samarthya-bot 2.2.1 → 2.3.1

package/backend/services/tools/toolRegistry.js

@@ -1,11 +1,14 @@
 const { TOOL_PACKS } = require('../../config/constants');
 const fs = require('fs').promises;
+const fsSync = require('fs');
 const path = require('path');
 const os = require('os');
 const { exec } = require('child_process');
 const nodemailer = require('nodemailer');
 const { Client } = require('ssh2');
 const workerClient = require('../worker/workerClient');
+const sandbox = require('../security/sandboxService');
+const platform = require('../system/platform');
 
 // ────────────────────────────────────────────────────────────
 // REAL Tool Definitions — No more simulations!
@@ -13,9 +16,68 @@ const workerClient = require('../worker/workerClient');
 
 /**
  * Security: Command Blacklist Map
- * Prevent the AI (or user injection) from autonomously executing critically destructive host/remote commands.
+ * Prevent the AI (or user injection) from autonomously executing critically
+ * destructive host/remote commands. Covers both *nix and Windows.
+ * NOTE: anchored to the start of each (trimmed) command SEGMENT — see
+ * assertCommandSafe(), which splits chained commands so that something like
+ * `echo hi && rm -rf /` cannot slip past the blacklist.
  */
-const BLOCKED_COMMANDS = /^(rm\s+-rf|rmdir|mkfs|dd|fdisk|shutdown|reboot|poweroff|halt|init|killall\s+-9|wget.*\.sh|curl.*\.sh|chmod\s+-R\s+777|chown\s+-R.*:.*\/)/im;
+const BLOCKED_COMMANDS = /^(sudo\s+)?(rm\s+-[a-z]*[rf]|rmdir|mkfs|dd\b|fdisk|shutdown|reboot|poweroff|halt|init\s+[06]|killall\s+-9|wget\s+.*\.sh|curl\s+.*\.sh|chmod\s+-R\s+777|chown\s+-R.*:.*\/|del\s+\/|rd\s+\/s|format\s+[a-z]:|diskpart|:\(\)\s*\{)/im;
+
+/**
+ * Split a raw command into individually-checkable segments so chained /
+ * piped / substituted commands are all validated, not just the first one.
+ */
+function splitCommandSegments(command) {
+    return String(command)
+        // Split on every shell separator/substitution: && || ; | & newline $( `
+        .split(/&&|\|\||[;\n\r&|]|\$\(|`/)
+        .map(s => s.trim())
+        .filter(Boolean);
+}
+
+/**
+ * Unified command safety gate. Returns { ok: boolean, reason?: string }.
+ * Runs every segment through the blacklist AND the workspace sandbox.
+ */
+function assertCommandSafe(command, { checkWorkspace = true } = {}) {
+    if (!command || typeof command !== 'string') {
+        return { ok: false, reason: '❌ No command provided.' };
+    }
+    for (const segment of splitCommandSegments(command)) {
+        if (BLOCKED_COMMANDS.test(segment)) {
+            return {
+                ok: false,
+                reason: `❌ Security Block: "${segment}" matches a restricted pattern (recursive delete, disk format, reboot, fork-bomb, remote shell download, etc.).`,
+            };
+        }
+    }
+    // Workspace + dangerous-pattern checks (fork bombs, /dev/sd*, etc.)
+    // Skipped for remote (SSH) targets, whose filesystem layout differs.
+    if (checkWorkspace) {
+        const sandboxCheck = sandbox.validateCommand(command);
+        if (!sandboxCheck.allowed) {
+            return { ok: false, reason: sandboxCheck.reason };
+        }
+    } else {
+        // Still apply the always-on dangerous-pattern guard for remote hosts.
+        for (const pattern of sandbox.blockedPatterns) {
+            if (pattern.test(command)) {
+                return { ok: false, reason: `🛡️ Safety Guard: remote command blocked — dangerous pattern detected.` };
+            }
+        }
+    }
+    return { ok: true };
+}
+
+/**
+ * Workspace path safety gate for file operations. Honours
+ * RESTRICT_TO_WORKSPACE (disabled => always allowed).
+ */
+function assertPathSafe(filePath) {
+    const check = sandbox.validatePath(filePath);
+    return { ok: check.allowed, reason: check.reason };
+}
 
 /**
  * Safe directory — tools can only operate within this sandbox
@@ -205,8 +267,12 @@ const toolDefinitions = {
                 // Normalize: LLM may use file_path, filename, file_name, etc.
                 const argPath = args.path || args.file_path || args.filename || args.file_name || args.file;
                 if (!argPath) return { success: false, result: '❌ Please provide a file path/name.' };
-                // No path restrictions for full OS access!
-                let filePath = argPath.startsWith('/') ? argPath : path.resolve(SAFE_DIR, argPath);
+                // Resolve absolute (cross-platform) vs. workspace-relative paths
+                let filePath = path.isAbsolute(argPath) ? path.resolve(argPath) : path.resolve(SAFE_DIR, argPath);
+
+                // Enforce workspace sandbox (no-op when RESTRICT_TO_WORKSPACE=false)
+                const guard = assertPathSafe(filePath);
+                if (!guard.ok) return { success: false, result: guard.reason };
 
                 const stat = await fs.stat(filePath);
                 if (stat.isDirectory()) {
@@ -264,8 +330,12 @@ const toolDefinitions = {
                 // Normalize: LLM may use file_path, filename, etc.
                 const argPath = args.path || args.file_path || args.filename || args.file_name || args.file;
                 if (!argPath) return { success: false, result: '❌ Please provide a file path/name.' };
-                // No path restrictions for full OS access!
-                let filePath = argPath.startsWith('/') ? argPath : path.resolve(SAFE_DIR, argPath);
+                // Resolve absolute (cross-platform) vs. workspace-relative paths
+                let filePath = path.isAbsolute(argPath) ? path.resolve(argPath) : path.resolve(SAFE_DIR, argPath);
+
+                // Enforce workspace sandbox (no-op when RESTRICT_TO_WORKSPACE=false)
+                const guard = assertPathSafe(filePath);
+                if (!guard.ok) return { success: false, result: guard.reason };
 
                 // Create subdirectories if needed
                 await fs.mkdir(path.dirname(filePath), { recursive: true });
@@ -297,7 +367,13 @@ const toolDefinitions = {
         execute: async (args, userContext) => {
             try {
                 const SAFE_DIR = await getSafeDir(userContext);
-                const targetDir = args.path ? (args.path.startsWith('/') ? args.path : path.resolve(SAFE_DIR, args.path)) : SAFE_DIR;
+                const targetDir = args.path
+                    ? (path.isAbsolute(args.path) ? path.resolve(args.path) : path.resolve(SAFE_DIR, args.path))
+                    : SAFE_DIR;
+
+                // Enforce workspace sandbox (no-op when RESTRICT_TO_WORKSPACE=false)
+                const guard = assertPathSafe(targetDir);
+                if (!guard.ok) return { success: false, result: guard.reason };
 
                 const files = await fs.readdir(targetDir, { withFileTypes: true });
                 if (files.length === 0) {
@@ -503,7 +579,7 @@ const toolDefinitions = {
     // ─────────── DEVOPS / STREAMING EXECUTION (Go Worker Integration) ───────────
     devops_execute_stream: {
         name: 'devops_execute_stream',
-        description: `Run long or complex shell commands (like npm install, git push, vercel deploy) and stream the output back. Required for any heavy DevOps/Auto-Coder tasks. Uses the ultra-fast Go micro-worker. Host OS: ${os.type()} ${os.release()}`,
+        description: `Run long or complex shell commands (like npm install, git push, vercel deploy) and stream the output back. Required for any heavy DevOps/Auto-Coder tasks. Uses the Go micro-worker when available, with an automatic native fallback on every OS. Host OS: ${platform.describe()}. Use commands valid for this OS.`,
         descriptionHi: 'लाइव शेल कमांड चलाएं',
         riskLevel: 'critical',
         category: 'system',
@@ -512,9 +588,8 @@ const toolDefinitions = {
             dir: { type: 'string', required: false, description: 'Working directory for the command' }
         },
         execute: async (args, userContext) => {
-            if (BLOCKED_COMMANDS.test(args.command)) {
-                return { success: false, result: `❌ Security Block: The command '${args.command}' contains patterns that are restricted (e.g., recursive deletes, system reboots, disk formats).` };
-            }
+            const safe = assertCommandSafe(args.command);
+            if (!safe.ok) return { success: false, result: safe.reason };
 
             return new Promise((resolve) => {
                 let liveLog = '';
@@ -549,20 +624,20 @@ const toolDefinitions = {
     // ─────────── LEGACY RUN COMMAND (Kept for instant small commands) ───────────
     run_command: {
         name: 'run_command',
-        description: `Run basic, instant shell commands natively. Host OS: ${os.type()} ${os.release()}. (Note: To open URLs/files, use 'start' for Windows, 'open' for macOS, 'xdg-open' for Linux).`,
+        description: `Run basic, instant shell commands natively. Host OS: ${platform.describe()}. IMPORTANT — use commands valid for this OS: on Windows use 'dir', 'type', 'copy'; on macOS/Linux use 'ls', 'cat', 'cp'. To open a URL/file/app prefer the 'open_path' tool (it auto-picks start/open/xdg-open).`,
         descriptionHi: 'शेल कमांड चलाएं',
         riskLevel: 'critical',
         category: 'system',
         parameters: {
-            command: { type: 'string', required: true, description: 'Shell command to execute' }
+            command: { type: 'string', required: true, description: 'Shell command to execute (must match the host OS)' }
         },
         execute: async (args, userContext) => {
-            if (BLOCKED_COMMANDS.test(args.command)) {
-                return { success: false, result: `❌ Security Block: The command '${args.command}' contains patterns that are restricted (e.g., recursive deletes, system reboots, disk formats).` };
-            }
+            const safe = assertCommandSafe(args.command);
+            if (!safe.ok) return { success: false, result: safe.reason };
 
+            const { shell } = platform.getShell();
             return new Promise((resolve) => {
-                exec(args.command, { timeout: 15000, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
+                exec(args.command, { timeout: 15000, maxBuffer: 1024 * 1024, shell, windowsHide: true }, (error, stdout, stderr) => {
                     if (error) {
                         resolve({
                             success: false,
@@ -594,9 +669,8 @@ const toolDefinitions = {
             command: { type: 'string', required: true, description: 'Command string to run on the remote VPS (e.g., "cd /var/www && git pull")' }
         },
         execute: async (args, userContext) => {
-            if (BLOCKED_COMMANDS.test(args.command)) {
-                return { success: false, result: `❌ Security Block: The command '${args.command}' contains patterns that are restricted on remote SSH systems.` };
-            }
+            const safe = assertCommandSafe(args.command, { checkWorkspace: false });
+            if (!safe.ok) return { success: false, result: safe.reason };
 
             return new Promise(async (resolve) => {
                 const conn = new Client();
@@ -845,29 +919,21 @@ const toolDefinitions = {
                 let log = `🌐 **Browser Automation Started:** ${args.url}\n`;
 
                 try {
-                    // Try to connect to existing local Chrome, fallback to a downloaded edge/chrome if needed.
-                    // For local system testing, we simulate launching a default visible chrome.
-                    let execPaths = [];
-                    if (os.platform() === 'win32') {
-                        execPaths = [
-                            'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
-                            'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'
-                        ];
-                    } else if (os.platform() === 'darwin') {
-                        execPaths = ['/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'];
-                    } else {
-                        execPaths = ['/usr/bin/google-chrome', '/usr/bin/chromium-browser'];
-                    }
-
-                    let validPath = execPaths.find(p => require('fs').existsSync(p));
+                    // Discover an installed Chromium-based browser across Windows/macOS/Linux.
+                    const validPath = platform.findBrowser();
                     if (!validPath) {
-                        return resolve({ success: false, result: `❌ Chrome/Edge executable not found for Puppeteer.` });
+                        return resolve({
+                            success: false,
+                            result: `❌ No Chrome/Edge/Brave/Chromium browser found for Puppeteer on this ${platform.OS} machine.\n\n💡 Install Google Chrome, or set CHROME_PATH in your .env to the browser executable path.`
+                        });
                     }
 
                     browser = await puppeteer.launch({
                         executablePath: validPath,
                         headless: false, // Make it visible to the user!
                         defaultViewport: null,
+                        // --no-sandbox is required on many Linux servers / containers.
+                        args: platform.isLinux ? ['--no-sandbox', '--disable-setuid-sandbox', '--start-maximized'] : ['--start-maximized'],
                     });
 
                     const page = await browser.newPage();
@@ -986,6 +1052,425 @@ const toolDefinitions = {
                 result: `🧪 **TASK SIMULATION MODE ACTIVE**\n\nI have analyzed the request: "${args.taskDecription}"\n\nIf executed, the following sequence would occur:\n1. 🔍 Validation step\n2. 📄 File operations (Safe mode preview)\n3. 📤 Network request (Dry run)\n\n_No actual system state was changed._`
             };
         }
+    },
+
+    // ─────────── OPEN PATH/URL/APP (Cross-platform: start | open | xdg-open) ───────────
+    open_path: {
+        name: 'open_path',
+        description: 'Open a URL, file, folder or application with the system default handler. Auto-selects the right command for the OS (Windows: start, macOS: open, Linux: xdg-open). Use this instead of guessing OS-specific open commands.',
+        descriptionHi: 'URL/फ़ाइल/ऐप खोलें',
+        riskLevel: 'medium',
+        category: 'system',
+        parameters: {
+            target: { type: 'string', required: true, description: 'A URL (https://...), an absolute file/folder path, or an application name' }
+        },
+        execute: async (args, userContext) => {
+            const target = String(args.target || args.url || args.path || args.app || '');
+            if (!target) return { success: false, result: '❌ Please provide a URL, file path or app to open.' };
+
+            // SECURITY: reject shell metacharacters. We spawn WITHOUT a shell
+            // (args array), but this is defense-in-depth against any handler
+            // that re-parses (e.g. cmd.exe `start`) and command substitution.
+            if (/[`$;&|<>(){}\n\r"'\\]/.test(target)) {
+                return { success: false, result: '❌ Refused: the target contains characters that are not allowed for safety.' };
+            }
+
+            const { spawn } = require('child_process');
+            // Build [binary, ...args] with NO shell interpolation.
+            let bin, spawnArgs;
+            if (platform.isWindows) {
+                bin = 'cmd';
+                spawnArgs = ['/c', 'start', '', target]; // empty title arg required by start
+            } else if (platform.isMac) {
+                bin = 'open';
+                spawnArgs = [target];
+            } else {
+                bin = 'xdg-open';
+                spawnArgs = [target];
+            }
+
+            return new Promise((resolve) => {
+                let child;
+                try {
+                    child = spawn(bin, spawnArgs, { windowsHide: true, stdio: 'ignore' });
+                } catch (err) {
+                    return resolve({ success: false, result: `❌ Could not open "${target}" on ${platform.OS}: ${err.message}` });
+                }
+                const timer = setTimeout(() => { try { child.kill(); } catch (_) {} resolve({ success: true, result: `🚀 Opened **${target}** (${platform.OS}).` }); }, 8000);
+                child.on('error', (err) => { clearTimeout(timer); resolve({ success: false, result: `❌ Could not open "${target}" on ${platform.OS}: ${err.message}` }); });
+                child.on('spawn', () => { clearTimeout(timer); resolve({ success: true, result: `🚀 Opened **${target}** using the system default handler (${platform.OS}).` }); });
+            });
+        }
+    },
+
+    // ─────────── HTTP REQUEST (Generic REST/API caller) ───────────
+    http_request: {
+        name: 'http_request',
+        description: 'Make an HTTP request to any REST API or webhook and return the response. Supports GET/POST/PUT/PATCH/DELETE, custom headers and JSON body.',
+        descriptionHi: 'API रिक्वेस्ट भेजें',
+        riskLevel: 'medium',
+        category: 'tool',
+        parameters: {
+            url: { type: 'string', required: true, description: 'Full URL (must start with http:// or https://)' },
+            method: { type: 'string', required: false, description: 'HTTP method (GET default)' },
+            headers: { type: 'string', required: false, description: 'JSON object of request headers' },
+            body: { type: 'string', required: false, description: 'Request body (JSON string or raw text)' }
+        },
+        execute: async (args, userContext) => {
+            try {
+                const url = args.url;
+                if (!/^https?:\/\//i.test(url || '')) {
+                    return { success: false, result: '❌ URL must start with http:// or https://' };
+                }
+                const method = (args.method || 'GET').toUpperCase();
+                let headers = {};
+                if (args.headers) {
+                    try { headers = typeof args.headers === 'string' ? JSON.parse(args.headers) : args.headers; } catch (e) { /* ignore bad headers */ }
+                }
+                const opts = { method, headers };
+                if (args.body && method !== 'GET' && method !== 'HEAD') {
+                    opts.body = typeof args.body === 'string' ? args.body : JSON.stringify(args.body);
+                    if (!Object.keys(headers).some(h => h.toLowerCase() === 'content-type')) {
+                        headers['Content-Type'] = 'application/json';
+                    }
+                }
+
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), 20000);
+                const res = await fetch(url, { ...opts, signal: controller.signal });
+                clearTimeout(timer);
+
+                const text = await res.text();
+                const preview = text.length > 3000 ? text.slice(0, 3000) + '\n…(truncated)' : text;
+                return {
+                    success: res.ok,
+                    result: `🌐 **${method} ${url}**\nStatus: ${res.status} ${res.statusText}\n\n\`\`\`\n${preview || '(empty body)'}\n\`\`\``
+                };
+            } catch (error) {
+                return { success: false, result: `❌ HTTP request failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── SECURE PASSWORD / TOKEN GENERATOR ───────────
+    password_generate: {
+        name: 'password_generate',
+        description: 'Generate a cryptographically secure random password, API token or secret key.',
+        descriptionHi: 'सुरक्षित पासवर्ड बनाएं',
+        riskLevel: 'low',
+        category: 'tool',
+        parameters: {
+            length: { type: 'number', required: false, description: 'Length of the password (default 20, max 128)' },
+            symbols: { type: 'boolean', required: false, description: 'Include symbols (default true)' }
+        },
+        execute: async (args, userContext) => {
+            try {
+                const crypto = require('crypto');
+                const length = Math.min(Math.max(parseInt(args.length) || 20, 8), 128);
+                const useSymbols = args.symbols !== false && args.symbols !== 'false';
+                const lower = 'abcdefghijklmnopqrstuvwxyz';
+                const upper = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+                const digits = '0123456789';
+                const symbols = '!@#$%^&*()-_=+[]{}<>?';
+                const charset = lower + upper + digits + (useSymbols ? symbols : '');
+
+                const bytes = crypto.randomBytes(length);
+                let pwd = '';
+                for (let i = 0; i < length; i++) pwd += charset[bytes[i] % charset.length];
+
+                return {
+                    success: true,
+                    result: `🔐 **Secure ${length}-char password generated:**\n\n\`${pwd}\`\n\n_Generated with crypto.randomBytes — never stored, never logged._`
+                };
+            } catch (error) {
+                return { success: false, result: `❌ Password generation failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── QR CODE GENERATOR (great for UPI links) ───────────
+    qr_generate: {
+        name: 'qr_generate',
+        description: 'Generate a QR code image URL for any text, link or UPI payment string. Returns a ready-to-share PNG link.',
+        descriptionHi: 'QR कोड बनाएं',
+        riskLevel: 'low',
+        category: 'tool',
+        parameters: {
+            data: { type: 'string', required: true, description: 'Text/URL/UPI string to encode' },
+            size: { type: 'number', required: false, description: 'Image size in px (default 300)' }
+        },
+        execute: async (args) => {
+            const data = args.data || args.text || args.url;
+            if (!data) return { success: false, result: '❌ Provide data to encode.' };
+            const size = Math.min(Math.max(parseInt(args.size) || 300, 100), 1000);
+            const qrUrl = `https://api.qrserver.com/v1/create-qr-code/?size=${size}x${size}&data=${encodeURIComponent(data)}`;
+            return {
+                success: true,
+                result: `📱 **QR Code generated!**\n\nEncodes: \`${data}\`\n\n🔗 Image: ${qrUrl}\n\n_Open the link to view/download the QR._`
+            };
+        }
+    },
+
+    // ─────────── CURRENCY CONVERTER (free, no key) ───────────
+    currency_convert: {
+        name: 'currency_convert',
+        description: 'Convert an amount between currencies using live exchange rates (e.g. USD to INR).',
+        descriptionHi: 'करेंसी कन्वर्ट करें',
+        riskLevel: 'low',
+        category: 'search',
+        parameters: {
+            amount: { type: 'number', required: true, description: 'Amount to convert' },
+            from: { type: 'string', required: true, description: 'Source currency code (e.g. USD)' },
+            to: { type: 'string', required: true, description: 'Target currency code (e.g. INR)' }
+        },
+        execute: async (args) => {
+            try {
+                const from = String(args.from || 'USD').toUpperCase();
+                const to = String(args.to || 'INR').toUpperCase();
+                const amount = Number(args.amount) || 0;
+                const res = await fetch(`https://open.er-api.com/v6/latest/${from}`);
+                const data = await res.json();
+                if (data.result !== 'success' || !data.rates?.[to]) {
+                    return { success: false, result: `❌ Could not get rate for ${from}→${to}.` };
+                }
+                const rate = data.rates[to];
+                const converted = (amount * rate).toFixed(2);
+                return {
+                    success: true,
+                    result: `💱 **${amount} ${from} = ${converted} ${to}**\n\n📈 Rate: 1 ${from} = ${rate} ${to}\n🕐 As of ${data.time_last_update_utc || 'now'}`
+                };
+            } catch (error) {
+                return { success: false, result: `❌ Currency conversion failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── CRYPTO PRICE (CoinGecko, free) ───────────
+    crypto_price: {
+        name: 'crypto_price',
+        description: 'Get the current price of a cryptocurrency (e.g. bitcoin, ethereum) in INR/USD.',
+        descriptionHi: 'क्रिप्टो कीमत जानें',
+        riskLevel: 'low',
+        category: 'search',
+        parameters: {
+            coin: { type: 'string', required: true, description: 'Coin id (e.g. bitcoin, ethereum, dogecoin)' },
+            currency: { type: 'string', required: false, description: 'Fiat currency (default inr)' }
+        },
+        execute: async (args) => {
+            try {
+                const coin = String(args.coin || 'bitcoin').toLowerCase().replace(/\s+/g, '-');
+                const vs = String(args.currency || 'inr').toLowerCase();
+                const res = await fetch(`https://api.coingecko.com/api/v3/simple/price?ids=${encodeURIComponent(coin)}&vs_currencies=${encodeURIComponent(vs)}&include_24hr_change=true`);
+                const data = await res.json();
+                if (!data[coin] || data[coin][vs] === undefined) {
+                    return { success: false, result: `❌ Coin "${coin}" not found. Use ids like bitcoin, ethereum, solana.` };
+                }
+                const price = data[coin][vs];
+                const change = data[coin][`${vs}_24h_change`];
+                const arrow = change >= 0 ? '🟢▲' : '🔴▼';
+                return {
+                    success: true,
+                    result: `🪙 **${coin.toUpperCase()}**\n\n💰 Price: **${price.toLocaleString()} ${vs.toUpperCase()}**\n${arrow} 24h: ${change?.toFixed(2)}%`
+                };
+            } catch (error) {
+                return { success: false, result: `❌ Crypto price failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── URL SHORTENER (is.gd, free) ───────────
+    url_shorten: {
+        name: 'url_shorten',
+        description: 'Shorten a long URL into a compact shareable link.',
+        descriptionHi: 'URL छोटा करें',
+        riskLevel: 'low',
+        category: 'tool',
+        parameters: {
+            url: { type: 'string', required: true, description: 'Long URL to shorten' }
+        },
+        execute: async (args) => {
+            try {
+                if (!/^https?:\/\//i.test(args.url || '')) {
+                    return { success: false, result: '❌ Provide a valid http(s) URL.' };
+                }
+                const res = await fetch(`https://is.gd/create.php?format=simple&url=${encodeURIComponent(args.url)}`);
+                const short = (await res.text()).trim();
+                if (!short.startsWith('http')) {
+                    return { success: false, result: `❌ Shortening failed: ${short}` };
+                }
+                return { success: true, result: `🔗 **Short URL:** ${short}\n\nOriginal: ${args.url}` };
+            } catch (error) {
+                return { success: false, result: `❌ URL shorten failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── IP GEOLOCATION (ip-api, free) ───────────
+    ip_geolocate: {
+        name: 'ip_geolocate',
+        description: 'Look up geolocation, ISP and org details for an IP address (or the host public IP if none given).',
+        descriptionHi: 'IP की लोकेशन पता करें',
+        riskLevel: 'low',
+        category: 'search',
+        parameters: {
+            ip: { type: 'string', required: false, description: 'IP address (leave empty for this machine\'s public IP)' }
+        },
+        execute: async (args) => {
+            try {
+                const ip = (args.ip || '').trim();
+                const res = await fetch(`http://ip-api.com/json/${encodeURIComponent(ip)}`);
+                const d = await res.json();
+                if (d.status !== 'success') {
+                    return { success: false, result: `❌ Lookup failed: ${d.message || 'unknown'}` };
+                }
+                return {
+                    success: true,
+                    result: `🌍 **IP ${d.query}**\n\n📍 ${d.city}, ${d.regionName}, ${d.country}\n🛰️ ISP: ${d.isp}\n🏢 Org: ${d.org || 'N/A'}\n🕐 Timezone: ${d.timezone}\n🗺️ Lat/Lon: ${d.lat}, ${d.lon}`
+                };
+            } catch (error) {
+                return { success: false, result: `❌ IP geolocation failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── TRANSLATE TEXT (MyMemory, free — great for Hindi) ───────────
+    translate_text: {
+        name: 'translate_text',
+        description: 'Translate text between languages (e.g. English to Hindi). Uses ISO codes like en, hi, ta, bn, mr.',
+        descriptionHi: 'टेक्स्ट का अनुवाद करें',
+        riskLevel: 'low',
+        category: 'tool',
+        parameters: {
+            text: { type: 'string', required: true, description: 'Text to translate' },
+            to: { type: 'string', required: true, description: 'Target language code (e.g. hi for Hindi)' },
+            from: { type: 'string', required: false, description: 'Source language code (default auto/en)' }
+        },
+        execute: async (args) => {
+            try {
+                const text = args.text;
+                if (!text) return { success: false, result: '❌ Provide text to translate.' };
+                const from = (args.from || 'en').toLowerCase();
+                const to = (args.to || 'hi').toLowerCase();
+                const res = await fetch(`https://api.mymemory.translated.net/get?q=${encodeURIComponent(text)}&langpair=${from}|${to}`);
+                const data = await res.json();
+                const translated = data?.responseData?.translatedText;
+                if (!translated) return { success: false, result: '❌ Translation failed.' };
+                return {
+                    success: true,
+                    result: `🌐 **Translation (${from}→${to}):**\n\n${translated}`
+                };
+            } catch (error) {
+                return { success: false, result: `❌ Translation failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── CLIPBOARD COPY (cross-platform) ───────────
+    clipboard_copy: {
+        name: 'clipboard_copy',
+        description: 'Copy text to the system clipboard. Works on Windows (clip), macOS (pbcopy) and Linux (xclip/xsel/wl-copy).',
+        descriptionHi: 'क्लिपबोर्ड पर कॉपी करें',
+        riskLevel: 'low',
+        category: 'system',
+        parameters: {
+            text: { type: 'string', required: true, description: 'Text to copy to clipboard' }
+        },
+        execute: async (args) => {
+            const text = args.text ?? '';
+            return new Promise((resolve) => {
+                let cmd;
+                if (platform.isWindows) cmd = 'clip';
+                else if (platform.isMac) cmd = 'pbcopy';
+                else cmd = 'xclip -selection clipboard 2>/dev/null || xsel --clipboard --input 2>/dev/null || wl-copy';
+
+                const { shell } = platform.getShell();
+                const child = exec(cmd, { shell, windowsHide: true }, (error) => {
+                    if (error) {
+                        return resolve({ success: false, result: `❌ Clipboard copy failed (${platform.OS}). On Linux install xclip/xsel/wl-clipboard.` });
+                    }
+                    resolve({ success: true, result: `📋 Copied ${String(text).length} characters to clipboard.` });
+                });
+                child.stdin.write(String(text));
+                child.stdin.end();
+            });
+        }
+    },
+
+    // ─────────── HASH / CHECKSUM ───────────
+    hash_text: {
+        name: 'hash_text',
+        description: 'Compute a cryptographic hash (md5, sha1, sha256, sha512) of a text string.',
+        descriptionHi: 'टेक्स्ट का हैश निकालें',
+        riskLevel: 'low',
+        category: 'tool',
+        parameters: {
+            text: { type: 'string', required: true, description: 'Text to hash' },
+            algorithm: { type: 'string', required: false, description: 'md5 | sha1 | sha256 (default) | sha512' }
+        },
+        execute: async (args) => {
+            try {
+                const crypto = require('crypto');
+                const algo = (args.algorithm || 'sha256').toLowerCase();
+                const allowed = ['md5', 'sha1', 'sha256', 'sha512'];
+                if (!allowed.includes(algo)) {
+                    return { success: false, result: `❌ Algorithm must be one of: ${allowed.join(', ')}` };
+                }
+                const digest = crypto.createHash(algo).update(String(args.text ?? '')).digest('hex');
+                return { success: true, result: `🔑 **${algo.toUpperCase()}**\n\n\`${digest}\`` };
+            } catch (error) {
+                return { success: false, result: `❌ Hashing failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── BASE64 ENCODE / DECODE ───────────
+    base64_tool: {
+        name: 'base64_tool',
+        description: 'Encode text to Base64 or decode Base64 back to text.',
+        descriptionHi: 'Base64 एनकोड/डिकोड',
+        riskLevel: 'low',
+        category: 'tool',
+        parameters: {
+            text: { type: 'string', required: true, description: 'Input text or base64 string' },
+            mode: { type: 'string', required: false, description: 'encode (default) | decode' }
+        },
+        execute: async (args) => {
+            try {
+                const mode = (args.mode || 'encode').toLowerCase();
+                const input = String(args.text ?? '');
+                if (mode === 'decode') {
+                    const out = Buffer.from(input, 'base64').toString('utf-8');
+                    return { success: true, result: `🔓 **Decoded:**\n\n${out}` };
+                }
+                const out = Buffer.from(input, 'utf-8').toString('base64');
+                return { success: true, result: `🔒 **Base64:**\n\n\`${out}\`` };
+            } catch (error) {
+                return { success: false, result: `❌ Base64 ${args.mode || 'encode'} failed: ${error.message}` };
+            }
+        }
+    },
+
+    // ─────────── WORLD CLOCK / TIMEZONE ───────────
+    timezone_now: {
+        name: 'timezone_now',
+        description: 'Get the current date and time in any timezone (e.g. Asia/Kolkata, America/New_York, UTC).',
+        descriptionHi: 'किसी टाइमज़ोन का समय जानें',
+        riskLevel: 'low',
+        category: 'tool',
+        parameters: {
+            timezone: { type: 'string', required: false, description: 'IANA timezone (default Asia/Kolkata)' }
+        },
+        execute: async (args) => {
+            try {
+                const tz = args.timezone || 'Asia/Kolkata';
+                const now = new Date().toLocaleString('en-US', {
+                    timeZone: tz, dateStyle: 'full', timeStyle: 'long'
+                });
+                return { success: true, result: `🕐 **${tz}**\n\n${now}` };
+            } catch (error) {
+                return { success: false, result: `❌ Invalid timezone "${args.timezone}". Use IANA names like Asia/Kolkata.` };
+            }
+        }
     }
 };