@astrosheep/keiyaku 2.9.2 → 2.9.4

package/build/cli/render/success-response.js

@@ -0,0 +1,77 @@
+import { repositoryCoordinateFromAddress } from "../commands/shared.js";
+import { renderResolvedAddressReceipt } from "./address.js";
+import { formatCallNextAction } from "./shared.js";
+function responseText(response) {
+    return response.text;
+}
+function responseData(response) {
+    const payload = response.payload;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload) || "error" in payload)
+        return {};
+    return payload;
+}
+function isCallProjectionFacts(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const facts = value;
+    return typeof facts.id === "string"
+        && (facts.phase === "active" || facts.phase === "done" || facts.phase === "failed"
+            || facts.phase === "dismissed" || facts.phase === "lost" || facts.phase === "quiescent");
+}
+function conversationalFooter(response) {
+    const data = responseData(response);
+    const lines = [];
+    if (response.address) {
+        const projection = data.projection;
+        const projectionFacts = isCallProjectionFacts(projection) ? projection : undefined;
+        const receiptArtifactId = typeof data.revivedArtifactId === "string"
+            ? data.revivedArtifactId
+            : typeof data.artifactId === "string" ? data.artifactId : undefined;
+        lines.push(renderResolvedAddressReceipt(response.address, { artifactId: receiptArtifactId, projectionId: projectionFacts?.id }));
+    }
+    const responsePath = typeof data.responsePath === "string" ? data.responsePath : undefined;
+    const agent = typeof data.agent === "string" ? data.agent : undefined;
+    const meta = data.meta && typeof data.meta === "object" && !Array.isArray(data.meta) ? data.meta : undefined;
+    const warnings = Array.isArray(meta?.warnings) ? meta.warnings.filter((warning) => typeof warning === "string") : [];
+    if (responsePath) {
+        lines.push(`Saved to ${responsePath}.`);
+    }
+    if (agent) {
+        lines.push(`Akuma: ${agent}`);
+    }
+    if (warnings.length > 0) {
+        lines.push("Warnings:", ...warnings.map((warning) => `- ${warning}`));
+    }
+    if (typeof data.summary === "string") {
+        const projection = data.projection;
+        const projectionFacts = isCallProjectionFacts(projection) ? projection : undefined;
+        const artifactId = typeof data.artifactId === "string" ? data.artifactId : undefined;
+        lines.push(formatCallNextAction({
+            projection: projectionFacts,
+            artifactId,
+            repositoryCoordinate: repositoryCoordinateFromAddress(response.address),
+        }));
+    }
+    return lines.join("\n");
+}
+export function writeSuccessResponse(command, flags, response) {
+    // Plain tell is always silent; tell --wait owns the ordinary wait response.
+    if (command === "tell" && flags.timeoutMs === undefined)
+        return;
+    if (command === "bind" && flags.dryRun) {
+        // Canonical Markdown already ends with exactly one newline.
+        process.stdout.write(responseText(response));
+        return;
+    }
+    if (command !== "revive") {
+        process.stdout.write(`${responseText(response)}\n`);
+        return;
+    }
+    const data = responseData(response);
+    const answer = typeof data.summary === "string" ? data.summary.trim() : responseText(response).trim();
+    const footer = conversationalFooter(response);
+    process.stdout.write(`${answer}\n`);
+    if (footer) {
+        process.stderr.write(`${footer}\n`);
+    }
+}

package/build/cli/render/task.js

@@ -1,9 +1,6 @@
-export function shortTaskId(id) {
-    return id.slice(0, 9);
-}
+import { commissionSlug } from "../../core/ids.js";
 export function shortContractId(contractId) {
-    const separator = contractId.indexOf(".");
-    return separator > 0 ? contractId.slice(0, separator) : contractId;
+    return commissionSlug(contractId);
 }
 export function deriveTaskDisplay(task) {
     if (task.state === "done")
@@ -20,7 +17,7 @@ function renderTaskRowWithId(task, id) {
     return `${id} · P${task.pri} · ${deriveTaskDisplay(task)} · ${task.title}`;
 }
 export function renderTaskListRow(task) {
-    return renderTaskRowWithId(task, shortTaskId(task.id));
+    return renderTaskRowWithId(task, task.id);
 }
 export function renderTaskMutationRow(task) {
     return renderTaskRowWithId(task, task.id);
@@ -67,27 +64,56 @@ export function renderTaskList(tasks, options = {}) {
     return groupAndSortTasks(tasks, options.selection).map(renderTaskListRow).join("\n");
 }
 function renderIds(ids) {
-    return ids.length === 0 ? "(none)" : ids.map(shortTaskId).join(", ");
+    return ids.length === 0 ? "(none)" : ids.join(", ");
 }
-export function renderTaskShow(task) {
+function renderTaskDetails(task) {
     const released = new Set(task.releasedNeeds);
     const needs = task.needs.length === 0
         ? "(none)"
         : task.needs
-            .map((id) => `${shortTaskId(id)}${released.has(id) ? " (dropped)" : ""}`)
+            .map((id) => `${id}${released.has(id) ? " (dropped)" : ""}`)
             .join(", ");
     return [
-        `${shortTaskId(task.id)} · ${task.title}`,
+        `${task.id} · ${task.title}`,
         `state: ${deriveTaskDisplay(task)}`,
         `priority: ${task.pri}`,
         `needs: ${needs}`,
         `blocks: ${renderIds(task.blocks)}`,
-        `parent: ${task.parent === null ? "(none)" : shortTaskId(task.parent)}`,
+        `parent: ${task.parent === null ? "(none)" : task.parent}`,
         `from: ${renderIds(task.from)}`,
         `created: ${task.createdAt} by ${task.creator}`,
         "",
         task.body,
-    ].join("\n");
+    ];
+}
+function renderTreeNode(node, prefix, last) {
+    const branch = last ? "`- " : "|- ";
+    const nestedPrefix = `${prefix}${last ? "   " : "|  "}`;
+    const task = node.task;
+    const released = new Set(task.releasedNeeds);
+    const needs = task.needs.length === 0
+        ? "(none)"
+        : task.needs.map((id) => `${id}${released.has(id) ? " (dropped)" : ""}`).join(", ");
+    const lines = [
+        `${prefix}${branch}${task.id} · ${deriveTaskDisplay(task)} · P${task.pri} · ${task.title}`,
+        `${nestedPrefix}needs: ${needs}`,
+        `${nestedPrefix}blocks: ${renderIds(task.blocks)}`,
+        `${nestedPrefix}from: ${renderIds(task.from)}`,
+    ];
+    node.children.forEach((child, index) => lines.push(...renderTreeNode(child, nestedPrefix, index === node.children.length - 1)));
+    return lines;
+}
+function treeDiagnostic(diagnostic) {
+    const id = diagnostic.id ? `${diagnostic.id} · ` : "";
+    return `! ${diagnostic.code}: ${id}${diagnostic.message}`;
+}
+export function renderTaskShow(task, tree) {
+    const treeLines = tree.descendants.length === 0
+        ? ["children tree: (empty)"]
+        : ["children tree:", ...tree.descendants.flatMap((node, index) => renderTreeNode(node, "", index === tree.descendants.length - 1))];
+    if (tree.diagnostics.length > 0)
+        treeLines.push("tree diagnostics:", ...tree.diagnostics.map(treeDiagnostic));
+    return [...renderTaskDetails(task), "", ...treeLines].join("\n");
 }
 export function taskJson(task) {
     return {
@@ -105,8 +131,22 @@ export function taskJson(task) {
         creator: task.creator,
     };
 }
-export function renderTaskShowJson(task) {
-    return `${JSON.stringify({ ...taskJson(task), body: task.body })}\n`;
+function taskTreeNodeJson(node) {
+    return { ...taskJson(node.task), children: node.children.map(taskTreeNodeJson) };
+}
+export function taskTreeJson(tree) {
+    return {
+        children: tree.descendants.map(taskTreeNodeJson),
+        diagnostics: tree.diagnostics.map((diagnostic) => ({
+            code: diagnostic.code,
+            message: diagnostic.message,
+            id: diagnostic.id ?? null,
+            relatedIds: [...(diagnostic.relatedIds ?? [])],
+        })),
+    };
+}
+export function renderTaskShowJson(task, tree) {
+    return `${JSON.stringify({ ...taskJson(task), body: task.body, descendants: taskTreeJson(tree) })}\n`;
 }
 export function renderTaskListJson(tasks, selection = "default") {
     return `${JSON.stringify(groupAndSortTasks(tasks, selection).map(taskJson))}\n`;

package/build/cli/render/tell.js

@@ -0,0 +1,5 @@
+import { textResponse } from "./shared.js";
+/** Accepted plain tell: zero stdout/stderr bytes. */
+export function buildSilentTellResponse() {
+    return textResponse("");
+}

package/build/cli/render/terminal-failure.js

@@ -0,0 +1,58 @@
+/** Aggregate status strips the SUBAGENT_ prefix from the public code suffix. */
+export function terminalFailureCodeSuffix(code) {
+    return code.startsWith("SUBAGENT_") ? code.slice("SUBAGENT_".length) : code;
+}
+export function terminalFailureColdStatement(failure) {
+    if (failure.publicCause?.kind === "rate_limit_exhausted") {
+        return "the provider rate limit is exhausted";
+    }
+    if (failure.class === "runner") {
+        return failure.code === "SUBAGENT_SPAWN_ERROR"
+            ? "the akuma never woke"
+            : "the akuma broke mid-flight";
+    }
+    switch (failure.code) {
+        case "SUBAGENT_TIMEOUT":
+            return "the akuma went silent";
+        case "SUBAGENT_PROVIDER_UNAVAILABLE":
+            return "the provider did not answer";
+        case "SUBAGENT_NON_ZERO_EXIT":
+            return failure.exitCode === undefined ? undefined : `the akuma died · exit ${failure.exitCode}`;
+        case "SUBAGENT_EXEC_ERROR":
+            return "the akuma broke mid-flight";
+        default:
+            return undefined;
+    }
+}
+function terminalFailureEvidence(failure, statement) {
+    const exitAlreadyInStatement = statement !== undefined
+        && failure.code === "SUBAGENT_NON_ZERO_EXIT"
+        && failure.exitCode !== undefined;
+    const parts = [];
+    if (failure.timeoutMs !== undefined)
+        parts.push(`idle ${failure.timeoutMs}ms`);
+    if (failure.signal)
+        parts.push(`signal ${failure.signal}`);
+    if (!exitAlreadyInStatement && failure.exitCode !== undefined)
+        parts.push(`exit ${failure.exitCode}`);
+    parts.push(`phase ${failure.phase}`);
+    return parts.length > 0 ? parts.join(" · ") : undefined;
+}
+/**
+ * Ordinary wait / single-projection status terminal face.
+ * Shape is the locked error-line stream: ✕ cold · CODE, then typed evidence.
+ */
+export function renderTerminalFailureFace(_projectionId, failure) {
+    const lines = [];
+    if (failure) {
+        const statement = terminalFailureColdStatement(failure);
+        if (statement)
+            lines.push(`✕ ${statement} · ${failure.code}`);
+        const evidence = terminalFailureEvidence(failure, statement);
+        if (evidence)
+            lines.push(`  ${evidence}`);
+        if (failure.artifactId)
+            lines.push(`  record ${failure.artifactId}`);
+    }
+    return lines;
+}

package/build/cli/render/types.js

@@ -1 +1,2 @@
+;
 export {};

package/build/cli/render/wait.js

@@ -1,6 +1,7 @@
 import { formatTimelineDuration, renderProjectionActivity, } from "./projection-activity.js";
 import { displayColumns, resolveLineColumns, truncateColumns } from "./line-width.js";
-import { projectionRejoinHintLines, textResponse } from "./shared.js";
+import { formatTellCommand, projectionRejoinHintLines, textResponse } from "./shared.js";
+import { renderTerminalFailureFace } from "./terminal-failure.js";
 const WAIT_HEADER_MAX_COLUMNS = 60;
 function shortAddress(projectionId) {
     return /\/([0-9a-f]{8})$/.exec(projectionId)?.[1] ?? projectionId;
@@ -19,6 +20,11 @@ function phaseState(phase) {
         case "quiescent": return "running";
     }
 }
+function isTerminalPhase(phase) {
+    // `lost` is intentionally absent: it can be an observation failure without
+    // a verdict. Core marks the excluded lost-runner-verdict case explicitly.
+    return ["done", "failed", "killed", "dismissed"].includes(phase);
+}
 function waitStateText(snapshot) {
     switch (snapshot.phase) {
         case "active":
@@ -63,12 +69,6 @@ function waitHeader(projectionId, akuma, snapshot, outputColumns) {
     const dashCount = Math.max(1, maxColumns - displayColumns(`${prefix}  ${state}`));
     return `${prefix} ${"─".repeat(dashCount)} ${state}`;
 }
-function terminalDiagnostic(result) {
-    if (result.state !== "terminal" || result.verdict.state !== "failed")
-        return undefined;
-    const text = result.verdict.detail?.replace(/\s+/g, " ").trim();
-    return text ? { at: result.verdict.at, text } : undefined;
-}
 function ledgerHint(projectionId, snapshot) {
     const file = snapshot.eventLedgerFile ?? "events.jsonl";
     return `· ledger: .keiyaku/projection/${projectionId}/${file}`;
@@ -91,33 +91,14 @@ function nextActionLines(projectionId, result, state) {
             "The akuma is back.",
             ...(snapshot.artifactId ? [`record: ${snapshot.artifactId}`] : []),
             "talk to it:",
-            `  » keiyaku tell ${projectionId} "your words"`,
+            `  » ${formatTellCommand(projectionId, '"your words"')}`,
         ];
     }
-    // Typed distinction: lost-runner → dead, failed → failed, observation lost → lost.
-    if (result.state === "terminal" && result.verdict.state === "lost-runner") {
-        return snapshot.artifactId
-            ? ["The akuma dropped dead mid-turn.", ...recordReviveLines(snapshot.artifactId)]
-            : ["The akuma dropped dead mid-turn.", "no record survived — there is nothing to revive."];
-    }
-    if (result.state === "terminal" && result.verdict.state === "failed") {
-        if (snapshot.failureCode === "SUBAGENT_PROVIDER_UNAVAILABLE") {
-            return snapshot.sourceArtifactId
-                ? [
-                    "× provider unavailable — no turn accepted",
-                    `» nothing was consumed · retry from the same artifact: keiyaku revive ${snapshot.sourceArtifactId}`,
-                ]
-                : [
-                    "× provider unavailable — no turn accepted",
-                    "» nothing was consumed · safe to call again",
-                ];
-        }
-        return [
-            "The akuma failed and stopped.",
-            ...(snapshot.artifactId ? [`record: ${snapshot.artifactId}`] : []),
-            "talk to it:",
-            `  » keiyaku tell ${projectionId} "your words"`,
-        ];
+    if (result.state === "terminal" && (result.verdict.terminalFailure
+        || result.verdict.state === "failed"
+        || result.verdict.state === "launch-failed"
+        || result.verdict.state === "lost-runner")) {
+        return renderTerminalFailureFace(projectionId, result.verdict.terminalFailure);
     }
     if (snapshot.phase === "lost") {
         return snapshot.artifactId
@@ -142,7 +123,7 @@ function startupTimeoutResponse(projectionId, akuma) {
             "the launch was never adopted — no akuma exists",
             "",
             "the next wake retries the launch:",
-            `  » keiyaku tell ${projectionId} "your words"`,
+            `  » ${formatTellCommand(projectionId, '"your words"')}`,
         ].join("\n")),
         exitCode: 1,
     };
@@ -198,7 +179,13 @@ export function buildWaitResponse(projectionId, result, options = {}) {
     if (result.state === "unknown") {
         return identityUnavailableResponse(projectionId, result.diagnostic);
     }
-    const snapshot = result.snapshot;
+    // A plural deadline may observe a verdict whose timestamp is at or after
+    // the cutoff. The typed timeout result owns presentation in that case; the
+    // later terminal-looking snapshot must not turn it into a terminal face.
+    const snapshot = result.state === "timeout"
+        && (result.terminalSnapshot || isTerminalPhase(result.snapshot.phase))
+        ? { ...result.snapshot, phase: "active" }
+        : result.snapshot;
     const maxColumns = options.maxColumns ?? resolveLineColumns();
     if (result.state === "terminal" && result.verdict.state === "killed") {
         return {
@@ -216,13 +203,11 @@ export function buildWaitResponse(projectionId, result, options = {}) {
     if (state === "returned") {
         return returnedResponse(projectionId, result);
     }
-    const diagnostic = terminalDiagnostic(result);
     const rendered = renderProjectionActivity(snapshot.activity, {
         anchorMs: snapshot.observedAtMs,
         state,
         showPlan: state === "running",
         ...(snapshot.workspaceRoot ? { workspaceRoot: snapshot.workspaceRoot } : {}),
-        ...(diagnostic ? { terminalDiagnostic: diagnostic } : {}),
         maxColumns,
     });
     const storageDiagnostics = (snapshot.eventDiagnostics ?? []).map((diagnostic) => `‼ ${diagnostic.kind} · ${diagnostic.detail}`);
@@ -247,3 +232,20 @@ export function buildWaitResponse(projectionId, result, options = {}) {
     }
     return response;
 }
+/** The plural face labels every member because a successful singleton face is answer-only. */
+export function buildProjectionWaitSetResponse(result) {
+    const rendered = result.results
+        .slice()
+        .sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0)
+        .map((member) => ({ id: member.id, response: buildWaitResponse(member.id, member.result) }));
+    const text = rendered.map(({ id, response }) => `${id}\n${response.text}`).join("\n\n");
+    const selectionSucceeded = result.selection === "all"
+        ? result.results.every((member) => member.result.state === "terminal" && member.result.verdict.state === "completed")
+        : result.selectedId !== undefined;
+    const exitCode = rendered.reduce((current, { response }) => {
+        if (response.exitCode === 130)
+            return 130;
+        return response.exitCode === 1 ? 1 : current;
+    }, selectionSucceeded ? undefined : 1);
+    return exitCode === undefined ? textResponse(text) : { ...textResponse(text), exitCode };
+}

package/build/cli/types.js

@@ -1 +1 @@
-export const TASK_SUBCOMMANDS = ["add", "view", "ls", "start", "stop", "done", "drop", "update", "doctor"];
+export const TASK_SUBCOMMANDS = ["add", "show", "ls", "start", "stop", "done", "drop", "update", "doctor"];

package/build/config/akuma-loader.js

@@ -200,11 +200,6 @@ export async function loadAkumaCatalog(cwd) {
             profile: freezeProfile({
                 provider: profile.provider,
                 ...(profile.description !== undefined ? { description: profile.description } : {}),
-                ...("model" in profile && profile.model !== undefined ? { model: profile.model } : {}),
-                ...("effort" in profile && profile.effort !== undefined ? { effort: profile.effort } : {}),
-                ...("effortOptions" in profile && profile.effortOptions !== undefined
-                    ? { effortOptions: Object.freeze([...profile.effortOptions]) }
-                    : {}),
             }),
         });
         candidates.push(candidate);

package/build/config/env-keys.js

@@ -25,7 +25,7 @@ export const ENV_KEYS = {
 const ENV_KEY_ENTRIES = [
     { key: ENV_KEYS.AGENT_OVERRIDE, defaultValue: "", description: "Override default agent name", category: "subagent" },
     { key: ENV_KEYS.DISABLE_SUBAGENT_SPAWN, defaultValue: "0", description: "Disable subprocess subagent spawning when set to 1", category: "subagent" },
-    { key: ENV_KEYS.SUBAGENT_EXEC_IDLE_TIMEOUT_MS, defaultValue: "600000", description: "Subagent idle timeout in milliseconds", category: "subagent" },
+    { key: ENV_KEYS.SUBAGENT_EXEC_IDLE_TIMEOUT_MS, defaultValue: "300000", description: "Subagent provider-ingress idle timeout in milliseconds", category: "subagent" },
     { key: ENV_KEYS.CODEX_EXEC_MAX_CAPTURE_CHARS, defaultValue: "200000", description: "Codex runtime output/diagnostics capture cap", category: "subagent" },
     { key: ENV_KEYS.CLAUDE_EXEC_MAX_CAPTURE_CHARS, defaultValue: "200000", description: "Claude runtime output/diagnostics capture cap", category: "subagent" },
     { key: ENV_KEYS.OPENCODE_EXEC_MAX_CAPTURE_CHARS, defaultValue: "200000", description: "OpenCode runtime output/diagnostics capture cap", category: "subagent" },

package/build/config/provider-policy-ownership.js

@@ -1,39 +1,10 @@
+import { getProviderRegistration } from "../agents/providers/registry.js";
 const EMPTY_OWNERSHIP = Object.freeze({
     access: Object.freeze([]),
     network: Object.freeze([]),
     webSearch: Object.freeze([]),
 });
-function owns(config, key) {
-    return Object.prototype.hasOwnProperty.call(config, key);
-}
 export function nativePolicyOwnership(instanceName, instance) {
-    if (instance.kind !== "codex-sdk" && instance.kind !== "codex-app-server") {
-        return EMPTY_OWNERSHIP;
-    }
-    const config = instance.config;
-    if (!config)
-        return EMPTY_OWNERSHIP;
-    const access = [];
-    const network = [];
-    const webSearch = [];
-    const add = (target, key) => {
-        target.push({ path: `providers.${instanceName}.config.${key}`, value: config[key] });
-    };
-    if (owns(config, "sandbox_mode"))
-        add(access, "sandbox_mode");
-    if (owns(config, "approval_policy"))
-        add(access, "approval_policy");
-    for (const key of Object.keys(config)) {
-        if (key !== "sandbox_workspace_write" && !key.startsWith("sandbox_workspace_write."))
-            continue;
-        add(access, key);
-        add(network, key);
-    }
-    if (owns(config, "web_search"))
-        add(webSearch, "web_search");
-    return Object.freeze({
-        access: Object.freeze(access),
-        network: Object.freeze(network),
-        webSearch: Object.freeze(webSearch),
-    });
+    const owned = getProviderRegistration(instance.kind).nativePolicyOwnership(instanceName, instance);
+    return owned ?? EMPTY_OWNERSHIP;
 }

package/build/config/settings/disease.js

@@ -21,6 +21,13 @@ export function assertSettingsKnobUsable(loaded, knob) {
     if (hits.length === 0)
         return;
     throw new FlowError("INVALID_SETTINGS", `Invalid settings in ${SETTINGS_FILE} (diseased knob '${knob}').`, {
-        hints: formatSettingsDiseases(hits),
+        facts: {
+            kind: "invalid_settings",
+            diseases: hits.map((disease) => ({
+                source: disease.source,
+                ...(disease.knob !== undefined ? { knob: disease.knob } : {}),
+                reason: disease.reason,
+            })),
+        },
     });
 }

package/build/config/settings/loader.js

@@ -1,5 +1,6 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { getProviderRegistration } from "../../agents/providers/registry.js";
 import { isErrnoException } from "../../errno.js";
 import { SETTINGS_FILE } from "../../keiyaku.js";
 import { getKeiyakuHome } from "../env.js";
@@ -85,10 +86,17 @@ function collectProviderCandidates(source, rawProviders) {
             continue;
         }
         const instance = instanceResult.data;
-        if (instance.kind === "codex-app-server" && instance.writableRoots !== undefined && source === "global") {
+        const registration = getProviderRegistration(instance.kind);
+        const writableRoots = registration.rejectsGlobalWritableRoots &&
+            instance &&
+            typeof instance === "object" &&
+            "writableRoots" in instance
+            ? instance.writableRoots
+            : undefined;
+        if (writableRoots !== undefined && source === "global") {
             let relativeIndex;
-            for (let i = 0; i < instance.writableRoots.length; i++) {
-                if (!path.posix.isAbsolute(instance.writableRoots[i])) {
+            for (let i = 0; i < writableRoots.length; i++) {
+                if (!path.posix.isAbsolute(writableRoots[i])) {
                     relativeIndex = i;
                     break;
                 }

package/build/config/settings/provider-instance-fields.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+// Local leaf copy of the Claude setting-source vocabulary so this module never
+// imports keiyaku.js (which re-exports the provider registry and would cycle).
+const CLAUDE_SETTING_SOURCES = ["project", "user", "local"];
+export const tomlValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.array(tomlValueSchema),
+    z.record(z.string(), tomlValueSchema),
+]));
+export const structuredTomlValueSchema = z.record(z.string(), tomlValueSchema);
+export const executableSchema = z.string().superRefine((value, ctx) => {
+    if (value.length === 0 || /\s/.test(value) || value.includes("\"") || value.includes("'")) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "must be a single program name token with no spaces or quotes.",
+        });
+    }
+});
+export const nonblankOptionalString = z
+    .string()
+    .refine((value) => value.trim().length > 0, { message: "must not be blank." })
+    .optional();
+export const providerCommonFields = {
+    description: nonblankOptionalString,
+};
+export const providerEnvSchema = z.record(z.string(), z.string()).optional();
+export const FORBIDDEN_CONFIG_KEYS = ["model", "model_reasoning_effort"];
+export function isConfigKeyForbidden(key) {
+    return FORBIDDEN_CONFIG_KEYS.includes(key);
+}
+export const claudeSettingSourceSchema = z.enum(CLAUDE_SETTING_SOURCES);
+export const writableRootItemSchema = z.string().superRefine((value, ctx) => {
+    if (value.length === 0) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not be empty." });
+        return;
+    }
+    if (value.startsWith("~")) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not begin with tilde." });
+        return;
+    }
+    if (value.includes("\0")) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not contain NUL byte." });
+        return;
+    }
+    if (/\$[A-Za-z_]/.test(value) || /\$\{/.test(value)) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "must not contain environment variable references." });
+        return;
+    }
+});