kritya 0.8.2-beta

package/dist/telemetry/otlp.js

@@ -0,0 +1,128 @@
+import { debugLog } from "../config/debug.js";
+function toAnyValue(value) {
+    if (typeof value === "string")
+        return { stringValue: value };
+    if (typeof value === "boolean")
+        return { boolValue: value };
+    return { doubleValue: value };
+}
+function toKeyValueList(attributes) {
+    return Object.entries(attributes).map(([key, value]) => ({ key, value: toAnyValue(value) }));
+}
+function toOtlpResource(resource) {
+    return { attributes: toKeyValueList(resource.attributes) };
+}
+const STATUS_CODE = { UNSET: 0, OK: 1, ERROR: 2 };
+function toOtlpSpan(span) {
+    return {
+        traceId: span.traceId,
+        spanId: span.spanId,
+        ...(span.parentSpanId ? { parentSpanId: span.parentSpanId } : {}),
+        name: span.name,
+        kind: 1, // SPAN_KIND_INTERNAL — kritya's spans are all local tool-loop work
+        startTimeUnixNano: span.startTimeUnixNano,
+        endTimeUnixNano: span.endTimeUnixNano,
+        attributes: toKeyValueList(span.attributes),
+        status: {
+            code: STATUS_CODE[span.status.code],
+            ...(span.status.message ? { message: span.status.message } : {}),
+        },
+        events: span.events.map((e) => ({
+            name: e.name,
+            timeUnixNano: e.timeUnixNano,
+            attributes: e.attributes ? toKeyValueList(e.attributes) : [],
+        })),
+    };
+}
+/** Wraps a single span in an ExportTraceServiceRequest — one HTTP call per span, no client-side batching (the collector batches downstream). */
+export function encodeSpan(span, resource) {
+    return {
+        resourceSpans: [
+            {
+                resource: toOtlpResource(resource),
+                scopeSpans: [{ scope: { name: "kritya" }, spans: [toOtlpSpan(span)] }],
+            },
+        ],
+    };
+}
+const CUMULATIVE = 2; // AGGREGATION_TEMPORALITY_CUMULATIVE
+function toOtlpMetric(point) {
+    const dataPointBase = {
+        attributes: toKeyValueList(point.attributes),
+        startTimeUnixNano: point.startTimeUnixNano,
+        timeUnixNano: point.timeUnixNano,
+    };
+    if (point.kind === "sum") {
+        return {
+            name: point.name,
+            sum: {
+                dataPoints: [{ ...dataPointBase, asDouble: point.sumValue ?? 0 }],
+                aggregationTemporality: CUMULATIVE,
+                isMonotonic: point.isMonotonic ?? true,
+            },
+        };
+    }
+    const h = point.histogram;
+    return {
+        name: point.name,
+        histogram: {
+            dataPoints: [
+                {
+                    ...dataPointBase,
+                    count: String(h.count),
+                    sum: h.sum,
+                    bucketCounts: h.bucketCounts.map(String),
+                    explicitBounds: h.explicitBounds,
+                },
+            ],
+            aggregationTemporality: CUMULATIVE,
+        },
+    };
+}
+/** Wraps the current cumulative snapshot of all metric points in one ExportMetricsServiceRequest. */
+export function encodeMetricsSnapshot(points, resource) {
+    return {
+        resourceMetrics: [
+            {
+                resource: toOtlpResource(resource),
+                scopeMetrics: [{ scope: { name: "kritya" }, metrics: points.map(toOtlpMetric) }],
+            },
+        ],
+    };
+}
+/**
+ * Fire-and-forget POST to an OTLP/HTTP collector endpoint. Best-effort like
+ * every other telemetry sink in this codebase — a down collector must never
+ * slow down or break a turn.
+ */
+export function postOtlp(endpoint, path, body, headers) {
+    try {
+        fetch(`${endpoint.replace(/\/+$/, "")}${path}`, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...(headers ?? {}) },
+            body: JSON.stringify(body),
+        }).catch((err) => debugLog(`postOtlp(${path})`, err));
+    }
+    catch (err) {
+        debugLog(`postOtlp(${path})`, err);
+    }
+}
+/**
+ * Same as postOtlp, but awaits the request instead of firing-and-forgetting.
+ * Used by shutdown paths that want to give the last export a chance to
+ * actually complete before the process exits — callers are expected to race
+ * this against a short timeout themselves (a hung network call must never
+ * block process shutdown indefinitely).
+ */
+export async function postOtlpAndWait(endpoint, path, body, headers) {
+    try {
+        await fetch(`${endpoint.replace(/\/+$/, "")}${path}`, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...(headers ?? {}) },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        debugLog(`postOtlpAndWait(${path})`, err);
+    }
+}

package/dist/telemetry/tracer.js

@@ -0,0 +1,240 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "../config/config.js";
+import { hardenWindowsDir } from "../config/winAcl.js";
+import { debugLog } from "../config/debug.js";
+import { VERSION } from "../version.js";
+import { encodeSpan, postOtlp } from "./otlp.js";
+function nowUnixNano() {
+    // ms resolution is all we can portably get; scale to nanoseconds so the
+    // field matches the OTel schema consumers expect.
+    return (BigInt(Date.now()) * 1000000n).toString();
+}
+const NOOP_SPAN = {
+    traceId: "",
+    spanId: "",
+    setAttribute() {
+        return this;
+    },
+    addEvent() {
+        return this;
+    },
+    setStatus() {
+        return this;
+    },
+    end() { },
+};
+/** A tracer that does nothing — used when telemetry is disabled. */
+export const NOOP_TRACER = {
+    startSpan() {
+        return NOOP_SPAN;
+    },
+};
+class RealSpan {
+    sink;
+    traceId;
+    spanId;
+    parentSpanId;
+    name;
+    start;
+    attributes;
+    events = [];
+    status = { code: "UNSET" };
+    ended = false;
+    constructor(name, traceId, parentSpanId, attributes, sink) {
+        this.sink = sink;
+        this.name = name;
+        this.traceId = traceId;
+        this.spanId = crypto.randomBytes(8).toString("hex");
+        this.parentSpanId = parentSpanId;
+        this.attributes = { ...attributes };
+        this.start = nowUnixNano();
+    }
+    setAttribute(key, value) {
+        this.attributes[key] = value;
+        return this;
+    }
+    addEvent(name, attributes) {
+        this.events.push({ name, timeUnixNano: nowUnixNano(), attributes });
+        return this;
+    }
+    setStatus(code, message) {
+        this.status = { code, message };
+        return this;
+    }
+    end() {
+        if (this.ended)
+            return; // ending twice would double-emit
+        this.ended = true;
+        this.sink({
+            traceId: this.traceId,
+            spanId: this.spanId,
+            parentSpanId: this.parentSpanId,
+            name: this.name,
+            startTimeUnixNano: this.start,
+            endTimeUnixNano: nowUnixNano(),
+            attributes: this.attributes,
+            status: this.status,
+            events: this.events,
+        });
+    }
+}
+class RealTracer {
+    sink;
+    constructor(sink) {
+        this.sink = sink;
+    }
+    startSpan(name, opts) {
+        const parent = opts?.parent;
+        // Children inherit the parent's trace id; roots mint a new one.
+        const traceId = parent && parent.traceId ? parent.traceId : crypto.randomBytes(16).toString("hex");
+        const parentSpanId = parent && parent.spanId ? parent.spanId : undefined;
+        return new RealSpan(name, traceId, parentSpanId, opts?.attributes ?? {}, this.sink);
+    }
+}
+/**
+ * KRITYA_TELEMETRY_DIR overrides it — used by tests so cleanupOldTelemetry's
+ * directory scan never touches the real ~/.kritya/telemetry on a dev machine.
+ */
+function telemetryDir() {
+    return process.env.KRITYA_TELEMETRY_DIR || path.join(CONFIG_DIR, "telemetry");
+}
+/** KRITYA_OTEL if set, else config.json's persisted `otel` default, else "off". */
+function resolveOtelMode(configDefault) {
+    return (process.env.KRITYA_OTEL ?? configDefault ?? "off").toLowerCase();
+}
+/**
+ * Where this session's spans are written, or undefined when no file sink is
+ * active. Exported so callers that report results (headless JSON) can point
+ * the reader at the trace without duplicating the path logic.
+ */
+export function telemetryFileFor(sessionId, configDefault) {
+    const mode = resolveOtelMode(configDefault);
+    if (mode === "off" || mode === "" || mode === "false")
+        return undefined;
+    // "console" is the only enabled mode with no file behind it.
+    if (mode === "console")
+        return undefined;
+    return process.env.KRITYA_OTEL_FILE ?? path.join(telemetryDir(), `${sessionId}.otel.jsonl`);
+}
+/**
+ * Delete telemetry span files older than `retentionDays`. Best-effort, same
+ * pattern as SessionStore.cleanupOldSessions and AuditLog.cleanupOld. 0 or
+ * negative means "keep forever" — auto-delete disabled.
+ */
+export function cleanupOldTelemetry(retentionDays) {
+    if (retentionDays <= 0)
+        return;
+    const cutoff = Date.now() - retentionDays * 24 * 60 * 60 * 1000;
+    let files;
+    try {
+        files = fs.readdirSync(telemetryDir()).filter((f) => f.endsWith(".otel.jsonl"));
+    }
+    catch {
+        return;
+    }
+    for (const f of files) {
+        const file = path.join(telemetryDir(), f);
+        try {
+            if (fs.statSync(file).mtimeMs < cutoff)
+                fs.unlinkSync(file);
+        }
+        catch (err) {
+            debugLog(`cleanupOldTelemetry(${file})`, err);
+        }
+    }
+}
+function fileSink(file) {
+    let ready = false;
+    return (span) => {
+        try {
+            if (!ready) {
+                fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+                hardenWindowsDir(telemetryDir());
+                ready = true;
+            }
+            fs.appendFileSync(file, JSON.stringify(span) + "\n", { mode: 0o600 });
+        }
+        catch (err) {
+            // best-effort: telemetry must never crash a turn
+            debugLog(`tracer.fileSink(${file})`, err);
+        }
+    };
+}
+function consoleSink() {
+    return (span) => {
+        try {
+            process.stderr.write(`[otel] ${JSON.stringify(span)}\n`);
+        }
+        catch {
+            // best-effort
+        }
+    };
+}
+function resourceFor(sessionId) {
+    return {
+        attributes: {
+            "service.name": "kritya",
+            "service.version": VERSION,
+            "os.type": process.platform,
+            // Same resource-identity fields as metrics.ts's createMeter, so traces
+            // and metrics from the same session agree on resource identity.
+            "service.instance.id": sessionId,
+        },
+    };
+}
+function parseOtlpHeaders(raw) {
+    if (!raw)
+        return undefined;
+    const headers = {};
+    for (const pair of raw.split(",")) {
+        const eq = pair.indexOf("=");
+        if (eq === -1)
+            continue;
+        headers[pair.slice(0, eq).trim()] = pair.slice(eq + 1).trim();
+    }
+    return headers;
+}
+function otlpSink(endpoint, sessionId) {
+    const headers = parseOtlpHeaders(process.env.KRITYA_OTEL_HEADERS);
+    const resource = resourceFor(sessionId);
+    return (span) => {
+        try {
+            postOtlp(endpoint, "/v1/traces", encodeSpan(span, resource), headers);
+        }
+        catch (err) {
+            // best-effort: telemetry must never crash a turn
+            debugLog(`tracer.otlpSink(${endpoint})`, err);
+        }
+    };
+}
+/**
+ * Build the tracer configured by the environment for this session. Returns the
+ * shared no-op tracer when telemetry is off, so callers can always hold a
+ * Tracer and call startSpan unconditionally.
+ */
+export function createTracer(sessionId, configDefault) {
+    const mode = resolveOtelMode(configDefault);
+    const endpoint = process.env.KRITYA_OTEL_ENDPOINT;
+    const modeOff = mode === "off" || mode === "" || mode === "false";
+    if (modeOff && !endpoint)
+        return NOOP_TRACER;
+    const sinks = [];
+    if (mode === "file" || mode === "both") {
+        sinks.push(fileSink(telemetryFileFor(sessionId, configDefault)));
+    }
+    if (mode === "console" || mode === "both") {
+        sinks.push(consoleSink());
+    }
+    if (endpoint) {
+        sinks.push(otlpSink(endpoint, sessionId));
+    }
+    if (!sinks.length) {
+        // Unrecognized value (e.g. "1", "on"): default to a file, which is the
+        // useful local-only behavior, rather than silently doing nothing.
+        sinks.push(fileSink(path.join(telemetryDir(), `${sessionId}.otel.jsonl`)));
+    }
+    const sink = sinks.length === 1 ? sinks[0] : (span) => sinks.forEach((s) => s(span));
+    return new RealTracer(sink);
+}

package/dist/tools/askUser.js

@@ -0,0 +1,64 @@
+const MAX_OPTIONS = 6;
+const OTHER = "Other (type my own answer)";
+/**
+ * A clarifying question with pick-from-a-list options instead of open prose,
+ * so the user can answer with a keypress. There is always a way to answer
+ * outside the given options: picking "Other" opens a free-text field, so a
+ * narrow option list never traps the user into a wrong answer.
+ *
+ * Deliberately not available to subagents — spawnAgents' isolated contexts
+ * don't carry a UI to ask through, and a subagent blocking on user input
+ * would stall the parallel batch it's part of.
+ */
+export const askUserTool = {
+    name: "ask_user",
+    description: "Ask the user one clarifying question with a short list of options to choose from, instead " +
+        "of open-ended prose. Use this for make-or-break questions where you'd otherwise have to " +
+        "guess — not for anything you can reasonably default and state your choice for. The user " +
+        'can always type a custom answer via the automatic "Other" option, so keep the given list ' +
+        `short (2-${MAX_OPTIONS - 1} options) rather than trying to enumerate every possibility.`,
+    parameters: {
+        type: "object",
+        properties: {
+            question: { type: "string", description: "The question to ask, in one or two sentences" },
+            options: {
+                type: "array",
+                description: `2 to ${MAX_OPTIONS - 1} short choices, each a few words`,
+                items: { type: "string" },
+            },
+        },
+        required: ["question", "options"],
+    },
+    requiresPermission: false,
+    summarize: (args) => `Ask: ${String(args.question ?? "").slice(0, 80)}`,
+    async execute(args, ctx) {
+        const question = String(args.question ?? "").trim();
+        if (!question)
+            throw new Error("question must not be empty");
+        const options = Array.isArray(args.options)
+            ? args.options.map((o) => String(o).trim()).filter(Boolean)
+            : [];
+        if (options.length < 2)
+            throw new Error("options must have at least 2 choices");
+        if (options.length > MAX_OPTIONS - 1) {
+            throw new Error(`options must have at most ${MAX_OPTIONS - 1} choices — keep it short`);
+        }
+        if (!ctx.requestElicitation) {
+            return "ask_user is not available in this session — proceed with your best judgment instead.";
+        }
+        const picked = await ctx.requestElicitation(question, [
+            { name: "choice", kind: "enum", label: question, options: [...options, OTHER] },
+        ]);
+        if (picked.action !== "accept")
+            return "The user declined to answer — proceed with your best judgment.";
+        const choice = picked.content.choice;
+        if (choice !== OTHER)
+            return `The user chose: ${choice}`;
+        const typed = await ctx.requestElicitation(question, [
+            { name: "answer", kind: "string", label: "Your answer" },
+        ]);
+        if (typed.action !== "accept")
+            return "The user declined to answer — proceed with your best judgment.";
+        return `The user answered: ${typed.content.answer}`;
+    },
+};

package/dist/tools/bg.js

@@ -0,0 +1,59 @@
+import { backgroundManager } from "../shell/background.js";
+import { truncateTail } from "./common.js";
+import { redactSecrets } from "./secretScan.js";
+export const bgOutputTool = {
+    name: "bg_output",
+    description: "Read the recent output of a background process started with shell background:true. " +
+        "Reports whether it is still running and its exit code if finished. " +
+        "Call without an id to list all background processes.",
+    parameters: {
+        type: "object",
+        properties: {
+            id: { type: "string", description: "Background process id, e.g. bg_1 (omit to list all)" },
+        },
+    },
+    requiresPermission: false,
+    summarize: (args) => (args.id ? `Read output of ${args.id}` : "List background processes"),
+    execute(args) {
+        if (!args.id) {
+            const list = backgroundManager.list();
+            if (!list.length)
+                return Promise.resolve("No background processes.");
+            return Promise.resolve(list
+                .map((p) => `${p.id} [${p.running ? "running" : "exited"}]: ${redactSecrets(p.command).redacted}`)
+                .join("\n"));
+        }
+        const info = backgroundManager.read(String(args.id));
+        if (!info)
+            return Promise.resolve(`Error: no background process "${args.id}"`);
+        const status = info.running ? "still running" : `exited with code ${info.exitCode}`;
+        // The header is redacted (a secret can appear in the command itself) but
+        // kept OUT of truncateTail, which keeps the tail: folding it in meant a
+        // chatty process could truncate away which process this is and whether
+        // it's still running.
+        const head = redactSecrets(`Process ${args.id} (${info.command}) — ${status}`);
+        const body = redactSecrets(info.output || "(no output yet)");
+        const matches = [...head.matches, ...body.matches];
+        const note = matches.length > 0
+            ? `[${matches.length} secret(s) redacted from output: ${matches.map((m) => m.kind).join(", ")}]\n`
+            : "";
+        return Promise.resolve(`${note}${head.redacted}\n\n${truncateTail(body.redacted, 10_000)}`);
+    },
+};
+export const bgKillTool = {
+    name: "bg_kill",
+    description: "Stop a background process started with shell background:true.",
+    parameters: {
+        type: "object",
+        properties: {
+            id: { type: "string", description: "Background process id, e.g. bg_1" },
+        },
+        required: ["id"],
+    },
+    requiresPermission: false,
+    summarize: (args) => `Kill background process ${args.id}`,
+    execute(args) {
+        const ok = backgroundManager.kill(String(args.id));
+        return Promise.resolve(ok ? `Sent SIGTERM to ${args.id}.` : `Error: "${args.id}" is not a running background process`);
+    },
+};

package/dist/tools/common.js

@@ -0,0 +1,158 @@
+import fs from "node:fs";
+import path from "node:path";
+/** Resolve symlinks in `p`, walking up to the nearest existing ancestor if it doesn't exist yet. */
+function realpathAllowMissing(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        const parent = path.dirname(p);
+        if (parent === p)
+            return p;
+        return path.join(realpathAllowMissing(parent), path.basename(p));
+    }
+}
+/**
+ * Filename/path patterns that are treated as sensitive and blocked from being
+ * read or written by tools, regardless of allowlist rules. This is a
+ * defense-in-depth measure against prompt injection tricking the agent into
+ * exfiltrating secrets — it is not a substitute for keeping real secrets out
+ * of the workspace.
+ */
+const SENSITIVE_PATH_PATTERNS = [
+    /(^|[\\/])\.env(\..*)?$/i,
+    // The whole .git/ directory, not just .git/config: .git/hooks/* runs
+    // automatically on the next commit/checkout/push, so a write anywhere in
+    // there is arbitrary code execution disguised as a file edit.
+    /(^|[\\/])\.git[\\/]/i,
+    /(^|[\\/])\.gitconfig$/i,
+    /(^|[\\/])[^\\/]*credentials[^\\/]*$/i,
+    /(^|[\\/])[^\\/]*secret[^\\/]*$/i,
+    /(^|[\\/])id_rsa(\.[^\\/]*)?$/i,
+    /(^|[\\/])id_ed25519(\.[^\\/]*)?$/i,
+    /(^|[\\/])id_ecdsa(\.[^\\/]*)?$/i,
+    /(^|[\\/])id_dsa(\.[^\\/]*)?$/i,
+    /\.pem$/i,
+    /\.key$/i,
+    /\.ppk$/i,
+    /\.jks$/i,
+    /(^|[\\/])\.npmrc$/i,
+    /(^|[\\/])\.netrc$/i,
+    /(^|[\\/])\.pypirc$/i,
+    /(^|[\\/])\.git-credentials$/i,
+    /(^|[\\/])\.kube[\\/]config$/i,
+    /(^|[\\/])\.docker[\\/]config\.json$/i,
+    /\.p12$/i,
+    /\.pfx$/i,
+];
+function isSensitivePath(relPath) {
+    return SENSITIVE_PATH_PATTERNS.some((re) => re.test(relPath));
+}
+/** Splits a shell command into path-like tokens, stripping quotes/metacharacters. */
+const COMMAND_TOKEN_SPLIT_RE = /[\s|;&<>()"'`$]+/;
+/**
+ * Best-effort check for whether a shell command references a sensitive file
+ * (.env, credentials, private keys, etc.) by name — e.g. `cat .env` or
+ * `grep foo .env`. Mirrors {@link isSensitivePath}, which already gates
+ * read_file/write_file, so the shell tool gets the same filename-based
+ * defense instead of relying solely on post-hoc output redaction.
+ *
+ * This is necessarily heuristic (arbitrary shell quoting/expansion can't be
+ * fully parsed without a real shell), so it only catches the literal
+ * filename appearing in the command text.
+ */
+export function commandTouchesSensitivePath(command) {
+    const tokens = command.split(COMMAND_TOKEN_SPLIT_RE).filter(Boolean);
+    for (const token of tokens) {
+        if (isSensitivePath(token))
+            return token;
+    }
+    return null;
+}
+/**
+ * Resolve a user/model-supplied path against the workspace root and refuse
+ * anything that escapes it, including via a symlink inside the workspace
+ * that points outside of it. Also refuses paths that look like secrets
+ * (.env, credentials, private keys, etc.) — see SENSITIVE_PATH_PATTERNS.
+ */
+export function resolveSafe(workspace, p) {
+    const abs = path.resolve(workspace, p);
+    const rel = path.relative(workspace, abs);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new Error(`Path "${p}" is outside the workspace (${workspace})`);
+    }
+    const realWorkspace = realpathAllowMissing(workspace);
+    const realAbs = realpathAllowMissing(abs);
+    const realRel = path.relative(realWorkspace, realAbs);
+    if (realRel.startsWith("..") || path.isAbsolute(realRel)) {
+        throw new Error(`Path "${p}" is outside the workspace (${workspace})`);
+    }
+    if (isSensitivePath(realRel) || isSensitivePath(rel)) {
+        throw new Error(`Path "${p}" looks like a secret file and is blocked from tool access`);
+    }
+    return abs;
+}
+/**
+ * Like {@link resolveSafe} but never throws — returns false for any path
+ * that escapes the workspace (directly or via symlink) or looks like a
+ * secret file. Used by tools (grep) that scan many candidate paths and
+ * should silently skip unsafe ones rather than aborting the whole search.
+ */
+export function isPathSafe(workspace, p) {
+    try {
+        resolveSafe(workspace, p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const MAX_RESULT_CHARS = 30_000;
+export function truncateResult(s, max = MAX_RESULT_CHARS) {
+    if (s.length <= max)
+        return s;
+    return s.slice(0, max) + `\n... [truncated, ${s.length - max} more characters]`;
+}
+/** Truncate keeping the END — for command output, where errors and summaries come last. */
+export function truncateTail(s, max = MAX_RESULT_CHARS) {
+    if (s.length <= max)
+        return s;
+    return `[... truncated, ${s.length - max} earlier characters]\n` + s.slice(-max);
+}
+const MAX_REGEX_PATTERN_LENGTH = 500;
+/** Nested-quantifier shapes like (a+)+, (a*)*, (a+)*, (.*)+ — classic catastrophic backtracking. */
+const CATASTROPHIC_BACKTRACKING_RE = /\([^()]*[+*][^()]*\)[+*]/;
+/**
+ * Compile a regex supplied by the model or a settings file, rejecting
+ * patterns that are excessively long or match a known catastrophic-
+ * backtracking shape. This is a heuristic backstop, not a guarantee — Node
+ * has no built-in regex execution timeout — but it catches the common cases
+ * (e.g. a model emitting `(a+)+$` as a grep pattern) before they can hang the
+ * process on adversarial input.
+ */
+export function safeCompileRegex(pattern, flags) {
+    if (pattern.length > MAX_REGEX_PATTERN_LENGTH) {
+        throw new Error(`Pattern too long (max ${MAX_REGEX_PATTERN_LENGTH} characters)`);
+    }
+    if (CATASTROPHIC_BACKTRACKING_RE.test(pattern)) {
+        throw new Error("Pattern rejected: nested quantifiers can cause catastrophic backtracking");
+    }
+    return new RegExp(pattern, flags);
+}
+/**
+ * Lines of a tool's output that carry information — no leading banner, no
+ * "(empty)" placeholder, no trailing truncation note. What's left is what a
+ * result summary should count.
+ */
+export function meaningfulLines(output) {
+    const lines = output
+        .split("\n")
+        .filter((l) => l.trim() && !/^\((no |empty)/i.test(l.trim()) && !/^\[?\.\.\. /.test(l.trim()));
+    return lines.length ? lines : null;
+}
+/** "10 entries", "1 line" — the shape of a result, for the tool-call line. */
+export function countLines(output, one, many) {
+    const lines = meaningfulLines(output);
+    const n = lines?.length ?? 0;
+    return `${n} ${n === 1 ? one : many}`;
+}