@ai-ecoverse/slicc-spectrum 1.60.2 → 1.62.0

package/dist/slicc-ui.js

@@ -6304,10 +6304,10 @@ function getNearestOverflowAncestor(node) {
   }
   return getNearestOverflowAncestor(parentNode);
 }
-function getOverflowAncestors(node, list4, traverseIframes) {
+function getOverflowAncestors(node, list5, traverseIframes) {
   var _node$ownerDocument2;
-  if (list4 === void 0) {
-    list4 = [];
+  if (list5 === void 0) {
+    list5 = [];
   }
   if (traverseIframes === void 0) {
     traverseIframes = true;
@@ -6317,9 +6317,9 @@ function getOverflowAncestors(node, list4, traverseIframes) {
   const win = getWindow(scrollableAncestor);
   if (isBody) {
     const frameElement = getFrameElement(win);
-    return list4.concat(win, win.visualViewport || [], isOverflowElement(scrollableAncestor) ? scrollableAncestor : [], frameElement && traverseIframes ? getOverflowAncestors(frameElement) : []);
+    return list5.concat(win, win.visualViewport || [], isOverflowElement(scrollableAncestor) ? scrollableAncestor : [], frameElement && traverseIframes ? getOverflowAncestors(frameElement) : []);
   } else {
-    return list4.concat(scrollableAncestor, getOverflowAncestors(scrollableAncestor, [], traverseIframes));
+    return list5.concat(scrollableAncestor, getOverflowAncestors(scrollableAncestor, [], traverseIframes));
   }
 }
 function getFrameElement(win) {
@@ -12300,7 +12300,7 @@ function remoteLight(status2) {
       "linked devices are watching the agent."
     )
   ].join(" ");
-  const by = (list4) => list4.length === 1 ? list4[0].name : `${list4.length} linked devices`;
+  const by = (list5) => list5.length === 1 ? list5[0].name : `${list5.length} linked devices`;
   if (asking2.length) {
     const text2 = asking2.length === 1 ? `${asking2[0].name} asks to follow` : `${asking2.length} devices ask to follow`;
     return { mode: "ask", variant: "notice", text: text2, tooltip };
@@ -12908,8 +12908,8 @@ var SliccNetwork = class extends ModelElement {
     }
     const device = status2.links?.devices.find((item2) => item2.id === exit.id);
     if (device?.state === "connected") return A;
-    const who = device ? `${device.name} is ${device.state}` : "The linked device isn\u2019t connected";
-    return b`<div class="warning" data-exit="device" data-held><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><div class="banner"><span>${who}. Internet traffic waits until it’s connected.</span><div class="actions"><swc-button size="s" variant="secondary" fill-style="outline" data-action="exit-direct" ?pending=${this.busy === "exit"} ?disabled=${this.#waiting("exit")} @click=${() => this.#act("exit", () => port.setExit?.(null), "error")}>Send directly</swc-button></div></div></div>`;
+    const who2 = device ? `${device.name} is ${device.state}` : "The linked device isn\u2019t connected";
+    return b`<div class="warning" data-exit="device" data-held><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><div class="banner"><span>${who2}. Internet traffic waits until it’s connected.</span><div class="actions"><swc-button size="s" variant="secondary" fill-style="outline" data-action="exit-direct" ?pending=${this.busy === "exit"} ?disabled=${this.#waiting("exit")} @click=${() => this.#act("exit", () => port.setExit?.(null), "error")}>Send directly</swc-button></div></div></div>`;
   }
   #exitPicker(port, status2) {
     const tailnet = status2.tailnet;
@@ -13694,8 +13694,8 @@ var Panels = class {
     if (bad) return bad;
     this.quietly(() => this.#host.open(id, focus, section));
     if (place3) {
-      const moved = this.move(id, place3);
-      if (moved.code !== 0) return moved;
+      const moved2 = this.move(id, place3);
+      if (moved2.code !== 0) return moved2;
     }
     return ok(`${focus ? "focused" : info.open ? "showed" : "opened"} ${id}`);
   }
@@ -13816,37 +13816,37 @@ function coneOf(agents, id) {
   }
   return agent?.kind === "cone" ? agent.id : null;
 }
-function resolve(panels, raw2, reachable, cone) {
+function resolve(panels, raw2, reachable2, cone) {
   if (/^(file|diff):./.test(raw2)) return raw2;
   if (raw2 === "chat") {
     const agent = cone === void 0 ? panels.active() : cone;
-    return reachable.some((info) => info.id === `chat:${agent}`) ? `chat:${agent}` : null;
+    return reachable2.some((info) => info.id === `chat:${agent}`) ? `chat:${agent}` : null;
   }
   if (raw2 === "terminal") {
-    const terminals = reachable.filter((info) => info.kind === "terminal");
+    const terminals = reachable2.filter((info) => info.kind === "terminal");
     const picked = terminals.find((info) => info.active) ?? terminals.filter((info) => info.open).at(-1) ?? terminals.at(-1);
     return picked?.id ?? null;
   }
-  if (reachable.some((info) => info.id === raw2)) return raw2;
+  if (reachable2.some((info) => info.id === raw2)) return raw2;
   const name = raw2.startsWith("sprinkle:") ? raw2.slice(9) : raw2;
-  const sprinkles = reachable.filter((info) => info.kind === "sprinkle");
+  const sprinkles = reachable2.filter((info) => info.kind === "sprinkle");
   const found = sprinkles.find((info) => info.id === `sprinkle:${name}`) ?? sprinkles.find((info) => cone && info.id === `sprinkle:${cone}/${name}`) ?? sprinkles.find((info) => info.id.split("/").at(-1) === name);
   return found?.id ?? null;
 }
 function state(info) {
-  const shown2 = info.active ? "active" : info.visible ? "shown" : info.open ? "open" : "closed";
-  return info.busy ? `${shown2} \xB7 busy: ${info.busy}` : shown2;
+  const shown3 = info.active ? "active" : info.visible ? "shown" : info.open ? "open" : "closed";
+  return info.busy ? `${shown3} \xB7 busy: ${info.busy}` : shown3;
 }
 function table(rows) {
   const lines = [["ID", "TITLE", "STATE"], ...rows.map((row) => [row.id, row.title, state(row)])];
   const widths = [0, 1].map((column) => Math.max(...lines.map((line) => line[column].length)));
-  return lines.map(([id, title, shown2]) => `${id.padEnd(widths[0])}  ${title.padEnd(widths[1])}  ${shown2}`).join("\n");
+  return lines.map(([id, title, shown3]) => `${id.padEnd(widths[0])}  ${title.padEnd(widths[1])}  ${shown3}`).join("\n");
 }
 var done = (result, note = "") => result.code === 0 ? { stdout: `${result.message}${note}
 `, stderr: "", code: 0 } : { stdout: "", stderr: `panel: ${result.message}
 `, code: result.code };
 function act(scope, parsed) {
-  const { panels, reachable, cone } = scope;
+  const { panels, reachable: reachable2, cone } = scope;
   if (parsed.verb === "reset") {
     const recent = scope.agent ? panels.recentClose() : null;
     if (recent)
@@ -13856,11 +13856,11 @@ function act(scope, parsed) {
     return done(panels.reset());
   }
   const raw2 = parsed.id;
-  const id = resolve(panels, raw2, reachable, cone);
+  const id = resolve(panels, raw2, reachable2, cone);
   if (!id) return done(unknown(raw2));
   let place3 = parsed.place;
   if (typeof place3 === "object") {
-    const ref = resolve(panels, place3.ref, reachable, cone);
+    const ref = resolve(panels, place3.ref, reachable2, cone);
     if (!ref) return done(unknown(place3.ref));
     place3 = { ...place3, ref };
   }
@@ -13895,12 +13895,12 @@ ${help}`, code: 2 };
   const agents = panels.agents();
   const scoped2 = caller.agentId !== null || !!caller.cone;
   const cone = scoped2 ? caller.cone ?? coneOf(agents, caller.agentId) : void 0;
-  const reachable = panels.list().filter(
+  const reachable2 = panels.list().filter(
     (info) => !scoped2 || info.agent === null || !!cone && coneOf(agents, info.agent) === cone
   );
   if (parsed.verb !== "list")
-    return act({ panels, agent: caller.agentId !== null, cone, reachable }, parsed);
-  const body4 = parsed.json ? JSON.stringify(reachable, null, 2) : table(reachable);
+    return act({ panels, agent: caller.agentId !== null, cone, reachable: reachable2 }, parsed);
+  const body4 = parsed.json ? JSON.stringify(reachable2, null, 2) : table(reachable2);
   return { stdout: `${body4}
 `, stderr: "", code: 0 };
 }
@@ -20681,12 +20681,12 @@ function user(message) {
   const tag3 = delivered === "steer" || delivered === "follow-up" ? deliveries[delivered] : null;
   const agent = message.origin === "agent";
   const name = message.from ?? "an agent";
-  const who = agent ? name : message.from ? `From ${message.from}` : "You";
+  const who2 = agent ? name : message.from ? `From ${message.from}` : "You";
   const label = agent ? `Request from ${name}` : message.from ? `Message from ${message.from}` : "Your message";
   return b`<swc-conversation-turn type="user" class="message user" accessible-label=${label} data-id=${message.id} data-mode=${message.mode ?? "send"} data-delivered=${delivered ?? "run"} data-origin=${message.origin ?? "user"}>
     <div class="bubble">
       <div class="meta">
-        <span class="who">${who}</span><span>${time(message.createdAt)}</span>
+        <span class="who">${who2}</span><span>${time(message.createdAt)}</span>
         ${agent ? b`<swc-badge class="origin" size="s" variant="indigo">Agent</swc-badge>` : A}
         ${tag3 ? b`<swc-badge class="tag" size="s" variant=${delivered === "steer" ? "notice" : "informative"} subtle>${tag3}</swc-badge>` : A}
       </div>
@@ -21945,8 +21945,8 @@ var SliccUpdates = class extends ModelElement {
   #checked(at) {
     if (at === null) return b`<span>Not checked yet</span>`;
     const date = new Date(at);
-    const shown2 = date.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short" });
-    return b`<span>Checked <time datetime=${date.toISOString()}>${shown2}</time></span>`;
+    const shown3 = date.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short" });
+    return b`<span>Checked <time datetime=${date.toISOString()}>${shown3}</time></span>`;
   }
   #item(item2) {
     const [variant, state3] = states[item2.state];
@@ -22011,14 +22011,14 @@ var SliccUpdates = class extends ModelElement {
   #package(item2, all2, act2) {
     const light = packageLight(item2);
     const busy = this.busy.get(item2.id);
-    const shown2 = busy ? [busy] : act2 ? item2.actions : [];
+    const shown3 = busy ? [busy] : act2 ? item2.actions : [];
     const error = this.problems.get(item2.id) ?? item2.error;
     return b`<li data-id=${item2.id} data-state=${item2.state}>
       <div class="name">
         <h3 title=${item2.package}>${item2.label}</h3>
         ${light ? b`<swc-status-light size="s" variant=${light[0]}>${light[1]}</swc-status-light>` : A}
       </div>
-      <div class="buttons">${shown2.map(
+      <div class="buttons">${shown3.map(
       (action) => b`<swc-button
             size="s"
             variant="secondary"
@@ -22035,7 +22035,7 @@ var SliccUpdates = class extends ModelElement {
       (warning) => b`<span><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle>${warning}</span>`
     )}</p>` : A}
       ${item2.commands.length ? b`<p class="commands"><span class="hidden">Commands: </span>${item2.commands.map(
-      (command2) => b`<code>${command2}</code>`
+      (command3) => b`<code>${command3}</code>`
     )}</p>` : A}
       ${this.#packageProgress(item2)}
       ${error ? b`<div class="error" role="alert" data-error>
@@ -22716,9 +22716,9 @@ var SliccApp = class extends ThemedElement {
     if (!model) return [];
     const selected = this.#cone();
     const cones = model.agent.list().filter((agent) => agent.kind === "cone");
-    const list4 = model.sprinkles.list();
-    const order = [selected, ...cones.map((cone) => cone.id), ...list4.map((item2) => item2.agentId)];
-    return list4.map((sprinkle) => {
+    const list5 = model.sprinkles.list();
+    const order = [selected, ...cones.map((cone) => cone.id), ...list5.map((item2) => item2.agentId)];
+    return list5.map((sprinkle) => {
       const cone = cones.find((agent) => agent.id === sprinkle.agentId && agent.id !== selected);
       return cone ? { ...sprinkle, title: `${cone.name} / ${sprinkle.title}` } : sprinkle;
     }).sort((a22, b13) => order.indexOf(a22.agentId) - order.indexOf(b13.agentId));
@@ -22774,11 +22774,11 @@ var SliccApp = class extends ThemedElement {
   #rail(items, side) {
     const primary = side === "bottom" ? items.filter((item2) => phoneRail.includes(item2.id)) : items;
     const fit = primary.length < items.length ? Math.min(primary.length, railCapacity(this.#width, Infinity)) : railCapacity(this.#width, items.length);
-    const shown2 = side === "bottom" ? primary.slice(0, fit) : items;
-    const grouped = new Set(shown2.map((item2) => item2.cone).filter(Boolean)).size > 1;
-    return b`<nav class=${`rail ${side}`} aria-label=${`Panels, ${side}`} @dragover=${this.#railOver} @dragleave=${this.#railLeave} @drop=${this.#railDrop}>${shown2.map(
-      (item2, index) => b`${grouped && index && shown2[index - 1].cone !== item2.cone ? b`<span class="cones" aria-hidden="true"></span>` : A}${this.#railButton(item2, side)}`
-    )}${this.#more(items.filter((item2) => !shown2.includes(item2)))}</nav>`;
+    const shown3 = side === "bottom" ? primary.slice(0, fit) : items;
+    const grouped = new Set(shown3.map((item2) => item2.cone).filter(Boolean)).size > 1;
+    return b`<nav class=${`rail ${side}`} aria-label=${`Panels, ${side}`} @dragover=${this.#railOver} @dragleave=${this.#railLeave} @drop=${this.#railDrop}>${shown3.map(
+      (item2, index) => b`${grouped && index && shown3[index - 1].cone !== item2.cone ? b`<span class="cones" aria-hidden="true"></span>` : A}${this.#railButton(item2, side)}`
+    )}${this.#more(items.filter((item2) => !shown3.includes(item2)))}</nav>`;
   }
   #rails() {
     const dock = this.renderRoot.querySelector("slicc-dock");
@@ -23021,6 +23021,202 @@ function sudo(approval) {
   const as = approval.target && approval.target !== "root" ? `-u ${approval.target} ` : "";
   return `sudo ${as}${approval.command}`;
 }
+var rulePaths = ["/etc/fnox", "/etc/fnox/config.toml", "/etc/slicc/secrets-policy.toml"];
+var ruleParents = ["/", "/etc", "/etc/slicc"];
+function absolute(cwd, word) {
+  const parts2 = [];
+  for (const part2 of `${word.startsWith("/") ? "" : cwd}/${word}`.split("/")) {
+    if (part2 === "..") parts2.pop();
+    else if (part2 && part2 !== ".") parts2.push(part2);
+    const alias = parts2.join("/").match(/^proc\/([^/]+)\/(?:task\/[^/]+\/)?(root|cwd)$/);
+    if (alias?.[2] === "root") parts2.length = 0;
+    else if (alias && /^(?:self|thread-self)$/.test(alias[1]))
+      parts2.splice(0, parts2.length, ...cwd.split("/").filter(Boolean));
+  }
+  return `/${parts2.join("/")}`;
+}
+function pattern(path) {
+  const source = path.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "
").replace(/\*\*/g, "").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]").replace(/\u0001/g, "(?:.*/)?").replace(/\u0002/g, ".*");
+  return new RegExp(`^${source}$`);
+}
+var opaque = /^\/(?:proc\/[^/]+\/(?:task\/[^/]+\/)?(?:cwd|fd|map_files)|dev\/fd)(?:\/|$)/;
+var certain = (rules) => rules.startsWith("/") && !opaque.test(rules) && !rules.endsWith("\u2026");
+var readOnly = [
+  "cat",
+  "cd",
+  "df",
+  "diff",
+  "du",
+  "echo",
+  "file",
+  "grep",
+  "head",
+  "ls",
+  "pwd",
+  "readlink",
+  "realpath",
+  "stat",
+  "tail",
+  "tree",
+  "wc"
+];
+function candidates(word) {
+  if (word === "--") return [];
+  if (word.startsWith("--")) return [word];
+  if (!word.startsWith("-")) return [word];
+  const slash = word.indexOf("/");
+  const cluster2 = Array.from(word.slice(2), (_9, index) => word.slice(index + 2));
+  return [...cluster2, ...slash > 2 ? [word.slice(slash)] : []];
+}
+function protects(path, whole) {
+  const inside = (candidate) => candidate === "/etc/fnox" || candidate.startsWith("/etc/fnox/");
+  if (opaque.test(path)) return true;
+  if (/[[{$]/.test(path)) {
+    const prefix = path.slice(0, path.search(/[*?[{$]/));
+    return inside(prefix) || rulePaths.some((rule) => rule.startsWith(prefix));
+  }
+  if (!/[*?]/.test(path))
+    return inside(path) || rulePaths.includes(path) || whole && ruleParents.includes(path);
+  const glob = pattern(path);
+  const top = path.split("/").slice(0, 3).join("/");
+  return rulePaths.some((rule) => glob.test(rule)) || top !== path && pattern(top).test("/etc/fnox") || whole && ruleParents.some((parent) => glob.test(parent));
+}
+var command2 = (word) => word.split("/").pop() ?? "";
+var trusted = (word) => readOnly.includes(word.replace(/^\/(?:usr\/)?bin\/(?=[^/]+$)/, ""));
+var expansion = /\$\([^)]*\)?|\$\{[^}]*\}?|\$[\w@*#?$!-]*|`[^`]*`?/;
+function moved(cwds, word) {
+  for (const cwd of [...cwds]) {
+    const next = absolute(cwd, word);
+    if (protects(next, false) || cwds.size >= 64) return next;
+    cwds.add(next);
+  }
+  return null;
+}
+function touched(cwds, word, whole) {
+  for (const candidate of candidates(word))
+    for (const cwd of cwds) {
+      const path = absolute(cwd, candidate);
+      if (protects(path, whole)) return path;
+    }
+  return null;
+}
+function ansi(command3) {
+  const escape2 = /\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8})|([0-7]{1,3})|([\s\S]))/g;
+  return command3.replace(
+    /\$'((?:[^'\\]|\\[\s\S])*)'/g,
+    (_9, body4) => `'${body4.replace(escape2, (_match, hex, short2, long, octal, plain) => {
+      if (octal) return String.fromCharCode(Number.parseInt(octal, 8));
+      if (plain) return plain;
+      return String.fromCodePoint(
+        Math.min(Number.parseInt(hex ?? short2 ?? long, 16), 1114111)
+      );
+    }).replace(/'/g, "'\\''")}'`
+  ).replace(/\$"/g, '"');
+}
+function unglob(command3) {
+  const chars = Array.from(command3);
+  const close = /* @__PURE__ */ new Map();
+  const open = [];
+  for (const [index, char] of chars.entries()) {
+    if (char === "(") open.push(index);
+    else if (char === ")" && open.length) close.set(open.pop(), index);
+  }
+  const out = [];
+  for (let index = 0; index < chars.length; index++) {
+    const end = close.get(index);
+    if (end !== void 0 && /^[?*+@!]$/.test(out.at(-1) ?? "")) {
+      out[out.length - 1] = "*";
+      index = end;
+    } else out.push(chars[index]);
+  }
+  return out.join("");
+}
+var separators = /[;&|\n()`]/;
+function hide2(char) {
+  return separators.test(char) ? String.fromCharCode(57344 + char.charCodeAt(0)) : char;
+}
+function unshield(segment2) {
+  return segment2.replace(
+    /[\ue000-\ue07f]/g,
+    (char) => String.fromCharCode(char.charCodeAt(0) - 57344)
+  );
+}
+function shield(text2) {
+  let out = "";
+  let quote = "";
+  for (let index = 0; index < text2.length; index++) {
+    const char = text2[index];
+    if (quote === '"' && char === "\\") out += hide2(char) + hide2(text2[++index] ?? "");
+    else if (quote) {
+      out += char === quote ? char : hide2(char);
+      if (char === quote) quote = "";
+    } else if (char === "'" || char === '"') {
+      quote = char;
+      out += char;
+    } else if (char === "\\") out += char + hide2(text2[++index] ?? "");
+    else out += char;
+  }
+  return out;
+}
+function quoted(segment2) {
+  const words = [];
+  let word = "";
+  let quote = "";
+  for (let index = 0; index < segment2.length; index++) {
+    const char = segment2[index];
+    if (quote === '"' && char === "\\" && /["\\$`\n]/.test(segment2[index + 1] ?? ""))
+      word += segment2[++index];
+    else if (quote) {
+      if (char === quote) quote = "";
+      else word += char;
+    } else if (char === "'" || char === '"') quote = char;
+    else if (char === "\\") word += segment2[++index] ?? "";
+    else if (/[\s<>=]/.test(char)) {
+      words.push(word);
+      word = "";
+    } else word += char;
+  }
+  return [...words, word];
+}
+function commas(words) {
+  return words.flatMap((word) => word.includes(",") ? [word, ...word.split(",")] : [word]).filter(Boolean);
+}
+function scan2(words, cwds, whole) {
+  let cd = false;
+  for (const [index, word] of words.entries()) {
+    let hit = null;
+    if (index === 0 || words[index - 1] === "-c") {
+      cd = ["cd", "pushd"].includes(command2(word));
+      hit = touched(cwds, word, whole);
+    } else if (!cd) hit = touched(cwds, word, whole);
+    else if (!word.startsWith("-")) {
+      cd = false;
+      hit = moved(cwds, word);
+    }
+    if (hit) return hit;
+  }
+  return null;
+}
+function secretRules(approval) {
+  if (approval.command.length > 4096) return `${approval.command.slice(0, 40)}\u2026`;
+  const start = absolute("/", approval.cwd ?? "/");
+  if (protects(start, false)) return start;
+  const cwds = /* @__PURE__ */ new Set([start]);
+  const text2 = unglob(ansi(approval.command.replace(/\\\n/g, "")));
+  const plain = text2.split(separators).map((segment2) => commas(segment2.split(/[\s<>=]+/).map((word) => word.replace(/['"\\]/g, ""))));
+  const aware = shield(text2).split(separators).map((segment2) => commas(quoted(unshield(segment2))));
+  const segments = JSON.stringify(aware) === JSON.stringify(plain) ? plain : [...plain, ...aware];
+  const whole = segments.some((words) => words.length > 0 && !trusted(words[0]));
+  for (const words of segments) {
+    const hit = scan2(words, cwds, whole);
+    if (hit) return hit;
+  }
+  const named = segments.flat().find((word) => !word.startsWith("/") && /fnox|secrets-policy/.test(word));
+  if (named) return absolute([...cwds].pop() ?? start, named);
+  const home2 = segments.flat().find((word) => /^~(?:[+-](?:\/|$)|.*\/\.\.(?:\/|$))/.test(word));
+  if (home2) return home2;
+  return segments.flat().some((word) => word.includes("$")) || text2.includes("`") ? text2.match(expansion)[0] : null;
+}
 function waiting(model, now) {
   return [...model?.approvals?.list() ?? []].filter((approval) => approval.expiresAt > now).sort((a22, b13) => a22.createdAt - b13.createdAt);
 }
@@ -23086,6 +23282,27 @@ var SliccApprovals = class extends ModelElement {
         margin-block-start: var(--swc-spacing-300);
         font-variant-numeric: tabular-nums;
       }
+      .rules {
+        display: flex;
+        align-items: flex-start;
+        gap: var(--swc-spacing-100);
+        margin-block-start: var(--swc-spacing-200);
+        padding: var(--swc-spacing-200) var(--swc-spacing-300);
+        border-radius: var(--swc-corner-radius-medium-default);
+        background: var(--swc-notice-subtle-background-color-default);
+        --swc-icon-color: var(--swc-icon-color-notice);
+      }
+      .rules swc-icon-alert-triangle {
+        flex: none;
+        margin-block-start: 0.15em;
+      }
+      .rules p {
+        margin: 0;
+      }
+      .rules code {
+        font-family: var(--swc-code-font-family-stack);
+        overflow-wrap: anywhere;
+      }
       .problem {
         display: flex;
         align-items: flex-start;
@@ -23140,6 +23357,7 @@ var SliccApprovals = class extends ModelElement {
   async decide(approval, decision) {
     const port = this.model?.approvals;
     if (!port?.decide || this.busy || decision !== "deny" && !this.#armed) return;
+    if (decision === "always" && secretRules(approval)) return;
     this.busy = decision;
     this.failure = null;
     this.#pending.add(approval.id);
@@ -23161,15 +23379,15 @@ var SliccApprovals = class extends ModelElement {
   }
   willUpdate(changed) {
     super.willUpdate(changed);
-    const list4 = this.#current();
+    const list5 = this.#current();
     const showing = this.#showing;
     if (showing && this.#pending.has(showing.id)) return;
-    if (showing && !this.gone && !this.#done.has(showing.id) && !list4.some((approval) => approval.id === showing.id)) {
+    if (showing && !this.gone && !this.#done.has(showing.id) && !list5.some((approval) => approval.id === showing.id)) {
       const reason = this.#ended.get(showing.id) ?? (showing.expiresAt <= this.now ? "expired" : "answered");
       if (reason !== "withdrawn") this.gone = { approval: showing, reason: gone(reason) };
     }
     if (this.gone) return;
-    const next = list4[0] ?? null;
+    const next = list5[0] ?? null;
     if (next?.id === showing?.id) return;
     this.#showing = next;
     clearTimeout(this.#arming);
@@ -23240,10 +23458,12 @@ var SliccApprovals = class extends ModelElement {
       );
     }
     const held = this.#showing && this.#pending.has(this.#showing.id) ? this.#showing : null;
-    const list4 = this.#current();
-    const [approval, ...rest] = held ? [held, ...list4.filter(({ id }) => id !== held.id)] : list4;
+    const list5 = this.#current();
+    const [approval, ...rest] = held ? [held, ...list5.filter(({ id }) => id !== held.id)] : list5;
     if (!approval) return A;
     const failure2 = this.failure?.id === approval.id ? this.failure.message : "";
+    const rules = secretRules(approval);
+    const always = approval.always && !rules;
     return this.#dialog(
       approval,
       approval.id,
@@ -23251,12 +23471,13 @@ var SliccApprovals = class extends ModelElement {
           <h2 id="title" slot="heading">Allow sudo?</h2>
           ${this.#request(approval)}
           ${approval.cwd ? b`<p class="cwd">In ${approval.cwd}</p>` : A}
-          ${approval.always ? b`<p class="hint">Always allow lets ${approval.requester.name} run exactly this command with sudo without asking again.</p>` : A}
+          ${rules ? b`<div class="rules" data-secret-rules=${rules}><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><p>${certain(rules) ? b`<strong>This changes secret rules.</strong> It names <code>${rules}</code>, where SLICC keeps which secrets programs may use and where they may be sent.` : b`<strong>This may change secret rules.</strong> SLICC can't tell where <code>${rules}</code> leads, and it could reach the files where SLICC keeps which secrets programs may use and where they may be sent.`} Allow it only if you asked for this change.</p></div>` : A}
+          ${always ? b`<p class="hint">Always allow lets ${approval.requester.name} run exactly this command with sudo without asking again.</p>` : A}
           ${failure2 ? b`<p class="problem" role="alert" data-error><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>${failure2}</span></p>` : A}
           <p class="timer" data-timer>Denied automatically in ${countdown(approval.expiresAt - this.now)}.</p>
           ${rest.length ? b`<p class="more" data-more>${rest.length === 1 ? "1 more request is waiting." : `${rest.length} more requests are waiting.`}</p>` : A}
           ${this.#button(approval, "deny", "Deny", "secondary")}
-          ${approval.always ? this.#button(approval, "always", "Always allow", "secondary") : A}
+          ${always ? this.#button(approval, "always", "Always allow", "secondary") : A}
           ${this.#button(approval, "once", "Allow once", "accent")}
         </sp-alert-dialog>`
     );
@@ -24168,9 +24389,9 @@ var SliccBrowser = class extends ModelElement {
     if (visible2 && tab && !this.#ticker)
       this.#ticker = setInterval(() => this.requestUpdate(), 1e3);
     if (!(visible2 && tab)) this.#still();
-    const list4 = this.renderRoot.querySelector(".actions:not(.last)");
-    const count = list4?.childElementCount ?? 0;
-    if (list4 && count !== this.#count) list4.scrollTop = list4.scrollHeight;
+    const list5 = this.renderRoot.querySelector(".actions:not(.last)");
+    const count = list5?.childElementCount ?? 0;
+    if (list5 && count !== this.#count) list5.scrollTop = list5.scrollHeight;
     this.#count = count;
   }
   #still() {
@@ -25064,18 +25285,18 @@ function failedTurns(messages, messageId) {
   }
   return ids;
 }
-var touched = false;
+var touched2 = false;
 document.addEventListener(
   "pointerdown",
   (event2) => {
-    touched = event2.pointerType !== "mouse";
+    touched2 = event2.pointerType !== "mouse";
   },
   true
 );
 document.addEventListener(
   "keydown",
   () => {
-    touched = false;
+    touched2 = false;
   },
   true
 );
@@ -25251,7 +25472,7 @@ var SliccChat = class extends ThemedElement {
     this.#observe();
   }
   focus() {
-    if (!touched && globalThis.matchMedia("(pointer: fine)").matches)
+    if (!touched2 && globalThis.matchMedia("(pointer: fine)").matches)
       this.focusOn("slicc-composer", ".log");
     else this.focusOn(".log");
   }
@@ -26257,7 +26478,7 @@ e25("swc-icon-clock", o84);
 // src/app/composer.ts
 var limit = 25 * 1024 * 1024;
 function available(model) {
-  return commands2.filter((command2) => command2.available?.(model) ?? true);
+  return commands2.filter((command3) => command3.available?.(model) ?? true);
 }
 var commands2 = [
   {
@@ -26336,20 +26557,21 @@ function trigger(text2, caret) {
   const argument = before.match(/^\/(\w+)\s+(\S*)$/);
   if (argument)
     return { kind: "argument", start: before.length - argument[2].length, query: argument[2] };
-  const command2 = before.match(/^\/([\w:-]*)$/);
-  if (command2) return { kind: "command", start: 0, query: command2[1] };
+  const command3 = before.match(/^\/([\w:-]*)$/);
+  if (command3) return { kind: "command", start: 0, query: command3[1] };
   const mention = before.match(/(^|\s)@([\w./-]*)$/);
   if (mention)
     return { kind: "mention", start: before.length - mention[2].length - 1, query: mention[2] };
   return null;
 }
-var SliccComposer = class extends ModelElement {
+var SliccComposer = class extends ThemedElement {
   static properties = {
-    ...ModelElement.properties,
+    ...ThemedElement.properties,
     value: { state: true },
     attachments: { state: true },
     popup: { state: true },
     dictating: { state: true },
+    blocked: { state: true },
     agent: {}
   };
   #drafts = /* @__PURE__ */ new Map();
@@ -26365,6 +26587,7 @@ var SliccComposer = class extends ModelElement {
     this.attachments = [];
     this.popup = null;
     this.dictating = false;
+    this.blocked = false;
     this.agent = "";
   }
   static styles = [
@@ -26403,6 +26626,38 @@ var SliccComposer = class extends ModelElement {
         border: var(--swc-border-width-100) dashed var(--swc-gray-300);
         color: var(--swc-neutral-content-color-default);
       }
+      .hold {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: var(--swc-spacing-100);
+        margin: 0 0 var(--swc-spacing-100);
+        padding: var(--swc-spacing-75) var(--swc-spacing-100) var(--swc-spacing-75) var(--swc-spacing-200);
+        border-radius: var(--swc-corner-radius-medium-default);
+        background: var(--swc-informative-subtle-background-color-default);
+        color: var(--swc-neutral-content-color-default);
+      }
+      .hold[data-hold='locked'] {
+        background: var(--swc-notice-subtle-background-color-default);
+      }
+      .hold swc-icon-lock,
+      .hold swc-progress-circle {
+        flex: none;
+      }
+      .hold .text {
+        flex: 1;
+        min-inline-size: 12em;
+      }
+      .hold .blocked {
+        flex-basis: 100%;
+        display: flex;
+        align-items: center;
+        gap: var(--swc-spacing-75);
+        color: var(--swc-negative-content-color-default);
+      }
+      .hold .held {
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
       .queued swc-icon-clock {
         flex: none;
         color: var(--swc-neutral-subdued-content-color-default);
@@ -26597,9 +26852,14 @@ var SliccComposer = class extends ModelElement {
     });
     const update = () => this.requestUpdate();
     return [
+      ...super.subscribe(model),
       model.agent.on("active", (id) => {
         if (!this.agent) this.#switch(id);
       }),
+      model.agent.on("hold", (hold) => {
+        if (hold?.reason !== "locked") this.blocked = false;
+        update();
+      }),
       model.agent.on("agents", update),
       model.agent.on("messages", update),
       model.agent.on("message", update),
@@ -26644,14 +26904,14 @@ var SliccComposer = class extends ModelElement {
     const text2 = this.value.trim();
     const attachments = this.attachments.filter((attachment2) => !attachment2.error);
     if (!model || !text2 && attachments.length === 0 || this.#held()) return;
-    const command2 = text2.match(/^\/(\w+)(?:\s+(.*))?$/);
-    const known = command2 && available(model).find((candidate) => candidate.name === command2[1]);
+    const command3 = text2.match(/^\/(\w+)(?:\s+(.*))?$/);
+    const known = command3 && available(model).find((candidate) => candidate.name === command3[1]);
     this.value = "";
     this.attachments = [];
     this.popup = null;
     this.#history = -1;
     if (known) {
-      known.run(model, this.#agent, (command2[2] ?? "").trim());
+      known.run(model, this.#agent, (command3[2] ?? "").trim());
       return;
     }
     const busy = this.#busy();
@@ -26739,22 +26999,22 @@ var SliccComposer = class extends ModelElement {
     const model = this.model;
     if (kind === "command") {
       const usable = available(model);
-      const builtins = usable.map((command2) => ({
-        value: command2.name,
-        label: `/${command2.name}`,
-        detail: command2.detail
+      const builtins = usable.map((command3) => ({
+        value: command3.name,
+        label: `/${command3.name}`,
+        detail: command3.detail
       }));
-      const own4 = model.agent.commands(this.#agent).filter((command2) => !usable.some((builtin) => builtin.name === command2.name)).map((command2) => ({
-        value: command2.name,
-        label: `/${command2.name}`,
-        detail: command2.description,
-        group: command2.kind === "skill" ? "Skills" : "Prompts"
+      const own4 = model.agent.commands(this.#agent).filter((command3) => !usable.some((builtin) => builtin.name === command3.name)).map((command3) => ({
+        value: command3.name,
+        label: `/${command3.name}`,
+        detail: command3.description,
+        group: command3.kind === "skill" ? "Skills" : "Prompts"
       })).sort((a22, b13) => a22.group === b13.group ? 0 : a22.group === "Prompts" ? -1 : 1);
       return filter([...builtins, ...own4], query, Number.POSITIVE_INFINITY);
     }
     if (kind === "argument") {
       const name = this.value.match(/^\/(\w+)/)?.[1];
-      return filter(commands2.find((command2) => command2.name === name)?.args?.(model) ?? [], query);
+      return filter(commands2.find((command3) => command3.name === name)?.args?.(model) ?? [], query);
     }
     const files = this.#paths.map((path) => ({
       value: path,
@@ -26774,7 +27034,7 @@ var SliccComposer = class extends ModelElement {
     if (this.popup?.kind === "file" || this.popup?.kind === "secret") return;
     const found = trigger(this.value, area.selectionStart ?? this.value.length);
     const name = this.value.match(/^\/(\w+)/)?.[1];
-    const takes = commands2.some((command2) => command2.name === name && command2.args);
+    const takes = commands2.some((command3) => command3.name === name && command3.args);
     this.popup = found && (found.kind !== "argument" || takes) ? { ...found, items: this.#choices(found.kind, found.query), index: 0 } : null;
   }
   openPopup(kind) {
@@ -26985,6 +27245,26 @@ var SliccComposer = class extends ModelElement {
     ) : b`<div class="empty">Nothing matches.</div>`}
     </div>`;
   }
+  #hold() {
+    const hold = this.model?.agent.hold?.();
+    if (!hold) return A;
+    const locked = hold.reason === "locked";
+    const vault = this.model?.vault;
+    const held = hold.held === 1 ? "1 tool result held" : `${hold.held} tool results held`;
+    return b`<div class="hold" role="status" data-hold=${hold.reason}>
+      ${locked ? b`<swc-icon-lock size="s" aria-hidden="true"></swc-icon-lock>` : b`<swc-progress-circle size="s" label="Waiting" aria-hidden="true"></swc-progress-circle>`}
+      <span class="text">${locked ? "Unlock the vault to continue" : "Waiting for the vault"}${hold.held ? b`<span class="held"> · ${held}</span>` : A}</span>
+      ${locked && vault ? b`<slicc-vault-button
+              data-action="unlock-vault"
+              .vault=${vault}
+              .config=${{ intent: { kind: "unlock" }, label: "Unlock", size: "s", variant: "accent", theme: this.color }}
+              @vault-popup=${(event2) => {
+      this.blocked = event2.detail.state === "blocked";
+    }}
+            ></slicc-vault-button>` : A}
+      ${locked && this.blocked ? b`<span class="blocked" role="alert" data-popup="blocked"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle>The browser blocked the vault window. Allow pop-ups for this site, then try again.</span>` : A}
+    </div>`;
+  }
   #queue() {
     const queued = this.model?.agent.queue(this.#agent) ?? [];
     if (queued.length === 0) return A;
@@ -27015,6 +27295,7 @@ var SliccComposer = class extends ModelElement {
     const speech = "SpeechRecognition" in globalThis || "webkitSpeechRecognition" in globalThis;
     const held = this.#held();
     return b`<div class="column">
+        ${this.#hold()}
         ${this.#queue()}
         ${this.#popup()}
         <swc-prompt-field
@@ -27368,8 +27649,8 @@ var SliccMemory = class extends ModelElement {
     const scopes = this.#scopes;
     const scope = this.scope;
     const option2 = (item2) => b`<sp-menu-item value=${item2.id}>${item2.label}</sp-menu-item>`;
-    const shown2 = visible(all2, scope, this.tag, this.query);
-    return b`<div class="bar"><span>${shown2.length} of ${all2.filter((memory) => memory.scope === scope).length} memories</span><span class="spacer"></span>
+    const shown3 = visible(all2, scope, this.tag, this.query);
+    return b`<div class="bar"><span>${shown3.length} of ${all2.filter((memory) => memory.scope === scope).length} memories</span><span class="spacer"></span>
         <swc-action-button size="s" quiet @click=${() => this.editing = "new"}><swc-icon-add slot="icon"></swc-icon-add>Remember</swc-action-button>
       </div>
       <div class="tools">
@@ -27391,7 +27672,7 @@ var SliccMemory = class extends ModelElement {
       </div>
       <div class="list">
         ${this.editing === "new" ? b`<div class="row">${this.#form({ scope })}</div>` : A}
-        ${shown2.length ? sections(shown2).map(
+        ${shown3.length ? sections(shown3).map(
       ([section, items]) => b`<h3>${section}</h3>${items.map((memory) => this.#row(memory))}`
     ) : b`<div class="note">${all2.length ? "No memories match." : "No memories yet."}</div>`}
       </div>`;
@@ -27699,10 +27980,10 @@ var SliccMonitor = class extends ModelElement {
     const surface2 = surfaces2[section.id];
     const rows = section.rows.length > 0;
     const open = rows && (this.expanded[section.id] ?? flag !== null);
-    const list4 = `rows-${section.id}`;
+    const list5 = `rows-${section.id}`;
     return b`<li class="section" data-id=${section.id} data-open=${open ? "" : A}>
       <div class="line">
-        ${rows ? b`<button class="toggle" aria-expanded=${open ? "true" : "false"} aria-controls=${open ? list4 : A} @click=${() => {
+        ${rows ? b`<button class="toggle" aria-expanded=${open ? "true" : "false"} aria-controls=${open ? list5 : A} @click=${() => {
       this.expanded = { ...this.expanded, [section.id]: !open };
     }}><span class="chevron"><swc-icon-chevron-right size="s" aria-hidden="true"></swc-icon-chevron-right></span><span class="name">${section.label}</span></button>` : b`<span class="chevron"></span><span class="name">${section.label}</span>`}
         ${flag ? b`<swc-badge size="s" variant=${flag.variant} subtle>${flag.text}</swc-badge>` : A}
@@ -27711,7 +27992,7 @@ var SliccMonitor = class extends ModelElement {
                 >Open</swc-action-button
               >` : A}
       </div>
-      ${open ? b`<ul class="rows" id=${list4} aria-label=${section.label}>${c(
+      ${open ? b`<ul class="rows" id=${list5} aria-label=${section.label}>${c(
       section.rows,
       (row, i25) => row.id ?? i25,
       (row) => this.#row(row)
@@ -27918,6 +28199,748 @@ var SliccNotices = class extends ModelElement {
   }
 };
 
+// src/app/vault.ts
+var exitNames = {
+  "vault-direct": "Straight from the vault",
+  "local-proxy": "Local proxy",
+  "cli-v": "Local SLICC, direct",
+  tailscale: "Tailscale",
+  "local-link": "Linked SLICC, through this page"
+};
+function devicesOf(model) {
+  return model?.network?.status().links?.devices ?? [];
+}
+function deviceName2(id, devices) {
+  return (devices.find((device) => device.id === id)?.name ?? id).replace(/^slicc\b/i, "SLICC");
+}
+function exitLabel(exit, devices) {
+  if (exit.startsWith("device:")) return deviceName2(exit.slice("device:".length), devices);
+  return exitNames[exit];
+}
+function list4(items) {
+  if (items.length < 2) return items.join("");
+  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
+function ruleLine(rule) {
+  const methods = rule.methods.length ? rule.methods.join(" or ") : "any method";
+  const paths = rule.paths.length ? rule.paths.join(" or ") : "any path";
+  return `${rule.domain}, in ${rule.header}, ${methods}, ${paths}`;
+}
+function shellWord(word) {
+  return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, "'\\''")}'`;
+}
+function execLine(grant) {
+  if (grant === false) return "Never revealed to programs";
+  if (grant === true) return "Revealed to any program that asks";
+  return `Revealed only to ${list4(grant.argv.map((argv) => argv.map(shellWord).join(" ")))}`;
+}
+function widening(change, devices) {
+  switch (change.kind) {
+    case "rule":
+      return `${change.secret} may now be sent to ${ruleLine(change.rule)}`;
+    case "methods":
+      return `${change.secret} may now use ${list4(change.methods)} on ${change.domain}`;
+    case "paths":
+      return `${change.secret} may now reach ${list4(change.paths)} on ${change.domain}`;
+    case "exec": {
+      const line = execLine(change.grant);
+      return `${change.secret}: ${line[0].toLowerCase()}${line.slice(1)}`;
+    }
+    case "exit":
+      return `${change.secret} may now leave through ${exitLabel(change.exit, devices)}`;
+    default:
+      return `The limit ${change.field} rose from ${change.from} to ${change.to}`;
+  }
+}
+function shown2(element2, style = getComputedStyle(element2)) {
+  return !element2.hidden && !element2.inert && style.display !== "none";
+}
+function disabled(element2) {
+  if (element2.matches(":disabled")) return true;
+  if (!element2.matches("button, input, select, textarea")) return false;
+  let fieldset = element2.closest("fieldset[disabled]");
+  while (fieldset) {
+    if (!fieldset.querySelector(":scope > legend")?.contains(element2)) return true;
+    fieldset = fieldset.parentElement?.closest("fieldset[disabled]") ?? null;
+  }
+  return false;
+}
+function reachable(element2) {
+  const radio = element2;
+  if (radio.localName !== "input" || radio.type !== "radio" || !radio.name) return true;
+  const root2 = radio.getRootNode();
+  const group = Array.from(root2.querySelectorAll("input[type=radio]")).filter(
+    (other) => other.name === radio.name && other.form === radio.form
+  );
+  const checked = group.find((other) => other.checked);
+  return checked ? checked === radio : radio === group[0] || radio === group.at(-1);
+}
+function tabbables(root2, stop, out = []) {
+  for (const child of Array.from(root2.children)) {
+    if (child === stop) {
+      out.push(null);
+      continue;
+    }
+    const style = getComputedStyle(child);
+    if (!shown2(child, style)) continue;
+    if (child.localName === "details" && !child.open) {
+      const summary = child.querySelector(":scope > summary");
+      if (summary && shown2(summary) && getComputedStyle(summary).visibility !== "hidden" && !(summary.hasAttribute("tabindex") && summary.tabIndex < 0))
+        out.push(summary);
+      continue;
+    }
+    if (child.tabIndex >= 0 && !disabled(child) && style.visibility !== "hidden" && reachable(child))
+      out.push(child);
+    if (child.shadowRoot) tabbables(child.shadowRoot, stop, out);
+    tabbables(child, stop, out);
+  }
+  return out;
+}
+function sequential(order) {
+  const rank = (element2) => element2 && element2.tabIndex > 0 ? element2.tabIndex : Number.POSITIVE_INFINITY;
+  return [...order].sort((a22, b13) => rank(a22) - rank(b13) || 0);
+}
+var SliccVaultButton = class extends i2 {
+  static properties = {
+    vault: { attribute: false },
+    config: { attribute: false }
+  };
+  #button = null;
+  #off = null;
+  #ready = false;
+  #sent = "";
+  static styles = i`
+    :host {
+      display: inline-flex;
+      vertical-align: middle;
+    }
+    iframe {
+      border: 0;
+      background: transparent;
+      color-scheme: normal;
+    }
+  `;
+  constructor() {
+    super();
+    this.vault = null;
+    this.config = null;
+  }
+  connectedCallback() {
+    super.connectedCallback();
+    this.requestUpdate();
+  }
+  disconnectedCallback() {
+    super.disconnectedCallback();
+    this.#drop();
+  }
+  focus() {
+    this.#button?.post({ type: "slicc-vault", v: 1, op: "focus" });
+  }
+  updated(changed) {
+    if (changed.has("vault")) this.#drop();
+    if (!this.#button && this.vault) this.#mount(this.vault);
+    this.#send();
+  }
+  #mount(vault) {
+    const button = vault.button();
+    this.#button = button;
+    this.#off = button.listen((event2) => this.#event(event2));
+    this.renderRoot.append(button.element);
+  }
+  #drop() {
+    this.#off?.();
+    this.#button?.element.remove();
+    this.#button = null;
+    this.#off = null;
+    this.#ready = false;
+    this.#sent = "";
+  }
+  #send() {
+    if (!(this.#ready && this.#button && this.config)) return;
+    const sent = JSON.stringify(this.config);
+    if (sent === this.#sent) return;
+    this.#sent = sent;
+    this.#button.post({ type: "slicc-vault", v: 1, op: "button", button: this.config });
+  }
+  #event(event2) {
+    const element2 = this.#button?.element;
+    if (event2.event === "ready") {
+      this.#ready = true;
+      this.#send();
+    } else if (event2.event === "size") {
+      element2.style.width = `${event2.width}px`;
+      element2.style.height = `${event2.height}px`;
+      element2.style.margin = `${-event2.inset}px`;
+    } else if (event2.event === "label") {
+      element2.title = event2.label;
+    } else if (event2.event === "focus") {
+      const order = sequential(tabbables(this.ownerDocument, this));
+      const at = order.indexOf(null);
+      order[event2.direction === "next" ? at + 1 : at - 1]?.focus();
+    } else if (event2.event === "popup") {
+      const { intent, state: state3, result } = event2;
+      this.dispatchEvent(
+        new CustomEvent("vault-popup", {
+          detail: { intent, state: state3, ...result ? { result } : {} },
+          bubbles: true,
+          composed: true
+        })
+      );
+    }
+  }
+};
+
+// src/app/secrets.ts
+var kinds = { secret: null, grant: "Sign-in", model: "Model key", mcp: "MCP server" };
+var lockModes = {
+  auto: "Unlocks with this browser",
+  passkey: "Unlocks with a passkey",
+  passphrase: "Unlocks with a passphrase"
+};
+function until(at, now = Date.now()) {
+  const minutes = Math.ceil((at - now) / 6e4);
+  if (minutes <= 0) return "expired";
+  if (minutes < 60) return `in ${minutes} min`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 24) return `in ${hours} h`;
+  const days = Math.round(hours / 24);
+  return `in ${days} ${days === 1 ? "day" : "days"}`;
+}
+function who(entry) {
+  if (entry.tag) return entry.tag;
+  if (entry.uid === null) return "the vault";
+  return entry.uid === 0 ? "root" : `uid ${entry.uid}`;
+}
+function sourceLine(secret, devices) {
+  const on = secret.sourceDevice ? ` on ${deviceName2(secret.sourceDevice, devices)}` : "";
+  const [kind, detail = ""] = secret.source.split(/:(.*)/s);
+  if (kind === "popup") return `Entered in the vault${on}`;
+  if (kind === "process") return `Saved by a program${on}`;
+  if (kind === "import") return `Imported from ${detail}`;
+  if (kind === "oauth") {
+    const as = secret.account ? ` as ${secret.account}` : "";
+    return `Signed in to ${secret.provider ?? detail}${as}`;
+  }
+  return `A jerk lease for ${detail.split("@")[0]}${on}`;
+}
+function startOfDay(now) {
+  const date = new Date(now);
+  date.setHours(0, 0, 0, 0);
+  return date.getTime();
+}
+function revealed(name, entries, now = Date.now(), more = false) {
+  const reveals = entries.filter(
+    (entry) => entry.type === "materialize" && entry.name === name
+  );
+  if (!reveals.length) return null;
+  const [last] = reveals;
+  const start = startOfDay(now);
+  const today = reveals.filter((entry) => entry.at >= start).length;
+  const partial = more && (entries[entries.length - 1]?.at ?? 0) >= start;
+  const when = today ? `${partial ? "at least " : ""}${today} ${today === 1 ? "time" : "times"} today` : since(last.at, now);
+  return b`Revealed to programs ${when}, last by ${who(last)} with <code>${last.argv}</code>`;
+}
+function auditLine(entry, devices) {
+  switch (entry.type) {
+    case "inject":
+    case "forward":
+      return b`${entry.type === "inject" ? "Sent to" : "Forwarded to"} ${entry.domain}: <code>${entry.method} ${entry.path}</code>, through ${exitLabel(entry.exit, devices)}`;
+    case "materialize":
+      return b`Revealed to <code>${entry.argv}</code> in <code>${entry.cwd}</code>`;
+    case "seal":
+      return b`${entry.rotated ? "Value replaced" : "Value saved"}`;
+    case "remove":
+      return b`Removed`;
+    case "restore":
+      return b`Restored`;
+    default: {
+      const count = entry.widened.length;
+      const widened = count ? `, widening ${count} ${count === 1 ? "rule" : "rules"}` : "";
+      return b`<code>${entry.file}</code> ${entry.accepted ? `changed${widened}` : "changed and was refused"}${entry.warning ? b`. ${entry.warning}` : A}`;
+    }
+  }
+}
+function merged(...pages) {
+  const bySeq = /* @__PURE__ */ new Map();
+  for (const page of pages) for (const entry of page) bySeq.set(entry.seq, entry);
+  return [...bySeq.values()].sort((a22, b13) => b13.seq - a22.seq);
+}
+function prompt2(text2) {
+  return text2.length > 200 ? `${text2.slice(0, 199)}\u2026` : text2;
+}
+var SliccSecrets = class extends ThemedElement {
+  static properties = {
+    ...ThemedElement.properties,
+    older: { state: true },
+    more: { state: true },
+    loading: { state: true },
+    reveals: { state: true },
+    popup: { state: true },
+    acking: { state: true },
+    failure: { state: true }
+  };
+  #tick;
+  constructor() {
+    super();
+    this.older = [];
+    this.more = null;
+    this.loading = false;
+    this.reveals = false;
+    this.popup = null;
+    this.acking = /* @__PURE__ */ new Set();
+    this.failure = null;
+  }
+  static styles = i`
+    :host {
+      display: block;
+      container-type: inline-size;
+    }
+    h2 {
+      font-size: var(--swc-heading-size-xs);
+      font-weight: var(--swc-bold-font-weight);
+      line-height: var(--swc-heading-line-height);
+      color: var(--swc-heading-color);
+      margin: 0;
+    }
+    h3 {
+      font-size: var(--swc-font-size-100);
+      font-weight: var(--swc-bold-font-weight);
+      color: var(--swc-heading-color);
+      margin: var(--swc-spacing-400) 0 var(--swc-spacing-100);
+    }
+    p {
+      margin: var(--swc-spacing-100) 0;
+    }
+    ul,
+    ol {
+      list-style: none;
+      margin: 0;
+      padding: 0;
+    }
+    code {
+      font-family: var(--swc-code-font-family, ui-monospace, monospace);
+      font-size: 0.9em;
+      overflow-wrap: anywhere;
+    }
+    .head {
+      display: flex;
+      flex-wrap: wrap;
+      align-items: baseline;
+      gap: var(--swc-spacing-200) var(--swc-spacing-300);
+      margin: var(--swc-spacing-500) 0 var(--swc-spacing-200);
+    }
+    .head slicc-vault-button {
+      align-self: center;
+      margin-inline-start: auto;
+    }
+    .muted {
+      color: var(--swc-neutral-subdued-content-color-default);
+    }
+    .box {
+      display: grid;
+      gap: var(--swc-spacing-100);
+      padding: var(--swc-spacing-200) var(--swc-spacing-300);
+      margin: var(--swc-spacing-200) 0;
+      border-radius: var(--swc-corner-radius-100);
+      border: var(--swc-border-width-100) solid var(--swc-gray-200);
+      background: var(--swc-background-layer-1-color);
+    }
+    .box.notice {
+      border-color: var(--swc-notice-visual-color);
+      --swc-icon-color: var(--swc-notice-visual-color);
+    }
+    .box .title {
+      display: flex;
+      align-items: flex-start;
+      gap: var(--swc-spacing-100);
+      font-weight: var(--swc-bold-font-weight);
+    }
+    .box ul {
+      list-style: disc;
+      padding-inline-start: var(--swc-spacing-400);
+    }
+    .box .actions {
+      display: flex;
+      flex-wrap: wrap;
+      align-items: center;
+      gap: var(--swc-spacing-200);
+    }
+    .prompt {
+      margin: 0;
+      padding-inline-start: var(--swc-spacing-200);
+      border-inline-start: var(--swc-border-width-200) solid var(--swc-gray-300);
+      overflow-wrap: anywhere;
+    }
+    .said {
+      white-space: pre-wrap;
+    }
+    .from {
+      display: block;
+      font-size: var(--swc-font-size-75);
+      color: var(--swc-neutral-subdued-content-color-default);
+    }
+    .secrets {
+      display: grid;
+      gap: var(--swc-spacing-200);
+    }
+    .secret {
+      display: grid;
+      grid-template-columns: minmax(0, 1fr) max-content;
+      gap: var(--swc-spacing-100) var(--swc-spacing-300);
+      padding: var(--swc-spacing-200) 0;
+      border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
+    }
+    .secret:first-child {
+      border-top: 0;
+    }
+    .name {
+      display: flex;
+      flex-wrap: wrap;
+      align-items: baseline;
+      gap: var(--swc-spacing-100) var(--swc-spacing-200);
+      min-width: 0;
+    }
+    .name code {
+      font-size: var(--swc-font-size-100);
+      font-weight: var(--swc-bold-font-weight);
+    }
+    .secret slicc-vault-button {
+      align-self: start;
+    }
+    .removed {
+      margin-top: var(--swc-spacing-200);
+      border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
+      padding-top: var(--swc-spacing-200);
+    }
+    .removed summary {
+      cursor: pointer;
+      font-size: var(--swc-font-size-75);
+      color: var(--swc-neutral-subdued-content-color-default);
+    }
+    .removed .secret dl,
+    .removed .secret .name code {
+      color: var(--swc-neutral-subdued-content-color-default);
+    }
+    dl {
+      grid-column: 1 / -1;
+      display: grid;
+      grid-template-columns: max-content minmax(0, 1fr);
+      gap: var(--swc-spacing-50) var(--swc-spacing-300);
+      margin: 0;
+      font-size: var(--swc-font-size-75);
+      line-height: var(--swc-line-height-200);
+    }
+    dt {
+      color: var(--swc-neutral-subdued-content-color-default);
+    }
+    dd {
+      margin: 0;
+      min-width: 0;
+      overflow-wrap: anywhere;
+    }
+    .audit-head {
+      display: flex;
+      flex-wrap: wrap;
+      align-items: baseline;
+      justify-content: space-between;
+      gap: var(--swc-spacing-200);
+      margin: var(--swc-spacing-400) 0 var(--swc-spacing-100);
+    }
+    .audit-head h3 {
+      margin-block: 0;
+    }
+    .audit li {
+      display: grid;
+      grid-template-columns: 7em minmax(0, 1fr);
+      gap: var(--swc-spacing-50) var(--swc-spacing-300);
+      padding: var(--swc-spacing-100) 0;
+      border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
+      font-size: var(--swc-font-size-75);
+      line-height: var(--swc-line-height-200);
+    }
+    .audit time {
+      color: var(--swc-neutral-subdued-content-color-default);
+    }
+    .audit .what {
+      overflow-wrap: anywhere;
+    }
+    .audit .by {
+      color: var(--swc-neutral-subdued-content-color-default);
+    }
+    .row {
+      display: flex;
+      flex-wrap: wrap;
+      align-items: center;
+      gap: var(--swc-spacing-200);
+      margin-top: var(--swc-spacing-200);
+    }
+    .error {
+      display: flex;
+      align-items: flex-start;
+      gap: var(--swc-spacing-100);
+      color: var(--swc-negative-content-color-default);
+      font-size: var(--swc-font-size-75);
+      --swc-icon-color: var(--swc-negative-content-color-default);
+    }
+    @container (max-width: 480px) {
+      .secret {
+        grid-template-columns: minmax(0, 1fr);
+      }
+      .secret slicc-vault-button {
+        order: 1;
+        justify-self: start;
+      }
+      dl {
+        grid-template-columns: minmax(0, 1fr);
+      }
+      dd {
+        margin-bottom: var(--swc-spacing-75);
+      }
+      .audit li {
+        grid-template-columns: minmax(0, 1fr);
+      }
+    }
+  `;
+  #pushed = [];
+  disconnectedCallback() {
+    super.disconnectedCallback();
+    clearTimeout(this.#tick);
+    this.older = [];
+    this.more = null;
+    this.#pushed = [];
+  }
+  willUpdate(changed) {
+    super.willUpdate(changed);
+    const before = changed.get("model");
+    if (!changed.has("model") || before?.vault === this.model?.vault) return;
+    this.older = [];
+    this.more = null;
+    this.loading = false;
+    this.popup = null;
+    this.acking = /* @__PURE__ */ new Set();
+    this.failure = null;
+    this.#pushed = [];
+  }
+  updated() {
+    clearTimeout(this.#tick);
+    if (!this.isConnected) return;
+    const now = Date.now();
+    const next = Math.min(
+      now + 6e4,
+      ...(this.model?.vault?.list()?.secrets ?? []).map((secret) => secret.expiresAt ?? Number.POSITIVE_INFINITY).filter((at) => at > now)
+    );
+    this.#tick = setTimeout(() => this.requestUpdate(), next - now);
+  }
+  #listed(vault) {
+    this.#pushed = [];
+    const head2 = vault.list()?.audit ?? [];
+    const last = head2[head2.length - 1];
+    if (this.older.length && (!last || last.seq > this.older[0].seq + 1)) {
+      this.older = [];
+      this.more = null;
+    }
+    this.requestUpdate();
+  }
+  #noticed(notice) {
+    this.#pushed = [...this.#pushed.filter((item2) => item2.id !== notice.id), notice];
+    this.requestUpdate();
+  }
+  subscribe(model) {
+    const update = () => this.requestUpdate();
+    return [
+      ...super.subscribe(model),
+      ...model.vault ? [
+        model.vault.on("status", update),
+        model.vault.on("list", () => this.#listed(model.vault)),
+        model.vault.on("notice", (notice) => this.#noticed(notice))
+      ] : [],
+      ...model.network ? [model.network.on("network", update)] : []
+    ];
+  }
+  #button(config) {
+    const theme3 = this.color;
+    return b`<slicc-vault-button
+      .vault=${this.model?.vault}
+      .config=${{ size: "m", variant: "secondary", ...config, theme: theme3 }}
+      @vault-popup=${(event2) => this.#popup(event2.detail)}
+    ></slicc-vault-button>`;
+  }
+  #popup(detail) {
+    this.popup = detail;
+  }
+  async showOlder(vault, entries) {
+    this.loading = true;
+    this.failure = null;
+    try {
+      const before = entries[entries.length - 1]?.seq;
+      const page = await vault.audit(before);
+      if (this.model?.vault !== vault || !this.isConnected) return;
+      const shown3 = merged(vault.list()?.audit ?? [], this.older);
+      if (shown3[shown3.length - 1]?.seq !== before) return;
+      this.older = merged(this.older, page.audit);
+      this.more = page.more;
+    } catch (error) {
+      if (this.model?.vault === vault && this.isConnected) this.failure = error.message;
+    } finally {
+      if (this.model?.vault === vault) this.loading = false;
+    }
+  }
+  async acknowledge(vault, notice) {
+    if (this.acking.has(notice.id)) return;
+    this.acking = /* @__PURE__ */ new Set([...this.acking, notice.id]);
+    this.failure = null;
+    try {
+      await vault.acknowledge(notice.id);
+      if (this.model?.vault === vault)
+        this.#pushed = this.#pushed.filter((item2) => item2.id !== notice.id);
+    } catch (error) {
+      if (this.model?.vault === vault && this.isConnected) this.failure = error.message;
+    } finally {
+      if (this.model?.vault === vault)
+        this.acking = new Set([...this.acking].filter((id) => id !== notice.id));
+    }
+  }
+  #request(request2) {
+    const asker = who(request2);
+    const what = request2.kind === "value" ? b`${asker} asks for <code>${request2.name}</code>` : request2.kind === "oauth" ? b`${asker} asks you to sign in to ${request2.provider}` : b`${asker} asks for a jerk lease for ${request2.provider}`;
+    return b`<div class="box" data-request=${request2.id}>
+      <span class="title">${what}</span>
+      ${request2.prompt ? b`<p class="prompt" data-prompt><span class="from">From the agent, not checked by SLICC:</span> <span class="said">${prompt2(request2.prompt)}</span></p>` : A}
+      <div class="actions">
+        ${this.#button({ intent: { kind: "request", request: request2.id }, label: "Answer in the vault", variant: "accent" })}
+        <span class="muted">Expires ${until(request2.expiresAt)}</span>
+      </div>
+    </div>`;
+  }
+  #notice(vault, notice, devices) {
+    return b`<div class="box notice" role="alert" data-notice=${notice.id}>
+      <span class="title"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>Rules widened in <code>${notice.file}</code> ${since(notice.at)}</span></span>
+      <ul>${notice.widened.map((change) => b`<li>${widening(change, devices)}</li>`)}</ul>
+      <span>If you didn’t mean this, change the file back with sudo.</span>
+      <div class="actions"><swc-button size="s" variant="secondary" data-action="acknowledge" ?pending=${this.acking.has(notice.id)} @click=${() => this.acknowledge(vault, notice)}>Acknowledge</swc-button></div>
+    </div>`;
+  }
+  #state(secret) {
+    const [variant, label] = secret.state === "removed" ? ["neutral", "Removed"] : secret.expiresAt !== void 0 && secret.expiresAt <= Date.now() ? ["notice", "Expired"] : secret.state === "inert" ? ["neutral", "No rule yet"] : ["positive", "Active"];
+    return b`<swc-status-light size="s" variant=${variant}>${label}</swc-status-light>`;
+  }
+  #action(secret) {
+    if (secret.state === "removed")
+      return this.#button({
+        intent: { kind: "manage", name: secret.name },
+        label: "Manage",
+        size: "s"
+      });
+    if (secret.source.startsWith("oauth:"))
+      return this.#button({
+        intent: { kind: "signin", provider: secret.source.slice("oauth:".length) },
+        label: "Sign in again",
+        size: "s"
+      });
+    return this.#button({
+      intent: { kind: "enter", name: secret.name },
+      label: "Replace value",
+      size: "s"
+    });
+  }
+  #secret(secret, entries, devices, more) {
+    const kind = kinds[secret.kind];
+    const reveal = revealed(secret.name, entries, Date.now(), more);
+    const gone2 = secret.state === "removed";
+    return b`<li class="secret" data-secret=${secret.name} data-state=${secret.state}>
+      <div class="name">
+        <code>${secret.name}</code>
+        ${kind ? b`<swc-badge size="s" variant="neutral" subtle>${kind}</swc-badge>` : A}
+        ${this.#state(secret)}
+      </div>
+      ${this.#action(secret)}
+      <dl>
+        <dt>${gone2 ? "Was sent to" : "Sent to"}</dt>
+        <dd data-rules>${secret.rules.length ? secret.rules.map((rule, index) => b`${index ? b`<br />` : A}${ruleLine(rule)}`) : "Nowhere yet: no rule names it"}</dd>
+        <dt>${gone2 ? "Left through" : "Leaves through"}</dt>
+        <dd data-exits>${list4(secret.exits.map((exit) => exitLabel(exit, devices)))}</dd>
+        <dt>Programs</dt>
+        <dd data-exec>${execLine(secret.exec)}${reveal ? b`<br />${reveal}` : A}</dd>
+        <dt>From</dt>
+        <dd data-source>${sourceLine(secret, devices)}</dd>
+        ${secret.usedAt ? b`<dt>Last used</dt><dd data-used>${since(secret.usedAt)}</dd>` : A}
+        ${secret.expiresAt ? b`<dt>Expires</dt><dd data-expires>${until(secret.expiresAt)}</dd>` : A}
+        ${secret.removedAt ? b`<dt>Removed</dt><dd>${since(secret.removedAt)}</dd>` : A}
+      </dl>
+    </li>`;
+  }
+  #secrets(list5, entries, devices) {
+    const more = this.more ?? list5.auditMore;
+    const row = (secret) => this.#secret(secret, entries, devices, more);
+    const live = list5.secrets.filter((secret) => secret.state !== "removed");
+    const removed = list5.secrets.filter((secret) => secret.state === "removed");
+    return b`${live.length ? b`<ul class="secrets" aria-labelledby="secrets">${live.map(row)}</ul>` : A}
+      ${removed.length ? b`<details class="removed" data-removed>
+              <summary>Removed (${removed.length})</summary>
+              <ul class="secrets">${removed.map(row)}</ul>
+            </details>` : A}`;
+  }
+  #entry(entry, devices) {
+    const date = new Date(entry.at);
+    const name = entry.type === "policy" ? null : entry.name;
+    return b`<li data-seq=${entry.seq} data-type=${entry.type}>
+      <time datetime=${date.toISOString()} title=${date.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short" })}>${since(entry.at)}</time>
+      <span class="what">${name ? b`<code>${name}</code> · ` : A}${auditLine(entry, devices)}${entry.type === "policy" ? A : b` <span class="by">by ${who(entry)}</span>`}</span>
+    </li>`;
+  }
+  #audit(vault, list5, entries, devices) {
+    const shown3 = this.reveals ? entries.filter((entry) => entry.type === "materialize") : entries;
+    const more = this.more ?? list5.auditMore;
+    return b`<div class="audit-head">
+        <h3 id="secrets-audit">Activity</h3>
+        <sp-switch size="s" data-action="reveals" .checked=${this.reveals} @change=${(event2) => {
+      this.reveals = event2.target.checked;
+    }}>Only reveals to programs</sp-switch>
+      </div>
+      ${shown3.length ? b`<ol class="audit" aria-labelledby="secrets-audit">${shown3.map((entry) => this.#entry(entry, devices))}</ol>` : b`<p class="muted" data-audit-empty>${this.reveals ? more ? "No reveals in the activity loaded so far." : "No program has been given a secret." : "Nothing has used a secret yet."}</p>`}
+      ${more ? b`<div class="row"><swc-button size="s" variant="secondary" fill-style="outline" data-action="older" ?pending=${this.loading} @click=${() => this.showOlder(vault, entries)}>Show older</swc-button></div>` : A}`;
+  }
+  #feedback() {
+    if (this.popup?.state === "blocked")
+      return b`<div class="error" role="alert" data-popup="blocked"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>The browser blocked the vault window. Allow pop-ups for this site, then try again.</span></div>`;
+    if (this.popup?.state === "done" && this.popup.result)
+      return b`<p role="status" data-popup="done">Saved <code>${this.popup.result.name}</code> in the vault.</p>`;
+    return A;
+  }
+  render() {
+    const vault = this.model?.vault;
+    if (!vault) return A;
+    const status2 = vault.status();
+    const current = vault.list();
+    const devices = devicesOf(this.model);
+    const entries = merged(current?.audit ?? [], this.older);
+    const listed = current?.notices ?? [];
+    const notices = [
+      ...listed,
+      ...this.#pushed.filter((notice) => !listed.some((item2) => item2.id === notice.id))
+    ].filter((notice) => !notice.acknowledged);
+    return b`<section aria-labelledby="secrets" data-vault=${status2 ? status2.locked ? "locked" : "unlocked" : "loading"}>
+      <div class="head">
+        <h2 id="secrets">Secrets</h2>
+        ${status2 ? b`<swc-status-light size="m" variant=${status2.locked ? "notice" : "positive"}>${status2.locked ? "Locked" : "Unlocked"}</swc-status-light><span class="muted">${lockModes[status2.lock]}</span>` : A}
+        ${status2?.locked ? this.#button({ intent: { kind: "unlock" }, label: "Unlock", variant: "accent" }) : this.#button({ intent: { kind: "manage" }, label: "Open the vault" })}
+      </div>
+      <p class="muted">Agents and programs use secrets by name. The values stay in the vault, so SLICC never sees or shows them.</p>
+      ${this.#feedback()}
+      ${this.failure ? b`<div class="error" role="alert" data-error="vault"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>${this.failure}</span></div>` : A}
+      ${status2?.waiting.length ? b`<h3>Waiting for you</h3>${status2.waiting.map((request2) => this.#request(request2))}` : A}
+      ${notices.map((notice) => this.#notice(vault, notice, devices))}
+      ${!current ? b`<p class="muted" data-loading>Loading secrets…</p>` : current.secrets.length ? this.#secrets(current, entries, devices) : b`<p data-empty>No secrets yet. When an agent or program needs one, it asks here, and you enter the value in the vault.</p>`}
+      <p class="muted" data-policy>Rules live in <code>/etc/fnox/config.toml</code> and <code>/etc/slicc/secrets-policy.toml</code>. Change them with sudo; SLICC asks you before every change.</p>
+      <div class="row">
+        ${this.#button({ intent: { kind: "import" }, label: "Import\u2026", size: "s" })}
+        ${this.#button({ intent: { kind: "export" }, label: "Export\u2026", size: "s" })}
+      </div>
+      ${current ? this.#audit(vault, current, entries, devices) : A}
+    </section>`;
+  }
+};
+
 // src/app/settings.ts
 var accountStatus = {
   connected: ["positive", "Connected"],
@@ -28275,6 +29298,7 @@ var SliccSettings = class extends ModelElement {
       <div class="accounts">${providers.map((account) => this.#account(account))}</div>
       ${servers.length ? b`<h2>MCP servers</h2>
               <div class="accounts" data-group="mcp">${servers.map((account) => this.#account(account))}</div>` : A}
+      ${this.model?.vault ? b`<slicc-secrets .model=${this.model}></slicc-secrets>` : A}
     </div>`;
   }
 };
@@ -31070,14 +32094,14 @@ var RegexSource = class {
     return CAPTURING_REGEX_SOURCE.test(regexSource);
   }
   static replaceCaptures(regexSource, captureSource, captureIndices) {
-    return regexSource.replace(CAPTURING_REGEX_SOURCE, (match, index, commandIndex, command2) => {
+    return regexSource.replace(CAPTURING_REGEX_SOURCE, (match, index, commandIndex, command3) => {
       let capture = captureIndices[parseInt(index || commandIndex, 10)];
       if (capture) {
         let result = captureSource.substring(capture.start, capture.end);
         while (result[0] === ".") {
           result = result.substring(1);
         }
-        switch (command2) {
+        switch (command3) {
           case "downcase":
             return result.toLowerCase();
           case "upcase":
@@ -32091,8 +33115,8 @@ var IncludeOnlyRule = class extends Rule {
     }
   }
   collectPatterns(grammar2, out) {
-    for (const pattern of this.patterns) {
-      const rule = grammar2.getRule(pattern);
+    for (const pattern2 of this.patterns) {
+      const rule = grammar2.getRule(pattern2);
       rule.collectPatterns(grammar2, out);
     }
   }
@@ -32159,8 +33183,8 @@ var BeginEndRule = class extends Rule {
   _getCachedCompiledPatterns(grammar2, endRegexSource) {
     if (!this._cachedCompiledPatterns) {
       this._cachedCompiledPatterns = new RegExpSourceList();
-      for (const pattern of this.patterns) {
-        const rule = grammar2.getRule(pattern);
+      for (const pattern2 of this.patterns) {
+        const rule = grammar2.getRule(pattern2);
         rule.collectPatterns(grammar2, this._cachedCompiledPatterns);
       }
       if (this.applyEndPatternLast) {
@@ -32232,8 +33256,8 @@ var BeginWhileRule = class extends Rule {
   _getCachedCompiledPatterns(grammar2) {
     if (!this._cachedCompiledPatterns) {
       this._cachedCompiledPatterns = new RegExpSourceList();
-      for (const pattern of this.patterns) {
-        const rule = grammar2.getRule(pattern);
+      for (const pattern2 of this.patterns) {
+        const rule = grammar2.getRule(pattern2);
         rule.collectPatterns(grammar2, this._cachedCompiledPatterns);
       }
     }
@@ -32354,14 +33378,14 @@ var RuleFactory = class _RuleFactory {
     let r39 = [];
     if (patterns) {
       for (let i25 = 0, len = patterns.length; i25 < len; i25++) {
-        const pattern = patterns[i25];
+        const pattern2 = patterns[i25];
         let ruleId = -1;
-        if (pattern.include) {
-          const reference2 = parseInclude(pattern.include);
+        if (pattern2.include) {
+          const reference2 = parseInclude(pattern2.include);
           switch (reference2.kind) {
             case 0:
             case 1:
-              ruleId = _RuleFactory.getCompiledRuleId(repository[pattern.include], helper, repository);
+              ruleId = _RuleFactory.getCompiledRuleId(repository[pattern2.include], helper, repository);
               break;
             case 2:
               let localIncludedRule = repository[reference2.ruleName];
@@ -32390,7 +33414,7 @@ var RuleFactory = class _RuleFactory {
               break;
           }
         } else {
-          ruleId = _RuleFactory.getCompiledRuleId(pattern, helper, repository);
+          ruleId = _RuleFactory.getCompiledRuleId(pattern2, helper, repository);
         }
         if (ruleId !== -1) {
           const rule = helper.getRule(ruleId);
@@ -37233,13 +38257,13 @@ function splitTokens(tokens, breakpoints) {
     });
   });
 }
-function flatTokenVariants(merged, variantsOrder, cssVariablePrefix, defaultColor, colorsRendering = "css-vars") {
+function flatTokenVariants(merged2, variantsOrder, cssVariablePrefix, defaultColor, colorsRendering = "css-vars") {
   const token2 = {
-    content: merged.content,
-    explanation: merged.explanation,
-    offset: merged.offset
+    content: merged2.content,
+    explanation: merged2.explanation,
+    offset: merged2.offset
   };
-  const styles = variantsOrder.map((t88) => getTokenStyleObject(merged.variants[t88]));
+  const styles = variantsOrder.map((t88) => getTokenStyleObject(merged2.variants[t88]));
   const styleKeys = new Set(styles.flatMap((t88) => Object.keys(t88)));
   const mergedStyles = {};
   const varKey = (idx, key2) => {
@@ -39349,25 +40373,25 @@ var namedCaptureDelim = r35`\(\?<(?![=!])(?<captureName>[^>]+)>`;
 var captureDelim = r35`${namedCaptureDelim}|(?<unnamed>\()(?!\?)`;
 var token = new RegExp(r35`${namedCaptureDelim}|${recursiveToken}|\(\?|\\?.`, "gsu");
 var overlappingRecursionMsg = "Cannot use multiple overlapping recursions";
-function recursion(pattern, data) {
+function recursion(pattern2, data) {
   const { hiddenCaptures, mode } = {
     hiddenCaptures: [],
     mode: "plugin",
     ...data
   };
   let captureTransfers = data?.captureTransfers ?? /* @__PURE__ */ new Map();
-  if (!new RegExp(recursiveToken, "su").test(pattern)) {
+  if (!new RegExp(recursiveToken, "su").test(pattern2)) {
     return {
-      pattern,
+      pattern: pattern2,
       captureTransfers,
       hiddenCaptures
     };
   }
-  if (mode === "plugin" && hasUnescaped(pattern, r35`\(\?\(DEFINE\)`, Context.DEFAULT)) {
+  if (mode === "plugin" && hasUnescaped(pattern2, r35`\(\?\(DEFINE\)`, Context.DEFAULT)) {
     throw new Error("DEFINE groups cannot be used with recursion");
   }
   const addedHiddenCaptures = [];
-  const hasNumberedBackref = hasUnescaped(pattern, r35`\\[1-9]`, Context.DEFAULT);
+  const hasNumberedBackref = hasUnescaped(pattern2, r35`\\[1-9]`, Context.DEFAULT);
   const groupContentsStartPos = /* @__PURE__ */ new Map();
   const openGroups = [];
   let hasRecursed = false;
@@ -39375,7 +40399,7 @@ function recursion(pattern, data) {
   let numCapturesPassed = 0;
   let match;
   token.lastIndex = 0;
-  while (match = token.exec(pattern)) {
+  while (match = token.exec(pattern2)) {
     const { 0: m15, groups: { captureName, rDepth, gRNameOrNum, gRDepth } } = match;
     if (m15 === "[") {
       numCharClassesOpen++;
@@ -39392,13 +40416,13 @@ function recursion(pattern, data) {
             `${mode === "external" ? "Backrefs" : "Numbered backrefs"} cannot be used with global recursion`
           );
         }
-        const left = pattern.slice(0, match.index);
-        const right = pattern.slice(token.lastIndex);
+        const left = pattern2.slice(0, match.index);
+        const right = pattern2.slice(token.lastIndex);
         if (hasUnescaped(right, recursiveToken, Context.DEFAULT)) {
           throw new Error(overlappingRecursionMsg);
         }
         const reps = +rDepth - 1;
-        pattern = makeRecursive(
+        pattern2 = makeRecursive(
           left,
           right,
           reps,
@@ -39432,7 +40456,7 @@ function recursion(pattern, data) {
           throw new Error(r35`Recursive \g cannot be used outside the referenced group "${mode === "external" ? gRNameOrNum : r35`\g<${gRNameOrNum}&R=${gRDepth}>`}"`);
         }
         const startPos = groupContentsStartPos.get(gRNameOrNum);
-        const groupContents = getGroupContents(pattern, startPos);
+        const groupContents = getGroupContents(pattern2, startPos);
         if (hasNumberedBackref && hasUnescaped(groupContents, r35`${namedCaptureDelim}|\((?!\?)`, Context.DEFAULT)) {
           throw new Error(
             // When used in `external` mode by transpilers other than Regex+, backrefs might have
@@ -39440,11 +40464,11 @@ function recursion(pattern, data) {
             `${mode === "external" ? "Backrefs" : "Numbered backrefs"} cannot be used with recursion of capturing groups`
           );
         }
-        const groupContentsLeft = pattern.slice(startPos, match.index);
+        const groupContentsLeft = pattern2.slice(startPos, match.index);
         const groupContentsRight = groupContents.slice(groupContentsLeft.length + m15.length);
         const numAddedHiddenCapturesPreExpansion = addedHiddenCaptures.length;
         const reps = +gRDepth - 1;
-        const expansion = makeRecursive(
+        const expansion2 = makeRecursive(
           groupContentsLeft,
           groupContentsRight,
           reps,
@@ -39461,10 +40485,10 @@ function recursion(pattern, data) {
           numAddedHiddenCapturesPreExpansion,
           numCapturesPassed
         );
-        const pre = pattern.slice(0, startPos);
-        const post = pattern.slice(startPos + groupContents.length);
-        pattern = `${pre}${expansion}${post}`;
-        token.lastIndex += expansion.length - m15.length - groupContentsLeft.length - groupContentsRight.length;
+        const pre = pattern2.slice(0, startPos);
+        const post = pattern2.slice(startPos + groupContents.length);
+        pattern2 = `${pre}${expansion2}${post}`;
+        token.lastIndex += expansion2.length - m15.length - groupContentsLeft.length - groupContentsRight.length;
         openGroups.forEach((g7) => g7.hasRecursedWithin = true);
         hasRecursed = true;
       } else if (captureName) {
@@ -39491,7 +40515,7 @@ function recursion(pattern, data) {
   }
   hiddenCaptures.push(...addedHiddenCaptures);
   return {
-    pattern,
+    pattern: pattern2,
     captureTransfers,
     hiddenCaptures
   };
@@ -39522,14 +40546,14 @@ function makeRecursive(left, right, reps, isSubpattern, hiddenCaptures, addedHid
   ];
   return `${left}${repeatWithDepth(`(?:${left}`, "forward", ...rest)}(?:)${repeatWithDepth(`${right})`, "backward", ...rest)}${right}`;
 }
-function repeatWithDepth(pattern, direction, reps, namesInRecursed, hiddenCaptures, addedHiddenCaptures, numCapturesPassed) {
+function repeatWithDepth(pattern2, direction, reps, namesInRecursed, hiddenCaptures, addedHiddenCaptures, numCapturesPassed) {
   const startNum = 2;
   const getDepthNum = (i25) => direction === "forward" ? i25 + startNum : reps - i25 + startNum - 1;
   let result = "";
   for (let i25 = 0; i25 < reps; i25++) {
     const depthNum = getDepthNum(i25);
     result += replaceUnescaped(
-      pattern,
+      pattern2,
       r35`${captureDelim}|\\k<(?<backref>[^>]+)>`,
       ({ 0: m15, groups: { captureName, unnamed, backref } }) => {
         if (backref && namesInRecursed && !namesInRecursed.has(backref)) {
@@ -40612,8 +41636,8 @@ function isLoneGLookaround(node, options) {
 function isValidJsGroupName(name) {
   return /^[$_\p{IDS}][$\u200C\u200D\p{IDC}]*$/u.test(name);
 }
-function parseFragment(pattern, options) {
-  const ast = J2(pattern, {
+function parseFragment(pattern2, options) {
+  const ast = J2(pattern2, {
     ...options,
     // Providing a custom set of Unicode property names avoids converting some JS Unicode
     // properties (ex: `\p{Alpha}`) to Onig POSIX classes
@@ -41209,13 +42233,13 @@ var EmulatedRegExp = class _EmulatedRegExp extends RegExp {
   @param {EmulatedRegExp} pattern
   @param {string} [flags]
   */
-  constructor(pattern, flags, options) {
+  constructor(pattern2, flags, options) {
     const lazyCompile = !!options?.lazyCompile;
-    if (pattern instanceof RegExp) {
+    if (pattern2 instanceof RegExp) {
       if (options) {
         throw new Error("Cannot provide options when copying a regexp");
       }
-      const re3 = pattern;
+      const re3 = pattern2;
       super(re3, flags);
       this.#pattern = re3.source;
       if (re3 instanceof _EmulatedRegExp) {
@@ -41231,8 +42255,8 @@ var EmulatedRegExp = class _EmulatedRegExp extends RegExp {
         transfers: [],
         ...options
       };
-      super(lazyCompile ? "" : pattern, flags);
-      this.#pattern = pattern;
+      super(lazyCompile ? "" : pattern2, flags);
+      this.#pattern = pattern2;
       this.#captureMap = createCaptureMap(opts.hiddenCaptures, opts.transfers);
       this.#strategy = opts.strategy;
       this.rawOptions = options ?? {};
@@ -41358,13 +42382,13 @@ function createCaptureMap(hiddenCaptures, transfers) {
   }
   return captureMap;
 }
-function createNameMap(pattern) {
+function createNameMap(pattern2) {
   const re3 = /(?<capture>\((?:\?<(?![=!])(?<name>[^>]+)>|(?!\?)))|\\?./gsu;
   const map = /* @__PURE__ */ new Map();
   let numCharClassesOpen = 0;
   let numCaptures = 0;
   let match;
-  while (match = re3.exec(pattern)) {
+  while (match = re3.exec(pattern2)) {
     const { 0: m15, groups: { capture, name } } = match;
     if (m15 === "[") {
       numCharClassesOpen++;
@@ -41381,16 +42405,16 @@ function createNameMap(pattern) {
   }
   return map;
 }
-function toRegExp(pattern, options) {
-  const d22 = toRegExpDetails(pattern, options);
+function toRegExp(pattern2, options) {
+  const d22 = toRegExpDetails(pattern2, options);
   if (d22.options) {
     return new EmulatedRegExp(d22.pattern, d22.flags, d22.options);
   }
   return new RegExp(d22.pattern, d22.flags);
 }
-function toRegExpDetails(pattern, options) {
+function toRegExpDetails(pattern2, options) {
   const opts = getOptions(options);
-  const onigurumaAst = J2(pattern, {
+  const onigurumaAst = J2(pattern2, {
     flags: opts.flags,
     normalizeUnknownPropertyNames: true,
     rules: {
@@ -41443,8 +42467,8 @@ function toRegExpDetails(pattern, options) {
 }
 
 // node_modules/@shikijs/engine-javascript/dist/engine-compile.mjs
-function defaultJavaScriptRegexConstructor(pattern, options) {
-  return toRegExp(pattern, {
+function defaultJavaScriptRegexConstructor(pattern2, options) {
+  return toRegExp(pattern2, {
     global: true,
     hasIndices: true,
     lazyCompileLength: 3e3,
@@ -41464,7 +42488,7 @@ function createJavaScriptRegexEngine(options = {}) {
     cache: /* @__PURE__ */ new Map(),
     ...options
   };
-  _options.regexConstructor ||= (pattern) => defaultJavaScriptRegexConstructor(pattern, { target: _options.target });
+  _options.regexConstructor ||= (pattern2) => defaultJavaScriptRegexConstructor(pattern2, { target: _options.target });
   return {
     createScanner(patterns) {
       return new JavaScriptScanner(patterns, _options);
@@ -42794,8 +43818,8 @@ var InteractionManager = class {
     const indexes = this.getLineIndex(point.lineNumber, point.side);
     if (indexes == null) return;
     const lineIndex = this.mode === "diff" ? `${indexes[0]},${indexes[1]}` : `${indexes[0]}`;
-    const candidates = this.pre.querySelectorAll(`[data-column-number="${point.lineNumber}"][data-line-index="${lineIndex}"]`);
-    for (const element2 of candidates) {
+    const candidates2 = this.pre.querySelectorAll(`[data-column-number="${point.lineNumber}"][data-line-index="${lineIndex}"]`);
+    for (const element2 of candidates2) {
       if (!(element2 instanceof HTMLElement)) continue;
       const target = this.resolvePointerTarget(getElementPath(element2));
       if (!isLinePointerTarget(target)) continue;
@@ -44047,6 +45071,7 @@ var EXTENSION_TO_FILE_FORMAT = {
   mli: "ocaml",
   mll: "ocaml",
   mly: "ocaml",
+  odin: "odin",
   pas: "pascal",
   p: "pascal",
   pl: "prolog",
@@ -44079,6 +45104,17 @@ var EXTENSION_TO_FILE_FORMAT = {
   py: "python",
   pyw: "python",
   pyi: "python",
+  BUCK: "python",
+  BUILD: "python",
+  PACKAGE: "python",
+  WORKSPACE: "python",
+  Tiltfile: "python",
+  bazel: "python",
+  bxl: "python",
+  bzl: "python",
+  bzlmod: "python",
+  star: "python",
+  sky: "python",
   qml: "qml",
   qmldir: "qmldir",
   qss: "qss",
@@ -44189,16 +45225,22 @@ var EXTENSION_TO_FILE_FORMAT = {
   sty: "tex"
 };
 function getFiletypeFromFileName(fileName) {
+  const format = matchFiletypeFromName(fileName);
+  if (format != null) return format;
+  const baseName = fileName.split(/[/\\]/).pop() ?? fileName;
+  return baseName === fileName ? "text" : matchFiletypeFromName(baseName) ?? "text";
+}
+function matchFiletypeFromName(fileName) {
   if (CUSTOM_EXTENSION_TO_FILE_FORMAT.has(fileName)) return CUSTOM_EXTENSION_TO_FILE_FORMAT.get(fileName) ?? "text";
-  if (EXTENSION_TO_FILE_FORMAT[fileName] != null) return EXTENSION_TO_FILE_FORMAT[fileName];
+  if (Object.hasOwn(EXTENSION_TO_FILE_FORMAT, fileName)) return EXTENSION_TO_FILE_FORMAT[fileName] ?? null;
   const compoundMatch = fileName.match(/\.([^/\\]+\.[^/\\]+)$/);
   if (compoundMatch != null) {
     if (CUSTOM_EXTENSION_TO_FILE_FORMAT.has(compoundMatch[1])) return CUSTOM_EXTENSION_TO_FILE_FORMAT.get(compoundMatch[1]) ?? "text";
-    if (EXTENSION_TO_FILE_FORMAT[compoundMatch[1]] != null) return EXTENSION_TO_FILE_FORMAT[compoundMatch[1]] ?? "text";
+    if (Object.hasOwn(EXTENSION_TO_FILE_FORMAT, compoundMatch[1])) return EXTENSION_TO_FILE_FORMAT[compoundMatch[1]] ?? "text";
   }
   const simpleMatch = fileName.match(/\.([^.]+)$/)?.[1] ?? "";
   if (CUSTOM_EXTENSION_TO_FILE_FORMAT.has(simpleMatch)) return CUSTOM_EXTENSION_TO_FILE_FORMAT.get(simpleMatch) ?? "text";
-  return EXTENSION_TO_FILE_FORMAT[simpleMatch] ?? "text";
+  return Object.hasOwn(EXTENSION_TO_FILE_FORMAT, simpleMatch) ? EXTENSION_TO_FILE_FORMAT[simpleMatch] ?? "text" : null;
 }
 
 // node_modules/@pierre/diffs/dist/utils/getHighlighterOptions.js
@@ -44564,8 +45606,8 @@ function normalizeThemeColors(theme3) {
 function fill(colors, key2, value) {
   if (value != null && value !== "") colors[key2] = value;
 }
-function firstColor(...candidates) {
-  for (const candidate of candidates) if (candidate != null && candidate !== "") return candidate;
+function firstColor(...candidates2) {
+  for (const candidate of candidates2) if (candidate != null && candidate !== "") return candidate;
 }
 function matchesSurface(color, surface2) {
   return surface2 != null && color.toLowerCase() === surface2.toLowerCase();
@@ -45671,6 +46713,12 @@ function isStyleNode(element2) {
   return typeof tagName === "string" && tagName.toLowerCase() === "style";
 }
 
+// node_modules/@pierre/diffs/dist/utils/platform.js
+var _isSafari = void 0;
+function isSafari() {
+  return _isSafari ??= "safari" in window && "pushNotification" in window.safari || /^((?!chrome|android).)*safari/i.test(navigator.userAgent);
+}
+
 // node_modules/@pierre/diffs/dist/utils/editSessionAnnotations.js
 function adoptEditSessionAnnotations(annotations, getName, previousSession) {
   const slotNames = /* @__PURE__ */ new Map();
@@ -45762,10 +46810,31 @@ function createHostThemeStyleNode() {
   return node;
 }
 
-// node_modules/@pierre/diffs/dist/utils/platform.js
-var _isSafari = void 0;
-function isSafari() {
-  return _isSafari ??= "safari" in window && "pushNotification" in window.safari || /^((?!chrome|android).)*safari/i.test(navigator.userAgent);
+// node_modules/@pierre/diffs/dist/worker/errors.js
+var WorkerPoolTerminatedError = class extends Error {
+  constructor() {
+    super("WorkerPoolManager: operation canceled because the pool terminated");
+    this.name = "WorkerPoolTerminatedError";
+  }
+};
+var WorkerPoolTaskCanceledError = class extends Error {
+  constructor() {
+    super("WorkerPoolManager: operation canceled before the task completed");
+    this.name = "WorkerPoolTaskCanceledError";
+  }
+};
+var WorkerPoolWorkerError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "WorkerPoolWorkerError";
+  }
+};
+var reportedWorkerErrors = /* @__PURE__ */ new WeakSet();
+function isWorkerPoolCancellation(error) {
+  return error instanceof WorkerPoolTerminatedError || error instanceof WorkerPoolTaskCanceledError;
+}
+function isHandledWorkerPoolError(error) {
+  return isWorkerPoolCancellation(error) || error instanceof WorkerPoolWorkerError && reportedWorkerErrors.has(error);
 }
 
 // node_modules/@pierre/diffs/dist/components/web-components.js
@@ -46417,6 +47486,7 @@ var File = class {
     const tokenizeMaxLength = this.options.tokenizeMaxLength ?? 1e5;
     if (this.fileRenderer.getOrCreateLineCache(file).length > tokenizeMaxLength) return;
     await workerManager.primeFileHighlightCache(file).catch((error) => {
+      if (isHandledWorkerPoolError(error)) return;
       console.error(error);
     });
   }
@@ -49288,13 +50358,13 @@ function getChangeIterationRanges(state3, content, diffStyle) {
   }
   if (iterationRanges.length === 0) return iterationRanges;
   iterationRanges.sort((a22, b13) => a22[0] - b13[0]);
-  const merged = [iterationRanges[0]];
+  const merged2 = [iterationRanges[0]];
   for (const [start, end] of iterationRanges.slice(1)) {
-    const last = merged[merged.length - 1];
+    const last = merged2[merged2.length - 1];
     if (start <= last[1]) last[1] = Math.max(last[1], end);
-    else merged.push([start, end]);
+    else merged2.push([start, end]);
   }
-  return merged;
+  return merged2;
 }
 function getChangeLineData({ hunkIndex, hunk, collapsedAfter, collapsedBefore, diffStyle, index, unifiedLineIndex, splitLineIndex, additionLineIndex, deletionLineIndex, additionLineNumber, deletionLineNumber, content, isLastContent, unifiedCount, splitCount }) {
   const unifiedDeletionLineIndex = index < content.deletions ? unifiedLineIndex + index : void 0;
@@ -50491,7 +51561,7 @@ var DiffHunksRenderer = class {
   * row set without a line-count change — the host must escalate to a full
   * re-render instead of its cheap refresh path.
   */
-  updateRenderCache(dirtyLines, themeType, lineCountChangeInFlight = false) {
+  updateRenderCache(dirtyLines, themeType, lineCountChangeInFlight = false, changedDocumentLines, documentLineCount) {
     this.pendingStructuralRows = void 0;
     const { renderCache } = this;
     if (renderCache == null) return false;
@@ -50502,13 +51572,27 @@ var DiffHunksRenderer = class {
     const pendingStructuralRows = this.pendingStructuralRows = lineCountChangeInFlight ? /* @__PURE__ */ new Map() : void 0;
     const changedAdditionLines = [];
     const previousAdditionLines = /* @__PURE__ */ new Map();
+    if (pendingStructuralRows == null && changedDocumentLines != null) {
+      const additionLineCount = diff.additionLines.length;
+      const canAppendFinalRow = canAppendFinalDocumentRow(diff.additionLines, documentLineCount);
+      for (const [line, text2] of changedDocumentLines) {
+        if (line < 0 || line > additionLineCount || line === additionLineCount && (text2 === "" || !canAppendFinalRow)) continue;
+        const previous = diff.additionLines[line] ?? "";
+        if (previous !== text2) {
+          diff.additionLines[line] = text2;
+          changedAdditionLines.push(line);
+          previousAdditionLines.set(line, previous);
+          if (!dirtyLines.has(line)) hastLines[line] = createPlainAdditionLineElement(line, cleanLastNewline(text2));
+        }
+      }
+    }
     for (const [line, tokens] of dirtyLines) {
       const prevProps = hastLines[line]?.properties ?? {};
       const lineText = tokens.map((a22) => a22[2]).join("");
       const canSyncDiffLine = line < diff.additionLines.length;
       const prevLine = canSyncDiffLine ? diff.additionLines[line] ?? "" : "";
       const prevText = cleanLastNewline(prevLine);
-      if (pendingStructuralRows == null && canSyncDiffLine) {
+      if (pendingStructuralRows == null && canSyncDiffLine && changedDocumentLines?.has(line) !== true) {
         diff.additionLines[line] = applyLineTextWithNewline(prevLine, lineText);
         if (prevText !== lineText) {
           changedAdditionLines.push(line);
@@ -51502,6 +52586,9 @@ function realignAdditionHastLines(previousLines, nextLines, hastLines, textDocum
   for (let index = prefix; index < nextLines.length; index++) realigned[index] ??= createPlainAdditionLineElement(index, textDocument.getLineText(index));
   return realigned;
 }
+function canAppendFinalDocumentRow(additionLines, documentLineCount) {
+  return documentLineCount === additionLines.length + 1 && additionLines.at(-1)?.endsWith("\n") === true;
+}
 function createPlainAdditionLineElement(lineIndex, lineText, unifiedLineIndex = lineIndex, splitLineIndex = lineIndex) {
   return {
     type: "element",
@@ -51604,6 +52691,7 @@ function getDiffHunksRendererOptions(options) {
     hunkSeparators: typeof options?.hunkSeparators === "function" ? "custom" : options?.hunkSeparators,
     expandUnchanged: options?.expandUnchanged,
     loadDiffFiles: options?.loadDiffFiles,
+    parseDiffOptions: options?.parseDiffOptions,
     collapsedContextThreshold: options?.collapsedContextThreshold,
     lineDiffType: options?.lineDiffType,
     maxLineDiffLength: options?.maxLineDiffLength,
@@ -52596,7 +53684,7 @@ var FileDiff = class {
     this.detachAdditionLines();
     this.hunksRenderer.beginEditSession(editSessionDiff);
     const { shouldRefreshDiffsView, lineCountChangeInFlight } = options;
-    if (this.hunksRenderer.updateRenderCache(dirtyLines, themeType, lineCountChangeInFlight)) {
+    if (this.hunksRenderer.updateRenderCache(dirtyLines, themeType, lineCountChangeInFlight, options.changedDocumentLines, options.documentLineCount)) {
       if (this.refreshViewTimeout != null) {
         clearTimeout(this.refreshViewTimeout);
         this.refreshViewTimeout = void 0;
@@ -52743,6 +53831,7 @@ var FileDiff = class {
     const tokenizeMaxLength = this.options.tokenizeMaxLength ?? 1e5;
     if (Math.max(fileDiff.additionLines.length, fileDiff.deletionLines.length) > tokenizeMaxLength) return;
     await workerManager.primeDiffHighlightCache(fileDiff).catch((error) => {
+      if (isHandledWorkerPoolError(error)) return;
       console.error(error);
     });
   }
@@ -54240,9 +55329,9 @@ function disableTextSelection(rootNode = document) {
 }
 function getDockviewTheme(element2) {
   function toClassList(element3) {
-    const list4 = [];
-    for (let i25 = 0; i25 < element3.classList.length; i25++) list4.push(element3.classList.item(i25));
-    return list4;
+    const list5 = [];
+    for (let i25 = 0; i25 < element3.classList.length; i25++) list5.push(element3.classList.item(i25));
+    return list5;
   }
   let theme3 = void 0;
   let parent = element2;
@@ -55446,7 +56535,7 @@ var BranchNode = class BranchNode2 extends CompositeDisposable {
       if (child instanceof BranchNode2) child.proportionalLayout = value;
     });
   }
-  constructor(orientation, proportionalLayout, styles, size4, orthogonalSize, disabled, margin, childDescriptors) {
+  constructor(orientation, proportionalLayout, styles, size4, orthogonalSize, disabled2, margin, childDescriptors) {
     super();
     this.orientation = orientation;
     this.styles = styles;
@@ -55489,7 +56578,7 @@ var BranchNode = class BranchNode2 extends CompositeDisposable {
       });
       this.splitview.layout(this.size, this.orthogonalSize);
     }
-    this.disabled = disabled;
+    this.disabled = disabled2;
     this.addDisposables(this._onDidChange, this._onDidVisibilityChange, this.splitview.onDidSashEnd(() => {
       this._onDidChange.fire({});
     }));
@@ -65093,9 +66182,9 @@ var ENTERPRISE_MODULE_NAMES = /* @__PURE__ */ new Set([
 var _warnedMissingModule = /* @__PURE__ */ new Set();
 function missingModuleMessage(moduleName, reason) {
   const reasons = reason === void 0 ? [] : [].concat(reason);
-  const quoted = reasons.map((r39) => `\`${r39}\``).join(", ");
+  const quoted2 = reasons.map((r39) => `\`${r39}\``).join(", ");
   const requires = reasons.length > 1 ? "require" : "requires";
-  const needed = reasons.length ? `${quoted} ${requires} the "${moduleName}" module` : `The "${moduleName}" module is required`;
+  const needed = reasons.length ? `${quoted2} ${requires} the "${moduleName}" module` : `The "${moduleName}" module is required`;
   if (ENTERPRISE_MODULE_NAMES.has(moduleName)) return `dockview: ${needed}, which ships in dockview-enterprise.
 
   npm install dockview-enterprise
@@ -65695,9 +66784,9 @@ var RootDropTargetService = class {
   }
   setOptions(options) {
     if ("dndEdges" in options) {
-      const disabled = typeof options.dndEdges === "boolean" && options.dndEdges === false;
-      this._html5Target.disabled = disabled;
-      this._pointerTarget.disabled = disabled;
+      const disabled2 = typeof options.dndEdges === "boolean" && options.dndEdges === false;
+      this._html5Target.disabled = disabled2;
+      this._pointerTarget.disabled = disabled2;
     }
     if ("dndEdges" in options || "dockToEdgeGroups" in options) {
       const model = resolveRootOverlayModel({
@@ -66076,16 +67165,16 @@ var nextContextMenuItemId = () => `dv-ctx-menu-item-${_nextId++}`;
 function isItemConfig(item2) {
   return typeof item2 === "object";
 }
-function buildItem(label, close, action, disabled) {
+function buildItem(label, close, action, disabled2) {
   const el = document.createElement("div");
   el.className = "dv-context-menu-item";
   el.setAttribute("role", "menuitem");
-  if (disabled) {
+  if (disabled2) {
     el.classList.add("dv-context-menu-item--disabled");
     el.setAttribute("aria-disabled", "true");
   }
   el.textContent = label;
-  if (!disabled) el.addEventListener("click", () => {
+  if (!disabled2) el.addEventListener("click", () => {
     action();
     close();
   });
@@ -71287,9 +72376,9 @@ var getBaseFileName = (path) => {
 };
 var getExtensionCandidates = (fileName) => {
   const segments = fileName.toLowerCase().split(".");
-  const candidates = [];
-  for (let index = 1; index < segments.length; index += 1) candidates.push(segments.slice(index).join("."));
-  return candidates;
+  const candidates2 = [];
+  for (let index = 1; index < segments.length; index += 1) candidates2.push(segments.slice(index).join("."));
+  return candidates2;
 };
 function remapEntryToIcon(entry, remappedFrom) {
   if (typeof entry === "string") return {
@@ -77442,8 +78531,8 @@ function getFileTreeRowAriaLabel(row) {
   if (flattenedSegments == null || flattenedSegments.length === 0) return row.name;
   return flattenedSegments.map((segment2) => segment2.name).join(" / ");
 }
-function computeStickyRowsFromCandidates(candidates, scrollTop, itemHeight, totalRowCount) {
-  return candidates.map((candidate, slotDepth) => {
+function computeStickyRowsFromCandidates(candidates2, scrollTop, itemHeight, totalRowCount) {
+  return candidates2.map((candidate, slotDepth) => {
     const defaultTop = slotDepth * itemHeight;
     const nextBoundaryIndex = candidate.subtreeEndIndex + 1;
     if (nextBoundaryIndex >= totalRowCount) return {
@@ -77490,9 +78579,9 @@ function getPointElement(rootNode, clientX, clientY) {
   return element2 instanceof HTMLElement ? element2 : null;
 }
 function getShadowPointElementByGeometry(rootNode, clientX, clientY) {
-  const candidates = Array.from(rootNode.querySelectorAll('[data-type="item"], [data-item-flattened-subitem]'));
-  for (let index = candidates.length - 1; index >= 0; index--) {
-    const candidate = candidates[index];
+  const candidates2 = Array.from(rootNode.querySelectorAll('[data-type="item"], [data-item-flattened-subitem]'));
+  for (let index = candidates2.length - 1; index >= 0; index--) {
+    const candidate = candidates2[index];
     const rect = candidate.getBoundingClientRect();
     if (clientX >= rect.left && clientX <= rect.right && clientY >= rect.top && clientY <= rect.bottom) return candidate;
   }
@@ -80010,6 +81099,8 @@ var elements = {
   "slicc-network": SliccNetwork,
   "slicc-notices": SliccNotices,
   "slicc-approvals": SliccApprovals,
+  "slicc-secrets": SliccSecrets,
+  "slicc-vault-button": SliccVaultButton,
   "slicc-confirm": SliccConfirm,
   "slicc-prompt": SliccPrompt,
   "slicc-app": SliccApp
@@ -80046,7 +81137,9 @@ export {
   SliccNetwork,
   SliccNotices,
   SliccPrompt,
+  SliccSecrets,
   SliccUpdates,
+  SliccVaultButton,
   confirm,
   define2 as define,
   grammarBase,