langflower 0.1.0 → 0.1.1

package/dist/chunk-WQZHA5FM.js

@@ -0,0 +1,1444 @@
+import { createRequire as __lfCreateRequire } from 'node:module';
+const require = __lfCreateRequire(import.meta.url);
+
+
+// packages/tools/dist/builtins/bash/tool.js
+import { spawn } from "node:child_process";
+
+// packages/tools/dist/path-sandbox.js
+import fs from "node:fs/promises";
+import path from "node:path";
+var DEFAULT_DENY = [
+  ".git/",
+  "node_modules/",
+  ".langflower/secrets/"
+];
+var isUnderRoot = (absolute, root) => {
+  const relative = path.relative(path.resolve(root), absolute);
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+};
+var matchesDeny = (posixRelative, denyPaths) => [...denyPaths, ...DEFAULT_DENY].find((pattern) => {
+  const normalized = pattern.replace(/\\/g, "/").replace(/^\//, "");
+  return posixRelative === normalized.replace(/\/$/, "") || posixRelative.startsWith(normalized.endsWith("/") ? normalized : `${normalized}/`) || normalized.endsWith("/") && posixRelative.startsWith(normalized);
+});
+var resolveFenceRoot = (projectRoot, absolute, allowedRoots = []) => {
+  const project = path.resolve(projectRoot);
+  if (isUnderRoot(absolute, project)) {
+    return project;
+  }
+  for (const entry of allowedRoots) {
+    const root = path.resolve(projectRoot, entry);
+    if (isUnderRoot(absolute, root)) {
+      return root;
+    }
+  }
+  return null;
+};
+var toHarnessDisplayPath = (projectRoot, absolute, allowedRoots = []) => {
+  const fence = resolveFenceRoot(projectRoot, absolute, allowedRoots);
+  const project = path.resolve(projectRoot);
+  if (fence === project) {
+    return path.relative(project, absolute).split(path.sep).join("/");
+  }
+  return absolute.split(path.sep).join("/");
+};
+var isPathFenceOptions = (value) => !Array.isArray(value);
+var asPathFenceOptions = (denyOrOptions) => isPathFenceOptions(denyOrOptions) ? denyOrOptions : { denyPaths: denyOrOptions };
+var resolveProjectPath = (projectRoot, userPath, denyOrOptions = {}) => {
+  const options = asPathFenceOptions(denyOrOptions);
+  const denyPaths = options.denyPaths ?? DEFAULT_DENY;
+  const allowedRoots = options.allowedRoots ?? [];
+  const trimmed = userPath.trim();
+  if (trimmed.length === 0) {
+    throw new Error("Path is required.");
+  }
+  const project = path.resolve(projectRoot);
+  const candidate = path.isAbsolute(trimmed) ? path.resolve(trimmed) : path.resolve(project, trimmed);
+  const fence = resolveFenceRoot(project, candidate, allowedRoots);
+  if (fence === null) {
+    throw new Error(`Path escapes project root: \xAB${userPath}\xBB. Stay under the project directory, or add the vault to harness.allowedRoots.`);
+  }
+  const posixRelative = path.relative(fence, candidate).split(path.sep).join("/");
+  const denied = matchesDeny(posixRelative, denyPaths);
+  if (denied !== void 0) {
+    throw new Error(`Path is denied by sandbox policy: \xAB${userPath}\xBB (matched \xAB${denied}\xBB).`);
+  }
+  return candidate;
+};
+var listSiblingHints = async (absolutePath, limit = 8) => {
+  const parent = path.dirname(absolutePath);
+  try {
+    const entries = await fs.readdir(parent);
+    return entries.slice(0, limit);
+  } catch {
+    return [];
+  }
+};
+var formatNotFound = async (absolutePath, userPath) => {
+  const siblings = await listSiblingHints(absolutePath);
+  const hint = siblings.length > 0 ? ` Nearby names: ${siblings.join(", ")}.` : "";
+  return `File not found: \xAB${userPath}\xBB.${hint}`;
+};
+
+// packages/tools/dist/builtins/args.js
+var asString = (args, key) => {
+  const value = args[key];
+  return typeof value === "string" ? value : void 0;
+};
+var asNumber = (args, key) => {
+  const value = args[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+};
+var asBoolean = (args, key, defaultValue) => {
+  const value = args[key];
+  return typeof value === "boolean" ? value : defaultValue;
+};
+
+// packages/tools/dist/builtins/fence.js
+var fenceOptions = (ctx) => ({
+  denyPaths: ctx.denyPaths,
+  allowedRoots: ctx.allowedRoots
+});
+var displayPath = (ctx, absolute) => toHarnessDisplayPath(ctx.projectRoot, absolute, ctx.allowedRoots);
+
+// packages/tools/dist/builtins/bash/tool.js
+var MAX_BASH_OUTPUT = 1e5;
+var invoke = async (ctx, args) => {
+  if (!ctx.bashEnabled) {
+    throw new Error("bash is disabled (default-deny). Enable bash on the project harness to run shell commands.");
+  }
+  const command = asString(args, "command");
+  if (command === void 0 || command.trim().length === 0) {
+    throw new Error("bash requires string argument \xABcommand\xBB.");
+  }
+  const cwdArg = asString(args, "cwd") ?? ".";
+  const cwd = resolveProjectPath(ctx.projectRoot, cwdArg, fenceOptions(ctx));
+  return await new Promise((resolve, reject) => {
+    const child = spawn(command, {
+      cwd,
+      shell: true,
+      windowsHide: true
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+      if (stdout.length > MAX_BASH_OUTPUT) {
+        stdout = stdout.slice(0, MAX_BASH_OUTPUT);
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+      if (stderr.length > MAX_BASH_OUTPUT) {
+        stderr = stderr.slice(0, MAX_BASH_OUTPUT);
+      }
+    });
+    child.on("error", (error) => {
+      reject(error);
+    });
+    child.on("close", (code) => {
+      const combined = [
+        `exit ${code ?? "null"}`,
+        stdout.length > 0 ? `stdout:
+${stdout}` : "stdout: (empty)",
+        stderr.length > 0 ? `stderr:
+${stderr}` : "stderr: (empty)"
+      ].join("\n");
+      resolve(combined);
+    });
+  });
+};
+var bashTool = {
+  id: "bash",
+  registration: {
+    toolId: "bash",
+    name: "bash",
+    description: "Run a shell command in the project root. Disabled unless the harness enables bash (default-deny). Not read-class \u2014 no postProcess.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        command: {
+          type: "string",
+          description: "Shell command to run"
+        },
+        cwd: {
+          type: "string",
+          description: "Optional subdirectory relative to project root"
+        }
+      },
+      required: ["command"],
+      additionalProperties: false
+    }
+  },
+  invoke
+};
+
+// packages/tools/dist/builtins/create/tool.js
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
+var invoke2 = async (ctx, args) => {
+  const userPath = asString(args, "path");
+  const content = asString(args, "content");
+  if (userPath === void 0 || content === void 0) {
+    throw new Error("create requires string arguments \xABpath\xBB and \xABcontent\xBB.");
+  }
+  const absolute = resolveProjectPath(ctx.projectRoot, userPath, fenceOptions(ctx));
+  try {
+    await fs2.access(absolute);
+    throw new Error(`create failed: \xAB${userPath}\xBB already exists. Use write to overwrite or choose another path.`);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("create failed:")) {
+      throw error;
+    }
+    const code = error !== null && typeof error === "object" && "code" in error ? String(error.code) : "";
+    if (code !== "ENOENT") {
+      throw error;
+    }
+  }
+  await fs2.mkdir(path2.dirname(absolute), { recursive: true });
+  await fs2.writeFile(absolute, content, { encoding: "utf8", flag: "wx" });
+  return `Created \xAB${userPath}\xBB (${content.length} chars).`;
+};
+var createTool = {
+  id: "create",
+  registration: {
+    toolId: "create",
+    name: "create",
+    description: "Create a new file. Fails if the path already exists (use write to overwrite).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Project-relative file path"
+        },
+        content: {
+          type: "string",
+          description: "Initial file contents"
+        }
+      },
+      required: ["path", "content"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke2
+};
+
+// packages/tools/dist/builtins/delete/tool.js
+import fs3 from "node:fs/promises";
+var invoke3 = async (ctx, args) => {
+  const userPath = asString(args, "path");
+  if (userPath === void 0) {
+    throw new Error("delete requires string argument \xABpath\xBB.");
+  }
+  const absolute = resolveProjectPath(ctx.projectRoot, userPath, fenceOptions(ctx));
+  try {
+    await fs3.unlink(absolute);
+  } catch (error) {
+    const code = error !== null && typeof error === "object" && "code" in error ? String(error.code) : "";
+    if (code === "ENOENT") {
+      throw new Error(await formatNotFound(absolute, userPath));
+    }
+    throw error;
+  }
+  return `Deleted \xAB${userPath}\xBB.`;
+};
+var deleteTool = {
+  id: "delete",
+  registration: {
+    toolId: "delete",
+    name: "delete",
+    description: "Delete a file under the project root.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Project-relative file path"
+        }
+      },
+      required: ["path"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke3
+};
+
+// packages/tools/dist/builtins/edit/tool.js
+import fs4 from "node:fs/promises";
+var invoke4 = async (ctx, args) => {
+  const userPath = asString(args, "path");
+  const oldString = asString(args, "oldString");
+  const newString = asString(args, "newString");
+  if (userPath === void 0 || oldString === void 0 || newString === void 0) {
+    throw new Error("edit requires string arguments \xABpath\xBB, \xABoldString\xBB, and \xABnewString\xBB.");
+  }
+  if (oldString.length === 0) {
+    throw new Error("edit \xABoldString\xBB must not be empty.");
+  }
+  const absolute = resolveProjectPath(ctx.projectRoot, userPath, fenceOptions(ctx));
+  let content;
+  try {
+    content = await fs4.readFile(absolute, "utf8");
+  } catch (error) {
+    const code = error !== null && typeof error === "object" && "code" in error ? String(error.code) : "";
+    if (code === "ENOENT") {
+      throw new Error(await formatNotFound(absolute, userPath));
+    }
+    throw error;
+  }
+  const parts = content.split(oldString);
+  if (parts.length === 1) {
+    throw new Error(`edit: oldString not found in \xAB${userPath}\xBB. Provide an exact unique match.`);
+  }
+  if (parts.length > 2) {
+    throw new Error(`edit: oldString matched ${parts.length - 1} times in \xAB${userPath}\xBB. Provide a longer unique snippet.`);
+  }
+  await fs4.writeFile(absolute, parts.join(newString), "utf8");
+  return `Edited \xAB${userPath}\xBB (1 replacement).`;
+};
+var editTool = {
+  id: "edit",
+  registration: {
+    toolId: "edit",
+    name: "edit",
+    description: "Exact string replace in a file. Fails if oldString is missing or not unique.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Project-relative file path"
+        },
+        oldString: {
+          type: "string",
+          description: "Exact text to find"
+        },
+        newString: {
+          type: "string",
+          description: "Replacement text"
+        }
+      },
+      required: ["path", "oldString", "newString"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke4
+};
+
+// packages/tools/dist/builtins/glob/tool.js
+import path5 from "node:path";
+
+// packages/tools/dist/post-process.js
+import vm from "node:vm";
+var DEFAULT_TIMEOUT_MS = 50;
+var DEFAULT_MAX_OUTPUT_CHARS = 2e5;
+var runReadClassPostProcess = (source, input, options = {}) => {
+  const trimmed = source.trim();
+  if (trimmed.length === 0) {
+    throw new Error("postProcess source is empty.");
+  }
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const maxOutputChars = options.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
+  const sandbox = {
+    __input: input,
+    __result: void 0
+  };
+  try {
+    vm.runInNewContext(`__result = (${trimmed})(__input)`, sandbox, {
+      timeout: timeoutMs,
+      displayErrors: true
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`postProcess failed: ${message}`);
+  }
+  if (typeof sandbox.__result !== "string") {
+    throw new Error(`postProcess must return a string (got ${typeof sandbox.__result}).`);
+  }
+  if (sandbox.__result.length > maxOutputChars) {
+    throw new Error(`postProcess output exceeds ${maxOutputChars} characters.`);
+  }
+  return sandbox.__result;
+};
+
+// packages/tools/dist/builtins/apply-post-process.js
+var applyPostProcess = (args, text) => {
+  const source = asString(args, "postProcess");
+  if (source === void 0 || source.trim().length === 0) {
+    return text;
+  }
+  return runReadClassPostProcess(source, text);
+};
+
+// packages/tools/dist/builtins/walk-files.js
+import fs6 from "node:fs/promises";
+import path4 from "node:path";
+
+// packages/tools/dist/gitignore.js
+import fs5 from "node:fs/promises";
+import path3 from "node:path";
+var parseIgnoreLine = (line) => {
+  const trimmed = line.trim();
+  if (trimmed.length === 0 || trimmed.startsWith("#")) {
+    return void 0;
+  }
+  const negated = trimmed.startsWith("!");
+  const body = negated ? trimmed.slice(1) : trimmed;
+  const directoryOnly = body.endsWith("/");
+  const pattern = directoryOnly ? body.slice(0, -1) : body;
+  if (pattern.length === 0) {
+    return void 0;
+  }
+  return { negated, directoryOnly, pattern };
+};
+var matchSegmentGlob = (pattern, value) => {
+  if (pattern === "**") {
+    return true;
+  }
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]");
+  return new RegExp(`^${escaped}$`).test(value);
+};
+var matchPath = (pattern, relativePosix) => {
+  const normalizedPattern = pattern.replace(/\\/g, "/").replace(/^\//, "");
+  const target = relativePosix.replace(/^\.\//, "");
+  if (!normalizedPattern.includes("/")) {
+    const parts = target.split("/");
+    return parts.some((part) => matchSegmentGlob(normalizedPattern, part));
+  }
+  const patternParts = normalizedPattern.split("/");
+  const targetParts = target.split("/");
+  const matchFrom = (pi, ti) => {
+    if (pi >= patternParts.length) {
+      return ti >= targetParts.length;
+    }
+    const part = patternParts[pi] ?? "";
+    if (part === "**") {
+      if (pi === patternParts.length - 1) {
+        return true;
+      }
+      for (let skip = ti; skip <= targetParts.length; skip += 1) {
+        if (matchFrom(pi + 1, skip)) {
+          return true;
+        }
+      }
+      return false;
+    }
+    if (ti >= targetParts.length) {
+      return false;
+    }
+    if (!matchSegmentGlob(part, targetParts[ti] ?? "")) {
+      return false;
+    }
+    return matchFrom(pi + 1, ti + 1);
+  };
+  return matchFrom(0, 0);
+};
+var loadGitIgnoreMatcher = async (projectRoot) => {
+  const rules = [
+    { negated: false, directoryOnly: false, pattern: ".git" },
+    { negated: false, directoryOnly: false, pattern: "node_modules" }
+  ];
+  const gitignorePath = path3.join(projectRoot, ".gitignore");
+  try {
+    const text = await fs5.readFile(gitignorePath, "utf8");
+    for (const line of text.split(/\r?\n/)) {
+      const rule = parseIgnoreLine(line);
+      if (rule !== void 0) {
+        rules.push(rule);
+      }
+    }
+  } catch {
+  }
+  return {
+    ignores: (relativePosix, isDirectory) => {
+      let ignored = false;
+      for (const rule of rules) {
+        if (rule.directoryOnly && !isDirectory) {
+          continue;
+        }
+        if (matchPath(rule.pattern, relativePosix)) {
+          ignored = !rule.negated;
+        }
+      }
+      return ignored;
+    }
+  };
+};
+
+// packages/tools/dist/builtins/walk-files.js
+var WALK_EXCLUDE_DIR_NAMES = [
+  "node_modules",
+  "dist",
+  "build",
+  ".git"
+];
+var globToRegExp = (pattern) => {
+  const escaped = pattern.replace(/\\/g, "/").replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "::DOUBLESTAR::").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/::DOUBLESTAR::/g, ".*");
+  return new RegExp(`^${escaped}$`);
+};
+var normalizeOptions = (options) => typeof options === "boolean" ? { respectGitignore: options } : options;
+var yieldEventLoop = () => new Promise((resolve) => {
+  setImmediate(resolve);
+});
+var throwIfAborted = (signal) => {
+  if (signal?.aborted) {
+    throw new Error("aborted");
+  }
+};
+var walkFiles = async (root, dir, options = true) => {
+  const opts = normalizeOptions(options);
+  const respectGitignore = opts.respectGitignore !== false;
+  const yieldEvery = opts.yieldEvery ?? 32;
+  const matcher = respectGitignore ? await loadGitIgnoreMatcher(root) : { ignores: () => false };
+  const out = [];
+  const visitedDirs = /* @__PURE__ */ new Set();
+  let steps = 0;
+  const visit = async (absoluteDir) => {
+    throwIfAborted(opts.signal);
+    let realDir;
+    try {
+      realDir = await fs6.realpath(absoluteDir);
+    } catch {
+      return;
+    }
+    if (visitedDirs.has(realDir)) {
+      return;
+    }
+    visitedDirs.add(realDir);
+    let entries;
+    try {
+      entries = await fs6.readdir(absoluteDir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      throwIfAborted(opts.signal);
+      steps += 1;
+      if (steps % yieldEvery === 0) {
+        await yieldEventLoop();
+        throwIfAborted(opts.signal);
+      }
+      if (entry.isDirectory() && WALK_EXCLUDE_DIR_NAMES.includes(entry.name)) {
+        continue;
+      }
+      const absolute = path4.join(absoluteDir, entry.name);
+      const relative = path4.relative(root, absolute).split(path4.sep).join("/");
+      if (matcher.ignores(relative, entry.isDirectory())) {
+        continue;
+      }
+      if (entry.isSymbolicLink()) {
+        continue;
+      }
+      if (entry.isDirectory()) {
+        await visit(absolute);
+      } else if (entry.isFile()) {
+        out.push(relative);
+        if (opts.maxFiles !== void 0 && out.length >= opts.maxFiles) {
+          return;
+        }
+      }
+    }
+  };
+  await visit(dir);
+  return out;
+};
+
+// packages/tools/dist/builtins/glob/tool.js
+var MAX_GLOB_MATCHES = 200;
+var invoke5 = async (ctx, args) => {
+  const pattern = asString(args, "pattern");
+  if (pattern === void 0) {
+    throw new Error("glob requires string argument \xABpattern\xBB.");
+  }
+  const cwdArg = asString(args, "cwd") ?? ".";
+  const respectGitignore = asBoolean(args, "respectGitignore", true);
+  const searchRoot = resolveProjectPath(ctx.projectRoot, cwdArg, fenceOptions(ctx));
+  const fenceRoot = resolveFenceRoot(ctx.projectRoot, searchRoot, ctx.allowedRoots) ?? path5.resolve(ctx.projectRoot);
+  const files = await walkFiles(fenceRoot, searchRoot, respectGitignore);
+  const regex = globToRegExp(pattern.replace(/\\/g, "/"));
+  const searchRel = path5.relative(fenceRoot, searchRoot).split(path5.sep).join("/");
+  const cwdPrefix = searchRel === "" ? "" : `${searchRel.replace(/\/$/, "")}/`;
+  const matches = files.filter((file) => {
+    const relativeToCwd = cwdPrefix ? file.startsWith(cwdPrefix) ? file.slice(cwdPrefix.length) : null : file;
+    return relativeToCwd !== null && regex.test(relativeToCwd);
+  }).map((file) => displayPath(ctx, path5.join(fenceRoot, file))).slice(0, MAX_GLOB_MATCHES + 1);
+  const truncated = matches.length > MAX_GLOB_MATCHES;
+  const listed = matches.slice(0, MAX_GLOB_MATCHES);
+  const body = listed.length === 0 ? "(no matches)" : listed.join("\n") + (truncated ? `
+\u2026[truncated at ${MAX_GLOB_MATCHES}; narrow the pattern]` : "");
+  return applyPostProcess(args, body);
+};
+var globTool = {
+  id: "glob",
+  registration: {
+    toolId: "glob",
+    name: "glob",
+    description: "List files matching a glob under the project root (gitignore-aware by default). Optional postProcess.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        pattern: {
+          type: "string",
+          description: "Glob pattern, e.g. **/*.ts"
+        },
+        cwd: {
+          type: "string",
+          description: "Optional subdirectory relative to project root"
+        },
+        respectGitignore: {
+          type: "boolean",
+          description: "Default true"
+        },
+        postProcess: {
+          type: "string",
+          description: "Optional source of (res: string) => string"
+        }
+      },
+      required: ["pattern"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke5
+};
+
+// packages/tools/dist/builtins/grep/tool.js
+import fs8 from "node:fs/promises";
+import path7 from "node:path";
+
+// packages/tools/dist/builtins/grep/search.js
+import fs7 from "node:fs/promises";
+import path6 from "node:path";
+
+// packages/tools/dist/builtins/command-exists.js
+import { spawn as spawn2 } from "node:child_process";
+var cache = /* @__PURE__ */ new Map();
+var commandExists = async (cmd) => {
+  const cached = cache.get(cmd);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const checkCmd = process.platform === "win32" ? "where" : "which";
+  const exists = await new Promise((resolve) => {
+    const child = spawn2(checkCmd, [cmd], {
+      stdio: "ignore",
+      windowsHide: true
+    });
+    child.on("error", () => {
+      resolve(false);
+    });
+    child.on("close", (code) => {
+      resolve(code === 0);
+    });
+  });
+  cache.set(cmd, exists);
+  return exists;
+};
+
+// packages/tools/dist/builtins/spawn-capture.js
+import { spawn as spawn3 } from "node:child_process";
+var spawnCapture = (command, args, options = {}) => {
+  const maxStdout = options.maxStdout ?? 2e6;
+  return new Promise((resolve, reject) => {
+    if (options.signal?.aborted) {
+      reject(new Error("aborted"));
+      return;
+    }
+    const child = spawn3(command, [...args], {
+      cwd: options.cwd,
+      windowsHide: true,
+      shell: false,
+      ...options.signal !== void 0 ? { signal: options.signal } : {}
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < maxStdout) {
+        stdout += String(chunk);
+        if (stdout.length > maxStdout) {
+          stdout = stdout.slice(0, maxStdout);
+        }
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+      if (stderr.length > 64e3) {
+        stderr = stderr.slice(0, 64e3);
+      }
+    });
+    child.on("error", (error) => {
+      reject(error);
+    });
+    child.on("close", (code) => {
+      resolve({ stdout, stderr, code });
+    });
+  });
+};
+
+// packages/tools/dist/builtins/grep/search.js
+var MAX_GREP_MATCHES = 100;
+var MAX_GREP_FILES_SCANNED = 5e3;
+var MAX_GREP_FILE_BYTES = 1048576;
+var MAX_GREP_LINE_CHARS = 8e3;
+var SEARCH_EXCLUDE_GLOBS = [
+  "!**/node_modules/**",
+  "!**/dist/**",
+  "!**/build/**",
+  "!**/.git/**"
+];
+var throwIfAborted2 = (signal) => {
+  if (signal?.aborted) {
+    throw new Error("aborted");
+  }
+};
+var formatHits = (hits, truncated) => {
+  if (hits.length === 0) {
+    return "(no matches)";
+  }
+  const body = hits.map((hit) => `${hit.file}:${hit.line}:${hit.text}`).join("\n");
+  return truncated ? `${body}
+\u2026[truncated at ${MAX_GREP_MATCHES}; refine pattern or path]` : body;
+};
+var formatGrepBody = (hits, truncated) => formatHits(hits, truncated);
+var parseLineHits = (stdout, displayPath2, fenceRoot, maxHits) => {
+  const hits = [];
+  const lines = stdout.split(/\r?\n/);
+  for (const raw of lines) {
+    if (raw.length === 0) {
+      continue;
+    }
+    const match = /^(.+?):(\d+):(.*)$/.exec(raw);
+    if (match === null) {
+      continue;
+    }
+    const fileAbs = path6.isAbsolute(match[1] ?? "") ? match[1] ?? "" : path6.join(fenceRoot, match[1] ?? "");
+    const line = Number(match[2]);
+    const text = match[3] ?? "";
+    if (!Number.isFinite(line)) {
+      continue;
+    }
+    hits.push({
+      file: displayPath2(fileAbs),
+      line,
+      text: text.length > MAX_GREP_LINE_CHARS ? `${text.slice(0, MAX_GREP_LINE_CHARS)}\u2026` : text
+    });
+    if (hits.length >= maxHits) {
+      return { hits, truncated: true };
+    }
+  }
+  return { hits, truncated: false };
+};
+var isBinaryAbortError = (error) => error instanceof Error && (error.name === "AbortError" || error.message === "aborted");
+var searchWithRipgrep = async (input, deps = {}) => {
+  const exists = deps.commandExists ?? commandExists;
+  const run = deps.spawnCapture ?? spawnCapture;
+  if (!await exists("rg")) {
+    return {
+      ok: false,
+      reason: "unavailable",
+      message: "ripgrep (rg) is not available on this system"
+    };
+  }
+  throwIfAborted2(input.signal);
+  const args = [
+    "-n",
+    "--color",
+    "never",
+    "--max-filesize",
+    `${MAX_GREP_FILE_BYTES}`,
+    ...input.respectGitignore ? [] : ["--no-ignore"],
+    ...SEARCH_EXCLUDE_GLOBS.flatMap((glob) => ["--glob", glob]),
+    ...input.caseInsensitive ? ["-i"] : [],
+    "-e",
+    input.pattern,
+    input.searchAbsolute
+  ];
+  try {
+    const result = await run("rg", args, {
+      cwd: input.fenceRoot,
+      ...input.signal !== void 0 ? { signal: input.signal } : {}
+    });
+    if (result.code !== null && result.code >= 2) {
+      const detail = result.stderr.trim();
+      return {
+        ok: false,
+        reason: "error",
+        message: detail.length > 0 ? `ripgrep failed: ${detail}` : "ripgrep failed"
+      };
+    }
+    const parsed = parseLineHits(result.stdout, input.displayPath, input.fenceRoot, MAX_GREP_MATCHES);
+    return {
+      ok: true,
+      hits: parsed.hits,
+      truncated: parsed.truncated,
+      backend: "rg"
+    };
+  } catch (error) {
+    if (isBinaryAbortError(error)) {
+      throw new Error("aborted");
+    }
+    return {
+      ok: false,
+      reason: "unavailable",
+      message: error instanceof Error ? error.message : "Error executing ripgrep"
+    };
+  }
+};
+var searchWithGrep = async (input, deps = {}) => {
+  const exists = deps.commandExists ?? commandExists;
+  const run = deps.spawnCapture ?? spawnCapture;
+  if (!await exists("grep")) {
+    return {
+      ok: false,
+      reason: "unavailable",
+      message: "grep is not available on this system"
+    };
+  }
+  throwIfAborted2(input.signal);
+  const args = [
+    "-r",
+    "-n",
+    "-E",
+    "-I",
+    ...input.caseInsensitive ? ["-i"] : [],
+    ...WALK_EXCLUDE_DIR_NAMES.flatMap((name) => ["--exclude-dir", name]),
+    "-e",
+    input.pattern,
+    input.searchAbsolute
+  ];
+  try {
+    const result = await run("grep", args, {
+      cwd: input.fenceRoot,
+      ...input.signal !== void 0 ? { signal: input.signal } : {}
+    });
+    if (result.code !== null && result.code >= 2) {
+      const detail = result.stderr.trim();
+      return {
+        ok: false,
+        reason: "error",
+        message: detail.length > 0 ? `grep failed: ${detail}` : "grep failed"
+      };
+    }
+    const parsed = parseLineHits(result.stdout, input.displayPath, input.fenceRoot, MAX_GREP_MATCHES);
+    return {
+      ok: true,
+      hits: parsed.hits,
+      truncated: parsed.truncated,
+      backend: "grep"
+    };
+  } catch (error) {
+    if (isBinaryAbortError(error)) {
+      throw new Error("aborted");
+    }
+    return {
+      ok: false,
+      reason: "unavailable",
+      message: error instanceof Error ? error.message : "Error executing grep"
+    };
+  }
+};
+var looksBinary = (buf) => {
+  const sample = buf.subarray(0, Math.min(buf.length, 8192));
+  return sample.includes(0);
+};
+var yieldEventLoop2 = () => new Promise((resolve) => {
+  setImmediate(resolve);
+});
+var searchWithNodeWalk = async (input) => {
+  throwIfAborted2(input.signal);
+  let regex;
+  try {
+    regex = new RegExp(input.pattern, input.caseInsensitive ? "i" : "");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      reason: "error",
+      message: `Invalid regex \xAB${input.pattern}\xBB: ${message}. Escape special characters or simplify the pattern.`
+    };
+  }
+  const stat = await fs7.stat(input.searchAbsolute).catch(() => null);
+  if (stat === null) {
+    return {
+      ok: false,
+      reason: "error",
+      message: `Path not found: ${input.searchAbsolute}`
+    };
+  }
+  const files = stat.isFile() ? [input.searchAbsolute] : (await walkFiles(input.fenceRoot, input.searchAbsolute, {
+    respectGitignore: input.respectGitignore,
+    ...input.signal !== void 0 ? { signal: input.signal } : {},
+    maxFiles: MAX_GREP_FILES_SCANNED
+  })).map((relative) => path6.join(input.fenceRoot, relative));
+  const hits = [];
+  let matchCapHit = false;
+  let scanned = 0;
+  for (const fileAbs of files) {
+    throwIfAborted2(input.signal);
+    scanned += 1;
+    if (scanned % 16 === 0) {
+      await yieldEventLoop2();
+      throwIfAborted2(input.signal);
+    }
+    if (hits.length >= MAX_GREP_MATCHES) {
+      matchCapHit = true;
+      break;
+    }
+    let buf;
+    try {
+      const handle = await fs7.open(fileAbs, "r");
+      try {
+        const st = await handle.stat();
+        if (st.size > MAX_GREP_FILE_BYTES) {
+          continue;
+        }
+        buf = Buffer.alloc(Number(st.size));
+        await handle.read(buf, 0, buf.length, 0);
+      } finally {
+        await handle.close();
+      }
+    } catch {
+      continue;
+    }
+    if (looksBinary(buf)) {
+      continue;
+    }
+    const text = buf.toString("utf8");
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+      let line = lines[i] ?? "";
+      if (line.length > MAX_GREP_LINE_CHARS) {
+        line = line.slice(0, MAX_GREP_LINE_CHARS);
+      }
+      if (regex.test(line)) {
+        hits.push({
+          file: input.displayPath(fileAbs),
+          line: i + 1,
+          text: line
+        });
+        if (hits.length >= MAX_GREP_MATCHES) {
+          matchCapHit = true;
+          break;
+        }
+      }
+    }
+  }
+  const fileCapHit = !stat.isFile() && files.length >= MAX_GREP_FILES_SCANNED;
+  return {
+    ok: true,
+    hits,
+    truncated: matchCapHit || fileCapHit,
+    backend: "node"
+  };
+};
+var runGrepCascade = async (input, deps = {}) => {
+  throwIfAborted2(input.signal);
+  const rg = await searchWithRipgrep(input, deps);
+  if (rg.ok) {
+    return {
+      body: formatGrepBody(rg.hits, rg.truncated),
+      backend: rg.backend
+    };
+  }
+  const grep = await searchWithGrep(input, deps);
+  if (grep.ok) {
+    return {
+      body: formatGrepBody(grep.hits, grep.truncated),
+      backend: grep.backend
+    };
+  }
+  const node = await searchWithNodeWalk(input);
+  if (!node.ok) {
+    throw new Error(node.message);
+  }
+  return {
+    body: formatGrepBody(node.hits, node.truncated),
+    backend: node.backend
+  };
+};
+
+// packages/tools/dist/builtins/grep/tool.js
+var invoke6 = async (ctx, args) => {
+  const pattern = asString(args, "pattern");
+  if (pattern === void 0) {
+    throw new Error("grep requires string argument \xABpattern\xBB.");
+  }
+  const searchPath = asString(args, "path") ?? ".";
+  const respectGitignore = asBoolean(args, "respectGitignore", true);
+  const caseInsensitive = asBoolean(args, "caseInsensitive", false);
+  const absolute = resolveProjectPath(ctx.projectRoot, searchPath, fenceOptions(ctx));
+  const stat = await fs8.stat(absolute).catch(() => null);
+  if (stat === null) {
+    throw new Error(await formatNotFound(absolute, searchPath));
+  }
+  const fenceRoot = resolveFenceRoot(ctx.projectRoot, absolute, ctx.allowedRoots) ?? path7.resolve(ctx.projectRoot);
+  const { body } = await runGrepCascade({
+    pattern,
+    caseInsensitive,
+    respectGitignore,
+    searchAbsolute: absolute,
+    fenceRoot,
+    displayPath: (fileAbs) => displayPath(ctx, fileAbs),
+    ...ctx.signal !== void 0 ? { signal: ctx.signal } : {}
+  });
+  return applyPostProcess(args, body);
+};
+var grepTool = {
+  id: "grep",
+  registration: {
+    toolId: "grep",
+    name: "grep",
+    description: "Regex search across project files (gitignore-aware by default; ripgrep when available, else grep, else bounded Node walk). Optional postProcess.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        pattern: {
+          type: "string",
+          description: "Regex pattern (ripgrep dialect when rg is available; JavaScript RegExp on Node fallback)"
+        },
+        path: {
+          type: "string",
+          description: "Optional subdirectory or file to search"
+        },
+        caseInsensitive: { type: "boolean" },
+        respectGitignore: {
+          type: "boolean",
+          description: "Default true"
+        },
+        postProcess: {
+          type: "string",
+          description: "Optional source of (res: string) => string"
+        }
+      },
+      required: ["pattern"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke6
+};
+
+// packages/tools/dist/builtins/read/tool.js
+import fs9 from "node:fs/promises";
+var MAX_READ_CHARS = 2e5;
+var sliceLines = (content, args) => {
+  const lines = content.split(/\r?\n/);
+  const startLine = asNumber(args, "startLine");
+  const endLine = asNumber(args, "endLine");
+  const offset = asNumber(args, "offset");
+  const limit = asNumber(args, "limit");
+  let start = 0;
+  let end = lines.length;
+  if (startLine !== void 0) {
+    start = Math.max(0, Math.floor(startLine) - 1);
+  } else if (offset !== void 0) {
+    start = Math.max(0, Math.floor(offset));
+  }
+  if (endLine !== void 0) {
+    end = Math.min(lines.length, Math.floor(endLine));
+  } else if (limit !== void 0) {
+    end = Math.min(lines.length, start + Math.max(0, Math.floor(limit)));
+  }
+  const sliced = lines.slice(start, end).join("\n");
+  const truncated = sliced.length > MAX_READ_CHARS ? `${sliced.slice(0, MAX_READ_CHARS)}
+\u2026[truncated at ${MAX_READ_CHARS} chars]` : sliced;
+  if (end < lines.length || start > 0) {
+    return `${truncated}
+
+[lines ${start + 1}-${Math.min(end, lines.length)} of ${lines.length}; continue with startLine=${end + 1}]`;
+  }
+  return truncated;
+};
+var invoke7 = async (ctx, args) => {
+  const userPath = asString(args, "path");
+  if (userPath === void 0) {
+    throw new Error("read requires string argument \xABpath\xBB.");
+  }
+  const absolute = resolveProjectPath(ctx.projectRoot, userPath, fenceOptions(ctx));
+  let content;
+  try {
+    content = await fs9.readFile(absolute, "utf8");
+  } catch (error) {
+    const code = error !== null && typeof error === "object" && "code" in error ? String(error.code) : "";
+    if (code === "ENOENT") {
+      throw new Error(await formatNotFound(absolute, userPath));
+    }
+    throw error;
+  }
+  return applyPostProcess(args, sliceLines(content, args));
+};
+var readTool = {
+  id: "read",
+  registration: {
+    toolId: "read",
+    name: "read",
+    description: "Read a file under the project root. Optional startLine/endLine (1-based) or offset/limit (byte-ish line slices). Optional postProcess: source of (res: string) => string.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Project-relative file path"
+        },
+        startLine: {
+          type: "number",
+          description: "1-based start line"
+        },
+        endLine: {
+          type: "number",
+          description: "1-based end line (inclusive)"
+        },
+        offset: {
+          type: "number",
+          description: "0-based line offset"
+        },
+        limit: {
+          type: "number",
+          description: "Max lines to return"
+        },
+        postProcess: {
+          type: "string",
+          description: "Optional source of (res: string) => string applied after a successful read"
+        }
+      },
+      required: ["path"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke7
+};
+
+// packages/tools/dist/builtins/write/tool.js
+import fs10 from "node:fs/promises";
+import path8 from "node:path";
+var invoke8 = async (ctx, args) => {
+  const userPath = asString(args, "path");
+  const content = asString(args, "content");
+  if (userPath === void 0 || content === void 0) {
+    throw new Error("write requires string arguments \xABpath\xBB and \xABcontent\xBB.");
+  }
+  const absolute = resolveProjectPath(ctx.projectRoot, userPath, fenceOptions(ctx));
+  await fs10.mkdir(path8.dirname(absolute), { recursive: true });
+  await fs10.writeFile(absolute, content, "utf8");
+  return `Wrote \xAB${userPath}\xBB (${content.length} chars).`;
+};
+var writeTool = {
+  id: "write",
+  registration: {
+    toolId: "write",
+    name: "write",
+    description: "Write or overwrite a file (creates parent directories). Prefer create for new-only files.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: {
+          type: "string",
+          description: "Project-relative file path"
+        },
+        content: {
+          type: "string",
+          description: "Full file contents"
+        }
+      },
+      required: ["path", "content"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke8
+};
+
+// packages/tools/dist/builtins/catalog.js
+var BUILTIN_TOOLS = [
+  readTool,
+  globTool,
+  grepTool,
+  editTool,
+  writeTool,
+  createTool,
+  deleteTool,
+  bashTool
+];
+var BUILTIN_TOOL_IDS = BUILTIN_TOOLS.map((tool) => tool.id);
+var BUILTIN_REGISTRATIONS = BUILTIN_TOOLS.map((tool) => tool.registration);
+var byId = Object.fromEntries(BUILTIN_TOOLS.map((tool) => [tool.id, tool]));
+var isBuiltinToolId = (toolId) => Object.hasOwn(byId, toolId);
+var invokeBuiltin = (toolId, ctx, args) => byId[toolId].invoke(ctx, args);
+
+// packages/tools/dist/permission.js
+var DEFAULT_PERMISSION_CONFIG = {
+  read: { "*": "allow" },
+  glob: { "*": "allow" },
+  grep: { "*": "allow" },
+  edit: { "*": "allow" },
+  write: { "*": "allow" },
+  create: { "*": "allow" },
+  delete: { "*": "allow" },
+  bash: { "*": "allow" }
+};
+var DECISION_RANK = {
+  deny: 3,
+  ask: 2,
+  allow: 1
+};
+var isDecision = (value) => value === "allow" || value === "ask" || value === "deny";
+var escapeRegExp = (text) => text.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+var matchPermissionPattern = (pattern, detail) => {
+  const normalizedPattern = pattern.trim();
+  const normalizedDetail = detail;
+  if (normalizedPattern.length === 0) {
+    return false;
+  }
+  if (normalizedPattern === "*") {
+    return true;
+  }
+  const pathStyle = normalizedPattern.includes("/") || normalizedPattern.includes("**");
+  if (pathStyle) {
+    const posixDetail = normalizedDetail.replace(/\\/g, "/");
+    let regexSource2 = "";
+    for (let i = 0; i < normalizedPattern.length; i += 1) {
+      if (normalizedPattern.startsWith("**/", i)) {
+        regexSource2 += "(?:.*/)?";
+        i += 2;
+        continue;
+      }
+      if (normalizedPattern.startsWith("**", i)) {
+        regexSource2 += ".*";
+        i += 1;
+        continue;
+      }
+      const ch = normalizedPattern[i] ?? "";
+      if (ch === "*") {
+        regexSource2 += "[^/]*";
+        continue;
+      }
+      regexSource2 += escapeRegExp(ch);
+    }
+    return new RegExp(`^${regexSource2}$`).test(posixDetail);
+  }
+  let regexSource = "";
+  for (const ch of normalizedPattern) {
+    if (ch === "*") {
+      regexSource += "[\\s\\S]*";
+      continue;
+    }
+    regexSource += escapeRegExp(ch);
+  }
+  return new RegExp(`^${regexSource}$`).test(normalizedDetail);
+};
+var rulesForTool = (config, toolId) => {
+  const raw = config[toolId] ?? DEFAULT_PERMISSION_CONFIG[toolId];
+  if (raw === void 0) {
+    return { "*": "deny" };
+  }
+  if (isDecision(raw)) {
+    return { "*": raw };
+  }
+  const entries = Object.entries(raw).filter((entry) => isDecision(entry[1]));
+  if (entries.length === 0) {
+    return { "*": "deny" };
+  }
+  return Object.fromEntries(entries);
+};
+var resolvePermission = (config, toolId, detail) => {
+  const merged = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...config ?? {}
+  };
+  const rules = rulesForTool(merged, toolId);
+  const matches = Object.entries(rules).filter(([pattern]) => matchPermissionPattern(pattern, detail));
+  if (matches.length === 0) {
+    return "deny";
+  }
+  matches.sort((a, b) => {
+    const lengthDelta = b[0].length - a[0].length;
+    if (lengthDelta !== 0) {
+      return lengthDelta;
+    }
+    return DECISION_RANK[b[1]] - DECISION_RANK[a[1]];
+  });
+  return matches[0]?.[1] ?? "deny";
+};
+var permissionDetailForCall = (toolId, args) => {
+  if (toolId === "bash") {
+    return typeof args.command === "string" ? args.command : "";
+  }
+  if (typeof args.path === "string" && args.path.length > 0) {
+    return args.path.replace(/\\/g, "/");
+  }
+  if (typeof args.file === "string" && args.file.length > 0) {
+    return args.file.replace(/\\/g, "/");
+  }
+  if (typeof args.url === "string" && args.url.length > 0) {
+    return args.url;
+  }
+  if (typeof args.key === "string" && args.key.length > 0) {
+    return args.key;
+  }
+  if (typeof args.collectionId === "string" && args.collectionId.length > 0) {
+    return args.collectionId;
+  }
+  return "*";
+};
+var permissionAskSummary = (toolId, detail) => {
+  if (toolId === "bash") {
+    return `Allow bash: ${detail.length > 0 ? detail : "(empty command)"}?`;
+  }
+  return `Allow ${toolId}: ${detail.length > 0 ? detail : "(no path)"}?`;
+};
+var grantKeyForCall = (toolId, detail) => `${toolId}\0${detail}`;
+var mergePermissionConfigs = (...layers) => layers.reduce((acc, layer) => layer === void 0 ? acc : { ...acc, ...layer }, {});
+var stricterPermission = (left, right) => DECISION_RANK[left] >= DECISION_RANK[right] ? left : right;
+var toolFloorDecision = (config, toolId) => {
+  const merged = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...config ?? {}
+  };
+  if (merged[toolId] === void 0 && DEFAULT_PERMISSION_CONFIG[toolId] === void 0) {
+    return "allow";
+  }
+  const rules = rulesForTool(merged, toolId);
+  const star = rules["*"];
+  if (star !== void 0 && Object.keys(rules).length === 1) {
+    return star;
+  }
+  const decisions = Object.values(rules);
+  if (decisions.some((decision) => decision === "allow")) {
+    return "allow";
+  }
+  if (decisions.some((decision) => decision === "ask")) {
+    return "ask";
+  }
+  return "deny";
+};
+var clampToolPermission = (floor, node) => stricterPermission(floor, node);
+var isToolAlwaysDenied = (config, toolId) => {
+  const merged = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...config ?? {}
+  };
+  if (merged[toolId] === void 0 && DEFAULT_PERMISSION_CONFIG[toolId] === void 0) {
+    return false;
+  }
+  const rules = rulesForTool(merged, toolId);
+  const decisions = Object.values(rules);
+  return decisions.length > 0 && decisions.every((decision) => decision === "deny");
+};
+var mergeProjectAndNodePermissions = (projectPermission, nodeToolPermissions) => {
+  const project = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...projectPermission ?? {}
+  };
+  if (nodeToolPermissions === void 0) {
+    return projectPermission ?? {};
+  }
+  const nodeEntries = [];
+  for (const [toolId, decision] of Object.entries(nodeToolPermissions)) {
+    if (!isDecision(decision)) {
+      continue;
+    }
+    const floor = toolFloorDecision(project, toolId);
+    nodeEntries.push([toolId, clampToolPermission(floor, decision)]);
+  }
+  return mergePermissionConfigs(projectPermission, Object.fromEntries(nodeEntries));
+};
+var PERMISSION_DENY_HINT = "Tighten or loosen via Inspector tool permissions (within project floor) or edit permission.<tool> in .langflower/langflower.jsonc.";
+var formatPermissionDeniedText = (toolId, detail) => {
+  const target = detail.length > 0 ? `${toolId} (${detail})` : toolId;
+  return `Permission denied for ${target}. Effective policy is deny (project floor and/or node toolPermissions). ${PERMISSION_DENY_HINT}`;
+};
+
+// packages/tools/dist/gate-tool-call.js
+var deniedToolResult = (toolId, detail) => ({
+  ok: false,
+  text: formatPermissionDeniedText(toolId, detail)
+});
+var gateToolCall = async (options) => {
+  const { toolId, detail, grants, permission, requestPermission, whenMissingToolConfig } = options;
+  const key = grantKeyForCall(toolId, detail);
+  if (grants.has(key)) {
+    return "allow";
+  }
+  const decision = whenMissingToolConfig !== void 0 && permission[toolId] === void 0 ? whenMissingToolConfig : resolvePermission(permission, toolId, detail);
+  if (decision === "allow") {
+    return "allow";
+  }
+  if (decision === "deny") {
+    return "deny";
+  }
+  if (requestPermission === void 0) {
+    return "deny";
+  }
+  const reply = await requestPermission({
+    toolId,
+    detail,
+    summary: permissionAskSummary(toolId, detail)
+  });
+  if (reply === "allow") {
+    grants.add(key);
+    return "allow";
+  }
+  return "deny";
+};
+
+// packages/tools/dist/create-project-harness.js
+var createProjectHarness = (options) => {
+  const ctx = {
+    projectRoot: options.projectRoot,
+    denyPaths: options.denyPaths ?? [],
+    allowedRoots: options.allowedRoots ?? [],
+    bashEnabled: options.bashEnabled === true
+  };
+  const permission = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...options.permission ?? {}
+  };
+  const grants = /* @__PURE__ */ new Set();
+  const gate = (toolId, detail) => gateToolCall({
+    toolId,
+    detail,
+    grants,
+    permission,
+    ...options.requestPermission !== void 0 ? { requestPermission: options.requestPermission } : {}
+  });
+  return {
+    listBuiltinRegistrations: () => BUILTIN_REGISTRATIONS,
+    authorize: async (call) => {
+      const toolId = call.toolId.trim();
+      const detail = permissionDetailForCall(toolId, call.args);
+      return gate(toolId, detail);
+    },
+    invoke: async (call) => {
+      const toolId = call.toolId.trim();
+      if (!isBuiltinToolId(toolId)) {
+        return {
+          ok: false,
+          text: `Unknown builtin tool \xAB${call.toolId}\xBB. Available: ${BUILTIN_TOOL_IDS.join(", ")}. Domain/custom tools must expose registration.handler (import from @langflower/tools), not harness toolId lookup.`
+        };
+      }
+      const detail = permissionDetailForCall(toolId, call.args);
+      const access = await gate(toolId, detail);
+      if (access === "deny") {
+        return deniedToolResult(toolId, detail);
+      }
+      try {
+        const invokeCtx = call.signal === void 0 ? ctx : { ...ctx, signal: call.signal };
+        const text = await invokeBuiltin(toolId, invokeCtx, call.args);
+        return { ok: true, text };
+      } catch (error) {
+        const text = error instanceof Error ? error.message : String(error);
+        return { ok: false, text };
+      }
+    }
+  };
+};
+
+export {
+  DEFAULT_PERMISSION_CONFIG,
+  isToolAlwaysDenied,
+  mergeProjectAndNodePermissions,
+  formatPermissionDeniedText,
+  resolveProjectPath,
+  formatNotFound,
+  walkFiles,
+  isBuiltinToolId,
+  createProjectHarness
+};