vigthoria-cli 1.13.18 → 1.13.22

package/dist/utils/mutation-journal.js

@@ -0,0 +1,387 @@
+import { createHash, randomUUID } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { assertSafeRelativePath, resolveWorkspacePath } from './workspace-boundary.js';
+const IGNORE_NAMES = new Set(['.git', 'node_modules', '.vigthoria']);
+const DEFAULT_MAX_BACKUP_BYTES = 128 * 1024 * 1024;
+const DEFAULT_MAX_FILE_BYTES = 16 * 1024 * 1024;
+const DEFAULT_MAX_FILES = 20_000;
+function hashFile(filePath) {
+    const hash = createHash('sha256');
+    const descriptor = fs.openSync(filePath, 'r');
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    try {
+        let bytesRead = 0;
+        do {
+            bytesRead = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+            if (bytesRead > 0)
+                hash.update(buffer.subarray(0, bytesRead));
+        } while (bytesRead > 0);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+    return hash.digest('hex');
+}
+export function createOperationId(value) {
+    const candidate = String(value || '').trim();
+    return /^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(candidate) ? candidate : randomUUID();
+}
+export class MutationJournal {
+    limits;
+    operationId;
+    rootPath;
+    manifestPath;
+    journalDirectory;
+    backupDirectory;
+    baseline = new Map();
+    baselineDirectories = new Set();
+    snapshotIssues = [];
+    status = 'open';
+    constructor(rootPath, requestedOperationId, limits = {
+        maxBackupBytes: DEFAULT_MAX_BACKUP_BYTES,
+        maxFileBytes: DEFAULT_MAX_FILE_BYTES,
+        maxFiles: DEFAULT_MAX_FILES,
+    }) {
+        this.limits = limits;
+        this.rootPath = fs.realpathSync(path.resolve(rootPath));
+        this.operationId = createOperationId(requestedOperationId);
+        this.captureBaselineDirectories();
+        this.journalDirectory = resolveWorkspacePath(this.rootPath, `.vigthoria/mutation-journal/${this.operationId}`, { allowMissing: true });
+        this.backupDirectory = path.join(this.journalDirectory, 'backups');
+        this.manifestPath = path.join(this.journalDirectory, 'journal.json');
+        this.captureBaseline();
+        this.persist('open', [], [], false);
+    }
+    listWorkspaceDirectories() {
+        const directories = [];
+        const walk = (directory) => {
+            let entries;
+            try {
+                entries = fs.readdirSync(directory, { withFileTypes: true });
+            }
+            catch {
+                return;
+            }
+            for (const entry of entries) {
+                if (IGNORE_NAMES.has(entry.name) || !entry.isDirectory())
+                    continue;
+                const absolute = path.join(directory, entry.name);
+                directories.push(path.relative(this.rootPath, absolute).replace(/\\/g, '/'));
+                walk(absolute);
+            }
+        };
+        walk(this.rootPath);
+        return directories;
+    }
+    captureBaselineDirectories() {
+        for (const directory of this.listWorkspaceDirectories())
+            this.baselineDirectories.add(directory);
+    }
+    listWorkspaceFiles() {
+        const files = [];
+        const walk = (directory) => {
+            let entries;
+            try {
+                entries = fs.readdirSync(directory, { withFileTypes: true });
+            }
+            catch (error) {
+                files.push({ relativePath: path.relative(this.rootPath, directory).replace(/\\/g, '/') || '.', absolutePath: directory, kind: 'unreadable', issue: `unreadable directory: ${error.message}` });
+                return;
+            }
+            for (const entry of entries) {
+                if (IGNORE_NAMES.has(entry.name))
+                    continue;
+                const absolutePath = path.join(directory, entry.name);
+                const relativePath = path.relative(this.rootPath, absolutePath).replace(/\\/g, '/');
+                if (entry.isSymbolicLink()) {
+                    files.push({ relativePath, absolutePath, kind: 'symlink' });
+                }
+                else if (entry.isDirectory()) {
+                    walk(absolutePath);
+                }
+                else if (entry.isFile()) {
+                    files.push({ relativePath, absolutePath, kind: 'file' });
+                }
+                else {
+                    files.push({ relativePath, absolutePath, kind: 'special', issue: 'special file' });
+                }
+            }
+        };
+        walk(this.rootPath);
+        return files;
+    }
+    captureBaseline() {
+        const files = this.listWorkspaceFiles();
+        let backupBytes = 0;
+        let backedFiles = 0;
+        for (const file of files) {
+            if (file.kind === 'symlink') {
+                try {
+                    const linkTarget = fs.readlinkSync(file.absolutePath);
+                    let linkType = 'file';
+                    try {
+                        if (fs.statSync(file.absolutePath).isDirectory())
+                            linkType = process.platform === 'win32' ? 'junction' : 'dir';
+                    }
+                    catch {
+                        // A dangling link is still preserved exactly; file is the portable
+                        // recreation default where the target type cannot be determined.
+                    }
+                    this.baseline.set(file.relativePath, {
+                        path: file.relativePath,
+                        kind: 'symlink',
+                        size: Buffer.byteLength(linkTarget),
+                        sha256: createHash('sha256').update(linkTarget).digest('hex'),
+                        linkTarget,
+                        linkType,
+                    });
+                }
+                catch (error) {
+                    this.snapshotIssues.push(`${file.relativePath}: link snapshot failed: ${error.message}`);
+                }
+                continue;
+            }
+            if (file.issue) {
+                this.snapshotIssues.push(`${file.relativePath}: ${file.issue}`);
+                continue;
+            }
+            try {
+                const stat = fs.statSync(file.absolutePath);
+                const baseline = {
+                    path: file.relativePath,
+                    kind: 'file',
+                    size: stat.size,
+                    sha256: hashFile(file.absolutePath),
+                    mode: stat.mode & 0o777,
+                };
+                if (backedFiles >= this.limits.maxFiles
+                    || stat.size > this.limits.maxFileBytes
+                    || backupBytes + stat.size > this.limits.maxBackupBytes) {
+                    this.snapshotIssues.push(`${file.relativePath}: rollback backup limit exceeded (${stat.size} bytes)`);
+                }
+                else {
+                    fs.mkdirSync(this.backupDirectory, { recursive: true, mode: 0o700 });
+                    const backupName = `${createHash('sha256').update(file.relativePath).digest('hex')}.bin`;
+                    baseline.backupPath = path.join(this.backupDirectory, backupName);
+                    fs.copyFileSync(file.absolutePath, baseline.backupPath, fs.constants.COPYFILE_EXCL);
+                    fs.chmodSync(baseline.backupPath, 0o600);
+                    backupBytes += stat.size;
+                    backedFiles += 1;
+                }
+                this.baseline.set(file.relativePath, baseline);
+            }
+            catch (error) {
+                this.snapshotIssues.push(`${file.relativePath}: snapshot failed: ${error.message}`);
+            }
+        }
+    }
+    changedPaths() {
+        const changed = new Set();
+        const current = new Map(this.listWorkspaceFiles().map((file) => [file.relativePath, file]));
+        for (const [relativePath, baseline] of this.baseline) {
+            const file = current.get(relativePath);
+            if (!file || file.issue || file.kind !== baseline.kind) {
+                changed.add(relativePath);
+                continue;
+            }
+            try {
+                if (baseline.kind === 'symlink') {
+                    const target = fs.readlinkSync(file.absolutePath);
+                    if (target !== baseline.linkTarget)
+                        changed.add(relativePath);
+                }
+                else {
+                    const stat = fs.statSync(file.absolutePath);
+                    if (stat.size !== baseline.size || hashFile(file.absolutePath) !== baseline.sha256)
+                        changed.add(relativePath);
+                }
+            }
+            catch {
+                changed.add(relativePath);
+            }
+        }
+        for (const [relativePath] of current) {
+            if (!this.baseline.has(relativePath))
+                changed.add(relativePath);
+        }
+        return [...changed].sort();
+    }
+    hasMutations() {
+        return this.changedPaths().length > 0;
+    }
+    resolveRollbackDestination(relativePath) {
+        const safe = assertSafeRelativePath(relativePath);
+        const segments = safe.split('/');
+        const name = segments.pop();
+        const parentRelative = segments.join('/');
+        const parent = parentRelative
+            ? resolveWorkspacePath(this.rootPath, parentRelative, { allowMissing: true })
+            : this.rootPath;
+        fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const parentReal = fs.realpathSync(parent);
+        const relativeParent = path.relative(this.rootPath, parentReal);
+        if (relativeParent === '..' || relativeParent.startsWith(`..${path.sep}`) || path.isAbsolute(relativeParent)) {
+            throw new Error('rollback parent escaped workspace');
+        }
+        return path.join(parentReal, name);
+    }
+    removeRollbackDestination(destination) {
+        try {
+            const stat = fs.lstatSync(destination);
+            if (stat.isDirectory() && !stat.isSymbolicLink()) {
+                fs.rmSync(destination, { recursive: true, force: true });
+            }
+            else {
+                fs.unlinkSync(destination);
+            }
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    persist(status, affectedPaths, rollbackFailures, rolledBack) {
+        this.status = status;
+        fs.mkdirSync(this.journalDirectory, { recursive: true, mode: 0o700 });
+        const payload = {
+            schemaVersion: 1,
+            operationId: this.operationId,
+            workspace: this.rootPath,
+            status,
+            affectedPaths,
+            rolledBack,
+            partialMutation: status === 'partial_mutation',
+            rollbackFailures,
+            snapshotIssues: this.snapshotIssues,
+            updatedAt: new Date().toISOString(),
+        };
+        const temporary = `${this.manifestPath}.tmp-${randomUUID()}`;
+        try {
+            fs.writeFileSync(temporary, `${JSON.stringify(payload, null, 2)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            fs.renameSync(temporary, this.manifestPath);
+        }
+        finally {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch (error) {
+                if (error?.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+    }
+    report(affectedPaths, rollbackFailures, rolledBack) {
+        return {
+            operationId: this.operationId,
+            status: this.status,
+            affectedPaths,
+            rolledBack,
+            partialMutation: this.status === 'partial_mutation',
+            rollbackFailures,
+            snapshotIssues: [...this.snapshotIssues],
+            manifestPath: this.manifestPath,
+        };
+    }
+    commit() {
+        const affectedPaths = this.changedPaths();
+        this.persist('committed', affectedPaths, [], false);
+        fs.rmSync(this.backupDirectory, { recursive: true, force: true });
+        return this.report(affectedPaths, [], false);
+    }
+    rollback() {
+        const affectedPaths = this.changedPaths();
+        const failures = [];
+        for (const relativePath of affectedPaths.filter((entry) => !this.baseline.has(entry))) {
+            try {
+                const safe = assertSafeRelativePath(relativePath);
+                const absolute = path.resolve(this.rootPath, ...safe.split('/'));
+                const relative = path.relative(this.rootPath, absolute);
+                if (relative.startsWith('..') || path.isAbsolute(relative))
+                    throw new Error('path escaped workspace');
+                try {
+                    fs.lstatSync(absolute);
+                    fs.unlinkSync(absolute);
+                }
+                catch (error) {
+                    if (error?.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+            catch (error) {
+                failures.push(`${relativePath}: could not remove created file: ${error.message}`);
+            }
+        }
+        for (const relativePath of affectedPaths.filter((entry) => this.baseline.has(entry))) {
+            const baseline = this.baseline.get(relativePath);
+            if (baseline.kind === 'file' && (!baseline.backupPath || !fs.existsSync(baseline.backupPath))) {
+                failures.push(`${relativePath}: rollback backup unavailable`);
+                continue;
+            }
+            try {
+                const destination = this.resolveRollbackDestination(relativePath);
+                this.removeRollbackDestination(destination);
+                if (baseline.kind === 'symlink') {
+                    if (baseline.linkTarget === undefined)
+                        throw new Error('rollback link target unavailable');
+                    fs.symlinkSync(baseline.linkTarget, destination, baseline.linkType);
+                }
+                else {
+                    if (!baseline.backupPath || !fs.existsSync(baseline.backupPath))
+                        throw new Error('rollback backup unavailable');
+                    const temporary = `${destination}.rollback-${randomUUID()}`;
+                    try {
+                        fs.copyFileSync(baseline.backupPath, temporary, fs.constants.COPYFILE_EXCL);
+                        fs.chmodSync(temporary, baseline.mode ?? 0o600);
+                        fs.renameSync(temporary, destination);
+                    }
+                    finally {
+                        try {
+                            fs.unlinkSync(temporary);
+                        }
+                        catch (error) {
+                            if (error?.code !== 'ENOENT')
+                                throw error;
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                failures.push(`${relativePath}: restore failed: ${error.message}`);
+            }
+        }
+        for (const relativePath of [...this.baselineDirectories].sort((a, b) => a.length - b.length)) {
+            try {
+                fs.mkdirSync(resolveWorkspacePath(this.rootPath, relativePath, { allowMissing: true }), { recursive: true });
+            }
+            catch (error) {
+                failures.push(`${relativePath}: directory restore failed: ${error.message}`);
+            }
+        }
+        for (const relativePath of this.listWorkspaceDirectories().sort((a, b) => b.length - a.length)) {
+            if (this.baselineDirectories.has(relativePath))
+                continue;
+            try {
+                const directory = resolveWorkspacePath(this.rootPath, relativePath);
+                if (fs.readdirSync(directory).length === 0)
+                    fs.rmdirSync(directory);
+            }
+            catch (error) {
+                failures.push(`${relativePath}: created directory remains: ${error.message}`);
+            }
+        }
+        const residual = this.changedPaths();
+        for (const relativePath of residual) {
+            if (!failures.some((failure) => failure.startsWith(`${relativePath}:`))) {
+                failures.push(`${relativePath}: mutation remains after rollback`);
+            }
+        }
+        const partial = failures.length > 0;
+        this.persist(partial ? 'partial_mutation' : 'rolled_back', affectedPaths, failures, !partial);
+        fs.rmSync(this.backupDirectory, { recursive: true, force: true });
+        return this.report(affectedPaths, failures, !partial);
+    }
+}
+export function finalizeMutationTransaction(journal, proofSucceeded) {
+    return proofSucceeded ? journal.commit() : journal.rollback();
+}

package/dist/utils/network-policy.d.ts

@@ -0,0 +1,24 @@
+import type { AxiosInstance } from 'axios';
+export { redactSensitiveText } from './secret-policy.js';
+export type EndpointAudience = 'auto' | 'coder' | 'models' | 'hub' | 'community' | 'music' | 'brain-hub' | 'mcp' | 'v3' | 'template' | 'hyperloop' | 'vigflow' | 'bridge' | 'release' | 'public';
+export declare const DEFAULT_NETWORK_TIMEOUT_MS = 30000;
+export declare class NetworkPolicyError extends Error {
+    readonly code: 'offline' | 'untrusted_endpoint' | 'credential_audience' | 'unsafe_redirect';
+    constructor(code: NetworkPolicyError['code'], message: string);
+}
+export declare function isOfflineNetworkMode(): boolean;
+export declare function isExplicitLoopbackEnabled(): boolean;
+export declare function assertTrustedEndpoint(raw: string, options?: {
+    audience?: EndpointAudience;
+    credentialBearing?: boolean;
+    websocket?: boolean;
+    ignoreOffline?: boolean;
+}): URL;
+export declare function assertTrustedWebSocketEndpoint(raw: string, audience?: EndpointAudience, credentialBearing?: boolean, ignoreOffline?: boolean): URL;
+export declare function guardedFetch(input: string | URL | Request, init?: RequestInit, options?: {
+    audience?: EndpointAudience;
+    maxRedirects?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<Response>;
+export declare function installGlobalFetchPolicy(): void;
+export declare function installAxiosNetworkPolicy(instance: AxiosInstance, audience?: EndpointAudience): void;

package/dist/utils/network-policy.js

@@ -0,0 +1,202 @@
+import { redactSensitiveText } from './secret-policy.js';
+export { redactSensitiveText } from './secret-policy.js';
+const AUDIENCE_HOSTS = {
+    coder: new Set(['coder.vigthoria.io']),
+    models: new Set(['api.vigthoria.io']),
+    hub: new Set(['api.vigthoria.io']),
+    community: new Set(['community.vigthoria.io']),
+    music: new Set(['music.vigthoria.io']),
+    'brain-hub': new Set(['coder.vigthoria.io']),
+    mcp: new Set(['coder.vigthoria.io', 'mcp.vigthoria.io']),
+    v3: new Set(['coder.vigthoria.io']),
+    template: new Set(['coder.vigthoria.io', 'template.vigthoria.io']),
+    hyperloop: new Set(['coder.vigthoria.io', 'hyperloop.vigthoria.io']),
+    vigflow: new Set(['coder.vigthoria.io', 'vigflow.vigthoria.io']),
+    bridge: new Set(['bridge.vigthoria.io', 'devtools.vigthoria.io']),
+    release: new Set([
+        'extension.vigthoria.io',
+        'landing.vigthoria.io',
+        'cli.vigthoria.io',
+        'coder.vigthoria.io',
+        'market.vigthoria.io',
+        'registry.npmjs.org',
+    ]),
+};
+// `auto` exists only as a compatibility guard for legacy calls to the primary
+// Coder origin. It must never mean "any Vigthoria host": doing so allows a
+// credential intended for one service to be forwarded to another trusted but
+// unrelated service. Every non-Coder credential-bearing transport must name
+// its audience explicitly.
+const AUTO_CREDENTIAL_HOSTS = AUDIENCE_HOSTS.coder;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+const LOOPBACK_PORTS = new Set(['4008', '4009', '4011', '4016', '49160', '8030', '8020', '5060', '5050', '8016', '9000']);
+const SENSITIVE_HEADER_NAMES = new Set(['authorization', 'cookie', 'proxy-authorization', 'x-api-key', 'x-service-key']);
+export const DEFAULT_NETWORK_TIMEOUT_MS = 30_000;
+export class NetworkPolicyError extends Error {
+    code;
+    constructor(code, message) {
+        super(redactSensitiveText(message));
+        this.name = 'NetworkPolicyError';
+        this.code = code;
+    }
+}
+export function isOfflineNetworkMode() {
+    return process.env.VIGTHORIA_OFFLINE === '1';
+}
+export function isExplicitLoopbackEnabled() {
+    return process.env.VIGTHORIA_ALLOW_LOOPBACK === '1'
+        || process.env.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1'
+        || process.env.VIGTHORIA_LOCAL_TEST_MODE === '1';
+}
+function normalizePort(url) {
+    if (url.port)
+        return url.port;
+    if (url.protocol === 'https:' || url.protocol === 'wss:')
+        return '443';
+    if (url.protocol === 'http:' || url.protocol === 'ws:')
+        return '80';
+    return '';
+}
+function isLoopback(url) {
+    return LOOPBACK_HOSTS.has(url.hostname.toLowerCase());
+}
+function isAllowedLoopback(url) {
+    return isExplicitLoopbackEnabled() && LOOPBACK_PORTS.has(normalizePort(url));
+}
+function parseEndpoint(raw) {
+    const value = String(raw || '').trim();
+    if (!value || /[\\\u0000-\u001f\u007f]/.test(value)) {
+        throw new NetworkPolicyError('untrusted_endpoint', 'Endpoint contains invalid or ambiguous characters');
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new NetworkPolicyError('untrusted_endpoint', 'Endpoint is not a valid absolute URL');
+    }
+    if (parsed.username || parsed.password) {
+        throw new NetworkPolicyError('untrusted_endpoint', 'Endpoint user information is prohibited');
+    }
+    return parsed;
+}
+export function assertTrustedEndpoint(raw, options = {}) {
+    if (isOfflineNetworkMode() && options.ignoreOffline !== true) {
+        throw new NetworkPolicyError('offline', 'Network access is disabled by offline mode');
+    }
+    const parsed = parseEndpoint(raw);
+    const websocket = options.websocket === true;
+    const secureProtocol = websocket ? 'wss:' : 'https:';
+    const insecureProtocol = websocket ? 'ws:' : 'http:';
+    if (parsed.protocol !== secureProtocol && parsed.protocol !== insecureProtocol) {
+        throw new NetworkPolicyError('untrusted_endpoint', `Unsupported endpoint protocol: ${parsed.protocol}`);
+    }
+    if (parsed.protocol === insecureProtocol && !isAllowedLoopback(parsed)) {
+        throw new NetworkPolicyError('untrusted_endpoint', 'Insecure endpoints require explicit loopback opt-in on an approved port');
+    }
+    if (isLoopback(parsed) && !isAllowedLoopback(parsed)) {
+        throw new NetworkPolicyError('untrusted_endpoint', 'Loopback endpoints require explicit opt-in on an approved port');
+    }
+    const audience = options.audience || 'auto';
+    const credentialBearing = options.credentialBearing === true;
+    if (audience !== 'public' && audience !== 'auto' && !isLoopback(parsed)) {
+        const allowed = AUDIENCE_HOSTS[audience];
+        if (!allowed.has(parsed.hostname.toLowerCase()) || normalizePort(parsed) !== '443') {
+            throw new NetworkPolicyError('credential_audience', `Endpoint is outside the ${audience} credential audience`);
+        }
+    }
+    if (credentialBearing && audience === 'auto' && !isLoopback(parsed)) {
+        if (!AUTO_CREDENTIAL_HOSTS.has(parsed.hostname.toLowerCase()) || normalizePort(parsed) !== '443') {
+            throw new NetworkPolicyError('credential_audience', 'Credential-bearing request requires an explicit service audience');
+        }
+    }
+    return parsed;
+}
+export function assertTrustedWebSocketEndpoint(raw, audience = 'bridge', credentialBearing = false, ignoreOffline = false) {
+    return assertTrustedEndpoint(raw, { audience, credentialBearing, websocket: true, ignoreOffline });
+}
+function headerEntries(headers) {
+    if (!headers)
+        return [];
+    return [...new Headers(headers).entries()];
+}
+function hasSensitiveHeaders(headers) {
+    return headerEntries(headers).some(([name]) => SENSITIVE_HEADER_NAMES.has(name.toLowerCase()));
+}
+function stripSensitiveHeaders(headers) {
+    const result = new Headers(headers);
+    for (const name of SENSITIVE_HEADER_NAMES)
+        result.delete(name);
+    return result;
+}
+export async function guardedFetch(input, init = {}, options = {}) {
+    const implementation = options.fetchImpl
+        || (globalFetchWrapper && globalThis.fetch === globalFetchWrapper ? nativeFetchImplementation : globalThis.fetch)
+        || globalThis.fetch;
+    const initialUrl = input instanceof Request ? input.url : String(input);
+    let current = assertTrustedEndpoint(initialUrl, {
+        audience: options.audience,
+        credentialBearing: hasSensitiveHeaders(init.headers || (input instanceof Request ? input.headers : undefined)),
+    });
+    let headers = new Headers(init.headers || (input instanceof Request ? input.headers : undefined));
+    const credentialBearing = hasSensitiveHeaders(headers);
+    const maxRedirects = options.maxRedirects ?? 5;
+    const signal = init.signal || AbortSignal.timeout(DEFAULT_NETWORK_TIMEOUT_MS);
+    for (let redirects = 0; redirects <= maxRedirects; redirects += 1) {
+        const response = await implementation(current, { ...init, headers, signal, redirect: 'manual' });
+        if (![301, 302, 303, 307, 308].includes(response.status))
+            return response;
+        const location = response.headers.get('location');
+        if (!location)
+            throw new NetworkPolicyError('unsafe_redirect', 'Redirect response omitted its destination');
+        if (redirects === maxRedirects)
+            throw new NetworkPolicyError('unsafe_redirect', 'Maximum redirect count exceeded');
+        const next = new URL(location, current);
+        assertTrustedEndpoint(next.toString(), { audience: options.audience, credentialBearing });
+        if (next.origin !== current.origin) {
+            if (credentialBearing) {
+                throw new NetworkPolicyError('unsafe_redirect', 'Cross-origin redirect of a credential-bearing request is prohibited');
+            }
+            headers = stripSensitiveHeaders(headers);
+        }
+        current = next;
+    }
+    throw new NetworkPolicyError('unsafe_redirect', 'Redirect validation failed');
+}
+let globalFetchInstalled = false;
+let nativeFetchImplementation = null;
+let globalFetchWrapper = null;
+export function installGlobalFetchPolicy() {
+    if (globalFetchInstalled || typeof globalThis.fetch !== 'function')
+        return;
+    const nativeFetch = globalThis.fetch.bind(globalThis);
+    nativeFetchImplementation = nativeFetch;
+    globalFetchWrapper = ((input, init) => guardedFetch(input, init, { fetchImpl: nativeFetch }));
+    globalThis.fetch = globalFetchWrapper;
+    globalFetchInstalled = true;
+}
+function resolveAxiosUrl(config) {
+    const direct = String(config.url || '');
+    const base = String(config.baseURL || '');
+    if (/^https?:\/\//i.test(direct))
+        return direct;
+    return new URL(direct || '', base).toString();
+}
+function axiosHasCredentials(config) {
+    return Object.keys(config.headers || {}).some((name) => SENSITIVE_HEADER_NAMES.has(name.toLowerCase()));
+}
+const installedAxios = new WeakSet();
+export function installAxiosNetworkPolicy(instance, audience = 'auto') {
+    if (installedAxios.has(instance))
+        return;
+    installedAxios.add(instance);
+    instance.interceptors.request.use((config) => {
+        const endpoint = resolveAxiosUrl(config);
+        assertTrustedEndpoint(endpoint, { audience, credentialBearing: axiosHasCredentials(config) });
+        config.maxRedirects = axiosHasCredentials(config) ? 0 : Math.min(config.maxRedirects ?? 5, 5);
+        if (!Number.isFinite(Number(config.timeout)) || Number(config.timeout) <= 0) {
+            config.timeout = DEFAULT_NETWORK_TIMEOUT_MS;
+        }
+        return config;
+    });
+}

package/dist/utils/operator-client.d.ts

@@ -0,0 +1,45 @@
+export interface OperatorWorkflowResponse {
+    content: string;
+    workflowId: string | null;
+    contextId?: string | null;
+    backendUrl: string;
+    savedWorkflow?: {
+        id: string;
+        name?: string | null;
+        sourceWorkflowId?: string | null;
+    } | null;
+    metadata?: Record<string, unknown>;
+    changedFiles?: Record<string, string>;
+}
+export declare class OperatorClientError extends Error {
+    readonly category: 'timeout' | 'model_backend';
+    constructor(message: string, category: 'timeout' | 'model_backend');
+}
+export interface OperatorRunInput {
+    message: string;
+    executionContext: Record<string, any>;
+    workspaceAlias: string;
+    workspaceSummary: Record<string, any> | null;
+    requestedModel: string;
+    resolvedModel: string;
+    timeoutMs: number;
+    onStreamEvent?: (event: Record<string, any>) => void;
+}
+export interface OperatorClientDependencies {
+    getBaseUrls(): string[];
+    getAuthToken(): string | null;
+    fetch(input: string, init: RequestInit): Promise<Response>;
+    sanitizeError(text: string): string;
+}
+export declare class OperatorClient {
+    private readonly dependencies;
+    constructor(dependencies: OperatorClientDependencies);
+    formatResponse(data?: {
+        summary?: string;
+        details?: any;
+        completed_agents?: string[];
+        answer?: string;
+        result?: string;
+    }): string;
+    run(input: OperatorRunInput): Promise<OperatorWorkflowResponse>;
+}