airaknit 1.1.2-rc.9

package/src/server/claude-pty-mcp/tools/glob.test.ts

@@ -0,0 +1,61 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { POLICY_DEFAULT } from "../../../shared/permission-policy"
+import { createToolCallbackService } from "../../claude-pty/tool-callback"
+import { createTestEventStore } from "../../storage/test-helpers"
+import { createGlobTool } from "./glob.adapter"
+
+async function newStore() {
+  const dir = await mkdtemp(path.join(tmpdir(), "kanna-mcp-glob-"))
+  const store = createTestEventStore(dir)
+  await store.initialize()
+  const cleanup = async () => {
+    await new Promise<void>((r) => setTimeout(r, 50))
+    await rm(dir, { recursive: true, force: true })
+  }
+  return { store, dir, cleanup }
+}
+
+const ctx = (cwd: string) => ({
+  chatId: "c",
+  sessionId: "s",
+  toolUseId: "tu",
+  cwd,
+  chatPolicy: { ...POLICY_DEFAULT, defaultAction: "auto-allow" as const },
+})
+
+describe("mcp__kanna__glob", () => {
+  test("*.ts pattern → returns matching files only", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createGlobTool({ toolCallback: svc })
+
+      // Create a mix of .ts and .txt files
+      await writeFile(path.join(dir, "foo.ts"), "")
+      await writeFile(path.join(dir, "bar.ts"), "")
+      await writeFile(path.join(dir, "baz.txt"), "")
+      await mkdir(path.join(dir, "sub"))
+      await writeFile(path.join(dir, "sub", "qux.ts"), "")
+
+      const result = await tool.handler({ path: dir, pattern: "**/*.ts" }, ctx(dir))
+      expect(result.isError).toBeFalsy()
+      const lines = result.content[0].text.split("\n").filter(Boolean)
+      expect(lines.every((l) => l.endsWith(".ts"))).toBe(true)
+      expect(lines.some((l) => l.includes("baz.txt"))).toBe(false)
+      expect(lines.length).toBe(3)
+    } finally { await cleanup() }
+  }, 30_000)
+
+  test("path in readPathDeny → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createGlobTool({ toolCallback: svc })
+      const result = await tool.handler({ path: "~/.ssh", pattern: "*.pem" }, ctx(dir))
+      expect(result.isError).toBe(true)
+    } finally { await cleanup() }
+  }, 30_000)
+})

package/src/server/claude-pty-mcp/tools/grep.adapter.ts

@@ -0,0 +1,126 @@
+import { z } from "zod"
+import { readdir, readFile, lstat, stat } from "node:fs/promises"
+import path from "node:path"
+import { homedir } from "node:os"
+import type { ToolCallbackService } from "../../claude-pty/tool-callback"
+import type { ToolHandlerContext, ToolHandlerResult } from "./tool-callback-shim"
+import { gatedToolCall } from "./tool-callback-shim"
+
+const InputSchema = z.object({
+  path: z.string(),
+  pattern: z.string(),
+})
+
+export type GrepInput = z.infer<typeof InputSchema>
+
+export interface GrepTool {
+  name: "grep"
+  schema: typeof InputSchema
+  handler: (input: GrepInput, ctx: ToolHandlerContext) => Promise<ToolHandlerResult>
+}
+
+function resolvePath(p: string, cwd: string): string {
+  if (p.startsWith("~")) return path.join(homedir(), p.slice(1).replace(/^\//, ""))
+  return path.resolve(cwd, p)
+}
+
+const SKIP_DIRS = new Set(["node_modules", ".git"])
+const MAX_LINES = 500
+const MAX_FILE_SIZE = 1_000_000 // 1 MB
+
+async function grepDir(root: string, re: RegExp, results: string[]): Promise<void> {
+  if (results.length >= MAX_LINES) return
+  let entries
+  try {
+    entries = await readdir(root, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const entry of entries) {
+    if (results.length >= MAX_LINES) break
+    const fullPath = path.join(root, entry.name)
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue
+      // Symlink guard: skip symlinked directories to prevent traversal loops
+      try {
+        const st = await lstat(fullPath)
+        if (st.isSymbolicLink()) continue
+      } catch {
+        continue
+      }
+      await grepDir(fullPath, re, results)
+    } else {
+      // Skip large files to prevent memory issues
+      try {
+        const fileStat = await stat(fullPath)
+        if (fileStat.size > MAX_FILE_SIZE) continue
+      } catch {
+        continue
+      }
+      let content: string
+      try {
+        content = await readFile(fullPath, "utf8")
+      } catch {
+        continue
+      }
+      const lines = content.split("\n")
+      for (let i = 0; i < lines.length && results.length < MAX_LINES; i++) {
+        if (re.test(lines[i])) {
+          results.push(`${fullPath}:${i + 1}: ${lines[i]}`)
+        }
+      }
+    }
+  }
+}
+
+async function grepWithTimeout(root: string, re: RegExp, results: string[]): Promise<void> {
+  return await Promise.race([
+    grepDir(root, re, results),
+    new Promise<void>((_, reject) => setTimeout(() => reject(new Error("grep timeout 30s")), 30_000)),
+  ])
+}
+
+export function createGrepTool(deps: { toolCallback: ToolCallbackService }): GrepTool {
+  return {
+    name: "grep",
+    schema: InputSchema,
+    async handler(input, ctx) {
+      return gatedToolCall({
+        toolCallback: deps.toolCallback,
+        toolName: "mcp__kanna__grep",
+        ctx,
+        args: input as unknown as Record<string, unknown>,
+        formatAnswer: async () => {
+          let re: RegExp
+          try {
+            re = new RegExp(input.pattern)
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err)
+            return {
+              content: [{ type: "text" as const, text: `Invalid regex pattern: ${msg}` }],
+              isError: true,
+            }
+          }
+          const root = resolvePath(input.path, ctx.cwd)
+          const results: string[] = []
+          try {
+            await grepWithTimeout(root, re, results)
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err)
+            return {
+              content: [{ type: "text" as const, text: `grep error: ${msg}` }],
+              isError: true,
+            }
+          }
+          return {
+            content: [{ type: "text" as const, text: results.join("\n") }],
+          }
+        },
+        formatDeny: (reason) => ({
+          content: [{ type: "text" as const, text: `Denied: ${reason}` }],
+          isError: true,
+        }),
+      })
+    },
+  }
+}

package/src/server/claude-pty-mcp/tools/grep.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { POLICY_DEFAULT } from "../../../shared/permission-policy"
+import { createToolCallbackService } from "../../claude-pty/tool-callback"
+import { createTestEventStore } from "../../storage/test-helpers"
+import { createGrepTool } from "./grep.adapter"
+
+async function newStore() {
+  const dir = await mkdtemp(path.join(tmpdir(), "kanna-mcp-grep-"))
+  const store = createTestEventStore(dir)
+  await store.initialize()
+  const cleanup = async () => {
+    await new Promise<void>((r) => setTimeout(r, 50))
+    await rm(dir, { recursive: true, force: true })
+  }
+  return { store, dir, cleanup }
+}
+
+const ctx = (cwd: string) => ({
+  chatId: "c",
+  sessionId: "s",
+  toolUseId: "tu",
+  cwd,
+  chatPolicy: { ...POLICY_DEFAULT, defaultAction: "auto-allow" as const },
+})
+
+describe("mcp__kanna__grep", () => {
+  test("finds lines matching pattern across multiple files", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createGrepTool({ toolCallback: svc })
+
+      // Use a dedicated search dir separate from the event store dir
+      const searchDir = path.join(dir, "search")
+      await mkdir(searchDir)
+      await writeFile(path.join(searchDir, "alpha.txt"), "hello world\nfoo bar\nhello again")
+      await mkdir(path.join(searchDir, "sub"))
+      await writeFile(path.join(searchDir, "sub", "beta.txt"), "nothing here\nhello sub\n")
+      await writeFile(path.join(searchDir, "gamma.txt"), "no match")
+
+      const result = await tool.handler({ path: searchDir, pattern: "hello" }, ctx(dir))
+      expect(result.isError).toBeFalsy()
+      const lines = result.content[0].text.split("\n").filter(Boolean)
+      // Should find "hello world", "hello again", "hello sub"
+      expect(lines.length).toBe(3)
+      expect(lines.every((l) => l.includes("hello"))).toBe(true)
+    } finally { await cleanup() }
+  }, 30_000)
+
+  test("path in readPathDeny → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createGrepTool({ toolCallback: svc })
+      const result = await tool.handler({ path: "~/.ssh", pattern: "KEY" }, ctx(dir))
+      expect(result.isError).toBe(true)
+    } finally { await cleanup() }
+  }, 30_000)
+})

package/src/server/claude-pty-mcp/tools/read.adapter.ts

@@ -0,0 +1,58 @@
+import { z } from "zod"
+import { readFile } from "node:fs/promises"
+import path from "node:path"
+import { homedir } from "node:os"
+import type { ToolCallbackService } from "../../claude-pty/tool-callback"
+import type { ToolHandlerContext, ToolHandlerResult } from "./tool-callback-shim"
+import { gatedToolCall } from "./tool-callback-shim"
+
+const InputSchema = z.object({
+  path: z.string(),
+})
+
+export type ReadInput = z.infer<typeof InputSchema>
+
+export interface ReadTool {
+  name: "read"
+  schema: typeof InputSchema
+  handler: (input: ReadInput, ctx: ToolHandlerContext) => Promise<ToolHandlerResult>
+}
+
+function resolvePath(p: string, cwd: string): string {
+  if (p.startsWith("~")) return path.join(homedir(), p.slice(1).replace(/^\//, ""))
+  return path.resolve(cwd, p)
+}
+
+export function createReadTool(deps: { toolCallback: ToolCallbackService }): ReadTool {
+  return {
+    name: "read",
+    schema: InputSchema,
+    async handler(input, ctx) {
+      return gatedToolCall({
+        toolCallback: deps.toolCallback,
+        toolName: "mcp__kanna__read",
+        ctx,
+        args: input as unknown as Record<string, unknown>,
+        formatAnswer: async () => {
+          try {
+            const resolved = resolvePath(input.path, ctx.cwd)
+            const content = await readFile(resolved, "utf8")
+            return {
+              content: [{ type: "text" as const, text: content }],
+            }
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err)
+            return {
+              content: [{ type: "text" as const, text: `Error reading file: ${msg}` }],
+              isError: true,
+            }
+          }
+        },
+        formatDeny: (reason) => ({
+          content: [{ type: "text" as const, text: `Denied: ${reason}` }],
+          isError: true,
+        }),
+      })
+    },
+  }
+}

package/src/server/claude-pty-mcp/tools/read.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtemp, rm, writeFile } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { POLICY_DEFAULT } from "../../../shared/permission-policy"
+import { createToolCallbackService } from "../../claude-pty/tool-callback"
+import { createTestEventStore } from "../../storage/test-helpers"
+import { createReadTool } from "./read.adapter"
+
+async function newStore() {
+  const dir = await mkdtemp(path.join(tmpdir(), "kanna-mcp-read-"))
+  const store = createTestEventStore(dir)
+  await store.initialize()
+  const cleanup = async () => {
+    await new Promise<void>((r) => setTimeout(r, 50))
+    await rm(dir, { recursive: true, force: true })
+  }
+  return { store, dir, cleanup }
+}
+
+const ctx = (cwd: string) => ({
+  chatId: "c",
+  sessionId: "s",
+  toolUseId: "tu",
+  cwd,
+  chatPolicy: { ...POLICY_DEFAULT, defaultAction: "auto-allow" as const },
+})
+
+describe("mcp__kanna__read", () => {
+  test("reads existing file → content in result, no isError", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createReadTool({ toolCallback: svc })
+      const filePath = path.join(dir, "hello.txt")
+      await writeFile(filePath, "hello world")
+      const result = await tool.handler({ path: filePath }, ctx(dir))
+      expect(result.isError).toBeFalsy()
+      expect(result.content[0].text).toBe("hello world")
+    } finally { await cleanup() }
+  }, 30_000)
+
+  test("path in readPathDeny (~/.ssh/id_rsa) → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createReadTool({ toolCallback: svc })
+      const result = await tool.handler({ path: "~/.ssh/id_rsa" }, ctx(dir))
+      expect(result.isError).toBe(true)
+    } finally { await cleanup() }
+  }, 30_000)
+
+  test("missing file → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createReadTool({ toolCallback: svc })
+      const result = await tool.handler({ path: path.join(dir, "does-not-exist.txt") }, ctx(dir))
+      expect(result.isError).toBe(true)
+    } finally { await cleanup() }
+  }, 30_000)
+})

package/src/server/claude-pty-mcp/tools/tool-callback-shim.ts

@@ -0,0 +1,42 @@
+import type { ToolCallbackService } from "../../claude-pty/tool-callback"
+import type { ChatPermissionPolicy } from "../../../shared/permission-policy"
+
+export interface ToolHandlerContext {
+  chatId: string
+  sessionId: string
+  toolUseId: string
+  cwd: string
+  chatPolicy: ChatPermissionPolicy
+}
+
+export interface ToolHandlerResult {
+  // Index signature required to satisfy MCP CallToolResult shape
+  [key: string]: unknown
+  content: { type: "text"; text: string }[]
+  isError?: boolean
+}
+
+export interface GatedToolCallArgs {
+  toolCallback: ToolCallbackService
+  toolName: string
+  ctx: ToolHandlerContext
+  args: Record<string, unknown>
+  formatAnswer: (payload: unknown) => ToolHandlerResult | Promise<ToolHandlerResult>
+  formatDeny: (reason: string) => ToolHandlerResult
+}
+
+export async function gatedToolCall(args: GatedToolCallArgs): Promise<ToolHandlerResult> {
+  const res = await args.toolCallback.submit({
+    chatId: args.ctx.chatId,
+    sessionId: args.ctx.sessionId,
+    toolUseId: args.ctx.toolUseId,
+    toolName: args.toolName,
+    args: args.args,
+    chatPolicy: args.ctx.chatPolicy,
+    cwd: args.ctx.cwd,
+  })
+  if (res.decision.kind === "allow" || res.decision.kind === "answer") {
+    return await args.formatAnswer(res.decision.payload)
+  }
+  return args.formatDeny(res.decision.reason ?? "denied")
+}

package/src/server/claude-pty-mcp/tools/webfetch.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtemp, rm } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { POLICY_DEFAULT } from "../../../shared/permission-policy"
+import { createToolCallbackService } from "../../claude-pty/tool-callback"
+import { createTestEventStore } from "../../storage/test-helpers"
+import { createWebFetchTool } from "./webfetch"
+
+async function newStore() {
+  const dir = await mkdtemp(path.join(tmpdir(), "kanna-mcp-webfetch-"))
+  const store = createTestEventStore(dir)
+  await store.initialize()
+  const cleanup = async () => {
+    await new Promise<void>((r) => setTimeout(r, 50))
+    await rm(dir, { recursive: true, force: true })
+  }
+  return { store, dir, cleanup }
+}
+
+const ctx = (cwd: string) => ({
+  chatId: "c",
+  sessionId: "s",
+  toolUseId: "tu",
+  cwd,
+  chatPolicy: { ...POLICY_DEFAULT, defaultAction: "auto-allow" as const },
+})
+
+describe("mcp__kanna__webfetch", () => {
+  test("fetches local server → result contains response body", async () => {
+    const { store, dir, cleanup } = await newStore()
+    const server = Bun.serve({
+      port: 0,
+      fetch() {
+        return new Response("hello from server", { status: 200 })
+      },
+    })
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createWebFetchTool({ toolCallback: svc })
+      const result = await tool.handler({ url: `http://localhost:${server.port}/` }, ctx(dir))
+      expect(result.isError).toBeFalsy()
+      expect(result.content[0].text).toContain("hello from server")
+    } finally {
+      server.stop()
+      await cleanup()
+    }
+  }, 30_000)
+
+  test("bad URL → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createWebFetchTool({ toolCallback: svc })
+      const result = await tool.handler({ url: "not-a-url" }, ctx(dir))
+      expect(result.isError).toBe(true)
+    } finally { await cleanup() }
+  }, 30_000)
+
+  test("rejects file:// URL → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createWebFetchTool({ toolCallback: svc })
+      const result = await tool.handler({ url: "file:///etc/passwd" }, ctx(dir))
+      expect(result.isError).toBe(true)
+      expect(result.content[0].text).toContain("scheme file: not allowed")
+    } finally { await cleanup() }
+  }, 30_000)
+
+  test("rejects cloud metadata URL → isError true", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createWebFetchTool({ toolCallback: svc })
+      const result = await tool.handler({ url: "http://169.254.169.254/latest/meta-data/" }, ctx(dir))
+      expect(result.isError).toBe(true)
+      expect(result.content[0].text).toContain("not externally reachable")
+    } finally { await cleanup() }
+  }, 30_000)
+})

package/src/server/claude-pty-mcp/tools/webfetch.ts

@@ -0,0 +1,82 @@
+import { z } from "zod"
+import type { ToolCallbackService } from "../../claude-pty/tool-callback"
+import type { ToolHandlerContext, ToolHandlerResult } from "./tool-callback-shim"
+import { gatedToolCall } from "./tool-callback-shim"
+
+const InputSchema = z.object({
+  url: z.string(),
+})
+
+export type WebFetchInput = z.infer<typeof InputSchema>
+
+export interface WebFetchTool {
+  name: "webfetch"
+  schema: typeof InputSchema
+  handler: (input: WebFetchInput, ctx: ToolHandlerContext) => Promise<ToolHandlerResult>
+}
+
+// Blocked patterns: cloud metadata endpoints and link-local ranges.
+// Loopback/RFC1918 are intentionally allowed since Kanna runs locally and
+// tests use localhost. Cloud metadata endpoints are the real SSRF risk.
+const BLOCKED_HOST_PATTERNS = [
+  /^169\.254\./,
+  /^metadata\.google\.internal$/,
+]
+
+function isSafeUrl(rawUrl: string): { ok: true; url: URL } | { ok: false; reason: string } {
+  let url: URL
+  try {
+    url = new URL(rawUrl)
+  } catch {
+    return { ok: false, reason: "invalid URL" }
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return { ok: false, reason: `scheme ${url.protocol} not allowed` }
+  }
+  const host = url.hostname.toLowerCase()
+  for (const re of BLOCKED_HOST_PATTERNS) {
+    if (re.test(host)) return { ok: false, reason: `host ${host} is not externally reachable` }
+  }
+  return { ok: true, url }
+}
+
+export function createWebFetchTool(deps: { toolCallback: ToolCallbackService }): WebFetchTool {
+  return {
+    name: "webfetch",
+    schema: InputSchema,
+    async handler(input, ctx) {
+      return gatedToolCall({
+        toolCallback: deps.toolCallback,
+        toolName: "mcp__kanna__webfetch",
+        ctx,
+        args: input as unknown as Record<string, unknown>,
+        formatAnswer: async () => {
+          const check = isSafeUrl(input.url)
+          if (!check.ok) {
+            return {
+              content: [{ type: "text" as const, text: `Error: ${check.reason}` }],
+              isError: true,
+            }
+          }
+          try {
+            const res = await fetch(input.url)
+            const text = await res.text()
+            return {
+              content: [{ type: "text" as const, text: `Status: ${res.status}\n\n${text}` }],
+            }
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err)
+            return {
+              content: [{ type: "text" as const, text: `Error fetching URL: ${msg}` }],
+              isError: true,
+            }
+          }
+        },
+        formatDeny: (reason) => ({
+          content: [{ type: "text" as const, text: `Denied: ${reason}` }],
+          isError: true,
+        }),
+      })
+    },
+  }
+}

package/src/server/claude-pty-mcp/tools/websearch.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from "bun:test"
+import { mkdtemp, rm } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import path from "node:path"
+import { POLICY_DEFAULT } from "../../../shared/permission-policy"
+import { createToolCallbackService } from "../../claude-pty/tool-callback"
+import { createTestEventStore } from "../../storage/test-helpers"
+import { createWebSearchTool } from "./websearch"
+
+async function newStore() {
+  const dir = await mkdtemp(path.join(tmpdir(), "kanna-mcp-websearch-"))
+  const store = createTestEventStore(dir)
+  await store.initialize()
+  const cleanup = async () => {
+    await new Promise<void>((r) => setTimeout(r, 50))
+    await rm(dir, { recursive: true, force: true })
+  }
+  return { store, dir, cleanup }
+}
+
+const ctx = (cwd: string) => ({
+  chatId: "c",
+  sessionId: "s",
+  toolUseId: "tu",
+  cwd,
+  chatPolicy: { ...POLICY_DEFAULT, defaultAction: "auto-allow" as const },
+})
+
+describe("mcp__kanna__websearch", () => {
+  test("always returns isError + message contains 'unavailable'", async () => {
+    const { store, dir, cleanup } = await newStore()
+    try {
+      const svc = createToolCallbackService({ store, serverSecret: "k", now: () => 1, timeoutMs: 600_000 })
+      const tool = createWebSearchTool({ toolCallback: svc })
+      const result = await tool.handler({ query: "some search query" }, ctx(dir))
+      expect(result.isError).toBe(true)
+      expect(result.content[0].text).toContain("unavailable")
+    } finally { await cleanup() }
+  }, 30_000)
+})

package/src/server/claude-pty-mcp/tools/websearch.ts

@@ -0,0 +1,42 @@
+import { z } from "zod"
+import type { ToolCallbackService } from "../../claude-pty/tool-callback"
+import type { ToolHandlerContext, ToolHandlerResult } from "./tool-callback-shim"
+import { gatedToolCall } from "./tool-callback-shim"
+
+const InputSchema = z.object({
+  query: z.string(),
+})
+
+export type WebSearchInput = z.infer<typeof InputSchema>
+
+export interface WebSearchTool {
+  name: "websearch"
+  schema: typeof InputSchema
+  handler: (input: WebSearchInput, ctx: ToolHandlerContext) => Promise<ToolHandlerResult>
+}
+
+export function createWebSearchTool(deps: { toolCallback: ToolCallbackService }): WebSearchTool {
+  return {
+    name: "websearch",
+    schema: InputSchema,
+    async handler(input, ctx) {
+      return gatedToolCall({
+        toolCallback: deps.toolCallback,
+        toolName: "mcp__kanna__websearch",
+        ctx,
+        args: input as unknown as Record<string, unknown>,
+        formatAnswer: async () => ({
+          content: [{
+            type: "text" as const,
+            text: "WebSearch unavailable in this environment. Use mcp__kanna__webfetch with a specific URL if you already know the target.",
+          }],
+          isError: true,
+        }),
+        formatDeny: (reason) => ({
+          content: [{ type: "text" as const, text: `Denied: ${reason}` }],
+          isError: true,
+        }),
+      })
+    },
+  }
+}