squidclaw 3.0.23 → 3.0.24

package/dist/plugin-sdk/slash-commands.runtime-BzYsaTST.js

@@ -0,0 +1,13 @@
+import "./run-with-concurrency-5DMu9szx.js";
+import "./accounts-D0W2pELU.js";
+import "./paths-8xF5kDne.js";
+import "./github-copilot-token-Dy-0-Kh3.js";
+import "./config-B2B64aX0.js";
+import "./logger-DDdrdbDu.js";
+import "./thinking-BgdUnMZ2.js";
+import "./plugins-BN64HHZA.js";
+import "./accounts-ucj0odJq.js";
+import "./accounts-CUEuUR3C.js";
+import { f as resolveCommandArgMenu, n as findCommandByNativeName, s as listNativeCommandSpecsForConfig, t as buildCommandTextFromArgs, u as parseCommandArgs } from "./commands-registry-e7YoqrbP.js";
+
+export { buildCommandTextFromArgs, findCommandByNativeName, listNativeCommandSpecsForConfig, parseCommandArgs, resolveCommandArgMenu };

package/dist/plugin-sdk/slash-dispatch.runtime-Cty8EAD9.js

@@ -0,0 +1,52 @@
+import "./run-with-concurrency-5DMu9szx.js";
+import "./accounts-D0W2pELU.js";
+import { N as finalizeInboundContext, X as createReplyPrefixOptions, a as deliverSlackSlashReplies, m as dispatchReplyWithDispatcher, n as recordInboundSessionMetaSafe, v as resolveAgentRoute } from "./reply-Bp49JV3f.js";
+import "./paths-8xF5kDne.js";
+import "./github-copilot-token-Dy-0-Kh3.js";
+import "./config-B2B64aX0.js";
+import "./logger-DDdrdbDu.js";
+import "./thinking-BgdUnMZ2.js";
+import "./image-ops-BP8ix1GC.js";
+import { rn as resolveConversationLabel } from "./pi-embedded-helpers-BExwPvTh.js";
+import "./plugins-BN64HHZA.js";
+import "./accounts-ucj0odJq.js";
+import "./accounts-CUEuUR3C.js";
+import "./send-Dm_-_xje.js";
+import "./paths-C6W4VHoa.js";
+import "./fetch-B_RcOnt9.js";
+import "./redact-BoNEjbpF.js";
+import "./errors-B8oJXuCF.js";
+import "./channel-activity-BMWLw4o2.js";
+import "./path-alias-guards-gBhrAn14.js";
+import "./fs-safe-Dqmpk-Fr.js";
+import "./ssrf-DOBwjFow.js";
+import "./fetch-guard-F0Fnqisy.js";
+import "./local-roots-BIPT8uAO.js";
+import { d as resolveChunkMode, i as resolveMarkdownTableMode } from "./ir-DWEc6zOp.js";
+import "./render-HmipMDlP.js";
+import "./tables-GIj79us5.js";
+import "./send-DCuaaP2w.js";
+import "./send-BxySs-Cu.js";
+import "./tool-images-GSlvf6RP.js";
+import "./target-errors-jlLHihbX.js";
+import "./send-D9THKp_J.js";
+import "./audio-transcription-runner-DnEooIyE.js";
+import "./tokens-CTIYTLWu.js";
+import "./skill-commands-DRvqtuFC.js";
+import "./skills-BWwlfbVj.js";
+import "./chrome-CV-q0Lmc.js";
+import "./deliver-BkyBtcLR.js";
+import "./diagnostic-DPRVoKTk.js";
+import "./store-BKDR_-Qk.js";
+import "./commands-registry-e7YoqrbP.js";
+import "./image-cBW8L8pp.js";
+import "./api-key-rotation-C4C_mDsg.js";
+import "./proxy-fetch-ZPEvp58f.js";
+import "./pi-model-discovery-DdctvBeX.js";
+import "./send-B9xnwtQ-.js";
+import "./outbound-attachment-DLsaxDsc.js";
+import "./proxy-BKdNrmWL.js";
+import "./manager-BD-aYaZ8.js";
+import "./query-expansion-eeVz_aEm.js";
+
+export { createReplyPrefixOptions, deliverSlackSlashReplies, dispatchReplyWithDispatcher, finalizeInboundContext, recordInboundSessionMetaSafe, resolveAgentRoute, resolveChunkMode, resolveConversationLabel, resolveMarkdownTableMode };

package/dist/plugin-sdk/slash-skill-commands.runtime-sg98L8BK.js

@@ -0,0 +1,16 @@
+import "./run-with-concurrency-5DMu9szx.js";
+import "./accounts-D0W2pELU.js";
+import "./paths-8xF5kDne.js";
+import "./github-copilot-token-Dy-0-Kh3.js";
+import "./config-B2B64aX0.js";
+import "./logger-DDdrdbDu.js";
+import "./thinking-BgdUnMZ2.js";
+import "./plugins-BN64HHZA.js";
+import "./accounts-ucj0odJq.js";
+import "./accounts-CUEuUR3C.js";
+import "./path-alias-guards-gBhrAn14.js";
+import { n as listSkillCommandsForAgents } from "./skill-commands-DRvqtuFC.js";
+import "./skills-BWwlfbVj.js";
+import "./commands-registry-e7YoqrbP.js";
+
+export { listSkillCommandsForAgents };

package/dist/plugin-sdk/ssrf-DOBwjFow.js

@@ -0,0 +1,202 @@
+import { $ as parseCanonicalIpAddress, G as isBlockedSpecialUseIpv4Address, J as isIpv4Address, K as isBlockedSpecialUseIpv6Address, W as extractEmbeddedIpv4FromIpv6, Y as isLegacyIpv4Literal, et as parseLooseIpAddress, q as isCanonicalDottedDecimalIPv4 } from "./config-B2B64aX0.js";
+import { Agent } from "undici";
+import { lookup } from "node:dns";
+import { lookup as lookup$1 } from "node:dns/promises";
+
+//#region src/infra/net/proxy-env.ts
+const PROXY_ENV_KEYS = [
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"ALL_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"all_proxy"
+];
+function hasProxyEnvConfigured(env = process.env) {
+	for (const key of PROXY_ENV_KEYS) {
+		const value = env[key];
+		if (typeof value === "string" && value.trim().length > 0) return true;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/infra/net/hostname.ts
+function normalizeHostname(hostname) {
+	const normalized = hostname.trim().toLowerCase().replace(/\.$/, "");
+	if (normalized.startsWith("[") && normalized.endsWith("]")) return normalized.slice(1, -1);
+	return normalized;
+}
+
+//#endregion
+//#region src/infra/net/ssrf.ts
+var SsrFBlockedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SsrFBlockedError";
+	}
+};
+const BLOCKED_HOSTNAMES = new Set([
+	"localhost",
+	"localhost.localdomain",
+	"metadata.google.internal"
+]);
+function normalizeHostnameSet(values) {
+	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
+	return new Set(values.map((value) => normalizeHostname(value)).filter(Boolean));
+}
+function normalizeHostnameAllowlist(values) {
+	if (!values || values.length === 0) return [];
+	return Array.from(new Set(values.map((value) => normalizeHostname(value)).filter((value) => value !== "*" && value !== "*." && value.length > 0)));
+}
+function isPrivateNetworkAllowedByPolicy(policy) {
+	return policy?.dangerouslyAllowPrivateNetwork === true || policy?.allowPrivateNetwork === true;
+}
+function resolveIpv4SpecialUseBlockOptions(policy) {
+	return { allowRfc2544BenchmarkRange: policy?.allowRfc2544BenchmarkRange === true };
+}
+function isHostnameAllowedByPattern(hostname, pattern) {
+	if (pattern.startsWith("*.")) {
+		const suffix = pattern.slice(2);
+		if (!suffix || hostname === suffix) return false;
+		return hostname.endsWith(`.${suffix}`);
+	}
+	return hostname === pattern;
+}
+function matchesHostnameAllowlist(hostname, allowlist) {
+	if (allowlist.length === 0) return true;
+	return allowlist.some((pattern) => isHostnameAllowedByPattern(hostname, pattern));
+}
+function looksLikeUnsupportedIpv4Literal(address) {
+	const parts = address.split(".");
+	if (parts.length === 0 || parts.length > 4) return false;
+	if (parts.some((part) => part.length === 0)) return true;
+	return parts.every((part) => /^[0-9]+$/.test(part) || /^0x/i.test(part));
+}
+function isPrivateIpAddress(address, policy) {
+	let normalized = address.trim().toLowerCase();
+	if (normalized.startsWith("[") && normalized.endsWith("]")) normalized = normalized.slice(1, -1);
+	if (!normalized) return false;
+	const blockOptions = resolveIpv4SpecialUseBlockOptions(policy);
+	const strictIp = parseCanonicalIpAddress(normalized);
+	if (strictIp) {
+		if (isIpv4Address(strictIp)) return isBlockedSpecialUseIpv4Address(strictIp, blockOptions);
+		if (isBlockedSpecialUseIpv6Address(strictIp)) return true;
+		const embeddedIpv4 = extractEmbeddedIpv4FromIpv6(strictIp);
+		if (embeddedIpv4) return isBlockedSpecialUseIpv4Address(embeddedIpv4, blockOptions);
+		return false;
+	}
+	if (normalized.includes(":") && !parseLooseIpAddress(normalized)) return true;
+	if (!isCanonicalDottedDecimalIPv4(normalized) && isLegacyIpv4Literal(normalized)) return true;
+	if (looksLikeUnsupportedIpv4Literal(normalized)) return true;
+	return false;
+}
+function isBlockedHostname(hostname) {
+	const normalized = normalizeHostname(hostname);
+	if (!normalized) return false;
+	return isBlockedHostnameNormalized(normalized);
+}
+function isBlockedHostnameNormalized(normalized) {
+	if (BLOCKED_HOSTNAMES.has(normalized)) return true;
+	return normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal");
+}
+function isBlockedHostnameOrIp(hostname, policy) {
+	const normalized = normalizeHostname(hostname);
+	if (!normalized) return false;
+	return isBlockedHostnameNormalized(normalized) || isPrivateIpAddress(normalized, policy);
+}
+const BLOCKED_HOST_OR_IP_MESSAGE = "Blocked hostname or private/internal/special-use IP address";
+const BLOCKED_RESOLVED_IP_MESSAGE = "Blocked: resolves to private/internal/special-use IP address";
+function assertAllowedHostOrIpOrThrow(hostnameOrIp, policy) {
+	if (isBlockedHostnameOrIp(hostnameOrIp, policy)) throw new SsrFBlockedError(BLOCKED_HOST_OR_IP_MESSAGE);
+}
+function assertAllowedResolvedAddressesOrThrow(results, policy) {
+	for (const entry of results) if (isBlockedHostnameOrIp(entry.address, policy)) throw new SsrFBlockedError(BLOCKED_RESOLVED_IP_MESSAGE);
+}
+function createPinnedLookup(params) {
+	const normalizedHost = normalizeHostname(params.hostname);
+	const fallback = params.fallback ?? lookup;
+	const fallbackLookup = fallback;
+	const fallbackWithOptions = fallback;
+	const records = params.addresses.map((address) => ({
+		address,
+		family: address.includes(":") ? 6 : 4
+	}));
+	let index = 0;
+	return ((host, options, callback) => {
+		const cb = typeof options === "function" ? options : callback;
+		if (!cb) return;
+		const normalized = normalizeHostname(host);
+		if (!normalized || normalized !== normalizedHost) {
+			if (typeof options === "function" || options === void 0) return fallbackLookup(host, cb);
+			return fallbackWithOptions(host, options, cb);
+		}
+		const opts = typeof options === "object" && options !== null ? options : {};
+		const requestedFamily = typeof options === "number" ? options : typeof opts.family === "number" ? opts.family : 0;
+		const candidates = requestedFamily === 4 || requestedFamily === 6 ? records.filter((entry) => entry.family === requestedFamily) : records;
+		const usable = candidates.length > 0 ? candidates : records;
+		if (opts.all) {
+			cb(null, usable);
+			return;
+		}
+		const chosen = usable[index % usable.length];
+		index += 1;
+		cb(null, chosen.address, chosen.family);
+	});
+}
+function dedupeAndPreferIpv4(results) {
+	const seen = /* @__PURE__ */ new Set();
+	const ipv4 = [];
+	const otherFamilies = [];
+	for (const entry of results) {
+		if (seen.has(entry.address)) continue;
+		seen.add(entry.address);
+		if (entry.family === 4) {
+			ipv4.push(entry.address);
+			continue;
+		}
+		otherFamilies.push(entry.address);
+	}
+	return [...ipv4, ...otherFamilies];
+}
+async function resolvePinnedHostnameWithPolicy(hostname, params = {}) {
+	const normalized = normalizeHostname(hostname);
+	if (!normalized) throw new Error("Invalid hostname");
+	const allowPrivateNetwork = isPrivateNetworkAllowedByPolicy(params.policy);
+	const allowedHostnames = normalizeHostnameSet(params.policy?.allowedHostnames);
+	const hostnameAllowlist = normalizeHostnameAllowlist(params.policy?.hostnameAllowlist);
+	const isExplicitAllowed = allowedHostnames.has(normalized);
+	const skipPrivateNetworkChecks = allowPrivateNetwork || isExplicitAllowed;
+	if (!matchesHostnameAllowlist(normalized, hostnameAllowlist)) throw new SsrFBlockedError(`Blocked hostname (not in allowlist): ${hostname}`);
+	if (!skipPrivateNetworkChecks) assertAllowedHostOrIpOrThrow(normalized, params.policy);
+	const results = await (params.lookupFn ?? lookup$1)(normalized, { all: true });
+	if (results.length === 0) throw new Error(`Unable to resolve hostname: ${hostname}`);
+	if (!skipPrivateNetworkChecks) assertAllowedResolvedAddressesOrThrow(results, params.policy);
+	const addresses = dedupeAndPreferIpv4(results);
+	if (addresses.length === 0) throw new Error(`Unable to resolve hostname: ${hostname}`);
+	return {
+		hostname: normalized,
+		addresses,
+		lookup: createPinnedLookup({
+			hostname: normalized,
+			addresses
+		})
+	};
+}
+function createPinnedDispatcher(pinned) {
+	return new Agent({ connect: { lookup: pinned.lookup } });
+}
+async function closeDispatcher(dispatcher) {
+	if (!dispatcher) return;
+	const candidate = dispatcher;
+	try {
+		if (typeof candidate.close === "function") {
+			await candidate.close();
+			return;
+		}
+		if (typeof candidate.destroy === "function") candidate.destroy();
+	} catch {}
+}
+
+//#endregion
+export { isBlockedHostnameOrIp as a, resolvePinnedHostnameWithPolicy as c, isBlockedHostname as i, normalizeHostname as l, closeDispatcher as n, isPrivateIpAddress as o, createPinnedDispatcher as r, isPrivateNetworkAllowedByPolicy as s, SsrFBlockedError as t, hasProxyEnvConfigured as u };

package/dist/plugin-sdk/store-BKDR_-Qk.js

@@ -0,0 +1,81 @@
+import { w as resolveConfigDir } from "./logger-DDdrdbDu.js";
+import { c as detectMime, l as extensionForMime } from "./image-ops-BP8ix1GC.js";
+import { createWriteStream } from "node:fs";
+import path from "node:path";
+import fs$1 from "node:fs/promises";
+import crypto from "node:crypto";
+import { pipeline } from "node:stream/promises";
+import { request } from "node:https";
+
+//#region src/media/store.ts
+const resolveMediaDir = () => path.join(resolveConfigDir(), "media");
+const MEDIA_MAX_BYTES = 5 * 1024 * 1024;
+const MAX_BYTES = MEDIA_MAX_BYTES;
+const DEFAULT_TTL_MS = 120 * 1e3;
+const MEDIA_FILE_MODE = 420;
+/**
+* Sanitize a filename for cross-platform safety.
+* Removes chars unsafe on Windows/SharePoint/all platforms.
+* Keeps: alphanumeric, dots, hyphens, underscores, Unicode letters/numbers.
+*/
+function sanitizeFilename(name) {
+	const trimmed = name.trim();
+	if (!trimmed) return "";
+	return trimmed.replace(/[^\p{L}\p{N}._-]+/gu, "_").replace(/_+/g, "_").replace(/^_|_$/g, "").slice(0, 60);
+}
+/**
+* Extract original filename from path if it matches the embedded format.
+* Pattern: {original}---{uuid}.{ext} → returns "{original}.{ext}"
+* Falls back to basename if no pattern match, or "file.bin" if empty.
+*/
+function extractOriginalFilename(filePath) {
+	const basename = path.basename(filePath);
+	if (!basename) return "file.bin";
+	const ext = path.extname(basename);
+	const match = path.basename(basename, ext).match(/^(.+)---[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i);
+	if (match?.[1]) return `${match[1]}${ext}`;
+	return basename;
+}
+function getMediaDir() {
+	return resolveMediaDir();
+}
+async function ensureMediaDir() {
+	const mediaDir = resolveMediaDir();
+	await fs$1.mkdir(mediaDir, {
+		recursive: true,
+		mode: 448
+	});
+	return mediaDir;
+}
+async function saveMediaBuffer(buffer, contentType, subdir = "inbound", maxBytes = MAX_BYTES, originalFilename) {
+	if (buffer.byteLength > maxBytes) throw new Error(`Media exceeds ${(maxBytes / (1024 * 1024)).toFixed(0)}MB limit`);
+	const dir = path.join(resolveMediaDir(), subdir);
+	await fs$1.mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const uuid = crypto.randomUUID();
+	const headerExt = extensionForMime(contentType?.split(";")[0]?.trim() ?? void 0);
+	const mime = await detectMime({
+		buffer,
+		headerMime: contentType
+	});
+	const ext = headerExt ?? extensionForMime(mime) ?? "";
+	let id;
+	if (originalFilename) {
+		const base = path.parse(originalFilename).name;
+		const sanitized = sanitizeFilename(base);
+		id = sanitized ? `${sanitized}---${uuid}${ext}` : `${uuid}${ext}`;
+	} else id = ext ? `${uuid}${ext}` : uuid;
+	const dest = path.join(dir, id);
+	await fs$1.writeFile(dest, buffer, { mode: MEDIA_FILE_MODE });
+	return {
+		id,
+		path: dest,
+		size: buffer.byteLength,
+		contentType: mime
+	};
+}
+
+//#endregion
+export { saveMediaBuffer as a, getMediaDir as i, ensureMediaDir as n, extractOriginalFilename as r, MEDIA_MAX_BYTES as t };

package/dist/plugin-sdk/subagent-registry-runtime-Dz50ieim.js

@@ -0,0 +1,52 @@
+import "./run-with-concurrency-5DMu9szx.js";
+import "./accounts-D0W2pELU.js";
+import { C as countPendingDescendantRunsExcludingRun, S as countPendingDescendantRuns, T as resolveRequesterForChildSession, w as isSubagentSessionRunActive, x as countActiveDescendantRuns } from "./reply-Bp49JV3f.js";
+import "./paths-8xF5kDne.js";
+import "./github-copilot-token-Dy-0-Kh3.js";
+import "./config-B2B64aX0.js";
+import "./logger-DDdrdbDu.js";
+import "./thinking-BgdUnMZ2.js";
+import "./image-ops-BP8ix1GC.js";
+import "./pi-embedded-helpers-BExwPvTh.js";
+import "./plugins-BN64HHZA.js";
+import "./accounts-ucj0odJq.js";
+import "./accounts-CUEuUR3C.js";
+import "./send-Dm_-_xje.js";
+import "./paths-C6W4VHoa.js";
+import "./fetch-B_RcOnt9.js";
+import "./redact-BoNEjbpF.js";
+import "./errors-B8oJXuCF.js";
+import "./channel-activity-BMWLw4o2.js";
+import "./path-alias-guards-gBhrAn14.js";
+import "./fs-safe-Dqmpk-Fr.js";
+import "./ssrf-DOBwjFow.js";
+import "./fetch-guard-F0Fnqisy.js";
+import "./local-roots-BIPT8uAO.js";
+import "./ir-DWEc6zOp.js";
+import "./render-HmipMDlP.js";
+import "./tables-GIj79us5.js";
+import "./send-DCuaaP2w.js";
+import "./send-BxySs-Cu.js";
+import "./tool-images-GSlvf6RP.js";
+import "./target-errors-jlLHihbX.js";
+import "./send-D9THKp_J.js";
+import "./audio-transcription-runner-DnEooIyE.js";
+import "./tokens-CTIYTLWu.js";
+import "./skill-commands-DRvqtuFC.js";
+import "./skills-BWwlfbVj.js";
+import "./chrome-CV-q0Lmc.js";
+import "./deliver-BkyBtcLR.js";
+import "./diagnostic-DPRVoKTk.js";
+import "./store-BKDR_-Qk.js";
+import "./commands-registry-e7YoqrbP.js";
+import "./image-cBW8L8pp.js";
+import "./api-key-rotation-C4C_mDsg.js";
+import "./proxy-fetch-ZPEvp58f.js";
+import "./pi-model-discovery-DdctvBeX.js";
+import "./send-B9xnwtQ-.js";
+import "./outbound-attachment-DLsaxDsc.js";
+import "./proxy-BKdNrmWL.js";
+import "./manager-BD-aYaZ8.js";
+import "./query-expansion-eeVz_aEm.js";
+
+export { countActiveDescendantRuns, countPendingDescendantRuns, countPendingDescendantRunsExcludingRun, isSubagentSessionRunActive, resolveRequesterForChildSession };

package/dist/plugin-sdk/tables-GIj79us5.js

@@ -0,0 +1,55 @@
+import { r as markdownToIRWithMeta } from "./ir-DWEc6zOp.js";
+import { t as renderMarkdownWithMarkers } from "./render-HmipMDlP.js";
+
+//#region src/markdown/tables.ts
+const MARKDOWN_STYLE_MARKERS = {
+	bold: {
+		open: "**",
+		close: "**"
+	},
+	italic: {
+		open: "_",
+		close: "_"
+	},
+	strikethrough: {
+		open: "~~",
+		close: "~~"
+	},
+	code: {
+		open: "`",
+		close: "`"
+	},
+	code_block: {
+		open: "```\n",
+		close: "```"
+	}
+};
+function convertMarkdownTables(markdown, mode) {
+	if (!markdown || mode === "off") return markdown;
+	const { ir, hasTables } = markdownToIRWithMeta(markdown, {
+		linkify: false,
+		autolink: false,
+		headingStyle: "none",
+		blockquotePrefix: "",
+		tableMode: mode
+	});
+	if (!hasTables) return markdown;
+	return renderMarkdownWithMarkers(ir, {
+		styleMarkers: MARKDOWN_STYLE_MARKERS,
+		escapeText: (text) => text,
+		buildLink: (link, text) => {
+			const href = link.href.trim();
+			if (!href) return null;
+			if (!text.slice(link.start, link.end)) return null;
+			return {
+				start: link.start,
+				end: link.end,
+				open: "[",
+				close: `](${href})`
+			};
+		}
+	});
+}
+
+//#endregion
+export { convertMarkdownTables as t };

package/dist/{target-errors-D0ZJUbbf.js → plugin-sdk/target-errors-jlLHihbX.js}

@@ -1,5 +1,5 @@
-import { b as detectMime } from "./image-ops-BoN1E_WZ.js";
-import { r as sanitizeToolResultImages } from "./tool-images-Zn6jVmkX.js";
+import { c as detectMime } from "./image-ops-BP8ix1GC.js";
+import { r as sanitizeToolResultImages } from "./tool-images-GSlvf6RP.js";
 import fs from "node:fs/promises";
 
 //#region src/agents/tools/common.ts