@caupulican/pi-adaptative 0.81.40 → 0.81.41

package/dist/core/tools/search-command-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-command-guard.js","sourceRoot":"","sources":["../../../src/core/tools/search-command-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAwB,CAAC;AAMlE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,iBAAiB;IACjB,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,UAAU;IACV,2BAA2B;IAC3B,yBAAyB;IACzB,QAAQ;IACR,SAAS;IACT,eAAe;IACf,eAAe;IACf,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,kBAAkB;IAClB,OAAO;IACP,YAAY;IACZ,WAAW;IACX,QAAQ;IACR,SAAS;IACT,WAAW;IACX,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,YAAY;CACZ,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAClG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AAI7G,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW,EAAe;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1E,IACC,UAAU,KAAK,GAAG;QAClB,UAAU,KAAK,IAAI;QACnB,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/B,UAAU,KAAK,GAAG;QAClB,UAAU,KAAK,OAAO;QACtB,UAAU,KAAK,eAAe;QAC9B,OAAO,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,EACzC,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IACC,UAAU,KAAK,GAAG;QAClB,UAAU,KAAK,GAAG;QAClB,UAAU,KAAK,IAAI;QACnB,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,MAAM;QACrB,UAAU,KAAK,MAAM;QACrB,UAAU,KAAK,QAAQ;QACvB,UAAU,KAAK,MAAM;QACrB,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC;QAEzC,OAAO,SAAS,CAAC;IAClB,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,aAAa,CAAC,OAAiB,EAAE,GAAW,EAAE,cAAuB,EAAW;IACxF,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC;AAAA,CACnD;AAUD,SAAS,gBAAgB,CAAC,IAAc,EAAe;IACtD,MAAM,MAAM,GAAgB;QAC3B,SAAS,EAAE,KAAK;QAChB,gBAAgB,EAAE,KAAK;QACvB,cAAc,EAAE,KAAK;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,EAAE;KACf,CAAC;IACF,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,SAAS;QACV,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,SAAS;QACV,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YACxB,SAAS;QACV,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC/B,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC/B,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;YAChE,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC;YACjE,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;gBACjE,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;oBAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBACjE,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;gBACjE,IAAI,IAAI,KAAK,GAAG,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,IAAI,SAAS,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;wBAAE,KAAK,EAAE,CAAC;oBAC9C,MAAM;gBACP,CAAC;YACF,CAAC;YACD,SAAS;QACV,CAAC;QACD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,QAAQ,CAAC,IAAc,EAAE,GAAW,EAAE,SAAkB,EAAyB;IACzF,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS;QAC/B,CAAC,CAAC,MAAM,CAAC,WAAW;QACpB,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACxB,CAAC,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtF,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClF,OAAO;QACN,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,oFAAoF;KAC5F,CAAC;AAAA,CACF;AAED,SAAS,mBAAmB,CAAC,IAAc,EAAE,GAAW,EAAE,SAAkB,EAAyB;IACpG,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAC1B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,aAAa,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAC1F,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,UAAU,CAAC,CAAC;IACxG,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAC/B,CAAC,GAAG,EAAE,EAAE,CACP,GAAG,KAAK,WAAW;QACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAC5B,GAAG,KAAK,WAAW;QACnB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAC5B,GAAG,KAAK,eAAe;QACvB,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CACjC,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,cAAc;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aACrC,IAAI,GAAG,KAAK,IAAI;YAAE,cAAc,GAAG,IAAI,CAAC;aACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;aAC9F,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3E,OAAO;QACN,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,0FAA0F;KAClG,CAAC;AAAA,CACF;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,GAAW,EAAyB;IACvE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;aAC7E,IAAI,GAAG,KAAK,IAAI;YAAE,KAAK,IAAI,CAAC,CAAC;;YAC7B,MAAM;IACZ,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1G,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACrH,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3E,OAAO;QACN,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,MAAM;QAClB,MAAM,EAAE,0FAA0F;KAClG,CAAC;AAAA,CACF;AAED,SAAS,QAAQ,CAAC,IAAc,EAAE,GAAW,EAAyB;IACrE,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;QAC1B,IAAI;QACJ,aAAa;QACb,aAAa;QACb,IAAI;QACJ,aAAa;QACb,IAAI;QACJ,WAAW;QACX,IAAI;QACJ,QAAQ;QACR,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,SAAS;QACT,SAAS;QACT,kBAAkB;QAClB,eAAe;KACf,CAAC,CAAC;IACH,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,cAAc;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aACrC,IAAI,GAAG,KAAK,IAAI;YAAE,cAAc,GAAG,IAAI,CAAC;aACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAChD,cAAc,GAAG,IAAI,CAAC;YACtB,KAAK,EAAE,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,cAAc,GAAG,IAAI,CAAC;aAC5D,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;aACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IACrG,IAAI,iBAAiB,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChG,OAAO;QACN,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,oGAAoG;KAC5G,CAAC;AAAA,CACF;AAED,SAAS,WAAW,CAAC,KAAa,EAAU;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC;SACpB,WAAW,EAAE;SACb,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAAA,CACzB;AAED,SAAS,uBAAuB,CAAC,IAAc,EAAY;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,KAAK,EAAE,CAAC;IACrF,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QAC3B,KAAK,EAAE,CAAC;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAE,KAAK,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAAA,CACzB;AAED,SAAS,gBAAgB,CAAC,IAAc,EAAE,GAAW,EAAE,SAAkB,EAAyB;IACjG,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACb,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9C,KAAK,MAAM;YACV,OAAO,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACzD,KAAK,MAAM;YACV,OAAO,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACrC,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ;YACZ,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACnC;YACC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;AAAA,CACD;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,GAAW,EAAyB;IAC3F,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,aAAa,GAAG,GAA0B,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAEhG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,oBAAoB;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxD,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,oBAAoB,GAAG,IAAI,CAAC;YAC5B,SAAS;QACV,CAAC;QACD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,UAAU,CAAC;QACnD,UAAU,GAAG,EAAE,CAAC;QAChB,oBAAoB,GAAG,KAAK,CAAC;QAC7B,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;IACnC,CAAC;IAED,OAAO,aAAa,EAAE,CAAC;AAAA,CACvB","sourcesContent":["import { homedir } from \"node:os\";\nimport { basename, resolve } from \"node:path\";\nimport { tokenizeShellCommand } from \"./shell-command-parser.ts\";\n\nexport const BROAD_SEARCH_OUTPUT_ROUTE = \"route-to-file\" as const;\n\nexport type SearchScopeAssessment =\n\t| { kind: \"scoped\" }\n\t| { kind: \"broad\"; searchTool: \"rg\" | \"grep\" | \"find\" | \"fd\"; reason: string };\n\nconst RG_LONG_VALUE_FLAGS = new Set([\n\t\"--after-context\",\n\t\"--before-context\",\n\t\"--color\",\n\t\"--colors\",\n\t\"--context\",\n\t\"--context-separator\",\n\t\"--encoding\",\n\t\"--engine\",\n\t\"--field-context-separator\",\n\t\"--field-match-separator\",\n\t\"--glob\",\n\t\"--iglob\",\n\t\"--ignore-file\",\n\t\"--max-columns\",\n\t\"--max-count\",\n\t\"--max-depth\",\n\t\"--max-filesize\",\n\t\"--path-separator\",\n\t\"--pre\",\n\t\"--pre-glob\",\n\t\"--replace\",\n\t\"--sort\",\n\t\"--sortr\",\n\t\"--threads\",\n\t\"--type\",\n\t\"--type-add\",\n\t\"--type-clear\",\n\t\"--type-not\",\n]);\nconst RG_SHORT_VALUE_FLAGS = new Set(\"ABCEMTdfgjmrt\".split(\"\"));\nconst RG_SCOPE_LONG_FLAGS = new Set([\"--glob\", \"--iglob\", \"--max-depth\", \"--type\", \"--type-not\"]);\nconst RG_SCOPE_SHORT_FLAGS = new Set([\"g\", \"t\", \"T\"]);\nconst RG_META_FLAGS = new Set([\"--generate\", \"--help\", \"--pcre2-version\", \"--type-list\", \"--version\", \"-h\"]);\n\ntype TargetScope = \"current\" | \"global\" | \"narrow\";\n\nfunction targetScope(target: string, cwd: string): TargetScope {\n\tconst normalized = target.trim().replace(/[\\\\/]+$/u, \"\") || target.trim();\n\tif (\n\t\tnormalized === \"/\" ||\n\t\tnormalized === \"\\\\\" ||\n\t\t/^[A-Za-z]:$/u.test(normalized) ||\n\t\tnormalized === \"~\" ||\n\t\tnormalized === \"$HOME\" ||\n\t\tnormalized === \"%USERPROFILE%\" ||\n\t\tresolve(normalized) === resolve(homedir())\n\t) {\n\t\treturn \"global\";\n\t}\n\tif (\n\t\tnormalized === \".\" ||\n\t\tnormalized === \"*\" ||\n\t\tnormalized === \"**\" ||\n\t\tnormalized === \"./*\" ||\n\t\tnormalized === \"./**\" ||\n\t\tnormalized === \"$PWD\" ||\n\t\tnormalized === \"$(pwd)\" ||\n\t\tnormalized === \"%CD%\" ||\n\t\tresolve(cwd, normalized) === resolve(cwd)\n\t)\n\t\treturn \"current\";\n\treturn \"narrow\";\n}\n\nfunction hasSafeTarget(targets: string[], cwd: string, hasScopeFilter: boolean): boolean {\n\tif (targets.includes(\"-\")) return true;\n\tconst scopes = (targets.length > 0 ? targets : [\".\"]).map((target) => targetScope(target, cwd));\n\tif (scopes.includes(\"global\")) return false;\n\treturn scopes.includes(\"narrow\") || hasScopeFilter;\n}\n\ninterface RgArguments {\n\tfilesMode: boolean;\n\thasPatternOption: boolean;\n\thasScopeFilter: boolean;\n\tmetaOnly: boolean;\n\tpositionals: string[];\n}\n\nfunction parseRgArguments(args: string[]): RgArguments {\n\tconst parsed: RgArguments = {\n\t\tfilesMode: false,\n\t\thasPatternOption: false,\n\t\thasScopeFilter: false,\n\t\tmetaOnly: false,\n\t\tpositionals: [],\n\t};\n\tlet pastDoubleDash = false;\n\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (pastDoubleDash) {\n\t\t\tparsed.positionals.push(arg);\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg === \"--\") {\n\t\t\tpastDoubleDash = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (RG_META_FLAGS.has(arg)) {\n\t\t\tparsed.metaOnly = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg === \"--files\") {\n\t\t\tparsed.filesMode = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg === \"--regexp\" || arg === \"--file\") {\n\t\t\tparsed.hasPatternOption = true;\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"--regexp=\") || arg.startsWith(\"--file=\")) {\n\t\t\tparsed.hasPatternOption = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"--\")) {\n\t\t\tconst flag = arg.split(\"=\", 1)[0];\n\t\t\tif (RG_SCOPE_LONG_FLAGS.has(flag)) parsed.hasScopeFilter = true;\n\t\t\tif (RG_LONG_VALUE_FLAGS.has(flag) && !arg.includes(\"=\")) index++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"-\") && arg.length > 1) {\n\t\t\tconst cluster = arg.slice(1);\n\t\t\tfor (let flagIndex = 0; flagIndex < cluster.length; flagIndex++) {\n\t\t\t\tconst flag = cluster[flagIndex];\n\t\t\t\tif (flag === \"e\" || flag === \"f\") parsed.hasPatternOption = true;\n\t\t\t\tif (RG_SCOPE_SHORT_FLAGS.has(flag)) parsed.hasScopeFilter = true;\n\t\t\t\tif (flag === \"e\" || RG_SHORT_VALUE_FLAGS.has(flag)) {\n\t\t\t\t\tif (flagIndex === cluster.length - 1) index++;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tparsed.positionals.push(arg);\n\t}\n\n\treturn parsed;\n}\n\nfunction assessRg(args: string[], cwd: string, readsPipe: boolean): SearchScopeAssessment {\n\tconst parsed = parseRgArguments(args);\n\tif (parsed.metaOnly) return { kind: \"scoped\" };\n\tconst targets = parsed.filesMode\n\t\t? parsed.positionals\n\t\t: parsed.hasPatternOption\n\t\t\t? parsed.positionals\n\t\t\t: parsed.positionals.slice(1);\n\tif (readsPipe && targets.length === 0 && !parsed.filesMode) return { kind: \"scoped\" };\n\tif (hasSafeTarget(targets, cwd, parsed.hasScopeFilter)) return { kind: \"scoped\" };\n\treturn {\n\t\tkind: \"broad\",\n\t\tsearchTool: \"rg\",\n\t\treason: \"rg would search the whole working tree without a narrow path, glob, or type filter\",\n\t};\n}\n\nfunction assessRecursiveGrep(args: string[], cwd: string, readsPipe: boolean): SearchScopeAssessment {\n\tconst recursive = args.some(\n\t\t(arg) => arg === \"-r\" || arg === \"-R\" || arg === \"--recursive\" || /^-[^-]*[rR]/u.test(arg),\n\t);\n\tif (!recursive || readsPipe) return { kind: \"scoped\" };\n\tconst hasPatternOption = args.some((arg) => arg === \"-e\" || arg.startsWith(\"-e\") || arg === \"--regexp\");\n\tconst hasScopeFilter = args.some(\n\t\t(arg) =>\n\t\t\targ === \"--include\" ||\n\t\t\targ.startsWith(\"--include=\") ||\n\t\t\targ === \"--exclude\" ||\n\t\t\targ.startsWith(\"--exclude=\") ||\n\t\t\targ === \"--exclude-dir\" ||\n\t\t\targ.startsWith(\"--exclude-dir=\"),\n\t);\n\tconst valueFlags = new Set([\"-A\", \"-B\", \"-C\", \"-D\", \"-d\", \"-e\", \"-f\", \"-m\", \"--regexp\"]);\n\tconst positionals: string[] = [];\n\tlet pastDoubleDash = false;\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (pastDoubleDash) positionals.push(arg);\n\t\telse if (arg === \"--\") pastDoubleDash = true;\n\t\telse if (valueFlags.has(arg) || [\"--include\", \"--exclude\", \"--exclude-dir\"].includes(arg)) index++;\n\t\telse if (!arg.startsWith(\"-\")) positionals.push(arg);\n\t}\n\tconst targets = hasPatternOption ? positionals : positionals.slice(1);\n\tif (hasSafeTarget(targets, cwd, hasScopeFilter)) return { kind: \"scoped\" };\n\treturn {\n\t\tkind: \"broad\",\n\t\tsearchTool: \"grep\",\n\t\treason: \"recursive grep would scan the whole working tree without a narrow path or include filter\",\n\t};\n}\n\nfunction assessFind(args: string[], cwd: string): SearchScopeAssessment {\n\tlet index = 0;\n\twhile (index < args.length) {\n\t\tconst arg = args[index];\n\t\tif (arg === \"-H\" || arg === \"-L\" || arg === \"-P\" || /^-O\\d*$/u.test(arg)) index++;\n\t\telse if (arg === \"-D\") index += 2;\n\t\telse break;\n\t}\n\tconst targets: string[] = [];\n\twhile (index < args.length && !args[index].startsWith(\"-\") && args[index] !== \"!\" && args[index] !== \"(\") {\n\t\ttargets.push(args[index++]);\n\t}\n\tconst hasScopeFilter = args.some((arg) => [\"-iname\", \"-ipath\", \"-iregex\", \"-name\", \"-path\", \"-regex\"].includes(arg));\n\tif (hasSafeTarget(targets, cwd, hasScopeFilter)) return { kind: \"scoped\" };\n\treturn {\n\t\tkind: \"broad\",\n\t\tsearchTool: \"find\",\n\t\treason: \"find would enumerate the whole working tree without a narrow path or name/path predicate\",\n\t};\n}\n\nfunction assessFd(args: string[], cwd: string): SearchScopeAssessment {\n\tconst positionals: string[] = [];\n\tlet hasScopeFilter = false;\n\tlet pastDoubleDash = false;\n\tconst valueFlags = new Set([\n\t\t\"-d\",\n\t\t\"--max-depth\",\n\t\t\"--min-depth\",\n\t\t\"-e\",\n\t\t\"--extension\",\n\t\t\"-E\",\n\t\t\"--exclude\",\n\t\t\"-t\",\n\t\t\"--type\",\n\t\t\"--base-directory\",\n\t\t\"--changed-before\",\n\t\t\"--changed-within\",\n\t\t\"--color\",\n\t\t\"--owner\",\n\t\t\"--path-separator\",\n\t\t\"--search-path\",\n\t]);\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (pastDoubleDash) positionals.push(arg);\n\t\telse if (arg === \"--\") pastDoubleDash = true;\n\t\telse if (arg === \"-e\" || arg === \"--extension\") {\n\t\t\thasScopeFilter = true;\n\t\t\tindex++;\n\t\t} else if (arg.startsWith(\"--extension=\")) hasScopeFilter = true;\n\t\telse if (valueFlags.has(arg)) index++;\n\t\telse if (!arg.startsWith(\"-\")) positionals.push(arg);\n\t}\n\tconst pattern = positionals[0];\n\tconst targets = positionals.slice(1);\n\tconst meaningfulPattern = Boolean(pattern && pattern !== \".\" && pattern !== \".*\" && pattern !== \"*\");\n\tif (meaningfulPattern || hasSafeTarget(targets, cwd, hasScopeFilter)) return { kind: \"scoped\" };\n\treturn {\n\t\tkind: \"broad\",\n\t\tsearchTool: \"fd\",\n\t\treason: \"fd would enumerate the whole working tree without a narrow pattern, path, glob, extension, or type\",\n\t};\n}\n\nfunction commandName(value: string): string {\n\treturn basename(value)\n\t\t.toLowerCase()\n\t\t.replace(/\\.exe$/u, \"\");\n}\n\nfunction stripInvocationPrefixes(args: string[]): string[] {\n\tlet index = 0;\n\twhile (index < args.length && /^[A-Za-z_][A-Za-z0-9_]*=/u.test(args[index])) index++;\n\tif (args[index] === \"command\") {\n\t\tindex++;\n\t\twhile (args[index]?.startsWith(\"-\")) index++;\n\t}\n\tif (args[index] === \"env\") {\n\t\tindex++;\n\t\twhile (args[index]?.startsWith(\"-\") || /^[A-Za-z_][A-Za-z0-9_]*=/u.test(args[index] ?? \"\")) index++;\n\t}\n\treturn args.slice(index);\n}\n\nfunction assessInvocation(args: string[], cwd: string, readsPipe: boolean): SearchScopeAssessment {\n\tconst invocation = stripInvocationPrefixes(args);\n\tconst name = commandName(invocation[0] ?? \"\");\n\tconst commandArgs = invocation.slice(1);\n\tswitch (name) {\n\t\tcase \"rg\":\n\t\tcase \"ripgrep\":\n\t\t\treturn assessRg(commandArgs, cwd, readsPipe);\n\t\tcase \"grep\":\n\t\t\treturn assessRecursiveGrep(commandArgs, cwd, readsPipe);\n\t\tcase \"find\":\n\t\t\treturn assessFind(commandArgs, cwd);\n\t\tcase \"fd\":\n\t\tcase \"fdfind\":\n\t\t\treturn assessFd(commandArgs, cwd);\n\t\tdefault:\n\t\t\treturn { kind: \"scoped\" };\n\t}\n}\n\n/**\n * Reject shell searches whose filesystem scope cannot be proven narrow. Dedicated grep/find\n * tools already own result caps and artifacts; this closes the raw-shell bypass before execution.\n */\nexport function assessShellSearchScope(command: string, cwd: string): SearchScopeAssessment {\n\tconst tokens = tokenizeShellCommand(command);\n\tif (!tokens) {\n\t\treturn { kind: \"scoped\" };\n\t}\n\n\tlet invocation: string[] = [];\n\tlet ignoreRedirectTarget = false;\n\tlet readsPipe = false;\n\tconst assessCurrent = (): SearchScopeAssessment => assessInvocation(invocation, cwd, readsPipe);\n\n\tfor (const token of tokens) {\n\t\tif (token.kind === \"arg\") {\n\t\t\tif (!ignoreRedirectTarget) invocation.push(token.value);\n\t\t\tcontinue;\n\t\t}\n\t\tif (token.kind === \"redirect\") {\n\t\t\tignoreRedirectTarget = true;\n\t\t\tcontinue;\n\t\t}\n\t\tconst assessment = assessCurrent();\n\t\tif (assessment.kind === \"broad\") return assessment;\n\t\tinvocation = [];\n\t\tignoreRedirectTarget = false;\n\t\treadsPipe = token.kind === \"pipe\";\n\t}\n\n\treturn assessCurrent();\n}\n"]}

package/dist/core/tools/secret-store.d.ts

@@ -0,0 +1,38 @@
+import { type Static, Type } from "typebox";
+import { type SecretProfileSummary, SecretVault } from "../secrets/secret-vault.ts";
+declare const secretStoreSchema: Type.TObject<{
+    action: Type.TUnion<[Type.TLiteral<"set">, Type.TLiteral<"list">, Type.TLiteral<"materialize">, Type.TLiteral<"remove">, Type.TLiteral<"lock">]>;
+    profile: Type.TOptional<Type.TString>;
+    description: Type.TOptional<Type.TString>;
+    envFile: Type.TOptional<Type.TString>;
+    variableNames: Type.TOptional<Type.TArray<Type.TString>>;
+    scope: Type.TOptional<Type.TUnion<[Type.TLiteral<"managed">, Type.TLiteral<"workspace">]>>;
+}>;
+export type SecretStoreToolInput = Static<typeof secretStoreSchema>;
+export type SecretStoreStatus = "cancelled" | "error" | "listed" | "locked" | "materialized" | "removed" | "stored" | "unavailable";
+export interface SecretStoreToolDetails {
+    action: SecretStoreToolInput["action"];
+    status: SecretStoreStatus;
+    profile?: string;
+    variableNames?: string[];
+    profiles?: SecretProfileSummary[];
+    scope?: "managed" | "workspace";
+    envFile?: string;
+    materialized?: boolean;
+    code?: string;
+    message?: string;
+}
+export interface SecretStoreToolOptions {
+    agentDir?: string;
+    vault?: SecretVault;
+}
+export declare function createSecretStoreToolDefinition(options: SecretStoreToolOptions): import("../extensions/types.ts").ToolDefinition<Type.TObject<{
+    action: Type.TUnion<[Type.TLiteral<"set">, Type.TLiteral<"list">, Type.TLiteral<"materialize">, Type.TLiteral<"remove">, Type.TLiteral<"lock">]>;
+    profile: Type.TOptional<Type.TString>;
+    description: Type.TOptional<Type.TString>;
+    envFile: Type.TOptional<Type.TString>;
+    variableNames: Type.TOptional<Type.TArray<Type.TString>>;
+    scope: Type.TOptional<Type.TUnion<[Type.TLiteral<"managed">, Type.TLiteral<"workspace">]>>;
+}>, SecretStoreToolDetails, any> & import("../extensions/types.ts").ToolDefinition<any, any, any>;
+export {};
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/core/tools/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAK5C,OAAO,EAQN,KAAK,oBAAoB,EACzB,WAAW,EAEX,MAAM,4BAA4B,CAAC;AAOpC,QAAA,MAAM,iBAAiB;;;;;;;EA0DtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEpE,MAAM,MAAM,iBAAiB,GAC1B,WAAW,GACX,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,SAAS,GACT,QAAQ,GACR,aAAa,CAAC;AAEjB,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,KAAK,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,WAAW,CAAC;CACpB;AA8YD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,sBAAsB;;;;;;;kGA6E9E","sourcesContent":["import { type Static, Type } from \"typebox\";\nimport { ExtensionEditorComponent } from \"../../modes/interactive/components/extension-editor.ts\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport { defineTool, type ExtensionContext } from \"../extensions/types.ts\";\nimport { parseDotenvDocument, SecretDotenvError } from \"../secrets/secret-dotenv.ts\";\nimport {\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\ttype SecretProfileSummary,\n\tSecretVault,\n\tSecretVaultError,\n} from \"../secrets/secret-vault.ts\";\nimport {\n\temptyOrchestrationCall,\n\tOrchestrationPanelComponent,\n\ttype OrchestrationPanelModel,\n} from \"./orchestration-panel.ts\";\n\nconst secretStoreSchema = Type.Object(\n\t{\n\t\taction: Type.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"set\"),\n\t\t\t\tType.Literal(\"list\"),\n\t\t\t\tType.Literal(\"materialize\"),\n\t\t\t\tType.Literal(\"remove\"),\n\t\t\t\tType.Literal(\"lock\"),\n\t\t\t],\n\t\t\t{ description: \"Credential-management action.\" },\n\t\t),\n\t\tprofile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_PROFILE_ID_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PROFILE_ID_PATTERN,\n\t\t\t\tdescription: \"Portable profile identifier, such as project-dev or aws-work.\",\n\t\t\t}),\n\t\t),\n\t\tdescription: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_DESCRIPTION_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PRINTABLE_METADATA_PATTERN,\n\t\t\t\tdescription: \"Non-secret profile description.\",\n\t\t\t}),\n\t\t),\n\t\tenvFile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 512,\n\t\t\t\tdescription:\n\t\t\t\t\t\"Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.\",\n\t\t\t}),\n\t\t),\n\t\tvariableNames: Type.Optional(\n\t\t\tType.Array(\n\t\t\t\tType.String({\n\t\t\t\t\tminLength: 1,\n\t\t\t\t\tmaxLength: SECRET_VARIABLE_NAME_MAX_CHARS,\n\t\t\t\t\tpattern: SECRET_VARIABLE_NAME_PATTERN,\n\t\t\t\t}),\n\t\t\t\t{\n\t\t\t\t\tminItems: 1,\n\t\t\t\t\tmaxItems: MAX_VARIABLES_PER_PROFILE,\n\t\t\t\t\tdescription: \"Specific variable names to remove. Omit to remove the whole profile.\",\n\t\t\t\t},\n\t\t\t),\n\t\t),\n\t\tscope: Type.Optional(\n\t\t\tType.Union([Type.Literal(\"managed\"), Type.Literal(\"workspace\")], {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport type SecretStoreToolInput = Static<typeof secretStoreSchema>;\n\nexport type SecretStoreStatus =\n\t| \"cancelled\"\n\t| \"error\"\n\t| \"listed\"\n\t| \"locked\"\n\t| \"materialized\"\n\t| \"removed\"\n\t| \"stored\"\n\t| \"unavailable\";\n\nexport interface SecretStoreToolDetails {\n\taction: SecretStoreToolInput[\"action\"];\n\tstatus: SecretStoreStatus;\n\tprofile?: string;\n\tvariableNames?: string[];\n\tprofiles?: SecretProfileSummary[];\n\tscope?: \"managed\" | \"workspace\";\n\tenvFile?: string;\n\tmaterialized?: boolean;\n\tcode?: string;\n\tmessage?: string;\n}\n\nexport interface SecretStoreToolOptions {\n\tagentDir?: string;\n\tvault?: SecretVault;\n}\n\ntype SecretStoreResult = {\n\tcontent: Array<{ type: \"text\"; text: string }>;\n\tdetails: SecretStoreToolDetails;\n};\n\nfunction result(details: SecretStoreToolDetails, text: string): SecretStoreResult {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nfunction cancelled(action: SecretStoreToolInput[\"action\"], profile?: string): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"cancelled\", ...(profile ? { profile } : {}), code: \"owner_cancelled\" },\n\t\t\"Secret store action was cancelled by the owner.\",\n\t);\n}\n\nfunction failed(action: SecretStoreToolInput[\"action\"], error: unknown, profile?: string): SecretStoreResult {\n\tconst code = error instanceof SecretVaultError ? error.code : \"safe_failure\";\n\tconst message =\n\t\terror instanceof SecretVaultError ? error.message : \"Secret store failed safely without exposing values.\";\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store failed: ${message}`,\n\t);\n}\n\nfunction invalid(\n\taction: SecretStoreToolInput[\"action\"],\n\tcode: string,\n\tmessage: string,\n\tprofile?: string,\n): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store request is invalid: ${message}`,\n\t);\n}\n\nfunction panelModel(details: SecretStoreToolDetails | undefined, expanded: boolean): OrchestrationPanelModel {\n\tif (!details) return { label: \"secrets\", status: \"error\", emptyText: \"No secret-store result was retained.\" };\n\tconst success = [\"listed\", \"locked\", \"materialized\", \"removed\", \"stored\"].includes(details.status);\n\tconst rows = expanded\n\t\t? (details.profiles ?? []).map((profile) => ({\n\t\t\t\tstatus: \"info\" as const,\n\t\t\t\tlabel: profile.profile,\n\t\t\t\tmeta: [\n\t\t\t\t\t`${profile.variableNames.length} variable${profile.variableNames.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t\t`${profile.bindings.length} binding${profile.bindings.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t],\n\t\t\t\tdetails: [\n\t\t\t\t\t...(profile.description ? [profile.description] : []),\n\t\t\t\t\t...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),\n\t\t\t\t],\n\t\t\t}))\n\t\t: undefined;\n\treturn {\n\t\tlabel: \"secrets\",\n\t\taction: details.status,\n\t\tstatus: success ? \"success\" : details.status === \"cancelled\" ? \"warning\" : \"error\",\n\t\tsummary: [\n\t\t\tdetails.profile,\n\t\t\tdetails.envFile,\n\t\t\tdetails.scope,\n\t\t\tdetails.variableNames\n\t\t\t\t? `${details.variableNames.length} variable${details.variableNames.length === 1 ? \"\" : \"s\"}`\n\t\t\t\t: undefined,\n\t\t\tdetails.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? \"\" : \"s\"}` : undefined,\n\t\t].filter((value): value is string => value !== undefined),\n\t\trows,\n\t\tnotices:\n\t\t\texpanded && details.message ? [{ status: success ? \"info\" : \"error\", text: details.message }] : undefined,\n\t};\n}\n\nasync function ensureUnlocked(\n\tvault: SecretVault,\n\taction: SecretStoreToolInput[\"action\"],\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n\tprofile?: string,\n): Promise<SecretStoreResult | undefined> {\n\tif (vault.isUnlocked) return undefined;\n\tif (await vault.exists()) {\n\t\twhile (!signal?.aborted) {\n\t\t\tlet passphrase = await ctx.ui.input(\"Unlock secret vault\", \"Master passphrase\", {\n\t\t\t\tsignal,\n\t\t\t\tsensitive: true,\n\t\t\t});\n\t\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\t\ttry {\n\t\t\t\tawait vault.unlock(passphrase);\n\t\t\t\treturn undefined;\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof SecretVaultError && [\"invalid_passphrase\", \"unlock_failed\"].includes(error.code)) {\n\t\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn failed(action, error, profile);\n\t\t\t} finally {\n\t\t\t\tpassphrase = \"\";\n\t\t\t}\n\t\t}\n\t\treturn cancelled(action, profile);\n\t}\n\n\twhile (!signal?.aborted) {\n\t\tlet passphrase = await ctx.ui.input(\"Create secret vault\", \"New master passphrase\", { signal, sensitive: true });\n\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\tlet confirmation = await ctx.ui.input(\"Confirm secret vault\", \"Repeat master passphrase\", {\n\t\t\tsignal,\n\t\t\tsensitive: true,\n\t\t});\n\t\tif (confirmation === undefined || signal?.aborted) {\n\t\t\tpassphrase = \"\";\n\t\t\treturn cancelled(action, profile);\n\t\t}\n\t\ttry {\n\t\t\tif (passphrase !== confirmation) {\n\t\t\t\tctx.ui.notify(\"The two master passphrases do not match.\", \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait vault.initialize(passphrase);\n\t\t\treturn undefined;\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretVaultError && error.code === \"invalid_passphrase\") {\n\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn failed(action, error, profile);\n\t\t} finally {\n\t\t\tpassphrase = \"\";\n\t\t\tconfirmation = \"\";\n\t\t}\n\t}\n\treturn cancelled(action, profile);\n}\n\nfunction validateInput(input: SecretStoreToolInput): SecretStoreResult | undefined {\n\tif (input.action === \"lock\" || input.action === \"list\") {\n\t\tif (\n\t\t\tinput.profile !== undefined ||\n\t\t\tinput.description !== undefined ||\n\t\t\tinput.envFile !== undefined ||\n\t\t\tinput.variableNames !== undefined ||\n\t\t\tinput.scope !== undefined\n\t\t) {\n\t\t\treturn invalid(input.action, \"unexpected_fields\", `Action ${input.action} does not accept profile fields.`);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (input.action === \"set\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action set requires a profile.\");\n\t}\n\tif (input.action === \"remove\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action remove requires a profile.\");\n\t}\n\tif (input.action !== \"set\" && (input.description !== undefined || input.envFile !== undefined)) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_profile_fields\",\n\t\t\t\"description and envFile are valid only for set.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"remove\" && input.variableNames !== undefined) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_variable_names\",\n\t\t\t\"variableNames is valid only for remove.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"materialize\" && input.scope !== undefined) {\n\t\treturn invalid(input.action, \"unexpected_scope\", \"scope is valid only for materialize.\", input.profile);\n\t}\n\tif (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {\n\t\treturn invalid(input.action, \"duplicate_variables\", \"Variable names must be unique.\", input.profile);\n\t}\n\treturn undefined;\n}\n\nasync function openPrivateDotenvEditor(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<string | undefined> {\n\tif (signal?.aborted) return undefined;\n\ttry {\n\t\treturn await ctx.ui.custom<string | undefined>(\n\t\t\t(tui, _theme, keybindings, done) =>\n\t\t\t\tnew ExtensionEditorComponent(\n\t\t\t\t\ttui,\n\t\t\t\t\tkeybindings,\n\t\t\t\t\ttitle,\n\t\t\t\t\tprefill,\n\t\t\t\t\t(value) => done(value),\n\t\t\t\t\t() => done(undefined),\n\t\t\t\t\t{\n\t\t\t\t\t\tprivateContent: true,\n\t\t\t\t\t\tallowExternalEditor: false,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\tnotice: \"Private plaintext editor · content stays local and never enters model context\",\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tif (signal?.aborted) return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function captureValidDotenv(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<{ document: string; variableNames: string[] } | undefined> {\n\tlet draft = prefill;\n\twhile (!signal?.aborted) {\n\t\tconst edited = await openPrivateDotenvEditor(ctx, title, draft, signal);\n\t\tif (edited === undefined || signal?.aborted) return undefined;\n\t\ttry {\n\t\t\tconst parsed = parseDotenvDocument(edited);\n\t\t\tconst variableNames = parsed.variables.map((variable) => variable.name);\n\t\t\tfor (const variable of parsed.variables) variable.value = \"\";\n\t\t\tdraft = \"\";\n\t\t\treturn { document: parsed.document, variableNames };\n\t\t} catch (error) {\n\t\t\tctx.ui.notify(error instanceof SecretDotenvError ? error.message : \"The dotenv document is invalid.\", \"error\");\n\t\t\tdraft = edited;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nasync function executeSet(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tlet document = \"\";\n\tlet originalUnmanagedContent: string | undefined;\n\ttry {\n\t\tconst target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? \".env\");\n\t\tconst destinationState = await vault.inspectEnvDestination(target.destination, input.profile);\n\t\tif (destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The selected dotenv location is already managed by another profile.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\t\tconst storedDocument = await vault.getProfileDocument(input.profile);\n\t\tlet prefill = storedDocument ?? \"\";\n\t\tif (destinationState === \"unmanaged\") {\n\t\t\toriginalUnmanagedContent = await vault.readOwnerDotenv(target.destination);\n\t\t\tprefill = originalUnmanagedContent;\n\t\t}\n\t\tif (destinationState === \"managed-profile\" && storedDocument === undefined) {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"profile_missing\",\n\t\t\t\t\"The dotenv target claims this profile, but the encrypted profile is missing.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\n\t\tconst captured = await captureValidDotenv(\n\t\t\tctx,\n\t\t\t`Secrets · ${input.profile}  →  ${target.destination}`,\n\t\t\tprefill,\n\t\t\tsignal,\n\t\t);\n\t\tprefill = \"\";\n\t\tif (!captured) return cancelled(input.action, input.profile);\n\t\tdocument = captured.document;\n\t\tawait vault.replaceProfileDocument(input.profile, input.description, document, {\n\t\t\tworkspace: target.workspace,\n\t\t\tenvFile: target.envFile,\n\t\t});\n\t\ttry {\n\t\t\tawait vault.materializeEnv(input.profile, target.destination, {\n\t\t\t\tallowReplaceUnmanaged: destinationState === \"unmanaged\",\n\t\t\t\texpectedUnmanagedContent: originalUnmanagedContent,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof SecretVaultError ? error.message : \"Dotenv materialization failed safely.\";\n\t\t\tctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, \"warning\");\n\t\t\treturn result(\n\t\t\t\t{\n\t\t\t\t\taction: input.action,\n\t\t\t\t\tstatus: \"stored\",\n\t\t\t\t\tprofile: input.profile,\n\t\t\t\t\tenvFile: target.envFile,\n\t\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\t\tmaterialized: false,\n\t\t\t\t\tcode: \"materialization_failed\",\n\t\t\t\t\tmessage,\n\t\t\t\t},\n\t\t\t\t`Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`,\n\t\t\t);\n\t\t}\n\t\tctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"stored\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tenvFile: target.envFile,\n\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t} finally {\n\t\tdocument = \"\";\n\t\toriginalUnmanagedContent = undefined;\n\t}\n}\n\nasync function executeMaterialize(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput,\n\tctx: ExtensionContext,\n): Promise<SecretStoreResult> {\n\ttry {\n\t\tconst scope = input.scope ?? \"workspace\";\n\t\tconst binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);\n\t\tconst destination = scope === \"managed\" ? vault.getManagedEnvPath(binding.profile) : binding.destination;\n\t\tconst destinationState = await vault.inspectEnvDestination(destination, binding.profile);\n\t\tif (destinationState === \"unmanaged\" || destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The bound dotenv location is no longer safely managed. Use set to review it in the private editor.\",\n\t\t\t\tbinding.profile,\n\t\t\t);\n\t\t}\n\t\tconst materialized = await vault.materializeEnv(binding.profile, destination, {\n\t\t\tactivationWorkspace: ctx.cwd,\n\t\t\tmanaged: scope === \"managed\",\n\t\t});\n\t\tctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"materialized\",\n\t\t\t\tprofile: binding.profile,\n\t\t\t\tvariableNames: materialized.variableNames,\n\t\t\t\tscope,\n\t\t\t\tenvFile: scope === \"workspace\" ? binding.envFile : undefined,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nasync function executeRemove(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tconst target = input.variableNames?.length\n\t\t? `${input.variableNames.join(\", \")} from profile ${input.profile}`\n\t\t: `the entire profile ${input.profile}`;\n\tconst approved = await ctx.ui.confirm(\n\t\t\"Remove stored secrets\",\n\t\t`Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`,\n\t\t{ signal },\n\t);\n\tif (!approved || signal?.aborted) return cancelled(input.action, input.profile);\n\ttry {\n\t\tconst removal = await vault.removeProfile(input.profile, input.variableNames);\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"removed\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tvariableNames: removal.removedVariableNames,\n\t\t\t},\n\t\t\t`Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? \"\" : \"s\"} from profile ${input.profile}.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nexport function createSecretStoreToolDefinition(options: SecretStoreToolOptions) {\n\tconst vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);\n\tif (!vault) throw new Error(\"secret_store requires an agentDir or SecretVault\");\n\treturn defineTool<typeof secretStoreSchema, SecretStoreToolDetails>({\n\t\tname: \"secret_store\",\n\t\tlabel: \"Secret Store\",\n\t\tdescription:\n\t\t\t\"Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.\",\n\t\tpromptSnippet:\n\t\t\t\"Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.\",\n\t\t\t\"Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.\",\n\t\t\t\"Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.\",\n\t\t\t\"After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.\",\n\t\t\t\"Treat cancellation as owner intent. Do not immediately repeat the same credential request.\",\n\t\t],\n\t\tparameters: secretStoreSchema,\n\t\texecutionMode: \"sequential\",\n\t\trenderShell: \"self\",\n\t\trenderCall() {\n\t\t\treturn emptyOrchestrationCall();\n\t\t},\n\t\trenderResult(toolResult, { expanded, isPartial }, theme: Theme) {\n\t\t\tif (isPartial) {\n\t\t\t\treturn new OrchestrationPanelComponent(theme, {\n\t\t\t\t\tlabel: \"secrets\",\n\t\t\t\t\taction: \"waiting for you\",\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);\n\t\t},\n\t\tasync execute(_toolCallId, input, signal, _onUpdate, ctx) {\n\t\t\tif (!ctx.hasUI || ctx.mode !== \"tui\") {\n\t\t\t\treturn result(\n\t\t\t\t\t{\n\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\tstatus: \"unavailable\",\n\t\t\t\t\t\t...(input.profile ? { profile: input.profile } : {}),\n\t\t\t\t\t\tcode: \"user_tui_required\",\n\t\t\t\t\t\tmessage: \"Secret values can be captured only in a user-visible TUI session.\",\n\t\t\t\t\t},\n\t\t\t\t\t\"secret_store requires a user-visible TUI session.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (signal?.aborted) return cancelled(input.action, input.profile);\n\t\t\tconst validation = validateInput(input);\n\t\t\tif (validation) return validation;\n\t\t\tif (input.action === \"lock\") {\n\t\t\t\tvault.lock();\n\t\t\t\treturn result(\n\t\t\t\t\t{ action: input.action, status: \"locked\" },\n\t\t\t\t\t\"Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);\n\t\t\t\tif (unlockResult) return unlockResult;\n\t\t\t\tif (input.action === \"list\") {\n\t\t\t\t\tconst profiles = await vault.listProfiles();\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"listed\", profiles },\n\t\t\t\t\t\t`Secret vault contains ${profiles.length} profile${profiles.length === 1 ? \"\" : \"s\"}. Only names, variable names, and workspace bindings were returned.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"set\" && input.profile) {\n\t\t\t\t\treturn executeSet(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"materialize\") return executeMaterialize(vault, input, ctx);\n\t\t\t\tif (!input.profile) return invalid(input.action, \"profile_required\", \"A profile is required.\");\n\t\t\t\treturn executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t} catch (error) {\n\t\t\t\treturn failed(input.action, error, input.profile);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}

package/dist/core/tools/secret-store.js

@@ -0,0 +1,412 @@
+import { Type } from "typebox";
+import { ExtensionEditorComponent } from "../../modes/interactive/components/extension-editor.js";
+import { defineTool } from "../extensions/types.js";
+import { parseDotenvDocument, SecretDotenvError } from "../secrets/secret-dotenv.js";
+import { MAX_VARIABLES_PER_PROFILE, SECRET_DESCRIPTION_MAX_CHARS, SECRET_PRINTABLE_METADATA_PATTERN, SECRET_PROFILE_ID_MAX_CHARS, SECRET_PROFILE_ID_PATTERN, SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN, SecretVault, SecretVaultError, } from "../secrets/secret-vault.js";
+import { emptyOrchestrationCall, OrchestrationPanelComponent, } from "./orchestration-panel.js";
+const secretStoreSchema = Type.Object({
+    action: Type.Union([
+        Type.Literal("set"),
+        Type.Literal("list"),
+        Type.Literal("materialize"),
+        Type.Literal("remove"),
+        Type.Literal("lock"),
+    ], { description: "Credential-management action." }),
+    profile: Type.Optional(Type.String({
+        minLength: 1,
+        maxLength: SECRET_PROFILE_ID_MAX_CHARS,
+        pattern: SECRET_PROFILE_ID_PATTERN,
+        description: "Portable profile identifier, such as project-dev or aws-work.",
+    })),
+    description: Type.Optional(Type.String({
+        minLength: 1,
+        maxLength: SECRET_DESCRIPTION_MAX_CHARS,
+        pattern: SECRET_PRINTABLE_METADATA_PATTERN,
+        description: "Non-secret profile description.",
+    })),
+    envFile: Type.Optional(Type.String({
+        minLength: 1,
+        maxLength: 512,
+        description: "Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.",
+    })),
+    variableNames: Type.Optional(Type.Array(Type.String({
+        minLength: 1,
+        maxLength: SECRET_VARIABLE_NAME_MAX_CHARS,
+        pattern: SECRET_VARIABLE_NAME_PATTERN,
+    }), {
+        minItems: 1,
+        maxItems: MAX_VARIABLES_PER_PROFILE,
+        description: "Specific variable names to remove. Omit to remove the whole profile.",
+    })),
+    scope: Type.Optional(Type.Union([Type.Literal("managed"), Type.Literal("workspace")], {
+        description: "Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.",
+    })),
+}, { additionalProperties: false });
+function result(details, text) {
+    return { content: [{ type: "text", text }], details };
+}
+function cancelled(action, profile) {
+    return result({ action, status: "cancelled", ...(profile ? { profile } : {}), code: "owner_cancelled" }, "Secret store action was cancelled by the owner.");
+}
+function failed(action, error, profile) {
+    const code = error instanceof SecretVaultError ? error.code : "safe_failure";
+    const message = error instanceof SecretVaultError ? error.message : "Secret store failed safely without exposing values.";
+    return result({ action, status: "error", ...(profile ? { profile } : {}), code, message }, `Secret store failed: ${message}`);
+}
+function invalid(action, code, message, profile) {
+    return result({ action, status: "error", ...(profile ? { profile } : {}), code, message }, `Secret store request is invalid: ${message}`);
+}
+function panelModel(details, expanded) {
+    if (!details)
+        return { label: "secrets", status: "error", emptyText: "No secret-store result was retained." };
+    const success = ["listed", "locked", "materialized", "removed", "stored"].includes(details.status);
+    const rows = expanded
+        ? (details.profiles ?? []).map((profile) => ({
+            status: "info",
+            label: profile.profile,
+            meta: [
+                `${profile.variableNames.length} variable${profile.variableNames.length === 1 ? "" : "s"}`,
+                `${profile.bindings.length} binding${profile.bindings.length === 1 ? "" : "s"}`,
+            ],
+            details: [
+                ...(profile.description ? [profile.description] : []),
+                ...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),
+            ],
+        }))
+        : undefined;
+    return {
+        label: "secrets",
+        action: details.status,
+        status: success ? "success" : details.status === "cancelled" ? "warning" : "error",
+        summary: [
+            details.profile,
+            details.envFile,
+            details.scope,
+            details.variableNames
+                ? `${details.variableNames.length} variable${details.variableNames.length === 1 ? "" : "s"}`
+                : undefined,
+            details.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? "" : "s"}` : undefined,
+        ].filter((value) => value !== undefined),
+        rows,
+        notices: expanded && details.message ? [{ status: success ? "info" : "error", text: details.message }] : undefined,
+    };
+}
+async function ensureUnlocked(vault, action, ctx, signal, profile) {
+    if (vault.isUnlocked)
+        return undefined;
+    if (await vault.exists()) {
+        while (!signal?.aborted) {
+            let passphrase = await ctx.ui.input("Unlock secret vault", "Master passphrase", {
+                signal,
+                sensitive: true,
+            });
+            if (passphrase === undefined || signal?.aborted)
+                return cancelled(action, profile);
+            try {
+                await vault.unlock(passphrase);
+                return undefined;
+            }
+            catch (error) {
+                if (error instanceof SecretVaultError && ["invalid_passphrase", "unlock_failed"].includes(error.code)) {
+                    ctx.ui.notify(error.message, "error");
+                    continue;
+                }
+                return failed(action, error, profile);
+            }
+            finally {
+                passphrase = "";
+            }
+        }
+        return cancelled(action, profile);
+    }
+    while (!signal?.aborted) {
+        let passphrase = await ctx.ui.input("Create secret vault", "New master passphrase", { signal, sensitive: true });
+        if (passphrase === undefined || signal?.aborted)
+            return cancelled(action, profile);
+        let confirmation = await ctx.ui.input("Confirm secret vault", "Repeat master passphrase", {
+            signal,
+            sensitive: true,
+        });
+        if (confirmation === undefined || signal?.aborted) {
+            passphrase = "";
+            return cancelled(action, profile);
+        }
+        try {
+            if (passphrase !== confirmation) {
+                ctx.ui.notify("The two master passphrases do not match.", "error");
+                continue;
+            }
+            await vault.initialize(passphrase);
+            return undefined;
+        }
+        catch (error) {
+            if (error instanceof SecretVaultError && error.code === "invalid_passphrase") {
+                ctx.ui.notify(error.message, "error");
+                continue;
+            }
+            return failed(action, error, profile);
+        }
+        finally {
+            passphrase = "";
+            confirmation = "";
+        }
+    }
+    return cancelled(action, profile);
+}
+function validateInput(input) {
+    if (input.action === "lock" || input.action === "list") {
+        if (input.profile !== undefined ||
+            input.description !== undefined ||
+            input.envFile !== undefined ||
+            input.variableNames !== undefined ||
+            input.scope !== undefined) {
+            return invalid(input.action, "unexpected_fields", `Action ${input.action} does not accept profile fields.`);
+        }
+        return undefined;
+    }
+    if (input.action === "set" && !input.profile) {
+        return invalid(input.action, "profile_required", "Action set requires a profile.");
+    }
+    if (input.action === "remove" && !input.profile) {
+        return invalid(input.action, "profile_required", "Action remove requires a profile.");
+    }
+    if (input.action !== "set" && (input.description !== undefined || input.envFile !== undefined)) {
+        return invalid(input.action, "unexpected_profile_fields", "description and envFile are valid only for set.", input.profile);
+    }
+    if (input.action !== "remove" && input.variableNames !== undefined) {
+        return invalid(input.action, "unexpected_variable_names", "variableNames is valid only for remove.", input.profile);
+    }
+    if (input.action !== "materialize" && input.scope !== undefined) {
+        return invalid(input.action, "unexpected_scope", "scope is valid only for materialize.", input.profile);
+    }
+    if (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {
+        return invalid(input.action, "duplicate_variables", "Variable names must be unique.", input.profile);
+    }
+    return undefined;
+}
+async function openPrivateDotenvEditor(ctx, title, prefill, signal) {
+    if (signal?.aborted)
+        return undefined;
+    try {
+        return await ctx.ui.custom((tui, _theme, keybindings, done) => new ExtensionEditorComponent(tui, keybindings, title, prefill, (value) => done(value), () => done(undefined), {
+            privateContent: true,
+            allowExternalEditor: false,
+            signal,
+            notice: "Private plaintext editor · content stays local and never enters model context",
+        }));
+    }
+    catch (error) {
+        if (signal?.aborted)
+            return undefined;
+        throw error;
+    }
+}
+async function captureValidDotenv(ctx, title, prefill, signal) {
+    let draft = prefill;
+    while (!signal?.aborted) {
+        const edited = await openPrivateDotenvEditor(ctx, title, draft, signal);
+        if (edited === undefined || signal?.aborted)
+            return undefined;
+        try {
+            const parsed = parseDotenvDocument(edited);
+            const variableNames = parsed.variables.map((variable) => variable.name);
+            for (const variable of parsed.variables)
+                variable.value = "";
+            draft = "";
+            return { document: parsed.document, variableNames };
+        }
+        catch (error) {
+            ctx.ui.notify(error instanceof SecretDotenvError ? error.message : "The dotenv document is invalid.", "error");
+            draft = edited;
+        }
+    }
+    return undefined;
+}
+async function executeSet(vault, input, ctx, signal) {
+    let document = "";
+    let originalUnmanagedContent;
+    try {
+        const target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? ".env");
+        const destinationState = await vault.inspectEnvDestination(target.destination, input.profile);
+        if (destinationState === "managed-other") {
+            return invalid(input.action, "destination_conflict", "The selected dotenv location is already managed by another profile.", input.profile);
+        }
+        const storedDocument = await vault.getProfileDocument(input.profile);
+        let prefill = storedDocument ?? "";
+        if (destinationState === "unmanaged") {
+            originalUnmanagedContent = await vault.readOwnerDotenv(target.destination);
+            prefill = originalUnmanagedContent;
+        }
+        if (destinationState === "managed-profile" && storedDocument === undefined) {
+            return invalid(input.action, "profile_missing", "The dotenv target claims this profile, but the encrypted profile is missing.", input.profile);
+        }
+        const captured = await captureValidDotenv(ctx, `Secrets · ${input.profile}  →  ${target.destination}`, prefill, signal);
+        prefill = "";
+        if (!captured)
+            return cancelled(input.action, input.profile);
+        document = captured.document;
+        await vault.replaceProfileDocument(input.profile, input.description, document, {
+            workspace: target.workspace,
+            envFile: target.envFile,
+        });
+        try {
+            await vault.materializeEnv(input.profile, target.destination, {
+                allowReplaceUnmanaged: destinationState === "unmanaged",
+                expectedUnmanagedContent: originalUnmanagedContent,
+            });
+        }
+        catch (error) {
+            const message = error instanceof SecretVaultError ? error.message : "Dotenv materialization failed safely.";
+            ctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, "warning");
+            return result({
+                action: input.action,
+                status: "stored",
+                profile: input.profile,
+                envFile: target.envFile,
+                variableNames: captured.variableNames,
+                materialized: false,
+                code: "materialization_failed",
+                message,
+            }, `Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`);
+        }
+        ctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, "info");
+        return result({
+            action: input.action,
+            status: "stored",
+            profile: input.profile,
+            envFile: target.envFile,
+            variableNames: captured.variableNames,
+            materialized: true,
+        }, `Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`);
+    }
+    catch (error) {
+        return failed(input.action, error, input.profile);
+    }
+    finally {
+        document = "";
+        originalUnmanagedContent = undefined;
+    }
+}
+async function executeMaterialize(vault, input, ctx) {
+    try {
+        const scope = input.scope ?? "workspace";
+        const binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);
+        const destination = scope === "managed" ? vault.getManagedEnvPath(binding.profile) : binding.destination;
+        const destinationState = await vault.inspectEnvDestination(destination, binding.profile);
+        if (destinationState === "unmanaged" || destinationState === "managed-other") {
+            return invalid(input.action, "destination_conflict", "The bound dotenv location is no longer safely managed. Use set to review it in the private editor.", binding.profile);
+        }
+        const materialized = await vault.materializeEnv(binding.profile, destination, {
+            activationWorkspace: ctx.cwd,
+            managed: scope === "managed",
+        });
+        ctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, "info");
+        return result({
+            action: input.action,
+            status: "materialized",
+            profile: binding.profile,
+            variableNames: materialized.variableNames,
+            scope,
+            envFile: scope === "workspace" ? binding.envFile : undefined,
+            materialized: true,
+        }, `Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`);
+    }
+    catch (error) {
+        return failed(input.action, error, input.profile);
+    }
+}
+async function executeRemove(vault, input, ctx, signal) {
+    const target = input.variableNames?.length
+        ? `${input.variableNames.join(", ")} from profile ${input.profile}`
+        : `the entire profile ${input.profile}`;
+    const approved = await ctx.ui.confirm("Remove stored secrets", `Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`, { signal });
+    if (!approved || signal?.aborted)
+        return cancelled(input.action, input.profile);
+    try {
+        const removal = await vault.removeProfile(input.profile, input.variableNames);
+        return result({
+            action: input.action,
+            status: "removed",
+            profile: input.profile,
+            variableNames: removal.removedVariableNames,
+        }, `Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? "" : "s"} from profile ${input.profile}.`);
+    }
+    catch (error) {
+        return failed(input.action, error, input.profile);
+    }
+}
+export function createSecretStoreToolDefinition(options) {
+    const vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);
+    if (!vault)
+        throw new Error("secret_store requires an agentDir or SecretVault");
+    return defineTool({
+        name: "secret_store",
+        label: "Secret Store",
+        description: "Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.",
+        promptSnippet: "Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.",
+        promptGuidelines: [
+            "Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.",
+            "Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.",
+            "Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.",
+            "After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.",
+            "Treat cancellation as owner intent. Do not immediately repeat the same credential request.",
+        ],
+        parameters: secretStoreSchema,
+        executionMode: "sequential",
+        renderShell: "self",
+        renderCall() {
+            return emptyOrchestrationCall();
+        },
+        renderResult(toolResult, { expanded, isPartial }, theme) {
+            if (isPartial) {
+                return new OrchestrationPanelComponent(theme, {
+                    label: "secrets",
+                    action: "waiting for you",
+                    status: "running",
+                });
+            }
+            return new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);
+        },
+        async execute(_toolCallId, input, signal, _onUpdate, ctx) {
+            if (!ctx.hasUI || ctx.mode !== "tui") {
+                return result({
+                    action: input.action,
+                    status: "unavailable",
+                    ...(input.profile ? { profile: input.profile } : {}),
+                    code: "user_tui_required",
+                    message: "Secret values can be captured only in a user-visible TUI session.",
+                }, "secret_store requires a user-visible TUI session.");
+            }
+            if (signal?.aborted)
+                return cancelled(input.action, input.profile);
+            const validation = validateInput(input);
+            if (validation)
+                return validation;
+            if (input.action === "lock") {
+                vault.lock();
+                return result({ action: input.action, status: "locked" }, "Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.");
+            }
+            try {
+                const unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);
+                if (unlockResult)
+                    return unlockResult;
+                if (input.action === "list") {
+                    const profiles = await vault.listProfiles();
+                    return result({ action: input.action, status: "listed", profiles }, `Secret vault contains ${profiles.length} profile${profiles.length === 1 ? "" : "s"}. Only names, variable names, and workspace bindings were returned.`);
+                }
+                if (input.action === "set" && input.profile) {
+                    return executeSet(vault, { ...input, profile: input.profile }, ctx, signal);
+                }
+                if (input.action === "materialize")
+                    return executeMaterialize(vault, input, ctx);
+                if (!input.profile)
+                    return invalid(input.action, "profile_required", "A profile is required.");
+                return executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);
+            }
+            catch (error) {
+                return failed(input.action, error, input.profile);
+            }
+        },
+    });
+}
+//# sourceMappingURL=secret-store.js.map