joonecli 0.1.1 → 0.2.1

package/dist/tools/security.d.ts

@@ -1,28 +0,0 @@
-import { SandboxManager } from "../sandbox/manager.js";
-import { LazyInstaller } from "../sandbox/bootstrap.js";
-import { DynamicToolInterface } from "./index.js";
-/**
- * Binds the security tools to the sandbox and installer.
- * Must be called at session start.
- */
-export declare function bindSecuritySandbox(sandbox: SandboxManager, installer: LazyInstaller): void;
-/**
- * Scans code for security vulnerabilities using the Gemini CLI Security Extension.
- *
- * Execution flow:
- * 1. LazyInstaller ensures Gemini CLI + security extension are in the sandbox.
- * 2. Runs `gemini -x security:analyze` in the sandbox.
- * 3. Returns the generated security report.
- *
- * If Gemini CLI installation fails, returns a descriptive fallback message
- * suggesting manual review or alternative tools.
- */
-export declare const SecurityScanTool: DynamicToolInterface;
-/**
- * Scans project dependencies for known vulnerabilities.
- *
- * Execution flow:
- * 1. Try OSV-Scanner (more comprehensive, covers multiple ecosystems).
- * 2. Fall back to `npm audit --json` (always available in Node sandboxes).
- */
-export declare const DepScanTool: DynamicToolInterface;

package/dist/tools/security.js

@@ -1,183 +0,0 @@
-// ─── Sandbox + Installer references (set at session start) ──────────────────
-let _sandboxManager = null;
-let _installer = null;
-/**
- * Binds the security tools to the sandbox and installer.
- * Must be called at session start.
- */
-export function bindSecuritySandbox(sandbox, installer) {
-    _sandboxManager = sandbox;
-    _installer = installer;
-}
-// ─── Security Helpers ───────────────────────────────────────────────────────────
-/**
- * Escapes a string so it can be safely used as an argument in a Bash shell command.
- */
-function escapeBashArg(arg) {
-    return `'${arg.replace(/'/g, "'\\''")}'`;
-}
-/**
- * Validates a file path to prevent directory traversal out of the workspace.
- */
-function isSafePath(pathStr) {
-    if (!pathStr || pathStr.trim() === "")
-        return false;
-    if (pathStr.includes("..") || pathStr.startsWith("/"))
-        return false;
-    return true;
-}
-// ─── SecurityScanTool ───────────────────────────────────────────────────────────
-/**
- * Scans code for security vulnerabilities using the Gemini CLI Security Extension.
- *
- * Execution flow:
- * 1. LazyInstaller ensures Gemini CLI + security extension are in the sandbox.
- * 2. Runs `gemini -x security:analyze` in the sandbox.
- * 3. Returns the generated security report.
- *
- * If Gemini CLI installation fails, returns a descriptive fallback message
- * suggesting manual review or alternative tools.
- */
-export const SecurityScanTool = {
-    name: "security_scan",
-    description: "Scans code changes for security vulnerabilities using the Gemini CLI Security Extension. " +
-        "Analyzes the current branch diff for common vulnerabilities and generates a security report.",
-    schema: {
-        type: "object",
-        properties: {
-            target: {
-                type: "string",
-                enum: ["changes", "file", "deps"],
-                description: 'What to scan: "changes" (branch diff), "file" (specific file), "deps" (dependencies only)',
-            },
-            path: {
-                type: "string",
-                description: "File path for single-file scan (required when target is 'file')",
-            },
-        },
-        required: ["target"],
-    },
-    execute: async (args) => {
-        if (!_sandboxManager || !_sandboxManager.isActive()) {
-            return { content: "Sandbox is not active. Cannot run security scan.", isError: true };
-        }
-        if (!_installer) {
-            return { content: "LazyInstaller not initialized. Call bindSecuritySandbox() first.", isError: true };
-        }
-        // Ensure Gemini CLI is available
-        const cliReady = await _installer.ensureGeminiCli(_sandboxManager);
-        if (!cliReady) {
-            return {
-                content: ("⚠ Gemini CLI could not be installed in the sandbox.\n" +
-                    "Suggestions:\n" +
-                    '  - Use `dep_scan` tool for dependency vulnerability scanning (uses npm audit)\n' +
-                    "  - Manually review code for OWASP Top 10 vulnerabilities\n" +
-                    "  - Set sandboxTemplate to a pre-baked template with Gemini CLI installed"),
-                isError: true
-            };
-        }
-        // Build the command based on target
-        let command;
-        switch (args.target) {
-            case "changes":
-                command = "cd /workspace && gemini -x security:analyze 2>&1";
-                break;
-            case "file":
-                if (!args.path) {
-                    return { content: "Error: 'path' is required when target is 'file'.", isError: true };
-                }
-                if (!isSafePath(args.path)) {
-                    return { content: "Error: Invalid file path. Path must be relative and cannot contain traversal characters ('..').", isError: true };
-                }
-                command = `cd /workspace && gemini -x security:analyze --file ${escapeBashArg(args.path)} 2>&1`;
-                break;
-            case "deps":
-                command = "cd /workspace && gemini -x security:analyze --deps-only 2>&1";
-                break;
-            default:
-                return { content: `Error: Unknown target "${args.target}". Use "changes", "file", or "deps".`, isError: true };
-        }
-        const result = await _sandboxManager.exec(command);
-        if (result.exitCode !== 0) {
-            return {
-                content: `Security scan failed (exit code ${result.exitCode}):\n${result.stdout}\n${result.stderr}`,
-                metadata: { exitCode: result.exitCode },
-                isError: true
-            };
-        }
-        return {
-            content: result.stdout || "Security scan completed — no issues found.",
-            metadata: { exitCode: result.exitCode },
-            isError: false
-        };
-    },
-};
-// ─── DepScanTool ────────────────────────────────────────────────────────────────
-/**
- * Scans project dependencies for known vulnerabilities.
- *
- * Execution flow:
- * 1. Try OSV-Scanner (more comprehensive, covers multiple ecosystems).
- * 2. Fall back to `npm audit --json` (always available in Node sandboxes).
- */
-export const DepScanTool = {
-    name: "dep_scan",
-    description: "Scans project dependencies for known vulnerabilities (CVEs). " +
-        "Uses OSV-Scanner when available, falls back to npm audit.",
-    schema: {
-        type: "object",
-        properties: {
-            format: {
-                type: "string",
-                enum: ["summary", "json"],
-                description: 'Output format: "summary" (human readable) or "json" (raw)',
-            },
-        },
-    },
-    execute: async (args) => {
-        if (!_sandboxManager || !_sandboxManager.isActive()) {
-            return { content: "Sandbox is not active. Cannot run dependency scan.", isError: true };
-        }
-        if (!_installer) {
-            return { content: "LazyInstaller not initialized.", isError: true };
-        }
-        const format = args?.format ?? "summary";
-        // Try OSV-Scanner first
-        const osvReady = await _installer.ensureOsvScanner(_sandboxManager);
-        if (osvReady) {
-            const osvCmd = format === "json"
-                ? "cd /workspace && osv-scanner --json . 2>&1"
-                : "cd /workspace && osv-scanner . 2>&1";
-            const result = await _sandboxManager.exec(osvCmd);
-            if (result.exitCode === 0) {
-                return {
-                    content: result.stdout || "No known vulnerabilities found in dependencies.",
-                    metadata: { exitCode: result.exitCode },
-                    isError: false
-                };
-            }
-            // Exit code 1 from OSV-Scanner means vulnerabilities found — still valid output
-            if (result.exitCode === 1 && result.stdout) {
-                return {
-                    content: result.stdout,
-                    metadata: { exitCode: result.exitCode },
-                    isError: false
-                };
-            }
-            // If we reach here, OSV-Scanner failed for another reason (e.g. exit > 1)
-            console.warn(`⚠ OSV-Scanner failed (exit code ${result.exitCode}). Falling back to npm audit.\nDetails: ${result.stdout}\n${result.stderr}`);
-        }
-        // Fallback: npm audit
-        const auditCmd = format === "json"
-            ? "cd /workspace && npm audit --json 2>&1"
-            : "cd /workspace && npm audit 2>&1";
-        const auditResult = await _sandboxManager.exec(auditCmd);
-        // npm audit returns 1 when vulnerabilities are found — that's valid output
-        return {
-            content: auditResult.stdout || "No known vulnerabilities found in dependencies.",
-            metadata: { exitCode: auditResult.exitCode },
-            isError: false
-        };
-    },
-};
-//# sourceMappingURL=security.js.map

package/dist/tools/security.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/tools/security.ts"],"names":[],"mappings":"AAIA,+EAA+E;AAE/E,IAAI,eAAe,GAA0B,IAAI,CAAC;AAClD,IAAI,UAAU,GAAyB,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,SAAwB;IAExB,eAAe,GAAG,OAAO,CAAC;IAC1B,UAAU,GAAG,SAAS,CAAC;AACzB,CAAC;AAED,mFAAmF;AAEnF;;GAEG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AAEnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAyB;IACpD,IAAI,EAAE,eAAe;IACrB,WAAW,EACT,2FAA2F;QAC3F,8FAA8F;IAChG,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,WAAW,EACT,2FAA2F;aAC9F;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iEAAiE;aACpE;SACF;QACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB;IACD,OAAO,EAAE,KAAK,EAAE,IAAuC,EAAuB,EAAE;QAC9E,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,kEAAkE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxG,CAAC;QAED,iCAAiC;QACjC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAEnE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,CACP,uDAAuD;oBACvD,gBAAgB;oBAChB,kFAAkF;oBAClF,6DAA6D;oBAC7D,2EAA2E,CAC5E;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAe,CAAC;QACpB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,SAAS;gBACZ,OAAO,GAAG,kDAAkD,CAAC;gBAC7D,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,EAAE,OAAO,EAAE,kDAAkD,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACxF,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,OAAO,EAAE,OAAO,EAAE,iGAAiG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACvI,CAAC;gBACD,OAAO,GAAG,sDAAsD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAChG,MAAM;YACR,KAAK,MAAM;gBACT,OAAO,GAAG,8DAA8D,CAAC;gBACzE,MAAM;YACR;gBACE,OAAO,EAAE,OAAO,EAAE,0BAA0B,IAAI,CAAC,MAAM,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,mCAAmC,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE;gBACnG,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACvC,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,4CAA4C;YACtE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;YACvC,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,mFAAmF;AAEnF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAyB;IAC/C,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,+DAA+D;QAC/D,2DAA2D;IAC7D,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;gBACzB,WAAW,EAAE,2DAA2D;aACzE;SACF;KACF;IACD,OAAO,EAAE,KAAK,EAAE,IAA0B,EAAuB,EAAE;QACjE,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,oDAAoD,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;QAEzC,wBAAwB;QACxB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAEpE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GACV,MAAM,KAAK,MAAM;gBACf,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,qCAAqC,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAElD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,MAAM,IAAI,iDAAiD;oBAC3E,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACvC,OAAO,EAAE,KAAK;iBACf,CAAC;YACJ,CAAC;YAED,gFAAgF;YAChF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC3C,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,MAAM;oBACtB,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACvC,OAAO,EAAE,KAAK;iBACf,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,QAAQ,2CAA2C,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/I,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GACZ,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,iCAAiC,CAAC;QAExC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzD,2EAA2E;QAC3E,OAAO;YACL,OAAO,EAAE,WAAW,CAAC,MAAM,IAAI,iDAAiD;YAChF,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE;YAC5C,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/tools/spawnAgent.d.ts

@@ -1,19 +0,0 @@
-/**
- * Spawn Agent Tools
- *
- * DynamicToolInterface implementations for spawning and checking sub-agents.
- * These tools are registered with the main agent's tool set, allowing the
- * LLM to delegate scoped tasks to isolated sub-agents.
- *
- * Safety: spawn_agent and check_agent are excluded from sub-agent tool sets
- * to enforce the depth-1 nesting limit.
- */
-import { DynamicToolInterface } from "./index.js";
-import { SubAgentManager } from "../core/subAgent.js";
-import { AgentRegistry } from "../agents/agentRegistry.js";
-/**
- * Creates the spawn_agent and check_agent tools bound to a SubAgentManager.
- * The agent registry summary is injected into the spawn_agent description
- * so the LLM knows which agents are available.
- */
-export declare function createSpawnAgentTools(manager: SubAgentManager, registry: AgentRegistry): DynamicToolInterface[];

package/dist/tools/spawnAgent.js

@@ -1,130 +0,0 @@
-/**
- * Spawn Agent Tools
- *
- * DynamicToolInterface implementations for spawning and checking sub-agents.
- * These tools are registered with the main agent's tool set, allowing the
- * LLM to delegate scoped tasks to isolated sub-agents.
- *
- * Safety: spawn_agent and check_agent are excluded from sub-agent tool sets
- * to enforce the depth-1 nesting limit.
- */
-// ─── Factory ────────────────────────────────────────────────────────────────────
-/**
- * Creates the spawn_agent and check_agent tools bound to a SubAgentManager.
- * The agent registry summary is injected into the spawn_agent description
- * so the LLM knows which agents are available.
- */
-export function createSpawnAgentTools(manager, registry) {
-    const agentNames = registry.getNames();
-    const agentList = agentNames.join(", ");
-    // ─── spawn_agent ───────────────────────────────────────────────────────────
-    const SpawnAgentTool = {
-        name: "spawn_agent",
-        description: `Spawn an isolated sub-agent to handle a scoped task. Available agents: ${agentList}. ` +
-            `The sub-agent runs independently with its own conversation and returns a structured result. ` +
-            `Use mode "async" for non-blocking execution — you can continue working and check results later with check_agent.`,
-        schema: {
-            type: "object",
-            properties: {
-                agent: {
-                    type: "string",
-                    description: `The agent name from the registry. Available: ${agentList}`,
-                    enum: agentNames,
-                },
-                task: {
-                    type: "string",
-                    description: "Detailed description of the task for the sub-agent to complete",
-                },
-                mode: {
-                    type: "string",
-                    enum: ["sync", "async"],
-                    description: "Execution mode: 'sync' (default, blocks until done) or 'async' (non-blocking, returns taskId)",
-                },
-            },
-            required: ["agent", "task"],
-        },
-        execute: async (args) => {
-            const mode = args.mode ?? "sync";
-            if (mode === "async") {
-                try {
-                    const taskId = await manager.spawnAsync(args.agent, args.task);
-                    return {
-                        content: `Async sub-agent "${args.agent}" started. Task ID: ${taskId}\n` +
-                            `Use check_agent with this taskId to get the result when ready.`,
-                        metadata: { taskId, agentName: args.agent, mode: "async" },
-                    };
-                }
-                catch (err) {
-                    return { content: `Spawn error: ${err.message}`, isError: true };
-                }
-            }
-            // Sync mode (default)
-            const result = await manager.spawn(args.agent, args.task);
-            return {
-                content: formatSubAgentResult(result),
-                metadata: {
-                    agentName: result.agentName,
-                    outcome: result.outcome,
-                    toolCalls: result.toolCallCount,
-                    turnsUsed: result.turnsUsed,
-                    duration: result.duration,
-                },
-                isError: result.outcome === "failure",
-            };
-        },
-    };
-    // ─── check_agent ───────────────────────────────────────────────────────────
-    const CheckAgentTool = {
-        name: "check_agent",
-        description: "Check the status or retrieve the result of an async sub-agent task. " +
-            "If the task is still running, returns a status update. If completed, returns the result.",
-        schema: {
-            type: "object",
-            properties: {
-                taskId: {
-                    type: "string",
-                    description: "The task ID returned by spawn_agent in async mode",
-                },
-            },
-            required: ["taskId"],
-        },
-        execute: async (args) => {
-            const result = await manager.getResult(args.taskId);
-            if (typeof result === "string") {
-                // Still running or unknown
-                return { content: result };
-            }
-            // Completed — return formatted result
-            return {
-                content: formatSubAgentResult(result),
-                metadata: {
-                    agentName: result.agentName,
-                    outcome: result.outcome,
-                    toolCalls: result.toolCallCount,
-                    turnsUsed: result.turnsUsed,
-                    duration: result.duration,
-                },
-                isError: result.outcome === "failure",
-            };
-        },
-    };
-    return [SpawnAgentTool, CheckAgentTool];
-}
-// ─── Formatter ──────────────────────────────────────────────────────────────────
-/**
- * Formats a SubAgentResult into a readable string for the main agent.
- */
-function formatSubAgentResult(result) {
-    const lines = [
-        `--- Sub-Agent Result: ${result.agentName} ---`,
-        `Outcome: ${result.outcome}`,
-        `Turns: ${result.turnsUsed} | Tool Calls: ${result.toolCallCount} | Duration: ${Math.round(result.duration / 1000)}s`,
-        `Tokens: ~${result.tokenUsage.prompt} prompt + ~${result.tokenUsage.completion} completion`,
-    ];
-    if (result.filesModified.length > 0) {
-        lines.push(`Files Modified: ${result.filesModified.join(", ")}`);
-    }
-    lines.push(`\nResult:\n${result.result}`);
-    return lines.join("\n");
-}
-//# sourceMappingURL=spawnAgent.js.map

package/dist/tools/spawnAgent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"spawnAgent.js","sourceRoot":"","sources":["../../src/tools/spawnAgent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,mFAAmF;AAEnF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAwB,EACxB,QAAuB;IAEvB,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAExC,8EAA8E;IAE9E,MAAM,cAAc,GAAyB;QAC3C,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,0EAA0E,SAAS,IAAI;YACvF,8FAA8F;YAC9F,kHAAkH;QACpH,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gDAAgD,SAAS,EAAE;oBACxE,IAAI,EAAE,UAAU;iBACjB;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gEAAgE;iBAC9E;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;oBACvB,WAAW,EAAE,+FAA+F;iBAC7G;aACF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;SAC5B;QACD,OAAO,EAAE,KAAK,EAAE,IAIf,EAAuB,EAAE;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;YAEjC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/D,OAAO;wBACL,OAAO,EAAE,oBAAoB,IAAI,CAAC,KAAK,uBAAuB,MAAM,IAAI;4BACtE,gEAAgE;wBAClE,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;qBAC3D,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,OAAO,EAAE,OAAO,EAAE,gBAAgB,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACnE,CAAC;YACH,CAAC;YAED,sBAAsB;YACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC;gBACrC,QAAQ,EAAE;oBACR,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,aAAa;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;gBACD,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,SAAS;aACtC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAyB;QAC3C,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,sEAAsE;YACtE,0FAA0F;QAC5F,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,mDAAmD;iBACjE;aACF;YACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;SACrB;QACD,OAAO,EAAE,KAAK,EAAE,IAAwB,EAAuB,EAAE;YAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAEpD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,2BAA2B;gBAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7B,CAAC;YAED,sCAAsC;YACtC,OAAO;gBACL,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC;gBACrC,QAAQ,EAAE;oBACR,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,aAAa;oBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;gBACD,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,SAAS;aACtC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AAC1C,CAAC;AAED,mFAAmF;AAEnF;;GAEG;AACH,SAAS,oBAAoB,CAAC,MAAsB;IAClD,MAAM,KAAK,GAAG;QACZ,yBAAyB,MAAM,CAAC,SAAS,MAAM;QAC/C,YAAY,MAAM,CAAC,OAAO,EAAE;QAC5B,UAAU,MAAM,CAAC,SAAS,kBAAkB,MAAM,CAAC,aAAa,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG;QACrH,YAAY,MAAM,CAAC,UAAU,CAAC,MAAM,cAAc,MAAM,CAAC,UAAU,CAAC,UAAU,aAAa;KAC5F,CAAC;IAEF,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/webSearch.d.ts

@@ -1,6 +0,0 @@
-import { DynamicToolInterface } from "./index.js";
-/**
- * Bind the Valyu API key at session start.
- */
-export declare function bindValyuApiKey(key: string | undefined): void;
-export declare const WebSearchTool: DynamicToolInterface;

package/dist/tools/webSearch.js

@@ -1,120 +0,0 @@
-/**
- * Web Search Tool — wraps the Valyu AI Search SDK.
- *
- * Provides AI-optimized web search and domain-specific search
- * (papers, finance, patents, SEC filings, etc.). Runs on the Host
- * (API call, not a shell command).
- *
- * Requires a Valyu API key in config (`valyuApiKey`).
- */
-let _valyuApiKey;
-/**
- * Bind the Valyu API key at session start.
- */
-export function bindValyuApiKey(key) {
-    _valyuApiKey = key;
-}
-export const WebSearchTool = {
-    name: "web_search",
-    description: "Search the web for information. Supports general web search and specialized sources: " +
-        "papers (arXiv/PubMed), finance, patents, SEC filings, companies. " +
-        "Returns AI-optimized structured results.",
-    schema: {
-        type: "object",
-        properties: {
-            query: {
-                type: "string",
-                description: "The search query",
-            },
-            source: {
-                type: "string",
-                enum: ["web", "papers", "finance", "patents", "sec", "companies"],
-                description: 'Search source (default: "web"). Use "papers" for academic, "finance" for financial data, etc.',
-            },
-            maxResults: {
-                type: "number",
-                description: "Maximum number of results to return (default: 5)",
-            },
-        },
-        required: ["query"],
-    },
-    execute: async (args) => {
-        if (!_valyuApiKey) {
-            return {
-                content: "Error: Valyu API key not configured.\n" +
-                    'Run `joone config` and set your Valyu API key, or add "valyuApiKey" to ~/.joone/config.json.',
-                isError: true
-            };
-        }
-        const source = args.source ?? "web";
-        const maxResults = args.maxResults ?? 5;
-        try {
-            // Dynamic import to avoid requiring the dependency at startup
-            const { Valyu } = await import("@valyu/ai-sdk");
-            const valyu = new Valyu({ apiKey: _valyuApiKey });
-            let results;
-            switch (source) {
-                case "web":
-                    results = await valyu.search({
-                        query: args.query,
-                        maxResults,
-                    });
-                    break;
-                case "papers":
-                    results = await valyu.paperSearch({
-                        query: args.query,
-                        maxResults,
-                    });
-                    break;
-                case "finance":
-                    results = await valyu.financeSearch({
-                        query: args.query,
-                        maxResults,
-                    });
-                    break;
-                case "patents":
-                    results = await valyu.patentSearch({
-                        query: args.query,
-                        maxResults,
-                    });
-                    break;
-                case "sec":
-                    results = await valyu.secSearch({
-                        query: args.query,
-                        maxResults,
-                    });
-                    break;
-                case "companies":
-                    results = await valyu.companyResearch({
-                        query: args.query,
-                        maxResults,
-                    });
-                    break;
-                default:
-                    return {
-                        content: `Error: Unknown source "${source}". Use: web, papers, finance, patents, sec, companies.`,
-                        isError: true
-                    };
-            }
-            // Format results for the LLM
-            if (!results || !results.results || results.results.length === 0) {
-                return { content: `No results found for "${args.query}" in ${source} source.` };
-            }
-            const formatted = results.results
-                .map((r, i) => `${i + 1}. **${r.title || "Untitled"}**\n   ${r.url || ""}\n   ${r.snippet || r.content || ""}`)
-                .join("\n\n");
-            return { content: `Search results for "${args.query}" (${source}):\n\n${formatted}` };
-        }
-        catch (error) {
-            if (error.code === "ERR_MODULE_NOT_FOUND" || error.code === "MODULE_NOT_FOUND") {
-                return {
-                    content: "Error: @valyu/ai-sdk is not installed.\n" +
-                        "Run: npm install @valyu/ai-sdk",
-                    isError: true
-                };
-            }
-            return { content: `Search error: ${error.message}`, isError: true };
-        }
-    },
-};
-//# sourceMappingURL=webSearch.js.map

package/dist/tools/webSearch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webSearch.js","sourceRoot":"","sources":["../../src/tools/webSearch.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,IAAI,YAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,YAAY,GAAG,GAAG,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAyB;IACjD,IAAI,EAAE,YAAY;IAClB,WAAW,EACT,uFAAuF;QACvF,mEAAmE;QACnE,0CAA0C;IAC5C,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,kBAAkB;aAChC;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC;gBACjE,WAAW,EACT,+FAA+F;aAClG;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,kDAAkD;aAChE;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB;IACD,OAAO,EAAE,KAAK,EAAE,IAIf,EAAuB,EAAE;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EACL,wCAAwC;oBACxC,8FAA8F;gBAChG,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAEhD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAElD,IAAI,OAAY,CAAC;YAEjB,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,KAAK;oBACR,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;wBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,UAAU;qBACX,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,QAAQ;oBACX,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;wBAChC,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,UAAU;qBACX,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,SAAS;oBACZ,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;wBAClC,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,UAAU;qBACX,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,SAAS;oBACZ,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC;wBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,UAAU;qBACX,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,KAAK;oBACR,OAAO,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;wBAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,UAAU;qBACX,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,WAAW;oBACd,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC;wBACpC,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,UAAU;qBACX,CAAC,CAAC;oBACH,MAAM;gBACR;oBACE,OAAO;wBACL,OAAO,EAAE,0BAA0B,MAAM,wDAAwD;wBACjG,OAAO,EAAE,IAAI;qBACd,CAAC;YACN,CAAC;YAED,6BAA6B;YAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjE,OAAO,EAAE,OAAO,EAAE,yBAAyB,IAAI,CAAC,KAAK,QAAQ,MAAM,UAAU,EAAE,CAAC;YAClF,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO;iBAC9B,GAAG,CACF,CAAC,CAAM,EAAE,CAAS,EAAE,EAAE,CACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,UAAU,UAAU,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAClG;iBACA,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhB,OAAO,EAAE,OAAO,EAAE,uBAAuB,IAAI,CAAC,KAAK,MAAM,MAAM,SAAS,SAAS,EAAE,EAAE,CAAC;QACxF,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC/E,OAAO;oBACL,OAAO,EACL,0CAA0C;wBAC1C,gCAAgC;oBAClC,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;CACF,CAAC"}

package/docs/01_insights_and_patterns.md

@@ -1,27 +0,0 @@
-# Actionable Insights, Patterns, and Best Practices
-
-Derived from recent research on Harness Engineering and Prompt Caching for Agentic Coding.
-
-## 1. The Cache-Optimized Context Prefix (Prompt Caching)
-
-- **Prefix Matching Rule:** LLM APIs cache everything from the start of a prompt up to a `cache_control` breakpoint. Any dynamic change in the middle invalidates the rest of the cache.
-- **Order Matters (Static to Dynamic):**
-  1. Base System Instructions & Tool Definitions (Globally Cached)
-  2. Project/Workspace memory (e.g., `CLAUDE.md`) (Cached per project)
-  3. Session State (Environment variables, rules) (Cached per session)
-  4. Conversation Messages (Grows iteratively)
-- **Immutability within a Session:** Never add/remove tools mid-conversation, and never swap models (e.g., from Opus to Haiku) mid-session, as this breaks the cache prefix.
-- **The `<system-reminder>` Pattern:** If you need to update agent behavior or state, do **not** edit the system prompt. Instead, insert a `<system-reminder>` tag inside the next simulated User Message or Tool Result.
-
-## 2. Harness Engineering & Middleware
-
-- **Control via Harness, Not Just Prompts:** Mold the agent's behavior by building programmatic wrappers (middleware) around the LLM reasoning step rather than just asking the LLM nicely.
-- **Anti-Doom-Loop Middleware:** Track per-file edits in the harness. If an agent edits the same file N times without success, inject a message forcing it to reconsider its approach.
-- **Forced Self-Verification:** Agents tend to write code and immediately stop without testing. Implement a `PreCompletionChecklistMiddleware` that intercepts the agent's attempt to exit, forcing it to run local tests and read the full output before concluding.
-- **Local Context Injection:** Automatically discover and map the working directory and available binaries (e.g., Python, Node) into the prompt upon startup.
-
-## 3. Agent Execution Strategy
-
-- **The Reasoning Sandwich:** Adjust the amount of compute/reasoning dynamically. Use heavy reasoning for Planning, Discovery, and Final Verification, but use medium reasoning for straightforward code implementations to save time and tokens.
-- **Lazy Tool Loading (Searchable Tools):** Instead of stuffing every possible schema into the prompt, provide "stubs" (tool names and descriptions). Allow the agent to search for advanced tools, deferring the loading of full schemas to preserve prefix caching.
-- **Trace-Driven Improvement:** Treat tracing (e.g., LangSmith) as a first-class feature. Route raw text-space traces to a designated "Trace Analyzer Subagent" to find where the agent frequently fails, allowing you to patch the harness without blindly guessing.