Tools, Addons & Security

# Built-In Sandboxed Tools (24 Modules)

`tacet-tools` houses 24 tool modules operating inside strict workspace boundaries:

• find_file: Fast glob-pattern file search and recursive directory tree walker.
• read_document: Reads document lines with 1-indexed line slicing and automatic encoding detection.
• edit_document / write_code: Multi-chunk exact string replacement and file creation.
• git: Read-only git repository status, diff analysis, log inspection, and commit tree navigation.
• web_search: Privacy-preserving web search integration with DuckDuckGo / SearXNG parsing.
• calc: Precision arithmetic expression evaluator and unit converter.
• time: World clock, timezone resolution, and locale-aware date parsing (e.g. Turkish month names Ocak, Şubat, Aralık).
• sandbox_path: Enforces strict path containment, preventing directory traversal attacks outside workspace root.

# Five Permission-Gated System Addons

System-level operations are gated behind explicit user confirmation dialogs:

• calendar: Read local calendar schedule events or insert new appointments.
• clipboard: Read or write system clipboard buffers.
• db: Inspect SQLite database schemas and execute parameterized queries.
• http_call: Outbound HTTP/HTTPS client with custom headers and SSRF domain rules.
• shell: Execute terminal bash/sh commands inside process groups with group timeout floors.

# SSRF Security Protection Floor

All network calls (`http_call`, `web_search`) enforce strict SSRF domain protection rules at the socket boundary. Requests resolving to private loopback or internal network IP ranges (`127.0.0.1`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.169.254`) are blocked before socket creation.