// Package io implements the built-in I/O and network tools for Cyrene v2
// (DevDocs/design/09-插件生态.md). It exposes file, http, web-search, web-fetch
// and knowledge as pkg/plugins/sdk.Tool values, wired to the process-internal
// config, logger and runtime/memory retriever.
//
// Build the full configured tool set with New(cfg, opts...). Tools() and
// Register(reg) are convenience wrappers that use platform defaults; production
// wiring should call New(cfg, opts...) so the tools honor the real DataDir,
// search endpoint and knowledge retriever.
//
// Security constraints
//
//   - file: every path is cleaned and validated to stay inside the configured
//     data directory or an explicit whitelist; ".." traversal and symlink escape
//     are rejected; reads and writes are size-capped.
//   - http: GET/POST only, timeouts, response truncation and SSRF protection
//     (loopback/private/link-local addresses and localhost are refused unless
//     the host is on an explicit allowlist).
//   - web-search: requires a configured search endpoint, otherwise a clear error.
//   - web-fetch: size- and content-type-limited readable text extraction.
//   - knowledge: RAG lookup over the runtime memory retriever; a clear message
//     when no knowledge base is configured.
//
// All tools are safe for concurrent use, as required by sdk.Tool.
package io