;AFxHA,IAAM,KAAK,IAAI,gBAAgB;AAAA;AAAA,EAE7B,cAAc;AAAA;AAAA,EAEd,gBAAgB;AAClB,CAAC;AAMD,GAAG,QAAQ,0BAA0B;AAAA,EACnC,QAAQ,CAAC,UAAU,SAAS,UAAU;AAAA,EACtC,aAAa,MAAM;AACrB,CAAC;AAcD,IAAM,YAAY;AAClB,IAAM,aAAa;AAGnB,IAAM,iBAAiB,CAAC,YAAwC,YAAY,IAAI,OAAO;AAQhF,IAAM,YAA2C;AAAA,EACtD,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aACE;AAAA,EAEF,WACE;AAAA,EAOF,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,cAAc,CAAC,cAAc;AAAA,EAC7B,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,EAKN,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,gBAAgB;AAAA,EAChB,aAAa;AAAA,IACX,MAAM;AAAA,IACN,YAAY;AAAA,MACV,KAAK;AAAA,QACH,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM,CAAC,YAAY,QAAQ,KAAK;AAAA,QAChC,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,UAAU,CAAC,KAAK;AAAA,EAClB;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK,MAAM;AAC9B,QAAI;AACJ,UAAM,gBAAgB,UAAU;AAChC,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,UAAU;AAAA,QAClB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AACA,qBAAiB,MAAM,cAAc,OAAO,KAAK,IAAI,GAAG;AACtD,UAAI,GAAG,SAAS,QAAS,SAAQ,GAAG;AAAA,IACtC;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,UAAU;AAAA,QAClB,SAAS;AAAA,QACT,MAAM;AAAA,QACN,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EACA,OAAO,cAAc,OAAO,KAAK,MAAoD;AACnF,QAAI,CAAC,OAAO,KAAK;AACf,YAAM,IAAIC,qBAAoB;AAAA,QAC5B,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,IAAI,IAAI,IAAI,MAAM,GAAG;AAC3B,QAAI,EAAE,aAAa,YAAY,EAAE,aAAa,SAAS;AACrD,YAAM,IAAIA,qBAAoB;AAAA,QAC5B,SAAS,gCAAgC,EAAE,QAAQ;AAAA,QACnD,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,QAAI,EAAE,aAAa,WAAW,CAAC,eAAe;AAC5C,YAAM,IAAIA,qBAAoB;AAAA,QAC5B,SAAS;AAAA,QACT,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,iBAAiB,EAAE,QAAQ;AAEjC,UAAM,EAAE,MAAM,OAAO,MAAM,OAAO,MAAM,GAAG,GAAG;AAE9C,UAAM,OAAO,IAAI,gBAAgB;AACjC,UAAM,QAAQ,WAAW,MAAM,KAAK,MAAM,IAAI,UAAU;AAAA,MACtD,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC,CAAC,GAAG,UAAU;AACf,UAAM,WAAW,eAAe,CAAC,KAAK,QAAQ,KAAK,MAAM,CAAC;AAE1D,QAAI;AACF,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,aAAa,MAAM,KAAK,GAAG,QAAQ;AAAA,MACjD,SAAS,KAAK;AAOZ,YAAI,KAAK,OAAO,QAAS,OAAM;AAC/B,cAAM,mBAAmB,KAAK,MAAM,KAAK,KAAK,OAAO,OAAO;AAAA,MAC9D;AAEA,YAAM,KAAK,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC9C,UAAI,uDAAuD,KAAK,EAAE,GAAG;AACnE,cAAM,IAAIC,YAAW;AAAA,UACnB,SAAS,gDAAgD,EAAE;AAAA,UAC3D,QAAQ,IAAI;AAAA,UACZ,SAAS,EAAE,KAAK,IAAI,KAAK,aAAa,GAAG;AAAA,QAC3C,CAAC;AAAA,MACH;AAEA,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,MAAM,QAAQ,IAAI,MAAM,IAAI,EAAE;AAAA,QAC9B,MAAM,EAAE,QAAQ,IAAI,QAAQ,aAAa,GAAG;AAAA,MAC9C;AAEA,YAAM,SAAS,IAAI,MAAM,UAAU;AACnC,UAAI,WAAW;AACf,YAAM,SAAuB,CAAC;AAC9B,UAAI,eAAe;AACnB,YAAM,WAAW,IAAI;AACrB,UAAI,QAAQ;AACV,mBAAS;AACP,gBAAM,EAAE,OAAO,KAAK,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,KAAM;AACV,cAAI,CAAC,MAAO;AACZ,sBAAY,MAAM;AAClB,0BAAgB,MAAM;AACtB,iBAAO,KAAK,KAAK;AACjB,cAAI,gBAAgB,UAAU;AAI5B,kBAAM,SAAS,OAAO,KAAK,KAAK,EAAE,SAAS,OAAO;AAClD,kBAAM;AAAA,cACJ,MAAM;AAAA,cACN,MAAM;AAAA,cACN,MAAM,EAAE,SAAS;AAAA,YACnB;AACA,2BAAe;AAAA,UACjB;AACA,cAAI,WAAW,UAAW;AAAA,QAC5B;AAAA,MACF;AACA,YAAM,OAAO,OAAO,OAAO,OAAO,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,MAAM;AAE7E,YAAM,SAAS,MAAM,WAAW,GAAG,SAAS,WAAW,IAAI,aAAa;AACxE,UAAI;AACJ,UAAI,WAAW,MAAO,WAAU;AAAA,eACvB,WAAW,cAAc,GAAG,SAAS,WAAW,EAAG,WAAU,GAAG,SAAS,IAAI;AAAA,eAC7E,GAAG,SAAS,kBAAkB,EAAG,WAAU,WAAW,IAAI;AAAA,UAC9D,WAAU;AAEf,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,QAAQ;AAAA,UACN,SAAS,eAAe,SAAS,SAAS;AAAA,UAC1C,QAAQ,IAAI;AAAA,UACZ,cAAc;AAAA,UACd,KAAK,IAAI;AAAA,QACX;AAAA,MACF;AAEA,UAAI,mBAAmB;AAAA,QACrB,WAAW,SAAS,KAAK,IAAI,CAAC;AAAA,QAC9B,UAAU;AAAA,QACV,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC3B,OAAO,EAAE,KAAK,MAAM,KAAK,QAAQ,MAAM,OAAO;AAAA,QAC9C,SAAS,QAAQ,IAAI,MAAM,KAAK,EAAE;AAAA,QAClC,MAAM;AAAA,MACR,CAAC;AAAA,IACH,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAUA,SAAS,mBAAmB,KAAc,KAAa,UAA2C;AAChG,MAAI,UAAU;AACZ,WAAO,IAAI,UAAU;AAAA,MACnB,SAAS,cAAc,GAAG,oBAAoB,UAAU;AAAA,MACxD,MAAM;AAAA,MACN,UAAU;AAAA,MACV,SAAS,EAAE,KAAK,UAAU,MAAM,WAAW,WAAW;AAAA,MACtD,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,oBAAI,IAAa;AAC9B,MAAI,MAAe;AACnB,SAAO,eAAe,SAAS,CAAC,KAAK,IAAI,GAAG,GAAG;AAC7C,SAAK,IAAI,GAAG;AACZ,UAAM,OAAQ,IAA8B;AAC5C,UAAM,QAAQ,OAAO,GAAG,IAAI,KAAK,IAAI,OAAO,KAAK,IAAI;AAGrD,QAAI,SAAS,UAAU,kBAAkB,CAAC,MAAM,SAAS,KAAK,EAAG,OAAM,KAAK,KAAK;AACjF,UAAO,IAA4B;AAAA,EACrC;AACA,QAAM,SAAS,MAAM,SAAS,IAAI,MAAM,KAAK,UAAK,IAAI;AACtD,SAAO,IAAIA,YAAW;AAAA,IACpB,SAAS,cAAc,GAAG,kBAAa,MAAM;AAAA,IAC7C,QAAQ;AAAA,IACR,SAAS,EAAE,KAAK,UAAU,OAAO,iBAAiB,MAAM;AAAA;AAAA;AAAA;AAAA,IAIxD,OAAO;AAAA,EACT,CAAC;AACH;AAEA,SAAS,WAAW,GAAmB;AACrC,MAAI;AACF,WAAO,KAAK,UAAU,KAAK,MAAM,CAAC,GAAG,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": ["FetchError", "ToolValidationError", "ToolValidationError", "FetchError"]
+}

package/dist/format.d.ts

@@ -1,5 +1,4 @@
-import { Tool } from '@wrongstack/core';
-
+import type { Tool } from '@wrongstack/core';
 interface FormatInput {
     files?: string | string[] | undefined;
     fixer?: 'biome' | 'prettier' | 'auto' | undefined;
@@ -13,6 +12,6 @@ interface FormatOutput {
     output: string;
     truncated: boolean;
 }
-declare const formatTool: Tool<FormatInput, FormatOutput>;
-
-export { formatTool };
+export declare const formatTool: Tool<FormatInput, FormatOutput>;
+export {};
+//# sourceMappingURL=format.d.ts.map

package/dist/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../src/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AAK9D,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CA0HtD,CAAC"}