@caupulican/pi-adaptative 0.81.42 → 0.81.43

package/dist/core/tools/secret-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAK5C,OAAO,EAQN,KAAK,oBAAoB,EACzB,WAAW,EAEX,MAAM,4BAA4B,CAAC;AAOpC,QAAA,MAAM,iBAAiB;;;;;;;EA0DtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEpE,MAAM,MAAM,iBAAiB,GAC1B,WAAW,GACX,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,SAAS,GACT,QAAQ,GACR,aAAa,CAAC;AAEjB,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,KAAK,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,WAAW,CAAC;CACpB;AA8YD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,sBAAsB;;;;;;;kGA6E9E","sourcesContent":["import { type Static, Type } from \"typebox\";\nimport { ExtensionEditorComponent } from \"../../modes/interactive/components/extension-editor.ts\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport { defineTool, type ExtensionContext } from \"../extensions/types.ts\";\nimport { parseDotenvDocument, SecretDotenvError } from \"../secrets/secret-dotenv.ts\";\nimport {\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\ttype SecretProfileSummary,\n\tSecretVault,\n\tSecretVaultError,\n} from \"../secrets/secret-vault.ts\";\nimport {\n\temptyOrchestrationCall,\n\tOrchestrationPanelComponent,\n\ttype OrchestrationPanelModel,\n} from \"./orchestration-panel.ts\";\n\nconst secretStoreSchema = Type.Object(\n\t{\n\t\taction: Type.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"set\"),\n\t\t\t\tType.Literal(\"list\"),\n\t\t\t\tType.Literal(\"materialize\"),\n\t\t\t\tType.Literal(\"remove\"),\n\t\t\t\tType.Literal(\"lock\"),\n\t\t\t],\n\t\t\t{ description: \"Credential-management action.\" },\n\t\t),\n\t\tprofile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_PROFILE_ID_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PROFILE_ID_PATTERN,\n\t\t\t\tdescription: \"Portable profile identifier, such as project-dev or aws-work.\",\n\t\t\t}),\n\t\t),\n\t\tdescription: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_DESCRIPTION_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PRINTABLE_METADATA_PATTERN,\n\t\t\t\tdescription: \"Non-secret profile description.\",\n\t\t\t}),\n\t\t),\n\t\tenvFile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 512,\n\t\t\t\tdescription:\n\t\t\t\t\t\"Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.\",\n\t\t\t}),\n\t\t),\n\t\tvariableNames: Type.Optional(\n\t\t\tType.Array(\n\t\t\t\tType.String({\n\t\t\t\t\tminLength: 1,\n\t\t\t\t\tmaxLength: SECRET_VARIABLE_NAME_MAX_CHARS,\n\t\t\t\t\tpattern: SECRET_VARIABLE_NAME_PATTERN,\n\t\t\t\t}),\n\t\t\t\t{\n\t\t\t\t\tminItems: 1,\n\t\t\t\t\tmaxItems: MAX_VARIABLES_PER_PROFILE,\n\t\t\t\t\tdescription: \"Specific variable names to remove. Omit to remove the whole profile.\",\n\t\t\t\t},\n\t\t\t),\n\t\t),\n\t\tscope: Type.Optional(\n\t\t\tType.Union([Type.Literal(\"managed\"), Type.Literal(\"workspace\")], {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport type SecretStoreToolInput = Static<typeof secretStoreSchema>;\n\nexport type SecretStoreStatus =\n\t| \"cancelled\"\n\t| \"error\"\n\t| \"listed\"\n\t| \"locked\"\n\t| \"materialized\"\n\t| \"removed\"\n\t| \"stored\"\n\t| \"unavailable\";\n\nexport interface SecretStoreToolDetails {\n\taction: SecretStoreToolInput[\"action\"];\n\tstatus: SecretStoreStatus;\n\tprofile?: string;\n\tvariableNames?: string[];\n\tprofiles?: SecretProfileSummary[];\n\tscope?: \"managed\" | \"workspace\";\n\tenvFile?: string;\n\tmaterialized?: boolean;\n\tcode?: string;\n\tmessage?: string;\n}\n\nexport interface SecretStoreToolOptions {\n\tagentDir?: string;\n\tvault?: SecretVault;\n}\n\ntype SecretStoreResult = {\n\tcontent: Array<{ type: \"text\"; text: string }>;\n\tdetails: SecretStoreToolDetails;\n};\n\nfunction result(details: SecretStoreToolDetails, text: string): SecretStoreResult {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nfunction cancelled(action: SecretStoreToolInput[\"action\"], profile?: string): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"cancelled\", ...(profile ? { profile } : {}), code: \"owner_cancelled\" },\n\t\t\"Secret store action was cancelled by the owner.\",\n\t);\n}\n\nfunction failed(action: SecretStoreToolInput[\"action\"], error: unknown, profile?: string): SecretStoreResult {\n\tconst code = error instanceof SecretVaultError ? error.code : \"safe_failure\";\n\tconst message =\n\t\terror instanceof SecretVaultError ? error.message : \"Secret store failed safely without exposing values.\";\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store failed: ${message}`,\n\t);\n}\n\nfunction invalid(\n\taction: SecretStoreToolInput[\"action\"],\n\tcode: string,\n\tmessage: string,\n\tprofile?: string,\n): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store request is invalid: ${message}`,\n\t);\n}\n\nfunction panelModel(details: SecretStoreToolDetails | undefined, expanded: boolean): OrchestrationPanelModel {\n\tif (!details) return { label: \"secrets\", status: \"error\", emptyText: \"No secret-store result was retained.\" };\n\tconst success = [\"listed\", \"locked\", \"materialized\", \"removed\", \"stored\"].includes(details.status);\n\tconst rows = expanded\n\t\t? (details.profiles ?? []).map((profile) => ({\n\t\t\t\tstatus: \"info\" as const,\n\t\t\t\tlabel: profile.profile,\n\t\t\t\tmeta: [\n\t\t\t\t\t`${profile.variableNames.length} variable${profile.variableNames.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t\t`${profile.bindings.length} binding${profile.bindings.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t],\n\t\t\t\tdetails: [\n\t\t\t\t\t...(profile.description ? [profile.description] : []),\n\t\t\t\t\t...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),\n\t\t\t\t],\n\t\t\t}))\n\t\t: undefined;\n\treturn {\n\t\tlabel: \"secrets\",\n\t\taction: details.status,\n\t\tstatus: success ? \"success\" : details.status === \"cancelled\" ? \"warning\" : \"error\",\n\t\tsummary: [\n\t\t\tdetails.profile,\n\t\t\tdetails.envFile,\n\t\t\tdetails.scope,\n\t\t\tdetails.variableNames\n\t\t\t\t? `${details.variableNames.length} variable${details.variableNames.length === 1 ? \"\" : \"s\"}`\n\t\t\t\t: undefined,\n\t\t\tdetails.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? \"\" : \"s\"}` : undefined,\n\t\t].filter((value): value is string => value !== undefined),\n\t\trows,\n\t\tnotices:\n\t\t\texpanded && details.message ? [{ status: success ? \"info\" : \"error\", text: details.message }] : undefined,\n\t};\n}\n\nasync function ensureUnlocked(\n\tvault: SecretVault,\n\taction: SecretStoreToolInput[\"action\"],\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n\tprofile?: string,\n): Promise<SecretStoreResult | undefined> {\n\tif (vault.isUnlocked) return undefined;\n\tif (await vault.exists()) {\n\t\twhile (!signal?.aborted) {\n\t\t\tlet passphrase = await ctx.ui.input(\"Unlock secret vault\", \"Master passphrase\", {\n\t\t\t\tsignal,\n\t\t\t\tsensitive: true,\n\t\t\t});\n\t\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\t\ttry {\n\t\t\t\tawait vault.unlock(passphrase);\n\t\t\t\treturn undefined;\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof SecretVaultError && [\"invalid_passphrase\", \"unlock_failed\"].includes(error.code)) {\n\t\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn failed(action, error, profile);\n\t\t\t} finally {\n\t\t\t\tpassphrase = \"\";\n\t\t\t}\n\t\t}\n\t\treturn cancelled(action, profile);\n\t}\n\n\twhile (!signal?.aborted) {\n\t\tlet passphrase = await ctx.ui.input(\"Create secret vault\", \"New master passphrase\", { signal, sensitive: true });\n\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\tlet confirmation = await ctx.ui.input(\"Confirm secret vault\", \"Repeat master passphrase\", {\n\t\t\tsignal,\n\t\t\tsensitive: true,\n\t\t});\n\t\tif (confirmation === undefined || signal?.aborted) {\n\t\t\tpassphrase = \"\";\n\t\t\treturn cancelled(action, profile);\n\t\t}\n\t\ttry {\n\t\t\tif (passphrase !== confirmation) {\n\t\t\t\tctx.ui.notify(\"The two master passphrases do not match.\", \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait vault.initialize(passphrase);\n\t\t\treturn undefined;\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretVaultError && error.code === \"invalid_passphrase\") {\n\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn failed(action, error, profile);\n\t\t} finally {\n\t\t\tpassphrase = \"\";\n\t\t\tconfirmation = \"\";\n\t\t}\n\t}\n\treturn cancelled(action, profile);\n}\n\nfunction validateInput(input: SecretStoreToolInput): SecretStoreResult | undefined {\n\tif (input.action === \"lock\" || input.action === \"list\") {\n\t\tif (\n\t\t\tinput.profile !== undefined ||\n\t\t\tinput.description !== undefined ||\n\t\t\tinput.envFile !== undefined ||\n\t\t\tinput.variableNames !== undefined ||\n\t\t\tinput.scope !== undefined\n\t\t) {\n\t\t\treturn invalid(input.action, \"unexpected_fields\", `Action ${input.action} does not accept profile fields.`);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (input.action === \"set\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action set requires a profile.\");\n\t}\n\tif (input.action === \"remove\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action remove requires a profile.\");\n\t}\n\tif (input.action !== \"set\" && (input.description !== undefined || input.envFile !== undefined)) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_profile_fields\",\n\t\t\t\"description and envFile are valid only for set.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"remove\" && input.variableNames !== undefined) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_variable_names\",\n\t\t\t\"variableNames is valid only for remove.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"materialize\" && input.scope !== undefined) {\n\t\treturn invalid(input.action, \"unexpected_scope\", \"scope is valid only for materialize.\", input.profile);\n\t}\n\tif (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {\n\t\treturn invalid(input.action, \"duplicate_variables\", \"Variable names must be unique.\", input.profile);\n\t}\n\treturn undefined;\n}\n\nasync function openPrivateDotenvEditor(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<string | undefined> {\n\tif (signal?.aborted) return undefined;\n\ttry {\n\t\treturn await ctx.ui.custom<string | undefined>(\n\t\t\t(tui, _theme, keybindings, done) =>\n\t\t\t\tnew ExtensionEditorComponent(\n\t\t\t\t\ttui,\n\t\t\t\t\tkeybindings,\n\t\t\t\t\ttitle,\n\t\t\t\t\tprefill,\n\t\t\t\t\t(value) => done(value),\n\t\t\t\t\t() => done(undefined),\n\t\t\t\t\t{\n\t\t\t\t\t\tprivateContent: true,\n\t\t\t\t\t\tallowExternalEditor: false,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\tnotice: \"Private plaintext editor · content stays local and never enters model context\",\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tif (signal?.aborted) return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function captureValidDotenv(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<{ document: string; variableNames: string[] } | undefined> {\n\tlet draft = prefill;\n\twhile (!signal?.aborted) {\n\t\tconst edited = await openPrivateDotenvEditor(ctx, title, draft, signal);\n\t\tif (edited === undefined || signal?.aborted) return undefined;\n\t\ttry {\n\t\t\tconst parsed = parseDotenvDocument(edited);\n\t\t\tconst variableNames = parsed.variables.map((variable) => variable.name);\n\t\t\tfor (const variable of parsed.variables) variable.value = \"\";\n\t\t\tdraft = \"\";\n\t\t\treturn { document: parsed.document, variableNames };\n\t\t} catch (error) {\n\t\t\tctx.ui.notify(error instanceof SecretDotenvError ? error.message : \"The dotenv document is invalid.\", \"error\");\n\t\t\tdraft = edited;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nasync function executeSet(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tlet document = \"\";\n\tlet originalUnmanagedContent: string | undefined;\n\ttry {\n\t\tconst target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? \".env\");\n\t\tconst destinationState = await vault.inspectEnvDestination(target.destination, input.profile);\n\t\tif (destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The selected dotenv location is already managed by another profile.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\t\tconst storedDocument = await vault.getProfileDocument(input.profile);\n\t\tlet prefill = storedDocument ?? \"\";\n\t\tif (destinationState === \"unmanaged\") {\n\t\t\toriginalUnmanagedContent = await vault.readOwnerDotenv(target.destination);\n\t\t\tprefill = originalUnmanagedContent;\n\t\t}\n\t\tif (destinationState === \"managed-profile\" && storedDocument === undefined) {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"profile_missing\",\n\t\t\t\t\"The dotenv target claims this profile, but the encrypted profile is missing.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\n\t\tconst captured = await captureValidDotenv(\n\t\t\tctx,\n\t\t\t`Secrets · ${input.profile}  →  ${target.destination}`,\n\t\t\tprefill,\n\t\t\tsignal,\n\t\t);\n\t\tprefill = \"\";\n\t\tif (!captured) return cancelled(input.action, input.profile);\n\t\tdocument = captured.document;\n\t\tawait vault.replaceProfileDocument(input.profile, input.description, document, {\n\t\t\tworkspace: target.workspace,\n\t\t\tenvFile: target.envFile,\n\t\t});\n\t\ttry {\n\t\t\tawait vault.materializeEnv(input.profile, target.destination, {\n\t\t\t\tallowReplaceUnmanaged: destinationState === \"unmanaged\",\n\t\t\t\texpectedUnmanagedContent: originalUnmanagedContent,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof SecretVaultError ? error.message : \"Dotenv materialization failed safely.\";\n\t\t\tctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, \"warning\");\n\t\t\treturn result(\n\t\t\t\t{\n\t\t\t\t\taction: input.action,\n\t\t\t\t\tstatus: \"stored\",\n\t\t\t\t\tprofile: input.profile,\n\t\t\t\t\tenvFile: target.envFile,\n\t\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\t\tmaterialized: false,\n\t\t\t\t\tcode: \"materialization_failed\",\n\t\t\t\t\tmessage,\n\t\t\t\t},\n\t\t\t\t`Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`,\n\t\t\t);\n\t\t}\n\t\tctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"stored\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tenvFile: target.envFile,\n\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t} finally {\n\t\tdocument = \"\";\n\t\toriginalUnmanagedContent = undefined;\n\t}\n}\n\nasync function executeMaterialize(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput,\n\tctx: ExtensionContext,\n): Promise<SecretStoreResult> {\n\ttry {\n\t\tconst scope = input.scope ?? \"workspace\";\n\t\tconst binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);\n\t\tconst destination = scope === \"managed\" ? vault.getManagedEnvPath(binding.profile) : binding.destination;\n\t\tconst destinationState = await vault.inspectEnvDestination(destination, binding.profile);\n\t\tif (destinationState === \"unmanaged\" || destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The bound dotenv location is no longer safely managed. Use set to review it in the private editor.\",\n\t\t\t\tbinding.profile,\n\t\t\t);\n\t\t}\n\t\tconst materialized = await vault.materializeEnv(binding.profile, destination, {\n\t\t\tactivationWorkspace: ctx.cwd,\n\t\t\tmanaged: scope === \"managed\",\n\t\t});\n\t\tctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"materialized\",\n\t\t\t\tprofile: binding.profile,\n\t\t\t\tvariableNames: materialized.variableNames,\n\t\t\t\tscope,\n\t\t\t\tenvFile: scope === \"workspace\" ? binding.envFile : undefined,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nasync function executeRemove(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tconst target = input.variableNames?.length\n\t\t? `${input.variableNames.join(\", \")} from profile ${input.profile}`\n\t\t: `the entire profile ${input.profile}`;\n\tconst approved = await ctx.ui.confirm(\n\t\t\"Remove stored secrets\",\n\t\t`Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`,\n\t\t{ signal },\n\t);\n\tif (!approved || signal?.aborted) return cancelled(input.action, input.profile);\n\ttry {\n\t\tconst removal = await vault.removeProfile(input.profile, input.variableNames);\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"removed\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tvariableNames: removal.removedVariableNames,\n\t\t\t},\n\t\t\t`Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? \"\" : \"s\"} from profile ${input.profile}.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nexport function createSecretStoreToolDefinition(options: SecretStoreToolOptions) {\n\tconst vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);\n\tif (!vault) throw new Error(\"secret_store requires an agentDir or SecretVault\");\n\treturn defineTool<typeof secretStoreSchema, SecretStoreToolDetails>({\n\t\tname: \"secret_store\",\n\t\tlabel: \"Secret Store\",\n\t\tdescription:\n\t\t\t\"Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.\",\n\t\tpromptSnippet:\n\t\t\t\"Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.\",\n\t\t\t\"Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.\",\n\t\t\t\"Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.\",\n\t\t\t\"After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.\",\n\t\t\t\"Treat cancellation as owner intent. Do not immediately repeat the same credential request.\",\n\t\t],\n\t\tparameters: secretStoreSchema,\n\t\texecutionMode: \"sequential\",\n\t\trenderShell: \"self\",\n\t\trenderCall() {\n\t\t\treturn emptyOrchestrationCall();\n\t\t},\n\t\trenderResult(toolResult, { expanded, isPartial }, theme: Theme) {\n\t\t\tif (isPartial) {\n\t\t\t\treturn new OrchestrationPanelComponent(theme, {\n\t\t\t\t\tlabel: \"secrets\",\n\t\t\t\t\taction: \"waiting for you\",\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);\n\t\t},\n\t\tasync execute(_toolCallId, input, signal, _onUpdate, ctx) {\n\t\t\tif (!ctx.hasUI || ctx.mode !== \"tui\") {\n\t\t\t\treturn result(\n\t\t\t\t\t{\n\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\tstatus: \"unavailable\",\n\t\t\t\t\t\t...(input.profile ? { profile: input.profile } : {}),\n\t\t\t\t\t\tcode: \"user_tui_required\",\n\t\t\t\t\t\tmessage: \"Secret values can be captured only in a user-visible TUI session.\",\n\t\t\t\t\t},\n\t\t\t\t\t\"secret_store requires a user-visible TUI session.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (signal?.aborted) return cancelled(input.action, input.profile);\n\t\t\tconst validation = validateInput(input);\n\t\t\tif (validation) return validation;\n\t\t\tif (input.action === \"lock\") {\n\t\t\t\tvault.lock();\n\t\t\t\treturn result(\n\t\t\t\t\t{ action: input.action, status: \"locked\" },\n\t\t\t\t\t\"Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);\n\t\t\t\tif (unlockResult) return unlockResult;\n\t\t\t\tif (input.action === \"list\") {\n\t\t\t\t\tconst profiles = await vault.listProfiles();\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"listed\", profiles },\n\t\t\t\t\t\t`Secret vault contains ${profiles.length} profile${profiles.length === 1 ? \"\" : \"s\"}. Only names, variable names, and workspace bindings were returned.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"set\" && input.profile) {\n\t\t\t\t\treturn executeSet(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"materialize\") return executeMaterialize(vault, input, ctx);\n\t\t\t\tif (!input.profile) return invalid(input.action, \"profile_required\", \"A profile is required.\");\n\t\t\t\treturn executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t} catch (error) {\n\t\t\t\treturn failed(input.action, error, input.profile);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAK5C,OAAO,EAQN,KAAK,oBAAoB,EACzB,WAAW,EAEX,MAAM,4BAA4B,CAAC;AAOpC,QAAA,MAAM,iBAAiB;;;;;;;EA0DtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEpE,MAAM,MAAM,iBAAiB,GAC1B,WAAW,GACX,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,SAAS,GACT,QAAQ,GACR,aAAa,CAAC;AAEjB,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAClC,KAAK,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,WAAW,CAAC;CACpB;AA8YD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,sBAAsB;;;;;;;kGA6E9E"}

package/dist/core/tools/secret-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAElG,OAAO,EAAE,UAAU,EAAyB,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EACN,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAE5B,WAAW,EACX,gBAAgB,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,sBAAsB,EACtB,2BAA2B,GAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CACpC;IACC,MAAM,EAAE,IAAI,CAAC,KAAK,CACjB;QACC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,EACD,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAChD;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,2BAA2B;QACtC,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,+DAA+D;KAC5E,CAAC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,4BAA4B;QACvC,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,iCAAiC;KAC9C,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,WAAW,EACV,yHAAyH;KAC1H,CAAC,CACF;IACD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CACT,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,8BAA8B;QACzC,OAAO,EAAE,4BAA4B;KACrC,CAAC,EACF;QACC,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,yBAAyB;QACnC,WAAW,EAAE,sEAAsE;KACnF,CACD,CACD;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE;QAChE,WAAW,EACV,kHAAkH;KACnH,CAAC,CACF;CACD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAqCF,SAAS,MAAM,CAAC,OAA+B,EAAE,IAAY,EAAqB;IACjF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAAA,CACtD;AAED,SAAS,SAAS,CAAC,MAAsC,EAAE,OAAgB,EAAqB;IAC/F,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EACzF,iDAAiD,CACjD,CAAC;AAAA,CACF;AAED,SAAS,MAAM,CAAC,MAAsC,EAAE,KAAc,EAAE,OAAgB,EAAqB;IAC5G,MAAM,IAAI,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD,CAAC;IAC3G,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,wBAAwB,OAAO,EAAE,CACjC,CAAC;AAAA,CACF;AAED,SAAS,OAAO,CACf,MAAsC,EACtC,IAAY,EACZ,OAAe,EACf,OAAgB,EACI;IACpB,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,oCAAoC,OAAO,EAAE,CAC7C,CAAC;AAAA,CACF;AAED,SAAS,UAAU,CAAC,OAA2C,EAAE,QAAiB,EAA2B;IAC5G,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,sCAAsC,EAAE,CAAC;IAC9G,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,QAAQ;QACpB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,MAAe;YACvB,KAAK,EAAE,OAAO,CAAC,OAAO;YACtB,IAAI,EAAE;gBACL,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC1F,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;aAC/E;YACD,OAAO,EAAE;gBACR,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,OAAM,OAAO,CAAC,SAAS,EAAE,CAAC;aACjF;SACD,CAAC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QAClF,OAAO,EAAE;YACR,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,aAAa;gBACpB,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC5F,CAAC,CAAC,SAAS;YACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC9G,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACzD,IAAI;QACJ,OAAO,EACN,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1G,CAAC;AAAA,CACF;AAED,KAAK,UAAU,cAAc,CAC5B,KAAkB,EAClB,MAAsC,EACtC,GAAqB,EACrB,MAA+B,EAC/B,OAAgB,EACyB;IACzC,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,mBAAmB,EAAE;gBAC/E,MAAM;gBACN,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnF,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,SAAS,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACtC,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACV,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnF,IAAI,YAAY,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,EAAE;YACzF,MAAM;YACN,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACnD,UAAU,GAAG,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBACjC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;gBACnE,SAAS;YACV,CAAC;YACD,MAAM,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC9E,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtC,SAAS;YACV,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;YAChB,YAAY,GAAG,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,aAAa,CAAC,KAA2B,EAAiC;IAClF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxD,IACC,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,WAAW,KAAK,SAAS;YAC/B,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,aAAa,KAAK,SAAS;YACjC,KAAK,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACF,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,KAAK,CAAC,MAAM,kCAAkC,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,iDAAiD,EACjD,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,yCAAyC,EACzC,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,sCAAsC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC7F,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B,EACD;IAC9B,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CACzB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAClC,IAAI,wBAAwB,CAC3B,GAAG,EACH,WAAW,EACX,KAAK,EACL,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EACtB,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EACrB;YACC,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,KAAK;YAC1B,MAAM;YACN,MAAM,EAAE,gFAA+E;SACvF,CACD,CACF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B,EACsC;IACrE,IAAI,KAAK,GAAG,OAAO,CAAC;IACpB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;YAC/G,KAAK,GAAG,MAAM,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,KAAK,UAAU,UAAU,CACxB,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B,EACF;IAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,wBAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC1C,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,qEAAqE,EACrE,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,cAAc,IAAI,EAAE,CAAC;QACnC,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,wBAAwB,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3E,OAAO,GAAG,wBAAwB,CAAC;QACpC,CAAC;QACD,IAAI,gBAAgB,KAAK,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,iBAAiB,EACjB,8EAA8E,EAC9E,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACxC,GAAG,EACH,cAAa,KAAK,CAAC,OAAO,UAAQ,MAAM,CAAC,WAAW,EAAE,EACtD,OAAO,EACP,MAAM,CACN,CAAC;QACF,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,MAAM,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE;YAC9E,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACJ,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC7D,qBAAqB,EAAE,gBAAgB,KAAK,WAAW;gBACvD,wBAAwB,EAAE,wBAAwB;aAClD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC5G,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,MAAM,CAAC,WAAW,uBAAuB,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;YACpG,OAAO,MAAM,CACZ;gBACC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,YAAY,EAAE,KAAK;gBACnB,IAAI,EAAE,wBAAwB;gBAC9B,OAAO;aACP,EACD,kBAAkB,KAAK,CAAC,OAAO,wGAAwG,CACvI,CAAC;QACH,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,KAAK,CAAC,OAAO,4BAA4B,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3G,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,IAAI;SAClB,EACD,wBAAwB,QAAQ,CAAC,aAAa,CAAC,MAAM,0BAA0B,KAAK,CAAC,OAAO,8EAA8E,CAC1K,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACV,QAAQ,GAAG,EAAE,CAAC;QACd,wBAAwB,GAAG,SAAS,CAAC;IACtC,CAAC;AAAA,CACD;AAED,KAAK,UAAU,kBAAkB,CAChC,KAAkB,EAClB,KAA2B,EAC3B,GAAqB,EACQ;IAC7B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACzG,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,gBAAgB,KAAK,WAAW,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC9E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,oGAAoG,EACpG,OAAO,CAAC,OAAO,CACf,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE;YAC7E,mBAAmB,EAAE,GAAG,CAAC,GAAG;YAC5B,OAAO,EAAE,KAAK,KAAK,SAAS;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,OAAO,CAAC,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3F,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,KAAK;YACL,OAAO,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC5D,YAAY,EAAE,IAAI;SAClB,EACD,qBAAqB,OAAO,CAAC,OAAO,oHAAoH,CACxJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AAAA,CACD;AAED,KAAK,UAAU,aAAa,CAC3B,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B,EACF;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,MAAM;QACzC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE;QACnE,CAAC,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CACpC,uBAAuB,EACvB,UAAU,MAAM,mEAAmE,EACnF,EAAE,MAAM,EAAE,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,OAAO,CAAC,oBAAoB;SAC3C,EACD,WAAW,OAAO,CAAC,oBAAoB,CAAC,MAAM,mBAAmB,OAAO,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC,OAAO,GAAG,CACtJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AAAA,CACD;AAED,MAAM,UAAU,+BAA+B,CAAC,OAA+B,EAAE;IAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChF,OAAO,UAAU,CAAmD;QACnE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACV,kMAAkM;QACnM,aAAa,EACZ,0LAA0L;QAC3L,gBAAgB,EAAE;YACjB,uIAAuI;YACvI,8KAA8K;YAC9K,4LAA4L;YAC5L,+JAA+J;YAC/J,4FAA4F;SAC5F;QACD,UAAU,EAAE,iBAAiB;QAC7B,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,MAAM;QACnB,UAAU,GAAG;YACZ,OAAO,sBAAsB,EAAE,CAAC;QAAA,CAChC;QACD,YAAY,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAY,EAAE;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE;oBAC7C,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,iBAAiB;oBACzB,MAAM,EAAE,SAAS;iBACjB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAAA,CAClG;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACtC,OAAO,MAAM,CACZ;oBACC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa;oBACrB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,mEAAmE;iBAC5E,EACD,mDAAmD,CACnD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAC1C,wGAAwG,CACxG,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3F,IAAI,YAAY;oBAAE,OAAO,YAAY,CAAC;gBACtC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC5C,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACpD,yBAAyB,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qEAAqE,CACxJ,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC7C,OAAO,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;oBAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;gBAC/F,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;QAAA,CACD;KACD,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { type Static, Type } from \"typebox\";\nimport { ExtensionEditorComponent } from \"../../modes/interactive/components/extension-editor.ts\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport { defineTool, type ExtensionContext } from \"../extensions/types.ts\";\nimport { parseDotenvDocument, SecretDotenvError } from \"../secrets/secret-dotenv.ts\";\nimport {\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\ttype SecretProfileSummary,\n\tSecretVault,\n\tSecretVaultError,\n} from \"../secrets/secret-vault.ts\";\nimport {\n\temptyOrchestrationCall,\n\tOrchestrationPanelComponent,\n\ttype OrchestrationPanelModel,\n} from \"./orchestration-panel.ts\";\n\nconst secretStoreSchema = Type.Object(\n\t{\n\t\taction: Type.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"set\"),\n\t\t\t\tType.Literal(\"list\"),\n\t\t\t\tType.Literal(\"materialize\"),\n\t\t\t\tType.Literal(\"remove\"),\n\t\t\t\tType.Literal(\"lock\"),\n\t\t\t],\n\t\t\t{ description: \"Credential-management action.\" },\n\t\t),\n\t\tprofile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_PROFILE_ID_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PROFILE_ID_PATTERN,\n\t\t\t\tdescription: \"Portable profile identifier, such as project-dev or aws-work.\",\n\t\t\t}),\n\t\t),\n\t\tdescription: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_DESCRIPTION_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PRINTABLE_METADATA_PATTERN,\n\t\t\t\tdescription: \"Non-secret profile description.\",\n\t\t\t}),\n\t\t),\n\t\tenvFile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 512,\n\t\t\t\tdescription:\n\t\t\t\t\t\"Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.\",\n\t\t\t}),\n\t\t),\n\t\tvariableNames: Type.Optional(\n\t\t\tType.Array(\n\t\t\t\tType.String({\n\t\t\t\t\tminLength: 1,\n\t\t\t\t\tmaxLength: SECRET_VARIABLE_NAME_MAX_CHARS,\n\t\t\t\t\tpattern: SECRET_VARIABLE_NAME_PATTERN,\n\t\t\t\t}),\n\t\t\t\t{\n\t\t\t\t\tminItems: 1,\n\t\t\t\t\tmaxItems: MAX_VARIABLES_PER_PROFILE,\n\t\t\t\t\tdescription: \"Specific variable names to remove. Omit to remove the whole profile.\",\n\t\t\t\t},\n\t\t\t),\n\t\t),\n\t\tscope: Type.Optional(\n\t\t\tType.Union([Type.Literal(\"managed\"), Type.Literal(\"workspace\")], {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport type SecretStoreToolInput = Static<typeof secretStoreSchema>;\n\nexport type SecretStoreStatus =\n\t| \"cancelled\"\n\t| \"error\"\n\t| \"listed\"\n\t| \"locked\"\n\t| \"materialized\"\n\t| \"removed\"\n\t| \"stored\"\n\t| \"unavailable\";\n\nexport interface SecretStoreToolDetails {\n\taction: SecretStoreToolInput[\"action\"];\n\tstatus: SecretStoreStatus;\n\tprofile?: string;\n\tvariableNames?: string[];\n\tprofiles?: SecretProfileSummary[];\n\tscope?: \"managed\" | \"workspace\";\n\tenvFile?: string;\n\tmaterialized?: boolean;\n\tcode?: string;\n\tmessage?: string;\n}\n\nexport interface SecretStoreToolOptions {\n\tagentDir?: string;\n\tvault?: SecretVault;\n}\n\ntype SecretStoreResult = {\n\tcontent: Array<{ type: \"text\"; text: string }>;\n\tdetails: SecretStoreToolDetails;\n};\n\nfunction result(details: SecretStoreToolDetails, text: string): SecretStoreResult {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nfunction cancelled(action: SecretStoreToolInput[\"action\"], profile?: string): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"cancelled\", ...(profile ? { profile } : {}), code: \"owner_cancelled\" },\n\t\t\"Secret store action was cancelled by the owner.\",\n\t);\n}\n\nfunction failed(action: SecretStoreToolInput[\"action\"], error: unknown, profile?: string): SecretStoreResult {\n\tconst code = error instanceof SecretVaultError ? error.code : \"safe_failure\";\n\tconst message =\n\t\terror instanceof SecretVaultError ? error.message : \"Secret store failed safely without exposing values.\";\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store failed: ${message}`,\n\t);\n}\n\nfunction invalid(\n\taction: SecretStoreToolInput[\"action\"],\n\tcode: string,\n\tmessage: string,\n\tprofile?: string,\n): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store request is invalid: ${message}`,\n\t);\n}\n\nfunction panelModel(details: SecretStoreToolDetails | undefined, expanded: boolean): OrchestrationPanelModel {\n\tif (!details) return { label: \"secrets\", status: \"error\", emptyText: \"No secret-store result was retained.\" };\n\tconst success = [\"listed\", \"locked\", \"materialized\", \"removed\", \"stored\"].includes(details.status);\n\tconst rows = expanded\n\t\t? (details.profiles ?? []).map((profile) => ({\n\t\t\t\tstatus: \"info\" as const,\n\t\t\t\tlabel: profile.profile,\n\t\t\t\tmeta: [\n\t\t\t\t\t`${profile.variableNames.length} variable${profile.variableNames.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t\t`${profile.bindings.length} binding${profile.bindings.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t],\n\t\t\t\tdetails: [\n\t\t\t\t\t...(profile.description ? [profile.description] : []),\n\t\t\t\t\t...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),\n\t\t\t\t],\n\t\t\t}))\n\t\t: undefined;\n\treturn {\n\t\tlabel: \"secrets\",\n\t\taction: details.status,\n\t\tstatus: success ? \"success\" : details.status === \"cancelled\" ? \"warning\" : \"error\",\n\t\tsummary: [\n\t\t\tdetails.profile,\n\t\t\tdetails.envFile,\n\t\t\tdetails.scope,\n\t\t\tdetails.variableNames\n\t\t\t\t? `${details.variableNames.length} variable${details.variableNames.length === 1 ? \"\" : \"s\"}`\n\t\t\t\t: undefined,\n\t\t\tdetails.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? \"\" : \"s\"}` : undefined,\n\t\t].filter((value): value is string => value !== undefined),\n\t\trows,\n\t\tnotices:\n\t\t\texpanded && details.message ? [{ status: success ? \"info\" : \"error\", text: details.message }] : undefined,\n\t};\n}\n\nasync function ensureUnlocked(\n\tvault: SecretVault,\n\taction: SecretStoreToolInput[\"action\"],\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n\tprofile?: string,\n): Promise<SecretStoreResult | undefined> {\n\tif (vault.isUnlocked) return undefined;\n\tif (await vault.exists()) {\n\t\twhile (!signal?.aborted) {\n\t\t\tlet passphrase = await ctx.ui.input(\"Unlock secret vault\", \"Master passphrase\", {\n\t\t\t\tsignal,\n\t\t\t\tsensitive: true,\n\t\t\t});\n\t\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\t\ttry {\n\t\t\t\tawait vault.unlock(passphrase);\n\t\t\t\treturn undefined;\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof SecretVaultError && [\"invalid_passphrase\", \"unlock_failed\"].includes(error.code)) {\n\t\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn failed(action, error, profile);\n\t\t\t} finally {\n\t\t\t\tpassphrase = \"\";\n\t\t\t}\n\t\t}\n\t\treturn cancelled(action, profile);\n\t}\n\n\twhile (!signal?.aborted) {\n\t\tlet passphrase = await ctx.ui.input(\"Create secret vault\", \"New master passphrase\", { signal, sensitive: true });\n\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\tlet confirmation = await ctx.ui.input(\"Confirm secret vault\", \"Repeat master passphrase\", {\n\t\t\tsignal,\n\t\t\tsensitive: true,\n\t\t});\n\t\tif (confirmation === undefined || signal?.aborted) {\n\t\t\tpassphrase = \"\";\n\t\t\treturn cancelled(action, profile);\n\t\t}\n\t\ttry {\n\t\t\tif (passphrase !== confirmation) {\n\t\t\t\tctx.ui.notify(\"The two master passphrases do not match.\", \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait vault.initialize(passphrase);\n\t\t\treturn undefined;\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretVaultError && error.code === \"invalid_passphrase\") {\n\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn failed(action, error, profile);\n\t\t} finally {\n\t\t\tpassphrase = \"\";\n\t\t\tconfirmation = \"\";\n\t\t}\n\t}\n\treturn cancelled(action, profile);\n}\n\nfunction validateInput(input: SecretStoreToolInput): SecretStoreResult | undefined {\n\tif (input.action === \"lock\" || input.action === \"list\") {\n\t\tif (\n\t\t\tinput.profile !== undefined ||\n\t\t\tinput.description !== undefined ||\n\t\t\tinput.envFile !== undefined ||\n\t\t\tinput.variableNames !== undefined ||\n\t\t\tinput.scope !== undefined\n\t\t) {\n\t\t\treturn invalid(input.action, \"unexpected_fields\", `Action ${input.action} does not accept profile fields.`);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (input.action === \"set\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action set requires a profile.\");\n\t}\n\tif (input.action === \"remove\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action remove requires a profile.\");\n\t}\n\tif (input.action !== \"set\" && (input.description !== undefined || input.envFile !== undefined)) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_profile_fields\",\n\t\t\t\"description and envFile are valid only for set.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"remove\" && input.variableNames !== undefined) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_variable_names\",\n\t\t\t\"variableNames is valid only for remove.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"materialize\" && input.scope !== undefined) {\n\t\treturn invalid(input.action, \"unexpected_scope\", \"scope is valid only for materialize.\", input.profile);\n\t}\n\tif (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {\n\t\treturn invalid(input.action, \"duplicate_variables\", \"Variable names must be unique.\", input.profile);\n\t}\n\treturn undefined;\n}\n\nasync function openPrivateDotenvEditor(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<string | undefined> {\n\tif (signal?.aborted) return undefined;\n\ttry {\n\t\treturn await ctx.ui.custom<string | undefined>(\n\t\t\t(tui, _theme, keybindings, done) =>\n\t\t\t\tnew ExtensionEditorComponent(\n\t\t\t\t\ttui,\n\t\t\t\t\tkeybindings,\n\t\t\t\t\ttitle,\n\t\t\t\t\tprefill,\n\t\t\t\t\t(value) => done(value),\n\t\t\t\t\t() => done(undefined),\n\t\t\t\t\t{\n\t\t\t\t\t\tprivateContent: true,\n\t\t\t\t\t\tallowExternalEditor: false,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\tnotice: \"Private plaintext editor · content stays local and never enters model context\",\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tif (signal?.aborted) return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function captureValidDotenv(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<{ document: string; variableNames: string[] } | undefined> {\n\tlet draft = prefill;\n\twhile (!signal?.aborted) {\n\t\tconst edited = await openPrivateDotenvEditor(ctx, title, draft, signal);\n\t\tif (edited === undefined || signal?.aborted) return undefined;\n\t\ttry {\n\t\t\tconst parsed = parseDotenvDocument(edited);\n\t\t\tconst variableNames = parsed.variables.map((variable) => variable.name);\n\t\t\tfor (const variable of parsed.variables) variable.value = \"\";\n\t\t\tdraft = \"\";\n\t\t\treturn { document: parsed.document, variableNames };\n\t\t} catch (error) {\n\t\t\tctx.ui.notify(error instanceof SecretDotenvError ? error.message : \"The dotenv document is invalid.\", \"error\");\n\t\t\tdraft = edited;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nasync function executeSet(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tlet document = \"\";\n\tlet originalUnmanagedContent: string | undefined;\n\ttry {\n\t\tconst target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? \".env\");\n\t\tconst destinationState = await vault.inspectEnvDestination(target.destination, input.profile);\n\t\tif (destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The selected dotenv location is already managed by another profile.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\t\tconst storedDocument = await vault.getProfileDocument(input.profile);\n\t\tlet prefill = storedDocument ?? \"\";\n\t\tif (destinationState === \"unmanaged\") {\n\t\t\toriginalUnmanagedContent = await vault.readOwnerDotenv(target.destination);\n\t\t\tprefill = originalUnmanagedContent;\n\t\t}\n\t\tif (destinationState === \"managed-profile\" && storedDocument === undefined) {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"profile_missing\",\n\t\t\t\t\"The dotenv target claims this profile, but the encrypted profile is missing.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\n\t\tconst captured = await captureValidDotenv(\n\t\t\tctx,\n\t\t\t`Secrets · ${input.profile}  →  ${target.destination}`,\n\t\t\tprefill,\n\t\t\tsignal,\n\t\t);\n\t\tprefill = \"\";\n\t\tif (!captured) return cancelled(input.action, input.profile);\n\t\tdocument = captured.document;\n\t\tawait vault.replaceProfileDocument(input.profile, input.description, document, {\n\t\t\tworkspace: target.workspace,\n\t\t\tenvFile: target.envFile,\n\t\t});\n\t\ttry {\n\t\t\tawait vault.materializeEnv(input.profile, target.destination, {\n\t\t\t\tallowReplaceUnmanaged: destinationState === \"unmanaged\",\n\t\t\t\texpectedUnmanagedContent: originalUnmanagedContent,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof SecretVaultError ? error.message : \"Dotenv materialization failed safely.\";\n\t\t\tctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, \"warning\");\n\t\t\treturn result(\n\t\t\t\t{\n\t\t\t\t\taction: input.action,\n\t\t\t\t\tstatus: \"stored\",\n\t\t\t\t\tprofile: input.profile,\n\t\t\t\t\tenvFile: target.envFile,\n\t\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\t\tmaterialized: false,\n\t\t\t\t\tcode: \"materialization_failed\",\n\t\t\t\t\tmessage,\n\t\t\t\t},\n\t\t\t\t`Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`,\n\t\t\t);\n\t\t}\n\t\tctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"stored\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tenvFile: target.envFile,\n\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t} finally {\n\t\tdocument = \"\";\n\t\toriginalUnmanagedContent = undefined;\n\t}\n}\n\nasync function executeMaterialize(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput,\n\tctx: ExtensionContext,\n): Promise<SecretStoreResult> {\n\ttry {\n\t\tconst scope = input.scope ?? \"workspace\";\n\t\tconst binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);\n\t\tconst destination = scope === \"managed\" ? vault.getManagedEnvPath(binding.profile) : binding.destination;\n\t\tconst destinationState = await vault.inspectEnvDestination(destination, binding.profile);\n\t\tif (destinationState === \"unmanaged\" || destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The bound dotenv location is no longer safely managed. Use set to review it in the private editor.\",\n\t\t\t\tbinding.profile,\n\t\t\t);\n\t\t}\n\t\tconst materialized = await vault.materializeEnv(binding.profile, destination, {\n\t\t\tactivationWorkspace: ctx.cwd,\n\t\t\tmanaged: scope === \"managed\",\n\t\t});\n\t\tctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"materialized\",\n\t\t\t\tprofile: binding.profile,\n\t\t\t\tvariableNames: materialized.variableNames,\n\t\t\t\tscope,\n\t\t\t\tenvFile: scope === \"workspace\" ? binding.envFile : undefined,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nasync function executeRemove(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tconst target = input.variableNames?.length\n\t\t? `${input.variableNames.join(\", \")} from profile ${input.profile}`\n\t\t: `the entire profile ${input.profile}`;\n\tconst approved = await ctx.ui.confirm(\n\t\t\"Remove stored secrets\",\n\t\t`Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`,\n\t\t{ signal },\n\t);\n\tif (!approved || signal?.aborted) return cancelled(input.action, input.profile);\n\ttry {\n\t\tconst removal = await vault.removeProfile(input.profile, input.variableNames);\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"removed\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tvariableNames: removal.removedVariableNames,\n\t\t\t},\n\t\t\t`Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? \"\" : \"s\"} from profile ${input.profile}.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nexport function createSecretStoreToolDefinition(options: SecretStoreToolOptions) {\n\tconst vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);\n\tif (!vault) throw new Error(\"secret_store requires an agentDir or SecretVault\");\n\treturn defineTool<typeof secretStoreSchema, SecretStoreToolDetails>({\n\t\tname: \"secret_store\",\n\t\tlabel: \"Secret Store\",\n\t\tdescription:\n\t\t\t\"Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.\",\n\t\tpromptSnippet:\n\t\t\t\"Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.\",\n\t\t\t\"Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.\",\n\t\t\t\"Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.\",\n\t\t\t\"After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.\",\n\t\t\t\"Treat cancellation as owner intent. Do not immediately repeat the same credential request.\",\n\t\t],\n\t\tparameters: secretStoreSchema,\n\t\texecutionMode: \"sequential\",\n\t\trenderShell: \"self\",\n\t\trenderCall() {\n\t\t\treturn emptyOrchestrationCall();\n\t\t},\n\t\trenderResult(toolResult, { expanded, isPartial }, theme: Theme) {\n\t\t\tif (isPartial) {\n\t\t\t\treturn new OrchestrationPanelComponent(theme, {\n\t\t\t\t\tlabel: \"secrets\",\n\t\t\t\t\taction: \"waiting for you\",\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);\n\t\t},\n\t\tasync execute(_toolCallId, input, signal, _onUpdate, ctx) {\n\t\t\tif (!ctx.hasUI || ctx.mode !== \"tui\") {\n\t\t\t\treturn result(\n\t\t\t\t\t{\n\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\tstatus: \"unavailable\",\n\t\t\t\t\t\t...(input.profile ? { profile: input.profile } : {}),\n\t\t\t\t\t\tcode: \"user_tui_required\",\n\t\t\t\t\t\tmessage: \"Secret values can be captured only in a user-visible TUI session.\",\n\t\t\t\t\t},\n\t\t\t\t\t\"secret_store requires a user-visible TUI session.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (signal?.aborted) return cancelled(input.action, input.profile);\n\t\t\tconst validation = validateInput(input);\n\t\t\tif (validation) return validation;\n\t\t\tif (input.action === \"lock\") {\n\t\t\t\tvault.lock();\n\t\t\t\treturn result(\n\t\t\t\t\t{ action: input.action, status: \"locked\" },\n\t\t\t\t\t\"Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);\n\t\t\t\tif (unlockResult) return unlockResult;\n\t\t\t\tif (input.action === \"list\") {\n\t\t\t\t\tconst profiles = await vault.listProfiles();\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"listed\", profiles },\n\t\t\t\t\t\t`Secret vault contains ${profiles.length} profile${profiles.length === 1 ? \"\" : \"s\"}. Only names, variable names, and workspace bindings were returned.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"set\" && input.profile) {\n\t\t\t\t\treturn executeSet(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"materialize\") return executeMaterialize(vault, input, ctx);\n\t\t\t\tif (!input.profile) return invalid(input.action, \"profile_required\", \"A profile is required.\");\n\t\t\t\treturn executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t} catch (error) {\n\t\t\t\treturn failed(input.action, error, input.profile);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAElG,OAAO,EAAE,UAAU,EAAyB,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EACN,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAE5B,WAAW,EACX,gBAAgB,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,sBAAsB,EACtB,2BAA2B,GAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CACpC;IACC,MAAM,EAAE,IAAI,CAAC,KAAK,CACjB;QACC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,EACD,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAChD;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,2BAA2B;QACtC,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,+DAA+D;KAC5E,CAAC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,4BAA4B;QACvC,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,iCAAiC;KAC9C,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,WAAW,EACV,yHAAyH;KAC1H,CAAC,CACF;IACD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CACT,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,8BAA8B;QACzC,OAAO,EAAE,4BAA4B;KACrC,CAAC,EACF;QACC,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,yBAAyB;QACnC,WAAW,EAAE,sEAAsE;KACnF,CACD,CACD;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE;QAChE,WAAW,EACV,kHAAkH;KACnH,CAAC,CACF;CACD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAqCF,SAAS,MAAM,CAAC,OAA+B,EAAE,IAAY;IAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,MAAsC,EAAE,OAAgB;IAC1E,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EACzF,iDAAiD,CACjD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAsC,EAAE,KAAc,EAAE,OAAgB;IACvF,MAAM,IAAI,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD,CAAC;IAC3G,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,wBAAwB,OAAO,EAAE,CACjC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACf,MAAsC,EACtC,IAAY,EACZ,OAAe,EACf,OAAgB;IAEhB,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,oCAAoC,OAAO,EAAE,CAC7C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C,EAAE,QAAiB;IACjF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,sCAAsC,EAAE,CAAC;IAC9G,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,QAAQ;QACpB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,MAAe;YACvB,KAAK,EAAE,OAAO,CAAC,OAAO;YACtB,IAAI,EAAE;gBACL,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC1F,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;aAC/E;YACD,OAAO,EAAE;gBACR,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;aACjF;SACD,CAAC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QAClF,OAAO,EAAE;YACR,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,aAAa;gBACpB,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC5F,CAAC,CAAC,SAAS;YACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC9G,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACzD,IAAI;QACJ,OAAO,EACN,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1G,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,KAAkB,EAClB,MAAsC,EACtC,GAAqB,EACrB,MAA+B,EAC/B,OAAgB;IAEhB,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,mBAAmB,EAAE;gBAC/E,MAAM;gBACN,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnF,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,SAAS,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACtC,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACV,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnF,IAAI,YAAY,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,EAAE;YACzF,MAAM;YACN,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACnD,UAAU,GAAG,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBACjC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;gBACnE,SAAS;YACV,CAAC;YACD,MAAM,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC9E,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtC,SAAS;YACV,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;YAChB,YAAY,GAAG,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,KAA2B;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxD,IACC,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,WAAW,KAAK,SAAS;YAC/B,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,aAAa,KAAK,SAAS;YACjC,KAAK,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACF,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,KAAK,CAAC,MAAM,kCAAkC,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,iDAAiD,EACjD,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,yCAAyC,EACzC,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,sCAAsC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC7F,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B;IAE/B,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CACzB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAClC,IAAI,wBAAwB,CAC3B,GAAG,EACH,WAAW,EACX,KAAK,EACL,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EACtB,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EACrB;YACC,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,KAAK;YAC1B,MAAM;YACN,MAAM,EAAE,+EAA+E;SACvF,CACD,CACF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B;IAE/B,IAAI,KAAK,GAAG,OAAO,CAAC;IACpB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;YAC/G,KAAK,GAAG,MAAM,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B;IAE/B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,wBAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC1C,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,qEAAqE,EACrE,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,cAAc,IAAI,EAAE,CAAC;QACnC,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,wBAAwB,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3E,OAAO,GAAG,wBAAwB,CAAC;QACpC,CAAC;QACD,IAAI,gBAAgB,KAAK,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,iBAAiB,EACjB,8EAA8E,EAC9E,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACxC,GAAG,EACH,aAAa,KAAK,CAAC,OAAO,QAAQ,MAAM,CAAC,WAAW,EAAE,EACtD,OAAO,EACP,MAAM,CACN,CAAC;QACF,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,MAAM,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE;YAC9E,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACJ,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC7D,qBAAqB,EAAE,gBAAgB,KAAK,WAAW;gBACvD,wBAAwB,EAAE,wBAAwB;aAClD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC5G,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,MAAM,CAAC,WAAW,uBAAuB,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;YACpG,OAAO,MAAM,CACZ;gBACC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,YAAY,EAAE,KAAK;gBACnB,IAAI,EAAE,wBAAwB;gBAC9B,OAAO;aACP,EACD,kBAAkB,KAAK,CAAC,OAAO,wGAAwG,CACvI,CAAC;QACH,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,KAAK,CAAC,OAAO,4BAA4B,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3G,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,IAAI;SAClB,EACD,wBAAwB,QAAQ,CAAC,aAAa,CAAC,MAAM,0BAA0B,KAAK,CAAC,OAAO,8EAA8E,CAC1K,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACV,QAAQ,GAAG,EAAE,CAAC;QACd,wBAAwB,GAAG,SAAS,CAAC;IACtC,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,KAAkB,EAClB,KAA2B,EAC3B,GAAqB;IAErB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACzG,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,gBAAgB,KAAK,WAAW,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC9E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,oGAAoG,EACpG,OAAO,CAAC,OAAO,CACf,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE;YAC7E,mBAAmB,EAAE,GAAG,CAAC,GAAG;YAC5B,OAAO,EAAE,KAAK,KAAK,SAAS;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,OAAO,CAAC,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3F,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,KAAK;YACL,OAAO,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC5D,YAAY,EAAE,IAAI;SAClB,EACD,qBAAqB,OAAO,CAAC,OAAO,oHAAoH,CACxJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AACF,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B;IAE/B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,MAAM;QACzC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE;QACnE,CAAC,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CACpC,uBAAuB,EACvB,UAAU,MAAM,mEAAmE,EACnF,EAAE,MAAM,EAAE,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,OAAO,CAAC,oBAAoB;SAC3C,EACD,WAAW,OAAO,CAAC,oBAAoB,CAAC,MAAM,mBAAmB,OAAO,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC,OAAO,GAAG,CACtJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAA+B;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChF,OAAO,UAAU,CAAmD;QACnE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACV,kMAAkM;QACnM,aAAa,EACZ,0LAA0L;QAC3L,gBAAgB,EAAE;YACjB,uIAAuI;YACvI,8KAA8K;YAC9K,4LAA4L;YAC5L,+JAA+J;YAC/J,4FAA4F;SAC5F;QACD,UAAU,EAAE,iBAAiB;QAC7B,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,MAAM;QACnB,UAAU;YACT,OAAO,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,YAAY,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAY;YAC7D,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE;oBAC7C,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,iBAAiB;oBACzB,MAAM,EAAE,SAAS;iBACjB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnG,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG;YACvD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACtC,OAAO,MAAM,CACZ;oBACC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa;oBACrB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,mEAAmE;iBAC5E,EACD,mDAAmD,CACnD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAC1C,wGAAwG,CACxG,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3F,IAAI,YAAY;oBAAE,OAAO,YAAY,CAAC;gBACtC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC5C,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACpD,yBAAyB,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qEAAqE,CACxJ,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC7C,OAAO,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;oBAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;gBAC/F,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { type Static, Type } from \"typebox\";\nimport { ExtensionEditorComponent } from \"../../modes/interactive/components/extension-editor.ts\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport { defineTool, type ExtensionContext } from \"../extensions/types.ts\";\nimport { parseDotenvDocument, SecretDotenvError } from \"../secrets/secret-dotenv.ts\";\nimport {\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\ttype SecretProfileSummary,\n\tSecretVault,\n\tSecretVaultError,\n} from \"../secrets/secret-vault.ts\";\nimport {\n\temptyOrchestrationCall,\n\tOrchestrationPanelComponent,\n\ttype OrchestrationPanelModel,\n} from \"./orchestration-panel.ts\";\n\nconst secretStoreSchema = Type.Object(\n\t{\n\t\taction: Type.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"set\"),\n\t\t\t\tType.Literal(\"list\"),\n\t\t\t\tType.Literal(\"materialize\"),\n\t\t\t\tType.Literal(\"remove\"),\n\t\t\t\tType.Literal(\"lock\"),\n\t\t\t],\n\t\t\t{ description: \"Credential-management action.\" },\n\t\t),\n\t\tprofile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_PROFILE_ID_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PROFILE_ID_PATTERN,\n\t\t\t\tdescription: \"Portable profile identifier, such as project-dev or aws-work.\",\n\t\t\t}),\n\t\t),\n\t\tdescription: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_DESCRIPTION_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PRINTABLE_METADATA_PATTERN,\n\t\t\t\tdescription: \"Non-secret profile description.\",\n\t\t\t}),\n\t\t),\n\t\tenvFile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 512,\n\t\t\t\tdescription:\n\t\t\t\t\t\"Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.\",\n\t\t\t}),\n\t\t),\n\t\tvariableNames: Type.Optional(\n\t\t\tType.Array(\n\t\t\t\tType.String({\n\t\t\t\t\tminLength: 1,\n\t\t\t\t\tmaxLength: SECRET_VARIABLE_NAME_MAX_CHARS,\n\t\t\t\t\tpattern: SECRET_VARIABLE_NAME_PATTERN,\n\t\t\t\t}),\n\t\t\t\t{\n\t\t\t\t\tminItems: 1,\n\t\t\t\t\tmaxItems: MAX_VARIABLES_PER_PROFILE,\n\t\t\t\t\tdescription: \"Specific variable names to remove. Omit to remove the whole profile.\",\n\t\t\t\t},\n\t\t\t),\n\t\t),\n\t\tscope: Type.Optional(\n\t\t\tType.Union([Type.Literal(\"managed\"), Type.Literal(\"workspace\")], {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport type SecretStoreToolInput = Static<typeof secretStoreSchema>;\n\nexport type SecretStoreStatus =\n\t| \"cancelled\"\n\t| \"error\"\n\t| \"listed\"\n\t| \"locked\"\n\t| \"materialized\"\n\t| \"removed\"\n\t| \"stored\"\n\t| \"unavailable\";\n\nexport interface SecretStoreToolDetails {\n\taction: SecretStoreToolInput[\"action\"];\n\tstatus: SecretStoreStatus;\n\tprofile?: string;\n\tvariableNames?: string[];\n\tprofiles?: SecretProfileSummary[];\n\tscope?: \"managed\" | \"workspace\";\n\tenvFile?: string;\n\tmaterialized?: boolean;\n\tcode?: string;\n\tmessage?: string;\n}\n\nexport interface SecretStoreToolOptions {\n\tagentDir?: string;\n\tvault?: SecretVault;\n}\n\ntype SecretStoreResult = {\n\tcontent: Array<{ type: \"text\"; text: string }>;\n\tdetails: SecretStoreToolDetails;\n};\n\nfunction result(details: SecretStoreToolDetails, text: string): SecretStoreResult {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nfunction cancelled(action: SecretStoreToolInput[\"action\"], profile?: string): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"cancelled\", ...(profile ? { profile } : {}), code: \"owner_cancelled\" },\n\t\t\"Secret store action was cancelled by the owner.\",\n\t);\n}\n\nfunction failed(action: SecretStoreToolInput[\"action\"], error: unknown, profile?: string): SecretStoreResult {\n\tconst code = error instanceof SecretVaultError ? error.code : \"safe_failure\";\n\tconst message =\n\t\terror instanceof SecretVaultError ? error.message : \"Secret store failed safely without exposing values.\";\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store failed: ${message}`,\n\t);\n}\n\nfunction invalid(\n\taction: SecretStoreToolInput[\"action\"],\n\tcode: string,\n\tmessage: string,\n\tprofile?: string,\n): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store request is invalid: ${message}`,\n\t);\n}\n\nfunction panelModel(details: SecretStoreToolDetails | undefined, expanded: boolean): OrchestrationPanelModel {\n\tif (!details) return { label: \"secrets\", status: \"error\", emptyText: \"No secret-store result was retained.\" };\n\tconst success = [\"listed\", \"locked\", \"materialized\", \"removed\", \"stored\"].includes(details.status);\n\tconst rows = expanded\n\t\t? (details.profiles ?? []).map((profile) => ({\n\t\t\t\tstatus: \"info\" as const,\n\t\t\t\tlabel: profile.profile,\n\t\t\t\tmeta: [\n\t\t\t\t\t`${profile.variableNames.length} variable${profile.variableNames.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t\t`${profile.bindings.length} binding${profile.bindings.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t],\n\t\t\t\tdetails: [\n\t\t\t\t\t...(profile.description ? [profile.description] : []),\n\t\t\t\t\t...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),\n\t\t\t\t],\n\t\t\t}))\n\t\t: undefined;\n\treturn {\n\t\tlabel: \"secrets\",\n\t\taction: details.status,\n\t\tstatus: success ? \"success\" : details.status === \"cancelled\" ? \"warning\" : \"error\",\n\t\tsummary: [\n\t\t\tdetails.profile,\n\t\t\tdetails.envFile,\n\t\t\tdetails.scope,\n\t\t\tdetails.variableNames\n\t\t\t\t? `${details.variableNames.length} variable${details.variableNames.length === 1 ? \"\" : \"s\"}`\n\t\t\t\t: undefined,\n\t\t\tdetails.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? \"\" : \"s\"}` : undefined,\n\t\t].filter((value): value is string => value !== undefined),\n\t\trows,\n\t\tnotices:\n\t\t\texpanded && details.message ? [{ status: success ? \"info\" : \"error\", text: details.message }] : undefined,\n\t};\n}\n\nasync function ensureUnlocked(\n\tvault: SecretVault,\n\taction: SecretStoreToolInput[\"action\"],\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n\tprofile?: string,\n): Promise<SecretStoreResult | undefined> {\n\tif (vault.isUnlocked) return undefined;\n\tif (await vault.exists()) {\n\t\twhile (!signal?.aborted) {\n\t\t\tlet passphrase = await ctx.ui.input(\"Unlock secret vault\", \"Master passphrase\", {\n\t\t\t\tsignal,\n\t\t\t\tsensitive: true,\n\t\t\t});\n\t\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\t\ttry {\n\t\t\t\tawait vault.unlock(passphrase);\n\t\t\t\treturn undefined;\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof SecretVaultError && [\"invalid_passphrase\", \"unlock_failed\"].includes(error.code)) {\n\t\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn failed(action, error, profile);\n\t\t\t} finally {\n\t\t\t\tpassphrase = \"\";\n\t\t\t}\n\t\t}\n\t\treturn cancelled(action, profile);\n\t}\n\n\twhile (!signal?.aborted) {\n\t\tlet passphrase = await ctx.ui.input(\"Create secret vault\", \"New master passphrase\", { signal, sensitive: true });\n\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\tlet confirmation = await ctx.ui.input(\"Confirm secret vault\", \"Repeat master passphrase\", {\n\t\t\tsignal,\n\t\t\tsensitive: true,\n\t\t});\n\t\tif (confirmation === undefined || signal?.aborted) {\n\t\t\tpassphrase = \"\";\n\t\t\treturn cancelled(action, profile);\n\t\t}\n\t\ttry {\n\t\t\tif (passphrase !== confirmation) {\n\t\t\t\tctx.ui.notify(\"The two master passphrases do not match.\", \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait vault.initialize(passphrase);\n\t\t\treturn undefined;\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretVaultError && error.code === \"invalid_passphrase\") {\n\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn failed(action, error, profile);\n\t\t} finally {\n\t\t\tpassphrase = \"\";\n\t\t\tconfirmation = \"\";\n\t\t}\n\t}\n\treturn cancelled(action, profile);\n}\n\nfunction validateInput(input: SecretStoreToolInput): SecretStoreResult | undefined {\n\tif (input.action === \"lock\" || input.action === \"list\") {\n\t\tif (\n\t\t\tinput.profile !== undefined ||\n\t\t\tinput.description !== undefined ||\n\t\t\tinput.envFile !== undefined ||\n\t\t\tinput.variableNames !== undefined ||\n\t\t\tinput.scope !== undefined\n\t\t) {\n\t\t\treturn invalid(input.action, \"unexpected_fields\", `Action ${input.action} does not accept profile fields.`);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (input.action === \"set\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action set requires a profile.\");\n\t}\n\tif (input.action === \"remove\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action remove requires a profile.\");\n\t}\n\tif (input.action !== \"set\" && (input.description !== undefined || input.envFile !== undefined)) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_profile_fields\",\n\t\t\t\"description and envFile are valid only for set.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"remove\" && input.variableNames !== undefined) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_variable_names\",\n\t\t\t\"variableNames is valid only for remove.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"materialize\" && input.scope !== undefined) {\n\t\treturn invalid(input.action, \"unexpected_scope\", \"scope is valid only for materialize.\", input.profile);\n\t}\n\tif (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {\n\t\treturn invalid(input.action, \"duplicate_variables\", \"Variable names must be unique.\", input.profile);\n\t}\n\treturn undefined;\n}\n\nasync function openPrivateDotenvEditor(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<string | undefined> {\n\tif (signal?.aborted) return undefined;\n\ttry {\n\t\treturn await ctx.ui.custom<string | undefined>(\n\t\t\t(tui, _theme, keybindings, done) =>\n\t\t\t\tnew ExtensionEditorComponent(\n\t\t\t\t\ttui,\n\t\t\t\t\tkeybindings,\n\t\t\t\t\ttitle,\n\t\t\t\t\tprefill,\n\t\t\t\t\t(value) => done(value),\n\t\t\t\t\t() => done(undefined),\n\t\t\t\t\t{\n\t\t\t\t\t\tprivateContent: true,\n\t\t\t\t\t\tallowExternalEditor: false,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\tnotice: \"Private plaintext editor · content stays local and never enters model context\",\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tif (signal?.aborted) return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function captureValidDotenv(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<{ document: string; variableNames: string[] } | undefined> {\n\tlet draft = prefill;\n\twhile (!signal?.aborted) {\n\t\tconst edited = await openPrivateDotenvEditor(ctx, title, draft, signal);\n\t\tif (edited === undefined || signal?.aborted) return undefined;\n\t\ttry {\n\t\t\tconst parsed = parseDotenvDocument(edited);\n\t\t\tconst variableNames = parsed.variables.map((variable) => variable.name);\n\t\t\tfor (const variable of parsed.variables) variable.value = \"\";\n\t\t\tdraft = \"\";\n\t\t\treturn { document: parsed.document, variableNames };\n\t\t} catch (error) {\n\t\t\tctx.ui.notify(error instanceof SecretDotenvError ? error.message : \"The dotenv document is invalid.\", \"error\");\n\t\t\tdraft = edited;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nasync function executeSet(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tlet document = \"\";\n\tlet originalUnmanagedContent: string | undefined;\n\ttry {\n\t\tconst target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? \".env\");\n\t\tconst destinationState = await vault.inspectEnvDestination(target.destination, input.profile);\n\t\tif (destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The selected dotenv location is already managed by another profile.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\t\tconst storedDocument = await vault.getProfileDocument(input.profile);\n\t\tlet prefill = storedDocument ?? \"\";\n\t\tif (destinationState === \"unmanaged\") {\n\t\t\toriginalUnmanagedContent = await vault.readOwnerDotenv(target.destination);\n\t\t\tprefill = originalUnmanagedContent;\n\t\t}\n\t\tif (destinationState === \"managed-profile\" && storedDocument === undefined) {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"profile_missing\",\n\t\t\t\t\"The dotenv target claims this profile, but the encrypted profile is missing.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\n\t\tconst captured = await captureValidDotenv(\n\t\t\tctx,\n\t\t\t`Secrets · ${input.profile}  →  ${target.destination}`,\n\t\t\tprefill,\n\t\t\tsignal,\n\t\t);\n\t\tprefill = \"\";\n\t\tif (!captured) return cancelled(input.action, input.profile);\n\t\tdocument = captured.document;\n\t\tawait vault.replaceProfileDocument(input.profile, input.description, document, {\n\t\t\tworkspace: target.workspace,\n\t\t\tenvFile: target.envFile,\n\t\t});\n\t\ttry {\n\t\t\tawait vault.materializeEnv(input.profile, target.destination, {\n\t\t\t\tallowReplaceUnmanaged: destinationState === \"unmanaged\",\n\t\t\t\texpectedUnmanagedContent: originalUnmanagedContent,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof SecretVaultError ? error.message : \"Dotenv materialization failed safely.\";\n\t\t\tctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, \"warning\");\n\t\t\treturn result(\n\t\t\t\t{\n\t\t\t\t\taction: input.action,\n\t\t\t\t\tstatus: \"stored\",\n\t\t\t\t\tprofile: input.profile,\n\t\t\t\t\tenvFile: target.envFile,\n\t\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\t\tmaterialized: false,\n\t\t\t\t\tcode: \"materialization_failed\",\n\t\t\t\t\tmessage,\n\t\t\t\t},\n\t\t\t\t`Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`,\n\t\t\t);\n\t\t}\n\t\tctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"stored\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tenvFile: target.envFile,\n\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t} finally {\n\t\tdocument = \"\";\n\t\toriginalUnmanagedContent = undefined;\n\t}\n}\n\nasync function executeMaterialize(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput,\n\tctx: ExtensionContext,\n): Promise<SecretStoreResult> {\n\ttry {\n\t\tconst scope = input.scope ?? \"workspace\";\n\t\tconst binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);\n\t\tconst destination = scope === \"managed\" ? vault.getManagedEnvPath(binding.profile) : binding.destination;\n\t\tconst destinationState = await vault.inspectEnvDestination(destination, binding.profile);\n\t\tif (destinationState === \"unmanaged\" || destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The bound dotenv location is no longer safely managed. Use set to review it in the private editor.\",\n\t\t\t\tbinding.profile,\n\t\t\t);\n\t\t}\n\t\tconst materialized = await vault.materializeEnv(binding.profile, destination, {\n\t\t\tactivationWorkspace: ctx.cwd,\n\t\t\tmanaged: scope === \"managed\",\n\t\t});\n\t\tctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"materialized\",\n\t\t\t\tprofile: binding.profile,\n\t\t\t\tvariableNames: materialized.variableNames,\n\t\t\t\tscope,\n\t\t\t\tenvFile: scope === \"workspace\" ? binding.envFile : undefined,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nasync function executeRemove(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tconst target = input.variableNames?.length\n\t\t? `${input.variableNames.join(\", \")} from profile ${input.profile}`\n\t\t: `the entire profile ${input.profile}`;\n\tconst approved = await ctx.ui.confirm(\n\t\t\"Remove stored secrets\",\n\t\t`Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`,\n\t\t{ signal },\n\t);\n\tif (!approved || signal?.aborted) return cancelled(input.action, input.profile);\n\ttry {\n\t\tconst removal = await vault.removeProfile(input.profile, input.variableNames);\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"removed\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tvariableNames: removal.removedVariableNames,\n\t\t\t},\n\t\t\t`Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? \"\" : \"s\"} from profile ${input.profile}.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nexport function createSecretStoreToolDefinition(options: SecretStoreToolOptions) {\n\tconst vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);\n\tif (!vault) throw new Error(\"secret_store requires an agentDir or SecretVault\");\n\treturn defineTool<typeof secretStoreSchema, SecretStoreToolDetails>({\n\t\tname: \"secret_store\",\n\t\tlabel: \"Secret Store\",\n\t\tdescription:\n\t\t\t\"Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.\",\n\t\tpromptSnippet:\n\t\t\t\"Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.\",\n\t\t\t\"Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.\",\n\t\t\t\"Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.\",\n\t\t\t\"After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.\",\n\t\t\t\"Treat cancellation as owner intent. Do not immediately repeat the same credential request.\",\n\t\t],\n\t\tparameters: secretStoreSchema,\n\t\texecutionMode: \"sequential\",\n\t\trenderShell: \"self\",\n\t\trenderCall() {\n\t\t\treturn emptyOrchestrationCall();\n\t\t},\n\t\trenderResult(toolResult, { expanded, isPartial }, theme: Theme) {\n\t\t\tif (isPartial) {\n\t\t\t\treturn new OrchestrationPanelComponent(theme, {\n\t\t\t\t\tlabel: \"secrets\",\n\t\t\t\t\taction: \"waiting for you\",\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);\n\t\t},\n\t\tasync execute(_toolCallId, input, signal, _onUpdate, ctx) {\n\t\t\tif (!ctx.hasUI || ctx.mode !== \"tui\") {\n\t\t\t\treturn result(\n\t\t\t\t\t{\n\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\tstatus: \"unavailable\",\n\t\t\t\t\t\t...(input.profile ? { profile: input.profile } : {}),\n\t\t\t\t\t\tcode: \"user_tui_required\",\n\t\t\t\t\t\tmessage: \"Secret values can be captured only in a user-visible TUI session.\",\n\t\t\t\t\t},\n\t\t\t\t\t\"secret_store requires a user-visible TUI session.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (signal?.aborted) return cancelled(input.action, input.profile);\n\t\t\tconst validation = validateInput(input);\n\t\t\tif (validation) return validation;\n\t\t\tif (input.action === \"lock\") {\n\t\t\t\tvault.lock();\n\t\t\t\treturn result(\n\t\t\t\t\t{ action: input.action, status: \"locked\" },\n\t\t\t\t\t\"Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);\n\t\t\t\tif (unlockResult) return unlockResult;\n\t\t\t\tif (input.action === \"list\") {\n\t\t\t\t\tconst profiles = await vault.listProfiles();\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"listed\", profiles },\n\t\t\t\t\t\t`Secret vault contains ${profiles.length} profile${profiles.length === 1 ? \"\" : \"s\"}. Only names, variable names, and workspace bindings were returned.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"set\" && input.profile) {\n\t\t\t\t\treturn executeSet(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"materialize\") return executeMaterialize(vault, input, ctx);\n\t\t\t\tif (!input.profile) return invalid(input.action, \"profile_required\", \"A profile is required.\");\n\t\t\t\treturn executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t} catch (error) {\n\t\t\t\treturn failed(input.action, error, input.profile);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}

package/dist/core/tools/shell-command-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-command-parser.d.ts","sourceRoot":"","sources":["../../../src/core/tools/shell-command-parser.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;AAEtE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACd;AA0FD,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAEhE;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAEzE;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgB1E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D","sourcesContent":["export type ShellTokenKind = \"arg\" | \"operator\" | \"pipe\" | \"redirect\";\n\nexport interface ShellToken {\n\tkind: ShellTokenKind;\n\tvalue: string;\n}\n\ninterface TokenizeOptions {\n\toperators: boolean;\n}\n\nfunction pushArgument(tokens: ShellToken[], current: string): string {\n\tif (current.length > 0) tokens.push({ kind: \"arg\", value: current });\n\treturn \"\";\n}\n\nfunction tokenize(input: string, options: TokenizeOptions): ShellToken[] | null {\n\tconst tokens: ShellToken[] = [];\n\tlet current = \"\";\n\tlet quote: \"'\" | '\"' | undefined;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < input.length; index++) {\n\t\tconst char = input[index];\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (char === quote) quote = undefined;\n\t\t\telse current += char;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \"|\" || char === \"&\" || char === \";\" || char === \"\\n\" || char === \"\\r\")) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tif (char === \"|\" && input[index + 1] === \"&\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: \"|&\" });\n\t\t\t\tindex++;\n\t\t\t} else if ((char === \"|\" || char === \"&\") && input[index + 1] === char) {\n\t\t\t\ttokens.push({ kind: \"operator\", value: `${char}${char}` });\n\t\t\t\tindex++;\n\t\t\t} else if (char === \"|\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: char });\n\t\t\t} else {\n\t\t\t\ttokens.push({ kind: \"operator\", value: char });\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \">\" || char === \"<\")) {\n\t\t\tlet fileDescriptor = \"\";\n\t\t\tif (char === \">\" && /^\\d+$/u.test(current)) {\n\t\t\t\tfileDescriptor = current;\n\t\t\t\tcurrent = \"\";\n\t\t\t} else {\n\t\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\t}\n\t\t\tlet value = `${fileDescriptor}${char}`;\n\t\t\tif (input[index + 1] === char) {\n\t\t\t\tvalue += char;\n\t\t\t\tindex++;\n\t\t\t}\n\t\t\tif (input[index + 1] === \"&\") {\n\t\t\t\tvalue += \"&\";\n\t\t\t\tindex++;\n\t\t\t\twhile (index + 1 < input.length && /[\\d-]/u.test(input[index + 1])) {\n\t\t\t\t\tvalue += input[++index];\n\t\t\t\t}\n\t\t\t}\n\t\t\ttokens.push({ kind: \"redirect\", value });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (/\\s/u.test(char)) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += char;\n\t}\n\n\tif (quote || escaped) return null;\n\tpushArgument(tokens, current);\n\treturn tokens;\n}\n\n/** Tokenize one simple command while preserving the pre-existing quote/escape contract. */\nexport function tokenizeCommand(command: string): string[] | null {\n\treturn tokenize(command, { operators: false })?.map((token) => token.value) ?? null;\n}\n\n/** Tokenize a shell command and expose quote-aware command boundaries and redirects. */\nexport function tokenizeShellCommand(command: string): ShellToken[] | null {\n\treturn tokenize(command, { operators: true });\n}\n\nexport interface ParsedCommand {\n\tenvVars: Record<string, string>;\n\tcoreCommandTokens: string[];\n}\n\nexport function parseCommandPrefixes(command: string): ParsedCommand | null {\n\tconst tokens = tokenizeCommand(command);\n\tif (!tokens || tokens.length === 0) return null;\n\n\tconst envVars: Record<string, string> = {};\n\tlet index = 0;\n\tconst envPattern = /^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/u;\n\n\twhile (index < tokens.length) {\n\t\tconst match = tokens[index].match(envPattern);\n\t\tif (!match) break;\n\t\tenvVars[match[1]] = match[2];\n\t\tindex++;\n\t}\n\n\treturn { envVars, coreCommandTokens: tokens.slice(index) };\n}\n\nexport function isComplexShellCommand(command: string): boolean {\n\treturn /[|><&;\\n\\r$`()*?[\\]#]/u.test(command);\n}\n"]}
+{"version":3,"file":"shell-command-parser.d.ts","sourceRoot":"","sources":["../../../src/core/tools/shell-command-parser.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;AAEtE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACd;AA0FD,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAEhE;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAEzE;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgB1E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D"}

package/dist/core/tools/shell-command-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-command-parser.js","sourceRoot":"","sources":["../../../src/core/tools/shell-command-parser.ts"],"names":[],"mappings":"AAWA,SAAS,YAAY,CAAC,MAAoB,EAAE,OAAe,EAAU;IACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,CAAC;AAAA,CACV;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAwB,EAAuB;IAC/E,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,IAAI,CAAC;YAChB,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;;gBACjC,OAAO,IAAI,IAAI,CAAC;YACrB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3G,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3C,KAAK,EAAE,CAAC;YACT,CAAC;iBAAM,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC3D,KAAK,EAAE,CAAC;YACT,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,cAAc,GAAG,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,cAAc,GAAG,OAAO,CAAC;gBACzB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;iBAAM,CAAC;gBACP,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,KAAK,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/B,KAAK,IAAI,IAAI,CAAC;gBACd,KAAK,EAAE,CAAC;YACT,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9B,KAAK,IAAI,GAAG,CAAC;gBACb,KAAK,EAAE,CAAC;gBACR,OAAO,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpE,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;gBACzB,CAAC;YACF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YACzC,SAAS;QACV,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,SAAS;QACV,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAAA,CACd;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,OAAe,EAAmB;IACjE,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAAA,CACpF;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAuB;IAC1E,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAAA,CAC9C;AAOD,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAwB;IAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,kCAAkC,CAAC;IAEtD,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,KAAK,EAAE,CAAC;IACT,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAAA,CAC3D;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAW;IAC/D,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAAA,CAC9C","sourcesContent":["export type ShellTokenKind = \"arg\" | \"operator\" | \"pipe\" | \"redirect\";\n\nexport interface ShellToken {\n\tkind: ShellTokenKind;\n\tvalue: string;\n}\n\ninterface TokenizeOptions {\n\toperators: boolean;\n}\n\nfunction pushArgument(tokens: ShellToken[], current: string): string {\n\tif (current.length > 0) tokens.push({ kind: \"arg\", value: current });\n\treturn \"\";\n}\n\nfunction tokenize(input: string, options: TokenizeOptions): ShellToken[] | null {\n\tconst tokens: ShellToken[] = [];\n\tlet current = \"\";\n\tlet quote: \"'\" | '\"' | undefined;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < input.length; index++) {\n\t\tconst char = input[index];\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (char === quote) quote = undefined;\n\t\t\telse current += char;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \"|\" || char === \"&\" || char === \";\" || char === \"\\n\" || char === \"\\r\")) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tif (char === \"|\" && input[index + 1] === \"&\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: \"|&\" });\n\t\t\t\tindex++;\n\t\t\t} else if ((char === \"|\" || char === \"&\") && input[index + 1] === char) {\n\t\t\t\ttokens.push({ kind: \"operator\", value: `${char}${char}` });\n\t\t\t\tindex++;\n\t\t\t} else if (char === \"|\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: char });\n\t\t\t} else {\n\t\t\t\ttokens.push({ kind: \"operator\", value: char });\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \">\" || char === \"<\")) {\n\t\t\tlet fileDescriptor = \"\";\n\t\t\tif (char === \">\" && /^\\d+$/u.test(current)) {\n\t\t\t\tfileDescriptor = current;\n\t\t\t\tcurrent = \"\";\n\t\t\t} else {\n\t\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\t}\n\t\t\tlet value = `${fileDescriptor}${char}`;\n\t\t\tif (input[index + 1] === char) {\n\t\t\t\tvalue += char;\n\t\t\t\tindex++;\n\t\t\t}\n\t\t\tif (input[index + 1] === \"&\") {\n\t\t\t\tvalue += \"&\";\n\t\t\t\tindex++;\n\t\t\t\twhile (index + 1 < input.length && /[\\d-]/u.test(input[index + 1])) {\n\t\t\t\t\tvalue += input[++index];\n\t\t\t\t}\n\t\t\t}\n\t\t\ttokens.push({ kind: \"redirect\", value });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (/\\s/u.test(char)) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += char;\n\t}\n\n\tif (quote || escaped) return null;\n\tpushArgument(tokens, current);\n\treturn tokens;\n}\n\n/** Tokenize one simple command while preserving the pre-existing quote/escape contract. */\nexport function tokenizeCommand(command: string): string[] | null {\n\treturn tokenize(command, { operators: false })?.map((token) => token.value) ?? null;\n}\n\n/** Tokenize a shell command and expose quote-aware command boundaries and redirects. */\nexport function tokenizeShellCommand(command: string): ShellToken[] | null {\n\treturn tokenize(command, { operators: true });\n}\n\nexport interface ParsedCommand {\n\tenvVars: Record<string, string>;\n\tcoreCommandTokens: string[];\n}\n\nexport function parseCommandPrefixes(command: string): ParsedCommand | null {\n\tconst tokens = tokenizeCommand(command);\n\tif (!tokens || tokens.length === 0) return null;\n\n\tconst envVars: Record<string, string> = {};\n\tlet index = 0;\n\tconst envPattern = /^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/u;\n\n\twhile (index < tokens.length) {\n\t\tconst match = tokens[index].match(envPattern);\n\t\tif (!match) break;\n\t\tenvVars[match[1]] = match[2];\n\t\tindex++;\n\t}\n\n\treturn { envVars, coreCommandTokens: tokens.slice(index) };\n}\n\nexport function isComplexShellCommand(command: string): boolean {\n\treturn /[|><&;\\n\\r$`()*?[\\]#]/u.test(command);\n}\n"]}
+{"version":3,"file":"shell-command-parser.js","sourceRoot":"","sources":["../../../src/core/tools/shell-command-parser.ts"],"names":[],"mappings":"AAWA,SAAS,YAAY,CAAC,MAAoB,EAAE,OAAe;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAwB;IACxD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,KAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,IAAI,CAAC;YAChB,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,IAAI,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;;gBACjC,OAAO,IAAI,IAAI,CAAC;YACrB,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACV,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3G,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3C,KAAK,EAAE,CAAC;YACT,CAAC;iBAAM,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC3D,KAAK,EAAE,CAAC;YACT,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,SAAS;QACV,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,cAAc,GAAG,EAAE,CAAC;YACxB,IAAI,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,cAAc,GAAG,OAAO,CAAC;gBACzB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;iBAAM,CAAC;gBACP,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,KAAK,GAAG,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/B,KAAK,IAAI,IAAI,CAAC;gBACd,KAAK,EAAE,CAAC;YACT,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9B,KAAK,IAAI,GAAG,CAAC;gBACb,KAAK,EAAE,CAAC;gBACR,OAAO,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpE,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;gBACzB,CAAC;YACF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YACzC,SAAS;QACV,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,SAAS;QACV,CAAC;QACD,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,KAAK,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AACf,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,OAAe;IAC9C,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AACrF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,OAAe;IACnD,OAAO,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/C,CAAC;AAOD,MAAM,UAAU,oBAAoB,CAAC,OAAe;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,UAAU,GAAG,kCAAkC,CAAC;IAEtD,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM;QAClB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,KAAK,EAAE,CAAC;IACT,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["export type ShellTokenKind = \"arg\" | \"operator\" | \"pipe\" | \"redirect\";\n\nexport interface ShellToken {\n\tkind: ShellTokenKind;\n\tvalue: string;\n}\n\ninterface TokenizeOptions {\n\toperators: boolean;\n}\n\nfunction pushArgument(tokens: ShellToken[], current: string): string {\n\tif (current.length > 0) tokens.push({ kind: \"arg\", value: current });\n\treturn \"\";\n}\n\nfunction tokenize(input: string, options: TokenizeOptions): ShellToken[] | null {\n\tconst tokens: ShellToken[] = [];\n\tlet current = \"\";\n\tlet quote: \"'\" | '\"' | undefined;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < input.length; index++) {\n\t\tconst char = input[index];\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (char === quote) quote = undefined;\n\t\t\telse current += char;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \"|\" || char === \"&\" || char === \";\" || char === \"\\n\" || char === \"\\r\")) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tif (char === \"|\" && input[index + 1] === \"&\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: \"|&\" });\n\t\t\t\tindex++;\n\t\t\t} else if ((char === \"|\" || char === \"&\") && input[index + 1] === char) {\n\t\t\t\ttokens.push({ kind: \"operator\", value: `${char}${char}` });\n\t\t\t\tindex++;\n\t\t\t} else if (char === \"|\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: char });\n\t\t\t} else {\n\t\t\t\ttokens.push({ kind: \"operator\", value: char });\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \">\" || char === \"<\")) {\n\t\t\tlet fileDescriptor = \"\";\n\t\t\tif (char === \">\" && /^\\d+$/u.test(current)) {\n\t\t\t\tfileDescriptor = current;\n\t\t\t\tcurrent = \"\";\n\t\t\t} else {\n\t\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\t}\n\t\t\tlet value = `${fileDescriptor}${char}`;\n\t\t\tif (input[index + 1] === char) {\n\t\t\t\tvalue += char;\n\t\t\t\tindex++;\n\t\t\t}\n\t\t\tif (input[index + 1] === \"&\") {\n\t\t\t\tvalue += \"&\";\n\t\t\t\tindex++;\n\t\t\t\twhile (index + 1 < input.length && /[\\d-]/u.test(input[index + 1])) {\n\t\t\t\t\tvalue += input[++index];\n\t\t\t\t}\n\t\t\t}\n\t\t\ttokens.push({ kind: \"redirect\", value });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (/\\s/u.test(char)) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += char;\n\t}\n\n\tif (quote || escaped) return null;\n\tpushArgument(tokens, current);\n\treturn tokens;\n}\n\n/** Tokenize one simple command while preserving the pre-existing quote/escape contract. */\nexport function tokenizeCommand(command: string): string[] | null {\n\treturn tokenize(command, { operators: false })?.map((token) => token.value) ?? null;\n}\n\n/** Tokenize a shell command and expose quote-aware command boundaries and redirects. */\nexport function tokenizeShellCommand(command: string): ShellToken[] | null {\n\treturn tokenize(command, { operators: true });\n}\n\nexport interface ParsedCommand {\n\tenvVars: Record<string, string>;\n\tcoreCommandTokens: string[];\n}\n\nexport function parseCommandPrefixes(command: string): ParsedCommand | null {\n\tconst tokens = tokenizeCommand(command);\n\tif (!tokens || tokens.length === 0) return null;\n\n\tconst envVars: Record<string, string> = {};\n\tlet index = 0;\n\tconst envPattern = /^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/u;\n\n\twhile (index < tokens.length) {\n\t\tconst match = tokens[index].match(envPattern);\n\t\tif (!match) break;\n\t\tenvVars[match[1]] = match[2];\n\t\tindex++;\n\t}\n\n\treturn { envVars, coreCommandTokens: tokens.slice(index) };\n}\n\nexport function isComplexShellCommand(command: string): boolean {\n\treturn /[|><&;\\n\\r$`()*?[\\]#]/u.test(command);\n}\n"]}

package/dist/core/tools/shell-contract-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-contract-router.d.ts","sourceRoot":"","sources":["../../../src/core/tools/shell-contract-router.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAC3B;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAuS1C,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,kBAAkB,CA8DpB","sourcesContent":["export type ShellContractRoute =\n\t| { kind: \"passthrough\"; command: string }\n\t| { kind: \"powershell\"; command: string; argv: readonly string[] }\n\t| { kind: \"python-engine\"; command: string }\n\t| { kind: \"unsupported\"; error: string };\n\nconst ENGINE_OWNED_BUILTINS = new Set([\"cd\", \"export\", \"unset\", \"exit\"]);\n\ninterface TokenizeResult {\n\tok: boolean;\n\targv?: string[];\n\terror?: string;\n}\n\nconst BLOCKED_NESTED_SHELLS = new Set([\n\t\"bash\",\n\t\"sh\",\n\t\"zsh\",\n\t\"fish\",\n\t\"cmd\",\n\t\"cmd.exe\",\n\t\"powershell\",\n\t\"powershell.exe\",\n\t\"pwsh\",\n\t\"pwsh.exe\",\n\t\"wsl\",\n\t\"wsl.exe\",\n]);\nconst UNSUPPORTED_OPERATOR_MESSAGE =\n\t\"Unsupported Bash construct on Windows. Use one simple command per call; pipelines, redirection, command substitution, variable expansion, shell chaining, and nested shells are not translated.\";\n\nfunction tokenizePortableCommand(command: string): TokenizeResult {\n\tconst argv: string[] = [];\n\tlet token = \"\";\n\tlet tokenStarted = false;\n\tlet quote: \"single\" | \"double\" | undefined;\n\tlet escaping = false;\n\n\tconst finishToken = () => {\n\t\tif (!tokenStarted) return;\n\t\targv.push(token);\n\t\ttoken = \"\";\n\t\ttokenStarted = false;\n\t};\n\n\tconst source = command.trim();\n\tfor (let index = 0; index < source.length; index++) {\n\t\tconst character = source[index];\n\t\tconst nextCharacter = source[index + 1];\n\t\tif (escaping) {\n\t\t\ttoken += character;\n\t\t\ttokenStarted = true;\n\t\t\tescaping = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"single\") {\n\t\t\tif (character === \"'\") quote = undefined;\n\t\t\telse token += character;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"double\") {\n\t\t\tif (character === '\"') {\n\t\t\t\tquote = undefined;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (character === \"\\\\\") {\n\t\t\t\tif (nextCharacter && '\"$`\\\\'.includes(nextCharacter)) {\n\t\t\t\t\ttoken += nextCharacter;\n\t\t\t\t\ttokenStarted = true;\n\t\t\t\t\tindex++;\n\t\t\t\t} else {\n\t\t\t\t\ttoken += character;\n\t\t\t\t\ttokenStarted = true;\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (character === \"$\" || character === \"`\") {\n\t\t\t\treturn { ok: false, error: UNSUPPORTED_OPERATOR_MESSAGE };\n\t\t\t}\n\t\t\ttoken += character;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (character === \"'\") {\n\t\t\tquote = \"single\";\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === '\"') {\n\t\t\tquote = \"double\";\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"\\\\\") {\n\t\t\tif (/^[A-Za-z]:/u.test(token) || token.startsWith(\"\\\\\\\\\")) {\n\t\t\t\ttoken += character;\n\t\t\t\ttokenStarted = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token === \"\" && nextCharacter === \"\\\\\") {\n\t\t\t\ttoken = \"\\\\\\\\\";\n\t\t\t\ttokenStarted = true;\n\t\t\t\tindex++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tescaping = true;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/\\s/u.test(character)) {\n\t\t\tfinishToken();\n\t\t\tcontinue;\n\t\t}\n\t\tif (\"|><&;\\n\\r$`(){}*?[]\".includes(character) || character === \"#\" || (character === \"~\" && token === \"\")) {\n\t\t\treturn { ok: false, error: UNSUPPORTED_OPERATOR_MESSAGE };\n\t\t}\n\t\ttoken += character;\n\t\ttokenStarted = true;\n\t}\n\n\tif (escaping) return { ok: false, error: \"Unsupported trailing escape in Bash-like command.\" };\n\tif (quote) return { ok: false, error: \"Unclosed quote in Bash-like command.\" };\n\tfinishToken();\n\treturn argv.length > 0 ? { ok: true, argv } : { ok: false, error: \"Shell command is empty.\" };\n}\n\nfunction quotePowerShell(value: string): string {\n\treturn `'${value.replaceAll(\"'\", \"''\")}'`;\n}\n\nfunction powershellArray(values: readonly string[]): string {\n\treturn `@(${values.map(quotePowerShell).join(\", \")})`;\n}\n\nfunction externalCommand(argv: readonly string[]): string {\n\tconst invocation = `& ${argv.map(quotePowerShell).join(\" \")}`;\n\treturn `${invocation}\\nif ($null -ne $LASTEXITCODE) { exit $LASTEXITCODE }\\nif (-not $?) { exit 1 }`;\n}\n\nfunction parseFlags(\n\targv: readonly string[],\n\tallowedFlags: ReadonlySet<string>,\n): { flags: Set<string>; operands: string[] } | undefined {\n\tconst flags = new Set<string>();\n\tconst operands: string[] = [];\n\tlet optionsEnded = false;\n\tfor (const value of argv) {\n\t\tif (!optionsEnded && value === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!optionsEnded && value.startsWith(\"-\") && value !== \"-\") {\n\t\t\tif (!allowedFlags.has(value)) return undefined;\n\t\t\tflags.add(value);\n\t\t\tcontinue;\n\t\t}\n\t\toperands.push(value);\n\t}\n\treturn { flags, operands };\n}\n\nfunction routeLs(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-a\", \"-A\", \"-l\", \"-1\", \"-la\", \"-al\"]));\n\tif (!parsed || parsed.operands.length > 1) return undefined;\n\tconst target = parsed.operands[0] ?? \".\";\n\tconst includeHidden = [...parsed.flags].some((flag) => flag.includes(\"a\") || flag.includes(\"A\"));\n\tconst hiddenFilter = includeHidden ? \"\" : \" | Where-Object { -not $_.Name.StartsWith('.') }\";\n\treturn `[string[]]$items = @(Get-ChildItem -LiteralPath ${quotePowerShell(target)}${includeHidden ? \" -Force\" : \"\"} -ErrorAction Stop${hiddenFilter} | ForEach-Object { if ($_.PSIsContainer) { $_.Name + '/' } else { $_.Name } }); [Array]::Sort($items, [StringComparer]::Ordinal); $items`;\n}\n\nfunction routeCat(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"--\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `foreach ($path in ${powershellArray(parsed.operands)}) { [Console]::Out.Write([IO.File]::ReadAllText($path)) }`;\n}\n\nfunction routeHeadOrTail(argv: readonly string[], tail: boolean): string | undefined {\n\tlet count = 10;\n\tlet operands = argv.slice(1);\n\tif (operands[0] === \"-n\") {\n\t\tconst parsedCount = Number(operands[1]);\n\t\tif (!Number.isInteger(parsedCount) || parsedCount < 0) return undefined;\n\t\tcount = parsedCount;\n\t\toperands = operands.slice(2);\n\t}\n\tif (operands.length !== 1 || operands[0].startsWith(\"-\")) return undefined;\n\treturn `Get-Content -LiteralPath ${quotePowerShell(operands[0])} ${tail ? \"-Tail\" : \"-TotalCount\"} ${count} -ErrorAction Stop`;\n}\n\nfunction routeGrep(argv: readonly string[]): string | undefined {\n\tif (argv.length !== 3 || argv[1].startsWith(\"-\") || argv[2].startsWith(\"-\")) return undefined;\n\treturn `[string[]]$matches = @(Select-String -LiteralPath ${quotePowerShell(argv[2])} -Pattern ${quotePowerShell(argv[1])} -CaseSensitive -ErrorAction Stop | ForEach-Object { $_.Line }); if ($matches.Count -eq 0) { exit 1 }; $matches`;\n}\n\nfunction routeFind(argv: readonly string[]): string | undefined {\n\tlet searchPath = \".\";\n\tlet type: \"File\" | \"Directory\" | undefined;\n\tlet filter: string | undefined;\n\tlet index = 1;\n\tif (argv[index] && !argv[index].startsWith(\"-\")) searchPath = argv[index++];\n\twhile (index < argv.length) {\n\t\tconst option = argv[index++];\n\t\tif (option === \"-type\" && (argv[index] === \"f\" || argv[index] === \"d\")) {\n\t\t\ttype = argv[index++] === \"f\" ? \"File\" : \"Directory\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (option === \"-name\" && argv[index]) {\n\t\t\tfilter = argv[index++];\n\t\t\tcontinue;\n\t\t}\n\t\treturn undefined;\n\t}\n\tconst typeFlag = type ? ` -${type}` : \"\";\n\tconst filterFlag = filter ? ` -Filter ${quotePowerShell(filter)}` : \"\";\n\treturn `[string[]]$paths = @(Get-ChildItem -LiteralPath ${quotePowerShell(searchPath)} -Recurse -Force${typeFlag}${filterFlag} -ErrorAction Stop | ForEach-Object { $_.FullName.Replace('\\\\', '/') }); [Array]::Sort($paths, [StringComparer]::Ordinal); $paths`;\n}\n\nfunction routeRemove(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-f\", \"-r\", \"-rf\", \"-fr\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\tconst recursive = [...parsed.flags].some((flag) => flag.includes(\"r\"));\n\tconst force = [...parsed.flags].some((flag) => flag.includes(\"f\"));\n\treturn `foreach ($path in ${powershellArray(parsed.operands)}) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force${recursive ? \" -Recurse\" : \"\"} -ErrorAction Stop }${force ? \"\" : ' else { throw \"rm: path not found: $path\" }'} }`;\n}\n\nfunction routeCopyOrMove(argv: readonly string[], move: boolean): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), move ? new Set<string>() : new Set([\"-r\", \"-R\"]));\n\tif (!parsed || parsed.operands.length !== 2) return undefined;\n\tconst [source, destination] = parsed.operands;\n\tconst recurse = !move && parsed.flags.size > 0 ? \" -Recurse\" : \"\";\n\tconst rejectDirectoryWithoutRecursion =\n\t\t!move && parsed.flags.size === 0\n\t\t\t? `$sourceItem = Get-Item -LiteralPath ${quotePowerShell(source)} -Force -ErrorAction Stop; if ($sourceItem.PSIsContainer) { throw 'cp: source is a directory; use -r' }; `\n\t\t\t: \"\";\n\treturn `${rejectDirectoryWithoutRecursion}${move ? \"Move-Item\" : \"Copy-Item\"} -LiteralPath ${quotePowerShell(source)} -Destination ${quotePowerShell(destination)}${recurse} -ErrorAction Stop`;\n}\n\nfunction routeMkdir(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-p\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `${powershellArray(parsed.operands)} | ForEach-Object { New-Item -ItemType Directory -Path $_${parsed.flags.has(\"-p\") ? \" -Force\" : \"\"} -ErrorAction Stop | Out-Null }`;\n}\n\nfunction routeTouch(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set());\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `${powershellArray(parsed.operands)} | ForEach-Object { if (Test-Path -LiteralPath $_) { (Get-Item -LiteralPath $_ -ErrorAction Stop).LastWriteTime = Get-Date } else { New-Item -ItemType File -Path $_ -ErrorAction Stop | Out-Null } }`;\n}\n\nfunction routeBuiltIn(argv: readonly string[]): string | undefined {\n\tconst command = argv[0].toLowerCase();\n\tif (command === \"pwd\" && argv.length === 1) return \"(Get-Location).Path\";\n\tif (command === \"echo\") {\n\t\tlet valueIndex = 1;\n\t\twhile (/^-n+$/u.test(argv[valueIndex] ?? \"\")) valueIndex++;\n\t\tif (/^-[neE]+$/u.test(argv[valueIndex] ?? \"\") && /[eE]/u.test(argv[valueIndex] ?? \"\")) return undefined;\n\t\tconst method = valueIndex > 1 ? \"Write\" : \"WriteLine\";\n\t\treturn `[Console]::Out.${method}((${powershellArray(argv.slice(valueIndex))} -join ' '))`;\n\t}\n\tif (command === \"true\" && argv.length === 1) return \"exit 0\";\n\tif (command === \"false\" && argv.length === 1) return \"exit 1\";\n\tif (command === \"which\" && argv.length === 2) {\n\t\treturn `(Get-Command -Name ${quotePowerShell(argv[1])} -CommandType Application -ErrorAction Stop).Source`;\n\t}\n\tif (command === \"ls\") return routeLs(argv);\n\tif (command === \"cat\") return routeCat(argv);\n\tif (command === \"head\") return routeHeadOrTail(argv, false);\n\tif (command === \"tail\") return routeHeadOrTail(argv, true);\n\tif (command === \"grep\") return routeGrep(argv);\n\tif (command === \"find\") return routeFind(argv);\n\tif (command === \"rm\") return routeRemove(argv);\n\tif (command === \"cp\") return routeCopyOrMove(argv, false);\n\tif (command === \"mv\") return routeCopyOrMove(argv, true);\n\tif (command === \"mkdir\") return routeMkdir(argv);\n\tif (command === \"touch\") return routeTouch(argv);\n\treturn undefined;\n}\n\nconst ROUTED_BUILTIN_NAMES = new Set([\n\t\"pwd\",\n\t\"echo\",\n\t\"true\",\n\t\"false\",\n\t\"which\",\n\t\"ls\",\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"grep\",\n\t\"find\",\n\t\"rm\",\n\t\"cp\",\n\t\"mv\",\n\t\"mkdir\",\n\t\"touch\",\n]);\n\nexport function routeShellContract(\n\tcommand: string,\n\tplatform: NodeJS.Platform = process.platform,\n\toptions?: { pythonEngine?: boolean },\n): ShellContractRoute {\n\tif (platform !== \"win32\") return { kind: \"passthrough\", command };\n\tconst pythonEngine = options?.pythonEngine === true;\n\tconst tokenized = tokenizePortableCommand(command);\n\n\t// Complex constructs (pipelines, redirection, expansion, quoting the tokenizer refuses, …) are\n\t// exactly the grammar the Python engine owns; with the engine off this is the original\n\t// fail-closed floor verbatim.\n\tif (!tokenized.ok || !tokenized.argv) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn { kind: \"unsupported\", error: tokenized.error ?? UNSUPPORTED_OPERATOR_MESSAGE };\n\t}\n\n\tconst argv = tokenized.argv;\n\tconst commandName = argv[0].toLowerCase();\n\n\t// Inline env assignments (`NAME=value [cmd]`) are a state-mutating/expansion form the engine\n\t// supports (§2.1); with the engine off this is the original fail-closed floor verbatim.\n\tif (/^[A-Za-z_][A-Za-z0-9_]*=/u.test(argv[0])) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"Inline environment assignments are not supported. Configure the environment outside the shell command.\",\n\t\t};\n\t}\n\n\t// State mutators and controlled exit route to the engine unconditionally when enabled: the\n\t// engine is the sole state owner and must frame `exit` instead of terminating the PS backend.\n\tif (ENGINE_OWNED_BUILTINS.has(commandName)) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\tif (commandName === \"exit\") {\n\t\t\treturn {\n\t\t\t\tkind: \"unsupported\",\n\t\t\t\terror: \"The Bash-like 'exit' builtin requires the Windows Python shell engine so Pi can preserve its terminal result protocol.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (BLOCKED_NESTED_SHELLS.has(commandName)) {\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"Nested shell execution is not supported by the Windows shell contract router.\",\n\t\t};\n\t}\n\tconst builtIn = routeBuiltIn(argv);\n\tif (builtIn) return { kind: \"powershell\", command: builtIn, argv };\n\tif (ROUTED_BUILTIN_NAMES.has(commandName)) {\n\t\t// The PS floor rejected the FORM (flags/argument shape); the engine supports the fuller\n\t\t// flag set for the same builtin (§2.2).\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: `Unsupported ${argv[0]} form on Windows. Use a simpler Bash-like form or Pi's dedicated read/search/edit tools.`,\n\t\t};\n\t}\n\tif (commandName.endsWith(\".sh\") || commandName.includes(\"/bin/\")) {\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"POSIX shell scripts are not supported by the Windows shell contract router.\",\n\t\t};\n\t}\n\treturn { kind: \"powershell\", command: externalCommand(argv), argv };\n}\n"]}
+{"version":3,"file":"shell-contract-router.d.ts","sourceRoot":"","sources":["../../../src/core/tools/shell-contract-router.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAC3B;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAuS1C,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,kBAAkB,CAiEpB"}

package/dist/core/tools/shell-contract-router.js

@@ -329,9 +329,12 @@ export function routeShellContract(command, platform = process.platform, options
         }
     }
     if (BLOCKED_NESTED_SHELLS.has(commandName)) {
+        const powershellGuidance = ["powershell", "powershell.exe", "pwsh", "pwsh.exe"].includes(commandName)
+            ? " Invoke the .ps1 path directly with its arguments, without powershell.exe -File or pwsh -File."
+            : " Invoke the target executable or supported script directly.";
         return {
             kind: "unsupported",
-            error: "Nested shell execution is not supported by the Windows shell contract router.",
+            error: `Nested shell execution is not supported by the Windows shell contract router.${powershellGuidance}`,
         };
     }
     const builtIn = routeBuiltIn(argv);

package/dist/core/tools/shell-contract-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"shell-contract-router.js","sourceRoot":"","sources":["../../../src/core/tools/shell-contract-router.ts"],"names":[],"mappings":"AAMA,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAQzE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,IAAI;IACJ,KAAK;IACL,MAAM;IACN,KAAK;IACL,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,MAAM;IACN,UAAU;IACV,KAAK;IACL,SAAS;CACT,CAAC,CAAC;AACH,MAAM,4BAA4B,GACjC,iMAAiM,CAAC;AAEnM,SAAS,uBAAuB,CAAC,OAAe,EAAkB;IACjE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAsC,CAAC;IAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,GAAG,EAAE,CAAC;QACX,YAAY,GAAG,KAAK,CAAC;IAAA,CACrB,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,IAAI,SAAS,CAAC;YACnB,YAAY,GAAG,IAAI,CAAC;YACpB,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,SAAS,KAAK,GAAG;gBAAE,KAAK,GAAG,SAAS,CAAC;;gBACpC,KAAK,IAAI,SAAS,CAAC;YACxB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACvB,KAAK,GAAG,SAAS,CAAC;gBAClB,SAAS;YACV,CAAC;YACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxB,IAAI,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBACtD,KAAK,IAAI,aAAa,CAAC;oBACvB,YAAY,GAAG,IAAI,CAAC;oBACpB,KAAK,EAAE,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,SAAS,CAAC;oBACnB,YAAY,GAAG,IAAI,CAAC;gBACrB,CAAC;gBACD,SAAS;YACV,CAAC;YACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC3D,CAAC;YACD,KAAK,IAAI,SAAS,CAAC;YACnB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QAED,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,KAAK,IAAI,SAAS,CAAC;gBACnB,YAAY,GAAG,IAAI,CAAC;gBACpB,SAAS;YACV,CAAC;YACD,IAAI,KAAK,KAAK,EAAE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC5C,KAAK,GAAG,MAAM,CAAC;gBACf,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,EAAE,CAAC;gBACR,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,WAAW,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;YAC3G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC3D,CAAC;QACD,KAAK,IAAI,SAAS,CAAC;QACnB,YAAY,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;IAC/F,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC/E,WAAW,EAAE,CAAC;IACd,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAAA,CAC9F;AAED,SAAS,eAAe,CAAC,KAAa,EAAU;IAC/C,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAAA,CAC1C;AAED,SAAS,eAAe,CAAC,MAAyB,EAAU;IAC3D,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAAA,CACtD;AAED,SAAS,eAAe,CAAC,IAAuB,EAAU;IACzD,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,UAAU,gFAAgF,CAAC;AAAA,CACrG;AAED,SAAS,UAAU,CAClB,IAAuB,EACvB,YAAiC,EACwB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACrC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/C,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,SAAS;QACV,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAAA,CAC3B;AAED,SAAS,OAAO,CAAC,IAAuB,EAAsB;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kDAAkD,CAAC;IAC7F,OAAO,mDAAmD,eAAe,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,YAAY,2IAA2I,CAAC;AAAA,CAC/R;AAED,SAAS,QAAQ,CAAC,IAAuB,EAAsB;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,qBAAqB,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,2DAA2D,CAAC;AAAA,CACxH;AAED,SAAS,eAAe,CAAC,IAAuB,EAAE,IAAa,EAAsB;IACpF,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACxE,KAAK,GAAG,WAAW,CAAC;QACpB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,4BAA4B,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,IAAI,KAAK,oBAAoB,CAAC;AAAA,CAC/H;AAED,SAAS,SAAS,CAAC,IAAuB,EAAsB;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,OAAO,qDAAqD,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iHAAiH,CAAC;AAAA,CAC3O;AAED,SAAS,SAAS,CAAC,IAAuB,EAAsB;IAC/D,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,IAAI,IAAsC,CAAC;IAC3C,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACxE,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;YACpD,SAAS;QACV,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACvB,SAAS;QACV,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,mDAAmD,eAAe,CAAC,UAAU,CAAC,mBAAmB,QAAQ,GAAG,UAAU,mIAAmI,CAAC;AAAA,CACjQ;AAED,SAAS,WAAW,CAAC,IAAuB,EAAsB;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,qBAAqB,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,gFAAgF,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,uBAAuB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6CAA6C,IAAI,CAAC;AAAA,CAC9P;AAED,SAAS,eAAe,CAAC,IAAuB,EAAE,IAAa,EAAsB;IACpF,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,+BAA+B,GACpC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC/B,CAAC,CAAC,uCAAuC,eAAe,CAAC,MAAM,CAAC,2GAA2G;QAC3K,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,+BAA+B,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,iBAAiB,eAAe,CAAC,MAAM,CAAC,iBAAiB,eAAe,CAAC,WAAW,CAAC,GAAG,OAAO,oBAAoB,CAAC;AAAA,CAChM;AAED,SAAS,UAAU,CAAC,IAAuB,EAAsB;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,4DAA4D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iCAAiC,CAAC;AAAA,CAC/K;AAED,SAAS,UAAU,CAAC,IAAuB,EAAsB;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,uMAAuM,CAAC;AAAA,CAClP;AAED,SAAS,YAAY,CAAC,IAAuB,EAAsB;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACzE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,UAAU,EAAE,CAAC;QAC3D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QACxG,MAAM,MAAM,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACtD,OAAO,kBAAkB,MAAM,KAAK,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,cAAc,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9D,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,sBAAsB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qDAAqD,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CACjC,OAAe,EACf,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,OAAoC,EACf;IACrB,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAClE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEnD,iGAA+F;IAC/F,uFAAuF;IACvF,8BAA8B;IAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,4BAA4B,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAE1C,6FAA6F;IAC7F,yFAAwF;IACxF,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,wGAAwG;SAC/G,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,8FAA8F;IAC9F,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,wHAAwH;aAC/H,CAAC;QACH,CAAC;IACF,CAAC;IAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,+EAA+E;SACtF,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,wFAAwF;QACxF,yCAAwC;QACxC,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,eAAe,IAAI,CAAC,CAAC,CAAC,0FAA0F;SACvH,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,6EAA6E;SACpF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AAAA,CACpE","sourcesContent":["export type ShellContractRoute =\n\t| { kind: \"passthrough\"; command: string }\n\t| { kind: \"powershell\"; command: string; argv: readonly string[] }\n\t| { kind: \"python-engine\"; command: string }\n\t| { kind: \"unsupported\"; error: string };\n\nconst ENGINE_OWNED_BUILTINS = new Set([\"cd\", \"export\", \"unset\", \"exit\"]);\n\ninterface TokenizeResult {\n\tok: boolean;\n\targv?: string[];\n\terror?: string;\n}\n\nconst BLOCKED_NESTED_SHELLS = new Set([\n\t\"bash\",\n\t\"sh\",\n\t\"zsh\",\n\t\"fish\",\n\t\"cmd\",\n\t\"cmd.exe\",\n\t\"powershell\",\n\t\"powershell.exe\",\n\t\"pwsh\",\n\t\"pwsh.exe\",\n\t\"wsl\",\n\t\"wsl.exe\",\n]);\nconst UNSUPPORTED_OPERATOR_MESSAGE =\n\t\"Unsupported Bash construct on Windows. Use one simple command per call; pipelines, redirection, command substitution, variable expansion, shell chaining, and nested shells are not translated.\";\n\nfunction tokenizePortableCommand(command: string): TokenizeResult {\n\tconst argv: string[] = [];\n\tlet token = \"\";\n\tlet tokenStarted = false;\n\tlet quote: \"single\" | \"double\" | undefined;\n\tlet escaping = false;\n\n\tconst finishToken = () => {\n\t\tif (!tokenStarted) return;\n\t\targv.push(token);\n\t\ttoken = \"\";\n\t\ttokenStarted = false;\n\t};\n\n\tconst source = command.trim();\n\tfor (let index = 0; index < source.length; index++) {\n\t\tconst character = source[index];\n\t\tconst nextCharacter = source[index + 1];\n\t\tif (escaping) {\n\t\t\ttoken += character;\n\t\t\ttokenStarted = true;\n\t\t\tescaping = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"single\") {\n\t\t\tif (character === \"'\") quote = undefined;\n\t\t\telse token += character;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"double\") {\n\t\t\tif (character === '\"') {\n\t\t\t\tquote = undefined;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (character === \"\\\\\") {\n\t\t\t\tif (nextCharacter && '\"$`\\\\'.includes(nextCharacter)) {\n\t\t\t\t\ttoken += nextCharacter;\n\t\t\t\t\ttokenStarted = true;\n\t\t\t\t\tindex++;\n\t\t\t\t} else {\n\t\t\t\t\ttoken += character;\n\t\t\t\t\ttokenStarted = true;\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (character === \"$\" || character === \"`\") {\n\t\t\t\treturn { ok: false, error: UNSUPPORTED_OPERATOR_MESSAGE };\n\t\t\t}\n\t\t\ttoken += character;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (character === \"'\") {\n\t\t\tquote = \"single\";\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === '\"') {\n\t\t\tquote = \"double\";\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"\\\\\") {\n\t\t\tif (/^[A-Za-z]:/u.test(token) || token.startsWith(\"\\\\\\\\\")) {\n\t\t\t\ttoken += character;\n\t\t\t\ttokenStarted = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token === \"\" && nextCharacter === \"\\\\\") {\n\t\t\t\ttoken = \"\\\\\\\\\";\n\t\t\t\ttokenStarted = true;\n\t\t\t\tindex++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tescaping = true;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/\\s/u.test(character)) {\n\t\t\tfinishToken();\n\t\t\tcontinue;\n\t\t}\n\t\tif (\"|><&;\\n\\r$`(){}*?[]\".includes(character) || character === \"#\" || (character === \"~\" && token === \"\")) {\n\t\t\treturn { ok: false, error: UNSUPPORTED_OPERATOR_MESSAGE };\n\t\t}\n\t\ttoken += character;\n\t\ttokenStarted = true;\n\t}\n\n\tif (escaping) return { ok: false, error: \"Unsupported trailing escape in Bash-like command.\" };\n\tif (quote) return { ok: false, error: \"Unclosed quote in Bash-like command.\" };\n\tfinishToken();\n\treturn argv.length > 0 ? { ok: true, argv } : { ok: false, error: \"Shell command is empty.\" };\n}\n\nfunction quotePowerShell(value: string): string {\n\treturn `'${value.replaceAll(\"'\", \"''\")}'`;\n}\n\nfunction powershellArray(values: readonly string[]): string {\n\treturn `@(${values.map(quotePowerShell).join(\", \")})`;\n}\n\nfunction externalCommand(argv: readonly string[]): string {\n\tconst invocation = `& ${argv.map(quotePowerShell).join(\" \")}`;\n\treturn `${invocation}\\nif ($null -ne $LASTEXITCODE) { exit $LASTEXITCODE }\\nif (-not $?) { exit 1 }`;\n}\n\nfunction parseFlags(\n\targv: readonly string[],\n\tallowedFlags: ReadonlySet<string>,\n): { flags: Set<string>; operands: string[] } | undefined {\n\tconst flags = new Set<string>();\n\tconst operands: string[] = [];\n\tlet optionsEnded = false;\n\tfor (const value of argv) {\n\t\tif (!optionsEnded && value === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!optionsEnded && value.startsWith(\"-\") && value !== \"-\") {\n\t\t\tif (!allowedFlags.has(value)) return undefined;\n\t\t\tflags.add(value);\n\t\t\tcontinue;\n\t\t}\n\t\toperands.push(value);\n\t}\n\treturn { flags, operands };\n}\n\nfunction routeLs(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-a\", \"-A\", \"-l\", \"-1\", \"-la\", \"-al\"]));\n\tif (!parsed || parsed.operands.length > 1) return undefined;\n\tconst target = parsed.operands[0] ?? \".\";\n\tconst includeHidden = [...parsed.flags].some((flag) => flag.includes(\"a\") || flag.includes(\"A\"));\n\tconst hiddenFilter = includeHidden ? \"\" : \" | Where-Object { -not $_.Name.StartsWith('.') }\";\n\treturn `[string[]]$items = @(Get-ChildItem -LiteralPath ${quotePowerShell(target)}${includeHidden ? \" -Force\" : \"\"} -ErrorAction Stop${hiddenFilter} | ForEach-Object { if ($_.PSIsContainer) { $_.Name + '/' } else { $_.Name } }); [Array]::Sort($items, [StringComparer]::Ordinal); $items`;\n}\n\nfunction routeCat(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"--\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `foreach ($path in ${powershellArray(parsed.operands)}) { [Console]::Out.Write([IO.File]::ReadAllText($path)) }`;\n}\n\nfunction routeHeadOrTail(argv: readonly string[], tail: boolean): string | undefined {\n\tlet count = 10;\n\tlet operands = argv.slice(1);\n\tif (operands[0] === \"-n\") {\n\t\tconst parsedCount = Number(operands[1]);\n\t\tif (!Number.isInteger(parsedCount) || parsedCount < 0) return undefined;\n\t\tcount = parsedCount;\n\t\toperands = operands.slice(2);\n\t}\n\tif (operands.length !== 1 || operands[0].startsWith(\"-\")) return undefined;\n\treturn `Get-Content -LiteralPath ${quotePowerShell(operands[0])} ${tail ? \"-Tail\" : \"-TotalCount\"} ${count} -ErrorAction Stop`;\n}\n\nfunction routeGrep(argv: readonly string[]): string | undefined {\n\tif (argv.length !== 3 || argv[1].startsWith(\"-\") || argv[2].startsWith(\"-\")) return undefined;\n\treturn `[string[]]$matches = @(Select-String -LiteralPath ${quotePowerShell(argv[2])} -Pattern ${quotePowerShell(argv[1])} -CaseSensitive -ErrorAction Stop | ForEach-Object { $_.Line }); if ($matches.Count -eq 0) { exit 1 }; $matches`;\n}\n\nfunction routeFind(argv: readonly string[]): string | undefined {\n\tlet searchPath = \".\";\n\tlet type: \"File\" | \"Directory\" | undefined;\n\tlet filter: string | undefined;\n\tlet index = 1;\n\tif (argv[index] && !argv[index].startsWith(\"-\")) searchPath = argv[index++];\n\twhile (index < argv.length) {\n\t\tconst option = argv[index++];\n\t\tif (option === \"-type\" && (argv[index] === \"f\" || argv[index] === \"d\")) {\n\t\t\ttype = argv[index++] === \"f\" ? \"File\" : \"Directory\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (option === \"-name\" && argv[index]) {\n\t\t\tfilter = argv[index++];\n\t\t\tcontinue;\n\t\t}\n\t\treturn undefined;\n\t}\n\tconst typeFlag = type ? ` -${type}` : \"\";\n\tconst filterFlag = filter ? ` -Filter ${quotePowerShell(filter)}` : \"\";\n\treturn `[string[]]$paths = @(Get-ChildItem -LiteralPath ${quotePowerShell(searchPath)} -Recurse -Force${typeFlag}${filterFlag} -ErrorAction Stop | ForEach-Object { $_.FullName.Replace('\\\\', '/') }); [Array]::Sort($paths, [StringComparer]::Ordinal); $paths`;\n}\n\nfunction routeRemove(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-f\", \"-r\", \"-rf\", \"-fr\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\tconst recursive = [...parsed.flags].some((flag) => flag.includes(\"r\"));\n\tconst force = [...parsed.flags].some((flag) => flag.includes(\"f\"));\n\treturn `foreach ($path in ${powershellArray(parsed.operands)}) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force${recursive ? \" -Recurse\" : \"\"} -ErrorAction Stop }${force ? \"\" : ' else { throw \"rm: path not found: $path\" }'} }`;\n}\n\nfunction routeCopyOrMove(argv: readonly string[], move: boolean): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), move ? new Set<string>() : new Set([\"-r\", \"-R\"]));\n\tif (!parsed || parsed.operands.length !== 2) return undefined;\n\tconst [source, destination] = parsed.operands;\n\tconst recurse = !move && parsed.flags.size > 0 ? \" -Recurse\" : \"\";\n\tconst rejectDirectoryWithoutRecursion =\n\t\t!move && parsed.flags.size === 0\n\t\t\t? `$sourceItem = Get-Item -LiteralPath ${quotePowerShell(source)} -Force -ErrorAction Stop; if ($sourceItem.PSIsContainer) { throw 'cp: source is a directory; use -r' }; `\n\t\t\t: \"\";\n\treturn `${rejectDirectoryWithoutRecursion}${move ? \"Move-Item\" : \"Copy-Item\"} -LiteralPath ${quotePowerShell(source)} -Destination ${quotePowerShell(destination)}${recurse} -ErrorAction Stop`;\n}\n\nfunction routeMkdir(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-p\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `${powershellArray(parsed.operands)} | ForEach-Object { New-Item -ItemType Directory -Path $_${parsed.flags.has(\"-p\") ? \" -Force\" : \"\"} -ErrorAction Stop | Out-Null }`;\n}\n\nfunction routeTouch(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set());\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `${powershellArray(parsed.operands)} | ForEach-Object { if (Test-Path -LiteralPath $_) { (Get-Item -LiteralPath $_ -ErrorAction Stop).LastWriteTime = Get-Date } else { New-Item -ItemType File -Path $_ -ErrorAction Stop | Out-Null } }`;\n}\n\nfunction routeBuiltIn(argv: readonly string[]): string | undefined {\n\tconst command = argv[0].toLowerCase();\n\tif (command === \"pwd\" && argv.length === 1) return \"(Get-Location).Path\";\n\tif (command === \"echo\") {\n\t\tlet valueIndex = 1;\n\t\twhile (/^-n+$/u.test(argv[valueIndex] ?? \"\")) valueIndex++;\n\t\tif (/^-[neE]+$/u.test(argv[valueIndex] ?? \"\") && /[eE]/u.test(argv[valueIndex] ?? \"\")) return undefined;\n\t\tconst method = valueIndex > 1 ? \"Write\" : \"WriteLine\";\n\t\treturn `[Console]::Out.${method}((${powershellArray(argv.slice(valueIndex))} -join ' '))`;\n\t}\n\tif (command === \"true\" && argv.length === 1) return \"exit 0\";\n\tif (command === \"false\" && argv.length === 1) return \"exit 1\";\n\tif (command === \"which\" && argv.length === 2) {\n\t\treturn `(Get-Command -Name ${quotePowerShell(argv[1])} -CommandType Application -ErrorAction Stop).Source`;\n\t}\n\tif (command === \"ls\") return routeLs(argv);\n\tif (command === \"cat\") return routeCat(argv);\n\tif (command === \"head\") return routeHeadOrTail(argv, false);\n\tif (command === \"tail\") return routeHeadOrTail(argv, true);\n\tif (command === \"grep\") return routeGrep(argv);\n\tif (command === \"find\") return routeFind(argv);\n\tif (command === \"rm\") return routeRemove(argv);\n\tif (command === \"cp\") return routeCopyOrMove(argv, false);\n\tif (command === \"mv\") return routeCopyOrMove(argv, true);\n\tif (command === \"mkdir\") return routeMkdir(argv);\n\tif (command === \"touch\") return routeTouch(argv);\n\treturn undefined;\n}\n\nconst ROUTED_BUILTIN_NAMES = new Set([\n\t\"pwd\",\n\t\"echo\",\n\t\"true\",\n\t\"false\",\n\t\"which\",\n\t\"ls\",\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"grep\",\n\t\"find\",\n\t\"rm\",\n\t\"cp\",\n\t\"mv\",\n\t\"mkdir\",\n\t\"touch\",\n]);\n\nexport function routeShellContract(\n\tcommand: string,\n\tplatform: NodeJS.Platform = process.platform,\n\toptions?: { pythonEngine?: boolean },\n): ShellContractRoute {\n\tif (platform !== \"win32\") return { kind: \"passthrough\", command };\n\tconst pythonEngine = options?.pythonEngine === true;\n\tconst tokenized = tokenizePortableCommand(command);\n\n\t// Complex constructs (pipelines, redirection, expansion, quoting the tokenizer refuses, …) are\n\t// exactly the grammar the Python engine owns; with the engine off this is the original\n\t// fail-closed floor verbatim.\n\tif (!tokenized.ok || !tokenized.argv) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn { kind: \"unsupported\", error: tokenized.error ?? UNSUPPORTED_OPERATOR_MESSAGE };\n\t}\n\n\tconst argv = tokenized.argv;\n\tconst commandName = argv[0].toLowerCase();\n\n\t// Inline env assignments (`NAME=value [cmd]`) are a state-mutating/expansion form the engine\n\t// supports (§2.1); with the engine off this is the original fail-closed floor verbatim.\n\tif (/^[A-Za-z_][A-Za-z0-9_]*=/u.test(argv[0])) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"Inline environment assignments are not supported. Configure the environment outside the shell command.\",\n\t\t};\n\t}\n\n\t// State mutators and controlled exit route to the engine unconditionally when enabled: the\n\t// engine is the sole state owner and must frame `exit` instead of terminating the PS backend.\n\tif (ENGINE_OWNED_BUILTINS.has(commandName)) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\tif (commandName === \"exit\") {\n\t\t\treturn {\n\t\t\t\tkind: \"unsupported\",\n\t\t\t\terror: \"The Bash-like 'exit' builtin requires the Windows Python shell engine so Pi can preserve its terminal result protocol.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (BLOCKED_NESTED_SHELLS.has(commandName)) {\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"Nested shell execution is not supported by the Windows shell contract router.\",\n\t\t};\n\t}\n\tconst builtIn = routeBuiltIn(argv);\n\tif (builtIn) return { kind: \"powershell\", command: builtIn, argv };\n\tif (ROUTED_BUILTIN_NAMES.has(commandName)) {\n\t\t// The PS floor rejected the FORM (flags/argument shape); the engine supports the fuller\n\t\t// flag set for the same builtin (§2.2).\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: `Unsupported ${argv[0]} form on Windows. Use a simpler Bash-like form or Pi's dedicated read/search/edit tools.`,\n\t\t};\n\t}\n\tif (commandName.endsWith(\".sh\") || commandName.includes(\"/bin/\")) {\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"POSIX shell scripts are not supported by the Windows shell contract router.\",\n\t\t};\n\t}\n\treturn { kind: \"powershell\", command: externalCommand(argv), argv };\n}\n"]}
+{"version":3,"file":"shell-contract-router.js","sourceRoot":"","sources":["../../../src/core/tools/shell-contract-router.ts"],"names":[],"mappings":"AAMA,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAQzE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACrC,MAAM;IACN,IAAI;IACJ,KAAK;IACL,MAAM;IACN,KAAK;IACL,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,MAAM;IACN,UAAU;IACV,KAAK;IACL,SAAS;CACT,CAAC,CAAC;AACH,MAAM,4BAA4B,GACjC,iMAAiM,CAAC;AAEnM,SAAS,uBAAuB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAsC,CAAC;IAC3C,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,WAAW,GAAG,GAAG,EAAE;QACxB,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,GAAG,EAAE,CAAC;QACX,YAAY,GAAG,KAAK,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACd,KAAK,IAAI,SAAS,CAAC;YACnB,YAAY,GAAG,IAAI,CAAC;YACpB,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,SAAS,KAAK,GAAG;gBAAE,KAAK,GAAG,SAAS,CAAC;;gBACpC,KAAK,IAAI,SAAS,CAAC;YACxB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACvB,KAAK,GAAG,SAAS,CAAC;gBAClB,SAAS;YACV,CAAC;YACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxB,IAAI,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBACtD,KAAK,IAAI,aAAa,CAAC;oBACvB,YAAY,GAAG,IAAI,CAAC;oBACpB,KAAK,EAAE,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACP,KAAK,IAAI,SAAS,CAAC;oBACnB,YAAY,GAAG,IAAI,CAAC;gBACrB,CAAC;gBACD,SAAS;YACV,CAAC;YACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC3D,CAAC;YACD,KAAK,IAAI,SAAS,CAAC;YACnB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QAED,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,QAAQ,CAAC;YACjB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,KAAK,IAAI,SAAS,CAAC;gBACnB,YAAY,GAAG,IAAI,CAAC;gBACpB,SAAS;YACV,CAAC;YACD,IAAI,KAAK,KAAK,EAAE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC5C,KAAK,GAAG,MAAM,CAAC;gBACf,YAAY,GAAG,IAAI,CAAC;gBACpB,KAAK,EAAE,CAAC;gBACR,SAAS;YACV,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,WAAW,EAAE,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;YAC3G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC3D,CAAC;QACD,KAAK,IAAI,SAAS,CAAC;QACnB,YAAY,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;IAC/F,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC/E,WAAW,EAAE,CAAC;IACd,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IACjD,OAAO,KAAK,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB;IAC/C,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9D,OAAO,GAAG,UAAU,gFAAgF,CAAC;AACtG,CAAC;AAED,SAAS,UAAU,CAClB,IAAuB,EACvB,YAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACrC,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC/C,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,SAAS;QACV,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,IAAuB;IACvC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACzC,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kDAAkD,CAAC;IAC7F,OAAO,mDAAmD,eAAe,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,YAAY,2IAA2I,CAAC;AAChS,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,qBAAqB,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,2DAA2D,CAAC;AACzH,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB,EAAE,IAAa;IAC9D,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACxE,KAAK,GAAG,WAAW,CAAC;QACpB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,4BAA4B,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,IAAI,KAAK,oBAAoB,CAAC;AAChI,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,OAAO,qDAAqD,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iHAAiH,CAAC;AAC5O,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB;IACzC,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,IAAI,IAAsC,CAAC;IAC3C,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACxE,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;YACpD,SAAS;QACV,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACvB,SAAS;QACV,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,mDAAmD,eAAe,CAAC,UAAU,CAAC,mBAAmB,QAAQ,GAAG,UAAU,mIAAmI,CAAC;AAClQ,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB;IAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,qBAAqB,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,gFAAgF,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,uBAAuB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6CAA6C,IAAI,CAAC;AAC/P,CAAC;AAED,SAAS,eAAe,CAAC,IAAuB,EAAE,IAAa;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,+BAA+B,GACpC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAC/B,CAAC,CAAC,uCAAuC,eAAe,CAAC,MAAM,CAAC,2GAA2G;QAC3K,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,+BAA+B,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,iBAAiB,eAAe,CAAC,MAAM,CAAC,iBAAiB,eAAe,CAAC,WAAW,CAAC,GAAG,OAAO,oBAAoB,CAAC;AACjM,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,4DAA4D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iCAAiC,CAAC;AAChL,CAAC;AAED,SAAS,UAAU,CAAC,IAAuB;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,uMAAuM,CAAC;AACnP,CAAC;AAED,SAAS,YAAY,CAAC,IAAuB;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACzE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,UAAU,EAAE,CAAC;QAC3D,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QACxG,MAAM,MAAM,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACtD,OAAO,kBAAkB,MAAM,KAAK,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,cAAc,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7D,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9D,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,sBAAsB,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qDAAqD,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CACjC,OAAe,EACf,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAC5C,OAAoC;IAEpC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAClE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEnD,+FAA+F;IAC/F,uFAAuF;IACvF,8BAA8B;IAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,4BAA4B,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAE1C,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,wGAAwG;SAC/G,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,8FAA8F;IAC9F,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,wHAAwH;aAC/H,CAAC;QACH,CAAC;IACF,CAAC;IAED,IAAI,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpG,CAAC,CAAC,gGAAgG;YAClG,CAAC,CAAC,6DAA6D,CAAC;QACjE,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,gFAAgF,kBAAkB,EAAE;SAC3G,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,wFAAwF;QACxF,wCAAwC;QACxC,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAC5D,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,eAAe,IAAI,CAAC,CAAC,CAAC,0FAA0F;SACvH,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClE,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,6EAA6E;SACpF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACrE,CAAC","sourcesContent":["export type ShellContractRoute =\n\t| { kind: \"passthrough\"; command: string }\n\t| { kind: \"powershell\"; command: string; argv: readonly string[] }\n\t| { kind: \"python-engine\"; command: string }\n\t| { kind: \"unsupported\"; error: string };\n\nconst ENGINE_OWNED_BUILTINS = new Set([\"cd\", \"export\", \"unset\", \"exit\"]);\n\ninterface TokenizeResult {\n\tok: boolean;\n\targv?: string[];\n\terror?: string;\n}\n\nconst BLOCKED_NESTED_SHELLS = new Set([\n\t\"bash\",\n\t\"sh\",\n\t\"zsh\",\n\t\"fish\",\n\t\"cmd\",\n\t\"cmd.exe\",\n\t\"powershell\",\n\t\"powershell.exe\",\n\t\"pwsh\",\n\t\"pwsh.exe\",\n\t\"wsl\",\n\t\"wsl.exe\",\n]);\nconst UNSUPPORTED_OPERATOR_MESSAGE =\n\t\"Unsupported Bash construct on Windows. Use one simple command per call; pipelines, redirection, command substitution, variable expansion, shell chaining, and nested shells are not translated.\";\n\nfunction tokenizePortableCommand(command: string): TokenizeResult {\n\tconst argv: string[] = [];\n\tlet token = \"\";\n\tlet tokenStarted = false;\n\tlet quote: \"single\" | \"double\" | undefined;\n\tlet escaping = false;\n\n\tconst finishToken = () => {\n\t\tif (!tokenStarted) return;\n\t\targv.push(token);\n\t\ttoken = \"\";\n\t\ttokenStarted = false;\n\t};\n\n\tconst source = command.trim();\n\tfor (let index = 0; index < source.length; index++) {\n\t\tconst character = source[index];\n\t\tconst nextCharacter = source[index + 1];\n\t\tif (escaping) {\n\t\t\ttoken += character;\n\t\t\ttokenStarted = true;\n\t\t\tescaping = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"single\") {\n\t\t\tif (character === \"'\") quote = undefined;\n\t\t\telse token += character;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote === \"double\") {\n\t\t\tif (character === '\"') {\n\t\t\t\tquote = undefined;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (character === \"\\\\\") {\n\t\t\t\tif (nextCharacter && '\"$`\\\\'.includes(nextCharacter)) {\n\t\t\t\t\ttoken += nextCharacter;\n\t\t\t\t\ttokenStarted = true;\n\t\t\t\t\tindex++;\n\t\t\t\t} else {\n\t\t\t\t\ttoken += character;\n\t\t\t\t\ttokenStarted = true;\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (character === \"$\" || character === \"`\") {\n\t\t\t\treturn { ok: false, error: UNSUPPORTED_OPERATOR_MESSAGE };\n\t\t\t}\n\t\t\ttoken += character;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (character === \"'\") {\n\t\t\tquote = \"single\";\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === '\"') {\n\t\t\tquote = \"double\";\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (character === \"\\\\\") {\n\t\t\tif (/^[A-Za-z]:/u.test(token) || token.startsWith(\"\\\\\\\\\")) {\n\t\t\t\ttoken += character;\n\t\t\t\ttokenStarted = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (token === \"\" && nextCharacter === \"\\\\\") {\n\t\t\t\ttoken = \"\\\\\\\\\";\n\t\t\t\ttokenStarted = true;\n\t\t\t\tindex++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tescaping = true;\n\t\t\ttokenStarted = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (/\\s/u.test(character)) {\n\t\t\tfinishToken();\n\t\t\tcontinue;\n\t\t}\n\t\tif (\"|><&;\\n\\r$`(){}*?[]\".includes(character) || character === \"#\" || (character === \"~\" && token === \"\")) {\n\t\t\treturn { ok: false, error: UNSUPPORTED_OPERATOR_MESSAGE };\n\t\t}\n\t\ttoken += character;\n\t\ttokenStarted = true;\n\t}\n\n\tif (escaping) return { ok: false, error: \"Unsupported trailing escape in Bash-like command.\" };\n\tif (quote) return { ok: false, error: \"Unclosed quote in Bash-like command.\" };\n\tfinishToken();\n\treturn argv.length > 0 ? { ok: true, argv } : { ok: false, error: \"Shell command is empty.\" };\n}\n\nfunction quotePowerShell(value: string): string {\n\treturn `'${value.replaceAll(\"'\", \"''\")}'`;\n}\n\nfunction powershellArray(values: readonly string[]): string {\n\treturn `@(${values.map(quotePowerShell).join(\", \")})`;\n}\n\nfunction externalCommand(argv: readonly string[]): string {\n\tconst invocation = `& ${argv.map(quotePowerShell).join(\" \")}`;\n\treturn `${invocation}\\nif ($null -ne $LASTEXITCODE) { exit $LASTEXITCODE }\\nif (-not $?) { exit 1 }`;\n}\n\nfunction parseFlags(\n\targv: readonly string[],\n\tallowedFlags: ReadonlySet<string>,\n): { flags: Set<string>; operands: string[] } | undefined {\n\tconst flags = new Set<string>();\n\tconst operands: string[] = [];\n\tlet optionsEnded = false;\n\tfor (const value of argv) {\n\t\tif (!optionsEnded && value === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!optionsEnded && value.startsWith(\"-\") && value !== \"-\") {\n\t\t\tif (!allowedFlags.has(value)) return undefined;\n\t\t\tflags.add(value);\n\t\t\tcontinue;\n\t\t}\n\t\toperands.push(value);\n\t}\n\treturn { flags, operands };\n}\n\nfunction routeLs(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-a\", \"-A\", \"-l\", \"-1\", \"-la\", \"-al\"]));\n\tif (!parsed || parsed.operands.length > 1) return undefined;\n\tconst target = parsed.operands[0] ?? \".\";\n\tconst includeHidden = [...parsed.flags].some((flag) => flag.includes(\"a\") || flag.includes(\"A\"));\n\tconst hiddenFilter = includeHidden ? \"\" : \" | Where-Object { -not $_.Name.StartsWith('.') }\";\n\treturn `[string[]]$items = @(Get-ChildItem -LiteralPath ${quotePowerShell(target)}${includeHidden ? \" -Force\" : \"\"} -ErrorAction Stop${hiddenFilter} | ForEach-Object { if ($_.PSIsContainer) { $_.Name + '/' } else { $_.Name } }); [Array]::Sort($items, [StringComparer]::Ordinal); $items`;\n}\n\nfunction routeCat(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"--\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `foreach ($path in ${powershellArray(parsed.operands)}) { [Console]::Out.Write([IO.File]::ReadAllText($path)) }`;\n}\n\nfunction routeHeadOrTail(argv: readonly string[], tail: boolean): string | undefined {\n\tlet count = 10;\n\tlet operands = argv.slice(1);\n\tif (operands[0] === \"-n\") {\n\t\tconst parsedCount = Number(operands[1]);\n\t\tif (!Number.isInteger(parsedCount) || parsedCount < 0) return undefined;\n\t\tcount = parsedCount;\n\t\toperands = operands.slice(2);\n\t}\n\tif (operands.length !== 1 || operands[0].startsWith(\"-\")) return undefined;\n\treturn `Get-Content -LiteralPath ${quotePowerShell(operands[0])} ${tail ? \"-Tail\" : \"-TotalCount\"} ${count} -ErrorAction Stop`;\n}\n\nfunction routeGrep(argv: readonly string[]): string | undefined {\n\tif (argv.length !== 3 || argv[1].startsWith(\"-\") || argv[2].startsWith(\"-\")) return undefined;\n\treturn `[string[]]$matches = @(Select-String -LiteralPath ${quotePowerShell(argv[2])} -Pattern ${quotePowerShell(argv[1])} -CaseSensitive -ErrorAction Stop | ForEach-Object { $_.Line }); if ($matches.Count -eq 0) { exit 1 }; $matches`;\n}\n\nfunction routeFind(argv: readonly string[]): string | undefined {\n\tlet searchPath = \".\";\n\tlet type: \"File\" | \"Directory\" | undefined;\n\tlet filter: string | undefined;\n\tlet index = 1;\n\tif (argv[index] && !argv[index].startsWith(\"-\")) searchPath = argv[index++];\n\twhile (index < argv.length) {\n\t\tconst option = argv[index++];\n\t\tif (option === \"-type\" && (argv[index] === \"f\" || argv[index] === \"d\")) {\n\t\t\ttype = argv[index++] === \"f\" ? \"File\" : \"Directory\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (option === \"-name\" && argv[index]) {\n\t\t\tfilter = argv[index++];\n\t\t\tcontinue;\n\t\t}\n\t\treturn undefined;\n\t}\n\tconst typeFlag = type ? ` -${type}` : \"\";\n\tconst filterFlag = filter ? ` -Filter ${quotePowerShell(filter)}` : \"\";\n\treturn `[string[]]$paths = @(Get-ChildItem -LiteralPath ${quotePowerShell(searchPath)} -Recurse -Force${typeFlag}${filterFlag} -ErrorAction Stop | ForEach-Object { $_.FullName.Replace('\\\\', '/') }); [Array]::Sort($paths, [StringComparer]::Ordinal); $paths`;\n}\n\nfunction routeRemove(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-f\", \"-r\", \"-rf\", \"-fr\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\tconst recursive = [...parsed.flags].some((flag) => flag.includes(\"r\"));\n\tconst force = [...parsed.flags].some((flag) => flag.includes(\"f\"));\n\treturn `foreach ($path in ${powershellArray(parsed.operands)}) { if (Test-Path -LiteralPath $path) { Remove-Item -LiteralPath $path -Force${recursive ? \" -Recurse\" : \"\"} -ErrorAction Stop }${force ? \"\" : ' else { throw \"rm: path not found: $path\" }'} }`;\n}\n\nfunction routeCopyOrMove(argv: readonly string[], move: boolean): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), move ? new Set<string>() : new Set([\"-r\", \"-R\"]));\n\tif (!parsed || parsed.operands.length !== 2) return undefined;\n\tconst [source, destination] = parsed.operands;\n\tconst recurse = !move && parsed.flags.size > 0 ? \" -Recurse\" : \"\";\n\tconst rejectDirectoryWithoutRecursion =\n\t\t!move && parsed.flags.size === 0\n\t\t\t? `$sourceItem = Get-Item -LiteralPath ${quotePowerShell(source)} -Force -ErrorAction Stop; if ($sourceItem.PSIsContainer) { throw 'cp: source is a directory; use -r' }; `\n\t\t\t: \"\";\n\treturn `${rejectDirectoryWithoutRecursion}${move ? \"Move-Item\" : \"Copy-Item\"} -LiteralPath ${quotePowerShell(source)} -Destination ${quotePowerShell(destination)}${recurse} -ErrorAction Stop`;\n}\n\nfunction routeMkdir(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set([\"-p\"]));\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `${powershellArray(parsed.operands)} | ForEach-Object { New-Item -ItemType Directory -Path $_${parsed.flags.has(\"-p\") ? \" -Force\" : \"\"} -ErrorAction Stop | Out-Null }`;\n}\n\nfunction routeTouch(argv: readonly string[]): string | undefined {\n\tconst parsed = parseFlags(argv.slice(1), new Set());\n\tif (!parsed || parsed.operands.length === 0) return undefined;\n\treturn `${powershellArray(parsed.operands)} | ForEach-Object { if (Test-Path -LiteralPath $_) { (Get-Item -LiteralPath $_ -ErrorAction Stop).LastWriteTime = Get-Date } else { New-Item -ItemType File -Path $_ -ErrorAction Stop | Out-Null } }`;\n}\n\nfunction routeBuiltIn(argv: readonly string[]): string | undefined {\n\tconst command = argv[0].toLowerCase();\n\tif (command === \"pwd\" && argv.length === 1) return \"(Get-Location).Path\";\n\tif (command === \"echo\") {\n\t\tlet valueIndex = 1;\n\t\twhile (/^-n+$/u.test(argv[valueIndex] ?? \"\")) valueIndex++;\n\t\tif (/^-[neE]+$/u.test(argv[valueIndex] ?? \"\") && /[eE]/u.test(argv[valueIndex] ?? \"\")) return undefined;\n\t\tconst method = valueIndex > 1 ? \"Write\" : \"WriteLine\";\n\t\treturn `[Console]::Out.${method}((${powershellArray(argv.slice(valueIndex))} -join ' '))`;\n\t}\n\tif (command === \"true\" && argv.length === 1) return \"exit 0\";\n\tif (command === \"false\" && argv.length === 1) return \"exit 1\";\n\tif (command === \"which\" && argv.length === 2) {\n\t\treturn `(Get-Command -Name ${quotePowerShell(argv[1])} -CommandType Application -ErrorAction Stop).Source`;\n\t}\n\tif (command === \"ls\") return routeLs(argv);\n\tif (command === \"cat\") return routeCat(argv);\n\tif (command === \"head\") return routeHeadOrTail(argv, false);\n\tif (command === \"tail\") return routeHeadOrTail(argv, true);\n\tif (command === \"grep\") return routeGrep(argv);\n\tif (command === \"find\") return routeFind(argv);\n\tif (command === \"rm\") return routeRemove(argv);\n\tif (command === \"cp\") return routeCopyOrMove(argv, false);\n\tif (command === \"mv\") return routeCopyOrMove(argv, true);\n\tif (command === \"mkdir\") return routeMkdir(argv);\n\tif (command === \"touch\") return routeTouch(argv);\n\treturn undefined;\n}\n\nconst ROUTED_BUILTIN_NAMES = new Set([\n\t\"pwd\",\n\t\"echo\",\n\t\"true\",\n\t\"false\",\n\t\"which\",\n\t\"ls\",\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"grep\",\n\t\"find\",\n\t\"rm\",\n\t\"cp\",\n\t\"mv\",\n\t\"mkdir\",\n\t\"touch\",\n]);\n\nexport function routeShellContract(\n\tcommand: string,\n\tplatform: NodeJS.Platform = process.platform,\n\toptions?: { pythonEngine?: boolean },\n): ShellContractRoute {\n\tif (platform !== \"win32\") return { kind: \"passthrough\", command };\n\tconst pythonEngine = options?.pythonEngine === true;\n\tconst tokenized = tokenizePortableCommand(command);\n\n\t// Complex constructs (pipelines, redirection, expansion, quoting the tokenizer refuses, …) are\n\t// exactly the grammar the Python engine owns; with the engine off this is the original\n\t// fail-closed floor verbatim.\n\tif (!tokenized.ok || !tokenized.argv) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn { kind: \"unsupported\", error: tokenized.error ?? UNSUPPORTED_OPERATOR_MESSAGE };\n\t}\n\n\tconst argv = tokenized.argv;\n\tconst commandName = argv[0].toLowerCase();\n\n\t// Inline env assignments (`NAME=value [cmd]`) are a state-mutating/expansion form the engine\n\t// supports (§2.1); with the engine off this is the original fail-closed floor verbatim.\n\tif (/^[A-Za-z_][A-Za-z0-9_]*=/u.test(argv[0])) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"Inline environment assignments are not supported. Configure the environment outside the shell command.\",\n\t\t};\n\t}\n\n\t// State mutators and controlled exit route to the engine unconditionally when enabled: the\n\t// engine is the sole state owner and must frame `exit` instead of terminating the PS backend.\n\tif (ENGINE_OWNED_BUILTINS.has(commandName)) {\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\tif (commandName === \"exit\") {\n\t\t\treturn {\n\t\t\t\tkind: \"unsupported\",\n\t\t\t\terror: \"The Bash-like 'exit' builtin requires the Windows Python shell engine so Pi can preserve its terminal result protocol.\",\n\t\t\t};\n\t\t}\n\t}\n\n\tif (BLOCKED_NESTED_SHELLS.has(commandName)) {\n\t\tconst powershellGuidance = [\"powershell\", \"powershell.exe\", \"pwsh\", \"pwsh.exe\"].includes(commandName)\n\t\t\t? \" Invoke the .ps1 path directly with its arguments, without powershell.exe -File or pwsh -File.\"\n\t\t\t: \" Invoke the target executable or supported script directly.\";\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: `Nested shell execution is not supported by the Windows shell contract router.${powershellGuidance}`,\n\t\t};\n\t}\n\tconst builtIn = routeBuiltIn(argv);\n\tif (builtIn) return { kind: \"powershell\", command: builtIn, argv };\n\tif (ROUTED_BUILTIN_NAMES.has(commandName)) {\n\t\t// The PS floor rejected the FORM (flags/argument shape); the engine supports the fuller\n\t\t// flag set for the same builtin (§2.2).\n\t\tif (pythonEngine) return { kind: \"python-engine\", command };\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: `Unsupported ${argv[0]} form on Windows. Use a simpler Bash-like form or Pi's dedicated read/search/edit tools.`,\n\t\t};\n\t}\n\tif (commandName.endsWith(\".sh\") || commandName.includes(\"/bin/\")) {\n\t\treturn {\n\t\t\tkind: \"unsupported\",\n\t\t\terror: \"POSIX shell scripts are not supported by the Windows shell contract router.\",\n\t\t};\n\t}\n\treturn { kind: \"powershell\", command: externalCommand(argv), argv };\n}\n"]}

package/dist/core/tools/shell-execution-session.d.ts

@@ -0,0 +1,4 @@
+/** One production lifecycle boundary for every process/state resource owned by a shell session. */
+/** Idempotently dispose both execution tiers and their shared authoritative Windows state. */
+export declare function disposeShellExecutionSession(sessionKey: string): void;
+//# sourceMappingURL=shell-execution-session.d.ts.map

package/dist/core/tools/shell-execution-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-execution-session.d.ts","sourceRoot":"","sources":["../../../src/core/tools/shell-execution-session.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAMnG,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAIrE"}

package/dist/core/tools/shell-execution-session.js

@@ -0,0 +1,11 @@
+/** One production lifecycle boundary for every process/state resource owned by a shell session. */
+import { disposePersistentShellSession } from "./shell-session.js";
+import { disposeWindowsShellEngineSession } from "./windows-shell-engine.js";
+import { disposeWindowsShellState } from "./windows-shell-state.js";
+/** Idempotently dispose both execution tiers and their shared authoritative Windows state. */
+export function disposeShellExecutionSession(sessionKey) {
+    disposeWindowsShellEngineSession(sessionKey);
+    disposePersistentShellSession(sessionKey);
+    disposeWindowsShellState(sessionKey);
+}
+//# sourceMappingURL=shell-execution-session.js.map

package/dist/core/tools/shell-execution-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-execution-session.js","sourceRoot":"","sources":["../../../src/core/tools/shell-execution-session.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAEnG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,8FAA8F;AAC9F,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC9D,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAC7C,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC1C,wBAAwB,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/** One production lifecycle boundary for every process/state resource owned by a shell session. */\n\nimport { disposePersistentShellSession } from \"./shell-session.ts\";\nimport { disposeWindowsShellEngineSession } from \"./windows-shell-engine.ts\";\nimport { disposeWindowsShellState } from \"./windows-shell-state.ts\";\n\n/** Idempotently dispose both execution tiers and their shared authoritative Windows state. */\nexport function disposeShellExecutionSession(sessionKey: string): void {\n\tdisposeWindowsShellEngineSession(sessionKey);\n\tdisposePersistentShellSession(sessionKey);\n\tdisposeWindowsShellState(sessionKey);\n}\n"]}