langflower 0.0.1

package/vendor/tools/dist/path-sandbox.js

@@ -0,0 +1,97 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+const DEFAULT_DENY = [
+    '.git/',
+    'node_modules/',
+    '.langflower/secrets/',
+];
+const isUnderRoot = (absolute, root) => {
+    const relative = path.relative(path.resolve(root), absolute);
+    return (relative === '' ||
+        (!relative.startsWith('..') && !path.isAbsolute(relative)));
+};
+const matchesDeny = (posixRelative, denyPaths) => [...denyPaths, ...DEFAULT_DENY].find((pattern) => {
+    const normalized = pattern.replace(/\\/g, '/').replace(/^\//, '');
+    return (posixRelative === normalized.replace(/\/$/, '') ||
+        posixRelative.startsWith(normalized.endsWith('/') ? normalized : `${normalized}/`) ||
+        (normalized.endsWith('/') && posixRelative.startsWith(normalized)));
+});
+/**
+ * Resolve which fence root contains `absolute` — project root first, then
+ * allowlisted roots. Returns `null` when the path is outside every fence.
+ */
+export const resolveFenceRoot = (projectRoot, absolute, allowedRoots = []) => {
+    const project = path.resolve(projectRoot);
+    if (isUnderRoot(absolute, project)) {
+        return project;
+    }
+    for (const entry of allowedRoots) {
+        const root = path.resolve(projectRoot, entry);
+        if (isUnderRoot(absolute, root)) {
+            return root;
+        }
+    }
+    return null;
+};
+/**
+ * Path string suitable for later harness tool calls.
+ * Project-scoped → relative; allowlisted outside → absolute (posix `/`).
+ */
+export const toHarnessDisplayPath = (projectRoot, absolute, allowedRoots = []) => {
+    const fence = resolveFenceRoot(projectRoot, absolute, allowedRoots);
+    const project = path.resolve(projectRoot);
+    if (fence === project) {
+        return path.relative(project, absolute).split(path.sep).join('/');
+    }
+    return absolute.split(path.sep).join('/');
+};
+/**
+ * Resolve `userPath` under the project root, or under an allowlisted extra
+ * root when the path escapes the project (absolute vault paths, …).
+ */
+const isPathFenceOptions = (value) => !Array.isArray(value);
+const asPathFenceOptions = (denyOrOptions) => isPathFenceOptions(denyOrOptions)
+    ? denyOrOptions
+    : { denyPaths: denyOrOptions };
+export const resolveProjectPath = (projectRoot, userPath, denyOrOptions = {}) => {
+    const options = asPathFenceOptions(denyOrOptions);
+    const denyPaths = options.denyPaths ?? DEFAULT_DENY;
+    const allowedRoots = options.allowedRoots ?? [];
+    const trimmed = userPath.trim();
+    if (trimmed.length === 0) {
+        throw new Error('Path is required.');
+    }
+    const project = path.resolve(projectRoot);
+    const candidate = path.isAbsolute(trimmed)
+        ? path.resolve(trimmed)
+        : path.resolve(project, trimmed);
+    const fence = resolveFenceRoot(project, candidate, allowedRoots);
+    if (fence === null) {
+        throw new Error(`Path escapes project root: «${userPath}». Stay under the project directory, or add the vault to harness.allowedRoots.`);
+    }
+    const posixRelative = path
+        .relative(fence, candidate)
+        .split(path.sep)
+        .join('/');
+    const denied = matchesDeny(posixRelative, denyPaths);
+    if (denied !== undefined) {
+        throw new Error(`Path is denied by sandbox policy: «${userPath}» (matched «${denied}»).`);
+    }
+    return candidate;
+};
+const listSiblingHints = async (absolutePath, limit = 8) => {
+    const parent = path.dirname(absolutePath);
+    try {
+        const entries = await fs.readdir(parent);
+        return entries.slice(0, limit);
+    }
+    catch {
+        return [];
+    }
+};
+export const formatNotFound = async (absolutePath, userPath) => {
+    const siblings = await listSiblingHints(absolutePath);
+    const hint = siblings.length > 0 ? ` Nearby names: ${siblings.join(', ')}.` : '';
+    return `File not found: «${userPath}».${hint}`;
+};
+//# sourceMappingURL=path-sandbox.js.map

package/vendor/tools/dist/path-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-sandbox.js","sourceRoot":"","sources":["../src/path-sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,YAAY,GAAG;IACpB,OAAO;IACP,eAAe;IACf,sBAAsB;CACb,CAAC;AAYX,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAW,EAAE;IAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,CACN,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC1D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CACnB,aAAqB,EACrB,SAA4B,EACP,EAAE,CACvB,CAAC,GAAG,SAAS,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,CACN,aAAa,KAAK,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/C,aAAa,CAAC,UAAU,CACvB,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CACxD;QACD,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAClE,CAAC;AACH,CAAC,CAAC,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,WAAmB,EACnB,QAAgB,EAChB,eAAkC,EAAE,EACpB,EAAE;IAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE1C,IAAI,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CACnC,WAAmB,EACnB,QAAgB,EAChB,eAAkC,EAAE,EAC3B,EAAE;IACX,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE1C,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,kBAAkB,GAAG,CAC1B,KAA2C,EACf,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEtD,MAAM,kBAAkB,GAAG,CAC1B,aAAmD,EAChC,EAAE,CACrB,kBAAkB,CAAC,aAAa,CAAC;IAChC,CAAC,CAAC,aAAa;IACf,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;AAEjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,WAAmB,EACnB,QAAgB,EAChB,gBAAsD,EAAE,EAC/C,EAAE;IACX,MAAM,OAAO,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEhC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAEjE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACd,+BAA+B,QAAQ,gFAAgF,CACvH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI;SACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;SAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAErD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACd,sCAAsC,QAAQ,eAAe,MAAM,KAAK,CACxE,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAC7B,YAAoB,EACpB,KAAK,GAAG,CAAC,EACoB,EAAE;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE1C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAClC,YAAoB,EACpB,QAAgB,EACE,EAAE;IACpB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GACT,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,OAAO,oBAAoB,QAAQ,KAAK,IAAI,EAAE,CAAC;AAChD,CAAC,CAAC"}

package/vendor/tools/dist/permission.d.ts

@@ -0,0 +1,46 @@
+/**
+ * OpenCode-style permission resolver for harness tools.
+ *
+ * Policy comes from `langflower.jsonc` `permission` — pattern → allow|ask|deny.
+ * This is the **runtime** security boundary; author-time `enabledToolIds` only
+ * controls which tools bind into the model inventory.
+ */
+export type PermissionDecision = 'allow' | 'ask' | 'deny';
+/** Per-tool rules: pattern → decision, or a single decision for `*`. */
+export type PermissionToolConfig = PermissionDecision | Readonly<Record<string, PermissionDecision>>;
+/** Top-level `permission` block keyed by tool id (`read`, `bash`, …). */
+export type PermissionConfig = Readonly<Record<string, PermissionToolConfig>>;
+export type PermissionAskRequest = {
+    readonly toolId: string;
+    readonly detail: string;
+    readonly summary: string;
+};
+/** Defaults when `permission` is missing or incomplete. */
+export declare const DEFAULT_PERMISSION_CONFIG: PermissionConfig;
+/**
+ * Match OpenCode-style patterns:
+ * - `*` — anything
+ * - path globs with `**` / `*` (e.g. all markdown under a tree, `docs/**`)
+ * - command prefixes with trailing `*` (`git diff*`, `rm *`)
+ */
+export declare const matchPermissionPattern: (pattern: string, detail: string) => boolean;
+/**
+ * Resolve allow|ask|deny for one tool call.
+ * Among matching patterns, longest pattern wins; ties prefer deny > ask > allow.
+ */
+export declare const resolvePermission: (config: PermissionConfig | undefined, toolId: string, detail: string) => PermissionDecision;
+/** Extract the path/command string used for pattern matching. */
+export declare const permissionDetailForCall: (toolId: string, args: Readonly<Record<string, unknown>>) => string;
+/**
+ * Permission detail for an MCP invoke — remote tool name plus a stable args
+ * digest so grants/patterns are not collapsed to a single `'mcp'` key.
+ */
+export declare const permissionDetailForMcpCall: (remoteName: string, args: Readonly<Record<string, unknown>>) => string;
+export declare const permissionAskSummary: (toolId: string, detail: string) => string;
+export declare const grantKeyForCall: (toolId: string, detail: string) => string;
+/**
+ * Shallow per-tool merge: later layers replace whole tool configs.
+ * Used for project config ← role posture overlays.
+ */
+export declare const mergePermissionConfigs: (...layers: readonly (PermissionConfig | undefined)[]) => PermissionConfig;
+//# sourceMappingURL=permission.d.ts.map

package/vendor/tools/dist/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAE1D,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAC/B,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEnE,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAE9E,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,yBAAyB,EAAE,gBASvC,CAAC;AAcF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,MAAM,EACf,QAAQ,MAAM,KACZ,OAyDF,CAAC;AA2BF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,GAAG,SAAS,EACpC,QAAQ,MAAM,EACd,QAAQ,MAAM,KACZ,kBAyBF,CAAC;AAEF,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,GACnC,QAAQ,MAAM,EACd,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACrC,MA0BF,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACrC,MAyBF,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,QAAQ,MAAM,KACZ,MAMF,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,EAAE,QAAQ,MAAM,KAAG,MAC1C,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAClC,GAAG,QAAQ,SAAS,CAAC,gBAAgB,GAAG,SAAS,CAAC,EAAE,KAClD,gBAID,CAAC"}

package/vendor/tools/dist/permission.js

@@ -0,0 +1,172 @@
+/**
+ * OpenCode-style permission resolver for harness tools.
+ *
+ * Policy comes from `langflower.jsonc` `permission` — pattern → allow|ask|deny.
+ * This is the **runtime** security boundary; author-time `enabledToolIds` only
+ * controls which tools bind into the model inventory.
+ */
+/** Defaults when `permission` is missing or incomplete. */
+export const DEFAULT_PERMISSION_CONFIG = {
+    read: { '*': 'allow' },
+    glob: { '*': 'allow' },
+    grep: { '*': 'allow' },
+    edit: { '*': 'ask' },
+    write: { '*': 'ask' },
+    create: { '*': 'ask' },
+    delete: { '*': 'ask' },
+    bash: { '*': 'deny' },
+};
+const DECISION_RANK = {
+    deny: 3,
+    ask: 2,
+    allow: 1,
+};
+const isDecision = (value) => value === 'allow' || value === 'ask' || value === 'deny';
+const escapeRegExp = (text) => text.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+/**
+ * Match OpenCode-style patterns:
+ * - `*` — anything
+ * - path globs with `**` / `*` (e.g. all markdown under a tree, `docs/**`)
+ * - command prefixes with trailing `*` (`git diff*`, `rm *`)
+ */
+export const matchPermissionPattern = (pattern, detail) => {
+    const normalizedPattern = pattern.trim();
+    const normalizedDetail = detail;
+    if (normalizedPattern.length === 0) {
+        return false;
+    }
+    if (normalizedPattern === '*') {
+        return true;
+    }
+    const pathStyle = normalizedPattern.includes('/') || normalizedPattern.includes('**');
+    if (pathStyle) {
+        const posixDetail = normalizedDetail.replace(/\\/g, '/');
+        let regexSource = '';
+        for (let i = 0; i < normalizedPattern.length; i += 1) {
+            if (normalizedPattern.startsWith('**/', i)) {
+                regexSource += '(?:.*/)?';
+                i += 2;
+                continue;
+            }
+            if (normalizedPattern.startsWith('**', i)) {
+                regexSource += '.*';
+                i += 1;
+                continue;
+            }
+            const ch = normalizedPattern[i] ?? '';
+            if (ch === '*') {
+                regexSource += '[^/]*';
+                continue;
+            }
+            regexSource += escapeRegExp(ch);
+        }
+        return new RegExp(`^${regexSource}$`).test(posixDetail);
+    }
+    let regexSource = '';
+    for (const ch of normalizedPattern) {
+        if (ch === '*') {
+            regexSource += '[\\s\\S]*';
+            continue;
+        }
+        regexSource += escapeRegExp(ch);
+    }
+    return new RegExp(`^${regexSource}$`).test(normalizedDetail);
+};
+const rulesForTool = (config, toolId) => {
+    const raw = config[toolId] ?? DEFAULT_PERMISSION_CONFIG[toolId];
+    if (raw === undefined) {
+        return { '*': 'deny' };
+    }
+    if (isDecision(raw)) {
+        return { '*': raw };
+    }
+    const entries = Object.entries(raw).filter((entry) => isDecision(entry[1]));
+    if (entries.length === 0) {
+        return { '*': 'deny' };
+    }
+    return Object.fromEntries(entries);
+};
+/**
+ * Resolve allow|ask|deny for one tool call.
+ * Among matching patterns, longest pattern wins; ties prefer deny > ask > allow.
+ */
+export const resolvePermission = (config, toolId, detail) => {
+    const merged = {
+        ...DEFAULT_PERMISSION_CONFIG,
+        ...(config ?? {}),
+    };
+    const rules = rulesForTool(merged, toolId);
+    const matches = Object.entries(rules).filter(([pattern]) => matchPermissionPattern(pattern, detail));
+    if (matches.length === 0) {
+        return 'deny';
+    }
+    matches.sort((a, b) => {
+        const lengthDelta = b[0].length - a[0].length;
+        if (lengthDelta !== 0) {
+            return lengthDelta;
+        }
+        return DECISION_RANK[b[1]] - DECISION_RANK[a[1]];
+    });
+    return matches[0]?.[1] ?? 'deny';
+};
+/** Extract the path/command string used for pattern matching. */
+export const permissionDetailForCall = (toolId, args) => {
+    if (toolId === 'bash') {
+        return typeof args.command === 'string' ? args.command : '';
+    }
+    if (typeof args.path === 'string' && args.path.length > 0) {
+        return args.path.replace(/\\/g, '/');
+    }
+    if (typeof args.file === 'string' && args.file.length > 0) {
+        return args.file.replace(/\\/g, '/');
+    }
+    if (typeof args.url === 'string' && args.url.length > 0) {
+        return args.url;
+    }
+    if (typeof args.key === 'string' && args.key.length > 0) {
+        return args.key;
+    }
+    if (typeof args.collectionId === 'string' && args.collectionId.length > 0) {
+        return args.collectionId;
+    }
+    return '*';
+};
+const MCP_DETAIL_ARGS_CAP = 180;
+/**
+ * Permission detail for an MCP invoke — remote tool name plus a stable args
+ * digest so grants/patterns are not collapsed to a single `'mcp'` key.
+ */
+export const permissionDetailForMcpCall = (remoteName, args) => {
+    const name = remoteName.trim().length > 0 ? remoteName.trim() : 'mcp';
+    const fromArgs = permissionDetailForCall('_', args);
+    if (fromArgs !== '*') {
+        return `${name}:${fromArgs}`;
+    }
+    const keys = Object.keys(args).sort();
+    if (keys.length === 0) {
+        return name;
+    }
+    try {
+        const digest = JSON.stringify(args, keys);
+        if (digest.length <= MCP_DETAIL_ARGS_CAP) {
+            return `${name}:${digest}`;
+        }
+        return `${name}:${digest.slice(0, MCP_DETAIL_ARGS_CAP)}…`;
+    }
+    catch {
+        return name;
+    }
+};
+export const permissionAskSummary = (toolId, detail) => {
+    if (toolId === 'bash') {
+        return `Allow bash: ${detail.length > 0 ? detail : '(empty command)'}?`;
+    }
+    return `Allow ${toolId}: ${detail.length > 0 ? detail : '(no path)'}?`;
+};
+export const grantKeyForCall = (toolId, detail) => `${toolId}\0${detail}`;
+/**
+ * Shallow per-tool merge: later layers replace whole tool configs.
+ * Used for project config ← role posture overlays.
+ */
+export const mergePermissionConfigs = (...layers) => layers.reduce((acc, layer) => (layer === undefined ? acc : { ...acc, ...layer }), {});
+//# sourceMappingURL=permission.js.map

package/vendor/tools/dist/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IAC1D,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;IACtB,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;IACtB,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;IACtB,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;IACpB,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;IACrB,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;IACtB,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;IACtB,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;CACrB,CAAC;AAEF,MAAM,aAAa,GAAiD;IACnE,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAc,EAA+B,EAAE,CAClE,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC;AAE1D,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACrC,OAAe,EACf,MAAc,EACJ,EAAE;IACZ,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,gBAAgB,GAAG,MAAM,CAAC;IAEhC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GACd,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAErE,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,WAAW,GAAG,EAAE,CAAC;QAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,IAAI,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5C,WAAW,IAAI,UAAU,CAAC;gBAC1B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YAED,IAAI,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3C,WAAW,IAAI,IAAI,CAAC;gBACpB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YAED,MAAM,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAEtC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAChB,WAAW,IAAI,OAAO,CAAC;gBACvB,SAAS;YACV,CAAC;YAED,WAAW,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,OAAO,IAAI,MAAM,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACpC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,WAAW,IAAI,WAAW,CAAC;YAC3B,SAAS;QACV,CAAC;QAED,WAAW,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,MAAM,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CACpB,MAAwB,EACxB,MAAc,EACiC,EAAE;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAEhE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CACzC,CAAC,KAAK,EAAyC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACtE,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACxB,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAChC,MAAoC,EACpC,MAAc,EACd,MAAc,EACO,EAAE;IACvB,MAAM,MAAM,GAAqB;QAChC,GAAG,yBAAyB;QAC5B,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAC1D,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CACvC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAE9C,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,WAAW,CAAC;QACpB,CAAC;QAED,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;AAClC,CAAC,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACtC,MAAc,EACd,IAAuC,EAC9B,EAAE;IACX,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACzC,UAAkB,EAClB,IAAuC,EAC9B,EAAE;IACX,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEpD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE1C,IAAI,MAAM,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAC1C,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;QAC5B,CAAC;QAED,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,GAAG,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CACnC,MAAc,EACd,MAAc,EACL,EAAE;IACX,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,eAAe,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAAC;IACzE,CAAC;IAED,OAAO,SAAS,MAAM,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,MAAc,EAAU,EAAE,CACzE,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACrC,GAAG,MAAiD,EACjC,EAAE,CACrB,MAAM,CAAC,MAAM,CACZ,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,EAClE,EAAE,CACF,CAAC"}

package/vendor/tools/dist/post-process.d.ts

@@ -0,0 +1,10 @@
+export type PostProcessOptions = {
+    readonly timeoutMs?: number;
+    readonly maxOutputChars?: number;
+};
+/**
+ * Run agent-supplied `(res: string) => string` source in an isolated VM.
+ * Fail closed: throw on timeout, non-function, non-string, or oversized output.
+ */
+export declare const runReadClassPostProcess: (source: string, input: string, options?: PostProcessOptions) => string;
+//# sourceMappingURL=post-process.d.ts.map

package/vendor/tools/dist/post-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-process.d.ts","sourceRoot":"","sources":["../src/post-process.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAAG;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,UAAS,kBAAuB,KAC9B,MAwCF,CAAC"}

package/vendor/tools/dist/post-process.js

@@ -0,0 +1,37 @@
+import vm from 'node:vm';
+const DEFAULT_TIMEOUT_MS = 50;
+const DEFAULT_MAX_OUTPUT_CHARS = 200_000;
+/**
+ * Run agent-supplied `(res: string) => string` source in an isolated VM.
+ * Fail closed: throw on timeout, non-function, non-string, or oversized output.
+ */
+export const runReadClassPostProcess = (source, input, options = {}) => {
+    const trimmed = source.trim();
+    if (trimmed.length === 0) {
+        throw new Error('postProcess source is empty.');
+    }
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxOutputChars = options.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+    const sandbox = {
+        __input: input,
+        __result: undefined,
+    };
+    try {
+        vm.runInNewContext(`__result = (${trimmed})(__input)`, sandbox, {
+            timeout: timeoutMs,
+            displayErrors: true,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`postProcess failed: ${message}`);
+    }
+    if (typeof sandbox.__result !== 'string') {
+        throw new Error(`postProcess must return a string (got ${typeof sandbox.__result}).`);
+    }
+    if (sandbox.__result.length > maxOutputChars) {
+        throw new Error(`postProcess output exceeds ${maxOutputChars} characters.`);
+    }
+    return sandbox.__result;
+};
+//# sourceMappingURL=post-process.js.map

package/vendor/tools/dist/post-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-process.js","sourceRoot":"","sources":["../src/post-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAOzC;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACtC,MAAc,EACd,KAAa,EACb,UAA8B,EAAE,EACvB,EAAE;IACX,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC1E,MAAM,OAAO,GAGT;QACH,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,SAAS;KACnB,CAAC;IAEF,IAAI,CAAC;QACJ,EAAE,CAAC,eAAe,CAAC,eAAe,OAAO,YAAY,EAAE,OAAO,EAAE;YAC/D,OAAO,EAAE,SAAS;YAClB,aAAa,EAAE,IAAI;SACnB,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACd,yCAAyC,OAAO,OAAO,CAAC,QAAQ,IAAI,CACpE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACd,8BAA8B,cAAc,cAAc,CAC1D,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,QAAQ,CAAC;AACzB,CAAC,CAAC"}

package/vendor/tools/dist/ssrf-guard.d.ts

@@ -0,0 +1,23 @@
+/** True when the address is loopback, private, link-local, or metadata. */
+export declare const isBlockedIpAddress: (address: string) => boolean;
+export type AssertUrlSafeOptions = {
+    readonly allowedHosts?: readonly string[];
+    /** When true, skip DNS resolution (hostname-only checks). */
+    readonly skipDns?: boolean;
+};
+/**
+ * Validated URL plus addresses that passed the SSRF check.
+ * Callers should pin the TCP connect to {@link pinnedAddresses} so DNS cannot
+ * rebind between check and fetch.
+ */
+export type SafeFetchTarget = {
+    readonly url: URL;
+    /** Public addresses validated at check time; empty when `skipDns`. */
+    readonly pinnedAddresses: readonly string[];
+};
+/**
+ * Reject non-http(s) URLs, blocked hostnames, and (by default) private IPs
+ * after DNS resolution. Optional `allowedHosts` is an exact hostname allowlist.
+ */
+export declare const assertUrlSafeForFetch: (rawUrl: string, options?: AssertUrlSafeOptions) => Promise<SafeFetchTarget>;
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/vendor/tools/dist/ssrf-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../src/ssrf-guard.ts"],"names":[],"mappings":"AA8EA,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,OAYpD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GACjC,QAAQ,MAAM,EACd,UAAS,oBAAyB,KAChC,OAAO,CAAC,eAAe,CAuEzB,CAAC"}

package/vendor/tools/dist/ssrf-guard.js

@@ -0,0 +1,120 @@
+import dns from 'node:dns/promises';
+import net from 'node:net';
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'localhost.localdomain',
+    'metadata.google.internal',
+]);
+const isIpv4Private = (ip) => {
+    const parts = ip.split('.').map((part) => Number(part));
+    if (parts.length !== 4 ||
+        parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+        return false;
+    }
+    const a = parts[0] ?? 0;
+    const b = parts[1] ?? 0;
+    if (a === 10) {
+        return true;
+    }
+    if (a === 127) {
+        return true;
+    }
+    if (a === 0) {
+        return true;
+    }
+    if (a === 169 && b === 254) {
+        return true;
+    }
+    if (a === 172 && b >= 16 && b <= 31) {
+        return true;
+    }
+    if (a === 192 && b === 168) {
+        return true;
+    }
+    if (a === 100 && b >= 64 && b <= 127) {
+        return true;
+    }
+    return false;
+};
+const isIpv6Private = (ip) => {
+    const normalized = ip.toLowerCase();
+    if (normalized === '::1' || normalized === '::') {
+        return true;
+    }
+    if (normalized.startsWith('fc') || normalized.startsWith('fd')) {
+        return true;
+    }
+    if (normalized.startsWith('fe80:')) {
+        return true;
+    }
+    // IPv4-mapped IPv6 (:ffff:x.x.x.x)
+    const mapped = normalized.match(/^:ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+    if (mapped?.[1] !== undefined) {
+        return isIpv4Private(mapped[1]);
+    }
+    return false;
+};
+/** True when the address is loopback, private, link-local, or metadata. */
+export const isBlockedIpAddress = (address) => {
+    const family = net.isIP(address);
+    if (family === 4) {
+        return isIpv4Private(address);
+    }
+    if (family === 6) {
+        return isIpv6Private(address);
+    }
+    return true;
+};
+/**
+ * Reject non-http(s) URLs, blocked hostnames, and (by default) private IPs
+ * after DNS resolution. Optional `allowedHosts` is an exact hostname allowlist.
+ */
+export const assertUrlSafeForFetch = async (rawUrl, options = {}) => {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Invalid URL: ${rawUrl}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Blocked URL protocol «${parsed.protocol}» (only http/https).`);
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname.length === 0) {
+        throw new Error('URL hostname is empty.');
+    }
+    if (BLOCKED_HOSTNAMES.has(hostname) ||
+        hostname.endsWith('.localhost') ||
+        hostname.endsWith('.local')) {
+        throw new Error(`Blocked hostname «${hostname}».`);
+    }
+    const allowed = options.allowedHosts?.map((host) => host.toLowerCase());
+    if (allowed !== undefined && allowed.length > 0) {
+        if (!allowed.includes(hostname)) {
+            throw new Error(`Hostname «${hostname}» is not in harness.allowedHosts.`);
+        }
+    }
+    if (net.isIP(hostname) !== 0) {
+        if (isBlockedIpAddress(hostname)) {
+            throw new Error(`Blocked IP address «${hostname}».`);
+        }
+        return { url: parsed, pinnedAddresses: [hostname] };
+    }
+    if (options.skipDns === true) {
+        return { url: parsed, pinnedAddresses: [] };
+    }
+    const records = await dns.lookup(hostname, { all: true, verbatim: true });
+    if (records.length === 0) {
+        throw new Error(`DNS lookup failed for «${hostname}».`);
+    }
+    const blocked = records.find((record) => isBlockedIpAddress(record.address));
+    if (blocked !== undefined) {
+        throw new Error(`Blocked: «${hostname}» resolves to private/link-local address ${blocked.address}.`);
+    }
+    return {
+        url: parsed,
+        pinnedAddresses: records.map((record) => record.address),
+    };
+};
+//# sourceMappingURL=ssrf-guard.js.map

package/vendor/tools/dist/ssrf-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.js","sourceRoot":"","sources":["../src/ssrf-guard.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,mBAAmB,CAAC;AACpC,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,uBAAuB;IACvB,0BAA0B;CAC1B,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE;IAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EACtE,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAExB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE;IAC7C,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpC,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,mCAAmC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAEjE,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAW,EAAE;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAmBF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACzC,MAAc,EACd,UAAgC,EAAE,EACP,EAAE;IAC7B,IAAI,MAAW,CAAC;IAEhB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACd,yBAAyB,MAAM,CAAC,QAAQ,sBAAsB,CAC9D,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,IACC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC1B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAExE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACd,aAAa,QAAQ,mCAAmC,CACxD,CAAC;QACH,CAAC;IACF,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACvC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,CAAC;IAEF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACd,aAAa,QAAQ,4CAA4C,OAAO,CAAC,OAAO,GAAG,CACnF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,EAAE,MAAM;QACX,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;KACxD,CAAC;AACH,CAAC,CAAC"}

package/vendor/tools/package.json

@@ -0,0 +1,73 @@
+{
+	"name": "@langflower/tools",
+	"version": "0.1.0",
+	"type": "module",
+	"exports": {
+		"./create-project-harness": {
+			"types": "./dist/create-project-harness.d.ts",
+			"import": "./dist/create-project-harness.js"
+		},
+		"./permission": {
+			"types": "./dist/permission.d.ts",
+			"import": "./dist/permission.js"
+		},
+		"./create-web-fetch": {
+			"types": "./dist/create-web-fetch.d.ts",
+			"import": "./dist/create-web-fetch.js"
+		},
+		"./create-crawl-context": {
+			"types": "./dist/create-crawl-context.d.ts",
+			"import": "./dist/create-crawl-context.js"
+		},
+		"./create-project-files-context": {
+			"types": "./dist/create-project-files-context.d.ts",
+			"import": "./dist/create-project-files-context.js"
+		},
+		"./domain-tool-configs": {
+			"types": "./dist/domain/domain-tool-configs.d.ts",
+			"import": "./dist/domain/domain-tool-configs.js"
+		},
+		"./create-memory-store": {
+			"types": "./dist/memory/create-memory-store.d.ts",
+			"import": "./dist/memory/create-memory-store.js"
+		},
+		"./html": {
+			"types": "./dist/domain/html.d.ts",
+			"import": "./dist/domain/html.js"
+		},
+		"./run-bfs-crawl": {
+			"types": "./dist/domain/run-bfs-crawl.d.ts",
+			"import": "./dist/domain/run-bfs-crawl.js"
+		},
+		"./mcp-stdio-client": {
+			"types": "./dist/mcp/mcp-stdio-client.d.ts",
+			"import": "./dist/mcp/mcp-stdio-client.js"
+		},
+		"./mcp-http-client": {
+			"types": "./dist/mcp/mcp-http-client.d.ts",
+			"import": "./dist/mcp/mcp-http-client.js"
+		},
+		"./mcp-tool-id": {
+			"types": "./dist/mcp/mcp-tool-id.d.ts",
+			"import": "./dist/mcp/mcp-tool-id.js"
+		},
+		"./build-mcp-handle": {
+			"types": "./dist/mcp/build-mcp-handle.d.ts",
+			"import": "./dist/mcp/build-mcp-handle.js"
+		},
+		"./format-mcp-connect-error": {
+			"types": "./dist/mcp/format-mcp-connect-error.d.ts",
+			"import": "./dist/mcp/format-mcp-connect-error.js"
+		},
+		"./create-system-mcp-handles": {
+			"types": "./dist/mcp/create-system-mcp-handles.d.ts",
+			"import": "./dist/mcp/create-system-mcp-handles.js"
+		}
+	},
+	"dependencies": {
+		"undici": "^7.28.0"
+	},
+	"files": [
+		"dist"
+	]
+}

package/vendor/websocket-bridge/dist/bridge-codec.d.ts

@@ -0,0 +1,3 @@
+import type { WsBridgeCodec } from './bridge-types.js';
+export declare const defaultWsBridgeCodec: WsBridgeCodec;
+//# sourceMappingURL=bridge-codec.d.ts.map

package/vendor/websocket-bridge/dist/bridge-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-codec.d.ts","sourceRoot":"","sources":["../src/bridge-codec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAiB,MAAM,mBAAmB,CAAC;AAEtE,eAAO,MAAM,oBAAoB,EAAE,aA8BlC,CAAC"}