cowork-os 0.3.21

package/dist/electron/electron/utils/process.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * Process Utilities
+ *
+ * Helper functions for executing external commands.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkBinaryExists = checkBinaryExists;
+exports.runCommand = runCommand;
+exports.runShellCommand = runShellCommand;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const execAsync = (0, util_1.promisify)(child_process_1.exec);
+/**
+ * Check if a binary exists in PATH
+ */
+async function checkBinaryExists(binary) {
+    try {
+        const command = process.platform === 'win32' ? `where ${binary}` : `which ${binary}`;
+        await execAsync(command);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Run a command with timeout
+ */
+async function runCommand(command, args, options = {}) {
+    const { timeoutMs = 30000, cwd, env } = options;
+    return new Promise((resolve) => {
+        let stdout = '';
+        let stderr = '';
+        let resolved = false;
+        const child = (0, child_process_1.spawn)(command, args, {
+            cwd,
+            env: env ? { ...process.env, ...env } : process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        const timeout = setTimeout(() => {
+            if (resolved)
+                return;
+            resolved = true;
+            child.kill('SIGKILL');
+            resolve({
+                code: -1,
+                stdout,
+                stderr: stderr || 'Command timed out',
+            });
+        }, timeoutMs);
+        child.stdout?.on('data', (data) => {
+            stdout += data.toString();
+        });
+        child.stderr?.on('data', (data) => {
+            stderr += data.toString();
+        });
+        child.on('error', (err) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timeout);
+            resolve({
+                code: -1,
+                stdout,
+                stderr: err.message,
+            });
+        });
+        child.on('exit', (code) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timeout);
+            resolve({
+                code: code ?? -1,
+                stdout,
+                stderr,
+            });
+        });
+    });
+}
+/**
+ * Run a shell command (with shell expansion)
+ */
+async function runShellCommand(command, options = {}) {
+    const { timeoutMs = 30000, cwd, env } = options;
+    try {
+        const { stdout, stderr } = await execAsync(command, {
+            cwd,
+            env: env ? { ...process.env, ...env } : process.env,
+            timeout: timeoutMs,
+        });
+        return { code: 0, stdout, stderr };
+    }
+    catch (error) {
+        return {
+            code: error.code ?? -1,
+            stdout: error.stdout ?? '',
+            stderr: error.stderr ?? error.message ?? String(error),
+        };
+    }
+}

package/dist/electron/electron/utils/rate-limiter.js

@@ -0,0 +1,104 @@
+"use strict";
+/**
+ * Simple in-memory rate limiter for IPC handlers
+ * Prevents abuse by limiting call frequency per channel
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rateLimiter = exports.RATE_LIMIT_CONFIGS = void 0;
+exports.withRateLimit = withRateLimit;
+// Default configurations for different handler types
+exports.RATE_LIMIT_CONFIGS = {
+    // Expensive operations (LLM calls, task creation)
+    expensive: { maxRequests: 10, windowMs: 60000 }, // 10 per minute
+    // Standard operations (most handlers)
+    standard: { maxRequests: 60, windowMs: 60000 }, // 60 per minute
+    // High-frequency operations (UI updates, status checks)
+    frequent: { maxRequests: 300, windowMs: 60000 }, // 300 per minute
+    // Very limited (settings save, credential operations)
+    limited: { maxRequests: 5, windowMs: 60000 }, // 5 per minute
+};
+class RateLimiter {
+    constructor() {
+        this.limits = new Map();
+        this.configs = new Map();
+    }
+    /**
+     * Configure rate limit for a specific channel
+     */
+    configure(channel, config) {
+        this.configs.set(channel, config);
+    }
+    /**
+     * Check if request should be allowed
+     * Returns true if allowed, false if rate limited
+     */
+    check(channel) {
+        const config = this.configs.get(channel) || exports.RATE_LIMIT_CONFIGS.standard;
+        const now = Date.now();
+        const entry = this.limits.get(channel);
+        if (!entry || now >= entry.resetTime) {
+            // First request or window expired - start new window
+            this.limits.set(channel, {
+                count: 1,
+                resetTime: now + config.windowMs,
+            });
+            return true;
+        }
+        if (entry.count >= config.maxRequests) {
+            // Rate limit exceeded
+            return false;
+        }
+        // Increment count
+        entry.count++;
+        return true;
+    }
+    /**
+     * Get remaining requests for a channel
+     */
+    getRemaining(channel) {
+        const config = this.configs.get(channel) || exports.RATE_LIMIT_CONFIGS.standard;
+        const entry = this.limits.get(channel);
+        if (!entry || Date.now() >= entry.resetTime) {
+            return config.maxRequests;
+        }
+        return Math.max(0, config.maxRequests - entry.count);
+    }
+    /**
+     * Get time until rate limit resets (in ms)
+     */
+    getResetTime(channel) {
+        const entry = this.limits.get(channel);
+        if (!entry)
+            return 0;
+        const remaining = entry.resetTime - Date.now();
+        return Math.max(0, remaining);
+    }
+    /**
+     * Clear rate limit for a channel (for testing)
+     */
+    reset(channel) {
+        this.limits.delete(channel);
+    }
+    /**
+     * Clear all rate limits
+     */
+    resetAll() {
+        this.limits.clear();
+    }
+}
+// Singleton instance
+exports.rateLimiter = new RateLimiter();
+/**
+ * Helper to wrap an IPC handler with rate limiting
+ */
+function withRateLimit(channel, handler, config = exports.RATE_LIMIT_CONFIGS.standard) {
+    exports.rateLimiter.configure(channel, config);
+    return (async (...args) => {
+        if (!exports.rateLimiter.check(channel)) {
+            const resetMs = exports.rateLimiter.getResetTime(channel);
+            const resetSec = Math.ceil(resetMs / 1000);
+            throw new Error(`Rate limit exceeded for ${channel}. Try again in ${resetSec} seconds.`);
+        }
+        return handler(...args);
+    });
+}

package/dist/electron/electron/utils/validation.js

@@ -0,0 +1,419 @@
+"use strict";
+/**
+ * Input validation schemas for IPC handlers using Zod
+ * Provides type-safe validation to prevent malformed input attacks
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCPRegistrySearchSchema = exports.MCPSettingsSchema = exports.MCPServerUpdateSchema = exports.MCPServerConfigSchema = exports.MCPAuthConfigSchema = exports.MCPTransportTypeSchema = exports.StringIdSchema = exports.UUIDSchema = exports.FilePathSchema = exports.GeneratePairingSchema = exports.RevokeAccessSchema = exports.GrantAccessSchema = exports.UpdateChannelSchema = exports.ChannelConfigSchema = exports.AddChannelSchema = exports.AddEmailChannelSchema = exports.AddBlueBubblesChannelSchema = exports.AddLineChannelSchema = exports.AddTwitchChannelSchema = exports.AddMatrixChannelSchema = exports.AddMattermostChannelSchema = exports.AddSignalChannelSchema = exports.AddImessageChannelSchema = exports.SignalTrustModeSchema = exports.SignalModeSchema = exports.GroupPolicySchema = exports.DmPolicySchema = exports.AddWhatsAppChannelSchema = exports.AddSlackChannelSchema = exports.AddDiscordChannelSchema = exports.AddTelegramChannelSchema = exports.SecurityModeSchema = exports.GuardrailSettingsSchema = exports.XSettingsSchema = exports.SearchSettingsSchema = exports.SearchProviderTypeSchema = exports.LLMSettingsSchema = exports.OpenAISettingsSchema = exports.OpenRouterSettingsSchema = exports.GeminiSettingsSchema = exports.OllamaSettingsSchema = exports.BedrockSettingsSchema = exports.AnthropicSettingsSchema = exports.LLMProviderTypeSchema = exports.ApprovalResponseSchema = exports.TaskMessageSchema = exports.TaskRenameSchema = exports.TaskCreateSchema = exports.SuccessCriteriaSchema = exports.WorkspaceCreateSchema = void 0;
+exports.HookMappingSchema = exports.HookMappingChannelSchema = void 0;
+exports.validateInput = validateInput;
+const zod_1 = require("zod");
+// Common validation patterns
+const MAX_STRING_LENGTH = 10000;
+const MAX_PATH_LENGTH = 4096;
+const MAX_TITLE_LENGTH = 500;
+const MAX_PROMPT_LENGTH = 100000;
+// ============ Workspace Schemas ============
+exports.WorkspaceCreateSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    path: zod_1.z.string().min(1).max(MAX_PATH_LENGTH),
+    permissions: zod_1.z.object({
+        read: zod_1.z.boolean().default(true),
+        write: zod_1.z.boolean().default(true),
+        delete: zod_1.z.boolean().default(false),
+        network: zod_1.z.boolean().default(false),
+        shell: zod_1.z.boolean().default(false),
+        // Broader filesystem access
+        unrestrictedFileAccess: zod_1.z.boolean().default(false),
+        allowedPaths: zod_1.z.array(zod_1.z.string().max(MAX_PATH_LENGTH)).max(50).optional(),
+    }).optional(),
+});
+// ============ Task Schemas ============
+exports.SuccessCriteriaSchema = zod_1.z.object({
+    type: zod_1.z.enum(['shell_command', 'file_exists']),
+    command: zod_1.z.string().max(5000).optional(),
+    filePaths: zod_1.z.array(zod_1.z.string().max(MAX_PATH_LENGTH)).max(20).optional(),
+});
+// TEMP_WORKSPACE_ID constant for validation
+const TEMP_WORKSPACE_ID = '__temp_workspace__';
+exports.TaskCreateSchema = zod_1.z.object({
+    title: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    prompt: zod_1.z.string().min(1).max(MAX_PROMPT_LENGTH),
+    workspaceId: zod_1.z.string().refine((val) => val === TEMP_WORKSPACE_ID || zod_1.z.string().uuid().safeParse(val).success, { message: 'Must be a valid UUID or temp workspace ID' }),
+    budgetTokens: zod_1.z.number().int().positive().optional(),
+    budgetCost: zod_1.z.number().positive().optional(),
+    // Goal Mode fields
+    successCriteria: exports.SuccessCriteriaSchema.optional(),
+    maxAttempts: zod_1.z.number().int().min(1).max(10).optional(),
+});
+exports.TaskRenameSchema = zod_1.z.object({
+    id: zod_1.z.string().uuid(),
+    title: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+});
+exports.TaskMessageSchema = zod_1.z.object({
+    taskId: zod_1.z.string().uuid(),
+    message: zod_1.z.string().min(1).max(MAX_PROMPT_LENGTH),
+});
+// ============ Approval Schemas ============
+exports.ApprovalResponseSchema = zod_1.z.object({
+    approvalId: zod_1.z.string().uuid(),
+    approved: zod_1.z.boolean(),
+});
+// ============ LLM Settings Schemas ============
+exports.LLMProviderTypeSchema = zod_1.z.enum(['anthropic', 'bedrock', 'ollama', 'gemini', 'openrouter', 'openai']);
+exports.AnthropicSettingsSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().max(500).optional(),
+}).optional();
+exports.BedrockSettingsSchema = zod_1.z.object({
+    region: zod_1.z.string().max(100).optional(),
+    accessKeyId: zod_1.z.string().max(500).optional(),
+    secretAccessKey: zod_1.z.string().max(500).optional(),
+    sessionToken: zod_1.z.string().max(2000).optional(),
+    profile: zod_1.z.string().max(100).optional(),
+    useDefaultCredentials: zod_1.z.boolean().optional(),
+    model: zod_1.z.string().max(200).optional(),
+}).optional();
+exports.OllamaSettingsSchema = zod_1.z.object({
+    baseUrl: zod_1.z.string().url().max(500).optional(),
+    model: zod_1.z.string().max(200).optional(),
+    apiKey: zod_1.z.string().max(500).optional(),
+}).optional();
+exports.GeminiSettingsSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().max(500).optional(),
+    model: zod_1.z.string().max(200).optional(),
+}).optional();
+exports.OpenRouterSettingsSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().max(500).optional(),
+    model: zod_1.z.string().max(200).optional(),
+}).optional();
+exports.OpenAISettingsSchema = zod_1.z.object({
+    apiKey: zod_1.z.string().max(500).optional(),
+    model: zod_1.z.string().max(200).optional(),
+    // OAuth tokens (alternative to API key)
+    accessToken: zod_1.z.string().max(2000).optional(),
+    refreshToken: zod_1.z.string().max(2000).optional(),
+    tokenExpiresAt: zod_1.z.number().optional(),
+    authMethod: zod_1.z.enum(['api_key', 'oauth']).optional(),
+}).optional();
+exports.LLMSettingsSchema = zod_1.z.object({
+    providerType: exports.LLMProviderTypeSchema,
+    modelKey: zod_1.z.string().max(200),
+    anthropic: exports.AnthropicSettingsSchema,
+    bedrock: exports.BedrockSettingsSchema,
+    ollama: exports.OllamaSettingsSchema,
+    gemini: exports.GeminiSettingsSchema,
+    openrouter: exports.OpenRouterSettingsSchema,
+    openai: exports.OpenAISettingsSchema,
+});
+// ============ Search Settings Schemas ============
+exports.SearchProviderTypeSchema = zod_1.z.enum(['tavily', 'brave', 'serpapi', 'google']).nullable();
+exports.SearchSettingsSchema = zod_1.z.object({
+    primaryProvider: exports.SearchProviderTypeSchema,
+    fallbackProvider: exports.SearchProviderTypeSchema,
+    tavily: zod_1.z.object({
+        apiKey: zod_1.z.string().max(500).optional(),
+    }).optional(),
+    brave: zod_1.z.object({
+        apiKey: zod_1.z.string().max(500).optional(),
+    }).optional(),
+    serpapi: zod_1.z.object({
+        apiKey: zod_1.z.string().max(500).optional(),
+    }).optional(),
+    google: zod_1.z.object({
+        apiKey: zod_1.z.string().max(500).optional(),
+        searchEngineId: zod_1.z.string().max(500).optional(),
+    }).optional(),
+});
+// ============ X/Twitter Settings Schema ============
+exports.XSettingsSchema = zod_1.z.object({
+    enabled: zod_1.z.boolean().default(false),
+    authMethod: zod_1.z.enum(['browser', 'manual']).default('browser'),
+    authToken: zod_1.z.string().max(2000).optional(),
+    ct0: zod_1.z.string().max(2000).optional(),
+    cookieSource: zod_1.z.array(zod_1.z.string().max(50)).max(10).optional(),
+    chromeProfile: zod_1.z.string().max(200).optional(),
+    chromeProfileDir: zod_1.z.string().max(MAX_PATH_LENGTH).optional(),
+    firefoxProfile: zod_1.z.string().max(200).optional(),
+    timeoutMs: zod_1.z.number().int().min(1000).max(120000).optional(),
+    cookieTimeoutMs: zod_1.z.number().int().min(1000).max(120000).optional(),
+    quoteDepth: zod_1.z.number().int().min(0).max(5).optional(),
+});
+// ============ Guardrail Settings Schema ============
+exports.GuardrailSettingsSchema = zod_1.z.object({
+    // Token budget
+    maxTokensPerTask: zod_1.z.number().int().min(1000).max(10000000).default(100000),
+    tokenBudgetEnabled: zod_1.z.boolean().default(true),
+    // Cost budget
+    maxCostPerTask: zod_1.z.number().min(0.01).max(100).default(1.00),
+    costBudgetEnabled: zod_1.z.boolean().default(false),
+    // Dangerous commands
+    blockDangerousCommands: zod_1.z.boolean().default(true),
+    customBlockedPatterns: zod_1.z.array(zod_1.z.string().max(500)).max(50).default([]),
+    // Auto-approve trusted commands
+    autoApproveTrustedCommands: zod_1.z.boolean().default(false),
+    trustedCommandPatterns: zod_1.z.array(zod_1.z.string().max(500)).max(100).default([]),
+    // File size
+    maxFileSizeMB: zod_1.z.number().int().min(1).max(500).default(50),
+    fileSizeLimitEnabled: zod_1.z.boolean().default(true),
+    // Network domains
+    enforceAllowedDomains: zod_1.z.boolean().default(false),
+    allowedDomains: zod_1.z.array(zod_1.z.string().max(255)).max(100).default([]),
+    // Iterations
+    maxIterationsPerTask: zod_1.z.number().int().min(5).max(500).default(50),
+    iterationLimitEnabled: zod_1.z.boolean().default(true),
+});
+// ============ Gateway/Channel Schemas ============
+exports.SecurityModeSchema = zod_1.z.enum(['pairing', 'allowlist', 'open']);
+exports.AddTelegramChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('telegram'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    botToken: zod_1.z.string().min(1).max(500),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddDiscordChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('discord'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    botToken: zod_1.z.string().min(1).max(500),
+    applicationId: zod_1.z.string().min(1).max(100),
+    guildIds: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddSlackChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('slack'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    botToken: zod_1.z.string().min(1).max(500),
+    appToken: zod_1.z.string().min(1).max(500),
+    signingSecret: zod_1.z.string().max(500).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddWhatsAppChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('whatsapp'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    allowedNumbers: zod_1.z.array(zod_1.z.string().max(20)).max(100).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+    selfChatMode: zod_1.z.boolean().optional(),
+    responsePrefix: zod_1.z.string().max(20).optional(),
+});
+exports.DmPolicySchema = zod_1.z.enum(['open', 'allowlist', 'pairing', 'disabled']);
+exports.GroupPolicySchema = zod_1.z.enum(['open', 'allowlist', 'disabled']);
+exports.SignalModeSchema = zod_1.z.enum(['native', 'daemon']);
+exports.SignalTrustModeSchema = zod_1.z.enum(['tofu', 'always', 'manual']);
+exports.AddImessageChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('imessage'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    cliPath: zod_1.z.string().max(500).optional(),
+    dbPath: zod_1.z.string().max(500).optional(),
+    allowedContacts: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+    dmPolicy: exports.DmPolicySchema.optional(),
+    groupPolicy: exports.GroupPolicySchema.optional(),
+    responsePrefix: zod_1.z.string().max(20).optional(),
+});
+exports.AddSignalChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('signal'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    phoneNumber: zod_1.z.string().min(1).max(20),
+    dataDir: zod_1.z.string().max(MAX_PATH_LENGTH).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+    mode: exports.SignalModeSchema.optional(),
+    trustMode: exports.SignalTrustModeSchema.optional(),
+    dmPolicy: exports.DmPolicySchema.optional(),
+    groupPolicy: exports.GroupPolicySchema.optional(),
+    sendReadReceipts: zod_1.z.boolean().optional(),
+    sendTypingIndicators: zod_1.z.boolean().optional(),
+});
+exports.AddMattermostChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('mattermost'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    mattermostServerUrl: zod_1.z.string().url().min(1).max(500),
+    mattermostToken: zod_1.z.string().min(1).max(500),
+    mattermostTeamId: zod_1.z.string().max(100).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddMatrixChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('matrix'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    matrixHomeserver: zod_1.z.string().url().min(1).max(500),
+    matrixUserId: zod_1.z.string().min(1).max(200),
+    matrixAccessToken: zod_1.z.string().min(1).max(1000),
+    matrixDeviceId: zod_1.z.string().max(200).optional(),
+    matrixRoomIds: zod_1.z.array(zod_1.z.string().max(200)).max(100).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddTwitchChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('twitch'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    twitchUsername: zod_1.z.string().min(1).max(100),
+    twitchOauthToken: zod_1.z.string().min(1).max(500),
+    twitchChannels: zod_1.z.array(zod_1.z.string().max(100)).min(1).max(50),
+    twitchAllowWhispers: zod_1.z.boolean().optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddLineChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('line'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    lineChannelAccessToken: zod_1.z.string().min(1).max(500),
+    lineChannelSecret: zod_1.z.string().min(1).max(200),
+    lineWebhookPort: zod_1.z.number().int().min(1024).max(65535).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddBlueBubblesChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('bluebubbles'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    blueBubblesServerUrl: zod_1.z.string().url().min(1).max(500),
+    blueBubblesPassword: zod_1.z.string().min(1).max(500),
+    blueBubblesWebhookPort: zod_1.z.number().int().min(1024).max(65535).optional(),
+    blueBubblesAllowedContacts: zod_1.z.array(zod_1.z.string().max(100)).max(100).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddEmailChannelSchema = zod_1.z.object({
+    type: zod_1.z.literal('email'),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH),
+    emailAddress: zod_1.z.string().email().min(1).max(200),
+    emailPassword: zod_1.z.string().min(1).max(500),
+    emailImapHost: zod_1.z.string().min(1).max(200),
+    emailImapPort: zod_1.z.number().int().min(1).max(65535).optional(),
+    emailSmtpHost: zod_1.z.string().min(1).max(200),
+    emailSmtpPort: zod_1.z.number().int().min(1).max(65535).optional(),
+    emailDisplayName: zod_1.z.string().max(100).optional(),
+    emailAllowedSenders: zod_1.z.array(zod_1.z.string().max(200)).max(100).optional(),
+    emailSubjectFilter: zod_1.z.string().max(200).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+});
+exports.AddChannelSchema = zod_1.z.discriminatedUnion('type', [
+    exports.AddTelegramChannelSchema,
+    exports.AddDiscordChannelSchema,
+    exports.AddSlackChannelSchema,
+    exports.AddWhatsAppChannelSchema,
+    exports.AddImessageChannelSchema,
+    exports.AddSignalChannelSchema,
+    exports.AddMattermostChannelSchema,
+    exports.AddMatrixChannelSchema,
+    exports.AddTwitchChannelSchema,
+    exports.AddLineChannelSchema,
+    exports.AddBlueBubblesChannelSchema,
+    exports.AddEmailChannelSchema,
+]);
+exports.ChannelConfigSchema = zod_1.z.object({
+    selfChatMode: zod_1.z.boolean().optional(),
+    responsePrefix: zod_1.z.string().max(20).optional(),
+}).passthrough(); // Allow additional properties
+exports.UpdateChannelSchema = zod_1.z.object({
+    id: zod_1.z.string().uuid(),
+    name: zod_1.z.string().min(1).max(MAX_TITLE_LENGTH).optional(),
+    securityMode: exports.SecurityModeSchema.optional(),
+    config: exports.ChannelConfigSchema.optional(),
+});
+exports.GrantAccessSchema = zod_1.z.object({
+    channelId: zod_1.z.string().uuid(),
+    userId: zod_1.z.string().min(1).max(100),
+    displayName: zod_1.z.string().max(MAX_TITLE_LENGTH).optional(),
+});
+exports.RevokeAccessSchema = zod_1.z.object({
+    channelId: zod_1.z.string().uuid(),
+    userId: zod_1.z.string().min(1).max(100),
+});
+exports.GeneratePairingSchema = zod_1.z.object({
+    channelId: zod_1.z.string().uuid(),
+    userId: zod_1.z.string().max(100).optional(),
+    displayName: zod_1.z.string().max(MAX_TITLE_LENGTH).optional(),
+});
+// ============ File Operation Schemas ============
+exports.FilePathSchema = zod_1.z.object({
+    filePath: zod_1.z.string().min(1).max(MAX_PATH_LENGTH),
+    workspacePath: zod_1.z.string().min(1).max(MAX_PATH_LENGTH),
+});
+// ============ ID Schemas (for simple string ID params) ============
+exports.UUIDSchema = zod_1.z.string().uuid();
+exports.StringIdSchema = zod_1.z.string().min(1).max(100);
+// ============ MCP (Model Context Protocol) Schemas ============
+exports.MCPTransportTypeSchema = zod_1.z.enum(['stdio', 'sse', 'websocket']);
+exports.MCPAuthConfigSchema = zod_1.z.object({
+    type: zod_1.z.enum(['none', 'bearer', 'api-key', 'basic']),
+    token: zod_1.z.string().max(2000).optional(),
+    apiKey: zod_1.z.string().max(2000).optional(),
+    username: zod_1.z.string().max(500).optional(),
+    password: zod_1.z.string().max(500).optional(),
+    headerName: zod_1.z.string().max(100).optional(),
+}).optional();
+exports.MCPServerConfigSchema = zod_1.z.object({
+    id: zod_1.z.string().uuid().optional(), // Optional for create (will be generated)
+    name: zod_1.z.string().min(1).max(200),
+    description: zod_1.z.string().max(1000).optional(),
+    enabled: zod_1.z.boolean().default(true),
+    transport: exports.MCPTransportTypeSchema,
+    // stdio transport config
+    command: zod_1.z.string().max(1000).optional(),
+    args: zod_1.z.array(zod_1.z.string().max(500)).max(50).optional(),
+    env: zod_1.z.record(zod_1.z.string(), zod_1.z.string().max(500)).optional(),
+    cwd: zod_1.z.string().max(MAX_PATH_LENGTH).optional(),
+    // HTTP-based transport config
+    url: zod_1.z.string().url().max(500).optional(),
+    headers: zod_1.z.record(zod_1.z.string(), zod_1.z.string().max(1000)).optional(),
+    // Authentication
+    auth: exports.MCPAuthConfigSchema,
+    // Timeouts
+    connectionTimeout: zod_1.z.number().int().min(1000).max(120000).optional(),
+    requestTimeout: zod_1.z.number().int().min(1000).max(300000).optional(),
+    // Metadata
+    version: zod_1.z.string().max(100).optional(),
+    author: zod_1.z.string().max(200).optional(),
+    homepage: zod_1.z.string().url().max(500).optional(),
+    repository: zod_1.z.string().url().max(500).optional(),
+    license: zod_1.z.string().max(100).optional(),
+});
+exports.MCPServerUpdateSchema = exports.MCPServerConfigSchema.partial().omit({ id: true });
+exports.MCPSettingsSchema = zod_1.z.object({
+    servers: zod_1.z.array(exports.MCPServerConfigSchema).max(50),
+    autoConnect: zod_1.z.boolean().default(true),
+    toolNamePrefix: zod_1.z.string().min(0).max(50).default('mcp_'),
+    maxReconnectAttempts: zod_1.z.number().int().min(0).max(20).default(5),
+    reconnectDelayMs: zod_1.z.number().int().min(100).max(60000).default(1000),
+    registryEnabled: zod_1.z.boolean().default(true),
+    registryUrl: zod_1.z.string().url().max(500).optional(),
+    hostEnabled: zod_1.z.boolean().default(false),
+    hostPort: zod_1.z.number().int().min(1024).max(65535).optional(),
+});
+// MCP Registry schemas
+exports.MCPRegistrySearchSchema = zod_1.z.object({
+    query: zod_1.z.string().max(200).optional(),
+    tags: zod_1.z.array(zod_1.z.string().max(50)).max(20).optional(),
+    limit: zod_1.z.number().int().min(1).max(100).default(50),
+    offset: zod_1.z.number().int().min(0).default(0),
+});
+// ============ Hooks (Webhooks) Schemas ============
+exports.HookMappingChannelSchema = zod_1.z.enum(['telegram', 'discord', 'slack', 'whatsapp', 'imessage', 'signal', 'mattermost', 'matrix', 'twitch', 'line', 'bluebubbles', 'email', 'last']);
+exports.HookMappingSchema = zod_1.z.object({
+    id: zod_1.z.string().max(100).optional(),
+    match: zod_1.z.object({
+        path: zod_1.z.string().max(500).optional(),
+        source: zod_1.z.string().max(100).optional(),
+    }).optional(),
+    action: zod_1.z.enum(['wake', 'agent']).optional(),
+    wakeMode: zod_1.z.enum(['now', 'next-heartbeat']).optional(),
+    name: zod_1.z.string().max(200).optional(),
+    sessionKey: zod_1.z.string().max(100).optional(),
+    messageTemplate: zod_1.z.string().max(10000).optional(),
+    textTemplate: zod_1.z.string().max(10000).optional(),
+    deliver: zod_1.z.boolean().optional(),
+    channel: exports.HookMappingChannelSchema.optional(),
+    to: zod_1.z.string().max(100).optional(),
+    model: zod_1.z.string().max(100).optional(),
+    thinking: zod_1.z.string().max(50).optional(),
+    timeoutSeconds: zod_1.z.number().int().min(1).max(3600).optional(),
+});
+// ============ Validation Helper ============
+/**
+ * Validate input against a schema and throw a user-friendly error if invalid
+ */
+function validateInput(schema, input, context) {
+    const result = schema.safeParse(input);
+    if (!result.success) {
+        // Zod v4 uses 'issues' instead of 'errors'
+        const issues = result.error.issues;
+        const errorMessages = issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join(', ');
+        const prefix = context ? `Invalid ${context}: ` : 'Invalid input: ';
+        throw new Error(`${prefix}${errorMessages}`);
+    }
+    return result.data;
+}