fanluc 2.0.0

package/dist/server.cjs

@@ -0,0 +1,1974 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// server.ts
+var server_exports = {};
+__export(server_exports, {
+  WORKSPACE_DIR: () => WORKSPACE_DIR,
+  startServer: () => startServer
+});
+module.exports = __toCommonJS(server_exports);
+var import_express = __toESM(require("express"), 1);
+var import_path = __toESM(require("path"), 1);
+var import_fs = __toESM(require("fs"), 1);
+var import_os = __toESM(require("os"), 1);
+var import_child_process = require("child_process");
+var import_vite = require("vite");
+var import_google_translate_api_x = require("google-translate-api-x");
+var import_jsdom = require("jsdom");
+var import_readability = require("@mozilla/readability");
+var import_dotenv = __toESM(require("dotenv"), 1);
+var import_promises = __toESM(require("node:dns/promises"), 1);
+var import_node_net = __toESM(require("node:net"), 1);
+
+// src/utils/decodeText.ts
+function decodeTextBuffer(buf) {
+  if (buf.length >= 3 && buf[0] === 239 && buf[1] === 187 && buf[2] === 191) {
+    return { text: buf.subarray(3).toString("utf8"), encoding: "utf-8-bom" };
+  }
+  if (buf.length >= 2 && buf[0] === 255 && buf[1] === 254) {
+    return { text: buf.subarray(2).toString("utf16le"), encoding: "utf-16le" };
+  }
+  if (buf.length >= 2 && buf[0] === 254 && buf[1] === 255) {
+    const sw = Buffer.from(buf.subarray(2));
+    for (let i = 0; i + 1 < sw.length; i += 2) {
+      const t = sw[i];
+      sw[i] = sw[i + 1];
+      sw[i + 1] = t;
+    }
+    return { text: sw.toString("utf16le"), encoding: "utf-16be" };
+  }
+  const sample = buf.subarray(0, Math.min(buf.length, 1024));
+  let nulOdd = 0, nulTotal = 0;
+  for (let i = 0; i < sample.length; i++) if (sample[i] === 0) {
+    nulTotal++;
+    if (i % 2 === 1) nulOdd++;
+  }
+  if (sample.length >= 4 && nulTotal > sample.length * 0.2 && nulOdd >= nulTotal * 0.9) {
+    return { text: buf.toString("utf16le"), encoding: "utf-16le" };
+  }
+  try {
+    return { text: new TextDecoder("utf-8", { fatal: true }).decode(buf), encoding: "utf-8" };
+  } catch {
+  }
+  try {
+    return { text: new TextDecoder("windows-1258").decode(buf), encoding: "windows-1258" };
+  } catch {
+  }
+  return { text: buf.toString("latin1"), encoding: "latin1" };
+}
+
+// src/core/security/blocklist.ts
+var import_node_path = __toESM(require("node:path"), 1);
+var DANGEROUS_PATTERNS = [
+  { pattern: /\bsudo\b|\bsu\s+(-|root)\b/i, reason: "privilege escalation (sudo/su)" },
+  { pattern: /\brm\s+(-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*)\s+\/(?!home\/|tmp\/|workspace)/i, reason: "recursive delete outside the workspace" },
+  { pattern: /\brm\s+(-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*)\s+[~*]\s*(\/|$)/i, reason: "recursive delete of home/root" },
+  { pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&?\s*\}\s*;/, reason: "fork bomb" },
+  { pattern: /\bmkfs\b|\bdd\s+if=.*of=\/dev\/|\bshred\b/i, reason: "disk-level destructive command" },
+  { pattern: /\b(shutdown|reboot|halt|poweroff)\b/i, reason: "system power control" },
+  { pattern: /\bchmod\s+.*777\s+\//i, reason: "world-writable permission change on root" },
+  { pattern: /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(bash|sh|zsh)\b/i, reason: "piping a remote script straight into a shell" },
+  { pattern: /\/etc\/(passwd|shadow|sudoers)\b/i, reason: "reading system credential files" },
+  { pattern: /\.env\b/i, reason: "accessing .env (may contain server secrets, not exposed to run_cmd on purpose)" },
+  { pattern: /\bnc\b.*-e\b|\/dev\/tcp\//i, reason: "raw reverse-shell / netcat exec pattern" },
+  { pattern: /\bcrontab\b/i, reason: "persistence via crontab" },
+  // --- Windows / PowerShell ---
+  { pattern: /\b(rd|rmdir)\b[^&|;]*\/s/i, reason: "Windows rd/rmdir /s recursive delete" },
+  { pattern: /\b(del|erase)\b[^&|;]*\/s/i, reason: "Windows del/erase /s recursive delete" },
+  { pattern: /\b(Format-Volume|Format-C|Clear-Disk|Remove-Partition)\b/i, reason: "Windows disk destructive command" },
+  { pattern: /\b(iwr|Invoke-WebRequest|Invoke-RestMethod|curl|wget)\b[^\n|;]*\|\s*(iex|Invoke-Expression)\b/i, reason: "PowerShell piping remote script into Invoke-Expression (iwr | iex)" },
+  { pattern: /\biex\b|\bInvoke-Expression\b/i, reason: "PowerShell Invoke-Expression" },
+  { pattern: /\b(Start-Process|Invoke-Item)\b.*\b(powershell|cmd|wscript|cscript)\b/i, reason: "PowerShell spawning shell via Start-Process" },
+  { pattern: /-EncodedCommand\b/i, reason: "PowerShell EncodedCommand (obfuscated script)" },
+  { pattern: /\bFromBase64String\b/i, reason: "PowerShell FromBase64String (obfuscated)" }
+];
+function tokenizeSegments(cmd) {
+  const segments = [];
+  let tokens = [];
+  let cur = "";
+  let hasCur = false;
+  let curFromPipe = false;
+  const pushToken = () => {
+    if (hasCur) tokens.push(cur);
+    cur = "";
+    hasCur = false;
+  };
+  const endSegment = (sep) => {
+    pushToken();
+    if (tokens.length) segments.push({ tokens, fromPipe: curFromPipe });
+    tokens = [];
+    curFromPipe = sep === "|";
+  };
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (ch === "'" || ch === '"') {
+      hasCur = true;
+      const q = ch;
+      i++;
+      while (i < cmd.length) {
+        if (cmd[i] === q) {
+          if (cmd[i + 1] === q) {
+            cur += q;
+            i += 2;
+            continue;
+          }
+          break;
+        }
+        if (q === '"' && cmd[i] === "`" && i + 1 < cmd.length) {
+          cur += cmd[i + 1];
+          i += 2;
+          continue;
+        }
+        cur += cmd[i++];
+      }
+      continue;
+    }
+    if (ch === ";" || ch === "\n" || ch === "\r" || ch === "&" || ch === "{" || ch === "}" || ch === "(" || ch === ")") {
+      endSegment(ch);
+      continue;
+    }
+    if (ch === "|") {
+      endSegment("|");
+      continue;
+    }
+    if (ch === " " || ch === "	" || ch === ",") {
+      pushToken();
+      continue;
+    }
+    cur += ch;
+    hasCur = true;
+  }
+  endSegment(";");
+  return segments;
+}
+function looksWindows(opts) {
+  const ws = opts.workspaceDir || "";
+  return opts.platform === "win32" || /^[a-zA-Z]:[\\/]/.test(ws) || ws.startsWith("\\\\");
+}
+var UNIVERSAL_WILDCARD = /^(\.?[\\/])?\*+(\.\*)?$/;
+function classifyTarget(rawTarget, recurse, force, opts) {
+  const t = rawTarget.trim();
+  if (!t) return null;
+  if (t === "~" || /^~[\\/]/.test(t) || /\$home\b/i.test(t) || /\$env:/i.test(t) || /%[^%]+%/.test(t)) {
+    return "target is home directory or environment path (~, $HOME, $env:, %VAR%)";
+  }
+  if (recurse && (/\$/.test(t) || /`/.test(t))) {
+    return "recursive delete with a target that cannot be resolved statically (variable / subexpression)";
+  }
+  const hasWildcard = /[*?]/.test(t);
+  if (recurse && UNIVERSAL_WILDCARD.test(t)) {
+    return "recursive delete of everything via wildcard (*)";
+  }
+  if (recurse && force && hasWildcard) {
+    return "recursive + force delete with a wildcard target";
+  }
+  const isWin = looksWindows(opts);
+  const p = isWin ? import_node_path.default.win32 : import_node_path.default.posix;
+  const isAbs = /^[a-zA-Z]:/.test(t) || t.startsWith("\\\\") || t.startsWith("\\") || t.startsWith("/") || p.isAbsolute(t);
+  if (!isWin && (/^[a-zA-Z]:/.test(t) || t.startsWith("\\"))) {
+    return "target is a Windows-style absolute path outside the workspace";
+  }
+  const ws = opts.workspaceDir ? p.resolve(opts.workspaceDir) : null;
+  const norm = (s) => isWin ? s.toLowerCase() : s;
+  const forResolve = hasWildcard ? t.replace(/[\\/]?[^\\/]*[*?][^\\/]*$/, "") || "." : t;
+  if (!ws) {
+    if (isAbs) return "absolute path target (workspace unknown)";
+    if (forResolve.split(/[\\/]+/).includes("..")) return "target escapes the workspace (..)";
+    return null;
+  }
+  const resolved = p.resolve(ws, forResolve);
+  const rel = p.relative(norm(ws), norm(resolved));
+  const escapes = rel === ".." || rel.startsWith(".." + p.sep) || p.isAbsolute(rel);
+  if (escapes) {
+    return isAbs ? "target is an absolute path outside the workspace" : "target escapes the workspace (..)";
+  }
+  if (recurse && rel === "" && !hasWildcard) {
+    return "recursive delete of the workspace root itself";
+  }
+  return null;
+}
+var PS_ONLY_DELETE = /* @__PURE__ */ new Set(["remove-item", "ri"]);
+var WIN_ALIAS_DELETE = /* @__PURE__ */ new Set(["rm", "del", "erase", "rd", "rmdir"]);
+var VALUE_FLAGS_TARGET = ["path", "literalpath"];
+var VALUE_FLAGS_SKIP = ["include", "exclude", "filter", "credential", "stream"];
+function flagMatches(name, full, minLen) {
+  const n = name.toLowerCase();
+  return n.length >= minLen && full.startsWith(n);
+}
+function analyzePowerShellDelete(command, opts) {
+  const platform = opts.platform ?? process.platform;
+  const heads = new Set(PS_ONLY_DELETE);
+  if (platform === "win32") for (const a of WIN_ALIAS_DELETE) heads.add(a);
+  const segments = tokenizeSegments(command);
+  let analyzedRemoveItem = 0;
+  for (const seg of segments) {
+    const head = (seg.tokens[0] || "").toLowerCase().replace(/^.*\\/, "");
+    if (!heads.has(head)) continue;
+    if (head === "remove-item") analyzedRemoveItem++;
+    let recurse = false;
+    let force = false;
+    const targets = [];
+    for (let i = 1; i < seg.tokens.length; i++) {
+      const tok = seg.tokens[i];
+      if (tok.startsWith("-") && tok.length > 1 && !/^-\d/.test(tok)) {
+        const body = tok.slice(1);
+        const colon = body.indexOf(":");
+        const name = colon >= 0 ? body.slice(0, colon) : body;
+        const inlineVal = colon >= 0 ? body.slice(colon + 1) : null;
+        if (flagMatches(name, "recurse", 1)) {
+          recurse = !(inlineVal && /^\$?false$/i.test(inlineVal));
+        } else if (flagMatches(name, "force", 2)) {
+          force = !(inlineVal && /^\$?false$/i.test(inlineVal));
+        } else if (VALUE_FLAGS_TARGET.some((f) => flagMatches(name, f, 1))) {
+          const v = inlineVal ?? seg.tokens[++i];
+          if (v) targets.push(v);
+        } else if (VALUE_FLAGS_SKIP.some((f) => flagMatches(name, f, 1))) {
+          if (inlineVal === null) i++;
+        }
+        continue;
+      }
+      targets.push(tok);
+    }
+    if (recurse && targets.length === 0 && seg.fromPipe) {
+      return "recursive delete with pipeline input (target unknown)";
+    }
+    if (recurse && targets.length === 0) {
+      return "recursive delete without an explicit target";
+    }
+    for (const t of targets) {
+      const why = classifyTarget(t, recurse, force, opts);
+      if (why) return `PowerShell delete blocked: ${why}`;
+    }
+  }
+  const rawCount = (command.match(/\bRemove-Item\b/gi) || []).length;
+  if (rawCount > analyzedRemoveItem && /-r(e(c(u(r(s(e)?)?)?)?)?)?\b/i.test(command)) {
+    return "PowerShell recursive delete inside a nested/quoted command (cannot verify target)";
+  }
+  return null;
+}
+function findBlockedPattern(command, opts = {}) {
+  for (const { pattern, reason } of DANGEROUS_PATTERNS) {
+    if (pattern.test(command)) return reason;
+  }
+  return analyzePowerShellDelete(command, opts);
+}
+
+// server.ts
+var import_client = require("@modelcontextprotocol/sdk/client/index.js");
+var import_stdio = require("@modelcontextprotocol/sdk/client/stdio.js");
+var import_streamableHttp = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+import_dotenv.default.config();
+var IS_WINDOWS = process.platform === "win32";
+function resolveWorkspaceDir() {
+  const override = process.env.FANLUC_WORKSPACE?.trim();
+  if (override) return import_path.default.resolve(override);
+  if (process.env.WORKSPACE_DIR?.trim()) return import_path.default.resolve(process.env.WORKSPACE_DIR.trim());
+  return import_path.default.join(process.cwd(), "workspace");
+}
+var WORKSPACE_DIR = resolveWorkspaceDir();
+function isInsideWorkspace(p) {
+  const rel = import_path.default.relative(WORKSPACE_DIR, import_path.default.resolve(p));
+  return rel === "" || !rel.startsWith("..") && !import_path.default.isAbsolute(rel);
+}
+try {
+  import_fs.default.mkdirSync(WORKSPACE_DIR, { recursive: true });
+} catch (e) {
+  console.error("Failed to create workspace dir:", e);
+}
+var SAFE_ENV = IS_WINDOWS ? {
+  PATH: process.env.PATH,
+  SystemRoot: process.env.SystemRoot,
+  windir: process.env.windir,
+  COMSPEC: process.env.COMSPEC,
+  OS: process.env.OS,
+  SystemDrive: process.env.SystemDrive,
+  TEMP: process.env.TEMP,
+  TMP: process.env.TMP,
+  // On Windows, don't override HOME/USERPROFILE to WORKSPACE_DIR — that causes
+  // PowerShell to create AppData\Local inside the workspace (polluting project).
+  // Keep original USERPROFILE/HOME so profile data stays in real home.
+  HOME: process.env.HOME || process.env.USERPROFILE || WORKSPACE_DIR,
+  USERPROFILE: process.env.USERPROFILE || process.env.HOME || WORKSPACE_DIR,
+  APPDATA: process.env.APPDATA,
+  LOCALAPPDATA: process.env.LOCALAPPDATA,
+  PYTHONDONTWRITEBYTECODE: "1",
+  PATHEXT: process.env.PATHEXT,
+  LANG: process.env.LANG || "en_US.UTF-8"
+} : {
+  PATH: process.env.PATH,
+  HOME: WORKSPACE_DIR,
+  LANG: process.env.LANG || "en_US.UTF-8",
+  PYTHONDONTWRITEBYTECODE: "1"
+};
+var permissionGrants = { file: 0, shell: 0 };
+var GRANT_TTL_MS = Number(process.env.FANLUC_GRANT_TTL_MS) > 0 ? Number(process.env.FANLUC_GRANT_TTL_MS) : 5 * 60 * 1e3;
+function isGranted(type) {
+  return permissionGrants[type] > Date.now();
+}
+function grantPermission(type) {
+  const until = Date.now() + GRANT_TTL_MS;
+  if (type === "all" || type === "file") permissionGrants.file = until;
+  if (type === "all" || type === "shell") permissionGrants.shell = until;
+}
+function clearGrants() {
+  permissionGrants = { file: 0, shell: 0 };
+}
+var FIREJAIL_AVAILABLE = false;
+if (!IS_WINDOWS) {
+  try {
+    (0, import_child_process.execFileSync)("which", ["firejail"], { stdio: "ignore" });
+    FIREJAIL_AVAILABLE = true;
+    console.log("[run_cmd] firejail detected \u2014 sandboxing run_cmd with it.");
+  } catch {
+    console.warn(
+      "[run_cmd] firejail not found \u2014 run_cmd will still be jailed to " + WORKSPACE_DIR + " with a stripped env + blocklist, but for real OS-level isolation install firejail (`sudo apt-get install -y firejail`) or run this whole server inside a Docker container."
+    );
+  }
+} else {
+  console.log("[run_cmd] Windows detected \u2014 firejail disabled, using PowerShell/cmd sandbox (blocklist enforced, permission ask blocks by default)");
+}
+var ZIP_AVAILABLE = false;
+var UNZIP_AVAILABLE = false;
+if (!IS_WINDOWS) {
+  try {
+    (0, import_child_process.execFileSync)("which", ["zip"], { stdio: "ignore" });
+    ZIP_AVAILABLE = true;
+  } catch {
+  }
+  try {
+    (0, import_child_process.execFileSync)("which", ["unzip"], { stdio: "ignore" });
+    UNZIP_AVAILABLE = true;
+  } catch {
+  }
+} else {
+  try {
+    (0, import_child_process.execFileSync)("where", ["zip"], { stdio: "ignore" });
+    ZIP_AVAILABLE = true;
+  } catch {
+  }
+  try {
+    (0, import_child_process.execFileSync)("where", ["unzip"], { stdio: "ignore" });
+    UNZIP_AVAILABLE = true;
+  } catch {
+  }
+}
+function preprocessCommand(command) {
+  let trimmed = command.trim();
+  if (!ZIP_AVAILABLE && /^zip\s+/i.test(trimmed)) {
+    const parts = trimmed.split(/\s+/).slice(1);
+    if (parts.length >= 2) {
+      const zipFile = parts[0];
+      const files = parts.slice(1).join(" ");
+      return `python3 -m zipfile -c ${zipFile} ${files}`;
+    }
+  }
+  if (!UNZIP_AVAILABLE && /^unzip\s+/i.test(trimmed)) {
+    const parts = trimmed.split(/\s+/).slice(1);
+    let zipFile = "";
+    let outDir = WORKSPACE_DIR;
+    for (let i = 0; i < parts.length; i++) {
+      if (parts[i] === "-d" && parts[i + 1]) {
+        outDir = parts[i + 1];
+        i++;
+      } else if (!zipFile && !parts[i].startsWith("-")) {
+        zipFile = parts[i];
+      }
+    }
+    if (zipFile) {
+      return `python3 -m zipfile -e ${zipFile} ${outDir}`;
+    }
+  }
+  return trimmed;
+}
+function findBlockedPattern2(command) {
+  return findBlockedPattern(command, { workspaceDir: WORKSPACE_DIR, platform: process.platform });
+}
+var DESKTOP_UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
+var BLOCKED_HOST_SUFFIXES = [
+  "facebook.com",
+  "fb.com",
+  "instagram.com",
+  "threads.net",
+  "twitter.com",
+  "x.com",
+  "tiktok.com",
+  "linkedin.com",
+  "pinterest.com",
+  "pinterest.jp",
+  "quora.com",
+  "discord.com",
+  "discord.gg",
+  "messenger.com",
+  "whatsapp.com",
+  "t.me",
+  "telegram.org",
+  "youtube.com",
+  "youtu.be",
+  "music.youtube.com",
+  "zalo.me",
+  "scribd.com",
+  "academia.edu",
+  "accounts.google.com",
+  "myaccount.google.com"
+];
+var DOMAIN_REWRITES = {
+  "reddit.com": "old.reddit.com",
+  "www.reddit.com": "old.reddit.com"
+};
+var REPUTABLE_HOST_SUFFIXES = [
+  "wikipedia.org",
+  "github.com",
+  "stackoverflow.com",
+  "developer.mozilla.org",
+  "docs.python.org",
+  "npmjs.com",
+  "arxiv.org",
+  "bbc.com",
+  "reuters.com",
+  "apnews.com",
+  "nytimes.com",
+  "theguardian.com",
+  "forbes.com",
+  "bloomberg.com",
+  "nature.com",
+  "sciencedirect.com",
+  "vnexpress.net",
+  "tuoitre.vn",
+  "thanhnien.vn",
+  "nhandan.vn",
+  "baochinhphu.vn",
+  "vietnamnet.vn",
+  "laodong.vn",
+  "dantri.com.vn",
+  "vtv.vn",
+  "vov.vn"
+];
+var REPUTABLE_TLD_SUFFIXES = [".gov", ".edu", ".gov.vn", ".edu.vn"];
+var NON_HTML_EXTENSIONS = [
+  ".pdf",
+  ".doc",
+  ".docx",
+  ".xls",
+  ".xlsx",
+  ".ppt",
+  ".pptx",
+  ".zip",
+  ".rar",
+  ".7z",
+  ".tar",
+  ".gz",
+  ".jpg",
+  ".jpeg",
+  ".png",
+  ".gif",
+  ".webp",
+  ".svg",
+  ".bmp",
+  ".ico",
+  ".mp3",
+  ".mp4",
+  ".avi",
+  ".mov",
+  ".wav",
+  ".exe",
+  ".apk",
+  ".dmg"
+];
+function hostMatchesSuffixList(hostname, suffixes) {
+  const h = hostname.toLowerCase().replace(/^www\./, "");
+  return suffixes.some((s) => h === s || h.endsWith("." + s));
+}
+function isBlockedHost(hostname) {
+  if (!hostname) return false;
+  return hostMatchesSuffixList(hostname, BLOCKED_HOST_SUFFIXES);
+}
+function applyDomainRewrite(urlStr) {
+  try {
+    const u = new URL(urlStr);
+    const host = u.hostname.toLowerCase();
+    if (DOMAIN_REWRITES[host]) {
+      u.hostname = DOMAIN_REWRITES[host];
+      return u.toString();
+    }
+    return urlStr;
+  } catch {
+    return urlStr;
+  }
+}
+function reputationScore(hostname) {
+  if (!hostname) return 0;
+  const h = hostname.toLowerCase();
+  if (hostMatchesSuffixList(h, REPUTABLE_HOST_SUFFIXES)) return 10;
+  if (REPUTABLE_TLD_SUFFIXES.some((tld) => h.endsWith(tld))) return 8;
+  return 0;
+}
+function looksLikeNonHtmlFile(urlStr) {
+  try {
+    const p = new URL(urlStr).pathname.toLowerCase();
+    return NON_HTML_EXTENSIONS.some((ext) => p.endsWith(ext));
+  } catch {
+    return false;
+  }
+}
+function decodeHtmlEntities(str) {
+  if (!str) return "";
+  return str.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#0?39;/g, "'").replace(/&apos;/g, "'").replace(/&rsquo;|&lsquo;/g, "'").replace(/&rdquo;|&ldquo;/g, '"').replace(/&mdash;/g, "\u2014").replace(/&ndash;/g, "\u2013").replace(/&hellip;/g, "\u2026").replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCodePoint(parseInt(hex, 16))).replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(parseInt(dec, 10)));
+}
+function stripInnerTags(str) {
+  if (!str) return "";
+  return str.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+async function searchDuckDuckGo(query, count) {
+  const results = [];
+  try {
+    const q = encodeURIComponent(query.trim());
+    const resp = await fetch(`https://html.duckduckgo.com/html/?q=${q}&kl=wt-wt`, {
+      headers: {
+        "User-Agent": DESKTOP_UA,
+        "Accept-Language": "en-US,en;q=0.9,vi;q=0.8"
+      }
+    });
+    if (!resp.ok) return results;
+    const html = await resp.text();
+    const resultRegex = /<a[^>]+class="result__a"[^>]+href="([^"]+)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?<a[^>]+class="result__snippet"[^>]*>([\s\S]*?)<\/a>/gi;
+    let m;
+    while ((m = resultRegex.exec(html)) !== null && results.length < count * 2) {
+      let url = m[1];
+      if (url.startsWith("//duckduckgo.com/l/")) {
+        const uddgMatch = url.match(/[?&]uddg=([^&]+)/);
+        if (uddgMatch) url = decodeURIComponent(uddgMatch[1]);
+      } else if (url.startsWith("//")) {
+        url = "https:" + url;
+      }
+      if (!url.startsWith("http")) continue;
+      const title = decodeHtmlEntities(stripInnerTags(m[2]));
+      const snippet = decodeHtmlEntities(stripInnerTags(m[3])) || title;
+      if (!title && !snippet) continue;
+      results.push({ url, title, snippet, engine: "duckduckgo" });
+    }
+  } catch (err) {
+    console.warn("DuckDuckGo search error:", err);
+  }
+  return results;
+}
+async function searchBing(query, count) {
+  const results = [];
+  try {
+    const q = encodeURIComponent(query.trim());
+    const resp = await fetch(`https://www.bing.com/search?q=${q}&count=${Math.min(30, count * 3)}&setlang=en-US`, {
+      headers: {
+        "User-Agent": DESKTOP_UA,
+        "Accept-Language": "en-US,en;q=0.9,vi;q=0.8"
+      }
+    });
+    if (!resp.ok) return results;
+    const html = await resp.text();
+    const resultRegex = /<li class="b_algo"[^>]*>[\s\S]*?<h2>[\s\S]*?<a href="([^"]+)"[^>]*>([\s\S]*?)<\/a>[\s\S]*?<\/h2>([\s\S]*?)<\/li>/gi;
+    let m;
+    while ((m = resultRegex.exec(html)) !== null && results.length < count * 2) {
+      const url = m[1];
+      if (!url.startsWith("http")) continue;
+      const title = decodeHtmlEntities(stripInnerTags(m[2]));
+      const bodyBlock = m[3] || "";
+      const snippetMatch = bodyBlock.match(/<p[^>]*>([\s\S]*?)<\/p>/i) || bodyBlock.match(/<div class="b_caption"[^>]*>([\s\S]*?)<\/div>/i);
+      const snippet = snippetMatch ? decodeHtmlEntities(stripInnerTags(snippetMatch[1])) : title;
+      if (!title && !snippet) continue;
+      results.push({ url, title, snippet, engine: "bing" });
+    }
+  } catch (err) {
+    console.warn("Bing search error:", err);
+  }
+  return results;
+}
+async function searchYahooJP(query, count) {
+  const results = [];
+  const q = encodeURIComponent(query.trim());
+  try {
+    const response = await fetch(`https://search.yahoo.co.jp/search?p=${q}`, {
+      headers: {
+        "User-Agent": DESKTOP_UA,
+        "Accept-Language": "en-US,en;q=0.9,vi;q=0.8"
+      }
+    });
+    if (response.ok) {
+      const html = await response.text();
+      const sectionRegex = /<div class="sw-Card[^"]*"[\s\S]*?<a\s+href="([^"]+)"[^>]*>[\s\S]*?<h3[^>]*>([\s\S]*?)<\/h3>[\s\S]*?(?:<p class="sw-Card__summary">([\s\S]*?)<\/p>)?/gi;
+      let match;
+      while ((match = sectionRegex.exec(html)) !== null && results.length < count) {
+        const url = match[1];
+        if (url.startsWith("http") && !url.includes("search.yahoo.co.jp")) {
+          const title = decodeHtmlEntities(stripInnerTags(match[2]));
+          const snippet = match[3] ? decodeHtmlEntities(stripInnerTags(match[3])) : title;
+          results.push({ url, title, snippet, engine: "yahoo" });
+        }
+      }
+    }
+  } catch (err) {
+    console.warn("Yahoo search primary endpoint error:", err);
+  }
+  if (results.length === 0) {
+    try {
+      const newsRes = await fetch(`https://news.search.yahoo.com/search?p=${q}`, {
+        headers: { "User-Agent": DESKTOP_UA }
+      });
+      if (newsRes.ok) {
+        const newsHtml = await newsRes.text();
+        const newsRegex = /<h4[^>]*><a[^>]+href="([^"]+)"[^>]*>(.*?)<\/a><\/h4>/gi;
+        let nMatch;
+        while ((nMatch = newsRegex.exec(newsHtml)) !== null && results.length < count) {
+          let link = nMatch[1];
+          if (link.includes("/RU=")) {
+            const ruMatch = link.match(/\/RU=([^/]+)/);
+            if (ruMatch) link = decodeURIComponent(ruMatch[1]);
+          }
+          const title = decodeHtmlEntities(stripInnerTags(nMatch[2]));
+          if (link.startsWith("http")) {
+            results.push({ url: link, title, snippet: title, engine: "yahoo-news" });
+          }
+        }
+      }
+    } catch (err) {
+      console.warn("Yahoo news fallback error:", err);
+    }
+  }
+  return results;
+}
+function interleaveResults(arrays) {
+  const out = [];
+  const maxLen = Math.max(0, ...arrays.map((a) => a.length));
+  for (let i = 0; i < maxLen; i++) {
+    for (const arr of arrays) {
+      if (arr[i]) out.push(arr[i]);
+    }
+  }
+  return out;
+}
+function normalizeForDedupe(url) {
+  try {
+    const u = new URL(url);
+    return (u.hostname.replace(/^www\./, "") + u.pathname.replace(/\/$/, "")).toLowerCase();
+  } catch {
+    return url.toLowerCase();
+  }
+}
+function mergeAndFilterResults(all, count) {
+  const seen = /* @__PURE__ */ new Set();
+  const perDomainCount = /* @__PURE__ */ new Map();
+  const filtered = [];
+  for (const r of all) {
+    if (!r.url || !r.url.startsWith("http")) continue;
+    let hostname = "";
+    try {
+      hostname = new URL(r.url).hostname.toLowerCase();
+    } catch {
+      continue;
+    }
+    if (isBlockedHost(hostname)) continue;
+    if (looksLikeNonHtmlFile(r.url)) continue;
+    const dedupeKey = normalizeForDedupe(r.url);
+    if (seen.has(dedupeKey)) continue;
+    const domainKey = hostname.replace(/^www\./, "");
+    const domainCount = perDomainCount.get(domainKey) || 0;
+    if (domainCount >= 2) continue;
+    seen.add(dedupeKey);
+    perDomainCount.set(domainKey, domainCount + 1);
+    filtered.push({ ...r, url: applyDomainRewrite(r.url), score: reputationScore(hostname) });
+  }
+  filtered.sort((a, b) => b.score - a.score);
+  return filtered.slice(0, count).map((r) => ({
+    url: r.url,
+    snippet: r.snippet && r.snippet.trim() || r.title || r.url
+  }));
+}
+var MAX_FETCH_BYTES = 6 * 1024 * 1024;
+async function fetchWithByteLimit(url, signal, maxBytes) {
+  const response = await fetch(url, {
+    signal,
+    redirect: "follow",
+    headers: {
+      "User-Agent": DESKTOP_UA,
+      "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language": "vi-VN,vi;q=0.9,en-US;q=0.8,en;q=0.7"
+    }
+  });
+  const contentType = response.headers.get("content-type") || "";
+  if (!response.body) {
+    const text = await response.text();
+    return { ok: response.ok, status: response.status, contentType, body: text.slice(0, maxBytes) };
+  }
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let received = 0;
+  let body = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    received += value.byteLength;
+    body += decoder.decode(value, { stream: true });
+    if (received >= maxBytes) {
+      try {
+        await reader.cancel();
+      } catch {
+      }
+      break;
+    }
+  }
+  body += decoder.decode();
+  return { ok: response.ok, status: response.status, contentType, body };
+}
+function fallbackCleanHtml(html) {
+  const stripped = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<noscript[\s\S]*?<\/noscript>/gi, " ").replace(/<svg[\s\S]*?<\/svg>/gi, " ").replace(/<iframe[\s\S]*?<\/iframe>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ").replace(/<(nav|header|footer|aside|form|button|select|figure|figcaption)[^>]*>[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+  return decodeHtmlEntities(stripped);
+}
+function extractReadableContent(html, url) {
+  try {
+    const dom = new import_jsdom.JSDOM(html, { url });
+    const doc = dom.window.document;
+    doc.querySelectorAll("script, style, noscript, iframe, svg, form").forEach((el) => el.remove());
+    const reader = new import_readability.Readability(doc, { charThreshold: 200 });
+    const article = reader.parse();
+    if (article && article.textContent && article.textContent.trim().length > 150) {
+      const cleanText = article.textContent.replace(/[ \t]+/g, " ").replace(/\n{3,}/g, "\n\n").trim();
+      return { title: article.title || "", text: cleanText, usedReadability: true };
+    }
+  } catch (err) {
+    console.warn("Readability extraction failed, falling back:", err?.message);
+  }
+  return { title: "", text: fallbackCleanHtml(html), usedReadability: false };
+}
+var SEARXNG_URL = (process.env.SEARXNG_URL || process.env.SEARXNG || "").replace(/\/$/, "");
+async function searchSearXNG(query, count, categories = "general", baseUrl = SEARXNG_URL) {
+  const results = [];
+  if (!baseUrl) return results;
+  try {
+    const params = new URLSearchParams({ q: query.trim(), format: "json", categories, pageno: "1" });
+    const url = `${baseUrl}/search?${params.toString()}`;
+    const resp = await fetch(url, {
+      signal: AbortSignal.timeout(6e3),
+      headers: {
+        "User-Agent": DESKTOP_UA,
+        "Accept": "application/json",
+        "Accept-Language": "en-US,en;q=0.9,vi;q=0.8"
+      }
+    });
+    if (!resp.ok) {
+      console.warn(`SearXNG search failed ${resp.status} for "${query}"`);
+      return results;
+    }
+    const j = await resp.json();
+    const raw = Array.isArray(j.results) ? j.results : [];
+    for (const x of raw) {
+      if (results.length >= count * 2) break;
+      if (categories === "images") {
+        const title = (x.title || x.content || "").toString();
+        const url2 = (x.url || x.img_src || "").toString();
+        const img_src = (x.img_src || x.url || "").toString();
+        const thumb = (x.thumbnail_src || x.img_src || x.thumbnail || "").toString();
+        if (!img_src && !url2) continue;
+        results.push({
+          url: url2 || img_src,
+          title,
+          snippet: title,
+          engine: "searxng-images",
+          _img_src: img_src,
+          _thumb: thumb
+        });
+      } else {
+        const title = (x.title || "").toString();
+        const url2 = (x.url || "").toString();
+        const snippet = (x.content || x.title || "").toString();
+        if (!url2 || !url2.startsWith("http")) continue;
+        results.push({ url: url2, title, snippet, engine: "searxng" });
+      }
+    }
+  } catch (err) {
+    console.warn("SearXNG search error:", err);
+  }
+  return results;
+}
+function isPrivateIp(ip) {
+  const v = ip.toLowerCase();
+  if (v.startsWith("::ffff:")) return isPrivateIp(v.slice(7));
+  if (import_node_net.default.isIPv4(v)) {
+    const [a, b] = v.split(".").map(Number);
+    return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127;
+  }
+  return v === "::1" || v === "::" || v.startsWith("fc") || v.startsWith("fd") || v.startsWith("fe80");
+}
+async function assertPublicUrl(raw) {
+  const u = new URL(raw);
+  if (u.protocol !== "http:" && u.protocol !== "https:") throw new Error("Only http/https URLs are allowed");
+  if (process.env.ALLOW_PRIVATE_URLS === "1") return u;
+  const host = u.hostname.replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".local") || host.endsWith(".internal")) throw new Error("Private/local hosts are not allowed");
+  const addrs = import_node_net.default.isIP(host) ? [{ address: host }] : await import_promises.default.lookup(host, { all: true });
+  for (const a of addrs) if (isPrivateIp(a.address)) throw new Error("Private/local hosts are not allowed");
+  return u;
+}
+async function resolveSearxUrl(req) {
+  const raw = String(req.body?.searxngUrl || req.headers["x-searxng-url"] || "").trim();
+  if (!raw) return SEARXNG_URL;
+  try {
+    const u = await assertPublicUrl(raw);
+    return (u.origin + u.pathname).replace(/\/$/, "");
+  } catch (e) {
+    console.warn("[SearXNG] user URL rejected:", e?.message);
+    return SEARXNG_URL;
+  }
+}
+function stripJsonc(s) {
+  return s.replace(/("(?:\\.|[^"\\])*")|\/\/.*$|\/\*[\s\S]*?\*\//gm, (_m, str) => str ?? "");
+}
+function mcpAdminGuard(req, res, next) {
+  const token = process.env.ADMIN_TOKEN;
+  if (!token) return next();
+  if (req.headers["x-admin-token"] === token) return next();
+  return res.status(403).json({ error: "Admin only: send header x-admin-token matching ADMIN_TOKEN." });
+}
+function resolveEnvVars(str) {
+  if (typeof str !== "string") return str;
+  return str.replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name.trim()] ?? "");
+}
+function resolveEnvObject(obj) {
+  if (!obj || typeof obj !== "object") return obj;
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    out[k] = typeof v === "string" ? resolveEnvVars(v) : v;
+  }
+  return out;
+}
+var mcp = /* @__PURE__ */ new Map();
+function normalizeMcpType(t) {
+  const low = (t || "").toLowerCase();
+  if (low === "http" || low === "remote" || low === "streamablehttp" || low === "sse") return "http";
+  return "stdio";
+}
+async function connectMcp(name, cfg) {
+  const explicitlyDisabled = cfg.enabled === false || cfg.disabled === true;
+  if (explicitlyDisabled) {
+    mcp.set(name, { client: null, tools: [], status: "disabled", config: cfg, type: normalizeMcpType(cfg.type) });
+    return;
+  }
+  const type = normalizeMcpType(cfg.type || (cfg.url ? "http" : "stdio"));
+  const entry = { client: null, tools: [], status: "connecting", config: cfg, type };
+  mcp.set(name, entry);
+  try {
+    let transport;
+    if (type === "http") {
+      const rawUrl = cfg.url;
+      if (!rawUrl) throw new Error("Missing url for http/remote MCP server");
+      const resolvedUrl = resolveEnvVars(String(rawUrl));
+      const headers = resolveEnvObject(cfg.headers) || {};
+      transport = new import_streamableHttp.StreamableHTTPClientTransport(new URL(resolvedUrl), { requestInit: { headers } });
+    } else {
+      let command = cfg.command;
+      let args = Array.isArray(cfg.args) ? cfg.args : [];
+      let env = resolveEnvObject(cfg.env || cfg.environment);
+      if (Array.isArray(command)) {
+        args = command.slice(1);
+        command = command[0];
+      }
+      if (!command) throw new Error("Missing command for stdio/local MCP server");
+      const resolvedCommand = resolveEnvVars(String(command));
+      const resolvedArgs = args.map((a) => resolveEnvVars(String(a)));
+      transport = new import_stdio.StdioClientTransport({ command: resolvedCommand, args: resolvedArgs, env });
+    }
+    const client = new import_client.Client({ name: "fanluc", version: "1.0.0" }, { capabilities: {} });
+    await client.connect(transport);
+    const toolsRes = await client.listTools();
+    const tools = Array.isArray(toolsRes?.tools) ? toolsRes.tools : [];
+    const truncated = tools.map((t) => ({
+      ...t,
+      description: typeof t.description === "string" ? t.description : t.description
+    }));
+    mcp.set(name, { client, tools: truncated, status: "connected", config: cfg, type });
+    console.log(`[MCP] ${name} connected \u2014 ${truncated.length} tools`);
+  } catch (e) {
+    const msg = e?.message || String(e);
+    console.warn(`[MCP] ${name} failed:`, msg);
+    mcp.set(name, { client: null, tools: [], status: "failed", error: msg, config: cfg, type });
+  }
+}
+function getFanlucConfigDir() {
+  if (process.env.FANLUC_CONFIG_DIR?.trim()) return process.env.FANLUC_CONFIG_DIR.trim();
+  if (IS_WINDOWS) {
+    const appData = process.env.APPDATA;
+    if (appData) return import_path.default.join(appData, "fanluc");
+    return import_path.default.join(import_os.default.homedir(), "AppData", "Roaming", "fanluc");
+  }
+  const xdg = process.env.XDG_CONFIG_HOME;
+  if (xdg) return import_path.default.join(xdg, "fanluc");
+  return import_path.default.join(import_os.default.homedir(), ".config", "fanluc");
+}
+function mcpConfigPath() {
+  const dir = getFanlucConfigDir();
+  try {
+    import_fs.default.mkdirSync(dir, { recursive: true });
+  } catch {
+  }
+  return import_path.default.join(dir, "mcp.json");
+}
+function readMcpServersFile(mcpPath) {
+  if (!import_fs.default.existsSync(mcpPath)) return {};
+  const raw = import_fs.default.readFileSync(mcpPath, "utf-8").replace(/^\uFEFF/, "");
+  if (!raw.trim()) return {};
+  const j = JSON.parse(stripJsonc(raw));
+  if (j.mcpServers) return j.mcpServers;
+  if (j.mcp && j.mcp.servers) return j.mcp.servers;
+  if (j.mcp && typeof j.mcp === "object") return j.mcp;
+  return j;
+}
+function loadMcpConfigSync() {
+  const configDir = getFanlucConfigDir();
+  const candidates = [
+    import_path.default.join(configDir, "mcp.json"),
+    import_path.default.join(configDir, "mcp.jsonc")
+  ];
+  for (const p of candidates) {
+    try {
+      if (import_fs.default.existsSync(p)) {
+        const raw = import_fs.default.readFileSync(p, "utf-8").replace(/^\uFEFF/, "");
+        const cleaned = stripJsonc(raw);
+        const j = JSON.parse(cleaned);
+        if (j.mcpServers && typeof j.mcpServers === "object") return j.mcpServers;
+        if (j.mcp && j.mcp.servers && typeof j.mcp.servers === "object") return j.mcp.servers;
+        if (j.mcp && typeof j.mcp === "object" && !j.mcp.servers) {
+          const maybe = j.mcp;
+          const vals = Object.values(maybe);
+          if (vals.length && vals.every((v) => v && typeof v.type === "string")) return maybe;
+        }
+        const topVals = Object.values(j);
+        if (topVals.length && topVals.every((v) => v && typeof v.type === "string")) return j;
+        return {};
+      }
+    } catch (e) {
+      console.warn(`Failed to load MCP config from ${p}:`, e);
+    }
+  }
+  return {};
+}
+async function initMcpFromFile() {
+  const cfgMap = loadMcpConfigSync();
+  const entries = Object.entries(cfgMap);
+  if (entries.length === 0) {
+    console.log("[MCP] no mcp.json found or empty \u2014 skipping MCP init");
+    return;
+  }
+  console.log(`[MCP] loading ${entries.length} server(s) from mcp.json`);
+  for (const [name, cfg] of entries) {
+    await connectMcp(name, cfg);
+  }
+}
+function getMcpToolsForModel() {
+  const out = [];
+  for (const [server, entry] of mcp.entries()) {
+    if (entry.status !== "connected") continue;
+    for (const t of entry.tools) {
+      out.push({
+        server,
+        name: `${server}_${t.name}`,
+        originalName: t.name,
+        description: t.description || "",
+        inputSchema: t.inputSchema
+      });
+    }
+  }
+  return out;
+}
+async function startServer() {
+  const app = (0, import_express.default)();
+  {
+    const bind = process.env.HOST || "0.0.0.0";
+    if (bind === "127.0.0.1" || bind === "localhost" || bind === "::1") {
+      app.use((req, res, next) => {
+        const h = String(req.headers.host || "").replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+        if (h === "localhost" || h === "127.0.0.1" || h === "::1") return next();
+        return res.status(403).json({ error: "Forbidden host" });
+      });
+    }
+  }
+  const PORT = Number(process.env.PORT) || 3e3;
+  app.use(import_express.default.json({ limit: "50mb" }));
+  initMcpFromFile().catch((e) => console.warn("[MCP] init failed:", e));
+  app.post("/api/proxy-chat", async (req, res) => {
+    try {
+      const { apiUrl, apiKey, body, customHeaders } = req.body;
+      if (!apiUrl) {
+        return res.status(400).json({ error: "Missing apiUrl parameter" });
+      }
+      const headers = {
+        "Content-Type": "application/json",
+        "ngrok-skip-browser-warning": "true",
+        "User-Agent": "AI-Studio-Rest-Client/1.0",
+        "Authorization": `Bearer ${apiKey || ""}`,
+        ...customHeaders || {}
+      };
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 3e5);
+      const response = await fetch(apiUrl, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!response.ok) {
+        const responseText2 = await response.text();
+        return res.status(response.status).send(responseText2);
+      }
+      if (body?.stream && response.body) {
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache");
+        res.setHeader("Connection", "keep-alive");
+        const reader = response.body.getReader();
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            res.write(Buffer.from(value));
+          }
+        } catch (streamErr) {
+          console.warn("Proxy stream pipe interrupted:", streamErr);
+        } finally {
+          res.end();
+        }
+        return;
+      }
+      const responseText = await response.text();
+      try {
+        const data = JSON.parse(responseText);
+        return res.json(data);
+      } catch {
+        return res.send(responseText);
+      }
+    } catch (error) {
+      console.error("Proxy error:", error);
+      if (error?.name === "AbortError") {
+        return res.status(504).json({
+          error: "API response timed out (>5 min) or instance disconnected."
+        });
+      }
+      return res.status(500).json({ error: error?.message || "Internal Proxy Error" });
+    }
+  });
+  app.post("/api/yahoo-search", async (req, res) => {
+    try {
+      const { query, count = 7 } = req.body;
+      if (!query || typeof query !== "string") {
+        return res.status(400).json({ error: "Missing query parameter" });
+      }
+      const maxCount = Math.min(15, Math.max(1, parseInt(count) || 7));
+      let searxResults = [];
+      try {
+        searxResults = await searchSearXNG(query, maxCount, "general", await resolveSearxUrl(req));
+      } catch (e) {
+        console.warn("SearXNG general search error, falling back:", e);
+      }
+      if (searxResults.length > 0) {
+        let results2 = mergeAndFilterResults(searxResults, maxCount);
+        if (results2.length === 0) {
+          results2 = searxResults.slice(0, maxCount).map((r) => ({ url: r.url, snippet: r.snippet || r.title || r.url }));
+        }
+        const formattedText2 = `${results2.length} results:
+` + results2.map((r) => `${r.url}: ${r.snippet}`).join("\n");
+        return res.json({ count: results2.length, results: results2, formattedText: formattedText2, engine: "searxng" });
+      }
+      const perEngineCount = Math.min(20, maxCount + 6);
+      const withTimeout = (p, ms = 8e3) => Promise.race([p.catch(() => []), new Promise((r) => setTimeout(() => r([]), ms))]);
+      const [ddgResults, bingResults, yahooResults] = await Promise.all([
+        withTimeout(searchDuckDuckGo(query, perEngineCount)),
+        withTimeout(searchBing(query, perEngineCount)),
+        withTimeout(searchYahooJP(query, perEngineCount))
+      ]);
+      let results = mergeAndFilterResults(
+        interleaveResults([ddgResults, bingResults, yahooResults]),
+        maxCount
+      );
+      if (results.length === 0) {
+        const rawAll = [...ddgResults, ...bingResults, ...yahooResults];
+        results = rawAll.slice(0, maxCount).map((r) => ({ url: r.url, snippet: r.snippet || r.title || r.url }));
+      }
+      const formattedText = results.length > 0 ? `${results.length} results:
+` + results.map((r) => `${r.url}: ${r.snippet}`).join("\n") : `0 results:
+(no results found for "${query}")`;
+      return res.json({
+        count: results.length,
+        results,
+        formattedText,
+        engine: results.length ? "fallback" : "none"
+      });
+    } catch (error) {
+      console.error("Web search error:", error);
+      return res.status(500).json({ error: error?.message || "Web search failed" });
+    }
+  });
+  app.post("/api/searxng-search", async (req, res) => {
+    try {
+      const { query, count = 7, categories = "general" } = req.body;
+      if (!query || typeof query !== "string") return res.status(400).json({ error: "Missing query" });
+      const maxCount = Math.min(15, Math.max(1, parseInt(count) || 7));
+      const cat = categories === "images" ? "images" : "general";
+      const raw = await searchSearXNG(query, maxCount, cat, await resolveSearxUrl(req));
+      let results = [];
+      if (cat === "images") {
+        const filtered = raw.slice(0, maxCount).map((r) => ({
+          title: r.title,
+          src: r._img_src || r.url,
+          thumb: r._thumb || r._img_src || r.url,
+          page: r.url,
+          url: r.url
+        }));
+        return res.json({ count: filtered.length, results: filtered, formattedText: filtered.length ? `${filtered.length} images:${filtered.map((x) => " " + x.src).join(",")}` : "0 images" });
+      } else {
+        results = mergeAndFilterResults(raw, maxCount);
+        if (results.length === 0) results = raw.slice(0, maxCount).map((r) => ({ url: r.url, snippet: r.snippet }));
+        const formattedText = results.length ? `${results.length} results:
+` + results.map((r) => `${r.url}: ${r.snippet}`).join("\n") : `0 results
+(no results)`;
+        return res.json({ count: results.length, results, formattedText });
+      }
+    } catch (e) {
+      return res.status(500).json({ error: e?.message });
+    }
+  });
+  app.post("/api/image-search", async (req, res) => {
+    try {
+      const { query, count = 6 } = req.body;
+      if (!query || typeof query !== "string") return res.status(400).json({ error: "Missing query" });
+      const maxCount = Math.min(12, Math.max(1, parseInt(count) || 6));
+      const raw = await searchSearXNG(query, maxCount, "images", await resolveSearxUrl(req));
+      let images = raw.slice(0, maxCount).map((r) => ({
+        title: r.title || query,
+        src: r._img_src || r.url,
+        thumb: r._thumb || r._img_src || r.url,
+        page: r.url
+      })).filter((x) => x.src && x.src.startsWith("http"));
+      const seen = /* @__PURE__ */ new Set();
+      images = images.filter((x) => {
+        if (seen.has(x.src)) return false;
+        seen.add(x.src);
+        return true;
+      });
+      const formattedText = images.length ? `\u0110\xE3 hi\u1EC3n th\u1ECB ${images.length} \u1EA3nh v\u1EC1 "${query}"` : `Kh\xF4ng t\xECm th\u1EA5y \u1EA3nh cho "${query}"`;
+      return res.json({ count: images.length, images, formattedText });
+    } catch (e) {
+      console.error("Image search error:", e);
+      return res.status(500).json({ error: e?.message || "Image search failed" });
+    }
+  });
+  app.get("/api/image-proxy", async (req, res) => {
+    try {
+      const url = String(req.query.url || "");
+      if (!url || !url.startsWith("http")) return res.status(400).send("Missing url");
+      const parsed = new URL(url);
+      if (isBlockedHost(parsed.hostname)) return res.status(403).send("Blocked host");
+      let resp = null;
+      let cur = url;
+      for (let hop = 0; hop < 4; hop++) {
+        const h = new URL(cur).hostname;
+        if (isBlockedHost(h)) return res.status(403).send("Blocked host");
+        resp = await fetch(cur, { redirect: "manual", headers: { "User-Agent": DESKTOP_UA, "Accept": "image/*,*/*" } });
+        const loc = resp.headers.get("location");
+        if (resp.status >= 300 && resp.status < 400 && loc) {
+          cur = new URL(loc, cur).toString();
+          resp = null;
+          continue;
+        }
+        break;
+      }
+      if (!resp) return res.status(508).send("Too many redirects");
+      if (!resp.ok) return res.status(resp.status).send("Fetch failed");
+      const ct = resp.headers.get("content-type") || "image/jpeg";
+      if (!ct.startsWith("image/")) return res.status(415).send("Not an image");
+      res.setHeader("Content-Type", ct);
+      res.setHeader("Cache-Control", "public, max-age=86400");
+      if (resp.body) {
+        const reader = resp.body.getReader();
+        res.flushHeaders?.();
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          res.write(Buffer.from(value));
+        }
+        res.end();
+      } else {
+        const buf = Buffer.from(await resp.arrayBuffer());
+        res.send(buf);
+      }
+    } catch (e) {
+      return res.status(500).send(e?.message);
+    }
+  });
+  app.get("/api/mcp/status", (_req, res) => {
+    const list = [...mcp.entries()].map(([name, v]) => ({
+      name,
+      type: v.type,
+      // stdio / http
+      status: v.status,
+      // connected / failed / disabled / connecting
+      tools: v.tools,
+      toolCount: v.tools.length,
+      error: v.error || null
+    }));
+    const modelTools = getMcpToolsForModel();
+    res.json({ servers: list, modelTools, count: list.length });
+  });
+  app.get("/api/mcp/tools", (_req, res) => {
+    res.json({ tools: getMcpToolsForModel() });
+  });
+  app.post("/api/mcp/call", async (req, res) => {
+    try {
+      const { server, tool, args, arguments: altArgs } = req.body || {};
+      const toolName = tool;
+      const toolArgs = args ?? altArgs ?? {};
+      if (!server || !toolName) return res.status(400).json({ error: "Missing server or tool" });
+      const entry = mcp.get(server);
+      if (!entry) return res.status(404).json({ error: `MCP server "${server}" not found` });
+      if (entry.status !== "connected" || !entry.client) return res.status(400).json({ error: `MCP server "${server}" not connected (${entry.status})${entry.error ? ": " + entry.error : ""}` });
+      const actualTool = toolName.includes("_") && toolName.startsWith(server + "_") ? toolName.slice(server.length + 1) : toolName;
+      const result = await entry.client.callTool({ name: actualTool, arguments: toolArgs });
+      return res.json(result);
+    } catch (e) {
+      console.error("MCP call error:", e);
+      return res.status(500).json({ error: e?.message || "MCP call failed" });
+    }
+  });
+  async function withUserMcp(cfg, fn) {
+    const u = await assertPublicUrl(String(cfg?.url || ""));
+    const headers = {};
+    if (cfg?.headers && typeof cfg.headers === "object") {
+      for (const [k, v] of Object.entries(cfg.headers)) if (typeof v === "string" && /^[\w-]+$/.test(k)) headers[k] = v;
+    }
+    const transport = new import_streamableHttp.StreamableHTTPClientTransport(u, { requestInit: { headers } });
+    const client = new import_client.Client({ name: "fanluc", version: "1.0.0" }, { capabilities: {} });
+    let timer;
+    try {
+      const run = (async () => {
+        await client.connect(transport);
+        return fn(client);
+      })();
+      return await Promise.race([run, new Promise((_, rej) => {
+        timer = setTimeout(() => rej(new Error("MCP timeout (20s)")), 2e4);
+      })]);
+    } finally {
+      clearTimeout(timer);
+      try {
+        await client.close();
+      } catch {
+      }
+    }
+  }
+  app.post("/api/mcp/user/probe", async (req, res) => {
+    const list = Array.isArray(req.body?.servers) ? req.body.servers.slice(0, 8) : [];
+    const out = await Promise.all(list.map(async (s) => {
+      const name = String(s?.name || "").replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 40);
+      try {
+        const tools = await withUserMcp(s, async (c) => {
+          const r = await c.listTools();
+          return Array.isArray(r?.tools) ? r.tools : [];
+        });
+        const t = tools.map((x) => ({ ...x, description: typeof x.description === "string" ? x.description : x.description }));
+        return { name, type: "http", status: "connected", tools: t, toolCount: t.length, error: null, source: "browser" };
+      } catch (e) {
+        return { name, type: "http", status: "failed", tools: [], toolCount: 0, error: e?.message || String(e), source: "browser" };
+      }
+    }));
+    res.json({ servers: out });
+  });
+  app.post("/api/mcp/user/call", async (req, res) => {
+    try {
+      const { server, tool, args } = req.body || {};
+      if (!server || !tool) return res.status(400).json({ error: "Missing server or tool" });
+      const name = String(server.name || "");
+      const actual = String(tool).startsWith(name + "_") ? String(tool).slice(name.length + 1) : String(tool);
+      const r = await withUserMcp(server, (c) => c.callTool({ name: actual, arguments: args && typeof args === "object" ? args : {} }));
+      return res.json(r);
+    } catch (e) {
+      return res.status(500).json({ error: e?.message || "MCP call failed" });
+    }
+  });
+  app.post("/api/mcp/reconnect", mcpAdminGuard, async (req, res) => {
+    try {
+      const { server } = req.body || {};
+      if (!server) return res.status(400).json({ error: "Missing server" });
+      const cfgMap = loadMcpConfigSync();
+      const cfg = cfgMap[server];
+      if (!cfg) return res.status(404).json({ error: "Server not found in mcp.json" });
+      const old = mcp.get(server);
+      try {
+        await old?.client?.close?.();
+      } catch {
+      }
+      await connectMcp(server, cfg);
+      const entry = mcp.get(server);
+      return res.json({ name: server, status: entry.status, toolCount: entry.tools.length, error: entry.error || null });
+    } catch (e) {
+      return res.status(500).json({ error: e?.message });
+    }
+  });
+  app.post("/api/mcp/toggle", mcpAdminGuard, async (req, res) => {
+    try {
+      const { server, enabled } = req.body || {};
+      if (!server) return res.status(400).json({ error: "Missing server" });
+      const cfgMap = loadMcpConfigSync();
+      let cfg = cfgMap[server];
+      if (!cfg) {
+        const mem = mcp.get(server);
+        if (!mem) return res.status(404).json({ error: "Server not found" });
+        cfg = mem.config;
+      }
+      const newEnabled = enabled !== void 0 ? !!enabled : mcp.get(server)?.status === "disabled";
+      const newCfg = { ...cfg, enabled: newEnabled, disabled: !newEnabled };
+      if (newEnabled) {
+        await connectMcp(server, newCfg);
+      } else {
+        const old = mcp.get(server);
+        try {
+          await old?.client?.close?.();
+        } catch {
+        }
+        mcp.set(server, { client: null, tools: [], status: "disabled", config: newCfg, type: normalizeMcpType(newCfg.type) });
+      }
+      try {
+        const mcpPath = mcpConfigPath();
+        const existing = readMcpServersFile(mcpPath);
+        if (existing[server]) {
+          existing[server] = { ...existing[server], enabled: newEnabled };
+          delete existing[server].disabled;
+          import_fs.default.writeFileSync(mcpPath, JSON.stringify({ mcpServers: existing }, null, 2), "utf-8");
+        }
+      } catch (e) {
+        console.warn("[MCP] could not persist toggle:", e?.message);
+      }
+      const entry = mcp.get(server);
+      return res.json({ name: server, status: entry.status, enabled: newEnabled });
+    } catch (e) {
+      return res.status(500).json({ error: e?.message });
+    }
+  });
+  app.post("/api/mcp/add", mcpAdminGuard, async (req, res) => {
+    try {
+      const { name, type, command, args, url, headers, env, enabled = true } = req.body || {};
+      if (!name || typeof name !== "string") return res.status(400).json({ error: "Missing name" });
+      const cleanName = name.trim().replace(/[^a-zA-Z0-9_-]/g, "_");
+      if (!cleanName) return res.status(400).json({ error: "Invalid name" });
+      const newCfg = { type: type || (url ? "http" : "stdio"), enabled: !!enabled };
+      if (newCfg.type === "http" || newCfg.type === "remote") {
+        if (!url || !String(url).startsWith("http")) return res.status(400).json({ error: "Invalid url for http server" });
+        newCfg.url = String(url);
+        if (headers && typeof headers === "object") newCfg.headers = headers;
+      } else {
+        if (!command || typeof command !== "string") return res.status(400).json({ error: "Missing command for stdio server" });
+        newCfg.command = String(command);
+        if (Array.isArray(args) && args.length) newCfg.args = args.map(String);
+        else if (typeof args === "string" && args.trim()) newCfg.args = String(args).trim().split(/\s+/);
+        if (env && typeof env === "object") newCfg.env = env;
+      }
+      const mcpPath = mcpConfigPath();
+      let existing = {};
+      try {
+        existing = readMcpServersFile(mcpPath);
+      } catch (e) {
+        return res.status(500).json({ error: "mcp.json is invalid, refusing to overwrite: " + (e?.message || e) });
+      }
+      existing[cleanName] = newCfg;
+      const toWrite = { mcpServers: existing };
+      import_fs.default.writeFileSync(mcpPath, JSON.stringify(toWrite, null, 2));
+      await connectMcp(cleanName, newCfg);
+      const entry = mcp.get(cleanName);
+      return res.json({ name: cleanName, status: entry.status, toolCount: entry.tools.length, error: entry.error || null });
+    } catch (e) {
+      return res.status(500).json({ error: e?.message });
+    }
+  });
+  app.post("/api/fetch-url", async (req, res) => {
+    const errorFallback = "you entered an incorrect URL, are missing characters, or the website no longer exists";
+    try {
+      const { url, length = 1100 } = req.body;
+      if (!url || typeof url !== "string") {
+        return res.json({
+          url: url || "",
+          text: errorFallback,
+          formattedText: errorFallback
+        });
+      }
+      const urlMatch = url.match(/https?:\/\/[^\s"']+/);
+      let targetUrl = urlMatch ? urlMatch[0] : url.trim();
+      try {
+        new URL(targetUrl);
+      } catch {
+        return res.json({
+          url: targetUrl,
+          text: errorFallback,
+          formattedText: errorFallback
+        });
+      }
+      targetUrl = applyDomainRewrite(targetUrl);
+      let hostname = "";
+      try {
+        hostname = new URL(targetUrl).hostname.toLowerCase();
+      } catch {
+      }
+      if (isBlockedHost(hostname)) {
+        const blockedMsg = `This site (${hostname}) blocks automated crawling or requires login, so its content cannot be reliably extracted. Try a different, publicly accessible source instead.`;
+        return res.json({
+          url: targetUrl,
+          text: blockedMsg,
+          formattedText: `fetched url: ${targetUrl}
+text: ${blockedMsg}`
+        });
+      }
+      if (looksLikeNonHtmlFile(targetUrl)) {
+        const fileMsg = "This URL points to a non-HTML file (document, image, archive, or media) and cannot be read as article text.";
+        return res.json({
+          url: targetUrl,
+          text: fileMsg,
+          formattedText: `fetched url: ${targetUrl}
+text: ${fileMsg}`
+        });
+      }
+      const cleanLength = Math.min(1e4, Math.max(100, parseInt(length) || 1100));
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 2e4);
+      let fetchResult;
+      try {
+        fetchResult = await fetchWithByteLimit(targetUrl, controller.signal, MAX_FETCH_BYTES);
+      } finally {
+        clearTimeout(timeoutId);
+      }
+      if (!fetchResult.ok) {
+        return res.json({
+          url: targetUrl,
+          text: errorFallback,
+          formattedText: errorFallback
+        });
+      }
+      if (fetchResult.contentType && !/text\/html|application\/xhtml/i.test(fetchResult.contentType)) {
+        const nonHtmlMsg = `This URL returned non-HTML content (${fetchResult.contentType.split(";")[0]}) and cannot be read as article text.`;
+        return res.json({
+          url: targetUrl,
+          text: nonHtmlMsg,
+          formattedText: `fetched url: ${targetUrl}
+text: ${nonHtmlMsg}`
+        });
+      }
+      const { title, text: extractedFull } = extractReadableContent(fetchResult.body, targetUrl);
+      if (!extractedFull) {
+        return res.json({
+          url: targetUrl,
+          text: errorFallback,
+          formattedText: errorFallback
+        });
+      }
+      const extracted = extractedFull.slice(0, cleanLength);
+      const titlePart = title ? `title: ${title}
+` : "";
+      const formattedText = `fetched url: ${targetUrl}
+${titlePart}text: ${extracted}`;
+      return res.json({
+        url: targetUrl,
+        title,
+        text: extracted,
+        formattedText
+      });
+    } catch (error) {
+      console.error("Fetch URL error:", error);
+      return res.json({
+        url: req.body?.url,
+        text: errorFallback,
+        formattedText: errorFallback
+      });
+    }
+  });
+  app.post("/api/read-doc", async (req, res) => {
+    try {
+      const { name } = req.body;
+      if (!name || typeof name !== "string") {
+        return res.status(400).json({ error: "Missing name parameter" });
+      }
+      const cleanName = name.trim().toLowerCase().replace(/^['"`]|['"`]$/g, "");
+      const docsDir = import_path.default.join(process.cwd(), "docs");
+      try {
+        const files = await import_fs.default.promises.readdir(docsDir);
+        let targetFile = files.find(
+          (f) => f.toLowerCase() === cleanName || f.toLowerCase() === `${cleanName}.md`
+        );
+        if (!targetFile) {
+          if (cleanName.includes("fanluc")) targetFile = files.find((f) => f.includes("fanluc"));
+          else if (cleanName.includes("guide")) targetFile = files.find((f) => f.includes("guide"));
+          else if (cleanName.includes("mondk")) targetFile = files.find((f) => f.includes("mondk"));
+          else if (cleanName.includes("msh")) targetFile = files.find((f) => f.includes("msh"));
+          else targetFile = files.find((f) => f.toLowerCase().includes(cleanName));
+        }
+        if (targetFile) {
+          const content = await import_fs.default.promises.readFile(import_path.default.join(docsDir, targetFile), "utf-8");
+          return res.json({
+            found: true,
+            fileName: targetFile,
+            content,
+            formattedText: `doc: ${targetFile}
+content:
+${content}`
+          });
+        }
+        return res.json({
+          found: false,
+          fileName: name,
+          content: `Doc '${name}' not found in /docs/`,
+          formattedText: `Doc '${name}' not found in /docs/`
+        });
+      } catch (err) {
+        return res.json({
+          found: false,
+          fileName: name,
+          content: `Error reading docs directory: ${err?.message}`,
+          formattedText: `Error reading docs directory: ${err?.message}`
+        });
+      }
+    } catch (error) {
+      return res.status(500).json({ error: error?.message || "Failed to read doc" });
+    }
+  });
+  app.post("/api/translate", async (req, res) => {
+    try {
+      const { text, to = "en", from = "auto" } = req.body;
+      if (!text || typeof text !== "string") {
+        return res.status(400).json({ error: "Missing text parameter" });
+      }
+      const cleanText = text.trim();
+      if (!cleanText) {
+        return res.status(400).json({ error: "Empty text parameter" });
+      }
+      const result = await (0, import_google_translate_api_x.translate)(cleanText, {
+        to: to || "en",
+        from: from || "auto"
+      });
+      const translatedText = typeof result?.text === "string" ? result.text : String(result?.text ?? "");
+      const detectedFrom = result?.from?.language?.iso || from || "auto";
+      return res.json({
+        translatedText,
+        detectedFrom,
+        originalText: cleanText,
+        targetLang: to,
+        formattedText: `translated "${cleanText}" (${detectedFrom} -> ${to}): "${translatedText}"`
+      });
+    } catch (error) {
+      console.error("Translation API error:", error);
+      return res.status(500).json({
+        error: error?.message || "Translation failed",
+        translatedText: "",
+        detectedFrom: req.body?.from || "auto",
+        formattedText: `translation failed: ${error?.message || "error"}`
+      });
+    }
+  });
+  app.get("/api/weather", async (req, res) => {
+    try {
+      const { lat, lon, city } = req.query;
+      let finalLat = lat;
+      let finalLon = lon;
+      let locationName = "Unknown Location";
+      if (city && city !== "auto") {
+        const geoRes = await fetch(`https://geocoding-api.open-meteo.com/v1/search?name=${encodeURIComponent(String(city))}&count=1&language=en&format=json`);
+        const geoData = await geoRes.json();
+        if (geoData.results && geoData.results.length > 0) {
+          finalLat = geoData.results[0].latitude;
+          finalLon = geoData.results[0].longitude;
+          locationName = geoData.results[0].name + (geoData.results[0].country ? `, ${geoData.results[0].country}` : "");
+        } else {
+          return res.status(404).json({ error: "City not found" });
+        }
+      } else if (lat && lon) {
+        try {
+          const revGeoRes = await fetch(`https://api.bigdatacloud.net/data/reverse-geocode-client?latitude=${lat}&longitude=${lon}&localityLanguage=en`);
+          const revGeoData = await revGeoRes.json();
+          locationName = revGeoData.city || revGeoData.locality || revGeoData.principalSubdivision || "Your Location";
+        } catch (e) {
+          locationName = "Your Location";
+        }
+      } else {
+        return res.status(400).json({ error: "Provide lat/lon or city" });
+      }
+      const weatherRes = await fetch(`https://api.open-meteo.com/v1/forecast?latitude=${finalLat}&longitude=${finalLon}&current_weather=true`);
+      const weatherData = await weatherRes.json();
+      if (!weatherData.current_weather) {
+        return res.status(500).json({ error: "Weather data not available" });
+      }
+      const current = weatherData.current_weather;
+      const code = current.weathercode;
+      let condition = "Clear";
+      if (code === 0) condition = "Sunny";
+      else if (code === 1 || code === 2 || code === 3) condition = "Cloudy";
+      else if (code === 45 || code === 48) condition = "Fog";
+      else if (code >= 51 && code <= 67) condition = "Rainy";
+      else if (code >= 71 && code <= 77) condition = "Snow";
+      else if (code >= 80 && code <= 82) condition = "Rainy";
+      else if (code >= 85 && code <= 86) condition = "Snow";
+      else if (code >= 95 && code <= 99) condition = "Stormy";
+      if (current.windspeed > 20 && (condition === "Sunny" || condition === "Cloudy" || condition === "Clear")) {
+        condition = "Windy";
+      }
+      res.json({
+        location: locationName,
+        temperature: current.temperature,
+        condition,
+        isDay: current.is_day === 1,
+        time: current.time
+      });
+    } catch (error) {
+      console.error("Weather API error:", error);
+      res.status(500).json({ error: "Failed to fetch weather" });
+    }
+  });
+  function getPermissionMode() {
+    const m = (process.env.FANLUC_PERMISSION || "").trim();
+    if (m === "readOnly" || m === "autoEdit" || m === "ask") return m;
+    try {
+      const cfgDir2 = getFanlucConfigDir();
+      const p = import_path.default.join(cfgDir2, "settings.json");
+      if (import_fs.default.existsSync(p)) {
+        const raw = import_fs.default.readFileSync(p, "utf-8").replace(/^\uFEFF/, "");
+        const j = JSON.parse(raw);
+        if (j.permission === "readOnly" || j.permission === "autoEdit" || j.permission === "ask") return j.permission;
+      }
+    } catch {
+    }
+    return "ask";
+  }
+  function loadFanlucMdSync() {
+    const candidates = [
+      import_path.default.join(WORKSPACE_DIR, "FANLUC.md"),
+      import_path.default.join(WORKSPACE_DIR, "fanluc.md"),
+      import_path.default.join(WORKSPACE_DIR, ".fanluc", "FANLUC.md")
+    ];
+    for (const p of candidates) {
+      try {
+        if (import_fs.default.existsSync(p) && import_fs.default.statSync(p).isFile()) {
+          const raw = import_fs.default.readFileSync(p, "utf-8").replace(/^\uFEFF/, "");
+          const MAX = 6e3;
+          const content = raw.length > MAX ? raw.slice(0, MAX) + "\n\n[... truncated ...]" : raw;
+          return { path: p, content };
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
+  app.get("/api/fanluc-md", (_req, res) => {
+    const md = loadFanlucMdSync();
+    if (!md) return res.json({ found: false, path: null, content: "" });
+    return res.json({ found: true, path: md.path, content: md.content });
+  });
+  app.get("/api/config", (_req, res) => {
+    const cfgDir2 = getFanlucConfigDir();
+    const perm = getPermissionMode();
+    const ws = WORKSPACE_DIR;
+    const md = loadFanlucMdSync();
+    res.json({
+      workspace: ws,
+      configDir: cfgDir2,
+      permission: perm,
+      fanlucMd: md ? { path: md.path, length: md.content.length } : null,
+      platform: process.platform
+    });
+  });
+  app.get("/api/permission/status", (_req, res) => {
+    const perm = getPermissionMode();
+    res.json({
+      permission: perm,
+      fileGranted: isGranted("file"),
+      shellGranted: isGranted("shell"),
+      ttlMs: GRANT_TTL_MS
+    });
+  });
+  app.post("/api/permission/approve", (req, res) => {
+    const { type } = req.body || {};
+    const t = type === "file" ? "file" : type === "shell" ? "shell" : "all";
+    const perm = getPermissionMode();
+    if (perm === "readOnly") {
+      return res.status(403).json({ error: "readOnly: cannot grant permission" });
+    }
+    grantPermission(t);
+    res.json({ ok: true, granted: t, until: Date.now() + GRANT_TTL_MS });
+  });
+  app.post("/api/permission/mode", (req, res) => {
+    const m = String(req.body?.mode || "");
+    if (m !== "ask" && m !== "autoEdit" && m !== "readOnly") return res.status(400).json({ error: "mode must be ask | autoEdit | readOnly" });
+    process.env.FANLUC_PERMISSION = m;
+    return res.json({ ok: true, permission: m });
+  });
+  app.post("/api/permission/reset", (_req, res) => {
+    clearGrants();
+    res.json({ ok: true });
+  });
+  app.post("/api/run-cmd", (req, res) => {
+    if (process.env.DISABLE_RUN_CMD === "1") {
+      const msg = "run_cmd is disabled on this server.";
+      return res.json({ stdout: "", stderr: msg, formattedText: msg, blocked: true });
+    }
+    const perm = getPermissionMode();
+    const needShellGrant = perm === "ask" || perm === "autoEdit";
+    if (perm === "readOnly" || needShellGrant && !isGranted("shell")) {
+      const hint = perm === "readOnly" ? "readOnly \u2014 shell disabled" : `permission '${perm}' requires confirmation via web ConfirmModal or POST /api/permission/approve {type:'shell'}`;
+      const msg = `Blocked by permission mode '${perm}': shell execution requires confirmation. ${hint}`;
+      return res.status(403).json({ stdout: "", stderr: msg, formattedText: msg, blocked: true, needConfirm: true, permission: perm });
+    }
+    const { command } = req.body || {};
+    if (!command || typeof command !== "string" || !command.trim()) {
+      return res.status(400).json({ error: "Missing command", formattedText: "Error: missing command" });
+    }
+    const trimmed = preprocessCommand(command.trim());
+    const blockedReason = findBlockedPattern2(trimmed);
+    if (blockedReason) {
+      const msg = `Command blocked for safety: ${blockedReason}.`;
+      return res.json({ stdout: "", stderr: msg, formattedText: msg, blocked: true });
+    }
+    const TIMEOUT_MS = 2e4;
+    const MAX_BUFFER = 2 * 1024 * 1024;
+    let bin;
+    let args;
+    if (IS_WINDOWS) {
+      bin = "powershell.exe";
+      const PS_UTF8 = "[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false);$OutputEncoding=[Console]::OutputEncoding;$PSDefaultParameterValues['Get-Content:Encoding']='utf8';$PSDefaultParameterValues['Set-Content:Encoding']='utf8';$PSDefaultParameterValues['Add-Content:Encoding']='utf8';$PSDefaultParameterValues['Out-File:Encoding']='utf8';";
+      args = ["-NoProfile", "-Command", PS_UTF8 + trimmed];
+    } else if (FIREJAIL_AVAILABLE) {
+      bin = "firejail";
+      args = [
+        "--quiet",
+        "--noprofile",
+        `--private=${WORKSPACE_DIR}`,
+        "--net=none",
+        "--rlimit-fsize=50000000",
+        "--rlimit-as=1073741824",
+        "bash",
+        "-c",
+        trimmed
+      ];
+    } else {
+      bin = "bash";
+      args = ["-c", trimmed];
+    }
+    (0, import_child_process.execFile)(
+      bin,
+      args,
+      { cwd: WORKSPACE_DIR, timeout: TIMEOUT_MS, maxBuffer: MAX_BUFFER, env: SAFE_ENV },
+      (err, stdout, stderr) => {
+        const out = (stdout || "").toString().slice(0, 2e4);
+        const errOut = (stderr || "").toString().slice(0, 2e4);
+        if (err && err.killed) {
+          const msg = `Command timed out (${TIMEOUT_MS / 1e3}s limit).`;
+          return res.json({ stdout: out, stderr: msg, formattedText: `$ ${trimmed}
+${out}
+${msg}`.trim(), timedOut: true });
+        }
+        const exitCode = err ? typeof err.code === "number" ? err.code : 1 : 0;
+        const body = `${out}${errOut ? (out ? "\n" : "") + errOut : ""}`.trim() || "(no output)";
+        const formattedText = `$ ${trimmed}
+${body}`;
+        return res.json({ stdout: out, stderr: errOut, exitCode, formattedText });
+      }
+    );
+  });
+  app.post("/api/upload-workspace-file", import_express.default.json({ limit: "10mb" }), async (req, res) => {
+    const perm = getPermissionMode();
+    if (perm === "readOnly" || perm === "ask" && !isGranted("file")) {
+      const hint = perm === "ask" ? "requires confirmation via ConfirmModal or POST /api/permission/approve {type:'file'}" : "readOnly";
+      return res.status(403).json({ error: `Blocked by permission mode '${perm}': file write ${hint}`, needConfirm: perm === "ask", permission: perm });
+    }
+    try {
+      const { name, content, encoding = "utf-8" } = req.body || {};
+      if (!name || typeof name !== "string") {
+        return res.status(400).json({ error: "Missing file name" });
+      }
+      const cleanName = name.trim().replace(/^(\.\/|\/)+/, "");
+      const filePath = import_path.default.join(WORKSPACE_DIR, cleanName);
+      const dir = import_path.default.dirname(filePath);
+      if (!isInsideWorkspace(dir)) {
+        return res.status(403).json({ error: "Invalid file path outside workspace" });
+      }
+      await import_fs.default.promises.mkdir(dir, { recursive: true });
+      let buffer;
+      if ((encoding === "base64" || cleanName.toLowerCase().endsWith(".zip")) && typeof content === "string") {
+        let rawBase64 = content;
+        if (rawBase64.includes(",")) {
+          rawBase64 = rawBase64.split(",")[1];
+        }
+        buffer = Buffer.from(rawBase64, "base64");
+      } else if (typeof content === "string") {
+        buffer = Buffer.from(content, "utf-8");
+      } else {
+        buffer = Buffer.from("");
+      }
+      await import_fs.default.promises.writeFile(filePath, buffer);
+      const stats = await import_fs.default.promises.stat(filePath);
+      return res.json({
+        success: true,
+        path: cleanName,
+        name: import_path.default.basename(cleanName),
+        size: stats.size,
+        updatedAt: stats.mtimeMs
+      });
+    } catch (err) {
+      console.error("Upload workspace file error:", err);
+      return res.status(500).json({ error: err?.message || "Failed to upload workspace file" });
+    }
+  });
+  app.post("/api/delete-workspace-file", import_express.default.json(), async (req, res) => {
+    const perm = getPermissionMode();
+    if (perm === "readOnly" || perm === "ask" && !isGranted("file")) {
+      const hint = perm === "ask" ? "requires confirmation via ConfirmModal or POST /api/permission/approve {type:'file'}" : "readOnly";
+      return res.status(403).json({ error: `Blocked by permission mode '${perm}': file delete ${hint}`, needConfirm: perm === "ask", permission: perm });
+    }
+    try {
+      const { path: filePathParam } = req.body || {};
+      if (!filePathParam || typeof filePathParam !== "string") {
+        return res.status(400).json({ error: "Missing file path" });
+      }
+      const cleanName = filePathParam.trim().replace(/^(\.\/|\/)+/, "");
+      const targetPath = import_path.default.join(WORKSPACE_DIR, cleanName);
+      if (!isInsideWorkspace(targetPath)) {
+        return res.status(403).json({ error: "Invalid file path outside workspace" });
+      }
+      if (import_fs.default.existsSync(targetPath)) {
+        await import_fs.default.promises.rm(targetPath, { recursive: true, force: true });
+      }
+      return res.json({ success: true, path: cleanName });
+    } catch (err) {
+      console.error("Delete workspace file error:", err);
+      return res.status(500).json({ error: err?.message || "Failed to delete workspace file" });
+    }
+  });
+  app.get("/api/workspace-files", async (_req, res) => {
+    try {
+      const filesMap = {};
+      async function walkDir(currentDir, relativeDir = "") {
+        let entries = [];
+        try {
+          entries = await import_fs.default.promises.readdir(currentDir, { withFileTypes: true });
+        } catch {
+          return;
+        }
+        for (const entry of entries) {
+          if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+          const fullPath = import_path.default.join(currentDir, entry.name);
+          const relPath = relativeDir ? `${relativeDir}/${entry.name}` : entry.name;
+          if (entry.isDirectory()) {
+            await walkDir(fullPath, relPath);
+          } else if (entry.isFile()) {
+            try {
+              const stats = await import_fs.default.promises.stat(fullPath);
+              if (stats.size <= 2 * 1024 * 1024) {
+                const ext = entry.name.split(".").pop()?.toLowerCase() || "";
+                const isBinary = ["zip", "gz", "tar", "tgz", "rar", "7z", "png", "jpg", "jpeg", "gif", "pdf", "exe", "bin", "apk", "iso"].includes(ext);
+                let content = "";
+                let fileEncoding = "utf-8";
+                if (isBinary) {
+                  content = `[Binary File: ${entry.name} (${(stats.size / 1024).toFixed(1)} KB)]`;
+                } else {
+                  try {
+                    const dec = decodeTextBuffer(await import_fs.default.promises.readFile(fullPath));
+                    content = dec.text;
+                    fileEncoding = dec.encoding;
+                  } catch {
+                    content = `[Unreadable File: ${(stats.size / 1024).toFixed(1)} KB]`;
+                  }
+                }
+                filesMap[relPath] = {
+                  path: relPath,
+                  name: entry.name,
+                  content,
+                  size: stats.size,
+                  language: ext,
+                  encoding: fileEncoding,
+                  updatedAt: stats.mtimeMs
+                };
+              } else {
+                filesMap[relPath] = {
+                  path: relPath,
+                  name: entry.name,
+                  content: `[Large File: ${(stats.size / 1024).toFixed(1)} KB]`,
+                  size: stats.size,
+                  language: entry.name.split(".").pop()?.toLowerCase() || "binary",
+                  updatedAt: stats.mtimeMs
+                };
+              }
+            } catch {
+            }
+          }
+        }
+      }
+      await walkDir(WORKSPACE_DIR);
+      return res.json({ files: filesMap });
+    } catch (err) {
+      return res.status(500).json({ error: err?.message || "Failed to list workspace files" });
+    }
+  });
+  app.get("/api/health", (_req, res) => {
+    res.json({ status: "ok", workspace: WORKSPACE_DIR, permission: getPermissionMode(), platform: process.platform });
+  });
+  if (process.env.NODE_ENV !== "production") {
+    const vite = await (0, import_vite.createServer)({
+      server: { middlewareMode: true },
+      appType: "spa"
+    });
+    app.use(vite.middlewares);
+  } else {
+    const distPath = import_path.default.join(process.cwd(), "dist");
+    app.use(import_express.default.static(distPath));
+    app.get("*", (_req, res) => {
+      res.sendFile(import_path.default.join(distPath, "index.html"));
+    });
+  }
+  const HOST = process.env.HOST || "0.0.0.0";
+  const cfgDir = getFanlucConfigDir();
+  const permMode = getPermissionMode();
+  const fanlucMd = loadFanlucMdSync();
+  console.log(`[fanluc] Workspace : ${WORKSPACE_DIR}`);
+  console.log(`[fanluc] Config dir: ${cfgDir}`);
+  console.log(`[fanluc] Permission: ${permMode}`);
+  if (fanlucMd) console.log(`[fanluc] FANLUC.md  : ${fanlucMd.path} (${fanlucMd.content.length} chars)`);
+  else console.log(`[fanluc] FANLUC.md  : (none)`);
+  app.listen(PORT, HOST, () => {
+    const displayHost = HOST === "0.0.0.0" ? "localhost" : HOST;
+    console.log(`Server running on http://${displayHost}:${PORT}`);
+    console.log(`Health: http://${displayHost}:${PORT}/api/health`);
+  });
+}
+if (process.env.FANLUC_NO_AUTO_START !== "1") {
+  startServer().catch((e) => {
+    console.error("Failed to start server:", e);
+    process.exit(1);
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  WORKSPACE_DIR,
+  startServer
+});
+//# sourceMappingURL=server.cjs.map