squidclaw 3.0.22 → 3.0.24

package/dist/plugin-sdk/diagnostic-DPRVoKTk.js

@@ -0,0 +1,319 @@
+import { n as loadConfig } from "./config-B2B64aX0.js";
+import { a as createSubsystemLogger } from "./logger-DDdrdbDu.js";
+
+//#region src/infra/diagnostic-events.ts
+function getDiagnosticEventsState() {
+	const globalStore = globalThis;
+	if (!globalStore.__squidclawDiagnosticEventsState) globalStore.__squidclawDiagnosticEventsState = {
+		seq: 0,
+		listeners: /* @__PURE__ */ new Set(),
+		dispatchDepth: 0
+	};
+	return globalStore.__squidclawDiagnosticEventsState;
+}
+function isDiagnosticsEnabled(config) {
+	return config?.diagnostics?.enabled === true;
+}
+function emitDiagnosticEvent(event) {
+	const state = getDiagnosticEventsState();
+	if (state.dispatchDepth > 100) {
+		console.error(`[diagnostic-events] recursion guard tripped at depth=${state.dispatchDepth}, dropping type=${event.type}`);
+		return;
+	}
+	const enriched = {
+		...event,
+		seq: state.seq += 1,
+		ts: Date.now()
+	};
+	state.dispatchDepth += 1;
+	for (const listener of state.listeners) try {
+		listener(enriched);
+	} catch (err) {
+		const errorMessage = err instanceof Error ? err.stack ?? err.message : typeof err === "string" ? err : String(err);
+		console.error(`[diagnostic-events] listener error type=${enriched.type} seq=${enriched.seq}: ${errorMessage}`);
+	}
+	state.dispatchDepth -= 1;
+}
+function onDiagnosticEvent(listener) {
+	const state = getDiagnosticEventsState();
+	state.listeners.add(listener);
+	return () => {
+		state.listeners.delete(listener);
+	};
+}
+
+//#endregion
+//#region src/logging/diagnostic-session-state.ts
+const diagnosticSessionStates = /* @__PURE__ */ new Map();
+const SESSION_STATE_TTL_MS = 1800 * 1e3;
+const SESSION_STATE_PRUNE_INTERVAL_MS = 60 * 1e3;
+const SESSION_STATE_MAX_ENTRIES = 2e3;
+let lastSessionPruneAt = 0;
+function pruneDiagnosticSessionStates(now = Date.now(), force = false) {
+	const shouldPruneForSize = diagnosticSessionStates.size > SESSION_STATE_MAX_ENTRIES;
+	if (!force && !shouldPruneForSize && now - lastSessionPruneAt < SESSION_STATE_PRUNE_INTERVAL_MS) return;
+	lastSessionPruneAt = now;
+	for (const [key, state] of diagnosticSessionStates.entries()) {
+		const ageMs = now - state.lastActivity;
+		if (state.state === "idle" && state.queueDepth <= 0 && ageMs > SESSION_STATE_TTL_MS) diagnosticSessionStates.delete(key);
+	}
+	if (diagnosticSessionStates.size <= SESSION_STATE_MAX_ENTRIES) return;
+	const excess = diagnosticSessionStates.size - SESSION_STATE_MAX_ENTRIES;
+	const ordered = Array.from(diagnosticSessionStates.entries()).toSorted((a, b) => a[1].lastActivity - b[1].lastActivity);
+	for (let i = 0; i < excess; i += 1) {
+		const key = ordered[i]?.[0];
+		if (!key) break;
+		diagnosticSessionStates.delete(key);
+	}
+}
+function resolveSessionKey({ sessionKey, sessionId }) {
+	return sessionKey ?? sessionId ?? "unknown";
+}
+function findStateBySessionId(sessionId) {
+	for (const state of diagnosticSessionStates.values()) if (state.sessionId === sessionId) return state;
+}
+function getDiagnosticSessionState(ref) {
+	pruneDiagnosticSessionStates();
+	const key = resolveSessionKey(ref);
+	const existing = diagnosticSessionStates.get(key) ?? (ref.sessionId && findStateBySessionId(ref.sessionId));
+	if (existing) {
+		if (ref.sessionId) existing.sessionId = ref.sessionId;
+		if (ref.sessionKey) existing.sessionKey = ref.sessionKey;
+		return existing;
+	}
+	const created = {
+		sessionId: ref.sessionId,
+		sessionKey: ref.sessionKey,
+		lastActivity: Date.now(),
+		state: "idle",
+		queueDepth: 0
+	};
+	diagnosticSessionStates.set(key, created);
+	pruneDiagnosticSessionStates(Date.now(), true);
+	return created;
+}
+
+//#endregion
+//#region src/logging/diagnostic.ts
+const diag = createSubsystemLogger("diagnostic");
+const webhookStats = {
+	received: 0,
+	processed: 0,
+	errors: 0,
+	lastReceived: 0
+};
+let lastActivityAt = 0;
+const DEFAULT_STUCK_SESSION_WARN_MS = 12e4;
+const MIN_STUCK_SESSION_WARN_MS = 1e3;
+const MAX_STUCK_SESSION_WARN_MS = 1440 * 60 * 1e3;
+let commandPollBackoffRuntimePromise = null;
+function loadCommandPollBackoffRuntime() {
+	commandPollBackoffRuntimePromise ??= import("./command-poll-backoff.runtime-BrAQqJqT.js");
+	return commandPollBackoffRuntimePromise;
+}
+function markActivity() {
+	lastActivityAt = Date.now();
+}
+function resolveStuckSessionWarnMs(config) {
+	const raw = config?.diagnostics?.stuckSessionWarnMs;
+	if (typeof raw !== "number" || !Number.isFinite(raw)) return DEFAULT_STUCK_SESSION_WARN_MS;
+	const rounded = Math.floor(raw);
+	if (rounded < MIN_STUCK_SESSION_WARN_MS || rounded > MAX_STUCK_SESSION_WARN_MS) return DEFAULT_STUCK_SESSION_WARN_MS;
+	return rounded;
+}
+function logWebhookReceived(params) {
+	webhookStats.received += 1;
+	webhookStats.lastReceived = Date.now();
+	if (diag.isEnabled("debug")) diag.debug(`webhook received: channel=${params.channel} type=${params.updateType ?? "unknown"} chatId=${params.chatId ?? "unknown"} total=${webhookStats.received}`);
+	emitDiagnosticEvent({
+		type: "webhook.received",
+		channel: params.channel,
+		updateType: params.updateType,
+		chatId: params.chatId
+	});
+	markActivity();
+}
+function logWebhookProcessed(params) {
+	webhookStats.processed += 1;
+	if (diag.isEnabled("debug")) diag.debug(`webhook processed: channel=${params.channel} type=${params.updateType ?? "unknown"} chatId=${params.chatId ?? "unknown"} duration=${params.durationMs ?? 0}ms processed=${webhookStats.processed}`);
+	emitDiagnosticEvent({
+		type: "webhook.processed",
+		channel: params.channel,
+		updateType: params.updateType,
+		chatId: params.chatId,
+		durationMs: params.durationMs
+	});
+	markActivity();
+}
+function logWebhookError(params) {
+	webhookStats.errors += 1;
+	diag.error(`webhook error: channel=${params.channel} type=${params.updateType ?? "unknown"} chatId=${params.chatId ?? "unknown"} error="${params.error}" errors=${webhookStats.errors}`);
+	emitDiagnosticEvent({
+		type: "webhook.error",
+		channel: params.channel,
+		updateType: params.updateType,
+		chatId: params.chatId,
+		error: params.error
+	});
+	markActivity();
+}
+function logMessageQueued(params) {
+	const state = getDiagnosticSessionState(params);
+	state.queueDepth += 1;
+	state.lastActivity = Date.now();
+	if (diag.isEnabled("debug")) diag.debug(`message queued: sessionId=${state.sessionId ?? "unknown"} sessionKey=${state.sessionKey ?? "unknown"} source=${params.source} queueDepth=${state.queueDepth} sessionState=${state.state}`);
+	emitDiagnosticEvent({
+		type: "message.queued",
+		sessionId: state.sessionId,
+		sessionKey: state.sessionKey,
+		channel: params.channel,
+		source: params.source,
+		queueDepth: state.queueDepth
+	});
+	markActivity();
+}
+function logMessageProcessed(params) {
+	if (params.outcome === "error" ? diag.isEnabled("error") : diag.isEnabled("debug")) {
+		const payload = `message processed: channel=${params.channel} chatId=${params.chatId ?? "unknown"} messageId=${params.messageId ?? "unknown"} sessionId=${params.sessionId ?? "unknown"} sessionKey=${params.sessionKey ?? "unknown"} outcome=${params.outcome} duration=${params.durationMs ?? 0}ms${params.reason ? ` reason=${params.reason}` : ""}${params.error ? ` error="${params.error}"` : ""}`;
+		if (params.outcome === "error") diag.error(payload);
+		else diag.debug(payload);
+	}
+	emitDiagnosticEvent({
+		type: "message.processed",
+		channel: params.channel,
+		chatId: params.chatId,
+		messageId: params.messageId,
+		sessionId: params.sessionId,
+		sessionKey: params.sessionKey,
+		durationMs: params.durationMs,
+		outcome: params.outcome,
+		reason: params.reason,
+		error: params.error
+	});
+	markActivity();
+}
+function logSessionStateChange(params) {
+	const state = getDiagnosticSessionState(params);
+	const isProbeSession = state.sessionId?.startsWith("probe-") ?? false;
+	const prevState = state.state;
+	state.state = params.state;
+	state.lastActivity = Date.now();
+	if (params.state === "idle") state.queueDepth = Math.max(0, state.queueDepth - 1);
+	if (!isProbeSession && diag.isEnabled("debug")) diag.debug(`session state: sessionId=${state.sessionId ?? "unknown"} sessionKey=${state.sessionKey ?? "unknown"} prev=${prevState} new=${params.state} reason="${params.reason ?? ""}" queueDepth=${state.queueDepth}`);
+	emitDiagnosticEvent({
+		type: "session.state",
+		sessionId: state.sessionId,
+		sessionKey: state.sessionKey,
+		prevState,
+		state: params.state,
+		reason: params.reason,
+		queueDepth: state.queueDepth
+	});
+	markActivity();
+}
+function logSessionStuck(params) {
+	const state = getDiagnosticSessionState(params);
+	diag.warn(`stuck session: sessionId=${state.sessionId ?? "unknown"} sessionKey=${state.sessionKey ?? "unknown"} state=${params.state} age=${Math.round(params.ageMs / 1e3)}s queueDepth=${state.queueDepth}`);
+	emitDiagnosticEvent({
+		type: "session.stuck",
+		sessionId: state.sessionId,
+		sessionKey: state.sessionKey,
+		state: params.state,
+		ageMs: params.ageMs,
+		queueDepth: state.queueDepth
+	});
+	markActivity();
+}
+function logLaneEnqueue(lane, queueSize) {
+	diag.debug(`lane enqueue: lane=${lane} queueSize=${queueSize}`);
+	emitDiagnosticEvent({
+		type: "queue.lane.enqueue",
+		lane,
+		queueSize
+	});
+	markActivity();
+}
+function logLaneDequeue(lane, waitMs, queueSize) {
+	diag.debug(`lane dequeue: lane=${lane} waitMs=${waitMs} queueSize=${queueSize}`);
+	emitDiagnosticEvent({
+		type: "queue.lane.dequeue",
+		lane,
+		queueSize,
+		waitMs
+	});
+	markActivity();
+}
+function logToolLoopAction(params) {
+	const payload = `tool loop: sessionId=${params.sessionId ?? "unknown"} sessionKey=${params.sessionKey ?? "unknown"} tool=${params.toolName} level=${params.level} action=${params.action} detector=${params.detector} count=${params.count}${params.pairedToolName ? ` pairedTool=${params.pairedToolName}` : ""} message="${params.message}"`;
+	if (params.level === "critical") diag.error(payload);
+	else diag.warn(payload);
+	emitDiagnosticEvent({
+		type: "tool.loop",
+		sessionId: params.sessionId,
+		sessionKey: params.sessionKey,
+		toolName: params.toolName,
+		level: params.level,
+		action: params.action,
+		detector: params.detector,
+		count: params.count,
+		message: params.message,
+		pairedToolName: params.pairedToolName
+	});
+	markActivity();
+}
+let heartbeatInterval = null;
+function startDiagnosticHeartbeat(config) {
+	if (heartbeatInterval) return;
+	heartbeatInterval = setInterval(() => {
+		let heartbeatConfig = config;
+		if (!heartbeatConfig) try {
+			heartbeatConfig = loadConfig();
+		} catch {
+			heartbeatConfig = void 0;
+		}
+		const stuckSessionWarnMs = resolveStuckSessionWarnMs(heartbeatConfig);
+		const now = Date.now();
+		pruneDiagnosticSessionStates(now, true);
+		const activeCount = Array.from(diagnosticSessionStates.values()).filter((s) => s.state === "processing").length;
+		const waitingCount = Array.from(diagnosticSessionStates.values()).filter((s) => s.state === "waiting").length;
+		const totalQueued = Array.from(diagnosticSessionStates.values()).reduce((sum, s) => sum + s.queueDepth, 0);
+		if (!(lastActivityAt > 0 || webhookStats.received > 0 || activeCount > 0 || waitingCount > 0 || totalQueued > 0)) return;
+		if (now - lastActivityAt > 12e4 && activeCount === 0 && waitingCount === 0) return;
+		diag.debug(`heartbeat: webhooks=${webhookStats.received}/${webhookStats.processed}/${webhookStats.errors} active=${activeCount} waiting=${waitingCount} queued=${totalQueued}`);
+		emitDiagnosticEvent({
+			type: "diagnostic.heartbeat",
+			webhooks: {
+				received: webhookStats.received,
+				processed: webhookStats.processed,
+				errors: webhookStats.errors
+			},
+			active: activeCount,
+			waiting: waitingCount,
+			queued: totalQueued
+		});
+		loadCommandPollBackoffRuntime().then(({ pruneStaleCommandPolls }) => {
+			for (const [, state] of diagnosticSessionStates) pruneStaleCommandPolls(state);
+		}).catch((err) => {
+			diag.debug(`command-poll-backoff prune failed: ${String(err)}`);
+		});
+		for (const [, state] of diagnosticSessionStates) {
+			const ageMs = now - state.lastActivity;
+			if (state.state === "processing" && ageMs > stuckSessionWarnMs) logSessionStuck({
+				sessionId: state.sessionId,
+				sessionKey: state.sessionKey,
+				state: state.state,
+				ageMs
+			});
+		}
+	}, 3e4);
+	heartbeatInterval.unref?.();
+}
+function stopDiagnosticHeartbeat() {
+	if (heartbeatInterval) {
+		clearInterval(heartbeatInterval);
+		heartbeatInterval = null;
+	}
+}
+
+//#endregion
+export { logMessageQueued as a, logWebhookError as c, startDiagnosticHeartbeat as d, stopDiagnosticHeartbeat as f, onDiagnosticEvent as g, isDiagnosticsEnabled as h, logMessageProcessed as i, logWebhookProcessed as l, emitDiagnosticEvent as m, logLaneDequeue as n, logSessionStateChange as o, getDiagnosticSessionState as p, logLaneEnqueue as r, logToolLoopAction as s, diag as t, logWebhookReceived as u };

package/dist/plugin-sdk/discord.js

@@ -4,7 +4,7 @@ import chalk, { Chalk } from "chalk";
 import fs, { constants } from "node:fs";
 import { Logger } from "tslog";
 import os from "node:os";
-import JSON5 from "json5";
+import json5 from "json5";
 import { isDeepStrictEqual, promisify } from "node:util";
 import fs$1 from "node:fs/promises";
 import { execFile, execFileSync, spawn } from "node:child_process";
@@ -802,7 +802,7 @@ function readLoggingConfig() {
 	try {
 		if (!fs.existsSync(configPath)) return;
 		const raw = fs.readFileSync(configPath, "utf-8");
-		const logging = JSON5.parse(raw)?.logging;
+		const logging = json5.parse(raw)?.logging;
 		if (!logging || typeof logging !== "object" || Array.isArray(logging)) return;
 		return logging;
 	} catch {
@@ -5861,7 +5861,7 @@ const defaultResolver = {
 		resolvedPath,
 		rootRealDir
 	}),
-	parseJson: (raw) => JSON5.parse(raw)
+	parseJson: (raw) => json5.parse(raw)
 };
 /**
 * Resolves all $include directives in a parsed config object.
@@ -13216,7 +13216,7 @@ function resolveConfigPathForDeps(deps) {
 function normalizeDeps(overrides = {}) {
 	return {
 		fs: overrides.fs ?? fs,
-		json5: overrides.json5 ?? JSON5,
+		json5: overrides.json5 ?? json5,
 		env: overrides.env ?? process.env,
 		homedir: overrides.homedir ?? (() => resolveRequiredHomeDir(overrides.env ?? process.env, os.homedir)),
 		configPath: overrides.configPath ?? "",
@@ -13227,11 +13227,11 @@ function maybeLoadDotEnvForConfig(env) {
 	if (env !== process.env) return;
 	loadDotEnv({ quiet: true });
 }
-function parseConfigJson5(raw, json5 = JSON5) {
+function parseConfigJson5(raw, json5$1 = json5) {
 	try {
 		return {
 			ok: true,
-			parsed: json5.parse(raw)
+			parsed: json5$1.parse(raw)
 		};
 	} catch (err) {
 		return {

package/dist/plugin-sdk/{errors-CgRPdp3o.js → errors-9oVz7reJ.js}

@@ -1,4 +1,4 @@
-import { t as redactSensitiveText } from "./redact-9WsNyb7S.js";
+import { t as redactSensitiveText } from "./redact-DfACyt0X.js";
 
 //#region src/infra/errors.ts
 function extractErrorCode(err) {

package/dist/plugin-sdk/errors-B8oJXuCF.js

@@ -0,0 +1,54 @@
+import { t as redactSensitiveText } from "./redact-BoNEjbpF.js";
+
+//#region src/infra/errors.ts
+function extractErrorCode(err) {
+	if (!err || typeof err !== "object") return;
+	const code = err.code;
+	if (typeof code === "string") return code;
+	if (typeof code === "number") return String(code);
+}
+function readErrorName(err) {
+	if (!err || typeof err !== "object") return "";
+	const name = err.name;
+	return typeof name === "string" ? name : "";
+}
+function collectErrorGraphCandidates(err, resolveNested) {
+	const queue = [err];
+	const seen = /* @__PURE__ */ new Set();
+	const candidates = [];
+	while (queue.length > 0) {
+		const current = queue.shift();
+		if (current == null || seen.has(current)) continue;
+		seen.add(current);
+		candidates.push(current);
+		if (!current || typeof current !== "object" || !resolveNested) continue;
+		for (const nested of resolveNested(current)) if (nested != null && !seen.has(nested)) queue.push(nested);
+	}
+	return candidates;
+}
+/**
+* Type guard for NodeJS.ErrnoException (any error with a `code` property).
+*/
+function isErrno(err) {
+	return Boolean(err && typeof err === "object" && "code" in err);
+}
+function formatErrorMessage(err) {
+	let formatted;
+	if (err instanceof Error) formatted = err.message || err.name || "Error";
+	else if (typeof err === "string") formatted = err;
+	else if (typeof err === "number" || typeof err === "boolean" || typeof err === "bigint") formatted = String(err);
+	else try {
+		formatted = JSON.stringify(err);
+	} catch {
+		formatted = Object.prototype.toString.call(err);
+	}
+	return redactSensitiveText(formatted);
+}
+function formatUncaughtError(err) {
+	if (extractErrorCode(err) === "INVALID_CONFIG") return formatErrorMessage(err);
+	if (err instanceof Error) return redactSensitiveText(err.stack ?? err.message ?? err.name);
+	return formatErrorMessage(err);
+}
+
+//#endregion
+export { isErrno as a, formatUncaughtError as i, extractErrorCode as n, readErrorName as o, formatErrorMessage as r, collectErrorGraphCandidates as t };

package/dist/plugin-sdk/fetch-guard-F0Fnqisy.js

@@ -0,0 +1,156 @@
+import { i as logWarn } from "./logger-DDdrdbDu.js";
+import { t as bindAbortRelay } from "./fetch-timeout-D455O27U.js";
+import { c as resolvePinnedHostnameWithPolicy, n as closeDispatcher, r as createPinnedDispatcher, t as SsrFBlockedError, u as hasProxyEnvConfigured } from "./ssrf-DOBwjFow.js";
+import { EnvHttpProxyAgent } from "undici";
+
+//#region src/infra/net/fetch-guard.ts
+const GUARDED_FETCH_MODE = {
+	STRICT: "strict",
+	TRUSTED_ENV_PROXY: "trusted_env_proxy"
+};
+const DEFAULT_MAX_REDIRECTS = 3;
+const CROSS_ORIGIN_REDIRECT_SENSITIVE_HEADERS = [
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"cookie2"
+];
+function withStrictGuardedFetchMode(params) {
+	return {
+		...params,
+		mode: GUARDED_FETCH_MODE.STRICT
+	};
+}
+function withTrustedEnvProxyGuardedFetchMode(params) {
+	return {
+		...params,
+		mode: GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY
+	};
+}
+function resolveGuardedFetchMode(params) {
+	if (params.mode) return params.mode;
+	if (params.proxy === "env" && params.dangerouslyAllowEnvProxyWithoutPinnedDns === true) return GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY;
+	return GUARDED_FETCH_MODE.STRICT;
+}
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function stripSensitiveHeadersForCrossOriginRedirect(init) {
+	if (!init?.headers) return init;
+	const headers = new Headers(init.headers);
+	for (const header of CROSS_ORIGIN_REDIRECT_SENSITIVE_HEADERS) headers.delete(header);
+	return {
+		...init,
+		headers
+	};
+}
+function buildAbortSignal(params) {
+	const { timeoutMs, signal } = params;
+	if (!timeoutMs && !signal) return {
+		signal: void 0,
+		cleanup: () => {}
+	};
+	if (!timeoutMs) return {
+		signal,
+		cleanup: () => {}
+	};
+	const controller = new AbortController();
+	const timeoutId = setTimeout(controller.abort.bind(controller), timeoutMs);
+	const onAbort = bindAbortRelay(controller);
+	if (signal) if (signal.aborted) controller.abort();
+	else signal.addEventListener("abort", onAbort, { once: true });
+	const cleanup = () => {
+		clearTimeout(timeoutId);
+		if (signal) signal.removeEventListener("abort", onAbort);
+	};
+	return {
+		signal: controller.signal,
+		cleanup
+	};
+}
+async function fetchWithSsrFGuard(params) {
+	const fetcher = params.fetchImpl ?? globalThis.fetch;
+	if (!fetcher) throw new Error("fetch is not available");
+	const maxRedirects = typeof params.maxRedirects === "number" && Number.isFinite(params.maxRedirects) ? Math.max(0, Math.floor(params.maxRedirects)) : DEFAULT_MAX_REDIRECTS;
+	const mode = resolveGuardedFetchMode(params);
+	const { signal, cleanup } = buildAbortSignal({
+		timeoutMs: params.timeoutMs,
+		signal: params.signal
+	});
+	let released = false;
+	const release = async (dispatcher) => {
+		if (released) return;
+		released = true;
+		cleanup();
+		await closeDispatcher(dispatcher ?? void 0);
+	};
+	const visited = /* @__PURE__ */ new Set();
+	let currentUrl = params.url;
+	let currentInit = params.init ? { ...params.init } : void 0;
+	let redirectCount = 0;
+	while (true) {
+		let parsedUrl;
+		try {
+			parsedUrl = new URL(currentUrl);
+		} catch {
+			await release();
+			throw new Error("Invalid URL: must be http or https");
+		}
+		if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+			await release();
+			throw new Error("Invalid URL: must be http or https");
+		}
+		let dispatcher = null;
+		try {
+			const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+				lookupFn: params.lookupFn,
+				policy: params.policy
+			});
+			if (mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured()) dispatcher = new EnvHttpProxyAgent();
+			else if (params.pinDns !== false) dispatcher = createPinnedDispatcher(pinned);
+			const init = {
+				...currentInit ? { ...currentInit } : {},
+				redirect: "manual",
+				...dispatcher ? { dispatcher } : {},
+				...signal ? { signal } : {}
+			};
+			const response = await fetcher(parsedUrl.toString(), init);
+			if (isRedirectStatus(response.status)) {
+				const location = response.headers.get("location");
+				if (!location) {
+					await release(dispatcher);
+					throw new Error(`Redirect missing location header (${response.status})`);
+				}
+				redirectCount += 1;
+				if (redirectCount > maxRedirects) {
+					await release(dispatcher);
+					throw new Error(`Too many redirects (limit: ${maxRedirects})`);
+				}
+				const nextParsedUrl = new URL(location, parsedUrl);
+				const nextUrl = nextParsedUrl.toString();
+				if (visited.has(nextUrl)) {
+					await release(dispatcher);
+					throw new Error("Redirect loop detected");
+				}
+				if (nextParsedUrl.origin !== parsedUrl.origin) currentInit = stripSensitiveHeadersForCrossOriginRedirect(currentInit);
+				visited.add(nextUrl);
+				response.body?.cancel();
+				await closeDispatcher(dispatcher);
+				currentUrl = nextUrl;
+				continue;
+			}
+			return {
+				response,
+				finalUrl: currentUrl,
+				release: async () => release(dispatcher)
+			};
+		} catch (err) {
+			if (err instanceof SsrFBlockedError) logWarn(`security: blocked URL fetch (${params.auditContext ?? "url-fetch"}) target=${parsedUrl.origin}${parsedUrl.pathname} reason=${err.message}`);
+			await release(dispatcher);
+			throw err;
+		}
+	}
+}
+
+//#endregion
+export { withStrictGuardedFetchMode as n, withTrustedEnvProxyGuardedFetchMode as r, fetchWithSsrFGuard as t };

package/dist/plugin-sdk/{fetch-guard-BBAT8G-1.js → fetch-guard-cfPCfkrw.js}

@@ -1,5 +1,5 @@
-import { i as logWarn } from "./logger-DIb2cGHp.js";
-import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-C4s12rr8.js";
+import { i as logWarn } from "./logger-Bg4vIUJn.js";
+import { i as createPinnedDispatcher, n as SsrFBlockedError, r as closeDispatcher, s as resolvePinnedHostnameWithPolicy, t as hasProxyEnvConfigured } from "./proxy-env-CUUXO6rv.js";
 import { t as bindAbortRelay } from "./fetch-timeout-CR10Uz2k.js";
 import { EnvHttpProxyAgent } from "undici";
 

package/dist/plugin-sdk/{fs-safe-DqCO1D4C.js → fs-safe-DFbwq9CS.js}

@@ -1,7 +1,7 @@
-import { B as isSymlinkOpenError, L as hasNodeErrorCode, N as sameFileIdentity, R as isNotFoundPathError, z as isPathInside } from "./run-with-concurrency-DmTrN5JG.js";
-import { i as logWarn } from "./logger-DIb2cGHp.js";
+import { B as isSymlinkOpenError, L as hasNodeErrorCode, N as sameFileIdentity, R as isNotFoundPathError, z as isPathInside } from "./run-with-concurrency-kVooFCVo.js";
+import { i as logWarn } from "./logger-Bg4vIUJn.js";
 import { l as expandHomePrefix } from "./paths-Duwviem_.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-TnxupPQC.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-DA0MhfkG.js";
 import path from "node:path";
 import { constants } from "node:fs";
 import os from "node:os";

package/dist/{fs-safe-DPYj7h8A.js → plugin-sdk/fs-safe-Dqmpk-Fr.js}

@@ -1,10 +1,10 @@
-import { _ as expandHomePrefix } from "./paths-CHIu6D1E.js";
-import { d as hasNodeErrorCode, f as isNotFoundPathError, m as isSymlinkOpenError, p as isPathInside, s as sameFileIdentity } from "./squidclaw-root-BQfLymzj.js";
-import { i as logWarn } from "./logger-DL3N22PJ.js";
-import { n as assertNoPathAliasEscape } from "./path-alias-guards-vfYYQFIg.js";
-import os from "node:os";
-import path from "node:path";
+import { B as isSymlinkOpenError, L as hasNodeErrorCode, N as sameFileIdentity, R as isNotFoundPathError, z as isPathInside } from "./run-with-concurrency-5DMu9szx.js";
+import { l as expandHomePrefix } from "./paths-8xF5kDne.js";
+import { i as logWarn } from "./logger-DDdrdbDu.js";
+import { n as assertNoPathAliasEscape } from "./path-alias-guards-gBhrAn14.js";
 import { constants } from "node:fs";
+import path from "node:path";
+import os from "node:os";
 import fs$1 from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { pipeline } from "node:stream/promises";

package/dist/plugin-sdk/{image-4ay2cw7G.js → image-FK5xhY5u.js}

@@ -1,8 +1,8 @@
-import { U as resolveAgentModelFallbackValues, W as resolveAgentModelPrimaryValue } from "./run-with-concurrency-DmTrN5JG.js";
-import { $t as resolveImplicitProviders, Fn as resolveSquidClawAgentDir, Hn as normalizeSecretInput, Mt as applyConfigEnvVars, Qt as resolveImplicitCopilotProvider, Xt as normalizeProviders, Zt as resolveImplicitBedrockProvider, cn as getApiKeyForModel, n as loadConfig, un as requireApiKey } from "./config-CnZ1TlEw.js";
-import { f as isRecord, x as shortenHomeInString } from "./logger-DIb2cGHp.js";
-import { N as sanitizeUserFacingText } from "./pi-embedded-helpers-BioULNev.js";
-import { n as redactToolDetail } from "./redact-9WsNyb7S.js";
+import { U as resolveAgentModelFallbackValues, W as resolveAgentModelPrimaryValue } from "./run-with-concurrency-kVooFCVo.js";
+import { $t as resolveImplicitProviders, Fn as resolveSquidClawAgentDir, Hn as normalizeSecretInput, Mt as applyConfigEnvVars, Qt as resolveImplicitCopilotProvider, Xt as normalizeProviders, Zt as resolveImplicitBedrockProvider, cn as getApiKeyForModel, n as loadConfig, un as requireApiKey } from "./config-Bt-c7PWF.js";
+import { f as isRecord, x as shortenHomeInString } from "./logger-Bg4vIUJn.js";
+import { N as sanitizeUserFacingText } from "./pi-embedded-helpers-CxMnPQ37.js";
+import { n as redactToolDetail } from "./redact-DfACyt0X.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import { complete } from "@mariozechner/pi-ai";
@@ -2254,7 +2254,7 @@ function resolveProviderVisionModelFromConfig(params) {
 //#region src/media-understanding/providers/image.ts
 let piModelDiscoveryRuntimePromise = null;
 function loadPiModelDiscoveryRuntime() {
-	piModelDiscoveryRuntimePromise ??= import("./pi-model-discovery-runtime-COnuGwZt.js");
+	piModelDiscoveryRuntimePromise ??= import("./pi-model-discovery-runtime-DGRFpUfd.js");
 	return piModelDiscoveryRuntimePromise;
 }
 async function describeImageWithModel(params) {