langflower 0.1.2 → 0.2.0

package/dist/{chunk-NIRPHJLO.js → chunk-3Z7Q6SQ5.js}

@@ -2,6 +2,202 @@ import { createRequire as __lfCreateRequire } from 'node:module';
 const require = __lfCreateRequire(import.meta.url);
 
 
+// packages/tools/dist/permission.js
+var DEFAULT_PERMISSION_CONFIG = {
+  read: { "*": "allow" },
+  glob: { "*": "allow" },
+  grep: { "*": "allow" },
+  edit: { "*": "allow" },
+  write: { "*": "allow" },
+  create: { "*": "allow" },
+  delete: { "*": "allow" },
+  move: { "*": "allow" },
+  sleep: { "*": "allow" },
+  bash: { "*": "allow" },
+  ask_user: { "*": "allow" }
+};
+var DECISION_RANK = {
+  deny: 3,
+  ask: 2,
+  allow: 1
+};
+var isDecision = (value) => value === "allow" || value === "ask" || value === "deny";
+var escapeRegExp = (text) => text.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+var matchPermissionPattern = (pattern, detail) => {
+  const normalizedPattern = pattern.trim();
+  const normalizedDetail = detail;
+  if (normalizedPattern.length === 0) {
+    return false;
+  }
+  if (normalizedPattern === "*") {
+    return true;
+  }
+  const pathStyle = normalizedPattern.includes("/") || normalizedPattern.includes("**");
+  if (pathStyle) {
+    const posixDetail = normalizedDetail.replace(/\\/g, "/");
+    let regexSource2 = "";
+    for (let i = 0; i < normalizedPattern.length; i += 1) {
+      if (normalizedPattern.startsWith("**/", i)) {
+        regexSource2 += "(?:.*/)?";
+        i += 2;
+        continue;
+      }
+      if (normalizedPattern.startsWith("**", i)) {
+        regexSource2 += ".*";
+        i += 1;
+        continue;
+      }
+      const ch = normalizedPattern[i] ?? "";
+      if (ch === "*") {
+        regexSource2 += "[^/]*";
+        continue;
+      }
+      regexSource2 += escapeRegExp(ch);
+    }
+    return new RegExp(`^${regexSource2}$`).test(posixDetail);
+  }
+  let regexSource = "";
+  for (const ch of normalizedPattern) {
+    if (ch === "*") {
+      regexSource += "[\\s\\S]*";
+      continue;
+    }
+    regexSource += escapeRegExp(ch);
+  }
+  return new RegExp(`^${regexSource}$`).test(normalizedDetail);
+};
+var rulesForTool = (config, toolId) => {
+  const raw = config[toolId] ?? DEFAULT_PERMISSION_CONFIG[toolId];
+  if (raw === void 0) {
+    return { "*": "deny" };
+  }
+  if (isDecision(raw)) {
+    return { "*": raw };
+  }
+  const entries = Object.entries(raw).filter((entry) => isDecision(entry[1]));
+  if (entries.length === 0) {
+    return { "*": "deny" };
+  }
+  return Object.fromEntries(entries);
+};
+var resolvePermission = (config, toolId, detail) => {
+  const merged = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...config ?? {}
+  };
+  const rules = rulesForTool(merged, toolId);
+  const matches = Object.entries(rules).filter(([pattern]) => matchPermissionPattern(pattern, detail));
+  if (matches.length === 0) {
+    return "deny";
+  }
+  matches.sort((a, b) => {
+    const lengthDelta = b[0].length - a[0].length;
+    if (lengthDelta !== 0) {
+      return lengthDelta;
+    }
+    return DECISION_RANK[b[1]] - DECISION_RANK[a[1]];
+  });
+  return matches[0]?.[1] ?? "deny";
+};
+var posixArg = (value) => typeof value === "string" && value.length > 0 ? value.replace(/\\/g, "/") : void 0;
+var singlePermissionDetail = (toolId, args) => {
+  if (toolId === "bash") {
+    return typeof args.command === "string" ? args.command : "";
+  }
+  if (toolId === "sleep") {
+    return typeof args.seconds === "number" && Number.isFinite(args.seconds) ? `${String(Math.trunc(args.seconds))}s` : "*";
+  }
+  if (toolId === "ask_user") {
+    if (typeof args.question === "string" && args.question.trim().length > 0) {
+      return args.question;
+    }
+    const questions = args.questions;
+    if (!Array.isArray(questions) || questions.length === 0) {
+      return "";
+    }
+    const first = questions[0];
+    if (first !== null && typeof first === "object" && !Array.isArray(first) && "prompt" in first && typeof first.prompt === "string") {
+      return first.prompt;
+    }
+    return "";
+  }
+  return posixArg(args.path) ?? posixArg(args.file) ?? posixArg(args.url) ?? posixArg(args.key) ?? posixArg(args.collectionId) ?? "*";
+};
+var permissionDetailsForCall = (toolId, args) => {
+  if (toolId === "move") {
+    const details = [posixArg(args.from), posixArg(args.to)].filter((value) => value !== void 0);
+    return details.length > 0 ? details : ["*"];
+  }
+  return [singlePermissionDetail(toolId, args)];
+};
+var permissionAskSummary = (toolId, detail) => {
+  if (toolId === "bash") {
+    return `Allow bash: ${detail.length > 0 ? detail : "(empty command)"}?`;
+  }
+  return `Allow ${toolId}: ${detail.length > 0 ? detail : "(no path)"}?`;
+};
+var grantKeyForCall = (toolId, detail) => `${toolId}\0${detail}`;
+var mergePermissionConfigs = (...layers) => layers.reduce((acc, layer) => layer === void 0 ? acc : { ...acc, ...layer }, {});
+var stricterPermission = (left, right) => DECISION_RANK[left] >= DECISION_RANK[right] ? left : right;
+var toolFloorDecision = (config, toolId) => {
+  const merged = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...config ?? {}
+  };
+  if (merged[toolId] === void 0 && DEFAULT_PERMISSION_CONFIG[toolId] === void 0) {
+    return "allow";
+  }
+  const rules = rulesForTool(merged, toolId);
+  const star = rules["*"];
+  if (star !== void 0 && Object.keys(rules).length === 1) {
+    return star;
+  }
+  const decisions = Object.values(rules);
+  if (decisions.some((decision) => decision === "allow")) {
+    return "allow";
+  }
+  if (decisions.some((decision) => decision === "ask")) {
+    return "ask";
+  }
+  return "deny";
+};
+var clampToolPermission = (floor, node) => stricterPermission(floor, node);
+var isToolAlwaysDenied = (config, toolId) => {
+  const merged = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...config ?? {}
+  };
+  if (merged[toolId] === void 0 && DEFAULT_PERMISSION_CONFIG[toolId] === void 0) {
+    return false;
+  }
+  const rules = rulesForTool(merged, toolId);
+  const decisions = Object.values(rules);
+  return decisions.length > 0 && decisions.every((decision) => decision === "deny");
+};
+var mergeProjectAndNodePermissions = (projectPermission, nodeToolPermissions) => {
+  const project = {
+    ...DEFAULT_PERMISSION_CONFIG,
+    ...projectPermission ?? {}
+  };
+  if (nodeToolPermissions === void 0) {
+    return projectPermission ?? {};
+  }
+  const nodeEntries = [];
+  for (const [toolId, decision] of Object.entries(nodeToolPermissions)) {
+    if (!isDecision(decision)) {
+      continue;
+    }
+    const floor = toolFloorDecision(project, toolId);
+    nodeEntries.push([toolId, clampToolPermission(floor, decision)]);
+  }
+  return mergePermissionConfigs(projectPermission, Object.fromEntries(nodeEntries));
+};
+var PERMISSION_DENY_HINT = "Tighten or loosen via Inspector tool permissions (within project floor) or edit permission.<tool> in .langflower/langflower.jsonc.";
+var formatPermissionDeniedText = (toolId, detail) => {
+  const target = detail.length > 0 ? `${toolId} (${detail})` : toolId;
+  return `Permission denied for ${target}. Effective policy is deny (project floor and/or node toolPermissions). ${PERMISSION_DENY_HINT}`;
+};
+
 // packages/tools/dist/builtins/args.js
 var asString = (args, key) => {
   const value = args[key];
@@ -16,6 +212,69 @@ var asBoolean = (args, key, defaultValue) => {
   return typeof value === "boolean" ? value : defaultValue;
 };
 
+// packages/tools/dist/builtins/ask_user/parse-ask-user-args.js
+var ASK_USER_MAX_QUESTIONS = 8;
+var ASK_USER_MAX_OPTIONS = 12;
+var isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var parseOptions = (raw) => {
+  if (raw === void 0) {
+    return [];
+  }
+  if (!Array.isArray(raw)) {
+    throw new Error("ask_user \xABoptions\xBB must be an array of strings.");
+  }
+  if (raw.length > ASK_USER_MAX_OPTIONS) {
+    throw new Error(`ask_user accepts at most ${ASK_USER_MAX_OPTIONS} options per question.`);
+  }
+  const options = [];
+  for (const [optionIndex, entry] of raw.entries()) {
+    if (typeof entry !== "string" || entry.trim().length === 0) {
+      throw new Error("ask_user option labels must be non-empty strings.");
+    }
+    options.push({
+      id: `o${optionIndex + 1}`,
+      label: entry.trim()
+    });
+  }
+  return options;
+};
+var parseQuestions = (raw) => {
+  if (raw === void 0) {
+    return [];
+  }
+  if (!Array.isArray(raw)) {
+    throw new Error("ask_user \xABquestions\xBB must be an array.");
+  }
+  if (raw.length > ASK_USER_MAX_QUESTIONS) {
+    throw new Error(`ask_user accepts at most ${ASK_USER_MAX_QUESTIONS} questions.`);
+  }
+  const questions = [];
+  for (const [index, entry] of raw.entries()) {
+    if (!isRecord(entry)) {
+      throw new Error("ask_user each question must be an object with \xABprompt\xBB.");
+    }
+    const prompt = asString(entry, "prompt")?.trim();
+    if (prompt === void 0 || prompt.length === 0) {
+      throw new Error("ask_user each question needs a non-empty \xABprompt\xBB.");
+    }
+    questions.push({
+      id: `q${index + 1}`,
+      prompt,
+      options: parseOptions(entry["options"]),
+      allowMultiple: asBoolean(entry, "allowMultiple", false)
+    });
+  }
+  return questions;
+};
+var parseAskUserArgs = (args) => {
+  const question = asString(args, "question")?.trim() ?? "";
+  const questions = parseQuestions(args["questions"]);
+  if (question.length === 0 && questions.length === 0) {
+    throw new Error("ask_user requires \xABquestion\xBB or a non-empty \xABquestions\xBB list.");
+  }
+  return { question, questions };
+};
+
 // packages/tools/dist/builtins/ask_user/tool.js
 var ASK_USER_ABORTED = "ask_user aborted.";
 var invokeWithAbort = (work, signal) => {
@@ -41,30 +300,49 @@ var invokeWithAbort = (work, signal) => {
   });
 };
 var invoke = async (ctx, args) => {
-  const question = asString(args, "question");
-  if (question === void 0 || question.trim().length === 0) {
-    throw new Error("ask_user requires string argument \xABquestion\xBB.");
-  }
+  const request = parseAskUserArgs(args);
   if (ctx.askUser === void 0) {
     throw new Error("ask_user requires a live HITL host. No askUser hook is bound on this harness.");
   }
-  return invokeWithAbort(ctx.askUser({ question: question.trim() }), ctx.signal);
+  return invokeWithAbort(ctx.askUser(request), ctx.signal);
 };
 var askUserTool = {
   id: "ask_user",
   registration: {
     toolId: "ask_user",
     name: "ask_user",
-    description: "Do not guess. If you are not sure, ask the user. Pauses the run so the operator can provide additional information.",
+    description: "Do not guess. If you are not sure, ask the user. Pauses the run so the operator can answer. Pass \xABquestion\xBB for a freeform prompt, and/or ordered \xABquestions\xBB with optional choice lists. The operator sees every question at once, may select options (multi-select when allowMultiple is true), and may also type a freeform reply. One Send returns the answers.",
     inputSchema: {
       type: "object",
       properties: {
         question: {
           type: "string",
-          description: "The question to show the operator. Be specific about what you need."
+          description: "Headline or single freeform question. Required when questions is omitted."
+        },
+        questions: {
+          type: "array",
+          description: "Ordered questions shown together. Each may include options. Max 8.",
+          items: {
+            type: "object",
+            properties: {
+              prompt: {
+                type: "string",
+                description: "Question text for the operator."
+              },
+              options: {
+                type: "array",
+                description: "Optional choice labels. Max 12. Empty means freeform only for this prompt.",
+                items: { type: "string" }
+              },
+              allowMultiple: {
+                type: "boolean",
+                description: "When true, the operator may select several options for this question."
+              }
+            },
+            required: ["prompt"]
+          }
         }
       },
-      required: ["question"],
       additionalProperties: false
     }
   },
@@ -111,10 +389,7 @@ var toHarnessDisplayPath = (projectRoot, absolute, allowedRoots = []) => {
   }
   return absolute.split(path.sep).join("/");
 };
-var isPathFenceOptions = (value) => !Array.isArray(value);
-var asPathFenceOptions = (denyOrOptions) => isPathFenceOptions(denyOrOptions) ? denyOrOptions : { denyPaths: denyOrOptions };
-var resolveProjectPath = (projectRoot, userPath, denyOrOptions = {}) => {
-  const options = asPathFenceOptions(denyOrOptions);
+var resolveProjectPath = (projectRoot, userPath, options = {}) => {
   const denyPaths = options.denyPaths ?? DEFAULT_DENY;
   const allowedRoots = options.allowedRoots ?? [];
   const trimmed = userPath.trim();
@@ -172,7 +447,8 @@ var invoke2 = async (ctx, args) => {
     const child = spawn(command, {
       cwd,
       shell: true,
-      windowsHide: true
+      windowsHide: true,
+      ...ctx.signal === void 0 ? {} : { signal: ctx.signal }
     });
     let stdout = "";
     let stderr = "";
@@ -532,7 +808,6 @@ var globToRegExp = (pattern) => {
   const escaped = pattern.replace(/\\/g, "/").replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "::DOUBLESTAR::").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/::DOUBLESTAR::/g, ".*");
   return new RegExp(`^${escaped}$`);
 };
-var normalizeOptions = (options) => typeof options === "boolean" ? { respectGitignore: options } : options;
 var yieldEventLoop = () => new Promise((resolve) => {
   setImmediate(resolve);
 });
@@ -541,16 +816,15 @@ var throwIfAborted = (signal) => {
     throw new Error("aborted");
   }
 };
-var walkFiles = async (root, dir, options = true) => {
-  const opts = normalizeOptions(options);
-  const respectGitignore = opts.respectGitignore !== false;
-  const yieldEvery = opts.yieldEvery ?? 32;
+var walkFiles = async (root, dir, options = {}) => {
+  const respectGitignore = options.respectGitignore !== false;
+  const yieldEvery = options.yieldEvery ?? 32;
   const matcher = respectGitignore ? await loadGitIgnoreMatcher(root) : { ignores: () => false };
   const out = [];
   const visitedDirs = /* @__PURE__ */ new Set();
   let steps = 0;
   const visit = async (absoluteDir) => {
-    throwIfAborted(opts.signal);
+    throwIfAborted(options.signal);
     let realDir;
     try {
       realDir = await fs6.realpath(absoluteDir);
@@ -568,11 +842,11 @@ var walkFiles = async (root, dir, options = true) => {
       return;
     }
     for (const entry of entries) {
-      throwIfAborted(opts.signal);
+      throwIfAborted(options.signal);
       steps += 1;
       if (steps % yieldEvery === 0) {
         await yieldEventLoop();
-        throwIfAborted(opts.signal);
+        throwIfAborted(options.signal);
       }
       if (entry.isDirectory() && WALK_EXCLUDE_DIR_NAMES.includes(entry.name)) {
         continue;
@@ -589,7 +863,7 @@ var walkFiles = async (root, dir, options = true) => {
         await visit(absolute);
       } else if (entry.isFile()) {
         out.push(relative);
-        if (opts.maxFiles !== void 0 && out.length >= opts.maxFiles) {
+        if (options.maxFiles !== void 0 && out.length >= options.maxFiles) {
           return;
         }
       }
@@ -610,7 +884,7 @@ var invoke6 = async (ctx, args) => {
   const respectGitignore = asBoolean(args, "respectGitignore", true);
   const searchRoot = resolveProjectPath(ctx.projectRoot, cwdArg, fenceOptions(ctx));
   const fenceRoot = resolveFenceRoot(ctx.projectRoot, searchRoot, ctx.allowedRoots) ?? path5.resolve(ctx.projectRoot);
-  const files = await walkFiles(fenceRoot, searchRoot, respectGitignore);
+  const files = await walkFiles(fenceRoot, searchRoot, { respectGitignore });
   const regex = globToRegExp(pattern.replace(/\\/g, "/"));
   const searchRel = path5.relative(fenceRoot, searchRoot).split(path5.sep).join("/");
   const cwdPrefix = searchRel === "" ? "" : `${searchRel.replace(/\/$/, "")}/`;
@@ -1072,8 +1346,88 @@ var grepTool = {
   invoke: invoke7
 };
 
-// packages/tools/dist/builtins/read/tool.js
+// packages/tools/dist/builtins/move/tool.js
 import fs9 from "node:fs/promises";
+import path8 from "node:path";
+var errorCode = (error) => error !== null && typeof error === "object" && "code" in error ? String(error.code) : "";
+var isInsideDirectory = (parent, child) => {
+  const relative = path8.relative(parent, child);
+  return relative !== "" && !relative.startsWith("..") && !path8.isAbsolute(relative);
+};
+var invoke8 = async (ctx, args) => {
+  const fromPath = asString(args, "from");
+  const toPath = asString(args, "to");
+  if (fromPath === void 0 || toPath === void 0) {
+    throw new Error("move requires string arguments \xABfrom\xBB and \xABto\xBB.");
+  }
+  const fromAbs = resolveProjectPath(ctx.projectRoot, fromPath, fenceOptions(ctx));
+  const toAbs = resolveProjectPath(ctx.projectRoot, toPath, fenceOptions(ctx));
+  if (fromAbs === toAbs) {
+    return `Already at \xAB${fromPath}\xBB.`;
+  }
+  let fromStat;
+  try {
+    fromStat = await fs9.lstat(fromAbs);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") {
+      throw new Error(await formatNotFound(fromAbs, fromPath));
+    }
+    throw error;
+  }
+  try {
+    const toStat = await fs9.lstat(toAbs);
+    const kind = toStat.isDirectory() ? "directory" : "file";
+    throw new Error(`move failed: \xAB${toPath}\xBB already exists (${kind}). Delete or rename it first, then retry.`);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("move failed:")) {
+      throw error;
+    }
+    if (errorCode(error) !== "ENOENT") {
+      throw error;
+    }
+  }
+  if (fromStat.isDirectory() && isInsideDirectory(fromAbs, toAbs)) {
+    throw new Error(`move failed: destination \xAB${toPath}\xBB is inside source directory \xAB${fromPath}\xBB.`);
+  }
+  await fs9.mkdir(path8.dirname(toAbs), { recursive: true });
+  try {
+    await fs9.rename(fromAbs, toAbs);
+  } catch (error) {
+    if (errorCode(error) !== "EXDEV") {
+      throw error;
+    }
+    await fs9.cp(fromAbs, toAbs, { recursive: true });
+    await fs9.rm(fromAbs, { recursive: true, force: true });
+  }
+  return `Moved \xAB${fromPath}\xBB \u2192 \xAB${toPath}\xBB.`;
+};
+var moveTool = {
+  id: "move",
+  registration: {
+    toolId: "move",
+    name: "move",
+    description: "Move or rename a file or directory under the project root. Fails if the destination exists (delete or rename it first). Prefer this over bash mv/ren/Move-Item. Both from and to must be the full path (not a parent directory).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        from: {
+          type: "string",
+          description: "Project-relative source file or directory"
+        },
+        to: {
+          type: "string",
+          description: "Project-relative destination path (full new path, not a parent folder)"
+        }
+      },
+      required: ["from", "to"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke8
+};
+
+// packages/tools/dist/builtins/read/tool.js
+import fs10 from "node:fs/promises";
 var MAX_READ_CHARS = 2e5;
 var sliceLines = (content, args) => {
   const lines = content.split(/\r?\n/);
@@ -1103,7 +1457,7 @@ var sliceLines = (content, args) => {
   }
   return truncated;
 };
-var invoke8 = async (ctx, args) => {
+var invoke9 = async (ctx, args) => {
   const userPath = asString(args, "path");
   if (userPath === void 0) {
     throw new Error("read requires string argument \xABpath\xBB.");
@@ -1111,7 +1465,7 @@ var invoke8 = async (ctx, args) => {
   const absolute = resolveProjectPath(ctx.projectRoot, userPath, fenceOptions(ctx));
   let content;
   try {
-    content = await fs9.readFile(absolute, "utf8");
+    content = await fs10.readFile(absolute, "utf8");
   } catch (error) {
     const code = error !== null && typeof error === "object" && "code" in error ? String(error.code) : "";
     if (code === "ENOENT") {
@@ -1159,21 +1513,74 @@ var readTool = {
       additionalProperties: false
     }
   },
-  invoke: invoke8
+  invoke: invoke9
+};
+
+// packages/tools/dist/builtins/sleep/tool.js
+var SLEEP_MIN_SECONDS = 1;
+var SLEEP_MAX_SECONDS = 300;
+var invoke10 = async (ctx, args) => {
+  const seconds = asNumber(args, "seconds");
+  if (seconds === void 0 || !Number.isInteger(seconds)) {
+    throw new Error("sleep requires integer argument \xABseconds\xBB (1\u2013300).");
+  }
+  if (seconds < SLEEP_MIN_SECONDS || seconds > SLEEP_MAX_SECONDS) {
+    throw new Error(`sleep \xABseconds\xBB must be between ${String(SLEEP_MIN_SECONDS)} and ${String(SLEEP_MAX_SECONDS)}.`);
+  }
+  const signal = ctx.signal;
+  await new Promise((resolve, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new Error("sleep aborted."));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, seconds * 1e3);
+    if (signal?.aborted) {
+      clearTimeout(timer);
+      reject(new Error("sleep aborted."));
+      return;
+    }
+    signal?.addEventListener("abort", onAbort);
+  });
+  return `Slept ${String(seconds)}s.`;
+};
+var sleepTool = {
+  id: "sleep",
+  registration: {
+    toolId: "sleep",
+    name: "sleep",
+    description: "Wait a bounded number of seconds (1\u2013300) without bash. Stop aborts the wait. Not a job-wait and not canvas Delay.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        seconds: {
+          type: "integer",
+          minimum: SLEEP_MIN_SECONDS,
+          maximum: SLEEP_MAX_SECONDS,
+          description: "Seconds to wait (integer, 1\u2013300). Over the cap is an error."
+        }
+      },
+      required: ["seconds"],
+      additionalProperties: false
+    }
+  },
+  invoke: invoke10
 };
 
 // packages/tools/dist/builtins/write/tool.js
-import fs10 from "node:fs/promises";
-import path8 from "node:path";
-var invoke9 = async (ctx, args) => {
+import fs11 from "node:fs/promises";
+import path9 from "node:path";
+var invoke11 = async (ctx, args) => {
   const userPath = asString(args, "path");
   const content = asString(args, "content");
   if (userPath === void 0 || content === void 0) {
     throw new Error("write requires string arguments \xABpath\xBB and \xABcontent\xBB.");
   }
   const absolute = resolveProjectPath(ctx.projectRoot, userPath, fenceOptions(ctx));
-  await fs10.mkdir(path8.dirname(absolute), { recursive: true });
-  await fs10.writeFile(absolute, content, "utf8");
+  await fs11.mkdir(path9.dirname(absolute), { recursive: true });
+  await fs11.writeFile(absolute, content, "utf8");
   return `Wrote \xAB${userPath}\xBB (${content.length} chars).`;
 };
 var writeTool = {
@@ -1198,7 +1605,7 @@ var writeTool = {
       additionalProperties: false
     }
   },
-  invoke: invoke9
+  invoke: invoke11
 };
 
 // packages/tools/dist/builtins/catalog.js
@@ -1210,6 +1617,8 @@ var BUILTIN_TOOLS = [
   writeTool,
   createTool,
   deleteTool,
+  moveTool,
+  sleepTool,
   bashTool,
   askUserTool
 ];
@@ -1219,226 +1628,71 @@ var byId = Object.fromEntries(BUILTIN_TOOLS.map((tool) => [tool.id, tool]));
 var isBuiltinToolId = (toolId) => Object.hasOwn(byId, toolId);
 var invokeBuiltin = (toolId, ctx, args) => byId[toolId].invoke(ctx, args);
 
-// packages/tools/dist/permission.js
-var DEFAULT_PERMISSION_CONFIG = {
-  read: { "*": "allow" },
-  glob: { "*": "allow" },
-  grep: { "*": "allow" },
-  edit: { "*": "allow" },
-  write: { "*": "allow" },
-  create: { "*": "allow" },
-  delete: { "*": "allow" },
-  bash: { "*": "allow" },
-  ask_user: { "*": "allow" }
-};
-var DECISION_RANK = {
-  deny: 3,
-  ask: 2,
-  allow: 1
-};
-var isDecision = (value) => value === "allow" || value === "ask" || value === "deny";
-var escapeRegExp = (text) => text.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-var matchPermissionPattern = (pattern, detail) => {
-  const normalizedPattern = pattern.trim();
-  const normalizedDetail = detail;
-  if (normalizedPattern.length === 0) {
-    return false;
-  }
-  if (normalizedPattern === "*") {
-    return true;
-  }
-  const pathStyle = normalizedPattern.includes("/") || normalizedPattern.includes("**");
-  if (pathStyle) {
-    const posixDetail = normalizedDetail.replace(/\\/g, "/");
-    let regexSource2 = "";
-    for (let i = 0; i < normalizedPattern.length; i += 1) {
-      if (normalizedPattern.startsWith("**/", i)) {
-        regexSource2 += "(?:.*/)?";
-        i += 2;
-        continue;
-      }
-      if (normalizedPattern.startsWith("**", i)) {
-        regexSource2 += ".*";
-        i += 1;
-        continue;
-      }
-      const ch = normalizedPattern[i] ?? "";
-      if (ch === "*") {
-        regexSource2 += "[^/]*";
-        continue;
-      }
-      regexSource2 += escapeRegExp(ch);
-    }
-    return new RegExp(`^${regexSource2}$`).test(posixDetail);
-  }
-  let regexSource = "";
-  for (const ch of normalizedPattern) {
-    if (ch === "*") {
-      regexSource += "[\\s\\S]*";
-      continue;
-    }
-    regexSource += escapeRegExp(ch);
-  }
-  return new RegExp(`^${regexSource}$`).test(normalizedDetail);
-};
-var rulesForTool = (config, toolId) => {
-  const raw = config[toolId] ?? DEFAULT_PERMISSION_CONFIG[toolId];
-  if (raw === void 0) {
-    return { "*": "deny" };
-  }
-  if (isDecision(raw)) {
-    return { "*": raw };
-  }
-  const entries = Object.entries(raw).filter((entry) => isDecision(entry[1]));
-  if (entries.length === 0) {
-    return { "*": "deny" };
-  }
-  return Object.fromEntries(entries);
-};
-var resolvePermission = (config, toolId, detail) => {
-  const merged = {
-    ...DEFAULT_PERMISSION_CONFIG,
-    ...config ?? {}
-  };
-  const rules = rulesForTool(merged, toolId);
-  const matches = Object.entries(rules).filter(([pattern]) => matchPermissionPattern(pattern, detail));
-  if (matches.length === 0) {
-    return "deny";
-  }
-  matches.sort((a, b) => {
-    const lengthDelta = b[0].length - a[0].length;
-    if (lengthDelta !== 0) {
-      return lengthDelta;
-    }
-    return DECISION_RANK[b[1]] - DECISION_RANK[a[1]];
-  });
-  return matches[0]?.[1] ?? "deny";
-};
-var permissionDetailForCall = (toolId, args) => {
-  if (toolId === "bash") {
-    return typeof args.command === "string" ? args.command : "";
-  }
-  if (toolId === "ask_user") {
-    return typeof args.question === "string" ? args.question : "";
-  }
-  if (typeof args.path === "string" && args.path.length > 0) {
-    return args.path.replace(/\\/g, "/");
-  }
-  if (typeof args.file === "string" && args.file.length > 0) {
-    return args.file.replace(/\\/g, "/");
-  }
-  if (typeof args.url === "string" && args.url.length > 0) {
-    return args.url;
-  }
-  if (typeof args.key === "string" && args.key.length > 0) {
-    return args.key;
-  }
-  if (typeof args.collectionId === "string" && args.collectionId.length > 0) {
-    return args.collectionId;
-  }
-  return "*";
-};
-var permissionAskSummary = (toolId, detail) => {
-  if (toolId === "bash") {
-    return `Allow bash: ${detail.length > 0 ? detail : "(empty command)"}?`;
-  }
-  return `Allow ${toolId}: ${detail.length > 0 ? detail : "(no path)"}?`;
-};
-var grantKeyForCall = (toolId, detail) => `${toolId}\0${detail}`;
-var mergePermissionConfigs = (...layers) => layers.reduce((acc, layer) => layer === void 0 ? acc : { ...acc, ...layer }, {});
-var stricterPermission = (left, right) => DECISION_RANK[left] >= DECISION_RANK[right] ? left : right;
-var toolFloorDecision = (config, toolId) => {
-  const merged = {
-    ...DEFAULT_PERMISSION_CONFIG,
-    ...config ?? {}
-  };
-  if (merged[toolId] === void 0 && DEFAULT_PERMISSION_CONFIG[toolId] === void 0) {
-    return "allow";
-  }
-  const rules = rulesForTool(merged, toolId);
-  const star = rules["*"];
-  if (star !== void 0 && Object.keys(rules).length === 1) {
-    return star;
-  }
-  const decisions = Object.values(rules);
-  if (decisions.some((decision) => decision === "allow")) {
-    return "allow";
-  }
-  if (decisions.some((decision) => decision === "ask")) {
-    return "ask";
-  }
-  return "deny";
-};
-var clampToolPermission = (floor, node) => stricterPermission(floor, node);
-var isToolAlwaysDenied = (config, toolId) => {
-  const merged = {
-    ...DEFAULT_PERMISSION_CONFIG,
-    ...config ?? {}
-  };
-  if (merged[toolId] === void 0 && DEFAULT_PERMISSION_CONFIG[toolId] === void 0) {
-    return false;
-  }
-  const rules = rulesForTool(merged, toolId);
-  const decisions = Object.values(rules);
-  return decisions.length > 0 && decisions.every((decision) => decision === "deny");
-};
-var mergeProjectAndNodePermissions = (projectPermission, nodeToolPermissions) => {
-  const project = {
-    ...DEFAULT_PERMISSION_CONFIG,
-    ...projectPermission ?? {}
-  };
-  if (nodeToolPermissions === void 0) {
-    return projectPermission ?? {};
-  }
-  const nodeEntries = [];
-  for (const [toolId, decision] of Object.entries(nodeToolPermissions)) {
-    if (!isDecision(decision)) {
-      continue;
-    }
-    const floor = toolFloorDecision(project, toolId);
-    nodeEntries.push([toolId, clampToolPermission(floor, decision)]);
-  }
-  return mergePermissionConfigs(projectPermission, Object.fromEntries(nodeEntries));
-};
-var PERMISSION_DENY_HINT = "Tighten or loosen via Inspector tool permissions (within project floor) or edit permission.<tool> in .langflower/langflower.jsonc.";
-var formatPermissionDeniedText = (toolId, detail) => {
-  const target = detail.length > 0 ? `${toolId} (${detail})` : toolId;
-  return `Permission denied for ${target}. Effective policy is deny (project floor and/or node toolPermissions). ${PERMISSION_DENY_HINT}`;
-};
-
 // packages/tools/dist/gate-tool-call.js
 var deniedToolResult = (toolId, detail) => ({
   ok: false,
   text: formatPermissionDeniedText(toolId, detail)
 });
 var gateToolCall = async (options) => {
-  const { toolId, detail, grants, permission, requestPermission, whenMissingToolConfig } = options;
-  const key = grantKeyForCall(toolId, detail);
-  if (grants.has(key)) {
-    return "allow";
+  const { toolId, grants, permission, requestPermission } = options;
+  const details = options.details.length > 0 ? options.details : ["*"];
+  const pendingAsk = [];
+  for (const detail of details) {
+    if (grants.has(grantKeyForCall(toolId, detail))) {
+      continue;
+    }
+    const decision = resolvePermission(permission, toolId, detail);
+    if (decision === "deny") {
+      return "deny";
+    }
+    if (decision === "ask") {
+      pendingAsk.push(detail);
+    }
   }
-  const decision = whenMissingToolConfig !== void 0 && permission[toolId] === void 0 ? whenMissingToolConfig : resolvePermission(permission, toolId, detail);
-  if (decision === "allow") {
+  if (pendingAsk.length === 0) {
     return "allow";
   }
-  if (decision === "deny") {
-    return "deny";
-  }
   if (requestPermission === void 0) {
     return "deny";
   }
+  const combined = details.join(" \u2192 ");
   const reply = await requestPermission({
     toolId,
-    detail,
-    summary: permissionAskSummary(toolId, detail)
-  });
+    detail: combined,
+    summary: permissionAskSummary(toolId, combined)
+  }, options.signal);
   if (reply === "allow") {
-    grants.add(key);
+    for (const detail of pendingAsk) {
+      grants.add(grantKeyForCall(toolId, detail));
+    }
     return "allow";
   }
   return "deny";
 };
 
+// packages/tools/dist/wrap-builtin-tool-handles.js
+var wrapBuiltinToolHandles = (harness, permission) => {
+  const filtered = harness.listBuiltinRegistrations().filter((reg) => !isToolAlwaysDenied(permission, reg.toolId));
+  return filtered.map((reg) => ({
+    toolId: reg.toolId,
+    name: reg.name,
+    description: reg.description,
+    inputSchema: reg.inputSchema,
+    invoke: async (args, toolCtx) => {
+      const hostCtx = toolCtx;
+      const result = await harness.invoke({
+        toolId: reg.toolId,
+        args,
+        ...hostCtx?.signal !== void 0 ? { signal: hostCtx.signal } : {}
+      });
+      if (!result.ok) {
+        throw new Error(result.text);
+      }
+      return result.text;
+    }
+  }));
+};
+
 // packages/tools/dist/create-project-harness.js
 var createProjectHarness = (options) => {
   const ctx = {
@@ -1453,19 +1707,24 @@ var createProjectHarness = (options) => {
     ...options.permission ?? {}
   };
   const grants = /* @__PURE__ */ new Set();
-  const gate = (toolId, detail) => gateToolCall({
+  const deniedDetail = (toolId, details) => {
+    const denied = details.find((detail) => resolvePermission(permission, toolId, detail) === "deny");
+    return denied ?? details.join(" \u2192 ");
+  };
+  const gate = (toolId, details, signal) => gateToolCall({
     toolId,
-    detail,
+    details,
     grants,
     permission,
-    ...options.requestPermission !== void 0 ? { requestPermission: options.requestPermission } : {}
+    ...options.requestPermission !== void 0 ? { requestPermission: options.requestPermission } : {},
+    ...signal !== void 0 ? { signal } : {}
   });
   return {
     listBuiltinRegistrations: () => BUILTIN_REGISTRATIONS,
     authorize: async (call) => {
       const toolId = call.toolId.trim();
-      const detail = permissionDetailForCall(toolId, call.args);
-      return gate(toolId, detail);
+      const details = permissionDetailsForCall(toolId, call.args);
+      return gate(toolId, details, call.signal);
     },
     invoke: async (call) => {
       const toolId = call.toolId.trim();
@@ -1475,10 +1734,10 @@ var createProjectHarness = (options) => {
           text: `Unknown builtin tool \xAB${call.toolId}\xBB. Available: ${BUILTIN_TOOL_IDS.join(", ")}. Domain/custom tools must expose registration.handler (import from @langflower/tools), not harness toolId lookup.`
         };
       }
-      const detail = permissionDetailForCall(toolId, call.args);
-      const access = await gate(toolId, detail);
+      const details = permissionDetailsForCall(toolId, call.args);
+      const access = await gate(toolId, details, call.signal);
       if (access === "deny") {
-        return deniedToolResult(toolId, detail);
+        return deniedToolResult(toolId, deniedDetail(toolId, details));
       }
       try {
         const invokeCtx = call.signal === void 0 ? ctx : { ...ctx, signal: call.signal };
@@ -1494,12 +1753,12 @@ var createProjectHarness = (options) => {
 
 export {
   DEFAULT_PERMISSION_CONFIG,
-  isToolAlwaysDenied,
   mergeProjectAndNodePermissions,
   formatPermissionDeniedText,
   resolveProjectPath,
   formatNotFound,
   walkFiles,
   isBuiltinToolId,
+  wrapBuiltinToolHandles,
   createProjectHarness
 };