agen-vektor 0.3.11 → 0.3.13

package/dist/providers/anthropic.js

@@ -96,6 +96,19 @@ class AnthropicProvider {
             body.tools = toToolDefs(params.tools);
         if (params.temperature !== undefined)
             body.temperature = params.temperature;
+        // Extended thinking (Anthropic): ask for a reasoning budget so thinking
+        // models (Claude 3.7+/4 family) stream thinking_delta blocks — rendered
+        // as the • Thinking card. Harmless for non-thinking models? No — the API
+        // REJECTS thinking for models without extended-thinking support, so it
+        // is opt-in via VECTOR_ANTHROPIC_THINKING=1 (or a budget explicitly set
+        // here), keeping every other model working unchanged.
+        const wantThinking = process.env.VECTOR_ANTHROPIC_THINKING === '1';
+        const budget = Number(process.env.VECTOR_ANTHROPIC_THINKING_BUDGET || 0);
+        if (wantThinking || budget > 0) {
+            body.thinking = { type: 'enabled', budget_tokens: budget > 0 ? budget : 8_000 };
+            // Anthropic requires temperature unset (or 1) when thinking is on.
+            delete body.temperature;
+        }
         return body;
     }
     async post(body, signal) {
@@ -133,10 +146,13 @@ class AnthropicProvider {
         const data = await this.post(this.buildBody(params, false), params.signal);
         const content = data.content || [];
         let text = '';
+        let thinking = '';
         const toolCalls = [];
         for (const block of content) {
             if (block.type === 'text')
                 text += String(block.text || '');
+            if (block.type === 'thinking')
+                thinking += String(block.thinking || '');
             if (block.type === 'tool_use') {
                 toolCalls.push({
                     id: String(block.id),
@@ -148,6 +164,7 @@ class AnthropicProvider {
         const usage = data.usage;
         return {
             content: text,
+            reasoning: thinking || undefined,
             toolCalls,
             stopReason: String(data.stop_reason || 'end_turn'),
             usage: usage
@@ -181,6 +198,7 @@ class AnthropicProvider {
             const decoder = new TextDecoder();
             let buffer = '';
             let content = '';
+            let thinking = '';
             const toolCalls = [];
             let currentTool = null;
             for (;;) {
@@ -210,12 +228,21 @@ class AnthropicProvider {
                             arguments: '',
                         };
                     }
+                    else if (evtName === 'content_block_start' && contentBlock?.type === 'thinking') {
+                        // Thinking block starts — its deltas carry type thinking_delta.
+                    }
                     else if (evtName === 'content_block_delta') {
                         const delta = json.delta;
                         if (delta?.type === 'text_delta' && typeof delta.text === 'string') {
                             content += delta.text;
                             yield { type: 'delta', delta: delta.text };
                         }
+                        else if (delta?.type === 'thinking_delta' && typeof delta.thinking === 'string') {
+                            // Extended thinking (Claude 3.7+/4): surface as reasoning so
+                            // the • Thinking card renders for these models too.
+                            thinking += delta.thinking;
+                            yield { type: 'delta', reasoning: delta.thinking };
+                        }
                         else if (delta?.type === 'input_json_delta' &&
                             currentTool &&
                             typeof delta.partial_json === 'string') {
@@ -252,7 +279,13 @@ class AnthropicProvider {
                 toolCalls.push(currentTool);
             yield {
                 type: 'done',
-                result: { content, toolCalls, stopReason: 'end_turn', model: params.model },
+                result: {
+                    content,
+                    reasoning: thinking || undefined,
+                    toolCalls,
+                    stopReason: 'end_turn',
+                    model: params.model,
+                },
             };
         }
         finally {

package/dist/providers/gemini.js

@@ -71,10 +71,17 @@ function extractResult(data) {
     const content0 = candidates[0]?.content || {};
     const parts = content0.parts || [];
     let content = '';
+    let reasoning = '';
     const toolCalls = [];
     for (const part of parts) {
-        if (typeof part.text === 'string')
-            content += part.text;
+        // Thinking models (Gemini 2.5/3 family) mark reasoning parts with
+        // thought: true — surface them as reasoning, never as answer text.
+        if (typeof part.text === 'string') {
+            if (part.thought === true)
+                reasoning += part.text;
+            else
+                content += part.text;
+        }
         if (part.functionCall) {
             const raw = part.functionCall;
             const fcs = Array.isArray(raw) ? raw : [raw];
@@ -87,7 +94,7 @@ function extractResult(data) {
             }
         }
     }
-    return { content, toolCalls };
+    return { content, reasoning, toolCalls };
 }
 class GeminiProvider {
     id = 'gemini';
@@ -151,9 +158,10 @@ class GeminiProvider {
             throw new provider_1.ProviderError(`Gemini HTTP ${res.status}: ${text.slice(0, 300)}`, res.status, res.status >= 500);
         }
         const data = JSON.parse(text);
-        const { content, toolCalls } = extractResult(data);
+        const { content, reasoning, toolCalls } = extractResult(data);
         return {
             content,
+            reasoning: reasoning || undefined,
             toolCalls,
             stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
             model: params.model,
@@ -169,6 +177,7 @@ class GeminiProvider {
         const decoder = new TextDecoder();
         let buffer = '';
         let content = '';
+        let reasoning = '';
         const toolCalls = [];
         for (;;) {
             const { done, value } = await reader.read();
@@ -187,7 +196,11 @@ class GeminiProvider {
                 const json = safeJson(payload);
                 if (!json)
                     continue;
-                const { content: deltaText, toolCalls: newCalls } = extractResult(json);
+                const { content: deltaText, reasoning: deltaThought, toolCalls: newCalls } = extractResult(json);
+                if (deltaThought) {
+                    reasoning += deltaThought;
+                    yield { type: 'delta', reasoning: deltaThought };
+                }
                 if (deltaText) {
                     content += deltaText;
                     yield { type: 'delta', delta: deltaText };
@@ -202,6 +215,7 @@ class GeminiProvider {
             type: 'done',
             result: {
                 content,
+                reasoning: reasoning || undefined,
                 toolCalls,
                 stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
                 model: params.model,

package/dist/providers/ollama.js

@@ -94,8 +94,12 @@ class OllamaProvider {
                 arguments: typeof fn.arguments === 'string' ? fn.arguments : JSON.stringify(fn.arguments ?? {}),
             };
         });
+        // Thinking models (Ollama ≥0.9: DeepSeek-R1, Qwen3 …) return the
+        // reasoning in message.thinking when the model supports it.
+        const thinking = typeof message.thinking === 'string' ? message.thinking : '';
         return {
             content: String(message.content || ''),
+            reasoning: thinking || undefined,
             toolCalls,
             stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
             model: String(data.model || params.model),
@@ -118,6 +122,7 @@ class OllamaProvider {
         const decoder = new TextDecoder();
         let buffer = '';
         let content = '';
+        let reasoning = '';
         const toolCalls = [];
         for (;;) {
             const { done, value } = await reader.read();
@@ -138,6 +143,7 @@ class OllamaProvider {
                         type: 'done',
                         result: {
                             content,
+                            reasoning: reasoning || undefined,
                             toolCalls,
                             stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
                             model: params.model,
@@ -146,6 +152,12 @@ class OllamaProvider {
                     return;
                 }
                 const message = (json.message || {});
+                // Thinking models stream reasoning in message.thinking (Ollama ≥0.9,
+                // DeepSeek-R1/Qwen3) — surface it so the • Thinking card renders.
+                if (typeof message.thinking === 'string' && message.thinking) {
+                    reasoning += message.thinking;
+                    yield { type: 'delta', reasoning: message.thinking };
+                }
                 if (typeof message.content === 'string' && message.content) {
                     content += message.content;
                     yield { type: 'delta', delta: message.content };
@@ -165,7 +177,7 @@ class OllamaProvider {
         }
         yield {
             type: 'done',
-            result: { content, toolCalls, stopReason: 'stop', model: params.model },
+            result: { content, reasoning: reasoning || undefined, toolCalls, stopReason: 'stop', model: params.model },
         };
     }
     async models() {

package/dist/providers/openai-compat.js

@@ -2,12 +2,69 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenAICompatProvider = void 0;
 exports.stripThinkTags = stripThinkTags;
+exports.createThinkTagStreamSplitter = createThinkTagStreamSplitter;
 /**
  * OpenAI-compatible provider — used by OpenAI, OpenRouter and Custom.
  * Speaks /v1/chat/completions (and /models) with tool calling + streaming.
  */
 const provider_1 = require("./provider");
 const credentials_1 = require("../config/credentials");
+/**
+ * Stream delta-collector for tool calls.
+ *
+ * WHY A MAP, NOT AN ARRAY INDEXED BY `part.index`:
+ * OpenAI spec says tool_calls deltas carry a 0-based `index` per tool call,
+ * and arguments arrive in fragments. Most gateways comply. But some gateways
+ * proxy Anthropic models and leak the UPSTREAM content-block positions as
+ * `index` (thinking=0, text=1, tool_use=2, ...) — with one tool call the
+ * chunks arrive with `index:2` (observed live on api.justwoker.icu, 2026-09-04).
+ * Indexing a plain array by that value produces a SPARSE array
+ * ([<hole>, <hole>, call]) which silently breaks `for..of` iteration in the
+ * agent loop (holes are skipped) and corrupts the follow-up request history.
+ * Collect per index in a Map, emit a DENSE array in arrival order, deduped
+ * by id (Anthropic ids are unique per call; OpenAI reuses one id across
+ * argument fragments).
+ */
+class StreamToolCallCollector {
+    byIndex = new Map();
+    /** Feed one delta.tool_calls part; returns the latest complete call, if any. */
+    add(part) {
+        const idx = Number(part.index || 0);
+        const fn = (part.function || {});
+        const existing = this.byIndex.get(idx);
+        if (!existing) {
+            this.byIndex.set(idx, {
+                id: String(part.id || `call_${idx}_${Math.random().toString(36).slice(2)}`),
+                name: String(fn.name || ''),
+                arguments: String(fn.arguments || ''),
+            });
+        }
+        else {
+            if (part.id)
+                existing.id = String(part.id);
+            if (fn.name)
+                existing.name = String(fn.name);
+            if (fn.arguments)
+                existing.arguments += String(fn.arguments);
+        }
+        const finished = this.finished();
+        return finished.length > 0 ? finished[finished.length - 1] : null;
+    }
+    /** All complete calls so far, in arrival order, DENSE (no holes/nulls). */
+    finished() {
+        const seen = new Set();
+        const out = [];
+        for (const call of this.byIndex.values()) {
+            if (!call.name)
+                continue; // incomplete: no function name yet
+            if (seen.has(call.id))
+                continue; // fragment of an already-collected call
+            seen.add(call.id);
+            out.push({ id: call.id, name: call.name, arguments: call.arguments || '{}' });
+        }
+        return out;
+    }
+}
 function toOpenAIMessages(messages) {
     const out = [];
     for (const m of messages) {
@@ -59,6 +116,81 @@ function extractReasoning(msg) {
 function stripThinkTags(text) {
     return text.replace(/<think>[\s\S]*?<\/think>/g, '').replace(/^\s*<think>[\s\S]*$/, '').trim();
 }
+/**
+ * Incremental `<think>…</think>` tag splitter for STREAMING: OpenAI-compat
+ * gateways often proxy reasoning models (DeepSeek-R1, QwQ, Qwen3 …) that
+ * inline their thinking into `delta.content` instead of a separate
+ * `reasoning_content` field. Non-streaming already strips via
+ * stripThinkTags — the streaming path needs the same treatment or the
+ * • Thinking card never appears for those models (raw <think> text used to
+ * leak into the visible answer too).
+ */
+function createThinkTagStreamSplitter() {
+    let inside = false;
+    let tail = ''; // partial tag spanning chunk boundaries
+    const flushTail = (emit) => {
+        // Find the highest safe split point: a '<' that MIGHT begin a tag when
+        // more text arrives is kept buffered; everything before it is emitted.
+        const lt = tail.indexOf('<');
+        if (lt === -1) {
+            emit(tail, inside);
+            tail = '';
+            return;
+        }
+        if (lt > 0) {
+            emit(tail.slice(0, lt), inside);
+            tail = tail.slice(lt);
+        }
+        // tail now starts with '<' — wait for more data.
+    };
+    return {
+        /** Feed one content delta; returns {content, reasoning} pieces. */
+        push(chunk) {
+            const content = [];
+            const reasoning = [];
+            const emit = (s, isReasoning) => {
+                if (s)
+                    (isReasoning ? reasoning : content).push(s);
+            };
+            tail += chunk;
+            for (;;) {
+                if (!inside) {
+                    const open = tail.indexOf('<think>');
+                    if (open !== -1) {
+                        emit(tail.slice(0, open), false);
+                        tail = tail.slice(open + 7);
+                        inside = true;
+                        continue;
+                    }
+                    flushTail(emit);
+                    break;
+                }
+                else {
+                    const close = tail.indexOf('</think>');
+                    if (close !== -1) {
+                        emit(tail.slice(0, close), true);
+                        tail = tail.slice(close + 8);
+                        inside = false;
+                        continue;
+                    }
+                    flushTail(emit);
+                    break;
+                }
+            }
+            return { content, reasoning };
+        },
+        /** End of stream: flush any buffered remainder (an unterminated
+         * <think> block counts as reasoning). */
+        finish() {
+            const content = [];
+            const reasoning = [];
+            if (tail)
+                (inside ? reasoning : content).push(tail);
+            tail = '';
+            return { content, reasoning };
+        },
+    };
+}
 function parseToolCalls(raw) {
     const calls = [];
     if (!Array.isArray(raw))
@@ -232,7 +364,14 @@ class OpenAICompatProvider {
             let buffer = '';
             let content = '';
             let reasoning = '';
-            const toolCalls = [];
+            // Dense collector — see StreamToolCallCollector: some gateways send
+            // non-0-based tool_calls indices (Anthropic block positions), which
+            // used to produce a sparse toolCalls array the agent loop skipped.
+            const toolCollector = new StreamToolCallCollector();
+            // Reasoning models behind OpenAI-compat gateways may inline thinking
+            // into delta.content as <think>…</think> (DeepSeek-R1/QwQ/Qwen3).
+            // Split it out so the • Thinking card works on EVERY model.
+            const thinkSplit = createThinkTagStreamSplitter();
             for (;;) {
                 const { done, value } = await reader.read();
                 if (done)
@@ -246,13 +385,20 @@ class OpenAICompatProvider {
                         continue;
                     const payload = trimmed.slice(5).trim();
                     if (payload === '[DONE]') {
+                        // Flush any <think> splitter remainder before finishing.
+                        const tail = thinkSplit.finish();
+                        for (const r of tail.reasoning)
+                            reasoning += r;
+                        for (const c of tail.content)
+                            content += c;
+                        const calls = toolCollector.finished();
                         yield {
                             type: 'done',
                             result: {
                                 content,
                                 reasoning: reasoning || undefined,
-                                toolCalls,
-                                stopReason: toolCalls.length > 0 ? 'tool_calls' : 'stop',
+                                toolCalls: calls,
+                                stopReason: calls.length > 0 ? 'tool_calls' : 'stop',
                                 model: params.model,
                             },
                         };
@@ -276,48 +422,42 @@ class OpenAICompatProvider {
                         yield { type: 'delta', reasoning: rc };
                     }
                     if (typeof delta.content === 'string' && delta.content) {
-                        content += delta.content;
-                        yield { type: 'delta', delta: delta.content };
+                        const pieces = thinkSplit.push(delta.content);
+                        for (const r of pieces.reasoning) {
+                            reasoning += r;
+                            yield { type: 'delta', reasoning: r };
+                        }
+                        for (const c of pieces.content) {
+                            content += c;
+                            yield { type: 'delta', delta: c };
+                        }
                     }
                     const tc = delta.tool_calls;
                     if (Array.isArray(tc)) {
+                        let latest = null;
                         for (const part of tc) {
-                            const idx = Number(part.index || 0);
-                            const fn = (part.function || {});
-                            const existing = toolCalls[idx];
-                            if (!existing) {
-                                toolCalls[idx] = {
-                                    id: String(part.id || `call_${idx}_${Math.random().toString(36).slice(2)}`),
-                                    name: String(fn.name || ''),
-                                    arguments: String(fn.arguments || ''),
-                                };
-                            }
-                            else {
-                                if (part.id)
-                                    existing.id = String(part.id);
-                                if (fn.name)
-                                    existing.name = String(fn.name);
-                                if (fn.arguments)
-                                    existing.arguments += String(fn.arguments);
-                            }
+                            const call = toolCollector.add(part);
+                            if (call)
+                                latest = call;
                         }
-                        const finished = toolCalls.filter((t) => t.name).map((t) => ({
-                            ...t,
-                            arguments: t.arguments || '{}',
-                        }));
-                        if (finished.length > 0) {
-                            yield { type: 'tool_call', toolCall: finished[finished.length - 1] };
+                        if (latest) {
+                            yield { type: 'tool_call', toolCall: latest };
                         }
                     }
                 }
             }
-            // Stream ended without [DONE]
+            // Stream ended without [DONE] — flush the <think> splitter tail.
+            const tail = thinkSplit.finish();
+            for (const r of tail.reasoning)
+                reasoning += r;
+            for (const c of tail.content)
+                content += c;
             yield {
                 type: 'done',
                 result: {
                     content,
                     reasoning: reasoning || undefined,
-                    toolCalls: toolCalls.filter((t) => t.name),
+                    toolCalls: toolCollector.finished(),
                     stopReason: 'stop',
                     model: params.model,
                 },

package/dist/security/command-policy.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifyCommand = classifyCommand;
+const sensitive_files_1 = require("./sensitive-files");
 const BLOCKED_PATTERNS = [
     /(^|[;&|]\s*)\s*rm\s+(-[a-z]*[rf][a-z]*\s+)*\/\s*($|[^a-zA-Z])/,
     /(^|[;&|]\s*)\s*rm\s+(-[a-z]*[rf][a-z]*\s+)*~(\/|$)/,
@@ -59,6 +60,12 @@ const ASK_PATTERNS = [
 /** Commands that are safe to run without asking. */
 const SAFE_PATTERNS = [
     /(^|[;&|]\s*)\s*(ls|cat|head|tail|less|more|wc|grep|find|locate|which|type|file|stat|du|df|tree)\s/,
+    // Local dev-server plumbing (compound verification commands like
+    // `cd web && python3 -m http.server 8917 & sleep 1; curl localhost; kill %1`)
+    /(^|[;&|]\s*)\s*cd\s+\S+/,
+    /(^|[;&|]\s*)\s*sleep\s+\d/,
+    /(^|[;&|]\s*)\s*python3?\s+-m\s+http\.server\b/,
+    /(^|[;&|]\s*)\s*kill\s+%\d+/,
     /(^|[;&|]\s*)\s*echo\s/,
     /(^|[;&|]\s*)\s*node\s+(-v|--version)/,
     /(^|[;&|]\s*)\s*npm\s+(-v|--version|ls|list)\s*/,
@@ -78,11 +85,63 @@ function classifyCommand(command) {
             return { level: 'blocked', reason: `command matches blocked pattern: ${re.source}` };
         }
     }
+    // Sensitive-file escalation (Freebuff fileFilter spirit): a shell command
+    // that references a secret (.env, private keys, credentials.json, …) must
+    // be PROMPTED even in yolo mode — `cat .env` / `cp id_rsa /tmp` / piping
+    // secrets into the network is the classic exfiltration path around the
+    // fs-tool guard. Only `cat *.example` template references stay exempt so
+    // agents can still learn the config surface.
+    const tokens = command.split(/\s+/).map((t) => t.replace(/['"`]/g, ''));
+    const touchesSensitive = tokens.some((raw) => {
+        // curl-style --data=@file and @file forms: keep only the path part.
+        const t = raw.split('=').pop() ?? raw;
+        const base = (t.startsWith('@') ? t.slice(1) : t).split('/').pop() ?? '';
+        if (!base)
+            return false;
+        if (base.endsWith('.example') || base.endsWith('.sample'))
+            return false;
+        return (0, sensitive_files_1.isSensitiveFile)(base) || (0, sensitive_files_1.isSensitiveEnvFilePath)(base);
+    });
+    if (touchesSensitive) {
+        return { level: 'dangerous', reason: 'command references a sensitive file (secrets must be prompted even in yolo)' };
+    }
     for (const re of DANGEROUS_PATTERNS) {
         if (re.test(command)) {
             return { level: 'dangerous', reason: `command matches dangerous pattern: ${re.source}` };
         }
     }
+    // Loopback exemption (Freebuff-style smooth local dev): curl/wget whose
+    // EVERY network target is localhost/127.0.0.1 cannot exfiltrate anything
+    // off the machine, so testing a local dev server should not prompt. Runs
+    // AFTER the dangerous/sensitive checks so `curl | bash` and
+    // `curl --data @secrets http://localhost` still escalate. Any remote host
+    // in the same command (or an extra URL) falls through to the ASK pattern.
+    if (/(^|[;&|]\s*)\s*(curl|wget)\s/.test(command)) {
+        const targets = [];
+        for (const seg of command.split(/[;&|]+/)) {
+            const m = seg.trim().match(/^(curl|wget)\s+(.*)$/);
+            if (!m)
+                continue;
+            for (const raw of m[2].split(/\s+/)) {
+                const t = raw.replace(/['"`]/g, '').split('=').pop() ?? '';
+                if (t.startsWith('-'))
+                    continue;
+                // URL/host-shaped token: scheme://host, host:port, or host.tld
+                if (/^https?:\/\//i.test(t) || (/^[\w.\-\[%]+(:\d+)?(\/|$|\?)/.test(t) && /[.:\[%]|localhost/.test(t))) {
+                    targets.push(t);
+                }
+            }
+        }
+        const isLoopback = (tok) => {
+            let s = tok.replace(/^https?:\/\//i, '').toLowerCase();
+            s = (s.split('/')[0] ?? '').split(':')[0] ?? '';
+            return (s === 'localhost' || s === '127.0.0.1' || s === '::1' ||
+                s === '[::1]' || s === '[::]' || s.endsWith('.localhost'));
+        };
+        if (targets.length > 0 && targets.every(isLoopback)) {
+            return { level: 'safe', reason: 'curl/wget targets loopback only (local dev server test, no remote transfer)' };
+        }
+    }
     for (const re of ASK_PATTERNS) {
         if (re.test(command)) {
             return { level: 'ask', reason: `command matches ask pattern: ${re.source}` };

package/dist/security/sensitive-files.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveEnvFilePath = isSensitiveEnvFilePath;
+exports.isSensitiveFile = isSensitiveFile;
+exports.sensitiveFileGuard = sensitiveFileGuard;
+/**
+ * Sensitive-file guard — port of Freebuff's fileFilter
+ * (CodebuffAI/freebuff cli/src/utils/create-run-config.ts: isSensitiveFile +
+ * SENSITIVE_EXTENSIONS/BASENAMES/PATTERNS, plus @codebuff/common's
+ * isSensitiveEnvFilePath).
+ *
+ * Freebuff applies this as a hard `fileFilter` on every SDK file operation:
+ * reads AND writes of secrets (.env, private keys, credentials, kubeconfig…)
+ * are blocked outright regardless of yolo/ask mode — the model never sees
+ * their contents. This module gives vector-agent the same layer: the fs tools
+ * call `sensitiveFileGuard()` before touching a path, and shell commands that
+ * reference a sensitive basename are escalated to 'dangerous' by the command
+ * policy (prompted even in yolo mode).
+ *
+ * Escape hatch for power users: VECTOR_ALLOW_SENSITIVE=1 disables the guard
+ * (documented in HANDOFF.md — off by default, like Freebuff).
+ */
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/** File extensions that are always secrets (Freebuff SENSITIVE_EXTENSIONS). */
+const SENSITIVE_EXTENSIONS = new Set([
+    '.pem', '.key', '.p12', '.pfx', '.jks', '.keystore', '.crt', '.cer',
+]);
+/** Exact basenames that are always secrets (Freebuff SENSITIVE_BASENAMES,
+ *  plus credentials.json — vector-agent's own key store). */
+const SENSITIVE_BASENAMES = new Set([
+    '.htpasswd', '.netrc', 'credentials', 'credentials.json',
+    '.npmrc', '.yarnrc', '.yarnrc.yml', 'auth.json', '.pypirc',
+    'terraform.tfvars', '.terraformrc', '.vector-credentials',
+]);
+/** SSH / private-key prefixes (Freebuff SENSITIVE_PATTERNS.prefix; the .pub
+ *  counterpart is explicitly allowed). */
+const SENSITIVE_KEY_PREFIXES = ['id_rsa', 'id_ed25519', 'id_dsa', 'id_ecdsa'];
+/** Substring hits (Freebuff SENSITIVE_PATTERNS.substring). */
+const SENSITIVE_SUBSTRINGS = ['kubeconfig', '.tfstate'];
+/** Suffixes that mark a TEMPLATE — safe to read so agents can learn which
+ *  env vars exist (.env.example etc). Not in Freebuff, but our listing tools
+ *  already surface them as visible files. */
+const TEMPLATE_SUFFIXES = ['.example', '.sample', '.template'];
+/** Port of @codebuff/common isSensitiveEnvFilePath: basename is `.env` or a
+ *  `.env.<anything>` variant (.env.local, .env.production, …), or `.envrc`. */
+function isSensitiveEnvFilePath(filePath) {
+    const base = path.basename(filePath).toLowerCase();
+    return base === '.env' || base === '.envrc' || base.startsWith('.env.');
+}
+/** Check if a file is sensitive and must be blocked from tool access. */
+function isSensitiveFile(filePath) {
+    const base = path.basename(filePath);
+    const lower = base.toLowerCase();
+    const ext = path.extname(filePath).toLowerCase();
+    if (TEMPLATE_SUFFIXES.some((s) => lower.endsWith(s)))
+        return false;
+    if (isSensitiveEnvFilePath(filePath))
+        return true;
+    if (SENSITIVE_EXTENSIONS.has(ext))
+        return true;
+    if (SENSITIVE_BASENAMES.has(lower))
+        return true;
+    if (SENSITIVE_KEY_PREFIXES.some((p) => lower.startsWith(p)) &&
+        !lower.endsWith('.pub')) {
+        return true;
+    }
+    if (SENSITIVE_SUBSTRINGS.some((s) => lower.includes(s)))
+        return true;
+    return false;
+}
+/**
+ * Guard for fs tools: returns an ERROR output string when the path (lexical
+ * or, when it exists on disk, its real path — catches symlink + `../`
+ * escapes) is sensitive, null when the operation may proceed.
+ * VECTOR_ALLOW_SENSITIVE=1 disables the guard entirely.
+ */
+function sensitiveFileGuard(absPath, displayPath) {
+    if (process.env.VECTOR_ALLOW_SENSITIVE === '1')
+        return null;
+    const check = (p) => {
+        try {
+            return isSensitiveFile(p) || isSensitiveFile(fs.realpathSync(p));
+        }
+        catch {
+            return isSensitiveFile(p);
+        }
+    };
+    if (check(absPath)) {
+        return `ERROR: blocked "${displayPath}" — sensitive file (secrets are never read/written; Freebuff fileFilter port). Use VECTOR_ALLOW_SENSITIVE=1 to override.`;
+    }
+    return null;
+}