whale-code 6.5.6 → 6.5.8

package/dist/cli/services/rewind.test.js

@@ -0,0 +1,175 @@
+/**
+ * Tests for RewindManager — checkpoint tracking and file change tracking
+ */
+
+import { describe, it, expect, beforeEach, vi, afterEach } from "vitest";
+import { RewindManager } from "./rewind.js";
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from "fs";
+
+// Mock fs operations
+vi.mock("fs", () => ({
+  existsSync: vi.fn(),
+  readFileSync: vi.fn(),
+  writeFileSync: vi.fn(),
+  unlinkSync: vi.fn()
+}));
+const mockExistsSync = existsSync;
+const mockReadFileSync = readFileSync;
+const mockWriteFileSync = writeFileSync;
+const mockUnlinkSync = unlinkSync;
+describe("RewindManager", () => {
+  let manager;
+  beforeEach(() => {
+    manager = new RewindManager();
+    vi.clearAllMocks();
+  });
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  // ── Checkpoint tracking ──
+
+  describe("addCheckpoint", () => {
+    it("should add a checkpoint with the correct data", () => {
+      manager.addCheckpoint(0, 2, "Let me read the file", []);
+      const cps = manager.getCheckpoints();
+      expect(cps).toHaveLength(1);
+      expect(cps[0].turnIndex).toBe(0);
+      expect(cps[0].messageCount).toBe(2);
+      expect(cps[0].summary).toBe("Let me read the file");
+      expect(cps[0].fileChanges).toEqual([]);
+      expect(cps[0].timestamp).toBeGreaterThan(0);
+    });
+    it("should truncate summary to 80 chars", () => {
+      const longSummary = "a".repeat(120);
+      manager.addCheckpoint(0, 2, longSummary, []);
+      expect(manager.getCheckpoints()[0].summary).toHaveLength(80);
+    });
+    it("should accumulate multiple checkpoints", () => {
+      manager.addCheckpoint(0, 2, "Turn 1", []);
+      manager.addCheckpoint(1, 5, "Turn 2", []);
+      manager.addCheckpoint(2, 8, "Turn 3", []);
+      expect(manager.getCheckpoints()).toHaveLength(3);
+      expect(manager.getCheckpointCount()).toBe(3);
+    });
+    it("should include file changes in checkpoint", () => {
+      const changes = [{
+        filePath: "/src/foo.ts",
+        backupPath: "/backup/123-foo.ts",
+        operation: "edit",
+        isNewFile: false
+      }, {
+        filePath: "/src/bar.ts",
+        backupPath: "",
+        operation: "write",
+        isNewFile: true
+      }];
+      manager.addCheckpoint(0, 3, "Modified files", changes);
+      expect(manager.getCheckpoints()[0].fileChanges).toHaveLength(2);
+      expect(manager.getCheckpoints()[0].fileChanges[1].isNewFile).toBe(true);
+    });
+  });
+  describe("getCheckpoints", () => {
+    it("should return a copy (not the internal array)", () => {
+      manager.addCheckpoint(0, 2, "Turn 1", []);
+      const cps = manager.getCheckpoints();
+      cps.push({});
+      expect(manager.getCheckpoints()).toHaveLength(1);
+    });
+  });
+
+  // ── File change tracking ──
+
+  describe("trackFileChange / getCurrentFileChanges / commitTurn", () => {
+    it("should track pending file changes", () => {
+      const change = {
+        filePath: "/src/test.ts",
+        backupPath: "/backup/123-test.ts",
+        operation: "edit",
+        isNewFile: false
+      };
+      manager.trackFileChange(change);
+      expect(manager.getCurrentFileChanges()).toHaveLength(1);
+      expect(manager.getCurrentFileChanges()[0].filePath).toBe("/src/test.ts");
+    });
+    it("should clear pending changes on commitTurn", () => {
+      manager.trackFileChange({
+        filePath: "/src/test.ts",
+        backupPath: "/backup/123-test.ts",
+        operation: "edit",
+        isNewFile: false
+      });
+      expect(manager.getCurrentFileChanges()).toHaveLength(1);
+      manager.commitTurn();
+      expect(manager.getCurrentFileChanges()).toHaveLength(0);
+    });
+    it("should return a copy of current file changes", () => {
+      manager.trackFileChange({
+        filePath: "/src/test.ts",
+        backupPath: "/backup/123-test.ts",
+        operation: "edit",
+        isNewFile: false
+      });
+      const changes = manager.getCurrentFileChanges();
+      changes.push({});
+      expect(manager.getCurrentFileChanges()).toHaveLength(1);
+    });
+  });
+
+  // ── Utility methods ──
+
+  describe("hasFileChanges", () => {
+    it("should return false when no file changes exist", () => {
+      manager.addCheckpoint(0, 2, "Turn 1", []);
+      expect(manager.hasFileChanges()).toBe(false);
+    });
+    it("should return true when file changes exist", () => {
+      manager.addCheckpoint(0, 2, "Turn 1", [{
+        filePath: "/src/foo.ts",
+        backupPath: "/backup/foo.ts",
+        operation: "edit",
+        isNewFile: false
+      }]);
+      expect(manager.hasFileChanges()).toBe(true);
+    });
+  });
+  describe("getFileChangeCountAfter", () => {
+    it("should count file changes after the given checkpoint", () => {
+      manager.addCheckpoint(0, 2, "Turn 1", []);
+      manager.addCheckpoint(1, 5, "Turn 2", [{
+        filePath: "/src/a.ts",
+        backupPath: "/backup/a.ts",
+        operation: "edit",
+        isNewFile: false
+      }]);
+      manager.addCheckpoint(2, 8, "Turn 3", [{
+        filePath: "/src/b.ts",
+        backupPath: "",
+        operation: "write",
+        isNewFile: true
+      }, {
+        filePath: "/src/c.ts",
+        backupPath: "/backup/c.ts",
+        operation: "edit",
+        isNewFile: false
+      }]);
+      expect(manager.getFileChangeCountAfter(0)).toBe(3); // Turn 2 (1) + Turn 3 (2)
+      expect(manager.getFileChangeCountAfter(1)).toBe(2); // Turn 3 (2)
+      expect(manager.getFileChangeCountAfter(2)).toBe(0); // Nothing after Turn 3
+    });
+  });
+  describe("reset", () => {
+    it("should clear all state", () => {
+      manager.addCheckpoint(0, 2, "Turn 1", []);
+      manager.trackFileChange({
+        filePath: "/src/test.ts",
+        backupPath: "/backup/test.ts",
+        operation: "edit",
+        isNewFile: false
+      });
+      manager.reset();
+      expect(manager.getCheckpoints()).toHaveLength(0);
+      expect(manager.getCurrentFileChanges()).toHaveLength(0);
+    });
+  });
+});

package/dist/cli/services/sandbox.test.js

@@ -0,0 +1,198 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { sandboxCommand, cleanupSandbox, isSandboxAvailable } from "./sandbox.js";
+import { existsSync, readFileSync } from "fs";
+
+// ============================================================================
+// sandboxCommand
+// ============================================================================
+
+describe("sandboxCommand", () => {
+  const profilePaths = [];
+  afterEach(() => {
+    // Clean up any sandbox profiles created during tests
+    for (const p of profilePaths) {
+      cleanupSandbox(p);
+    }
+    profilePaths.length = 0;
+  });
+
+  // These tests are macOS-specific since sandbox-exec only exists on Darwin
+  if (process.platform === "darwin") {
+    it("wraps command with sandbox-exec on macOS", () => {
+      const {
+        wrapped,
+        profilePath
+      } = sandboxCommand("echo hello", "/tmp/test");
+      profilePaths.push(profilePath);
+      expect(wrapped).toContain("sandbox-exec");
+      expect(wrapped).toContain("/bin/bash");
+      expect(wrapped).toContain("echo hello");
+      expect(profilePath).not.toBeNull();
+    });
+    it("creates a profile file on disk", () => {
+      const {
+        profilePath
+      } = sandboxCommand("ls", "/tmp/test");
+      profilePaths.push(profilePath);
+      expect(profilePath).not.toBeNull();
+      expect(existsSync(profilePath)).toBe(true);
+    });
+    it("profile includes cwd in allow rules", () => {
+      const cwd = "/Users/testuser/project";
+      const {
+        profilePath
+      } = sandboxCommand("ls", cwd);
+      profilePaths.push(profilePath);
+      const profile = readFileSync(profilePath, "utf-8");
+      expect(profile).toContain(`(allow file-write* (subpath "${cwd}"))`);
+    });
+    it("profile includes /tmp in allow rules", () => {
+      const {
+        profilePath
+      } = sandboxCommand("ls", "/some/dir");
+      profilePaths.push(profilePath);
+      const profile = readFileSync(profilePath, "utf-8");
+      expect(profile).toContain('(allow file-write* (subpath "/tmp"))');
+      expect(profile).toContain('(allow file-write* (subpath "/private/tmp"))');
+    });
+    it("profile includes ~/.whale in allow rules", () => {
+      const {
+        profilePath
+      } = sandboxCommand("ls", "/some/dir");
+      profilePaths.push(profilePath);
+      const profile = readFileSync(profilePath, "utf-8");
+      expect(profile).toContain(".whale");
+      expect(profile).toMatch(/allow file-write\*.*\.whale/);
+    });
+    it("profile includes /dev for terminal I/O", () => {
+      const {
+        profilePath
+      } = sandboxCommand("ls", "/some/dir");
+      profilePaths.push(profilePath);
+      const profile = readFileSync(profilePath, "utf-8");
+      expect(profile).toContain('(allow file-write* (subpath "/dev"))');
+    });
+    it("profile includes /private/var/folders for macOS temp", () => {
+      const {
+        profilePath
+      } = sandboxCommand("ls", "/some/dir");
+      profilePaths.push(profilePath);
+      const profile = readFileSync(profilePath, "utf-8");
+      expect(profile).toContain('(allow file-write* (subpath "/private/var/folders"))');
+    });
+    it("profile denies file-write by default", () => {
+      const {
+        profilePath
+      } = sandboxCommand("ls", "/some/dir");
+      profilePaths.push(profilePath);
+      const profile = readFileSync(profilePath, "utf-8");
+      expect(profile).toContain("(deny file-write*)");
+    });
+    it("profile allows default (read, network, etc.)", () => {
+      const {
+        profilePath
+      } = sandboxCommand("ls", "/some/dir");
+      profilePaths.push(profilePath);
+      const profile = readFileSync(profilePath, "utf-8");
+      expect(profile).toContain("(allow default)");
+    });
+    it("shell-escapes the profile path in the wrapped command", () => {
+      const {
+        wrapped,
+        profilePath
+      } = sandboxCommand("echo test", "/tmp/test");
+      profilePaths.push(profilePath);
+
+      // Profile path should be single-quoted in the command
+      expect(wrapped).toContain(`'${profilePath}'`);
+    });
+    it("shell-escapes the command itself", () => {
+      const cmd = "echo 'hello world'";
+      const {
+        wrapped,
+        profilePath
+      } = sandboxCommand(cmd, "/tmp/test");
+      profilePaths.push(profilePath);
+
+      // The command should be wrapped in single quotes (with inner quotes escaped)
+      expect(wrapped).toContain("/bin/bash -c");
+      // The inner single quotes in the command should be escaped
+      expect(wrapped).toContain("'\\''");
+    });
+    it("handles commands with special characters", () => {
+      const cmd = 'echo "hello" && cat /etc/passwd | grep root';
+      const {
+        wrapped,
+        profilePath
+      } = sandboxCommand(cmd, "/tmp/test");
+      profilePaths.push(profilePath);
+      expect(wrapped).toContain("sandbox-exec");
+      expect(profilePath).not.toBeNull();
+    });
+    it("generates unique profile paths for sequential calls", () => {
+      const {
+        profilePath: p1
+      } = sandboxCommand("echo 1", "/tmp/test");
+      const {
+        profilePath: p2
+      } = sandboxCommand("echo 2", "/tmp/test");
+      profilePaths.push(p1, p2);
+      expect(p1).not.toBe(p2);
+    });
+  } else {
+    it("returns command unchanged on non-macOS", () => {
+      const {
+        wrapped,
+        profilePath
+      } = sandboxCommand("echo hello", "/tmp/test");
+      expect(wrapped).toBe("echo hello");
+      expect(profilePath).toBeNull();
+    });
+  }
+});
+
+// ============================================================================
+// cleanupSandbox
+// ============================================================================
+
+describe("cleanupSandbox", () => {
+  it("handles null profilePath gracefully", () => {
+    // Should not throw
+    expect(() => cleanupSandbox(null)).not.toThrow();
+  });
+  if (process.platform === "darwin") {
+    it("removes the profile file from disk", () => {
+      const {
+        profilePath
+      } = sandboxCommand("echo test", "/tmp/test");
+      expect(profilePath).not.toBeNull();
+      expect(existsSync(profilePath)).toBe(true);
+      cleanupSandbox(profilePath);
+      expect(existsSync(profilePath)).toBe(false);
+    });
+    it("handles already-deleted profile gracefully", () => {
+      const {
+        profilePath
+      } = sandboxCommand("echo test", "/tmp/test");
+      cleanupSandbox(profilePath);
+      // Second cleanup should not throw
+      expect(() => cleanupSandbox(profilePath)).not.toThrow();
+    });
+  }
+});
+
+// ============================================================================
+// isSandboxAvailable
+// ============================================================================
+
+describe("isSandboxAvailable", () => {
+  if (process.platform === "darwin") {
+    it("returns true on macOS (sandbox-exec exists)", () => {
+      expect(isSandboxAvailable()).toBe(true);
+    });
+  } else {
+    it("returns false on non-macOS platforms", () => {
+      expect(isSandboxAvailable()).toBe(false);
+    });
+  }
+});

package/dist/cli/services/server-tools-client.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Server Tools Client — Supabase client management, connection checking, and tool definition loading.
+ * Extracted from server-tools.ts for file size management.
+ */
+import type Anthropic from "@anthropic-ai/sdk";
+interface ToolExecutionContext {
+    traceId?: string;
+    conversationId?: string;
+    userId?: string;
+    userEmail?: string;
+    source?: string;
+}
+/**
+ * Set the execution context for server tool calls.
+ * Called by agent-loop.ts before each turn so tool calls carry trace/user identity.
+ */
+export declare function setServerToolContext(ctx: ToolExecutionContext): void;
+export declare function getExecutionContext(): ToolExecutionContext;
+export interface ServerStatus {
+    connected: boolean;
+    storeId: string;
+    storeName: string;
+    toolCount: number;
+    authMethod: "service_role" | "jwt" | "none";
+}
+export declare function getCachedAuthMethod(): "service_role" | "jwt" | "none";
+export declare function resetServerToolClient(): void;
+export declare function checkConnection(): Promise<boolean>;
+/**
+ * Load server tool definitions from ai_tool_registry.
+ * Same query as the MCP server (index.ts). Cached for 60s.
+ * Filters out tool_mode='code' (those are local CLI tools).
+ */
+export declare function loadServerToolDefinitions(force?: boolean): Promise<Anthropic.Tool[]>;
+/**
+ * Check if a tool name is a server tool.
+ * After first load, checks against the dynamically loaded set.
+ */
+export declare function isServerTool(name: string): boolean;
+/**
+ * Get currently loaded definitions (for /tools listing).
+ * Returns whatever is cached — call loadServerToolDefinitions() first to populate.
+ */
+export declare function getAllServerToolDefinitions(): Anthropic.Tool[];
+export declare function getServerStatus(): Promise<ServerStatus>;
+export {};

package/dist/cli/services/server-tools-client.js

@@ -0,0 +1,211 @@
+/**
+ * Server Tools Client — Supabase client management, connection checking, and tool definition loading.
+ * Extracted from server-tools.ts for file size management.
+ */
+
+import { createClient } from "@supabase/supabase-js";
+import { resolveConfig } from "./config-store.js";
+import { getValidToken, createAuthenticatedClient } from "./auth-service.js";
+
+// ============================================================================
+// EXECUTION CONTEXT — set by agent-loop before tool dispatch
+// Provides trace + user identity for server-side telemetry correlation.
+// ============================================================================
+
+let executionContext = {};
+
+/**
+ * Set the execution context for server tool calls.
+ * Called by agent-loop.ts before each turn so tool calls carry trace/user identity.
+ */
+export function setServerToolContext(ctx) {
+  executionContext = ctx;
+}
+export function getExecutionContext() {
+  return executionContext;
+}
+// ============================================================================
+// SUPABASE CLIENT (tiered: service role > user JWT)
+// Used only for loading tool definitions from ai_tool_registry.
+// Tool execution goes through the edge function.
+// ============================================================================
+
+let cachedClient = null;
+let cachedStoreId = "";
+let cachedAuthMethod = "none";
+let cachedToken = "";
+export function getCachedAuthMethod() {
+  return cachedAuthMethod;
+}
+async function getSupabaseClient() {
+  const config = resolveConfig();
+
+  // Tier 1: Service role key (full access, MCP server mode) — never expires
+  if (config.supabaseUrl && config.supabaseKey) {
+    if (cachedClient && cachedAuthMethod === "service_role") {
+      return {
+        client: cachedClient,
+        storeId: cachedStoreId
+      };
+    }
+    cachedClient = createClient(config.supabaseUrl, config.supabaseKey, {
+      auth: {
+        persistSession: false,
+        autoRefreshToken: false
+      }
+    });
+    cachedStoreId = config.storeId || "";
+    cachedAuthMethod = "service_role";
+    return {
+      client: cachedClient,
+      storeId: cachedStoreId
+    };
+  }
+
+  // Tier 2: User JWT (CLI login) — recreate client when token refreshes
+  const token = await getValidToken();
+  if (token) {
+    if (cachedClient && cachedToken === token) {
+      cachedStoreId = config.storeId || "";
+      return {
+        client: cachedClient,
+        storeId: cachedStoreId
+      };
+    }
+    cachedClient = createAuthenticatedClient(token);
+    cachedToken = token;
+    cachedStoreId = config.storeId || "";
+    cachedAuthMethod = "jwt";
+    return {
+      client: cachedClient,
+      storeId: cachedStoreId
+    };
+  }
+  cachedClient = null;
+  cachedToken = "";
+  cachedAuthMethod = "none";
+  return null;
+}
+export function resetServerToolClient() {
+  cachedClient = null;
+  cachedStoreId = "";
+  cachedToken = "";
+  cachedAuthMethod = "none";
+  connectionVerified = false;
+  // Also clear tool cache so next load fetches fresh
+  loadedTools = [];
+  loadedToolNames.clear();
+  toolsLoadedAt = 0;
+}
+
+// ============================================================================
+// CONNECTION CHECK
+// ============================================================================
+
+let connectionVerified = false;
+export async function checkConnection() {
+  if (connectionVerified) return true;
+  const conn = await getSupabaseClient();
+  if (!conn) return false;
+  try {
+    // Quick health check — query a small table
+    const {
+      error
+    } = await conn.client.from("stores").select("id").limit(1);
+    connectionVerified = !error;
+    return connectionVerified;
+  } catch {
+    return false;
+  }
+}
+
+// ============================================================================
+// TOOL DEFINITIONS — loaded from ai_tool_registry (single source of truth)
+// ============================================================================
+
+let loadedTools = [];
+let loadedToolNames = new Set();
+let toolsLoadedAt = 0;
+const TOOL_CACHE_TTL = 60_000; // 1 minute
+
+/**
+ * Load server tool definitions from ai_tool_registry.
+ * Same query as the MCP server (index.ts). Cached for 60s.
+ * Filters out tool_mode='code' (those are local CLI tools).
+ */
+export async function loadServerToolDefinitions(force = false) {
+  // Return cache if fresh
+  if (!force && loadedTools.length > 0 && Date.now() - toolsLoadedAt < TOOL_CACHE_TTL) {
+    return loadedTools;
+  }
+  const conn = await getSupabaseClient();
+  if (!conn) return [];
+  try {
+    const {
+      data,
+      error
+    } = await conn.client.from("ai_tool_registry").select("name, description, definition").eq("is_active", true).neq("tool_mode", "code");
+    if (error) {
+      console.error("[server-tools] Failed to load from ai_tool_registry:", error.message);
+      return loadedTools; // Return stale cache on error
+    }
+    loadedTools = (data || []).map(t => ({
+      name: t.name,
+      description: t.description || t.definition?.description || `Execute ${t.name}`,
+      input_schema: t.definition?.input_schema || {
+        type: "object",
+        properties: {}
+      }
+    }));
+
+    // Rebuild the name set
+    loadedToolNames.clear();
+    for (const tool of loadedTools) {
+      loadedToolNames.add(tool.name);
+    }
+    toolsLoadedAt = Date.now();
+    connectionVerified = true;
+    return loadedTools;
+  } catch (err) {
+    console.error("[server-tools] Error loading tool definitions:", err);
+    return loadedTools;
+  }
+}
+
+/**
+ * Check if a tool name is a server tool.
+ * After first load, checks against the dynamically loaded set.
+ */
+export function isServerTool(name) {
+  return loadedToolNames.has(name);
+}
+
+/**
+ * Get currently loaded definitions (for /tools listing).
+ * Returns whatever is cached — call loadServerToolDefinitions() first to populate.
+ */
+export function getAllServerToolDefinitions() {
+  return loadedTools;
+}
+
+// ============================================================================
+// SERVER STATUS
+// ============================================================================
+
+export async function getServerStatus() {
+  const {
+    loadConfig
+  } = await import("./config-store.js");
+  const config = loadConfig();
+
+  // Loading tools also verifies connection
+  const tools = await loadServerToolDefinitions();
+  return {
+    connected: tools.length > 0,
+    storeId: config.store_id || "",
+    storeName: config.store_name || "",
+    toolCount: tools.length,
+    authMethod: cachedAuthMethod
+  };
+}
+//# sourceMappingURL=server-tools-client.js.map

package/dist/cli/services/server-tools-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-tools-client.js","names":["createClient","resolveConfig","getValidToken","createAuthenticatedClient","executionContext","setServerToolContext","ctx","getExecutionContext","cachedClient","cachedStoreId","cachedAuthMethod","cachedToken","getCachedAuthMethod","getSupabaseClient","config","supabaseUrl","supabaseKey","client","storeId","auth","persistSession","autoRefreshToken","token","resetServerToolClient","connectionVerified","loadedTools","loadedToolNames","clear","toolsLoadedAt","checkConnection","conn","error","from","select","limit","Set","TOOL_CACHE_TTL","loadServerToolDefinitions","force","length","Date","now","data","eq","neq","console","message","map","t","name","description","definition","input_schema","type","properties","tool","add","err","isServerTool","has","getAllServerToolDefinitions","getServerStatus","loadConfig","tools","connected","store_id","storeName","store_name","toolCount","authMethod"],"sources":["../../../src/cli/services/server-tools-client.ts"],"sourcesContent":["/**\n * Server Tools Client — Supabase client management, connection checking, and tool definition loading.\n * Extracted from server-tools.ts for file size management.\n */\n\nimport { createClient, type SupabaseClient } from \"@supabase/supabase-js\";\nimport type Anthropic from \"@anthropic-ai/sdk\";\nimport { resolveConfig } from \"./config-store.js\";\nimport { getValidToken, createAuthenticatedClient } from \"./auth-service.js\";\n\n// ============================================================================\n// EXECUTION CONTEXT — set by agent-loop before tool dispatch\n// Provides trace + user identity for server-side telemetry correlation.\n// ============================================================================\n\ninterface ToolExecutionContext {\n  traceId?: string;\n  conversationId?: string;\n  userId?: string;\n  userEmail?: string;\n  source?: string;\n}\n\nlet executionContext: ToolExecutionContext = {};\n\n/**\n * Set the execution context for server tool calls.\n * Called by agent-loop.ts before each turn so tool calls carry trace/user identity.\n */\nexport function setServerToolContext(ctx: ToolExecutionContext): void {\n  executionContext = ctx;\n}\n\nexport function getExecutionContext(): ToolExecutionContext {\n  return executionContext;\n}\n\nexport interface ServerStatus {\n  connected: boolean;\n  storeId: string;\n  storeName: string;\n  toolCount: number;\n  authMethod: \"service_role\" | \"jwt\" | \"none\";\n}\n\n// ============================================================================\n// SUPABASE CLIENT (tiered: service role > user JWT)\n// Used only for loading tool definitions from ai_tool_registry.\n// Tool execution goes through the edge function.\n// ============================================================================\n\nlet cachedClient: SupabaseClient | null = null;\nlet cachedStoreId: string = \"\";\nlet cachedAuthMethod: \"service_role\" | \"jwt\" | \"none\" = \"none\";\nlet cachedToken: string = \"\";\n\nexport function getCachedAuthMethod(): \"service_role\" | \"jwt\" | \"none\" {\n  return cachedAuthMethod;\n}\n\nasync function getSupabaseClient(): Promise<{ client: SupabaseClient; storeId: string } | null> {\n  const config = resolveConfig();\n\n  // Tier 1: Service role key (full access, MCP server mode) — never expires\n  if (config.supabaseUrl && config.supabaseKey) {\n    if (cachedClient && cachedAuthMethod === \"service_role\") {\n      return { client: cachedClient, storeId: cachedStoreId };\n    }\n    cachedClient = createClient(config.supabaseUrl, config.supabaseKey, {\n      auth: { persistSession: false, autoRefreshToken: false },\n    });\n    cachedStoreId = config.storeId || \"\";\n    cachedAuthMethod = \"service_role\";\n    return { client: cachedClient, storeId: cachedStoreId };\n  }\n\n  // Tier 2: User JWT (CLI login) — recreate client when token refreshes\n  const token = await getValidToken();\n  if (token) {\n    if (cachedClient && cachedToken === token) {\n      cachedStoreId = config.storeId || \"\";\n      return { client: cachedClient, storeId: cachedStoreId };\n    }\n    cachedClient = createAuthenticatedClient(token);\n    cachedToken = token;\n    cachedStoreId = config.storeId || \"\";\n    cachedAuthMethod = \"jwt\";\n    return { client: cachedClient, storeId: cachedStoreId };\n  }\n\n  cachedClient = null;\n  cachedToken = \"\";\n  cachedAuthMethod = \"none\";\n  return null;\n}\n\nexport function resetServerToolClient(): void {\n  cachedClient = null;\n  cachedStoreId = \"\";\n  cachedToken = \"\";\n  cachedAuthMethod = \"none\";\n  connectionVerified = false;\n  // Also clear tool cache so next load fetches fresh\n  loadedTools = [];\n  loadedToolNames.clear();\n  toolsLoadedAt = 0;\n}\n\n// ============================================================================\n// CONNECTION CHECK\n// ============================================================================\n\nlet connectionVerified = false;\n\nexport async function checkConnection(): Promise<boolean> {\n  if (connectionVerified) return true;\n\n  const conn = await getSupabaseClient();\n  if (!conn) return false;\n\n  try {\n    // Quick health check — query a small table\n    const { error } = await conn.client.from(\"stores\").select(\"id\").limit(1);\n    connectionVerified = !error;\n    return connectionVerified;\n  } catch {\n    return false;\n  }\n}\n\n// ============================================================================\n// TOOL DEFINITIONS — loaded from ai_tool_registry (single source of truth)\n// ============================================================================\n\nlet loadedTools: Anthropic.Tool[] = [];\nlet loadedToolNames = new Set<string>();\nlet toolsLoadedAt = 0;\nconst TOOL_CACHE_TTL = 60_000; // 1 minute\n\n/**\n * Load server tool definitions from ai_tool_registry.\n * Same query as the MCP server (index.ts). Cached for 60s.\n * Filters out tool_mode='code' (those are local CLI tools).\n */\nexport async function loadServerToolDefinitions(force = false): Promise<Anthropic.Tool[]> {\n  // Return cache if fresh\n  if (!force && loadedTools.length > 0 && Date.now() - toolsLoadedAt < TOOL_CACHE_TTL) {\n    return loadedTools;\n  }\n\n  const conn = await getSupabaseClient();\n  if (!conn) return [];\n\n  try {\n    const { data, error } = await conn.client\n      .from(\"ai_tool_registry\")\n      .select(\"name, description, definition\")\n      .eq(\"is_active\", true)\n      .neq(\"tool_mode\", \"code\");\n\n    if (error) {\n      console.error(\"[server-tools] Failed to load from ai_tool_registry:\", error.message);\n      return loadedTools; // Return stale cache on error\n    }\n\n    loadedTools = (data || []).map(t => ({\n      name: t.name,\n      description: t.description || t.definition?.description || `Execute ${t.name}`,\n      input_schema: t.definition?.input_schema || { type: \"object\" as const, properties: {} },\n    }));\n\n    // Rebuild the name set\n    loadedToolNames.clear();\n    for (const tool of loadedTools) {\n      loadedToolNames.add(tool.name);\n    }\n\n    toolsLoadedAt = Date.now();\n    connectionVerified = true;\n\n    return loadedTools;\n  } catch (err) {\n    console.error(\"[server-tools] Error loading tool definitions:\", err);\n    return loadedTools;\n  }\n}\n\n/**\n * Check if a tool name is a server tool.\n * After first load, checks against the dynamically loaded set.\n */\nexport function isServerTool(name: string): boolean {\n  return loadedToolNames.has(name);\n}\n\n/**\n * Get currently loaded definitions (for /tools listing).\n * Returns whatever is cached — call loadServerToolDefinitions() first to populate.\n */\nexport function getAllServerToolDefinitions(): Anthropic.Tool[] {\n  return loadedTools;\n}\n\n// ============================================================================\n// SERVER STATUS\n// ============================================================================\n\nexport async function getServerStatus(): Promise<ServerStatus> {\n  const { loadConfig } = await import(\"./config-store.js\");\n  const config = loadConfig();\n\n  // Loading tools also verifies connection\n  const tools = await loadServerToolDefinitions();\n  return {\n    connected: tools.length > 0,\n    storeId: config.store_id || \"\",\n    storeName: config.store_name || \"\",\n    toolCount: tools.length,\n    authMethod: cachedAuthMethod,\n  };\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;;AAEA,SAASA,YAAY,QAA6B,uBAAuB;AAEzE,SAASC,aAAa,QAAQ,mBAAmB;AACjD,SAASC,aAAa,EAAEC,yBAAyB,QAAQ,mBAAmB;;AAE5E;AACA;AACA;AACA;;AAUA,IAAIC,gBAAsC,GAAG,CAAC,CAAC;;AAE/C;AACA;AACA;AACA;AACA,OAAO,SAASC,oBAAoBA,CAACC,GAAyB,EAAQ;EACpEF,gBAAgB,GAAGE,GAAG;AACxB;AAEA,OAAO,SAASC,mBAAmBA,CAAA,EAAyB;EAC1D,OAAOH,gBAAgB;AACzB;AAUA;AACA;AACA;AACA;AACA;;AAEA,IAAII,YAAmC,GAAG,IAAI;AAC9C,IAAIC,aAAqB,GAAG,EAAE;AAC9B,IAAIC,gBAAiD,GAAG,MAAM;AAC9D,IAAIC,WAAmB,GAAG,EAAE;AAE5B,OAAO,SAASC,mBAAmBA,CAAA,EAAoC;EACrE,OAAOF,gBAAgB;AACzB;AAEA,eAAeG,iBAAiBA,CAAA,EAAgE;EAC9F,MAAMC,MAAM,GAAGb,aAAa,CAAC,CAAC;;EAE9B;EACA,IAAIa,MAAM,CAACC,WAAW,IAAID,MAAM,CAACE,WAAW,EAAE;IAC5C,IAAIR,YAAY,IAAIE,gBAAgB,KAAK,cAAc,EAAE;MACvD,OAAO;QAAEO,MAAM,EAAET,YAAY;QAAEU,OAAO,EAAET;MAAc,CAAC;IACzD;IACAD,YAAY,GAAGR,YAAY,CAACc,MAAM,CAACC,WAAW,EAAED,MAAM,CAACE,WAAW,EAAE;MAClEG,IAAI,EAAE;QAAEC,cAAc,EAAE,KAAK;QAAEC,gBAAgB,EAAE;MAAM;IACzD,CAAC,CAAC;IACFZ,aAAa,GAAGK,MAAM,CAACI,OAAO,IAAI,EAAE;IACpCR,gBAAgB,GAAG,cAAc;IACjC,OAAO;MAAEO,MAAM,EAAET,YAAY;MAAEU,OAAO,EAAET;IAAc,CAAC;EACzD;;EAEA;EACA,MAAMa,KAAK,GAAG,MAAMpB,aAAa,CAAC,CAAC;EACnC,IAAIoB,KAAK,EAAE;IACT,IAAId,YAAY,IAAIG,WAAW,KAAKW,KAAK,EAAE;MACzCb,aAAa,GAAGK,MAAM,CAACI,OAAO,IAAI,EAAE;MACpC,OAAO;QAAED,MAAM,EAAET,YAAY;QAAEU,OAAO,EAAET;MAAc,CAAC;IACzD;IACAD,YAAY,GAAGL,yBAAyB,CAACmB,KAAK,CAAC;IAC/CX,WAAW,GAAGW,KAAK;IACnBb,aAAa,GAAGK,MAAM,CAACI,OAAO,IAAI,EAAE;IACpCR,gBAAgB,GAAG,KAAK;IACxB,OAAO;MAAEO,MAAM,EAAET,YAAY;MAAEU,OAAO,EAAET;IAAc,CAAC;EACzD;EAEAD,YAAY,GAAG,IAAI;EACnBG,WAAW,GAAG,EAAE;EAChBD,gBAAgB,GAAG,MAAM;EACzB,OAAO,IAAI;AACb;AAEA,OAAO,SAASa,qBAAqBA,CAAA,EAAS;EAC5Cf,YAAY,GAAG,IAAI;EACnBC,aAAa,GAAG,EAAE;EAClBE,WAAW,GAAG,EAAE;EAChBD,gBAAgB,GAAG,MAAM;EACzBc,kBAAkB,GAAG,KAAK;EAC1B;EACAC,WAAW,GAAG,EAAE;EAChBC,eAAe,CAACC,KAAK,CAAC,CAAC;EACvBC,aAAa,GAAG,CAAC;AACnB;;AAEA;AACA;AACA;;AAEA,IAAIJ,kBAAkB,GAAG,KAAK;AAE9B,OAAO,eAAeK,eAAeA,CAAA,EAAqB;EACxD,IAAIL,kBAAkB,EAAE,OAAO,IAAI;EAEnC,MAAMM,IAAI,GAAG,MAAMjB,iBAAiB,CAAC,CAAC;EACtC,IAAI,CAACiB,IAAI,EAAE,OAAO,KAAK;EAEvB,IAAI;IACF;IACA,MAAM;MAAEC;IAAM,CAAC,GAAG,MAAMD,IAAI,CAACb,MAAM,CAACe,IAAI,CAAC,QAAQ,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,KAAK,CAAC,CAAC,CAAC;IACxEV,kBAAkB,GAAG,CAACO,KAAK;IAC3B,OAAOP,kBAAkB;EAC3B,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;;AAEA,IAAIC,WAA6B,GAAG,EAAE;AACtC,IAAIC,eAAe,GAAG,IAAIS,GAAG,CAAS,CAAC;AACvC,IAAIP,aAAa,GAAG,CAAC;AACrB,MAAMQ,cAAc,GAAG,MAAM,CAAC,CAAC;;AAE/B;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAACC,KAAK,GAAG,KAAK,EAA6B;EACxF;EACA,IAAI,CAACA,KAAK,IAAIb,WAAW,CAACc,MAAM,GAAG,CAAC,IAAIC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGb,aAAa,GAAGQ,cAAc,EAAE;IACnF,OAAOX,WAAW;EACpB;EAEA,MAAMK,IAAI,GAAG,MAAMjB,iBAAiB,CAAC,CAAC;EACtC,IAAI,CAACiB,IAAI,EAAE,OAAO,EAAE;EAEpB,IAAI;IACF,MAAM;MAAEY,IAAI;MAAEX;IAAM,CAAC,GAAG,MAAMD,IAAI,CAACb,MAAM,CACtCe,IAAI,CAAC,kBAAkB,CAAC,CACxBC,MAAM,CAAC,+BAA+B,CAAC,CACvCU,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CACrBC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC;IAE3B,IAAIb,KAAK,EAAE;MACTc,OAAO,CAACd,KAAK,CAAC,sDAAsD,EAAEA,KAAK,CAACe,OAAO,CAAC;MACpF,OAAOrB,WAAW,CAAC,CAAC;IACtB;IAEAA,WAAW,GAAG,CAACiB,IAAI,IAAI,EAAE,EAAEK,GAAG,CAACC,CAAC,KAAK;MACnCC,IAAI,EAAED,CAAC,CAACC,IAAI;MACZC,WAAW,EAAEF,CAAC,CAACE,WAAW,IAAIF,CAAC,CAACG,UAAU,EAAED,WAAW,IAAI,WAAWF,CAAC,CAACC,IAAI,EAAE;MAC9EG,YAAY,EAAEJ,CAAC,CAACG,UAAU,EAAEC,YAAY,IAAI;QAAEC,IAAI,EAAE,QAAiB;QAAEC,UAAU,EAAE,CAAC;MAAE;IACxF,CAAC,CAAC,CAAC;;IAEH;IACA5B,eAAe,CAACC,KAAK,CAAC,CAAC;IACvB,KAAK,MAAM4B,IAAI,IAAI9B,WAAW,EAAE;MAC9BC,eAAe,CAAC8B,GAAG,CAACD,IAAI,CAACN,IAAI,CAAC;IAChC;IAEArB,aAAa,GAAGY,IAAI,CAACC,GAAG,CAAC,CAAC;IAC1BjB,kBAAkB,GAAG,IAAI;IAEzB,OAAOC,WAAW;EACpB,CAAC,CAAC,OAAOgC,GAAG,EAAE;IACZZ,OAAO,CAACd,KAAK,CAAC,gDAAgD,EAAE0B,GAAG,CAAC;IACpE,OAAOhC,WAAW;EACpB;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASiC,YAAYA,CAACT,IAAY,EAAW;EAClD,OAAOvB,eAAe,CAACiC,GAAG,CAACV,IAAI,CAAC;AAClC;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASW,2BAA2BA,CAAA,EAAqB;EAC9D,OAAOnC,WAAW;AACpB;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeoC,eAAeA,CAAA,EAA0B;EAC7D,MAAM;IAAEC;EAAW,CAAC,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC;EACxD,MAAMhD,MAAM,GAAGgD,UAAU,CAAC,CAAC;;EAE3B;EACA,MAAMC,KAAK,GAAG,MAAM1B,yBAAyB,CAAC,CAAC;EAC/C,OAAO;IACL2B,SAAS,EAAED,KAAK,CAACxB,MAAM,GAAG,CAAC;IAC3BrB,OAAO,EAAEJ,MAAM,CAACmD,QAAQ,IAAI,EAAE;IAC9BC,SAAS,EAAEpD,MAAM,CAACqD,UAAU,IAAI,EAAE;IAClCC,SAAS,EAAEL,KAAK,CAACxB,MAAM;IACvB8B,UAAU,EAAE3D;EACd,CAAC;AACH","ignoreList":[]}

package/dist/cli/services/server-tools-media.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Server Tools Media — media download/extraction for server tool results.
+ * Extracted from server-tools.ts for file size management.
+ */
+/** Tools that produce downloadable media files via file_url */
+export declare const MEDIA_TOOLS: Set<string>;
+/**
+ * Download remote media (file_url) to the user's working directory.
+ * This ensures the LLM never needs to handle URLs — it just reports local paths.
+ * Prevents the hallucinated-URL problem where models fabricate wrong download URLs.
+ *
+ * Handles both single results (file_url at top level) and batch results
+ * (file_url inside images[] or previews[] arrays).
+ */
+export declare function downloadRemoteMedia(data: Record<string, unknown>, toolName: string, inputArgs?: Record<string, unknown>): Promise<void>;
+/**
+ * Extract base64 media from tool results, save to temp files, and replace
+ * with file paths. This prevents truncation from destroying binary data
+ * that the model needs to save for the user.
+ */
+export declare function extractMediaToFiles(data: Record<string, unknown>, toolName: string): void;