rivet-design 0.9.2 → 0.9.4

package/dist/mcp/agent-variants/previewQa.js

@@ -0,0 +1,374 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ASSET_PROBER = exports.DEFAULT_RUNTIME_QA_RUNNER = void 0;
+exports.runPreviewQa = runPreviewQa;
+exports.extractExternalAssetUrls = extractExternalAssetUrls;
+const dns_1 = __importDefault(require("dns"));
+const http_1 = __importDefault(require("http"));
+const https_1 = __importDefault(require("https"));
+const inspirationDesignContext_1 = require("./inspirationDesignContext");
+/**
+ * Preview QA — objective post-generation health checks for static-preview
+ * variants. The orchestrator runs this before accepting a `static_preview`
+ * succeeded report so a variant cannot enter `ready` while its referenced
+ * assets 404 or its runtime throws.
+ *
+ * The runner has two layers:
+ *
+ *   1. A pure static check that extracts external asset URLs from the
+ *      generated HTML and fetches each one with a small timeout. This
+ *      catches the most common failure mode (broken CDN URLs, missing
+ *      `.glb` model assets) without needing a browser.
+ *
+ *   2. An injectable runtime check that can be wired to Playwright later
+ *      to capture `pageerror` / `console.error` events. Tests stub this
+ *      layer; production uses `DEFAULT_RUNTIME_QA_RUNNER` which is a
+ *      no-op so the gate falls back to the static layer when no real
+ *      runner is available.
+ */
+const DEFAULT_ASSET_TIMEOUT_MS = 4_000;
+/**
+ * No-op runtime QA runner used when no real (e.g. Playwright-based)
+ * runner is injected. Returns an empty issue list so the gate decision
+ * is driven entirely by the static asset layer.
+ */
+const DEFAULT_RUNTIME_QA_RUNNER = async () => [];
+exports.DEFAULT_RUNTIME_QA_RUNNER = DEFAULT_RUNTIME_QA_RUNNER;
+const MAX_REDIRECTS = 5;
+/**
+ * Resolves a hostname to public addresses and returns the address that the
+ * subsequent HTTP request must use for its own lookup.
+ *
+ * @effect Performs a DNS lookup via dns.promises.lookup
+ */
+const resolvePinnedAddress = async (hostname) => {
+    if ((0, inspirationDesignContext_1.isLocalLiteralHostname)(hostname)) {
+        return {
+            kind: 'blocked',
+            message: `Host '${hostname}' resolves to a protected target.`,
+        };
+    }
+    let addresses;
+    try {
+        addresses = await dns_1.default.promises.lookup(hostname, { all: true });
+    }
+    catch {
+        return {
+            kind: 'blocked',
+            message: `Host '${hostname}' could not be resolved safely.`,
+        };
+    }
+    const protectedAddress = addresses.find(({ address }) => (0, inspirationDesignContext_1.isLocalLiteralHostname)(address));
+    if (protectedAddress) {
+        return {
+            kind: 'blocked',
+            message: `Host '${hostname}' resolves to a protected target.`,
+        };
+    }
+    const address = addresses[0];
+    if (!address) {
+        return {
+            kind: 'blocked',
+            message: `Host '${hostname}' did not resolve to an address.`,
+        };
+    }
+    return {
+        kind: 'resolved',
+        address: {
+            address: address.address,
+            family: address.family === 6 ? 6 : 4,
+        },
+    };
+};
+const locationHeader = (headers) => {
+    const value = headers.location;
+    return Array.isArray(value) ? value[0] : value;
+};
+/**
+ * Issues one HTTP request while pinning Node's lookup callback to the address
+ * produced by the SSRF guard.
+ *
+ * @effect Performs a network request to the validated asset URL
+ */
+const requestAsset = async (input) => {
+    const parsed = new URL(input.url);
+    const pinned = await resolvePinnedAddress(parsed.hostname);
+    if (pinned.kind === 'blocked') {
+        return { kind: 'blocked', status: 0, message: pinned.message };
+    }
+    const lookup = (_hostname, _options, callback) => {
+        callback(null, pinned.address.address, pinned.address.family);
+    };
+    const transport = parsed.protocol === 'https:' ? https_1.default : http_1.default;
+    return new Promise((resolve, reject) => {
+        const request = transport.request({
+            protocol: parsed.protocol,
+            hostname: parsed.hostname,
+            port: parsed.port || undefined,
+            path: `${parsed.pathname}${parsed.search}`,
+            method: input.method,
+            headers: input.headers,
+            lookup,
+            signal: input.signal,
+        }, (response) => {
+            response.resume();
+            resolve({
+                kind: 'response',
+                response: {
+                    status: response.statusCode ?? 0,
+                    headers: response.headers,
+                },
+            });
+        });
+        request.on('error', reject);
+        request.end();
+    });
+};
+const DEFAULT_ASSET_PROBER = async (url, timeoutMs) => {
+    // SSRF guard: agent-supplied HTML can carry URLs pointing at localhost,
+    // RFC1918, link-local, or cloud-metadata hosts. Validate scheme +
+    // local-literal targets before issuing a network request, pin DNS for the
+    // request itself, and re-check after redirects.
+    const validation = (0, inspirationDesignContext_1.validateInspirationUrl)(url);
+    if (!validation.ok) {
+        return { ok: false, status: 0, message: validation.reason };
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const requestWithGuardedRedirects = async (initialUrl, init) => {
+        let currentUrl = initialUrl;
+        for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
+            const currentValidation = (0, inspirationDesignContext_1.validateInspirationUrl)(currentUrl);
+            if (!currentValidation.ok) {
+                return {
+                    kind: 'blocked',
+                    status: 0,
+                    message: currentValidation.reason,
+                };
+            }
+            const result = await requestAsset({
+                url: currentValidation.normalized,
+                method: init.method,
+                headers: init.headers,
+                signal: controller.signal,
+            });
+            if (result.kind === 'blocked')
+                return result;
+            const response = result.response;
+            const isRedirect = response.status >= 300 && response.status < 400;
+            const location = locationHeader(response.headers);
+            if (!isRedirect || !location) {
+                return { kind: 'response', response };
+            }
+            if (hop === MAX_REDIRECTS) {
+                return {
+                    kind: 'blocked',
+                    status: 0,
+                    message: `Exceeded ${MAX_REDIRECTS} redirects probing asset.`,
+                };
+            }
+            // Resolve relative redirects against the URL we just hit.
+            let nextUrl;
+            try {
+                nextUrl = new URL(location, currentUrl);
+            }
+            catch {
+                return {
+                    kind: 'blocked',
+                    status: 0,
+                    message: `Malformed redirect Location '${location}'.`,
+                };
+            }
+            currentUrl = nextUrl.toString();
+        }
+        return {
+            kind: 'blocked',
+            status: 0,
+            message: 'Redirect handling exhausted unexpectedly.',
+        };
+    };
+    try {
+        let result = await requestWithGuardedRedirects(validation.normalized, {
+            method: 'HEAD',
+        });
+        if (result.kind === 'blocked') {
+            return { ok: false, status: result.status, message: result.message };
+        }
+        let response = result.response;
+        // Some CDNs reject HEAD with 405 — fall back to a ranged GET.
+        if (response.status === 405 || response.status === 501) {
+            result = await requestWithGuardedRedirects(validation.normalized, {
+                method: 'GET',
+                headers: { Range: 'bytes=0-0' },
+            });
+            if (result.kind === 'blocked') {
+                return { ok: false, status: result.status, message: result.message };
+            }
+            response = result.response;
+        }
+        return {
+            ok: response.status >= 200 && response.status < 300,
+            status: response.status,
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, status: 0, message };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+};
+exports.DEFAULT_ASSET_PROBER = DEFAULT_ASSET_PROBER;
+/**
+ * Run preview QA against a generated static-preview HTML document. The
+ * static layer extracts external asset URLs and probes each one; the
+ * injectable runtime layer adds console/runtime checks. Returns a single
+ * `VariantQaResult` with the combined verdict.
+ */
+async function runPreviewQa(input) {
+    const html = input.html;
+    if (typeof html !== 'string' || html.trim().length === 0) {
+        return {
+            status: 'failed',
+            issues: [
+                {
+                    kind: 'preview_unavailable',
+                    detail: input.options?.source ?? 'inline',
+                    message: 'Preview HTML was empty',
+                },
+            ],
+            summary: 'Preview unavailable: generated HTML was empty.',
+            checkedSource: input.options?.source,
+        };
+    }
+    const assetProber = input.options?.assetProber ?? exports.DEFAULT_ASSET_PROBER;
+    const runtimeRunner = input.options?.runtimeQaRunner ?? exports.DEFAULT_RUNTIME_QA_RUNNER;
+    const assetTimeoutMs = input.options?.assetTimeoutMs ?? DEFAULT_ASSET_TIMEOUT_MS;
+    const source = input.options?.source;
+    const issues = [];
+    const assetUrls = extractExternalAssetUrls(html);
+    await Promise.all(assetUrls.map(async (url) => {
+        const result = await assetProber(url, assetTimeoutMs);
+        if (!result.ok) {
+            issues.push({
+                kind: 'asset_load_failed',
+                detail: url,
+                message: result.status > 0
+                    ? `HTTP ${result.status}`
+                    : result.message ?? 'Network error',
+            });
+        }
+    }));
+    try {
+        const runtimeIssues = await runtimeRunner({ html, source: source ?? 'inline' });
+        for (const issue of runtimeIssues) {
+            issues.push(issue);
+        }
+    }
+    catch (err) {
+        issues.push({
+            kind: 'console_error',
+            detail: 'runtime_qa_runner',
+            message: err instanceof Error ? err.message : String(err),
+        });
+    }
+    // External-asset probe failures don't block — the user's browser fetches
+    // these directly when viewing the preview, so a server-side reachability
+    // failure (e.g. IPv6/SSRF-guard edge cases on fonts.googleapis.com) doesn't
+    // predict whether the iframe will render. Keep them in `issues` for
+    // visibility, but only console/runtime errors and missing previews actually
+    // fail QA.
+    const blockingIssues = issues.filter((issue) => issue.kind !== 'asset_load_failed');
+    if (blockingIssues.length === 0) {
+        const assetIssueCount = issues.length;
+        return {
+            status: 'passed',
+            issues,
+            summary: assetIssueCount === 0
+                ? 'Preview QA passed — assets reachable, no runtime errors.'
+                : `Preview QA passed — ${assetIssueCount} external asset${assetIssueCount === 1 ? '' : 's'} unreachable from server (browser will fetch independently).`,
+            checkedSource: source,
+        };
+    }
+    return {
+        status: 'failed',
+        issues,
+        summary: buildIssueSummary(issues),
+        checkedSource: source,
+    };
+}
+const buildIssueSummary = (issues) => {
+    const counts = {
+        asset_load_failed: 0,
+        console_error: 0,
+        preview_unavailable: 0,
+    };
+    for (const issue of issues) {
+        counts[issue.kind] += 1;
+    }
+    const fragments = [];
+    if (counts.asset_load_failed > 0) {
+        const first = issues.find((i) => i.kind === 'asset_load_failed');
+        fragments.push(counts.asset_load_failed === 1
+            ? `asset failed to load (${first?.detail ?? 'unknown'})`
+            : `${counts.asset_load_failed} assets failed to load`);
+    }
+    if (counts.console_error > 0) {
+        fragments.push(counts.console_error === 1
+            ? '1 console/runtime error detected'
+            : `${counts.console_error} console/runtime errors detected`);
+    }
+    if (counts.preview_unavailable > 0) {
+        fragments.push('preview unavailable');
+    }
+    return `Preview QA failed: ${fragments.join('; ')}.`;
+};
+/**
+ * Extract external asset URLs from a generated HTML document. Pulls from
+ * the common attributes (`src`, `href`, `poster`, `data-*` images) and
+ * inline CSS `url(...)` references. Keeps only http(s) URLs — relative
+ * paths and inline data URIs can't fail the QA gate because they don't
+ * touch the network.
+ */
+function extractExternalAssetUrls(html) {
+    const seen = new Set();
+    const push = (raw) => {
+        if (!raw)
+            return;
+        const trimmed = raw.trim();
+        if (!trimmed)
+            return;
+        if (!/^https?:\/\//i.test(trimmed))
+            return;
+        seen.add(trimmed);
+    };
+    const attributeRegex = /\b(?:src|href|poster|data-src|data-href|data-image|model-src)\s*=\s*("|')([^"']+)\1/gi;
+    let attrMatch;
+    while ((attrMatch = attributeRegex.exec(html))) {
+        push(attrMatch[2]);
+    }
+    // <link rel="stylesheet" href="..."> is already covered above; capture
+    // <img srcset> entries here. srcset is a comma list of "url descriptor".
+    const srcsetRegex = /\bsrcset\s*=\s*("|')([^"']+)\1/gi;
+    let srcsetMatch;
+    while ((srcsetMatch = srcsetRegex.exec(html))) {
+        const list = srcsetMatch[2];
+        for (const entry of list.split(',')) {
+            const url = entry.trim().split(/\s+/)[0];
+            push(url);
+        }
+    }
+    // Inline CSS `url(...)` references (background-image, etc.). Strip
+    // surrounding quotes if present.
+    const cssUrlRegex = /url\(\s*("|'|)([^"')]+)\1\s*\)/gi;
+    let cssMatch;
+    while ((cssMatch = cssUrlRegex.exec(html))) {
+        push(cssMatch[2]);
+    }
+    return [...seen];
+}
+//# sourceMappingURL=previewQa.js.map

package/dist/mcp/agent-variants/previewQa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"previewQa.js","sourceRoot":"","sources":["../../../src/mcp/agent-variants/previewQa.ts"],"names":[],"mappings":";;;;;;AA2TA,oCAuFC;AAwCD,4DAqCC;AA/dD,8CAAsB;AACtB,gDAAwB;AACxB,kDAA0B;AAO1B,yEAGoC;AAEpC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAmBvC;;;;GAIG;AACI,MAAM,yBAAyB,GAAoB,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;AAA5D,QAAA,yBAAyB,6BAAmC;AAsBzE,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,KAAK,EAChC,QAAgB,EAIhB,EAAE;IACF,IAAI,IAAA,iDAAsB,EAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,SAAS,QAAQ,mCAAmC;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,SAA8B,CAAC;IACnC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,aAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,SAAS,QAAQ,iCAAiC;SAC5D,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtD,IAAA,iDAAsB,EAAC,OAAO,CAAC,CAChC,CAAC;IACF,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,SAAS,QAAQ,mCAAmC;SAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,SAAS,QAAQ,kCAAkC;SAC7D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACrC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAiC,EAAsB,EAAE;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,KAAK,EAAE,KAK3B,EAGC,EAAE;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAK,CAAC,CAAC,CAAC,cAAI,CAAC;IAE9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAC/B;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YAC9B,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,EACD,CAAC,QAAQ,EAAE,EAAE;YACX,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE;oBACR,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,CAAC;oBAChC,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAgB,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;IACxE,wEAAwE;IACxE,kEAAkE;IAClE,0EAA0E;IAC1E,gDAAgD;IAChD,MAAM,UAAU,GAAG,IAAA,iDAAsB,EAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,MAAM,2BAA2B,GAAG,KAAK,EACvC,UAAkB,EAClB,IAAkE,EAIlE,EAAE;QACF,IAAI,UAAU,GAAG,UAAU,CAAC;QAC5B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,iBAAiB,GAAG,IAAA,iDAAsB,EAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC;gBAC1B,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,iBAAiB,CAAC,MAAM;iBAClC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,GAAG,EAAE,iBAAiB,CAAC,UAAU;gBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;YACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;YACD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC1B,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,YAAY,aAAa,2BAA2B;iBAC9D,CAAC;YACJ,CAAC;YACD,0DAA0D;YAC1D,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,CAAC;oBACT,OAAO,EAAE,gCAAgC,QAAQ,IAAI;iBACtD,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,2CAA2C;SACrD,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,MAAM,GAAG,MAAM,2BAA2B,CAAC,UAAU,CAAC,UAAU,EAAE;YACpE,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/B,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,GAAG,MAAM,2BAA2B,CAAC,UAAU,CAAC,UAAU,EAAE;gBAChE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;aAChC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACvE,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAnGW,QAAA,oBAAoB,wBAmG/B;AAkBF;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,KAAqB;IAErB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,QAAQ;oBACzC,OAAO,EAAE,wBAAwB;iBAClC;aACF;YACD,OAAO,EAAE,gDAAgD;YACzD,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM;SACrC,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,WAAW,IAAI,4BAAoB,CAAC;IACvE,MAAM,aAAa,GACjB,KAAK,CAAC,OAAO,EAAE,eAAe,IAAI,iCAAyB,CAAC;IAC9D,MAAM,cAAc,GAClB,KAAK,CAAC,OAAO,EAAE,cAAc,IAAI,wBAAwB,CAAC;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;IAErC,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,GAAG;gBACX,OAAO,EACL,MAAM,CAAC,MAAM,GAAG,CAAC;oBACf,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACzB,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,eAAe;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAChF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,oEAAoE;IACpE,4EAA4E;IAC5E,WAAW;IACX,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAC9C,CAAC;IAEF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,OAAO,EACL,eAAe,KAAK,CAAC;gBACnB,CAAC,CAAC,0DAA0D;gBAC5D,CAAC,CAAC,uBAAuB,eAAe,kBAAkB,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,8DAA8D;YAC5J,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,MAAM;QACN,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC;QAClC,aAAa,EAAE,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAU,EAAE;IAC7D,MAAM,MAAM,GAAuC;QACjD,iBAAiB,EAAE,CAAC;QACpB,aAAa,EAAE,CAAC;QAChB,mBAAmB,EAAE,CAAC;KACvB,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;QACjE,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,iBAAiB,KAAK,CAAC;YAC5B,CAAC,CAAC,yBAAyB,KAAK,EAAE,MAAM,IAAI,SAAS,GAAG;YACxD,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,wBAAwB,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAC7B,SAAS,CAAC,IAAI,CACZ,MAAM,CAAC,aAAa,KAAK,CAAC;YACxB,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,kCAAkC,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACnC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,sBAAsB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvD,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,IAAY;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAuB,EAAE,EAAE;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,uFAAuF,CAAC;IAC/G,IAAI,SAAiC,CAAC;IACtC,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,WAAW,GAAG,kCAAkC,CAAC;IACvD,IAAI,WAAmC,CAAC;IACxC,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,iCAAiC;IACjC,MAAM,WAAW,GAAG,kCAAkC,CAAC;IACvD,IAAI,QAAgC,CAAC;IACrC,OAAO,CAAC,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC"}

package/dist/mcp/agent-variants/sourceContext.d.ts

@@ -0,0 +1,8 @@
+import { type SourceArtifactInput, type SourceContextArtifact, type SourceContextInput } from './contracts';
+export declare const normalizeUrl: (rawUrl: string) => string | null;
+export declare const extractPromptUrls: (prompt: string) => string[];
+export declare const resolveSourceUrls: (prompt: string, sourceContext?: SourceContextInput) => string[];
+export declare const normalizeSourceArtifacts: (sourceArtifacts: SourceArtifactInput[] | undefined) => SourceArtifactInput[];
+export declare const normalizeSourceContextArtifact: (artifact: SourceContextArtifact) => SourceContextArtifact;
+export declare const buildSourceContextMarkdown: (artifact: SourceContextArtifact) => string;
+//# sourceMappingURL=sourceContext.d.ts.map

package/dist/mcp/agent-variants/sourceContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceContext.d.ts","sourceRoot":"","sources":["../../../src/mcp/agent-variants/sourceContext.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,aAAa,CAAC;AAkCrB,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,IA4BtD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,KAAG,MAAM,EAYxD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,MAAM,EACd,gBAAgB,kBAAkB,KACjC,MAAM,EAYR,CAAC;AAEF,eAAO,MAAM,wBAAwB,GACnC,iBAAiB,mBAAmB,EAAE,GAAG,SAAS,KACjD,mBAAmB,EAOrB,CAAC;AAEF,eAAO,MAAM,8BAA8B,GACzC,UAAU,qBAAqB,KAC9B,qBAsCF,CAAC;AAaF,eAAO,MAAM,0BAA0B,GACrC,UAAU,qBAAqB,KAC9B,MA0CF,CAAC"}

package/dist/mcp/agent-variants/sourceContext.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSourceContextMarkdown = exports.normalizeSourceContextArtifact = exports.normalizeSourceArtifacts = exports.resolveSourceUrls = exports.extractPromptUrls = exports.normalizeUrl = void 0;
+const errors_1 = require("./errors");
+// NOTE: This creates an ES module cycle with inspirationDesignContext (which
+// imports `extractPromptUrls` from here). The cycle is safe because
+// `isLocalLiteralHostname` is only invoked from inside `normalizeUrl`'s
+// function body, not at module-eval time. Without this guard,
+// `resolveSourceUrls` would happily pass `http://169.254.169.254/...` or
+// `http://localhost:.../` URLs from prompts / `sourceContext.sourceUrls`
+// straight into the `source_plan` work item, where the agent's browser
+// extraction step would dial them — bypassing the SSRF guard that already
+// covers the server-side inspiration fetcher.
+const inspirationDesignContext_1 = require("./inspirationDesignContext");
+const MAX_PROMPT_URLS = 6;
+const MAX_SOURCE_URLS = 24;
+const MAX_ARTIFACTS = 24;
+const MAX_ARTIFACT_CONTENT_LENGTH = 8_000;
+const MAX_FIELD_LENGTH = 400;
+const MAX_TOTAL_MARKDOWN_LENGTH = 60_000;
+const TRAILING_URL_PUNCTUATION = /[),.;:!?]+$/;
+const EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+const PHONE_PATTERN = /\b(?:\+?\d{1,3}[ -]?)?(?:\(?\d{2,4}\)?[ -]?)?\d{3,4}[ -]?\d{4}\b/g;
+const TOKEN_PATTERN = /\b(?:api[_-]?key|token|secret|password)\s*[:=]\s*[^\s,;]+/gi;
+const sanitizeText = (value, maxLength) => {
+    const redacted = value
+        .replace(EMAIL_PATTERN, '[redacted-email]')
+        .replace(PHONE_PATTERN, '[redacted-phone]')
+        .replace(TOKEN_PATTERN, '[redacted-secret]');
+    return redacted.replace(/\s+/g, ' ').trim().slice(0, maxLength);
+};
+const normalizeUrl = (rawUrl) => {
+    const trimmed = rawUrl.trim().replace(TRAILING_URL_PUNCTUATION, '');
+    if (!trimmed)
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(trimmed);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return null;
+    }
+    // SSRF gate: reject literal localhost / loopback / link-local /
+    // RFC1918 / cloud-metadata hosts here, before the URL is handed to
+    // `source_plan` and the agent's browser extraction step. The
+    // server-side inspiration fetcher applies the same check (plus a
+    // resolved-DNS check) — without this, prompt-injected URLs like
+    // `http://169.254.169.254/...` or `http://localhost:.../` would
+    // sneak through `resolveSourceUrls` and drive the agent at internal
+    // services. The DNS-resolved layer is intentionally not run here
+    // because `normalizeUrl` must stay sync; the literal check covers
+    // every cheap-to-stuff target without needing IO.
+    const hostname = parsed.hostname.toLowerCase();
+    if (!hostname || (0, inspirationDesignContext_1.isLocalLiteralHostname)(hostname)) {
+        return null;
+    }
+    parsed.hash = '';
+    return parsed.toString();
+};
+exports.normalizeUrl = normalizeUrl;
+const extractPromptUrls = (prompt) => {
+    const matches = prompt.match(/\bhttps?:\/\/[^\s)]+/g) ?? [];
+    const deduped = [];
+    const seen = new Set();
+    for (const raw of matches) {
+        const normalized = (0, exports.normalizeUrl)(raw);
+        if (!normalized || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        deduped.push(normalized);
+        if (deduped.length >= MAX_PROMPT_URLS)
+            break;
+    }
+    return deduped;
+};
+exports.extractPromptUrls = extractPromptUrls;
+const resolveSourceUrls = (prompt, sourceContext) => {
+    const merged = [...(0, exports.extractPromptUrls)(prompt), ...(sourceContext?.sourceUrls ?? [])];
+    const deduped = [];
+    const seen = new Set();
+    for (const candidate of merged) {
+        const normalized = (0, exports.normalizeUrl)(candidate);
+        if (!normalized || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        deduped.push(normalized);
+        if (deduped.length >= MAX_SOURCE_URLS)
+            break;
+    }
+    return deduped;
+};
+exports.resolveSourceUrls = resolveSourceUrls;
+const normalizeSourceArtifacts = (sourceArtifacts) => {
+    if (!sourceArtifacts || sourceArtifacts.length === 0)
+        return [];
+    return sourceArtifacts.slice(0, MAX_ARTIFACTS).map((artifact) => ({
+        kind: artifact.kind,
+        label: sanitizeText(artifact.label, 80),
+        content: sanitizeText(artifact.content, MAX_ARTIFACT_CONTENT_LENGTH),
+    }));
+};
+exports.normalizeSourceArtifacts = normalizeSourceArtifacts;
+const normalizeSourceContextArtifact = (artifact) => {
+    const normalizeList = (items) => items.map((item) => sanitizeText(item, MAX_FIELD_LENGTH)).filter(Boolean);
+    const normalized = {
+        sourceFindings: normalizeList(artifact.sourceFindings),
+        sectionInventory: normalizeList(artifact.sectionInventory),
+        visualObservations: normalizeList(artifact.visualObservations),
+        sourceRoles: artifact.sourceRoles.map((entry) => ({
+            url: sanitizeText(entry.url, 2_048),
+            role: entry.role,
+            ...(entry.rationale
+                ? { rationale: sanitizeText(entry.rationale, MAX_FIELD_LENGTH) }
+                : {}),
+        })),
+        qualityBar: normalizeList(artifact.qualityBar),
+        ...(artifact.screenshotReferences
+            ? {
+                screenshotReferences: normalizeList(artifact.screenshotReferences).slice(0, 16),
+            }
+            : {}),
+        ...(artifact.risks
+            ? { risks: normalizeList(artifact.risks).slice(0, 24) }
+            : {}),
+    };
+    const estimatedSize = JSON.stringify(normalized).length;
+    if (estimatedSize > MAX_TOTAL_MARKDOWN_LENGTH) {
+        throw new errors_1.AgentVariantsError('SOURCE_CONTEXT_TOO_LARGE', `Source context exceeds size limit (${estimatedSize} > ${MAX_TOTAL_MARKDOWN_LENGTH})`);
+    }
+    return normalized;
+};
+exports.normalizeSourceContextArtifact = normalizeSourceContextArtifact;
+const redactUrlForDisplay = (url) => {
+    try {
+        const parsed = new URL(url);
+        parsed.search = '';
+        parsed.hash = '';
+        return parsed.toString();
+    }
+    catch {
+        return url;
+    }
+};
+const buildSourceContextMarkdown = (artifact) => {
+    const lines = [
+        '# SOURCE_CONTEXT',
+        '',
+        '## Source Findings',
+        ...artifact.sourceFindings.map((item) => `- ${item}`),
+        '',
+        '## Section Inventory',
+        ...artifact.sectionInventory.map((item) => `- ${item}`),
+        '',
+        '## Visual Observations',
+        ...artifact.visualObservations.map((item) => `- ${item}`),
+        '',
+        '## Source Roles',
+        ...artifact.sourceRoles.map((entry) => entry.rationale
+            ? `- ${entry.role}: ${redactUrlForDisplay(entry.url)} (${entry.rationale})`
+            : `- ${entry.role}: ${redactUrlForDisplay(entry.url)}`),
+        '',
+        '## Quality Bar',
+        ...artifact.qualityBar.map((item) => `- ${item}`),
+    ];
+    if (artifact.screenshotReferences && artifact.screenshotReferences.length > 0) {
+        lines.push('', '## Screenshot References');
+        lines.push(...artifact.screenshotReferences.map((item) => `- ${item}`));
+    }
+    if (artifact.risks && artifact.risks.length > 0) {
+        lines.push('', '## Risks');
+        lines.push(...artifact.risks.map((item) => `- ${item}`));
+    }
+    const markdown = lines.join('\n').trim();
+    if (markdown.length > MAX_TOTAL_MARKDOWN_LENGTH) {
+        throw new errors_1.AgentVariantsError('SOURCE_CONTEXT_TOO_LARGE', `SOURCE_CONTEXT.md exceeds size limit (${markdown.length} > ${MAX_TOTAL_MARKDOWN_LENGTH})`);
+    }
+    return `${markdown}\n`;
+};
+exports.buildSourceContextMarkdown = buildSourceContextMarkdown;
+//# sourceMappingURL=sourceContext.js.map

package/dist/mcp/agent-variants/sourceContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceContext.js","sourceRoot":"","sources":["../../../src/mcp/agent-variants/sourceContext.ts"],"names":[],"mappings":";;;AAKA,qCAA8C;AAC9C,6EAA6E;AAC7E,oEAAoE;AACpE,wEAAwE;AACxE,8DAA8D;AAC9D,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,0EAA0E;AAC1E,8CAA8C;AAC9C,yEAAoE;AAEpE,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAC/C,MAAM,aAAa,GAAG,6CAA6C,CAAC;AACpE,MAAM,aAAa,GACjB,mEAAmE,CAAC;AACtE,MAAM,aAAa,GAAG,6DAA6D,CAAC;AAEpF,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE;IAChE,MAAM,QAAQ,GAAG,KAAK;SACnB,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC;SAC1C,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC;SAC1C,OAAO,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC,CAAC;AAEK,MAAM,YAAY,GAAG,CAAC,MAAc,EAAiB,EAAE;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gEAAgE;IAChE,mEAAmE;IACnE,6DAA6D;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,gEAAgE;IAChE,oEAAoE;IACpE,iEAAiE;IACjE,kEAAkE;IAClE,kDAAkD;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ,IAAI,IAAA,iDAAsB,EAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC,CAAC;AA5BW,QAAA,YAAY,gBA4BvB;AAEK,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAY,EAAE;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAA,oBAAY,EAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,eAAe;YAAE,MAAM;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAZW,QAAA,iBAAiB,qBAY5B;AAEK,MAAM,iBAAiB,GAAG,CAC/B,MAAc,EACd,aAAkC,EACxB,EAAE;IACZ,MAAM,MAAM,GAAG,CAAC,GAAG,IAAA,yBAAiB,EAAC,MAAM,CAAC,EAAE,GAAG,CAAC,aAAa,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAA,oBAAY,EAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,eAAe;YAAE,MAAM;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAfW,QAAA,iBAAiB,qBAe5B;AAEK,MAAM,wBAAwB,GAAG,CACtC,eAAkD,EAC3B,EAAE;IACzB,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACvC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;KACrE,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AATW,QAAA,wBAAwB,4BASnC;AAEK,MAAM,8BAA8B,GAAG,CAC5C,QAA+B,EACR,EAAE;IACzB,MAAM,aAAa,GAAG,CAAC,KAAe,EAAY,EAAE,CAClD,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5E,MAAM,UAAU,GAA0B;QACxC,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;QACtD,gBAAgB,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,kBAAkB,EAAE,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC9D,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChD,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,SAAS;gBACjB,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE;gBAChE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC,oBAAoB;YAC/B,CAAC,CAAC;gBACE,oBAAoB,EAAE,aAAa,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,KAAK,CACtE,CAAC,EACD,EAAE,CACH;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,KAAK;YAChB,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,aAAa,GAAG,yBAAyB,EAAE,CAAC;QAC9C,MAAM,IAAI,2BAAkB,CAC1B,0BAA0B,EAC1B,sCAAsC,aAAa,MAAM,yBAAyB,GAAG,CACtF,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAxCW,QAAA,8BAA8B,kCAwCzC;AAEF,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAU,EAAE;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC,CAAC;AAEK,MAAM,0BAA0B,GAAG,CACxC,QAA+B,EACvB,EAAE;IACV,MAAM,KAAK,GAAa;QACtB,kBAAkB;QAClB,EAAE;QACF,oBAAoB;QACpB,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,EAAE;QACF,sBAAsB;QACtB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,EAAE;QACF,wBAAwB;QACxB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACzD,EAAE;QACF,iBAAiB;QACjB,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACpC,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,SAAS,GAAG;YAC3E,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CACzD;QACD,EAAE;QACF,gBAAgB;QAChB,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;KAClD,CAAC;IAEF,IAAI,QAAQ,CAAC,oBAAoB,IAAI,QAAQ,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAChD,MAAM,IAAI,2BAAkB,CAC1B,0BAA0B,EAC1B,yCAAyC,QAAQ,CAAC,MAAM,MAAM,yBAAyB,GAAG,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,QAAQ,IAAI,CAAC;AACzB,CAAC,CAAC;AA5CW,QAAA,0BAA0B,8BA4CrC"}

package/dist/mcp/agent-variants/tools.d.ts

@@ -1,8 +1,44 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type VariantQaResult, type VisualEditorAttachment } from './contracts';
+import { slugifyPrompt } from './createZeroToOneTool';
+export { slugifyPrompt };
 import type { AgentVariantsOrchestrator } from './WorktreeOrchestrator';
+/**
+ * Coerce `output` to a structured value when an agent (incorrectly) sends a
+ * stringified JSON. The MCP schema accepts `z.unknown()` so the call doesn't
+ * fail validation, but downstream consumers (e.g. `output.html` in
+ * WorktreeOrchestrator) expect an object and silently no-op on strings —
+ * leaving the variant stuck at "not ready" until session expiry.
+ */
+export declare const normalizeAgentOutput: (output: unknown) => unknown;
 export interface ToolDeps {
     orchestrator: AgentVariantsOrchestrator;
     leaseOwner: () => string;
+    /**
+     * Zero-to-one only: ensure the Rivet visual editor is up on the future
+     * destination path so the iframe is ready when variants render. Wired
+     * from server.ts; same hook used by create_zero_to_one_project. When
+     * absent (e.g. unit tests), start_variants(mode='zero_to_one') skips
+     * the auto-open and the caller can open the editor themselves.
+     */
+    ensureVisualEditorOpen?: (input: {
+        projectPath: string;
+        framework: 'vite';
+    }) => Promise<VisualEditorAttachment>;
+    /** Test seam — defaults to os.homedir. */
+    homedir?: () => string;
+    telemetry?: unknown;
 }
 export declare function registerAgentVariantsTools(mcp: McpServer, deps: ToolDeps): void;
+/**
+ * User-facing prompt template for QA failures. Lists each failed variant
+ * with its summary + first asset/console issue, then asks the user
+ * whether to retry, continue with healthy variants, or cancel. Kept as
+ * data (not a log line) so the calling agent can present the choice
+ * directly to the human.
+ */
+export declare function buildQaFailurePrompt(failures: Array<{
+    label: string;
+    qa: VariantQaResult;
+}>, healthyCount: number): string;
 //# sourceMappingURL=tools.d.ts.map

package/dist/mcp/agent-variants/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/agent-variants/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA0BzE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAExE,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,yBAAyB,CAAC;IACxC,UAAU,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,QAAQ,GACb,IAAI,CAoON"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/mcp/agent-variants/tools.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAmCL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,CAAC;AAGzB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAGxE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,OAAO,KAAG,OAOtD,CAAC;AAmBF,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,yBAAyB,CAAC;IACxC,UAAU,EAAE,MAAM,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC/B,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAQD,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,QAAQ,GACb,IAAI,CAqYN;AA+GD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,eAAe,CAAA;CAAE,CAAC,EACvD,YAAY,EAAE,MAAM,GACnB,MAAM,CAwBR"}