deepseek-coder-cli 1.0.0

package/dist/utils/securityUtils.js

@@ -0,0 +1,324 @@
+/**
+ * Security Utilities for AGI Core
+ * Comprehensive security validation, sanitization, and safe execution utilities
+ */
+import { spawnSync } from 'node:child_process';
+import { URL } from 'node:url';
+import { logDebug } from './debugLogger.js';
+/**
+ * Validate target hostname, IP address, or domain
+ * Prevents command injection and path traversal
+ */
+export function validateTarget(target) {
+    if (typeof target !== 'string') {
+        return { valid: false, reason: 'Target must be a string' };
+    }
+    if (target.length > 253) {
+        return { valid: false, reason: 'Target too long (max 253 characters)' };
+    }
+    // Allow IP addresses (IPv4 and IPv6), hostnames, but no shell metacharacters
+    const validTargetRegex = /^[a-zA-Z0-9.\-:_[\]]+$/;
+    if (!validTargetRegex.test(target)) {
+        return { valid: false, reason: 'Target contains invalid characters' };
+    }
+    // Disallow localhost/private IPs unless explicitly allowed (add config flag if needed)
+    const privateIPRegex = /^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|::1|localhost)/;
+    if (privateIPRegex.test(target.toLowerCase())) {
+        console.warn(`Security warning: Scanning private/localhost target ${target}`);
+    }
+    return { valid: true };
+}
+/**
+ * Validate port numbers and ranges
+ */
+export function validatePorts(ports) {
+    if (typeof ports !== 'string') {
+        return { valid: false, reason: 'Ports must be a string' };
+    }
+    const portList = ports.split(',');
+    for (const port of portList) {
+        if (port.includes('-')) {
+            // Handle port ranges like "1-1000"
+            const [start, end] = port.split('-').map(p => parseInt(p.trim(), 10));
+            if (isNaN(start) || isNaN(end) || start < 1 || end > 65535 || start > end) {
+                return { valid: false, reason: `Invalid port range: ${port}` };
+            }
+        }
+        else {
+            const portNum = parseInt(port.trim(), 10);
+            if (isNaN(portNum) || portNum < 1 || portNum > 65535) {
+                return { valid: false, reason: `Invalid port: ${port}` };
+            }
+        }
+    }
+    return { valid: true };
+}
+/**
+ * Validate and sanitize URL
+ */
+export function validateUrl(url) {
+    try {
+        const parsed = new URL(url);
+        // Validate protocol
+        if (!['http:', 'https:'].includes(parsed.protocol)) {
+            return { valid: false, reason: `Unsupported protocol: ${parsed.protocol}` };
+        }
+        // Validate hostname
+        const hostnameValidation = validateTarget(parsed.hostname);
+        if (!hostnameValidation.valid) {
+            return { valid: false, reason: hostnameValidation.reason };
+        }
+        // Sanitize path (basic prevention of directory traversal in URL)
+        const sanitizedPath = parsed.pathname.replace(/\.\.\//g, '').replace(/\/\/+/g, '/');
+        return {
+            valid: true,
+            sanitized: `${parsed.protocol}//${parsed.hostname}${sanitizedPath}${parsed.search}${parsed.hash}`
+        };
+    }
+    catch (error) {
+        return { valid: false, reason: 'Invalid URL format' };
+    }
+}
+/**
+ * Safe command execution wrapper
+ * Uses spawnSync with array arguments, never shell mode
+ */
+export function safeExecSync(command, args = [], options = {}) {
+    try {
+        const defaultOptions = {
+            encoding: 'utf-8',
+            timeout: 30000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            shell: false, // CRITICAL: Never use shell mode
+        };
+        const mergedOptions = { ...defaultOptions, ...options };
+        const result = spawnSync(command, args, mergedOptions);
+        if (result.error) {
+            return {
+                success: false,
+                stdout: '',
+                stderr: '',
+                error: `Command execution failed: ${result.error.message}`
+            };
+        }
+        return {
+            success: result.status === 0,
+            stdout: result.stdout?.toString() || '',
+            stderr: result.stderr?.toString() || '',
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            stdout: '',
+            stderr: '',
+            error: `Execution error: ${error.message}`
+        };
+    }
+}
+/**
+ * Sanitize user input for shell commands
+ * Escapes shell metacharacters
+ */
+export function sanitizeShellInput(input) {
+    if (typeof input !== 'string')
+        return '';
+    // Escape shell metacharacters
+    return input.replace(/[;&|`$\\'"\n\r]/g, '\\$&');
+}
+/**
+ * Validate and sanitize file path
+ * Prevents directory traversal attacks
+ */
+export function sanitizeFilePath(path) {
+    if (typeof path !== 'string') {
+        return { valid: false, reason: 'Path must be a string' };
+    }
+    // Prevent directory traversal
+    if (path.includes('..') || path.includes('//')) {
+        return { valid: false, reason: 'Path contains directory traversal attempts' };
+    }
+    // Prevent absolute paths to sensitive locations (basic check)
+    const sensitivePaths = ['/etc/', '/var/', '/usr/', '/bin/', '/sbin/', '/root/', '/home/'];
+    const normalizedPath = path.toLowerCase();
+    if (sensitivePaths.some(sp => normalizedPath.startsWith(sp))) {
+        return { valid: false, reason: 'Path points to sensitive system location' };
+    }
+    return { valid: true, sanitized: path };
+}
+/**
+ * Rate limiting and request throttling
+ */
+export class RateLimiter {
+    maxRequests;
+    timeWindowMs;
+    requests = new Map();
+    constructor(maxRequests = 10, timeWindowMs = 60000) {
+        this.maxRequests = maxRequests;
+        this.timeWindowMs = timeWindowMs;
+    }
+    /**
+     * Check if request is allowed
+     */
+    isAllowed(key) {
+        const now = Date.now();
+        const windowStart = now - this.timeWindowMs;
+        let requests = this.requests.get(key) || [];
+        // Clean old requests
+        requests = requests.filter(time => time > windowStart);
+        if (requests.length >= this.maxRequests) {
+            return false;
+        }
+        requests.push(now);
+        this.requests.set(key, requests);
+        // Cleanup old entries periodically
+        if (Math.random() < 0.01) { // 1% chance to cleanup
+            this.cleanup();
+        }
+        return true;
+    }
+    /**
+     * Clean up old request records
+     */
+    cleanup() {
+        const now = Date.now();
+        const windowStart = now - this.timeWindowMs;
+        for (const [key, requests] of this.requests.entries()) {
+            const filtered = requests.filter(time => time > windowStart);
+            if (filtered.length === 0) {
+                this.requests.delete(key);
+            }
+            else {
+                this.requests.set(key, filtered);
+            }
+        }
+    }
+    /**
+     * Get wait time if rate limited
+     */
+    getWaitTime(key) {
+        const requests = this.requests.get(key) || [];
+        if (requests.length < this.maxRequests) {
+            return 0;
+        }
+        const oldest = Math.min(...requests);
+        return Math.max(0, oldest + this.timeWindowMs - Date.now());
+    }
+}
+/**
+ * Secure HTTP request utilities
+ */
+export class SecureHttpClient {
+    rateLimiter = new RateLimiter(50, 60000); // 50 requests per minute
+    async get(url, options = {}) {
+        // Validate URL
+        const urlValidation = validateUrl(url);
+        if (!urlValidation.valid) {
+            return { success: false, error: urlValidation.reason };
+        }
+        // Rate limiting
+        const hostname = new URL(url).hostname;
+        if (!this.rateLimiter.isAllowed(hostname)) {
+            return {
+                success: false,
+                error: `Rate limit exceeded for ${hostname}. Wait ${this.rateLimiter.getWaitTime(hostname)}ms`
+            };
+        }
+        // Use native HTTP/HTTPS modules (implementation would go here)
+        // This is a placeholder for actual HTTP implementation
+        return { success: false, error: 'HTTP client not implemented' };
+    }
+}
+/**
+ * Security policy validator
+ */
+export class SecurityPolicyValidator {
+    defaultContext = {
+        permissions: ['read', 'write', 'execute'],
+        maxExecutionTime: 30000,
+        allowedCommands: ['nmap', 'curl', 'dig', 'sshpass', 'openssl'],
+        allowedHosts: []
+    };
+    validateCommand(command, args, context = {}) {
+        const mergedContext = { ...this.defaultContext, ...context };
+        // Check if command is allowed
+        if (!mergedContext.allowedCommands.includes(command)) {
+            return { allowed: false, reason: `Command ${command} not allowed` };
+        }
+        // Validate arguments for specific commands
+        if (command === 'nmap') {
+            return this.validateNmapArgs(args);
+        }
+        if (command === 'curl') {
+            return this.validateCurlArgs(args);
+        }
+        return { allowed: true };
+    }
+    validateNmapArgs(args) {
+        const allowedOptions = [
+            '-sS', '-sT', '-sV', '-sC', '-O', '-T4', '-T5', '-p', '-p-',
+            '-Pn', '-A', '--script=vuln', '--script=safe', '--open',
+            '--host-timeout', '--max-retries'
+        ];
+        for (const arg of args) {
+            if (arg.startsWith('-p') && !['-p', '-p-'].includes(arg)) {
+                // Validate port specification
+                const ports = arg.substring(2);
+                const portValidation = validatePorts(ports);
+                if (!portValidation.valid) {
+                    return { allowed: false, reason: portValidation.reason };
+                }
+            }
+            else if (!allowedOptions.includes(arg) && !arg.startsWith('--script')) {
+                return { allowed: false, reason: `Disallowed nmap option: ${arg}` };
+            }
+        }
+        return { allowed: true };
+    }
+    validateCurlArgs(args) {
+        for (let i = 0; i < args.length; i++) {
+            const arg = args[i];
+            if (arg === '-X' || arg === '--request') {
+                const method = args[i + 1];
+                if (!['GET', 'POST', 'HEAD', 'OPTIONS'].includes(method?.toUpperCase())) {
+                    return { allowed: false, reason: `Disallowed HTTP method: ${method}` };
+                }
+                i++; // Skip next arg
+            }
+            if (arg.startsWith('http://') || arg.startsWith('https://')) {
+                const urlValidation = validateUrl(arg);
+                if (!urlValidation.valid) {
+                    return { allowed: false, reason: urlValidation.reason };
+                }
+            }
+        }
+        return { allowed: true };
+    }
+}
+/**
+ * Security logger for audit trail
+ */
+export class SecurityLogger {
+    logFile;
+    constructor(logFile) {
+        this.logFile = logFile;
+    }
+    logSecurityEvent(event) {
+        const logEntry = {
+            ...event,
+            timestamp: event.timestamp.toISOString(),
+            ip: this.getClientIp()
+        };
+        // Keep security logging off the main console; emit via debug logger
+        logDebug(`[SECURITY] ${JSON.stringify(logEntry)}`);
+    }
+    getClientIp() {
+        // Placeholder for actual IP detection
+        return '127.0.0.1';
+    }
+}
+// Export singleton instances
+export const securityValidator = new SecurityPolicyValidator();
+export const securityLogger = new SecurityLogger();
+export const globalRateLimiter = new RateLimiter(100, 60000); // 100 requests per minute globally
+//# sourceMappingURL=securityUtils.js.map

package/dist/utils/securityUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityUtils.js","sourceRoot":"","sources":["../../src/utils/securityUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAoB,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAC1E,CAAC;IAED,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;IAClD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACxE,CAAC;IAED,uFAAuF;IACvF,MAAM,cAAc,GAAG,sEAAsE,CAAC;IAC9F,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,mCAAmC;YACnC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;gBAC1E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,IAAI,EAAE,EAAE,CAAC;YACjE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;gBACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,oBAAoB;QACpB,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9E,CAAC;QAED,oBAAoB;QACpB,MAAM,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC;QAC7D,CAAC;QAED,iEAAiE;QACjE,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEpF,OAAO;YACL,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE;SAClG,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OAAiB,EAAE,EACnB,UAA4B,EAAE;IAE9B,IAAI,CAAC;QACH,MAAM,cAAc,GAAqB;YACvC,QAAQ,EAAE,OAAgB;YAC1B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,KAAK,EAAE,KAAK,EAAE,iCAAiC;SAChD,CAAC;QAEF,MAAM,aAAa,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QAExD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAEvD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;aAC3D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;SACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,oBAAoB,KAAK,CAAC,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzC,8BAA8B;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC3D,CAAC;IAED,8BAA8B;IAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAChF,CAAC;IAED,8DAA8D;IAC9D,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IAIZ;IACA;IAJF,QAAQ,GAA0B,IAAI,GAAG,EAAE,CAAC;IAEpD,YACU,cAAsB,EAAE,EACxB,eAAuB,KAAK;QAD5B,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAgB;IACnC,CAAC;IAEJ;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QAE5C,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE5C,qBAAqB;QACrB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC;QAEvD,IAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEjC,mCAAmC;QACnC,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,uBAAuB;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC;YAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,GAAW;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,yBAAyB;IAE3E,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,UAAkE,EAAE;QAMzF,eAAe;QACf,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;QACzD,CAAC;QAED,gBAAgB;QAChB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,2BAA2B,QAAQ,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI;aAC/F,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,uDAAuD;QAEvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAClE,CAAC;CACF;AAaD;;GAEG;AACH,MAAM,OAAO,uBAAuB;IAC1B,cAAc,GAAoB;QACxC,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;QACzC,gBAAgB,EAAE,KAAK;QACvB,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;QAC9D,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,eAAe,CAAC,OAAe,EAAE,IAAc,EAAE,UAAoC,EAAE;QAIrF,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;QAE7D,8BAA8B;QAC9B,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,OAAO,cAAc,EAAE,CAAC;QACtE,CAAC;QAED,2CAA2C;QAC3C,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,MAAM,cAAc,GAAG;YACrB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK;YAC3D,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ;YACvD,gBAAgB,EAAE,eAAe;SAClC,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzD,8BAA8B;gBAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;oBAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,GAAG,EAAE,EAAE,CAAC;YACtE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAEpB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;oBACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,MAAM,EAAE,EAAE,CAAC;gBACzE,CAAC;gBACD,CAAC,EAAE,CAAC,CAAC,gBAAgB;YACvB,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;oBACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,OAAO,CAAU;IAEzB,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,gBAAgB,CAAC,KAShB;QACC,MAAM,QAAQ,GAAG;YACf,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACxC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;SACvB,CAAC;QAEF,oEAAoE;QACpE,QAAQ,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAEO,WAAW;QACjB,sCAAsC;QACtC,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,uBAAuB,EAAE,CAAC;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,mCAAmC"}

package/dist/workspace.d.ts

@@ -0,0 +1,8 @@
+export interface WorkspaceCaptureOptions {
+    treeDepth?: number;
+    maxEntries?: number;
+    docExcerptLimit?: number;
+}
+export declare function resolveWorkspaceCaptureOptions(env?: NodeJS.ProcessEnv): WorkspaceCaptureOptions;
+export declare function buildWorkspaceContext(root: string, options?: WorkspaceCaptureOptions): string | null;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,8BAA8B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,uBAAuB,CAM5G;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,uBAA4B,GAAG,MAAM,GAAG,IAAI,CA4DxG"}

package/dist/workspace.js

@@ -0,0 +1,134 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { safeWorkspaceContext, validateWorkspaceOptions } from './workspace.validator.js';
+const PRIORITY_DOCS = ['README.md']; // Removed package.json to save context
+const IGNORED_DIRS = new Set([
+    '.git', 'node_modules', 'dist', '.agi', 'build', 'coverage', '.next', 'out',
+    '__pycache__', '.pytest_cache', '.mypy_cache', 'venv', '.venv', 'env',
+    'target', 'bin', 'obj', '.idea', '.vscode', '.DS_Store'
+]);
+const IGNORED_FILES = new Set(['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml']);
+const DEFAULT_TREE_DEPTH = 1; // Reduced from 2 to 1 for critical context savings
+const DEFAULT_MAX_ENTRIES = 30; // Further reduced from 50 to 30 - emergency reduction
+const DEFAULT_DOC_LIMIT = 200; // Further reduced from 300 to 200 - emergency reduction
+const DEBUG_CONTEXT_ERRORS = Boolean(process.env['DEBUG_CONTEXT_ERRORS']);
+export function resolveWorkspaceCaptureOptions(env = process.env) {
+    return {
+        treeDepth: parsePositiveInt(env['AGI_CONTEXT_TREE_DEPTH']),
+        maxEntries: parsePositiveInt(env['AGI_CONTEXT_MAX_ENTRIES']),
+        docExcerptLimit: parsePositiveInt(env['AGI_CONTEXT_DOC_LIMIT']),
+    };
+}
+export function buildWorkspaceContext(root, options = {}) {
+    // CRITICAL: Validate options BEFORE building context
+    const optionsValidation = validateWorkspaceOptions(options);
+    if (!optionsValidation.valid) {
+        // Only log in debug mode to avoid polluting chat
+        if (process.env['DEBUG_CONTEXT']) {
+            console.error('[Workspace Context] Invalid options:', optionsValidation.errors);
+        }
+        throw new Error(`Invalid workspace options: ${optionsValidation.errors.join(', ')}`);
+    }
+    // Warnings only in debug mode
+    if (optionsValidation.warnings.length > 0 && process.env['DEBUG_CONTEXT']) {
+        console.warn('[Workspace Context] Warnings:', optionsValidation.warnings);
+    }
+    const treeDepth = options.treeDepth ?? DEFAULT_TREE_DEPTH;
+    const maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    const docLimit = options.docExcerptLimit ?? DEFAULT_DOC_LIMIT;
+    try {
+        const treeLines = formatFileTree(root, treeDepth, maxEntries);
+        const docSnippets = capturePriorityDocs(root, docLimit);
+        const sections = [`cwd: ${root}`];
+        if (treeLines.length) {
+            sections.push('files:', ...treeLines);
+        }
+        if (docSnippets.length) {
+            sections.push(docSnippets.join('\n\n'));
+        }
+        const rawContent = sections.filter((section) => section.trim().length > 0).join('\n');
+        const safe = safeWorkspaceContext(rawContent, {
+            truncate: true,
+            throwOnError: false,
+        });
+        if (process.env['DEBUG_CONTEXT']) {
+            console.log('[Workspace Context] Stats:', safe.stats);
+        }
+        if (!safe.content.trim()) {
+            if (DEBUG_CONTEXT_ERRORS) {
+                console.warn('[Workspace Context] Captured context is empty after filtering.');
+            }
+            return null;
+        }
+        return safe.content;
+    }
+    catch (error) {
+        // Only log errors in debug mode to avoid polluting chat
+        if (DEBUG_CONTEXT_ERRORS || process.env['DEBUG_CONTEXT']) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.error('[Workspace Context] Failed to build context:', message);
+            console.error(error);
+        }
+        return null;
+    }
+}
+function capturePriorityDocs(root, docLimit) {
+    return PRIORITY_DOCS.filter((name) => existsSync(join(root, name))).map((name) => {
+        try {
+            const content = readFileSync(join(root, name), 'utf8');
+            // Safety: Hard limit to prevent context explosion
+            const safeLimit = Math.min(docLimit, 300);
+            const snippet = content.length > safeLimit ? `${content.slice(0, safeLimit)}\n...` : content;
+            return `--- ${name} ---\n${snippet.trim()}`;
+        }
+        catch {
+            return `--- ${name} ---\n[Could not read file]`;
+        }
+    });
+}
+function formatFileTree(root, maxDepth, maxEntries) {
+    const lines = [];
+    const walk = (dir, depth, prefix) => {
+        if (depth > maxDepth || lines.length >= maxEntries) {
+            return;
+        }
+        const entries = safeReadDir(dir)
+            .filter((entry) => !IGNORED_DIRS.has(entry.name))
+            .sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (entry.isFile() && IGNORED_FILES.has(entry.name)) {
+                continue;
+            }
+            if (lines.length >= maxEntries) {
+                break;
+            }
+            const isDir = entry.isDirectory();
+            lines.push(`${prefix}${entry.name}${isDir ? '/' : ''}`);
+            if (isDir && depth < maxDepth) {
+                walk(join(dir, entry.name), depth + 1, `${prefix}  `);
+            }
+        }
+    };
+    walk(root, 0, '');
+    return lines;
+}
+function safeReadDir(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true });
+    }
+    catch (error) {
+        if (DEBUG_CONTEXT_ERRORS) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(`[Workspace Context] Skipping ${dir}: ${message}`);
+        }
+        return [];
+    }
+}
+function parsePositiveInt(raw) {
+    if (!raw) {
+        return undefined;
+    }
+    const value = Number.parseInt(raw, 10);
+    return Number.isFinite(value) && value > 0 ? value : undefined;
+}
+//# sourceMappingURL=workspace.js.map

package/dist/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,MAAM,aAAa,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,uCAAuC;AAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK;IAC3E,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;IACrE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW;CACxD,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACpF,MAAM,kBAAkB,GAAG,CAAC,CAAC,CAAE,mDAAmD;AAClF,MAAM,mBAAmB,GAAG,EAAE,CAAC,CAAE,sDAAsD;AACvF,MAAM,iBAAiB,GAAG,GAAG,CAAC,CAAE,wDAAwD;AACxF,MAAM,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAQ1E,MAAM,UAAU,8BAA8B,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjF,OAAO;QACL,SAAS,EAAE,gBAAgB,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC1D,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC5D,eAAe,EAAE,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,UAAmC,EAAE;IACvF,qDAAqD;IACrD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC7B,iDAAiD;QACjD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,8BAA8B;IAC9B,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAE9D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAa,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtF,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,EAAE;YAC5C,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,IAAI,oBAAoB,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wDAAwD;QACxD,IAAI,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IACzD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,kDAAkD;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,OAAO,OAAO,IAAI,SAAS,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,IAAI,6BAA6B,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAgB,EAAE,UAAkB;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,MAAc,EAAE,EAAE;QAC1D,IAAI,KAAK,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC;aAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAEhD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,SAAS;YACX,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,KAAK,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,gCAAgC,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC"}

package/dist/workspace.validator.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Workspace Context Validator - Enforces strict safety limits
+ *
+ * CRITICAL: Prevents context explosion by validating all workspace context
+ * before it's sent to the LLM. Multiple safety layers ensure we never
+ * exceed token limits.
+ */
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+    stats: ContextStats;
+}
+export interface ContextStats {
+    totalChars: number;
+    totalLines: number;
+    estimatedTokens: number;
+    fileEntries: number;
+    docChars: number;
+}
+export interface WorkspaceContextSafe {
+    content: string;
+    stats: ContextStats;
+}
+/**
+ * Validate workspace context options BEFORE building context
+ */
+export declare function validateWorkspaceOptions(options: {
+    treeDepth?: number;
+    maxEntries?: number;
+    docExcerptLimit?: number;
+}): ValidationResult;
+/**
+ * Validate workspace context AFTER building - CRITICAL SAFETY CHECK
+ * This is the final line of defense against context explosion
+ */
+export declare function validateWorkspaceContext(content: string): ValidationResult;
+/**
+ * Safe truncation - if content exceeds limits, truncate intelligently
+ */
+export declare function truncateWorkspaceContext(content: string): WorkspaceContextSafe;
+/**
+ * Validate and enforce limits in a single call - RECOMMENDED USAGE
+ */
+export declare function safeWorkspaceContext(content: string | null, options?: {
+    truncate?: boolean;
+    throwOnError?: boolean;
+}): WorkspaceContextSafe;
+//# sourceMappingURL=workspace.validator.d.ts.map

package/dist/workspace.validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.validator.d.ts","sourceRoot":"","sources":["../src/workspace.validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;CACrB;AASD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,gBAAgB,CAuDnB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAuE1E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CA2C9E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,oBAAoB,CAiDtB"}