agentic-flow 2.0.1-alpha.9 → 2.0.2-alpha

package/agentic-flow/dist/sdk/query-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-control.js","sourceRoot":"","sources":["../../src/sdk/query-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA+B5C,0BAA0B;AAC1B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEpD,kCAAkC;AAClC,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,MAAM,EAAE,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACnD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAe;QACxB,EAAE;QACF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS;QACnD,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;QACV,eAAe;KAChB,CAAC;IAEF,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE7B,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEtE,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,eAAe;IAClB,KAAK,CAAa;IAClB,oBAAoB,GAAmC,EAAE,CAAC;IAC1D,yBAAyB,GAAkC,EAAE,CAAC;IAEtE,YAAY,KAAiB;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAkB;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1G,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QAEzB,mBAAmB;QACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,IAA0B;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAEjC,mBAAmB;QACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAElD,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,MAAkD;QACzD,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;QAChC,IAAI,MAAM,EAAE,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAClE,IAAI,MAAM,EAAE,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAEzD,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;YAC7B,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACjB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS;YAC3C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAe;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;QAC5B,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAiC;QAC7C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAgC;QACjD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO;YACL,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO;YACjD,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM;YACjD,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM;SACzD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,OAAO;YACL,0BAA0B;YAC1B,4BAA4B;YAC5B,2BAA2B;SAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,2DAA2D;QAC3D,OAAO;YACL,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;YAC9C,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QAKf,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS;YAC7C,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;gBAC7B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;aACzB;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,QAAQ,CAAC;gBAC3D,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC;aAC/D;SACF,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;IAC3B,CAAC;IACD,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAM3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;QAC1D,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9D,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Query Control - Runtime control of active queries\n *\n * Provides methods to control running queries:\n * - Change model mid-execution\n * - Switch permission modes\n * - Interrupt/abort queries\n * - Get query status and introspection\n */\n\nimport { logger } from \"../utils/logger.js\";\n\n/**\n * Query state for tracking active queries\n */\nexport interface QueryState {\n  id: string;\n  startTime: number;\n  model: string;\n  permissionMode: string;\n  status: 'running' | 'paused' | 'completed' | 'aborted' | 'error';\n  turnCount: number;\n  tokenCount: number;\n  costUsd: number;\n  abortController: AbortController;\n}\n\n/**\n * Model options for runtime switching\n */\nexport type ModelOption =\n  | 'claude-opus-4-5-20251101'\n  | 'claude-sonnet-4-5-20250929'\n  | 'claude-haiku-3-5-20241022'\n  | 'inherit';\n\n/**\n * Permission mode options\n */\nexport type PermissionModeOption = 'default' | 'acceptEdits' | 'bypassPermissions' | 'plan';\n\n// Active queries registry\nconst activeQueries = new Map<string, QueryState>();\n\n// Query counter for ID generation\nlet queryCounter = 0;\n\n/**\n * Create a new query controller\n */\nexport function createQueryController(options: {\n  model: string;\n  permissionMode?: string;\n}): QueryController {\n  const id = `query-${Date.now()}-${++queryCounter}`;\n  const abortController = new AbortController();\n\n  const state: QueryState = {\n    id,\n    startTime: Date.now(),\n    model: options.model,\n    permissionMode: options.permissionMode || 'default',\n    status: 'running',\n    turnCount: 0,\n    tokenCount: 0,\n    costUsd: 0,\n    abortController\n  };\n\n  activeQueries.set(id, state);\n\n  logger.info('Query controller created', { id, model: options.model });\n\n  return new QueryController(state);\n}\n\n/**\n * Query Controller - controls a single active query\n */\nexport class QueryController {\n  private state: QueryState;\n  private modelChangeCallbacks: Array<(model: string) => void> = [];\n  private permissionChangeCallbacks: Array<(mode: string) => void> = [];\n\n  constructor(state: QueryState) {\n    this.state = state;\n  }\n\n  /**\n   * Get query ID\n   */\n  get id(): string {\n    return this.state.id;\n  }\n\n  /**\n   * Get abort signal for SDK integration\n   */\n  get signal(): AbortSignal {\n    return this.state.abortController.signal;\n  }\n\n  /**\n   * Get current status\n   */\n  getStatus(): QueryState {\n    return { ...this.state };\n  }\n\n  /**\n   * Change model at runtime\n   * Note: SDK must support this via setModel() method\n   */\n  async setModel(model: ModelOption): Promise<boolean> {\n    if (this.state.status !== 'running') {\n      logger.warn('Cannot change model on non-running query', { id: this.state.id, status: this.state.status });\n      return false;\n    }\n\n    const oldModel = this.state.model;\n    this.state.model = model;\n\n    // Notify callbacks\n    for (const callback of this.modelChangeCallbacks) {\n      try {\n        callback(model);\n      } catch (error) {\n        logger.warn('Model change callback error', { error: (error as Error).message });\n      }\n    }\n\n    logger.info('Model changed', { id: this.state.id, oldModel, newModel: model });\n    return true;\n  }\n\n  /**\n   * Change permission mode at runtime\n   */\n  async setPermissionMode(mode: PermissionModeOption): Promise<boolean> {\n    if (this.state.status !== 'running') {\n      logger.warn('Cannot change permissions on non-running query', { id: this.state.id });\n      return false;\n    }\n\n    const oldMode = this.state.permissionMode;\n    this.state.permissionMode = mode;\n\n    // Notify callbacks\n    for (const callback of this.permissionChangeCallbacks) {\n      try {\n        callback(mode);\n      } catch (error) {\n        logger.warn('Permission change callback error', { error: (error as Error).message });\n      }\n    }\n\n    logger.info('Permission mode changed', { id: this.state.id, oldMode, newMode: mode });\n    return true;\n  }\n\n  /**\n   * Set max thinking tokens\n   */\n  async setMaxThinkingTokens(tokens: number): Promise<boolean> {\n    if (this.state.status !== 'running') return false;\n\n    logger.info('Max thinking tokens set', { id: this.state.id, tokens });\n    return true;\n  }\n\n  /**\n   * Interrupt the query (for streaming mode)\n   */\n  interrupt(): void {\n    if (this.state.status === 'running') {\n      this.state.status = 'paused';\n      logger.info('Query interrupted', { id: this.state.id });\n    }\n  }\n\n  /**\n   * Resume interrupted query\n   */\n  resume(): void {\n    if (this.state.status === 'paused') {\n      this.state.status = 'running';\n      logger.info('Query resumed', { id: this.state.id });\n    }\n  }\n\n  /**\n   * Abort the query completely\n   */\n  abort(): void {\n    if (this.state.status === 'running' || this.state.status === 'paused') {\n      this.state.abortController.abort();\n      this.state.status = 'aborted';\n      logger.info('Query aborted', { id: this.state.id });\n    }\n  }\n\n  /**\n   * Mark query as completed\n   */\n  complete(result?: { tokenCount?: number; costUsd?: number }): void {\n    this.state.status = 'completed';\n    if (result?.tokenCount) this.state.tokenCount = result.tokenCount;\n    if (result?.costUsd) this.state.costUsd = result.costUsd;\n\n    activeQueries.delete(this.state.id);\n    logger.info('Query completed', {\n      id: this.state.id,\n      duration: Date.now() - this.state.startTime,\n      turns: this.state.turnCount\n    });\n  }\n\n  /**\n   * Mark query as errored\n   */\n  error(message: string): void {\n    this.state.status = 'error';\n    activeQueries.delete(this.state.id);\n    logger.error('Query error', { id: this.state.id, message });\n  }\n\n  /**\n   * Increment turn count\n   */\n  incrementTurn(): void {\n    this.state.turnCount++;\n  }\n\n  /**\n   * Add model change callback\n   */\n  onModelChange(callback: (model: string) => void): void {\n    this.modelChangeCallbacks.push(callback);\n  }\n\n  /**\n   * Add permission change callback\n   */\n  onPermissionChange(callback: (mode: string) => void): void {\n    this.permissionChangeCallbacks.push(callback);\n  }\n\n  /**\n   * Get supported commands (introspection)\n   */\n  async supportedCommands(): Promise<string[]> {\n    return [\n      '/help', '/clear', '/compact', '/config', '/cost',\n      '/doctor', '/login', '/logout', '/memory', '/mcp',\n      '/model', '/permissions', '/review', '/terminal', '/vim'\n    ];\n  }\n\n  /**\n   * Get supported models (introspection)\n   */\n  async supportedModels(): Promise<string[]> {\n    return [\n      'claude-opus-4-5-20251101',\n      'claude-sonnet-4-5-20250929',\n      'claude-haiku-3-5-20241022'\n    ];\n  }\n\n  /**\n   * Get MCP server status\n   */\n  async mcpServerStatus(): Promise<Record<string, { connected: boolean; tools: number }>> {\n    // This would be populated by actual MCP server connections\n    return {\n      'claude-flow': { connected: true, tools: 213 },\n      'flow-nexus': { connected: true, tools: 45 }\n    };\n  }\n\n  /**\n   * Get account info\n   */\n  async accountInfo(): Promise<{\n    tier: string;\n    usage: { tokens: number; cost: number };\n    limits: { maxTokens: number; maxCost: number };\n  }> {\n    return {\n      tier: process.env.ANTHROPIC_TIER || 'unknown',\n      usage: {\n        tokens: this.state.tokenCount,\n        cost: this.state.costUsd\n      },\n      limits: {\n        maxTokens: parseInt(process.env.SDK_MAX_TOKENS || '100000'),\n        maxCost: parseFloat(process.env.SDK_MAX_BUDGET_USD || '10.00')\n      }\n    };\n  }\n}\n\n/**\n * Get all active queries\n */\nexport function getActiveQueries(): QueryState[] {\n  return Array.from(activeQueries.values());\n}\n\n/**\n * Get query by ID\n */\nexport function getQuery(id: string): QueryController | null {\n  const state = activeQueries.get(id);\n  if (!state) return null;\n  return new QueryController(state);\n}\n\n/**\n * Abort all active queries\n */\nexport function abortAllQueries(): void {\n  for (const state of activeQueries.values()) {\n    state.abortController.abort();\n    state.status = 'aborted';\n  }\n  activeQueries.clear();\n  logger.info('All queries aborted', { count: activeQueries.size });\n}\n\n/**\n * Get query statistics\n */\nexport function getQueryStats(): {\n  active: number;\n  total: number;\n  totalTokens: number;\n  totalCost: number;\n} {\n  const queries = Array.from(activeQueries.values());\n  return {\n    active: queries.filter(q => q.status === 'running').length,\n    total: queryCounter,\n    totalTokens: queries.reduce((sum, q) => sum + q.tokenCount, 0),\n    totalCost: queries.reduce((sum, q) => sum + q.costUsd, 0)\n  };\n}\n"]}

package/agentic-flow/dist/sdk/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/sdk/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAoB,GAAG,MAAM,GAAG,IAAI,CAsCvG;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAqCpF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,GAAE,MAAa,GAAG,MAAM,CAgB3E;AAMD;;GAEG;AACH,QAAA,MAAM,eAAe;;;GA8BpB,CAAC;AAEF;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUrD;AAaD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAmB7H;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAEnF;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,QAAA,MAAM,aAAa,QAA4C,CAAC;AAChE,QAAA,MAAM,cAAc,QAAsC,CAAC;AAE3D;;GAEG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,IAAI,CAkBtE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,GAAG,EACV,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,EAC1C,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAUN;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAUN;AAMD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,eAAe,CA0B3D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,EACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,eAAe,GACvB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA2CvC;AAMD;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,QAAQ,GAAG,QAAmB,GAAG,MAAM,CAE7F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAE/D;AAMD,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,EACf,CAAC"}

package/agentic-flow/dist/sdk/security.js

@@ -0,0 +1,329 @@
+/**
+ * Security Module - Comprehensive security hardening for SDK operations
+ *
+ * Provides:
+ * - Input validation and sanitization
+ * - Rate limiting
+ * - Audit logging
+ * - Secret detection
+ * - Path traversal protection
+ * - Command injection prevention
+ */
+import { logger } from "../utils/logger.js";
+import { existsSync, appendFileSync, mkdirSync } from "fs";
+import { join, resolve, normalize } from "path";
+import { homedir } from "os";
+import { createHash, randomBytes } from "crypto";
+// =============================================================================
+// Input Validation
+// =============================================================================
+/**
+ * Validate and sanitize file paths
+ */
+export function sanitizePath(inputPath, allowedBases = [process.cwd()]) {
+    if (!inputPath || typeof inputPath !== 'string') {
+        return null;
+    }
+    // Normalize the path
+    const normalizedPath = normalize(resolve(inputPath));
+    // Check for null bytes (path traversal attack)
+    if (inputPath.includes('\0')) {
+        logger.warn('Null byte detected in path', { path: inputPath });
+        return null;
+    }
+    // Check for path traversal attempts
+    if (inputPath.includes('..')) {
+        const resolved = resolve(inputPath);
+        const isWithinAllowed = allowedBases.some(base => resolved.startsWith(resolve(base)));
+        if (!isWithinAllowed) {
+            logger.warn('Path traversal attempt blocked', { path: inputPath });
+            return null;
+        }
+    }
+    // Verify the path is within allowed bases
+    const isAllowed = allowedBases.some(base => normalizedPath.startsWith(resolve(base)));
+    if (!isAllowed) {
+        logger.warn('Path outside allowed directories', { path: normalizedPath, allowed: allowedBases });
+        return null;
+    }
+    return normalizedPath;
+}
+/**
+ * Validate command for injection attacks
+ */
+export function validateCommand(command) {
+    if (!command || typeof command !== 'string') {
+        return { valid: false, reason: 'Command must be a non-empty string' };
+    }
+    // Check for command chaining/injection patterns
+    const dangerousPatterns = [
+        /;\s*rm\s/i, // Command chaining with rm
+        /\|\s*sh\b/i, // Piping to shell
+        /\|\s*bash\b/i, // Piping to bash
+        /`[^`]+`/, // Backtick command substitution
+        /\$\([^)]*\beval\b/, // Eval in command substitution
+        />\s*\/dev\/sd[a-z]/i, // Writing to block devices
+        /&&\s*rm\s+-rf/i, // Chained destructive rm
+        /\|\|\s*rm\s+-rf/i, // OR chained destructive rm
+        /\bnc\s+-[elp]/i, // Netcat reverse shell flags
+        /\bcurl\b.*\|\s*\w+sh/i, // Curl pipe to shell
+        /\bwget\b.*\|\s*\w+sh/i, // Wget pipe to shell
+        />\s*~\/.bashrc/i, // Writing to shell config
+        />\s*~\/.profile/i, // Writing to profile
+        />\s*\/etc\//i, // Writing to /etc
+        /\bsudo\s/i, // Sudo escalation
+        /\bchmod\s+[0-7]*7[0-7]*/i, // World-writable permissions
+    ];
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(command)) {
+            return { valid: false, reason: `Dangerous pattern detected: ${pattern.source}` };
+        }
+    }
+    // Check command length
+    if (command.length > 10000) {
+        return { valid: false, reason: 'Command too long (max 10000 chars)' };
+    }
+    return { valid: true };
+}
+/**
+ * Sanitize user input for logging
+ */
+export function sanitizeForLog(input, maxLength = 1000) {
+    if (input === null || input === undefined) {
+        return 'null';
+    }
+    let str = typeof input === 'string' ? input : JSON.stringify(input);
+    // Truncate
+    if (str.length > maxLength) {
+        str = str.substring(0, maxLength) + '...[truncated]';
+    }
+    // Remove potential secrets
+    str = redactSecrets(str);
+    return str;
+}
+// =============================================================================
+// Secret Detection
+// =============================================================================
+/**
+ * Patterns that indicate potential secrets
+ */
+const SECRET_PATTERNS = [
+    // API Keys
+    { pattern: /sk-[a-zA-Z0-9]{20,}/g, replacement: 'sk-***REDACTED***' },
+    { pattern: /api[_-]?key['":\s]*[a-zA-Z0-9]{20,}/gi, replacement: 'api_key=***REDACTED***' },
+    { pattern: /bearer\s+[a-zA-Z0-9._-]{20,}/gi, replacement: 'bearer ***REDACTED***' },
+    // Anthropic/OpenAI
+    { pattern: /sk-ant-[a-zA-Z0-9-]{20,}/g, replacement: 'sk-ant-***REDACTED***' },
+    { pattern: /sk-proj-[a-zA-Z0-9-]{20,}/g, replacement: 'sk-proj-***REDACTED***' },
+    // AWS
+    { pattern: /AKIA[0-9A-Z]{16}/g, replacement: 'AKIA***REDACTED***' },
+    { pattern: /aws[_-]?secret['":\s]*[a-zA-Z0-9/+=]{40}/gi, replacement: 'aws_secret=***REDACTED***' },
+    // GitHub
+    { pattern: /ghp_[a-zA-Z0-9]{36}/g, replacement: 'ghp_***REDACTED***' },
+    { pattern: /github_pat_[a-zA-Z0-9_]{22,}/g, replacement: 'github_pat_***REDACTED***' },
+    // Generic tokens/passwords
+    { pattern: /password['":\s]*[^\s'"]{8,}/gi, replacement: 'password=***REDACTED***' },
+    { pattern: /token['":\s]*[a-zA-Z0-9._-]{20,}/gi, replacement: 'token=***REDACTED***' },
+    { pattern: /secret['":\s]*[a-zA-Z0-9._-]{20,}/gi, replacement: 'secret=***REDACTED***' },
+    // Private keys
+    { pattern: /-----BEGIN [A-Z]+ PRIVATE KEY-----[\s\S]*?-----END [A-Z]+ PRIVATE KEY-----/g, replacement: '***PRIVATE_KEY_REDACTED***' },
+    // Database URLs
+    { pattern: /postgres:\/\/[^@]+@[^\s]+/gi, replacement: 'postgres://***REDACTED***' },
+    { pattern: /mysql:\/\/[^@]+@[^\s]+/gi, replacement: 'mysql://***REDACTED***' },
+    { pattern: /mongodb(\+srv)?:\/\/[^@]+@[^\s]+/gi, replacement: 'mongodb://***REDACTED***' },
+];
+/**
+ * Redact secrets from a string
+ */
+export function redactSecrets(text) {
+    let result = text;
+    for (const { pattern, replacement } of SECRET_PATTERNS) {
+        result = result.replace(pattern, replacement);
+    }
+    return result;
+}
+/**
+ * Check if text contains potential secrets
+ */
+export function containsSecrets(text) {
+    for (const { pattern } of SECRET_PATTERNS) {
+        if (pattern.test(text)) {
+            // Reset lastIndex for global patterns
+            pattern.lastIndex = 0;
+            return true;
+        }
+        pattern.lastIndex = 0;
+    }
+    return false;
+}
+const rateLimitStore = new Map();
+/**
+ * Check rate limit
+ */
+export function checkRateLimit(key, config) {
+    const now = Date.now();
+    const entry = rateLimitStore.get(key);
+    if (!entry || now > entry.resetTime) {
+        // New window
+        rateLimitStore.set(key, {
+            count: 1,
+            resetTime: now + config.windowMs
+        });
+        return { allowed: true, remaining: config.maxRequests - 1, resetIn: config.windowMs };
+    }
+    if (entry.count >= config.maxRequests) {
+        return { allowed: false, remaining: 0, resetIn: entry.resetTime - now };
+    }
+    entry.count++;
+    return { allowed: true, remaining: config.maxRequests - entry.count, resetIn: entry.resetTime - now };
+}
+/**
+ * Create a rate limiter function
+ */
+export function createRateLimiter(config) {
+    return (key) => checkRateLimit(key, config).allowed;
+}
+// Audit log path
+const AUDIT_LOG_DIR = join(homedir(), '.agentic-flow', 'audit');
+const AUDIT_LOG_FILE = join(AUDIT_LOG_DIR, 'security.log');
+/**
+ * Write audit log entry
+ */
+export function auditLog(entry) {
+    const fullEntry = {
+        ...entry,
+        timestamp: new Date().toISOString()
+    };
+    // Log to application logger
+    logger.info('Security audit', fullEntry);
+    // Write to audit file
+    try {
+        if (!existsSync(AUDIT_LOG_DIR)) {
+            mkdirSync(AUDIT_LOG_DIR, { recursive: true });
+        }
+        appendFileSync(AUDIT_LOG_FILE, JSON.stringify(fullEntry) + '\n');
+    }
+    catch (error) {
+        logger.warn('Failed to write audit log', { error: error.message });
+    }
+}
+/**
+ * Audit tool usage
+ */
+export function auditToolUsage(toolName, input, outcome, sessionId) {
+    auditLog({
+        event: 'tool_usage',
+        actor: 'agent',
+        resource: toolName,
+        action: 'execute',
+        outcome,
+        details: { input: sanitizeForLog(input, 500) },
+        sessionId
+    });
+}
+/**
+ * Audit permission decision
+ */
+export function auditPermissionDecision(toolName, decision, reason, sessionId) {
+    auditLog({
+        event: 'permission_decision',
+        actor: 'permission_handler',
+        resource: toolName,
+        action: decision,
+        outcome: decision === 'allow' ? 'success' : 'blocked',
+        details: { reason },
+        sessionId
+    });
+}
+/**
+ * Default security context
+ */
+export function getDefaultSecurityContext() {
+    return {
+        sessionId: randomBytes(16).toString('hex'),
+        allowedPaths: [
+            process.cwd(),
+            '/tmp',
+            join(homedir(), '.agentic-flow')
+        ],
+        allowedCommands: [
+            'ls', 'cat', 'head', 'tail', 'grep', 'find', 'wc',
+            'git', 'npm', 'node', 'python', 'python3',
+            'echo', 'pwd', 'date', 'which', 'env'
+        ],
+        blockedPatterns: [
+            /rm\s+-rf\s+[\/~]/,
+            /chmod\s+777/,
+            /curl.*\|\s*bash/,
+            /wget.*\|\s*sh/,
+            />\s*\/etc\//
+        ],
+        rateLimit: {
+            maxRequests: 100,
+            windowMs: 60000 // 1 minute
+        },
+        auditEnabled: true
+    };
+}
+/**
+ * Validate operation against security context
+ */
+export function validateOperation(operation, target, context) {
+    // Check rate limit
+    const rateCheck = checkRateLimit(`${context.sessionId}:${operation}`, context.rateLimit);
+    if (!rateCheck.allowed) {
+        return { allowed: false, reason: `Rate limit exceeded. Reset in ${Math.ceil(rateCheck.resetIn / 1000)}s` };
+    }
+    // Check path for read/write
+    if (operation === 'read' || operation === 'write') {
+        const sanitized = sanitizePath(target, context.allowedPaths);
+        if (!sanitized) {
+            return { allowed: false, reason: 'Path not allowed or invalid' };
+        }
+    }
+    // Check command for execute
+    if (operation === 'execute') {
+        const validation = validateCommand(target);
+        if (!validation.valid) {
+            return { allowed: false, reason: validation.reason };
+        }
+        // Check against blocked patterns
+        for (const pattern of context.blockedPatterns) {
+            if (pattern.test(target)) {
+                return { allowed: false, reason: `Blocked pattern: ${pattern.source}` };
+            }
+        }
+    }
+    // Audit if enabled
+    if (context.auditEnabled) {
+        auditLog({
+            event: 'operation_validated',
+            actor: 'security_context',
+            resource: target,
+            action: operation,
+            outcome: 'success',
+            sessionId: context.sessionId
+        });
+    }
+    return { allowed: true };
+}
+// =============================================================================
+// Secure Hash
+// =============================================================================
+/**
+ * Create secure hash of content
+ */
+export function secureHash(content, algorithm = 'sha256') {
+    return createHash(algorithm).update(content).digest('hex');
+}
+/**
+ * Generate secure random token
+ */
+export function generateSecureToken(length = 32) {
+    return randomBytes(length).toString('hex');
+}
+// =============================================================================
+// Exports
+// =============================================================================
+export { SECRET_PATTERNS, AUDIT_LOG_DIR, AUDIT_LOG_FILE };
+//# sourceMappingURL=security.js.map

package/agentic-flow/dist/sdk/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/sdk/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAW,MAAM,MAAM,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEjD,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,eAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qBAAqB;IACrB,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAErD,+CAA+C;IAC/C,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACnC,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACzC,CAAC;IAEF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACxE,CAAC;IAED,gDAAgD;IAChD,MAAM,iBAAiB,GAAG;QACxB,WAAW,EAAY,2BAA2B;QAClD,YAAY,EAAW,kBAAkB;QACzC,cAAc,EAAS,iBAAiB;QACxC,SAAS,EAAc,gCAAgC;QACvD,mBAAmB,EAAI,+BAA+B;QACtD,qBAAqB,EAAE,2BAA2B;QAClD,gBAAgB,EAAO,yBAAyB;QAChD,kBAAkB,EAAK,4BAA4B;QACnD,gBAAgB,EAAO,6BAA6B;QACpD,uBAAuB,EAAE,qBAAqB;QAC9C,uBAAuB,EAAE,qBAAqB;QAC9C,iBAAiB,EAAM,0BAA0B;QACjD,kBAAkB,EAAK,qBAAqB;QAC5C,cAAc,EAAS,kBAAkB;QACzC,WAAW,EAAY,kBAAkB;QACzC,0BAA0B,EAAE,6BAA6B;KAC1D,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAU,EAAE,YAAoB,IAAI;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpE,WAAW;IACX,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAAC;IACvD,CAAC;IAED,2BAA2B;IAC3B,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,mBAAmB,EAAE;IACrE,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAC3F,EAAE,OAAO,EAAE,gCAAgC,EAAE,WAAW,EAAE,uBAAuB,EAAE;IAEnF,mBAAmB;IACnB,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,uBAAuB,EAAE;IAC9E,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAEhF,MAAM;IACN,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACnE,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,2BAA2B,EAAE;IAEnG,SAAS;IACT,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACtE,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,2BAA2B,EAAE;IAEtF,2BAA2B;IAC3B,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACpF,EAAE,OAAO,EAAE,oCAAoC,EAAE,WAAW,EAAE,sBAAsB,EAAE;IACtF,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,uBAAuB,EAAE;IAExF,eAAe;IACf,EAAE,OAAO,EAAE,6EAA6E,EAAE,WAAW,EAAE,4BAA4B,EAAE;IAErI,gBAAgB;IAChB,EAAE,OAAO,EAAE,6BAA6B,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACpF,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,wBAAwB,EAAE;IAC9E,EAAE,OAAO,EAAE,oCAAoC,EAAE,WAAW,EAAE,0BAA0B,EAAE;CAC3F,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,eAAe,EAAE,CAAC;QACvD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;AAUzD;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAuB;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;QACpC,aAAa;QACb,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE;YACtB,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,QAAQ;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;AACxG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,OAAO,CAAC,GAAW,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAqBD,iBAAiB;AACjB,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;AAChE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAE3D;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAuC;IAC9D,MAAM,SAAS,GAAkB;QAC/B,GAAG,KAAK;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,4BAA4B;IAC5B,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAEzC,sBAAsB;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,KAAU,EACV,OAA0C,EAC1C,SAAkB;IAElB,QAAQ,CAAC;QACP,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,OAAO;QACd,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,SAAS;QACjB,OAAO;QACP,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;QAC9C,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,QAA0B,EAC1B,MAAc,EACd,SAAkB;IAElB,QAAQ,CAAC;QACP,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACrD,OAAO,EAAE,EAAE,MAAM,EAAE;QACnB,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAkBD;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1C,YAAY,EAAE;YACZ,OAAO,CAAC,GAAG,EAAE;YACb,MAAM;YACN,IAAI,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC;SACjC;QACD,eAAe,EAAE;YACf,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI;YACjD,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;YACzC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;SACtC;QACD,eAAe,EAAE;YACf,kBAAkB;YAClB,aAAa;YACb,iBAAiB;YACjB,eAAe;YACf,aAAa;SACd;QACD,SAAS,EAAE;YACT,WAAW,EAAE,GAAG;YAChB,QAAQ,EAAE,KAAK,CAAC,WAAW;SAC5B;QACD,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAuC,EACvC,MAAc,EACd,OAAwB;IAExB,mBAAmB;IACnB,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,SAAS,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACzF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7G,CAAC;IAED,4BAA4B;IAC5B,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,QAAQ,CAAC;YACP,KAAK,EAAE,qBAAqB;YAC5B,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,YAAiC,QAAQ;IACnF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE;IACrD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,EACf,CAAC","sourcesContent":["/**\n * Security Module - Comprehensive security hardening for SDK operations\n *\n * Provides:\n * - Input validation and sanitization\n * - Rate limiting\n * - Audit logging\n * - Secret detection\n * - Path traversal protection\n * - Command injection prevention\n */\n\nimport { logger } from \"../utils/logger.js\";\nimport { existsSync, appendFileSync, mkdirSync } from \"fs\";\nimport { join, resolve, normalize, dirname } from \"path\";\nimport { homedir } from \"os\";\nimport { createHash, randomBytes } from \"crypto\";\n\n// =============================================================================\n// Input Validation\n// =============================================================================\n\n/**\n * Validate and sanitize file paths\n */\nexport function sanitizePath(inputPath: string, allowedBases: string[] = [process.cwd()]): string | null {\n  if (!inputPath || typeof inputPath !== 'string') {\n    return null;\n  }\n\n  // Normalize the path\n  const normalizedPath = normalize(resolve(inputPath));\n\n  // Check for null bytes (path traversal attack)\n  if (inputPath.includes('\\0')) {\n    logger.warn('Null byte detected in path', { path: inputPath });\n    return null;\n  }\n\n  // Check for path traversal attempts\n  if (inputPath.includes('..')) {\n    const resolved = resolve(inputPath);\n    const isWithinAllowed = allowedBases.some(base =>\n      resolved.startsWith(resolve(base))\n    );\n\n    if (!isWithinAllowed) {\n      logger.warn('Path traversal attempt blocked', { path: inputPath });\n      return null;\n    }\n  }\n\n  // Verify the path is within allowed bases\n  const isAllowed = allowedBases.some(base =>\n    normalizedPath.startsWith(resolve(base))\n  );\n\n  if (!isAllowed) {\n    logger.warn('Path outside allowed directories', { path: normalizedPath, allowed: allowedBases });\n    return null;\n  }\n\n  return normalizedPath;\n}\n\n/**\n * Validate command for injection attacks\n */\nexport function validateCommand(command: string): { valid: boolean; reason?: string } {\n  if (!command || typeof command !== 'string') {\n    return { valid: false, reason: 'Command must be a non-empty string' };\n  }\n\n  // Check for command chaining/injection patterns\n  const dangerousPatterns = [\n    /;\\s*rm\\s/i,           // Command chaining with rm\n    /\\|\\s*sh\\b/i,          // Piping to shell\n    /\\|\\s*bash\\b/i,        // Piping to bash\n    /`[^`]+`/,             // Backtick command substitution\n    /\\$\\([^)]*\\beval\\b/,   // Eval in command substitution\n    />\\s*\\/dev\\/sd[a-z]/i, // Writing to block devices\n    /&&\\s*rm\\s+-rf/i,      // Chained destructive rm\n    /\\|\\|\\s*rm\\s+-rf/i,    // OR chained destructive rm\n    /\\bnc\\s+-[elp]/i,      // Netcat reverse shell flags\n    /\\bcurl\\b.*\\|\\s*\\w+sh/i, // Curl pipe to shell\n    /\\bwget\\b.*\\|\\s*\\w+sh/i, // Wget pipe to shell\n    />\\s*~\\/.bashrc/i,     // Writing to shell config\n    />\\s*~\\/.profile/i,    // Writing to profile\n    />\\s*\\/etc\\//i,        // Writing to /etc\n    /\\bsudo\\s/i,           // Sudo escalation\n    /\\bchmod\\s+[0-7]*7[0-7]*/i, // World-writable permissions\n  ];\n\n  for (const pattern of dangerousPatterns) {\n    if (pattern.test(command)) {\n      return { valid: false, reason: `Dangerous pattern detected: ${pattern.source}` };\n    }\n  }\n\n  // Check command length\n  if (command.length > 10000) {\n    return { valid: false, reason: 'Command too long (max 10000 chars)' };\n  }\n\n  return { valid: true };\n}\n\n/**\n * Sanitize user input for logging\n */\nexport function sanitizeForLog(input: any, maxLength: number = 1000): string {\n  if (input === null || input === undefined) {\n    return 'null';\n  }\n\n  let str = typeof input === 'string' ? input : JSON.stringify(input);\n\n  // Truncate\n  if (str.length > maxLength) {\n    str = str.substring(0, maxLength) + '...[truncated]';\n  }\n\n  // Remove potential secrets\n  str = redactSecrets(str);\n\n  return str;\n}\n\n// =============================================================================\n// Secret Detection\n// =============================================================================\n\n/**\n * Patterns that indicate potential secrets\n */\nconst SECRET_PATTERNS = [\n  // API Keys\n  { pattern: /sk-[a-zA-Z0-9]{20,}/g, replacement: 'sk-***REDACTED***' },\n  { pattern: /api[_-]?key['\":\\s]*[a-zA-Z0-9]{20,}/gi, replacement: 'api_key=***REDACTED***' },\n  { pattern: /bearer\\s+[a-zA-Z0-9._-]{20,}/gi, replacement: 'bearer ***REDACTED***' },\n\n  // Anthropic/OpenAI\n  { pattern: /sk-ant-[a-zA-Z0-9-]{20,}/g, replacement: 'sk-ant-***REDACTED***' },\n  { pattern: /sk-proj-[a-zA-Z0-9-]{20,}/g, replacement: 'sk-proj-***REDACTED***' },\n\n  // AWS\n  { pattern: /AKIA[0-9A-Z]{16}/g, replacement: 'AKIA***REDACTED***' },\n  { pattern: /aws[_-]?secret['\":\\s]*[a-zA-Z0-9/+=]{40}/gi, replacement: 'aws_secret=***REDACTED***' },\n\n  // GitHub\n  { pattern: /ghp_[a-zA-Z0-9]{36}/g, replacement: 'ghp_***REDACTED***' },\n  { pattern: /github_pat_[a-zA-Z0-9_]{22,}/g, replacement: 'github_pat_***REDACTED***' },\n\n  // Generic tokens/passwords\n  { pattern: /password['\":\\s]*[^\\s'\"]{8,}/gi, replacement: 'password=***REDACTED***' },\n  { pattern: /token['\":\\s]*[a-zA-Z0-9._-]{20,}/gi, replacement: 'token=***REDACTED***' },\n  { pattern: /secret['\":\\s]*[a-zA-Z0-9._-]{20,}/gi, replacement: 'secret=***REDACTED***' },\n\n  // Private keys\n  { pattern: /-----BEGIN [A-Z]+ PRIVATE KEY-----[\\s\\S]*?-----END [A-Z]+ PRIVATE KEY-----/g, replacement: '***PRIVATE_KEY_REDACTED***' },\n\n  // Database URLs\n  { pattern: /postgres:\\/\\/[^@]+@[^\\s]+/gi, replacement: 'postgres://***REDACTED***' },\n  { pattern: /mysql:\\/\\/[^@]+@[^\\s]+/gi, replacement: 'mysql://***REDACTED***' },\n  { pattern: /mongodb(\\+srv)?:\\/\\/[^@]+@[^\\s]+/gi, replacement: 'mongodb://***REDACTED***' },\n];\n\n/**\n * Redact secrets from a string\n */\nexport function redactSecrets(text: string): string {\n  let result = text;\n\n  for (const { pattern, replacement } of SECRET_PATTERNS) {\n    result = result.replace(pattern, replacement);\n  }\n\n  return result;\n}\n\n/**\n * Check if text contains potential secrets\n */\nexport function containsSecrets(text: string): boolean {\n  for (const { pattern } of SECRET_PATTERNS) {\n    if (pattern.test(text)) {\n      // Reset lastIndex for global patterns\n      pattern.lastIndex = 0;\n      return true;\n    }\n    pattern.lastIndex = 0;\n  }\n  return false;\n}\n\n// =============================================================================\n// Rate Limiting\n// =============================================================================\n\ninterface RateLimitEntry {\n  count: number;\n  resetTime: number;\n}\n\nconst rateLimitStore = new Map<string, RateLimitEntry>();\n\n/**\n * Rate limit configuration\n */\nexport interface RateLimitConfig {\n  maxRequests: number;\n  windowMs: number;\n}\n\n/**\n * Check rate limit\n */\nexport function checkRateLimit(key: string, config: RateLimitConfig): { allowed: boolean; remaining: number; resetIn: number } {\n  const now = Date.now();\n  const entry = rateLimitStore.get(key);\n\n  if (!entry || now > entry.resetTime) {\n    // New window\n    rateLimitStore.set(key, {\n      count: 1,\n      resetTime: now + config.windowMs\n    });\n    return { allowed: true, remaining: config.maxRequests - 1, resetIn: config.windowMs };\n  }\n\n  if (entry.count >= config.maxRequests) {\n    return { allowed: false, remaining: 0, resetIn: entry.resetTime - now };\n  }\n\n  entry.count++;\n  return { allowed: true, remaining: config.maxRequests - entry.count, resetIn: entry.resetTime - now };\n}\n\n/**\n * Create a rate limiter function\n */\nexport function createRateLimiter(config: RateLimitConfig): (key: string) => boolean {\n  return (key: string) => checkRateLimit(key, config).allowed;\n}\n\n// =============================================================================\n// Audit Logging\n// =============================================================================\n\n/**\n * Audit log entry\n */\nexport interface AuditLogEntry {\n  timestamp: string;\n  event: string;\n  actor: string;\n  resource: string;\n  action: string;\n  outcome: 'success' | 'failure' | 'blocked';\n  details?: Record<string, any>;\n  ip?: string;\n  sessionId?: string;\n}\n\n// Audit log path\nconst AUDIT_LOG_DIR = join(homedir(), '.agentic-flow', 'audit');\nconst AUDIT_LOG_FILE = join(AUDIT_LOG_DIR, 'security.log');\n\n/**\n * Write audit log entry\n */\nexport function auditLog(entry: Omit<AuditLogEntry, 'timestamp'>): void {\n  const fullEntry: AuditLogEntry = {\n    ...entry,\n    timestamp: new Date().toISOString()\n  };\n\n  // Log to application logger\n  logger.info('Security audit', fullEntry);\n\n  // Write to audit file\n  try {\n    if (!existsSync(AUDIT_LOG_DIR)) {\n      mkdirSync(AUDIT_LOG_DIR, { recursive: true });\n    }\n    appendFileSync(AUDIT_LOG_FILE, JSON.stringify(fullEntry) + '\\n');\n  } catch (error) {\n    logger.warn('Failed to write audit log', { error: (error as Error).message });\n  }\n}\n\n/**\n * Audit tool usage\n */\nexport function auditToolUsage(\n  toolName: string,\n  input: any,\n  outcome: 'success' | 'failure' | 'blocked',\n  sessionId?: string\n): void {\n  auditLog({\n    event: 'tool_usage',\n    actor: 'agent',\n    resource: toolName,\n    action: 'execute',\n    outcome,\n    details: { input: sanitizeForLog(input, 500) },\n    sessionId\n  });\n}\n\n/**\n * Audit permission decision\n */\nexport function auditPermissionDecision(\n  toolName: string,\n  decision: 'allow' | 'deny',\n  reason: string,\n  sessionId?: string\n): void {\n  auditLog({\n    event: 'permission_decision',\n    actor: 'permission_handler',\n    resource: toolName,\n    action: decision,\n    outcome: decision === 'allow' ? 'success' : 'blocked',\n    details: { reason },\n    sessionId\n  });\n}\n\n// =============================================================================\n// Security Context\n// =============================================================================\n\n/**\n * Security context for a session\n */\nexport interface SecurityContext {\n  sessionId: string;\n  allowedPaths: string[];\n  allowedCommands: string[];\n  blockedPatterns: RegExp[];\n  rateLimit: RateLimitConfig;\n  auditEnabled: boolean;\n}\n\n/**\n * Default security context\n */\nexport function getDefaultSecurityContext(): SecurityContext {\n  return {\n    sessionId: randomBytes(16).toString('hex'),\n    allowedPaths: [\n      process.cwd(),\n      '/tmp',\n      join(homedir(), '.agentic-flow')\n    ],\n    allowedCommands: [\n      'ls', 'cat', 'head', 'tail', 'grep', 'find', 'wc',\n      'git', 'npm', 'node', 'python', 'python3',\n      'echo', 'pwd', 'date', 'which', 'env'\n    ],\n    blockedPatterns: [\n      /rm\\s+-rf\\s+[\\/~]/,\n      /chmod\\s+777/,\n      /curl.*\\|\\s*bash/,\n      /wget.*\\|\\s*sh/,\n      />\\s*\\/etc\\//\n    ],\n    rateLimit: {\n      maxRequests: 100,\n      windowMs: 60000 // 1 minute\n    },\n    auditEnabled: true\n  };\n}\n\n/**\n * Validate operation against security context\n */\nexport function validateOperation(\n  operation: 'read' | 'write' | 'execute',\n  target: string,\n  context: SecurityContext\n): { allowed: boolean; reason?: string } {\n  // Check rate limit\n  const rateCheck = checkRateLimit(`${context.sessionId}:${operation}`, context.rateLimit);\n  if (!rateCheck.allowed) {\n    return { allowed: false, reason: `Rate limit exceeded. Reset in ${Math.ceil(rateCheck.resetIn / 1000)}s` };\n  }\n\n  // Check path for read/write\n  if (operation === 'read' || operation === 'write') {\n    const sanitized = sanitizePath(target, context.allowedPaths);\n    if (!sanitized) {\n      return { allowed: false, reason: 'Path not allowed or invalid' };\n    }\n  }\n\n  // Check command for execute\n  if (operation === 'execute') {\n    const validation = validateCommand(target);\n    if (!validation.valid) {\n      return { allowed: false, reason: validation.reason };\n    }\n\n    // Check against blocked patterns\n    for (const pattern of context.blockedPatterns) {\n      if (pattern.test(target)) {\n        return { allowed: false, reason: `Blocked pattern: ${pattern.source}` };\n      }\n    }\n  }\n\n  // Audit if enabled\n  if (context.auditEnabled) {\n    auditLog({\n      event: 'operation_validated',\n      actor: 'security_context',\n      resource: target,\n      action: operation,\n      outcome: 'success',\n      sessionId: context.sessionId\n    });\n  }\n\n  return { allowed: true };\n}\n\n// =============================================================================\n// Secure Hash\n// =============================================================================\n\n/**\n * Create secure hash of content\n */\nexport function secureHash(content: string, algorithm: 'sha256' | 'sha512' = 'sha256'): string {\n  return createHash(algorithm).update(content).digest('hex');\n}\n\n/**\n * Generate secure random token\n */\nexport function generateSecureToken(length: number = 32): string {\n  return randomBytes(length).toString('hex');\n}\n\n// =============================================================================\n// Exports\n// =============================================================================\n\nexport {\n  SECRET_PATTERNS,\n  AUDIT_LOG_DIR,\n  AUDIT_LOG_FILE\n};\n"]}

package/agentic-flow/dist/sdk/session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/sdk/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AA2BD;;GAEG;AACH,UAAU,gBAAgB;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,gBAAgB;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,SAAS,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,sBAAsB,CAAC;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,KAAK,UAAU,GAAG,gBAAgB,GAAG,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAoCnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAEnD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAEzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,WAAW,EAAE,CAEjD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAkBxE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAO1F;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAelD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAIvC;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;CACvB,CASA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,IAAI,CAaP;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAChC,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CAClB,GACL,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAkBrB"}

package/agentic-flow/dist/sdk/session-manager.js

@@ -0,0 +1,181 @@
+/**
+ * SDK Session Manager - Manages Claude Agent SDK session lifecycle
+ *
+ * Provides session ID capture, resume capability, and session forking
+ * for maintaining context across multiple queries.
+ */
+import { logger } from "../utils/logger.js";
+// Session TTL: 30 minutes of inactivity
+const SESSION_TTL_MS = 30 * 60 * 1000;
+// In-memory session storage
+const activeSessions = new Map();
+// Current session for quick access
+let currentSessionId = null;
+// Cleanup stale sessions periodically
+function cleanupStaleSessions() {
+    const now = Date.now();
+    for (const [id, session] of activeSessions.entries()) {
+        if (now - session.lastActivity > SESSION_TTL_MS) {
+            activeSessions.delete(id);
+            if (currentSessionId === id) {
+                currentSessionId = null;
+            }
+        }
+    }
+}
+// Run cleanup every 5 minutes
+setInterval(cleanupStaleSessions, 5 * 60 * 1000).unref();
+/**
+ * Capture session ID from SDK init message
+ * Call this for every message received from query()
+ */
+export function captureSessionId(message) {
+    if (message.type === 'system' &&
+        message.subtype === 'init' &&
+        message.session_id) {
+        const sessionId = message.session_id;
+        // Store session info
+        activeSessions.set(sessionId, {
+            sessionId,
+            startTime: Date.now(),
+            messageCount: 1,
+            lastActivity: Date.now(),
+            resumed: false
+        });
+        currentSessionId = sessionId;
+        logger.info('Session captured', {
+            sessionId,
+            model: message.model,
+            tools: message.tools?.length
+        });
+        return sessionId;
+    }
+    // Update message count for existing session
+    if (message.session_id && activeSessions.has(message.session_id)) {
+        const session = activeSessions.get(message.session_id);
+        session.messageCount++;
+        session.lastActivity = Date.now();
+    }
+    return null;
+}
+/**
+ * Get the current active session ID
+ */
+export function getCurrentSessionId() {
+    return currentSessionId;
+}
+/**
+ * Get session info by ID
+ */
+export function getSessionInfo(sessionId) {
+    return activeSessions.get(sessionId);
+}
+/**
+ * Get all active sessions
+ */
+export function getActiveSessions() {
+    return Array.from(activeSessions.values());
+}
+/**
+ * Get resume options for continuing a session
+ * @param sessionId - Session ID to resume, or uses current session if not provided
+ */
+export function getResumeOptions(sessionId) {
+    const id = sessionId || currentSessionId;
+    if (!id) {
+        return {};
+    }
+    // Mark session as resumed
+    const session = activeSessions.get(id);
+    if (session) {
+        session.resumed = true;
+    }
+    logger.info('Preparing session resume', { sessionId: id });
+    return {
+        resume: id
+    };
+}
+/**
+ * Get fork options for creating a new session branch from an existing one
+ * @param sessionId - Session ID to fork from
+ */
+export function getForkOptions(sessionId) {
+    logger.info('Forking session', { sourceSessionId: sessionId });
+    return {
+        resume: sessionId,
+        forkSession: true
+    };
+}
+/**
+ * Mark a session as ended
+ */
+export function endSession(sessionId) {
+    if (activeSessions.has(sessionId)) {
+        const session = activeSessions.get(sessionId);
+        logger.info('Session ended', {
+            sessionId,
+            duration: Date.now() - session.startTime,
+            messageCount: session.messageCount
+        });
+        activeSessions.delete(sessionId);
+        if (currentSessionId === sessionId) {
+            currentSessionId = null;
+        }
+    }
+}
+/**
+ * Clear all sessions (for testing/reset)
+ */
+export function clearAllSessions() {
+    activeSessions.clear();
+    currentSessionId = null;
+    logger.info('All sessions cleared');
+}
+/**
+ * Get session statistics
+ */
+export function getSessionStats() {
+    const sessions = Array.from(activeSessions.values());
+    return {
+        totalSessions: sessions.length,
+        activeSessions: sessions.filter(s => !s.resumed).length,
+        currentSessionId,
+        totalMessages: sessions.reduce((sum, s) => sum + s.messageCount, 0)
+    };
+}
+/**
+ * Process result message and extract session info
+ */
+export function processResultMessage(message) {
+    if (message.type !== 'result')
+        return null;
+    const resultMsg = message;
+    return {
+        success: resultMsg.subtype === 'success',
+        sessionId: resultMsg.session_id,
+        duration: resultMsg.duration_ms,
+        cost: resultMsg.total_cost_usd,
+        result: resultMsg.result,
+        errors: resultMsg.errors
+    };
+}
+/**
+ * Build query options with session support
+ */
+export function buildQueryOptionsWithSession(baseOptions, options = {}) {
+    const { resumeSession, sessionId, forkSession } = options;
+    if (forkSession && sessionId) {
+        return {
+            ...baseOptions,
+            ...getForkOptions(sessionId)
+        };
+    }
+    if (resumeSession) {
+        return {
+            ...baseOptions,
+            ...getResumeOptions(sessionId)
+        };
+    }
+    return baseOptions;
+}
+//# sourceMappingURL=session-manager.js.map

package/agentic-flow/dist/sdk/session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../../src/sdk/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAY5C,wCAAwC;AACxC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,4BAA4B;AAC5B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;AAEtD,mCAAmC;AACnC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,sCAAsC;AACtC,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,GAAG,GAAG,OAAO,CAAC,YAAY,GAAG,cAAc,EAAE,CAAC;YAChD,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,gBAAgB,KAAK,EAAE,EAAE,CAAC;gBAC5B,gBAAgB,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,8BAA8B;AAC9B,WAAW,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AA8BzD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAmB;IAClD,IACE,OAAO,CAAC,IAAI,KAAK,QAAQ;QACxB,OAA4B,CAAC,OAAO,KAAK,MAAM;QAC/C,OAA4B,CAAC,UAAU,EACxC,CAAC;QACD,MAAM,SAAS,GAAI,OAA4B,CAAC,UAAU,CAAC;QAE3D,qBAAqB;QACrB,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE;YAC5B,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,gBAAgB,GAAG,SAAS,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC9B,SAAS;YACT,KAAK,EAAG,OAA4B,CAAC,KAAK;YAC1C,KAAK,EAAG,OAA4B,CAAC,KAAK,EAAE,MAAM;SACnD,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAE,CAAC;QACxD,OAAO,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB;IACjD,MAAM,EAAE,GAAG,SAAS,IAAI,gBAAgB,CAAC;IAEzC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,0BAA0B;IAC1B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAE3D,OAAO;QACL,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;IAE/D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAC3B,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;YACxC,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEjC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,gBAAgB,GAAG,IAAI,CAAC;IACxB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAM7B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;QACvD,gBAAgB;QAChB,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAmB;IAQtD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,SAAS,GAAG,OAA2B,CAAC;IAE9C,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAO,KAAK,SAAS;QACxC,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,QAAQ,EAAE,SAAS,CAAC,WAAW;QAC/B,IAAI,EAAE,SAAS,CAAC,cAAc;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAgC,EAChC,UAII,EAAE;IAEN,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE1D,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,GAAG,WAAW;YACd,GAAG,cAAc,CAAC,SAAS,CAAC;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,GAAG,WAAW;YACd,GAAG,gBAAgB,CAAC,SAAS,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["/**\n * SDK Session Manager - Manages Claude Agent SDK session lifecycle\n *\n * Provides session ID capture, resume capability, and session forking\n * for maintaining context across multiple queries.\n */\n\nimport { logger } from \"../utils/logger.js\";\n\n// Session info stored in memory\ninterface SessionInfo {\n  sessionId: string;\n  startTime: number;\n  messageCount: number;\n  lastActivity: number;\n  agentName?: string;\n  resumed: boolean;\n}\n\n// Session TTL: 30 minutes of inactivity\nconst SESSION_TTL_MS = 30 * 60 * 1000;\n\n// In-memory session storage\nconst activeSessions = new Map<string, SessionInfo>();\n\n// Current session for quick access\nlet currentSessionId: string | null = null;\n\n// Cleanup stale sessions periodically\nfunction cleanupStaleSessions(): void {\n  const now = Date.now();\n  for (const [id, session] of activeSessions.entries()) {\n    if (now - session.lastActivity > SESSION_TTL_MS) {\n      activeSessions.delete(id);\n      if (currentSessionId === id) {\n        currentSessionId = null;\n      }\n    }\n  }\n}\n\n// Run cleanup every 5 minutes\nsetInterval(cleanupStaleSessions, 5 * 60 * 1000).unref();\n\n/**\n * SDK Message types (from documentation)\n */\ninterface SDKSystemMessage {\n  type: 'system';\n  subtype: 'init' | 'compact_boundary';\n  uuid: string;\n  session_id: string;\n  apiKeySource?: string;\n  cwd?: string;\n  tools?: string[];\n  model?: string;\n  permissionMode?: string;\n}\n\ninterface SDKResultMessage {\n  type: 'result';\n  subtype: 'success' | 'error_max_turns' | 'error_during_execution' | 'error_max_budget_usd';\n  uuid: string;\n  session_id: string;\n  duration_ms: number;\n  total_cost_usd: number;\n  result?: string;\n  errors?: string[];\n}\n\ntype SDKMessage = SDKSystemMessage | SDKResultMessage | { type: string; session_id?: string };\n\n/**\n * Capture session ID from SDK init message\n * Call this for every message received from query()\n */\nexport function captureSessionId(message: SDKMessage): string | null {\n  if (\n    message.type === 'system' &&\n    (message as SDKSystemMessage).subtype === 'init' &&\n    (message as SDKSystemMessage).session_id\n  ) {\n    const sessionId = (message as SDKSystemMessage).session_id;\n\n    // Store session info\n    activeSessions.set(sessionId, {\n      sessionId,\n      startTime: Date.now(),\n      messageCount: 1,\n      lastActivity: Date.now(),\n      resumed: false\n    });\n\n    currentSessionId = sessionId;\n\n    logger.info('Session captured', {\n      sessionId,\n      model: (message as SDKSystemMessage).model,\n      tools: (message as SDKSystemMessage).tools?.length\n    });\n\n    return sessionId;\n  }\n\n  // Update message count for existing session\n  if (message.session_id && activeSessions.has(message.session_id)) {\n    const session = activeSessions.get(message.session_id)!;\n    session.messageCount++;\n    session.lastActivity = Date.now();\n  }\n\n  return null;\n}\n\n/**\n * Get the current active session ID\n */\nexport function getCurrentSessionId(): string | null {\n  return currentSessionId;\n}\n\n/**\n * Get session info by ID\n */\nexport function getSessionInfo(sessionId: string): SessionInfo | undefined {\n  return activeSessions.get(sessionId);\n}\n\n/**\n * Get all active sessions\n */\nexport function getActiveSessions(): SessionInfo[] {\n  return Array.from(activeSessions.values());\n}\n\n/**\n * Get resume options for continuing a session\n * @param sessionId - Session ID to resume, or uses current session if not provided\n */\nexport function getResumeOptions(sessionId?: string): { resume?: string } {\n  const id = sessionId || currentSessionId;\n\n  if (!id) {\n    return {};\n  }\n\n  // Mark session as resumed\n  const session = activeSessions.get(id);\n  if (session) {\n    session.resumed = true;\n  }\n\n  logger.info('Preparing session resume', { sessionId: id });\n\n  return {\n    resume: id\n  };\n}\n\n/**\n * Get fork options for creating a new session branch from an existing one\n * @param sessionId - Session ID to fork from\n */\nexport function getForkOptions(sessionId: string): { resume: string; forkSession: boolean } {\n  logger.info('Forking session', { sourceSessionId: sessionId });\n\n  return {\n    resume: sessionId,\n    forkSession: true\n  };\n}\n\n/**\n * Mark a session as ended\n */\nexport function endSession(sessionId: string): void {\n  if (activeSessions.has(sessionId)) {\n    const session = activeSessions.get(sessionId)!;\n    logger.info('Session ended', {\n      sessionId,\n      duration: Date.now() - session.startTime,\n      messageCount: session.messageCount\n    });\n\n    activeSessions.delete(sessionId);\n\n    if (currentSessionId === sessionId) {\n      currentSessionId = null;\n    }\n  }\n}\n\n/**\n * Clear all sessions (for testing/reset)\n */\nexport function clearAllSessions(): void {\n  activeSessions.clear();\n  currentSessionId = null;\n  logger.info('All sessions cleared');\n}\n\n/**\n * Get session statistics\n */\nexport function getSessionStats(): {\n  totalSessions: number;\n  activeSessions: number;\n  currentSessionId: string | null;\n  totalMessages: number;\n} {\n  const sessions = Array.from(activeSessions.values());\n\n  return {\n    totalSessions: sessions.length,\n    activeSessions: sessions.filter(s => !s.resumed).length,\n    currentSessionId,\n    totalMessages: sessions.reduce((sum, s) => sum + s.messageCount, 0)\n  };\n}\n\n/**\n * Process result message and extract session info\n */\nexport function processResultMessage(message: SDKMessage): {\n  success: boolean;\n  sessionId?: string;\n  duration?: number;\n  cost?: number;\n  result?: string;\n  errors?: string[];\n} | null {\n  if (message.type !== 'result') return null;\n\n  const resultMsg = message as SDKResultMessage;\n\n  return {\n    success: resultMsg.subtype === 'success',\n    sessionId: resultMsg.session_id,\n    duration: resultMsg.duration_ms,\n    cost: resultMsg.total_cost_usd,\n    result: resultMsg.result,\n    errors: resultMsg.errors\n  };\n}\n\n/**\n * Build query options with session support\n */\nexport function buildQueryOptionsWithSession(\n  baseOptions: Record<string, any>,\n  options: {\n    resumeSession?: boolean;\n    sessionId?: string;\n    forkSession?: boolean;\n  } = {}\n): Record<string, any> {\n  const { resumeSession, sessionId, forkSession } = options;\n\n  if (forkSession && sessionId) {\n    return {\n      ...baseOptions,\n      ...getForkOptions(sessionId)\n    };\n  }\n\n  if (resumeSession) {\n    return {\n      ...baseOptions,\n      ...getResumeOptions(sessionId)\n    };\n  }\n\n  return baseOptions;\n}\n"]}

package/agentic-flow/dist/sdk/streaming-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streaming-input.d.ts","sourceRoot":"","sources":["../../src/sdk/streaming-input.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,OAAO,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;SACd,GAAG;YACF,IAAI,EAAE,OAAO,CAAC;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ,CAAC;gBACf,UAAU,EAAE,MAAM,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC;aACd,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC;CACzD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAO9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,GAAE,MAAoB,GAAG,cAAc,CActG;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,cAAc,CAoBrJ;AAED;;GAEG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,OAAO,CAAa;IAE5B;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAK3B;;OAEG;IACH,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAKnD;;OAEG;IACH,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAKvB;;OAEG;IACH,KAAK,IAAI,aAAa,CAAC,cAAc,CAAC;CAevC;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,sBAAsB,CAExD;AAED;;GAEG;AACH,qBAAa,uBAAwB,YAAW,aAAa,CAAC,cAAc,CAAC;IAC3E,OAAO,CAAC,KAAK,CAAwB;IACrC,OAAO,CAAC,OAAO,CAAyE;IACxF,OAAO,CAAC,MAAM,CAAkB;IAEhC;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAanC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI5B;;OAEG;IACH,KAAK,IAAI,IAAI;IAQb;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;YACW,IAAI;IAclB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,cAAc,CAAC;CAYxD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,uBAAuB,CAEjE;AAED;;GAEG;AACH,wBAAuB,eAAe,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,GAAG,aAAa,CAAC,cAAc,CAAC,CAMtH;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,cAAc,CAAC,CAQ3E;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAE,MAAa,GAAG,uBAAuB,CAsB1F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,EACrC,SAAS,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,GAC/E,aAAa,CAAC,cAAc,CAAC,CAQ/B;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,EACrC,SAAS,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACjE,aAAa,CAAC,cAAc,CAAC,CAU/B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,EACrC,aAAa,EAAE,MAAM,GACpB,aAAa,CAAC,cAAc,CAAC,CAkB/B;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,EACrC,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAAe,GACzB,aAAa,CAAC,cAAc,CAAC,CAwB/B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC,cAAc,CAAC,GAAG,aAAa,CAAC,cAAc,CAAC,CAUxH;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,EAAE,KAAK,GAAE,MAAsB,GAAG,aAAa,CAAC,cAAc,CAAC,CAerI"}