@agentdocumentformat/cli 0.7.7 → 0.8.0

package/dist/chunks/{chunk-4N4ASPH6.mjs → chunk-LCMANRYY.mjs}

@@ -7,10 +7,7 @@ const __dirname = __adfDirname(__filename);
 import {
   AGENT_DEFAULTS,
   DEFAULT_TOOLS
-} from "./chunk-CD3ATSXE.mjs";
-import {
-  __export
-} from "./chunk-M2RX3S2T.mjs";
+} from "./chunk-NZO5O4VN.mjs";
 
 // src/shared/constants/adf-defaults.ts
 var ADF_VERSION = "0.2", DOCS_GUIDES_URL = "https://raw.githubusercontent.com/christianbalevski/adf/main/docs/guides", ADF_SKILLS_REGISTRY_URL = "https://raw.githubusercontent.com/christianbalevski/adf/main/skills/registry.json", PROVIDER_TYPES = [
@@ -19,7 +16,8 @@ var ADF_VERSION = "0.2", DOCS_GUIDES_URL = "https://raw.githubusercontent.com/ch
   { type: "openai-compatible", label: "OpenAI Compatible", placeholder: { apiKey: "Optional", model: "e.g. llama-3-8b" } },
   { type: "openrouter", label: "OpenRouter", placeholder: { apiKey: "sk-or-...", model: "e.g. anthropic/claude-sonnet-4" } },
   { type: "chatgpt-subscription", label: "ChatGPT Subscription", placeholder: { apiKey: "OAuth \u2014 click Sign In", model: "e.g. gpt-5.6-sol" } },
-  { type: "grok-subscription", label: "Grok Subscription", placeholder: { apiKey: "OAuth \u2014 click Sign In", model: "e.g. grok-4.5" } }
+  { type: "grok-subscription", label: "Grok Subscription", placeholder: { apiKey: "OAuth \u2014 click Sign In", model: "e.g. grok-4.5" } },
+  { type: "claude-subscription", label: "Claude Subscription", placeholder: { apiKey: "Claude Code sign-in \u2014 click Sign In", model: "e.g. claude-sonnet-5-5" } }
 ], DEFAULT_AGENT_CONFIG = {
   adf_version: ADF_VERSION,
   name: "Untitled Agent",
@@ -31,7 +29,6 @@ var ADF_VERSION = "0.2", DOCS_GUIDES_URL = "https://raw.githubusercontent.com/ch
     provider: "",
     model_id: "",
     temperature: 0.7,
-    max_tokens: 4096,
     vision: !1
   },
   instructions: "",
@@ -250,246 +247,6 @@ The \`ws_*\` tools manage your configured connections (schemas have the details)
 };
 var DEFAULT_COMPACTION_PROMPT = "You are a conversation compactor. Read the transcript between an AI agent and its environment and write a present-tense status briefing: bullets organized by topic, under 1500 words. Keep current task state, key decisions and their reasoning, exact paths, names, IDs, and values in play, pending work and next steps, constraints or preferences discovered, open questions and hunches the agent was carrying, and anything surprising or still unexplained. Keep exact details; a vague summary is useless. Keep every open thread; anything dropped here is gone. Transcript role tags carry the loop seq when known (`[USER S137]` / `[ASSISTANT S137]`), so when a bullet derives from specific messages, cite them (`[S137]`) and the summary stays traceable to the archived history in adf_audit.";
 
-// src/main/utils/ssrf-guard.ts
-import { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
-var ALLOWED_FETCH_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]), ALLOWED_CONNECT_PROTOCOLS = /* @__PURE__ */ new Set(["ws:", "wss:", "http:", "https:"]);
-function parseLooseIPv4(host) {
-  let parts = host.split(".");
-  if (parts.length < 1 || parts.length > 4) return null;
-  let nums = [];
-  for (let part of parts) {
-    if (part === "") return null;
-    let n;
-    if (/^0[xX][0-9a-fA-F]+$/.test(part)) n = parseInt(part.slice(2), 16);
-    else if (/^0[0-7]+$/.test(part)) n = parseInt(part.slice(1), 8);
-    else if (/^[0-9]+$/.test(part)) n = parseInt(part, 10);
-    else return null;
-    if (!Number.isFinite(n) || n < 0) return null;
-    nums.push(n);
-  }
-  for (let i = 0; i < nums.length - 1; i++) if (nums[i] > 255) return null;
-  let last = nums[nums.length - 1];
-  if (last >= Math.pow(256, 4 - nums.length + 1)) return null;
-  let value = last;
-  for (let i = 0; i < nums.length - 1; i++) value += nums[i] * Math.pow(256, 3 - i);
-  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
-}
-function isBlockedIPv4(ip) {
-  let o = ip.split(".").map(Number);
-  if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return !1;
-  let [a, b, c] = o;
-  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 && c === 0 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a >= 224;
-}
-function isBlockedIPv6(raw) {
-  let addr = raw.toLowerCase().replace(/^\[|\]$/g, "").split("%")[0];
-  if (addr === "::" || addr === "::1" || /^(0:){7}[01]$/.test(addr)) return !0;
-  let mapped = addr.match(/^::(?:ffff:(?:0{1,4}:)?)?((?:\d{1,3}\.){3}\d{1,3})$/);
-  if (mapped) return isBlockedIPv4(mapped[1]);
-  let head = addr.split(":")[0];
-  if (!head) return !1;
-  let h = parseInt(head, 16);
-  return Number.isNaN(h) ? !1 : (h & 65472) === 65152 || (h & 65024) === 64512 || (h & 65280) === 65280;
-}
-function isBlockedIpAddress(ip) {
-  let version = isIP(ip.replace(/^\[|\]$/g, ""));
-  return version === 4 ? isBlockedIPv4(ip) : version === 6 ? isBlockedIPv6(ip) : !1;
-}
-function isLinkLocalIp(ip) {
-  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0], version = isIP(bare);
-  if (version === 4) {
-    let o = bare.split(".").map(Number);
-    return o[0] === 169 && o[1] === 254;
-  }
-  if (version === 6) {
-    let addr = bare.toLowerCase(), mapped = addr.match(/^::(?:ffff:(?:0{1,4}:)?)?((?:\d{1,3}\.){3}\d{1,3})$/);
-    if (mapped) {
-      let o = mapped[1].split(".").map(Number);
-      return o[0] === 169 && o[1] === 254;
-    }
-    let head = addr.split(":")[0], h = parseInt(head, 16);
-    return Number.isNaN(h) ? !1 : (h & 65472) === 65152;
-  }
-  return !1;
-}
-function isLoopbackIp(ip) {
-  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0], version = isIP(bare);
-  if (version === 4) return bare.split(".").map(Number)[0] === 127;
-  if (version === 6) {
-    let addr = bare.toLowerCase();
-    if (addr === "::1" || /^(0:){7}1$/.test(addr)) return !0;
-    let mapped = addr.match(/^::(?:ffff:(?:0{1,4}:)?)?((?:\d{1,3}\.){3}\d{1,3})$/);
-    return mapped ? mapped[1].split(".").map(Number)[0] === 127 : !1;
-  }
-  return !1;
-}
-function isLoopbackHostname(host) {
-  let h = host.toLowerCase().replace(/\.$/, "");
-  return h === "localhost" || h === "localhost.localdomain" || h.endsWith(".localhost");
-}
-function isUnspecifiedIp(ip) {
-  let bare = ip.replace(/^\[|\]$/g, "").split("%")[0].toLowerCase();
-  if (bare === "0.0.0.0" || bare === "::" || /^(0{1,4}:){7}0{1,4}$/.test(bare)) return !0;
-  let mapped = bare.match(/^::(?:ffff:(?:0{1,4}:)?)?((?:\d{1,3}\.){3}\d{1,3})$/);
-  return mapped ? mapped[1] === "0.0.0.0" : !1;
-}
-function blockedMessage(target) {
-  return `Blocked by the sys_fetch SSRF guard: "${target}" is a private-network address (loopback is allowed by default). Set security.allow_local_fetch: true in your config to permit private/LAN fetches \u2014 an agent-initiated write to that setting raises an owner approval request.`;
-}
-function connectBlockedMessage(target) {
-  return `Blocked by the ws_connect SSRF guard: "${target}" is a private-network address (loopback is allowed by default). Set security.allow_local_fetch: true in your config to permit private/LAN connections \u2014 an agent-initiated write to that setting raises an owner approval request.`;
-}
-async function classifyHost(host) {
-  let loopbackHost = !1, candidates = [];
-  if (isIP(host))
-    candidates = [host];
-  else if (isLoopbackHostname(host))
-    loopbackHost = !0;
-  else {
-    let loose = parseLooseIPv4(host);
-    if (loose)
-      candidates = [loose];
-    else
-      try {
-        candidates = (await lookup(host, { all: !0, verbatim: !0 })).map((a) => a.address);
-      } catch {
-        return null;
-      }
-  }
-  return {
-    anyLinkLocal: candidates.some(isLinkLocalIp),
-    anyLoopback: loopbackHost || candidates.some(isLoopbackIp),
-    anyUnspecified: candidates.some(isUnspecifiedIp),
-    // Blocked classes minus loopback (private, CGNAT, unspecified, multicast, …)
-    // — loopback itself is allowed by default and only tier-gated per-port.
-    anyNonLoopbackBlocked: candidates.some((ip) => isBlockedIpAddress(ip) && !isLoopbackIp(ip))
-  };
-}
-function applyPolicy(target, port, path, cls, opts, overridableMessage) {
-  return cls.anyLinkLocal ? `Blocked: "${target}" is a link-local / cloud-metadata address, which is never fetchable (even with allow_local_fetch).` : (cls.anyLoopback || cls.anyUnspecified) && opts.daemonPort && port === opts.daemonPort ? `Blocked: "${target}" (port ${port}) is the local ADF daemon control API, which is never fetchable, even with allow_local_fetch.` : opts.ownOrigin && cls.anyLoopback && port === opts.ownOrigin.port && path.startsWith(opts.ownOrigin.pathPrefix) || opts.allowLocal ? null : cls.anyNonLoopbackBlocked ? overridableMessage(target) : null;
-}
-async function checkFetchTarget(rawUrl, opts = { allowLocal: !1 }) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    return `Invalid URL: ${rawUrl}`;
-  }
-  if (!ALLOWED_FETCH_PROTOCOLS.has(url.protocol))
-    return `Blocked by the sys_fetch guard: only http and https URLs may be fetched (got "${url.protocol}").`;
-  let host = url.hostname.replace(/^\[|\]$/g, "");
-  if (!host) return `Invalid URL: ${rawUrl}`;
-  let port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80, cls = await classifyHost(host);
-  return cls ? applyPolicy(url.hostname, port, url.pathname, cls, opts, blockedMessage) : null;
-}
-async function checkConnectTarget(rawUrl, opts = { allowLocal: !1 }) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    return `Invalid URL: ${rawUrl}`;
-  }
-  if (!ALLOWED_CONNECT_PROTOCOLS.has(url.protocol))
-    return `Blocked by the ws_connect guard: only ws, wss, http and https URLs may be connected (got "${url.protocol}").`;
-  let host = url.hostname.replace(/^\[|\]$/g, "");
-  if (!host) return `Invalid URL: ${rawUrl}`;
-  let secure = url.protocol === "wss:" || url.protocol === "https:", port = url.port ? Number(url.port) : secure ? 443 : 80, cls = await classifyHost(host);
-  return cls ? applyPolicy(url.hostname, port, url.pathname, cls, opts, connectBlockedMessage) : null;
-}
-
-// src/shared/utils/context-breakdown.ts
-var context_breakdown_exports = {};
-__export(context_breakdown_exports, {
-  DEFAULT_COMPACT_THRESHOLD: () => DEFAULT_COMPACT_THRESHOLD,
-  contextCategories: () => contextCategories,
-  contextTotal: () => contextTotal,
-  resolveCompactThreshold: () => resolveCompactThreshold,
-  resolveHostThreshold: () => resolveHostThreshold,
-  resolveLoopThreshold: () => resolveLoopThreshold
-});
-var DEFAULT_COMPACT_THRESHOLD = 1e5;
-function hostThreshold(config, model) {
-  let context = config?.context?.compact_threshold;
-  if (context != null) return { value: context, source: "agent" };
-  let fromModel = model?.compact_threshold;
-  return fromModel != null ? { value: fromModel, source: "model" } : { value: 1e5, source: "default" };
-}
-function resolveCompactThreshold(config, loop) {
-  if (!loop || loop === "main") return hostThreshold(config, config?.model);
-  let declared = config?.loops?.find((l) => l.name === loop);
-  return declared ? declared.compact_threshold != null ? { value: declared.compact_threshold, source: "loop" } : hostThreshold(config, declared.model ?? config?.model) : hostThreshold(config, config?.model);
-}
-function resolveHostThreshold(config) {
-  return resolveCompactThreshold(config).value;
-}
-function resolveLoopThreshold(config, loop) {
-  return resolveCompactThreshold(config, loop).value;
-}
-function contextTotal(b) {
-  return b.system_prompt_tokens + b.tools_total_tokens + b.messages_tokens + b.dynamic_instructions_tokens;
-}
-var byTokens = (list) => [...list].sort((a, b) => b.tokens - a.tokens);
-function contextCategories(b, maxItems = 12) {
-  let fileTokens = b.injected_files.reduce((sum, f) => sum + f.tokens, 0), parts = b.system_prompt_parts, out = [
-    {
-      id: "system",
-      key: "system",
-      label: "System prompt",
-      tokens: Math.max(0, b.system_prompt_tokens - fileTokens),
-      items: parts ? byTokens([
-        { name: "Base prompt and capability sections", tokens: parts.base_and_sections },
-        { name: "Agent instructions", tokens: parts.instructions },
-        { name: "Identity, loop roster, runtime blocks", tokens: parts.runtime_blocks }
-      ]).filter((i) => i.tokens > 0) : [],
-      note: "Base prompt, instructions and runtime blocks: sent with every request."
-    }
-  ];
-  b.injected_files.length > 0 && out.push({
-    id: "files",
-    key: "files",
-    label: "Injected files",
-    tokens: fileTokens,
-    count: b.injected_files.length,
-    items: byTokens(b.injected_files.map((f) => ({ name: f.path, tokens: f.tokens }))).slice(0, maxItems),
-    note: "{{path}} files rendered into the system prompt."
-  });
-  let builtIn = b.tool_groups.filter((g) => g.source === "built-in"), builtInTools = builtIn.flatMap((g) => g.tools);
-  out.push({
-    id: "tools",
-    key: "tools",
-    label: "Tools",
-    tokens: builtIn.reduce((sum, g) => sum + g.tokens, 0),
-    count: builtInTools.length,
-    items: byTokens(builtInTools).slice(0, maxItems),
-    note: "Built-in tool schemas: sent with every request."
-  });
-  for (let group of b.tool_groups)
-    group.source !== "built-in" && out.push({
-      id: `mcp:${group.source}`,
-      key: "mcp",
-      label: `MCP ${group.source}`,
-      tokens: group.tokens,
-      count: group.tools.length,
-      items: byTokens(group.tools).slice(0, maxItems),
-      note: `Tool schemas from the ${group.source} MCP server.`
-    });
-  return out.push({
-    id: "dynamic",
-    key: "dynamic",
-    label: "Dynamic instructions",
-    tokens: b.dynamic_instructions_tokens,
-    items: [],
-    note: "Per-turn runtime notes (context pressure, reminders)."
-  }), out.push({
-    id: "messages",
-    key: "messages",
-    label: "Conversation",
-    tokens: b.messages_tokens,
-    items: [],
-    note: "This loop\u2019s history, compaction summary included (estimate)."
-  }), byTokens(out);
-}
-
 export {
   DOCS_GUIDES_URL,
   ADF_SKILLS_REGISTRY_URL,
@@ -500,12 +257,5 @@ export {
   DEFAULT_BASE_PROMPT,
   DEFAULT_TOOL_PROMPTS,
   DEFAULT_DYNAMIC_PROMPTS,
-  DEFAULT_COMPACTION_PROMPT,
-  checkFetchTarget,
-  checkConnectTarget,
-  resolveCompactThreshold,
-  resolveLoopThreshold,
-  contextTotal,
-  contextCategories,
-  context_breakdown_exports
+  DEFAULT_COMPACTION_PROMPT
 };

package/dist/chunks/{chunk-TPRZQ7Z4.mjs → chunk-LGL6ML37.mjs}

@@ -8,10 +8,10 @@ import {
   classifyRedirectTarget,
   parseBracedExpansion,
   unsupportedDevTargetMessage
-} from "./chunk-5W7KES6P.mjs";
+} from "./chunk-UZPDETEU.mjs";
 import {
   resolveWithDefault
-} from "./chunk-HPVFJYXR.mjs";
+} from "./chunk-ESP3VNMX.mjs";
 import {
   EXIT,
   enforceToolGate,
@@ -21,7 +21,7 @@ import {
   getCommand,
   notifyToolCallObservers,
   shellReadFile
-} from "./chunk-ZROSGV65.mjs";
+} from "./chunk-YRMKSHW3.mjs";
 
 // src/main/tools/shell/executor/pipeline-executor.ts
 function vfsPath(p) {
@@ -147,7 +147,7 @@ async function executeCommand(cmd, stdin, ctx) {
   for (let r of redirects) {
     if (r.type === "in" && r.target !== void 0) {
       let [redirectContent, redirectErr] = await shellReadFile(ctx.toolRegistry, ctx.workspace, vfsPath(r.target));
-      if (redirectErr)
+      if (redirectErr !== null)
         return err(`${name}: ${redirectErr}`);
       stdin = redirectContent;
     }

package/dist/chunks/chunk-LKFHERRV.mjs

@@ -0,0 +1,145 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+import {
+  __export
+} from "./chunk-M2RX3S2T.mjs";
+
+// src/shared/utils/file-ref.ts
+var file_ref_exports = {};
+__export(file_ref_exports, {
+  adfFileUrl: () => adfFileUrl,
+  applyFileRefChanges: () => applyFileRefChanges,
+  attachmentMetadata: () => attachmentMetadata,
+  attachmentText: () => attachmentText,
+  attachmentsOf: () => attachmentsOf,
+  deletedFilePlaceholder: () => deletedFilePlaceholder,
+  displayAttachment: () => displayAttachment,
+  fileRefKind: () => fileRefKind,
+  fileRefName: () => fileRefName,
+  fileRefText: () => fileRefText,
+  isAudioInputMime: () => isAudioInputMime,
+  isFileRefBlock: () => isFileRefBlock,
+  isVideoInputMime: () => isVideoInputMime,
+  isVisionMime: () => isVisionMime,
+  mediaKindOfMime: () => mediaKindOfMime,
+  splitLegacyUploads: () => splitLegacyUploads
+});
+var VISION_MIMES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]), AUDIO_INPUT_MIMES = /* @__PURE__ */ new Set([
+  "audio/wav",
+  "audio/mpeg",
+  "audio/mp3",
+  "audio/aiff",
+  "audio/aac",
+  "audio/ogg",
+  "audio/flac",
+  "audio/x-m4a",
+  "audio/webm"
+]), VIDEO_INPUT_MIMES = /* @__PURE__ */ new Set(["video/mp4", "video/mpeg", "video/quicktime", "video/webm"]);
+function isVisionMime(mime) {
+  return !!mime && VISION_MIMES.has(mime);
+}
+function isAudioInputMime(mime) {
+  return !!mime && AUDIO_INPUT_MIMES.has(mime);
+}
+function isVideoInputMime(mime) {
+  return !!mime && VIDEO_INPUT_MIMES.has(mime);
+}
+function mediaKindOfMime(mime) {
+  if (isVisionMime(mime)) return "image";
+  if (isAudioInputMime(mime)) return "audio";
+  if (isVideoInputMime(mime)) return "video";
+}
+function isFileRefBlock(block) {
+  return block.type === "file_ref" && !!block.file_ref && typeof block.file_ref.path == "string";
+}
+function fileRefKind(ref) {
+  return mediaKindOfMime(ref.mime_type);
+}
+function fileRefName(ref) {
+  let segments = ref.path.split("/");
+  return segments[segments.length - 1] || ref.path;
+}
+function deletedFilePlaceholder(ref) {
+  return `[deleted: ${fileRefName(ref)}]`;
+}
+function adfFileUrl(path) {
+  return `adf-file://${path.split("/").map(encodeURIComponent).join("/")}`;
+}
+function displayAttachment(ref) {
+  let kind = fileRefKind(ref);
+  return {
+    path: ref.path,
+    name: fileRefName(ref),
+    mime_type: ref.mime_type,
+    ...kind ? { kind } : {},
+    ...ref.deleted ? { deleted: !0 } : {}
+  };
+}
+function attachmentsOf(blocks) {
+  let out = [];
+  for (let block of blocks) isFileRefBlock(block) && out.push(displayAttachment(block.file_ref));
+  return out;
+}
+function attachmentMetadata(content, previews = []) {
+  let attachments = attachmentsOf(content);
+  if (!(attachments.length === 0 && previews.length === 0))
+    return { ...previews.length > 0 ? { imagePreviewUrls: previews } : {}, ...attachments.length > 0 ? { attachments } : {} };
+}
+function attachmentText(a) {
+  return a.deleted ? deletedFilePlaceholder(a) : `[${a.kind ?? "file"}: ${a.name}]`;
+}
+var LEGACY_UPLOAD_LINE = /^\[Uploaded file: .+ \(([^,()]+), [^()]+\)\. Use fs_read with path "(.+)" to inspect it\.\]$/;
+function splitLegacyUploads(text) {
+  if (!text.includes("[Uploaded file: ")) return { text, attachments: [] };
+  let attachments = [], kept = [];
+  for (let line of text.split(`
+`)) {
+    let match = LEGACY_UPLOAD_LINE.exec(line.trim());
+    if (!match) {
+      kept.push(line);
+      continue;
+    }
+    let kind = mediaKindOfMime(match[1]);
+    attachments.push({ path: match[2], name: fileRefName({ path: match[2] }), mime_type: match[1], ...kind ? { kind } : {} });
+  }
+  return { text: kept.join(`
+`).trim(), attachments };
+}
+function fileRefText(ref) {
+  return ref.deleted ? deletedFilePlaceholder(ref) : `[${fileRefKind(ref) ?? "file"}: ${ref.path}]`;
+}
+function applyFileRefChanges(blocks, changes) {
+  let out = null;
+  for (let i = 0; i < blocks.length; i++) {
+    let block = blocks[i];
+    if (!isFileRefBlock(block) || block.file_ref.deleted) continue;
+    let ref = block.file_ref;
+    for (let change of changes) {
+      if (ref.deleted) break;
+      change.op === "rename" && ref.path === change.from ? ref = { ...ref, path: change.to } : change.op === "delete" && ref.path === change.path && (ref = { ...ref, deleted: !0 });
+    }
+    ref !== block.file_ref && (out ??= blocks.slice(), out[i] = { ...block, file_ref: ref });
+  }
+  return out ?? blocks;
+}
+
+export {
+  isVisionMime,
+  isAudioInputMime,
+  isVideoInputMime,
+  mediaKindOfMime,
+  isFileRefBlock,
+  fileRefKind,
+  fileRefName,
+  deletedFilePlaceholder,
+  displayAttachment,
+  attachmentsOf,
+  splitLegacyUploads,
+  fileRefText,
+  applyFileRefChanges,
+  file_ref_exports
+};

package/dist/chunks/chunk-LTX74NU6.mjs

@@ -0,0 +1,29 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+
+// src/main/utils/secret-file.ts
+import { execFileSync } from "node:child_process";
+import { chmodSync } from "node:fs";
+import { userInfo } from "node:os";
+function restrictToCurrentUserWindows(path, run = (file, args) => {
+  execFileSync(file, args, { windowsHide: !0, stdio: ["ignore", "ignore", "pipe"] });
+}) {
+  let user = process.env.USERDOMAIN && process.env.USERNAME ? `${process.env.USERDOMAIN}\\${process.env.USERNAME}` : userInfo().username;
+  run("icacls", [path, "/inheritance:r", "/grant:r", `${user}:F`]);
+}
+function protectSecretFile(path, opts = {}) {
+  try {
+    return (opts.platform ?? process.platform) === "win32" ? restrictToCurrentUserWindows(path, opts.run) : chmodSync(path, 384), !0;
+  } catch (err) {
+    return console.warn(`[SecretFile] Could not restrict ${path} to the current user: ${err instanceof Error ? err.message : String(err)}`), !1;
+  }
+}
+
+export {
+  restrictToCurrentUserWindows,
+  protectSecretFile
+};