@caupulican/pi-adaptative 0.86.1 → 0.86.2

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [0.86.2] - 2026-08-06
+
+### Fixed
+
+- Aligned memory state sidecar paths with the `managedMemoryStateFile` SSOT, preventing root-level `.pi-managed.json` file generation beside `MEMORY.md` / `USER.md`.
+- Enhanced `migrateAgentDirLayout` to automatically discover and migrate unexpected root files and folders under `~/.pi/agent/` to their canonical `state/` directories.
+- Relaxed `wrapToolWithCredentialExposureGuard` to execute tool calls without upfront blocking errors on search or Python scope heuristics, relying on redacting loaded secrets from tool results instead.
+
 ## [0.86.1] - 2026-08-05
 
 ### Fixed

package/dist/core/agent-paths.d.ts

@@ -13,6 +13,9 @@ export declare function okfMemoryDir(agentDir: string): string;
 export declare function stateDir(agentDir: string): string;
 /** `<agentDir>/state/<segments…>` */
 export declare function stateFile(agentDir: string, ...segments: string[]): string;
+export type ManagedMemoryFileName = "MEMORY.md" | "USER.md";
+/** `<agentDir>/state/memory/file-store/<name>.pi-managed.json` -- file-store ownership metadata. */
+export declare function managedMemoryStateFile(agentDir: string, name: ManagedMemoryFileName): string;
 /** `<agentDir>/state/attachments` -- bounded, session-keyed clipboard image attachments. */
 export declare function attachmentsDir(agentDir: string): string;
 /** Retired local-secret state root. Current credential storage is provider-backed and never writes here. */

package/dist/core/agent-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-paths.d.ts","sourceRoot":"","sources":["../../src/core/agent-paths.ts"],"names":[],"mappings":"AAwCA,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,YACjC,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,SAAS,EACT,WAAW,EACX,kBAAkB,CACT,CAAC;AAEX,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,YACtC,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,OAAO,EACP,OAAO,EACP,KAAK,EACL,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,CACF,CAAC;AAIX,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,4GAA4G;AAC5G,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,2GAA2G;AAC3G,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAEzE;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,4GAA4G;AAC5G,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,kGAAkG;AAClG,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAEzE;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,uEAAuE;AACvE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED,6GAA6G;AAC7G,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAE/F;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS7G;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS9G;AAED,wDAAwD;AACxD,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,gEAAgE;AAChE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;AAE5F,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;GAKG;AACH,OAAO,EACN,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,eAAe,GACf,CAAC;AACF,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE5G;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,iCAA2B,CAAC"}
+{"version":3,"file":"agent-paths.d.ts","sourceRoot":"","sources":["../../src/core/agent-paths.ts"],"names":[],"mappings":"AAwCA,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAGhE,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,YACjC,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,SAAS,EACT,WAAW,EACX,kBAAkB,CACT,CAAC;AAEX,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,YACtC,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,UAAU,EACV,OAAO,EACP,OAAO,EACP,KAAK,EACL,MAAM,EACN,UAAU,EACV,QAAQ,EACR,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,CACF,CAAC;AAIX,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,4GAA4G;AAC5G,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,2GAA2G;AAC3G,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAEzE;AAED,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE5D,oGAAoG;AACpG,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAK5F;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,4GAA4G;AAC5G,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,kGAAkG;AAClG,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,qCAAqC;AACrC,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAEzE;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAG7E;AAED,uEAAuE;AACvE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,6GAA6G;AAC7G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,2FAA2F;AAC3F,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED,6GAA6G;AAC7G,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAE/F;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS7G;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS9G;AAED,wDAAwD;AACxD,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,gEAAgE;AAChE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,CAAC;AAE5F,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;GAKG;AACH,OAAO,EACN,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,eAAe,GACf,CAAC;AACF,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE5G;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,iCAA2B,CAAC"}

package/dist/core/agent-paths.js

@@ -91,6 +91,13 @@ export function stateDir(agentDir) {
 export function stateFile(agentDir, ...segments) {
     return join(stateDir(agentDir), ...segments);
 }
+/** `<agentDir>/state/memory/file-store/<name>.pi-managed.json` -- file-store ownership metadata. */
+export function managedMemoryStateFile(agentDir, name) {
+    if (name !== "MEMORY.md" && name !== "USER.md") {
+        throw new TypeError(`Unsupported managed memory file name: ${name}`);
+    }
+    return stateFile(agentDir, "memory", "file-store", `${name}.pi-managed.json`);
+}
 /** `<agentDir>/state/attachments` -- bounded, session-keyed clipboard image attachments. */
 export function attachmentsDir(agentDir) {
     return stateFile(agentDir, "attachments");

package/dist/core/agent-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-paths.js","sourceRoot":"","sources":["../../src/core/agent-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,WAAW;IACX,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,SAAS;IACT,WAAW;IACX,kBAAkB;CACT,CAAC;AAEX,oFAAoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,OAAO;IACP,OAAO;IACP,KAAK;IACL,MAAM;IACN,UAAU;IACV,QAAQ;IACR,UAAU;IACV,KAAK;IACL,KAAK;IACL,WAAW;CACF,CAAC;AAEX,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,qBAAqB,EAAE,GAAG,0BAA0B,CAAC,CAAC,CAAC;AAE1G,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACrD,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,IAAY;IACxD,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACxC,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAG,QAAkB;IAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC9C,OAAO,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,UAAU,CAAC,QAAgB;IAC1C,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAiB;IACpE,yBAAyB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAChD,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACxC,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAG,QAAkB;IAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAiB;IACpE,yBAAyB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,MAAM,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB;IACzD,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,QAAgB;IACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB,CAAC,eAAuB;IACvD,MAAM,UAAU,GAAG,yBAAyB,CAAC,eAAe,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,QAAQ,GACb,kBAAkB,CAAC,UAAU,CAAC;SAC5B,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QACrB,yFAAyF;QACzF,8FAA8F;SAC7F,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACpC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACxD,OAAO,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,eAAuB;IAChF,OAAO,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,eAAe,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,eAAuB;IACnF,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgB,EAAE,eAAuB;IACtF,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,eAAuB,EAAE,WAAmB;IACpG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,yEAAyE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CACV,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAClD,kBAAkB,EAClB,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,CACnC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,eAAuB,EAAE,WAAmB;IACrG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CACV,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAClD,gBAAgB,EAChB,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,CACnC,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,MAAM,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,MAAM,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAID,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,QAAgB;IACpE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACpD,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,OAAO,EACN,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,eAAe,GACf,CAAC;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC","sourcesContent":["/**\n * Typed path SSOT for everything machine-managed under `<agentDir>` (`~/.pi/agent/` by default,\n * `getAgentDir()` in `../config.ts`). Every writer that persists machine data (stores, caches, managed\n * runtimes/models, cross-process coordination) MUST resolve its path through one of the accessors\n * below instead of hand-rolling `join(agentDir, …)` — that ad-hoc pattern is exactly how root-level\n * stragglers like `trust.json` accumulated, and nothing stopped the next writer from doing it again.\n *\n * Canonical layout:\n * ```\n * <agentDir>/\n *   auth.json settings.json models.json keybindings.json MEMORY.md USER.md SYSTEM.md …   user CONFIG/MEMORY (root, kept)\n *   okf-memory/                                                                            authored memory (root, kept)\n *   skills/ extensions/ prompts/ themes/ profiles/                                        user RESOURCES (root, kept)\n *     profiles/directories/<workspace-hash>/settings.json                                 directory overlays\n *   state/     durable machine state (model adaptation/fitness, tool performance,\n *              learning observations, trust decisions, config backups, …)                 -- stateDir/stateFile\n *   cache/     rebuildable, safe to delete (tool-path probes, jiti transform cache, uv)    -- cacheDir/cacheFile\n *   work/      transient/scratch, delegated to work-directory.ts (tenant/run/lease),\n *              including context/sessions/<session-id>/{gc,artifacts}                     -- re-exported below\n *   runtimes/<kind>  models/<kind>                                                         -- runtimesDir/modelsDir\n *   npm/ git/ sessions/                                                                    -- npmDir/gitDir/sessionsDir\n *   state/orchestration/sessions/<session-key>/                                             -- one foreground-session-owned\n *                                                                                            control-plane bundle\n *   worktrees/<repo-slug>/<laneKey>   durable lane checkouts (core/worktree-sync)           -- worktreesDir\n * ```\n *\n * Every accessor takes `agentDir` as an explicit, required first argument -- deliberately mirroring\n * `work-directory.ts`'s existing `getWorkRoot(agentDir)` convention rather than defaulting to\n * `getAgentDir()` internally. Several real callers (stores' `forAgentDir`, test harnesses with a temp\n * agentDir) build paths for a NON-default agentDir; a hidden default would silently resolve the wrong\n * root for those callers instead of failing loudly. Callers operating on the process-wide default pass\n * `getAgentDir()` explicitly at the call site.\n *\n * These accessors are pure path builders -- no directory creation, no I/O. Every existing writer\n * already creates its parent directory at write time (see `util/atomic-file.ts`'s\n * `mkdirSync(dirname(filePath), { recursive: true })`), so duplicating that here would be redundant\n * and would blur the \"pure function\" contract readers rely on.\n */\nimport { createHash } from \"node:crypto\";\nimport { join } from \"node:path\";\nimport {\n\tacquireWorkRun,\n\tassertPortablePathSegment,\n\tboundedWorkRetention,\n\tcreateWorkRunId,\n\tgetProcessWorkRun,\n\tgetWorkRoot,\n\tgetWorkRunDir,\n\tgetWorkTenantDir,\n\thasActiveWorkRunLease,\n\tpruneWorkTenant,\n} from \"../utils/work-directory.ts\";\nimport { getReloadCoordinationDir } from \"./reload-blockers.ts\";\nimport { requireBoundedTrimmedText } from \"./util/bounded-value.ts\";\n\n/** Root entries reserved for user-authored configuration and memory. */\nexport const AGENT_ROOT_FILE_NAMES = [\n\t\"auth.json\",\n\t\"settings.json\",\n\t\"models.json\",\n\t\"keybindings.json\",\n\t\"MEMORY.md\",\n\t\"USER.md\",\n\t\"SYSTEM.md\",\n\t\"APPEND_SYSTEM.md\",\n] as const;\n\n/** Root entries reserved for user resources and machine-managed storage classes. */\nexport const AGENT_ROOT_DIRECTORY_NAMES = [\n\t\"okf-memory\",\n\t\"skills\",\n\t\"extensions\",\n\t\"prompts\",\n\t\"themes\",\n\t\"profiles\",\n\t\"state\",\n\t\"cache\",\n\t\"bin\",\n\t\"work\",\n\t\"runtimes\",\n\t\"models\",\n\t\"sessions\",\n\t\"npm\",\n\t\"git\",\n\t\"worktrees\",\n] as const;\n\nconst AGENT_ROOT_ENTRY_NAMES = new Set<string>([...AGENT_ROOT_FILE_NAMES, ...AGENT_ROOT_DIRECTORY_NAMES]);\n\nexport function isCanonicalAgentRootEntry(name: string): boolean {\n\treturn AGENT_ROOT_ENTRY_NAMES.has(name);\n}\n\n/** `<agentDir>/<name>` -- a root-level user config/memory file (auth.json, settings.json, MEMORY.md, …). */\nexport function configFile(agentDir: string, name: string): string {\n\treturn join(agentDir, name);\n}\n\n/** `<agentDir>/okf-memory` -- user-authored durable OKF memory documents. */\nexport function okfMemoryDir(agentDir: string): string {\n\treturn join(agentDir, \"okf-memory\");\n}\n\n/** `<agentDir>/state` -- durable machine-managed state. Deleting it loses real history, not just cache. */\nexport function stateDir(agentDir: string): string {\n\treturn join(agentDir, \"state\");\n}\n\n/** `<agentDir>/state/<segments…>` */\nexport function stateFile(agentDir: string, ...segments: string[]): string {\n\treturn join(stateDir(agentDir), ...segments);\n}\n\n/** `<agentDir>/state/attachments` -- bounded, session-keyed clipboard image attachments. */\nexport function attachmentsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"attachments\");\n}\n\n/** Retired local-secret state root. Current credential storage is provider-backed and never writes here. */\nexport function secretsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"secrets\");\n}\n\n/** Retired local vault path retained only so model-facing file access stays denied. */\nexport function secretVaultFile(agentDir: string): string {\n\treturn join(secretsDir(agentDir), \"vault.json\");\n}\n\n/** Retired plaintext materialization root retained only so model-facing file access stays denied. */\nexport function managedSecretEnvDir(agentDir: string): string {\n\treturn join(secretsDir(agentDir), \"materialized\");\n}\n\n/** `<agentDir>/state/extensions/<namespace>` -- durable state owned by one extension. */\nexport function extensionStateDir(agentDir: string, namespace: string): string {\n\tassertPortablePathSegment(\"Extension namespace\", namespace);\n\treturn stateFile(agentDir, \"extensions\", namespace);\n}\n\n/** `<agentDir>/state/backups/config` -- explicit user-requested configuration snapshots. */\nexport function configBackupsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"backups\", \"config\");\n}\n\n/** `<agentDir>/cache` -- rebuildable; safe to delete (the next run just re-probes/recomputes). */\nexport function cacheDir(agentDir: string): string {\n\treturn join(agentDir, \"cache\");\n}\n\n/** `<agentDir>/cache/<segments…>` */\nexport function cacheFile(agentDir: string, ...segments: string[]): string {\n\treturn join(cacheDir(agentDir), ...segments);\n}\n\n/** `<agentDir>/cache/extensions/<namespace>` -- rebuildable cache owned by one extension. */\nexport function extensionCacheDir(agentDir: string, namespace: string): string {\n\tassertPortablePathSegment(\"Extension namespace\", namespace);\n\treturn cacheFile(agentDir, \"extensions\", namespace);\n}\n\n/** `<agentDir>/bin` -- managed executable helpers (fd, rg, jq, uv). */\nexport function binDir(agentDir: string): string {\n\treturn join(agentDir, \"bin\");\n}\n\n/** `<agentDir>/runtimes/<kind>` -- a managed runtime install (ollama, python, prism-llamacpp, needle, …). */\nexport function runtimesDir(kind: string, agentDir: string): string {\n\treturn join(agentDir, \"runtimes\", kind);\n}\n\n/** `<agentDir>/models/<kind>` -- downloaded model weights, grouped by provider/runtime. */\nexport function modelsDir(kind: string, agentDir: string): string {\n\treturn join(agentDir, \"models\", kind);\n}\n\n/** `<agentDir>/sessions` -- session transcript storage (large, established; not a \"loose file\"). */\nexport function sessionsDir(agentDir: string): string {\n\treturn join(agentDir, \"sessions\");\n}\n\nfunction orchestrationSessionKey(parentSessionId: string): string {\n\tconst normalized = requireBoundedTrimmedText(parentSessionId, 512, \"Parent session id\");\n\tconst readable =\n\t\tencodeURIComponent(normalized)\n\t\t\t.replaceAll(\"%\", \"_\")\n\t\t\t// encodeURIComponent deliberately leaves `*` unescaped, but Windows forbids it in paths.\n\t\t\t// Restrict the readable prefix to a portable ASCII subset; the digest retains exact identity.\n\t\t\t.replaceAll(/[^a-zA-Z0-9._~-]/g, \"_\")\n\t\t\t.slice(0, 80) || \"session\";\n\tconst digest = createHash(\"sha256\").update(normalized).digest(\"hex\").slice(0, 16);\n\treturn `${readable}-${digest}`;\n}\n\n/**\n * `<agentDir>/state/orchestration/sessions/<session-key>` -- the one durable control-plane\n * bundle owned by a foreground session. Event state, worker mailboxes, mutation journals, and\n * worker transcripts must stay beneath this boundary so explicit session deletion can remove\n * exactly its companion artifacts without scanning global state.\n */\nexport function orchestrationSessionsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"orchestration\", \"sessions\");\n}\n\n/**\n * `<agentDir>/state/orchestration/sessions/<session-key>` -- the one durable control-plane\n * bundle owned by a foreground session.\n */\nexport function orchestrationSessionDir(agentDir: string, parentSessionId: string): string {\n\treturn join(orchestrationSessionsDir(agentDir), orchestrationSessionKey(parentSessionId));\n}\n\n/** `<orchestrationSessionDir>/events` -- append-only event tail, snapshot, cursor, and idempotency state. */\nexport function orchestrationEventStoreDir(agentDir: string, parentSessionId: string): string {\n\treturn join(orchestrationSessionDir(agentDir, parentSessionId), \"events\");\n}\n\n/**\n * `<orchestrationSessionDir>/worker-conversations` -- durable Pi worker transcripts owned by one\n * foreground session. Worker conversations remain in SessionManager's established JSONL format,\n * but are intentionally outside the foreground session picker namespace.\n */\nexport function workerConversationSessionsDir(agentDir: string, parentSessionId: string): string {\n\treturn join(orchestrationSessionDir(agentDir, parentSessionId), \"worker-conversations\");\n}\n\n/**\n * `<orchestrationSessionDir>/worker-mailboxes/<scope-digest>.json` -- durable bounded control\n * messages for one logical worker. Identity stays hashed so neither agent ids nor project paths\n * become path segments.\n */\nexport function workerAgentMailboxFile(agentDir: string, parentSessionId: string, scopeDigest: string): string {\n\tif (!/^[a-f0-9]{32,64}$/i.test(scopeDigest)) {\n\t\tthrow new TypeError(\"Worker agent mailbox scope digest must be a hexadecimal SHA-256 prefix.\");\n\t}\n\treturn join(\n\t\torchestrationSessionDir(agentDir, parentSessionId),\n\t\t\"worker-mailboxes\",\n\t\t`${scopeDigest.toLowerCase()}.json`,\n\t);\n}\n\n/**\n * `<orchestrationSessionDir>/worker-actions/<scope-digest>.json` -- durable, bounded mutation\n * intents and receipts for one fenced worker attempt. The opaque digest intentionally keeps task\n * identifiers out of filesystem path segments and works on Windows and WSL.\n */\nexport function workerActionJournalFile(agentDir: string, parentSessionId: string, scopeDigest: string): string {\n\tif (!/^[a-f0-9]{32,64}$/i.test(scopeDigest)) {\n\t\tthrow new TypeError(\"Worker action journal scope digest must be a hexadecimal SHA-256 prefix.\");\n\t}\n\treturn join(\n\t\torchestrationSessionDir(agentDir, parentSessionId),\n\t\t\"worker-actions\",\n\t\t`${scopeDigest.toLowerCase()}.json`,\n\t);\n}\n\n/** `<agentDir>/npm` -- managed npm package installs. */\nexport function npmDir(agentDir: string): string {\n\treturn join(agentDir, \"npm\");\n}\n\n/**\n * `<agentDir>/worktrees` -- lane worktree checkouts for the worktree-sync subsystem\n * (`core/worktree-sync/`), grouped as `worktrees/<repo-slug>/<laneKey>`. These hold REAL\n * uncommitted agent work, so they are durable like `state/` -- never under transient `work/`,\n * whose retention would silently eat in-progress code.\n */\nexport function worktreesDir(agentDir: string): string {\n\treturn join(agentDir, \"worktrees\");\n}\n\n/** `<agentDir>/git` -- managed git-sourced package installs. */\nexport function gitDir(agentDir: string): string {\n\treturn join(agentDir, \"git\");\n}\n\nexport type AgentResourceKind = \"skills\" | \"prompts\" | \"themes\" | \"extensions\" | \"profiles\";\n\n/** `<agentDir>/<kind>` -- a user-managed resource directory. Root, kept: moving it breaks users. */\nexport function resourceDir(kind: AgentResourceKind, agentDir: string): string {\n\treturn join(agentDir, kind);\n}\n\n/** `<agentDir>/profiles/directories` -- durable per-directory resource-profile overlays. */\nexport function directoryProfilesDir(agentDir: string): string {\n\treturn join(resourceDir(\"profiles\", agentDir), \"directories\");\n}\n\n/**\n * `work/` is a mature transient/scratch root with its own tenant/run/lease/retention machinery\n * (`utils/work-directory.ts`). The SSOT delegates to it wholesale instead of reimplementing -- these\n * are straight re-exports so every category (state/cache/work/runtimes/models/…) is reachable from one\n * module without duplicating `work-directory.ts`'s logic.\n */\nexport {\n\tgetWorkRoot,\n\tassertPortablePathSegment,\n\tboundedWorkRetention,\n\tgetWorkTenantDir,\n\tgetWorkRunDir,\n\tgetProcessWorkRun,\n\thasActiveWorkRunLease,\n\tacquireWorkRun,\n\tcreateWorkRunId,\n\tpruneWorkTenant,\n};\nexport type { AcquireWorkRunOptions, WorkRetentionOptions, WorkRunLease } from \"../utils/work-directory.ts\";\n\n/**\n * `work/reload-coordination` -- cross-process reload/live-op coordination state. Already correctly\n * work-scoped (defined in `reload-blockers.ts`, its natural home given the surrounding reload-gate\n * logic there); re-exported here under the taxonomy's canonical name for SSOT discoverability.\n */\nexport const reloadCoordinationDir = getReloadCoordinationDir;\n"]}
+{"version":3,"file":"agent-paths.js","sourceRoot":"","sources":["../../src/core/agent-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACN,cAAc,EACd,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,WAAW;IACX,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,SAAS;IACT,WAAW;IACX,kBAAkB;CACT,CAAC;AAEX,oFAAoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,OAAO;IACP,OAAO;IACP,KAAK;IACL,MAAM;IACN,UAAU;IACV,QAAQ;IACR,UAAU;IACV,KAAK;IACL,KAAK;IACL,WAAW;CACF,CAAC;AAEX,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,qBAAqB,EAAE,GAAG,0BAA0B,CAAC,CAAC,CAAC;AAE1G,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACrD,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,IAAY;IACxD,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACrC,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACxC,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAG,QAAkB;IAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAID,oGAAoG;AACpG,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,IAA2B;IACnF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,kBAAkB,CAAC,CAAC;AAC/E,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC9C,OAAO,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,UAAU,CAAC,QAAgB;IAC1C,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAiB;IACpE,yBAAyB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAChD,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACxC,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAG,QAAkB;IAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAiB;IACpE,yBAAyB,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,MAAM,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB;IACzD,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,QAAgB;IACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB,CAAC,eAAuB;IACvD,MAAM,UAAU,GAAG,yBAAyB,CAAC,eAAe,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,QAAQ,GACb,kBAAkB,CAAC,UAAU,CAAC;SAC5B,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;QACrB,yFAAyF;QACzF,8FAA8F;SAC7F,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACpC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACxD,OAAO,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,eAAuB;IAChF,OAAO,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,eAAe,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,eAAuB;IACnF,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgB,EAAE,eAAuB;IACtF,OAAO,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,eAAuB,EAAE,WAAmB;IACpG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,yEAAyE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CACV,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAClD,kBAAkB,EAClB,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,CACnC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,eAAuB,EAAE,WAAmB;IACrG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CACV,uBAAuB,CAAC,QAAQ,EAAE,eAAe,CAAC,EAClD,gBAAgB,EAChB,GAAG,WAAW,CAAC,WAAW,EAAE,OAAO,CACnC,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,MAAM,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,MAAM,CAAC,QAAgB;IACtC,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAID,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,QAAgB;IACpE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACpD,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,OAAO,EACN,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,eAAe,GACf,CAAC;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC","sourcesContent":["/**\n * Typed path SSOT for everything machine-managed under `<agentDir>` (`~/.pi/agent/` by default,\n * `getAgentDir()` in `../config.ts`). Every writer that persists machine data (stores, caches, managed\n * runtimes/models, cross-process coordination) MUST resolve its path through one of the accessors\n * below instead of hand-rolling `join(agentDir, …)` — that ad-hoc pattern is exactly how root-level\n * stragglers like `trust.json` accumulated, and nothing stopped the next writer from doing it again.\n *\n * Canonical layout:\n * ```\n * <agentDir>/\n *   auth.json settings.json models.json keybindings.json MEMORY.md USER.md SYSTEM.md …   user CONFIG/MEMORY (root, kept)\n *   okf-memory/                                                                            authored memory (root, kept)\n *   skills/ extensions/ prompts/ themes/ profiles/                                        user RESOURCES (root, kept)\n *     profiles/directories/<workspace-hash>/settings.json                                 directory overlays\n *   state/     durable machine state (model adaptation/fitness, tool performance,\n *              learning observations, trust decisions, config backups, …)                 -- stateDir/stateFile\n *   cache/     rebuildable, safe to delete (tool-path probes, jiti transform cache, uv)    -- cacheDir/cacheFile\n *   work/      transient/scratch, delegated to work-directory.ts (tenant/run/lease),\n *              including context/sessions/<session-id>/{gc,artifacts}                     -- re-exported below\n *   runtimes/<kind>  models/<kind>                                                         -- runtimesDir/modelsDir\n *   npm/ git/ sessions/                                                                    -- npmDir/gitDir/sessionsDir\n *   state/orchestration/sessions/<session-key>/                                             -- one foreground-session-owned\n *                                                                                            control-plane bundle\n *   worktrees/<repo-slug>/<laneKey>   durable lane checkouts (core/worktree-sync)           -- worktreesDir\n * ```\n *\n * Every accessor takes `agentDir` as an explicit, required first argument -- deliberately mirroring\n * `work-directory.ts`'s existing `getWorkRoot(agentDir)` convention rather than defaulting to\n * `getAgentDir()` internally. Several real callers (stores' `forAgentDir`, test harnesses with a temp\n * agentDir) build paths for a NON-default agentDir; a hidden default would silently resolve the wrong\n * root for those callers instead of failing loudly. Callers operating on the process-wide default pass\n * `getAgentDir()` explicitly at the call site.\n *\n * These accessors are pure path builders -- no directory creation, no I/O. Every existing writer\n * already creates its parent directory at write time (see `util/atomic-file.ts`'s\n * `mkdirSync(dirname(filePath), { recursive: true })`), so duplicating that here would be redundant\n * and would blur the \"pure function\" contract readers rely on.\n */\nimport { createHash } from \"node:crypto\";\nimport { join } from \"node:path\";\nimport {\n\tacquireWorkRun,\n\tassertPortablePathSegment,\n\tboundedWorkRetention,\n\tcreateWorkRunId,\n\tgetProcessWorkRun,\n\tgetWorkRoot,\n\tgetWorkRunDir,\n\tgetWorkTenantDir,\n\thasActiveWorkRunLease,\n\tpruneWorkTenant,\n} from \"../utils/work-directory.ts\";\nimport { getReloadCoordinationDir } from \"./reload-blockers.ts\";\nimport { requireBoundedTrimmedText } from \"./util/bounded-value.ts\";\n\n/** Root entries reserved for user-authored configuration and memory. */\nexport const AGENT_ROOT_FILE_NAMES = [\n\t\"auth.json\",\n\t\"settings.json\",\n\t\"models.json\",\n\t\"keybindings.json\",\n\t\"MEMORY.md\",\n\t\"USER.md\",\n\t\"SYSTEM.md\",\n\t\"APPEND_SYSTEM.md\",\n] as const;\n\n/** Root entries reserved for user resources and machine-managed storage classes. */\nexport const AGENT_ROOT_DIRECTORY_NAMES = [\n\t\"okf-memory\",\n\t\"skills\",\n\t\"extensions\",\n\t\"prompts\",\n\t\"themes\",\n\t\"profiles\",\n\t\"state\",\n\t\"cache\",\n\t\"bin\",\n\t\"work\",\n\t\"runtimes\",\n\t\"models\",\n\t\"sessions\",\n\t\"npm\",\n\t\"git\",\n\t\"worktrees\",\n] as const;\n\nconst AGENT_ROOT_ENTRY_NAMES = new Set<string>([...AGENT_ROOT_FILE_NAMES, ...AGENT_ROOT_DIRECTORY_NAMES]);\n\nexport function isCanonicalAgentRootEntry(name: string): boolean {\n\treturn AGENT_ROOT_ENTRY_NAMES.has(name);\n}\n\n/** `<agentDir>/<name>` -- a root-level user config/memory file (auth.json, settings.json, MEMORY.md, …). */\nexport function configFile(agentDir: string, name: string): string {\n\treturn join(agentDir, name);\n}\n\n/** `<agentDir>/okf-memory` -- user-authored durable OKF memory documents. */\nexport function okfMemoryDir(agentDir: string): string {\n\treturn join(agentDir, \"okf-memory\");\n}\n\n/** `<agentDir>/state` -- durable machine-managed state. Deleting it loses real history, not just cache. */\nexport function stateDir(agentDir: string): string {\n\treturn join(agentDir, \"state\");\n}\n\n/** `<agentDir>/state/<segments…>` */\nexport function stateFile(agentDir: string, ...segments: string[]): string {\n\treturn join(stateDir(agentDir), ...segments);\n}\n\nexport type ManagedMemoryFileName = \"MEMORY.md\" | \"USER.md\";\n\n/** `<agentDir>/state/memory/file-store/<name>.pi-managed.json` -- file-store ownership metadata. */\nexport function managedMemoryStateFile(agentDir: string, name: ManagedMemoryFileName): string {\n\tif (name !== \"MEMORY.md\" && name !== \"USER.md\") {\n\t\tthrow new TypeError(`Unsupported managed memory file name: ${name}`);\n\t}\n\treturn stateFile(agentDir, \"memory\", \"file-store\", `${name}.pi-managed.json`);\n}\n\n/** `<agentDir>/state/attachments` -- bounded, session-keyed clipboard image attachments. */\nexport function attachmentsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"attachments\");\n}\n\n/** Retired local-secret state root. Current credential storage is provider-backed and never writes here. */\nexport function secretsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"secrets\");\n}\n\n/** Retired local vault path retained only so model-facing file access stays denied. */\nexport function secretVaultFile(agentDir: string): string {\n\treturn join(secretsDir(agentDir), \"vault.json\");\n}\n\n/** Retired plaintext materialization root retained only so model-facing file access stays denied. */\nexport function managedSecretEnvDir(agentDir: string): string {\n\treturn join(secretsDir(agentDir), \"materialized\");\n}\n\n/** `<agentDir>/state/extensions/<namespace>` -- durable state owned by one extension. */\nexport function extensionStateDir(agentDir: string, namespace: string): string {\n\tassertPortablePathSegment(\"Extension namespace\", namespace);\n\treturn stateFile(agentDir, \"extensions\", namespace);\n}\n\n/** `<agentDir>/state/backups/config` -- explicit user-requested configuration snapshots. */\nexport function configBackupsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"backups\", \"config\");\n}\n\n/** `<agentDir>/cache` -- rebuildable; safe to delete (the next run just re-probes/recomputes). */\nexport function cacheDir(agentDir: string): string {\n\treturn join(agentDir, \"cache\");\n}\n\n/** `<agentDir>/cache/<segments…>` */\nexport function cacheFile(agentDir: string, ...segments: string[]): string {\n\treturn join(cacheDir(agentDir), ...segments);\n}\n\n/** `<agentDir>/cache/extensions/<namespace>` -- rebuildable cache owned by one extension. */\nexport function extensionCacheDir(agentDir: string, namespace: string): string {\n\tassertPortablePathSegment(\"Extension namespace\", namespace);\n\treturn cacheFile(agentDir, \"extensions\", namespace);\n}\n\n/** `<agentDir>/bin` -- managed executable helpers (fd, rg, jq, uv). */\nexport function binDir(agentDir: string): string {\n\treturn join(agentDir, \"bin\");\n}\n\n/** `<agentDir>/runtimes/<kind>` -- a managed runtime install (ollama, python, prism-llamacpp, needle, …). */\nexport function runtimesDir(kind: string, agentDir: string): string {\n\treturn join(agentDir, \"runtimes\", kind);\n}\n\n/** `<agentDir>/models/<kind>` -- downloaded model weights, grouped by provider/runtime. */\nexport function modelsDir(kind: string, agentDir: string): string {\n\treturn join(agentDir, \"models\", kind);\n}\n\n/** `<agentDir>/sessions` -- session transcript storage (large, established; not a \"loose file\"). */\nexport function sessionsDir(agentDir: string): string {\n\treturn join(agentDir, \"sessions\");\n}\n\nfunction orchestrationSessionKey(parentSessionId: string): string {\n\tconst normalized = requireBoundedTrimmedText(parentSessionId, 512, \"Parent session id\");\n\tconst readable =\n\t\tencodeURIComponent(normalized)\n\t\t\t.replaceAll(\"%\", \"_\")\n\t\t\t// encodeURIComponent deliberately leaves `*` unescaped, but Windows forbids it in paths.\n\t\t\t// Restrict the readable prefix to a portable ASCII subset; the digest retains exact identity.\n\t\t\t.replaceAll(/[^a-zA-Z0-9._~-]/g, \"_\")\n\t\t\t.slice(0, 80) || \"session\";\n\tconst digest = createHash(\"sha256\").update(normalized).digest(\"hex\").slice(0, 16);\n\treturn `${readable}-${digest}`;\n}\n\n/**\n * `<agentDir>/state/orchestration/sessions/<session-key>` -- the one durable control-plane\n * bundle owned by a foreground session. Event state, worker mailboxes, mutation journals, and\n * worker transcripts must stay beneath this boundary so explicit session deletion can remove\n * exactly its companion artifacts without scanning global state.\n */\nexport function orchestrationSessionsDir(agentDir: string): string {\n\treturn stateFile(agentDir, \"orchestration\", \"sessions\");\n}\n\n/**\n * `<agentDir>/state/orchestration/sessions/<session-key>` -- the one durable control-plane\n * bundle owned by a foreground session.\n */\nexport function orchestrationSessionDir(agentDir: string, parentSessionId: string): string {\n\treturn join(orchestrationSessionsDir(agentDir), orchestrationSessionKey(parentSessionId));\n}\n\n/** `<orchestrationSessionDir>/events` -- append-only event tail, snapshot, cursor, and idempotency state. */\nexport function orchestrationEventStoreDir(agentDir: string, parentSessionId: string): string {\n\treturn join(orchestrationSessionDir(agentDir, parentSessionId), \"events\");\n}\n\n/**\n * `<orchestrationSessionDir>/worker-conversations` -- durable Pi worker transcripts owned by one\n * foreground session. Worker conversations remain in SessionManager's established JSONL format,\n * but are intentionally outside the foreground session picker namespace.\n */\nexport function workerConversationSessionsDir(agentDir: string, parentSessionId: string): string {\n\treturn join(orchestrationSessionDir(agentDir, parentSessionId), \"worker-conversations\");\n}\n\n/**\n * `<orchestrationSessionDir>/worker-mailboxes/<scope-digest>.json` -- durable bounded control\n * messages for one logical worker. Identity stays hashed so neither agent ids nor project paths\n * become path segments.\n */\nexport function workerAgentMailboxFile(agentDir: string, parentSessionId: string, scopeDigest: string): string {\n\tif (!/^[a-f0-9]{32,64}$/i.test(scopeDigest)) {\n\t\tthrow new TypeError(\"Worker agent mailbox scope digest must be a hexadecimal SHA-256 prefix.\");\n\t}\n\treturn join(\n\t\torchestrationSessionDir(agentDir, parentSessionId),\n\t\t\"worker-mailboxes\",\n\t\t`${scopeDigest.toLowerCase()}.json`,\n\t);\n}\n\n/**\n * `<orchestrationSessionDir>/worker-actions/<scope-digest>.json` -- durable, bounded mutation\n * intents and receipts for one fenced worker attempt. The opaque digest intentionally keeps task\n * identifiers out of filesystem path segments and works on Windows and WSL.\n */\nexport function workerActionJournalFile(agentDir: string, parentSessionId: string, scopeDigest: string): string {\n\tif (!/^[a-f0-9]{32,64}$/i.test(scopeDigest)) {\n\t\tthrow new TypeError(\"Worker action journal scope digest must be a hexadecimal SHA-256 prefix.\");\n\t}\n\treturn join(\n\t\torchestrationSessionDir(agentDir, parentSessionId),\n\t\t\"worker-actions\",\n\t\t`${scopeDigest.toLowerCase()}.json`,\n\t);\n}\n\n/** `<agentDir>/npm` -- managed npm package installs. */\nexport function npmDir(agentDir: string): string {\n\treturn join(agentDir, \"npm\");\n}\n\n/**\n * `<agentDir>/worktrees` -- lane worktree checkouts for the worktree-sync subsystem\n * (`core/worktree-sync/`), grouped as `worktrees/<repo-slug>/<laneKey>`. These hold REAL\n * uncommitted agent work, so they are durable like `state/` -- never under transient `work/`,\n * whose retention would silently eat in-progress code.\n */\nexport function worktreesDir(agentDir: string): string {\n\treturn join(agentDir, \"worktrees\");\n}\n\n/** `<agentDir>/git` -- managed git-sourced package installs. */\nexport function gitDir(agentDir: string): string {\n\treturn join(agentDir, \"git\");\n}\n\nexport type AgentResourceKind = \"skills\" | \"prompts\" | \"themes\" | \"extensions\" | \"profiles\";\n\n/** `<agentDir>/<kind>` -- a user-managed resource directory. Root, kept: moving it breaks users. */\nexport function resourceDir(kind: AgentResourceKind, agentDir: string): string {\n\treturn join(agentDir, kind);\n}\n\n/** `<agentDir>/profiles/directories` -- durable per-directory resource-profile overlays. */\nexport function directoryProfilesDir(agentDir: string): string {\n\treturn join(resourceDir(\"profiles\", agentDir), \"directories\");\n}\n\n/**\n * `work/` is a mature transient/scratch root with its own tenant/run/lease/retention machinery\n * (`utils/work-directory.ts`). The SSOT delegates to it wholesale instead of reimplementing -- these\n * are straight re-exports so every category (state/cache/work/runtimes/models/…) is reachable from one\n * module without duplicating `work-directory.ts`'s logic.\n */\nexport {\n\tgetWorkRoot,\n\tassertPortablePathSegment,\n\tboundedWorkRetention,\n\tgetWorkTenantDir,\n\tgetWorkRunDir,\n\tgetProcessWorkRun,\n\thasActiveWorkRunLease,\n\tacquireWorkRun,\n\tcreateWorkRunId,\n\tpruneWorkTenant,\n};\nexport type { AcquireWorkRunOptions, WorkRetentionOptions, WorkRunLease } from \"../utils/work-directory.ts\";\n\n/**\n * `work/reload-coordination` -- cross-process reload/live-op coordination state. Already correctly\n * work-scoped (defined in `reload-blockers.ts`, its natural home given the surrounding reload-gate\n * logic there); re-exported here under the taxonomy's canonical name for SSOT discoverability.\n */\nexport const reloadCoordinationDir = getReloadCoordinationDir;\n"]}

package/dist/core/memory/providers/file-store.d.ts

@@ -17,6 +17,8 @@ export declare class FileStoreProvider implements MemoryProvider {
     private ctx?;
     private memoryFilePath;
     private userFilePath;
+    private memoryStatePath;
+    private userStatePath;
     private lastWrittenMemory;
     private lastWrittenUser;
     private userArchive?;

package/dist/core/memory/providers/file-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-store.d.ts","sourceRoot":"","sources":["../../../../src/core/memory/providers/file-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQhE,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGpF;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB3F;AAiBD,MAAM,WAAW,wBAAwB;IACxC,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,eAAO,MAAM,6BAA6B,0LAC8I,CAAC;AAgHzL,qBAAa,iBAAkB,YAAW,cAAc;IACvD,SAAgB,IAAI,gBAAgB;IACpC,SAAgB,MAAM,WAAW;IAEjC,OAAO,CAAC,GAAG,CAAC,CAAyB;IACrC,OAAO,CAAC,cAAc,CAAM;IAC5B,OAAO,CAAC,YAAY,CAAM;IAE1B,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,eAAe,CAAM;IAC7B,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAGnD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAQ;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAQ;IAE3C,YAAY,OAAO,GAAE,wBAA6B,EAEjD;IAEM,WAAW,IAAI,OAAO,CAE5B;IAEM,eAAe;QACZ,QAAQ;MACjB;IAEY,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWtF;YAEa,qBAAqB;IAkC5B,iBAAiB,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAyC5D;IAEY,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrD;IAEY,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAErC;IAEM,iBAAiB,IAAI,MAAM,EAAE,CAEnC;IAEM,kBAAkB,IAAI,cAAc,EAAE,CAmN5C;CACD"}
+{"version":3,"file":"file-store.d.ts","sourceRoot":"","sources":["../../../../src/core/memory/providers/file-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAQhE,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGpF;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB3F;AAiBD,MAAM,WAAW,wBAAwB;IACxC,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAC;CACpC;AAED,eAAO,MAAM,6BAA6B,0LAC8I,CAAC;AA4GzL,qBAAa,iBAAkB,YAAW,cAAc;IACvD,SAAgB,IAAI,gBAAgB;IACpC,SAAgB,MAAM,WAAW;IAEjC,OAAO,CAAC,GAAG,CAAC,CAAyB;IACrC,OAAO,CAAC,cAAc,CAAM;IAC5B,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,eAAe,CAAM;IAC7B,OAAO,CAAC,aAAa,CAAM;IAE3B,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,eAAe,CAAM;IAC7B,OAAO,CAAC,WAAW,CAAC,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAGnD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAQ;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAQ;IAE3C,YAAY,OAAO,GAAE,wBAA6B,EAEjD;IAEM,WAAW,IAAI,OAAO,CAE5B;IAEM,eAAe;QACZ,QAAQ;MACjB;IAEY,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAatF;YAEa,qBAAqB;IA8B5B,iBAAiB,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAyC5D;IAEY,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrD;IAEY,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAErC;IAEM,iBAAiB,IAAI,MAAM,EAAE,CAEnC;IAEM,kBAAkB,IAAI,cAAc,EAAE,CAoN5C;CACD"}

package/dist/core/memory/providers/file-store.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { Type } from "typebox";
-import { configFile } from "../../agent-paths.js";
+import { configFile, managedMemoryStateFile } from "../../agent-paths.js";
 import { hasInvisibleUnicode, scanContextFileThreats, stripInvisibleUnicode, } from "../../security/context-threat-scanner.js";
 import { jaccard, tokenize } from "../../tools/skill-audit.js";
 import { withFileLock, writeFileAtomic } from "../../util/atomic-file.js";
@@ -49,9 +49,6 @@ const memorySchema = Type.Object({
     oldContent: Type.Optional(Type.String({ description: "Exact substring to replace or remove (required for 'replace' or 'remove')" })),
 });
 export const FILE_STORE_MEMORY_SYSTEM_NOTE = "[System Note: Below is a snapshot of persistent memory. Proactively record verified reusable project facts and user preferences with the 'memory' tool; never store transient noise.]";
-function managedMemoryStatePath(filePath) {
-    return `${filePath}.pi-managed.json`;
-}
 function contentDigest(content) {
     return createHash("sha256").update(content, "utf8").digest("hex");
 }
@@ -79,9 +76,9 @@ function parseManagedMemoryState(raw) {
         ...(typeof record.pendingDigest === "string" ? { pendingDigest: record.pendingDigest } : {}),
     };
 }
-async function readManagedMemoryState(filePath) {
+async function readManagedMemoryState(statePath) {
     try {
-        const raw = await fs.readFile(managedMemoryStatePath(filePath), "utf8");
+        const raw = await fs.readFile(statePath, "utf8");
         const state = parseManagedMemoryState(raw);
         return state ? { status: "valid", state } : { status: "invalid", raw };
     }
@@ -94,8 +91,8 @@ async function readManagedMemoryState(filePath) {
 function serializeManagedMemoryState(state) {
     return `${JSON.stringify(state)}\n`;
 }
-async function writeManagedMemoryState(filePath, state) {
-    await writeFileAtomic(managedMemoryStatePath(filePath), serializeManagedMemoryState(state), { mode: 0o600 });
+async function writeManagedMemoryState(statePath, state) {
+    await writeFileAtomic(statePath, serializeManagedMemoryState(state), { mode: 0o600 });
 }
 function reconcileManagedMemoryState(currentDigest, state) {
     if (currentDigest === state.committedDigest) {
@@ -160,6 +157,8 @@ export class FileStoreProvider {
         this.egress = "local";
         this.memoryFilePath = "";
         this.userFilePath = "";
+        this.memoryStatePath = "";
+        this.userStatePath = "";
         this.lastWrittenMemory = "";
         this.lastWrittenUser = "";
         this.options = options;
@@ -174,14 +173,16 @@ export class FileStoreProvider {
         this.ctx = ctx;
         this.memoryFilePath = configFile(ctx.agentDir, "MEMORY.md");
         this.userFilePath = configFile(ctx.agentDir, "USER.md");
+        this.memoryStatePath = managedMemoryStateFile(ctx.agentDir, "MEMORY.md");
+        this.userStatePath = managedMemoryStateFile(ctx.agentDir, "USER.md");
         this.userArchive = new UserMemoryArchive(ctx.agentDir);
         await fs.mkdir(ctx.agentDir, { recursive: true });
         [this.lastWrittenMemory, this.lastWrittenUser] = await Promise.all([
-            this.initializeManagedFile(this.memoryFilePath),
-            this.initializeManagedFile(this.userFilePath),
+            this.initializeManagedFile(this.memoryFilePath, this.memoryStatePath),
+            this.initializeManagedFile(this.userFilePath, this.userStatePath),
         ]);
     }
-    async initializeManagedFile(filePath) {
+    async initializeManagedFile(filePath, statePath) {
         return withFileLock(filePath, async () => {
             let current = "";
             try {
@@ -193,19 +194,19 @@ export class FileStoreProvider {
                 await writeFileAtomic(filePath, "", { mode: 0o600 });
             }
             const currentDigest = contentDigest(current);
-            const stateRead = await readManagedMemoryState(filePath);
+            const stateRead = await readManagedMemoryState(statePath);
             if (stateRead.status === "missing") {
-                await writeManagedMemoryState(filePath, { version: 1, committedDigest: currentDigest });
+                await writeManagedMemoryState(statePath, { version: 1, committedDigest: currentDigest });
                 return current;
             }
             if (stateRead.status === "invalid") {
-                await writeFileAtomic(`${managedMemoryStatePath(filePath)}.bak.${Date.now()}.${randomUUID()}`, stateRead.raw, { mode: 0o600 });
-                await writeManagedMemoryState(filePath, { version: 1, committedDigest: currentDigest });
+                await writeFileAtomic(`${statePath}.bak.${Date.now()}.${randomUUID()}`, stateRead.raw, { mode: 0o600 });
+                await writeManagedMemoryState(statePath, { version: 1, committedDigest: currentDigest });
                 return current;
             }
             const reconciled = reconcileManagedMemoryState(currentDigest, stateRead.state);
             if (reconciled.recognized && reconciled.changed) {
-                await writeManagedMemoryState(filePath, reconciled.state);
+                await writeManagedMemoryState(statePath, reconciled.state);
             }
             return current;
         });
@@ -308,19 +309,20 @@ export class FileStoreProvider {
                         }
                     }
                     const filePath = target === "memory" ? this.memoryFilePath : this.userFilePath;
+                    const statePath = target === "memory" ? this.memoryStatePath : this.userStatePath;
                     const budget = target === "memory" ? FileStoreProvider.BUDGET_MEMORY : FileStoreProvider.BUDGET_USER;
                     try {
                         return await withFileLock(filePath, async () => {
                             const currentOnDisk = await fs.readFile(filePath, "utf8");
                             const currentDigest = contentDigest(currentOnDisk);
-                            const stateRead = await readManagedMemoryState(filePath);
+                            const stateRead = await readManagedMemoryState(statePath);
                             let managedState;
                             if (stateRead.status === "valid") {
                                 const reconciled = reconcileManagedMemoryState(currentDigest, stateRead.state);
                                 if (reconciled.recognized) {
                                     managedState = reconciled.state;
                                     if (reconciled.changed)
-                                        await writeManagedMemoryState(filePath, reconciled.state);
+                                        await writeManagedMemoryState(statePath, reconciled.state);
                                 }
                             }
                             if (!managedState) {
@@ -416,13 +418,13 @@ export class FileStoreProvider {
                             }
                             if (newContent !== currentOnDisk) {
                                 const newDigest = contentDigest(newContent);
-                                await writeManagedMemoryState(filePath, {
+                                await writeManagedMemoryState(statePath, {
                                     version: 1,
                                     committedDigest: managedState.committedDigest,
                                     pendingDigest: newDigest,
                                 });
                                 await writeFileAtomic(filePath, newContent, { mode: 0o600 });
-                                await writeManagedMemoryState(filePath, { version: 1, committedDigest: newDigest });
+                                await writeManagedMemoryState(statePath, { version: 1, committedDigest: newDigest });
                             }
                             if (target === "memory")
                                 this.lastWrittenMemory = newContent;

package/dist/core/memory/providers/file-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-store.js","sourceRoot":"","sources":["../../../../src/core/memory/providers/file-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACrB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,OAAe;IAC3E,MAAM,kBAAkB,GAAG,GAAG,CAAC;IAC/B,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,kBAAkB,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,6FAA6F;QAC7F,wCAAwC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YACxB,SAAS,GAAG,KAAK,CAAC;YAClB,OAAO,GAAG,CAAC,CAAC;QACb,CAAC;IACF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACzB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE;QAC1F,WAAW,EAAE,iFAAiF;KAC9F,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;QAClE,WAAW,EAAE,yDAAyD;KACtE,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC,CAAC;IAC1G,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC,CACzG;CACD,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,6BAA6B,GACzC,uLAAuL,CAAC;AAazL,SAAS,sBAAsB,CAAC,QAAgB;IAC/C,OAAO,GAAG,QAAQ,kBAAkB,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrG,OAAO;QACN,OAAO,EAAE,CAAC;QACV,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5D,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAyB;IAC7D,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAgB,EAAE,KAAyB;IACjF,MAAM,eAAe,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,2BAA2B,CACnC,aAAqB,EACrB,KAAyB;IAEzB,IAAI,aAAa,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1F,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YAC7D,OAAO,EAAE,IAAI;SACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE;YAC3D,OAAO,EAAE,IAAI;SACb,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,MAAsC;IACpF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/E,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,sEAAsE,CAAC;IACtF,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC;YAAE,MAAM;QAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,gBAAgB,GAAG,KAAK,GAAG,cAAc,CAAC;QAC5D,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,IAAI,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAa7B,oBAAoB;aACI,kBAAa,GAAG,IAAI,AAAP,CAAQ;aACrB,gBAAW,GAAG,IAAI,AAAP,CAAQ;IAE3C,YAAY,OAAO,GAA6B,EAAE;QAhBlC,SAAI,GAAG,YAAY,CAAC;QACpB,WAAM,GAAG,OAAO,CAAC;QAGzB,mBAAc,GAAG,EAAE,CAAC;QACpB,iBAAY,GAAG,EAAE,CAAC;QAElB,sBAAiB,GAAG,EAAE,CAAC;QACvB,oBAAe,GAAG,EAAE,CAAC;QAS5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;IAEM,WAAW;QACjB,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,eAAe;QACrB,OAAO,EAAE,QAAQ,EAAE,CAAC,SAAkB,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,GAA2B;QACtE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC;YAC/C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;SAC7C,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QACnD,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACxC,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC;gBACJ,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC5C,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;gBACxF,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,eAAe,CACpB,GAAG,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,EAAE,EACvE,SAAS,CAAC,GAAG,EACb,EAAE,IAAI,EAAE,KAAK,EAAE,CACf,CAAC;gBACF,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;gBACxF,OAAO,OAAO,CAAC;YAChB,CAAC;YAED,MAAM,UAAU,GAAG,2BAA2B,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/E,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,MAAM,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;IAEM,iBAAiB,CAAC,MAA2B;QACnD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE;YACpC,iGAAiG;YACjG,8FAA8F;YAC9F,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACzC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvE,CAAC;gBACD,OAAO,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC;QAEF,oGAAoG;QACpG,+FAA+F;QAC/F,kGAAkG;QAClG,4FAA4F;QAC5F,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE;YAC9C,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;gBAAE,OAAO,OAAO,CAAC;YAC5C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,oBAAoB,KAAK,8CAA8C,CAAC;QAC1G,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAE/E,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACX,CAAC;QAED,MAAM,KAAK,GAAG,2CAA2C,6BAA6B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnH,OAAO,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,MAAc;QACnC,kFAAkF;QAClF,OAAO,EAAE,CAAC;IACX,CAAC;IAEM,KAAK,CAAC,QAAQ;QACpB,QAAQ;IACT,CAAC;IAEM,iBAAiB;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IAEM,kBAAkB;QACxB,OAAO;YACN;gBACC,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EACV,4KAA4K;gBAC7K,UAAU,EAAE,YAAY;gBACxB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAoB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;oBAClF,IAAI,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;wBAC9B,OAAO;4BACN,OAAO,EAAE;gCACR;oCACC,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,mFAAmF;iCACzF;6BACD;4BACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE;yBAC/D,CAAC;oBACH,CAAC;oBAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;oBAEvD,sFAAsF;oBACtF,yFAAyF;oBACzF,0FAA0F;oBAC1F,yCAAyC;oBACzC,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBACzE,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;4BAClC,OAAO;gCACN,OAAO,EAAE;oCACR;wCACC,IAAI,EAAE,MAAM;wCACZ,IAAI,EAAE,kFAAkF;qCACxF;iCACD;gCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE;6BACvE,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACxB,OAAO;gCACN,OAAO,EAAE;oCACR;wCACC,IAAI,EAAE,MAAM;wCACZ,IAAI,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;qCACzG;iCACD;gCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE;6BAC5D,CAAC;wBACH,CAAC;oBACF,CAAC;oBAED,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;oBAC/E,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC;oBAErG,IAAI,CAAC;wBACJ,OAAO,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;4BAC9C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;4BAC1D,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;4BACnD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;4BACzD,IAAI,YAA4C,CAAC;4BACjD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gCAClC,MAAM,UAAU,GAAG,2BAA2B,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;gCAC/E,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;oCAC3B,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC;oCAChC,IAAI,UAAU,CAAC,OAAO;wCAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gCACnF,CAAC;4BACF,CAAC;4BACD,IAAI,CAAC,YAAY,EAAE,CAAC;gCACnB,MAAM,UAAU,GAAG,GAAG,QAAQ,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gCACnD,MAAM,eAAe,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gCAClE,OAAO;oCACN,OAAO,EAAE;wCACR;4CACC,IAAI,EAAE,MAAM;4CACZ,IAAI,EAAE,wHAAwH,UAAU,sBAAsB;yCAC9J;qCACD;oCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE;iCACpD,CAAC;4BACH,CAAC;4BAED,oFAAoF;4BACpF,0EAA0E;4BAC1E,IAAI,MAAM,KAAK,QAAQ;gCAAE,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;;gCAC3D,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC;4BAE1C,IAAI,UAAU,GAAG,aAAa,CAAC;4BAC/B,IAAI,cAAc,GAAG,KAAK,CAAC;4BAC3B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gCACvB,IAAI,CAAC,IAAI,CAAC,WAAW;oCAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gCAClF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oCACtB,IAAI,OAAO,KAAK,SAAS;wCACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;oCACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAC1C,aAAa,EACb,EAAE,MAAM,EAAE,OAAO,EAAE,EACnB,MAAM,EACN,0BAA0B,CAC1B,CAAC;oCACF,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;oCAChC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;gCACxC,CAAC;qCAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oCACjC,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wCACvD,MAAM,IAAI,KAAK,CACd,0EAA0E,CAC1E,CAAC;oCACH,CAAC;oCACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAC1C,aAAa,EACb,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAC/B,MAAM,EACN,0BAA0B,CAC1B,CAAC;oCACF,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;oCAChC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;gCACxC,CAAC;qCAAM,CAAC;oCACP,IAAI,UAAU,KAAK,SAAS;wCAC3B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oCAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAC1C,aAAa,EACb,EAAE,MAAM,EAAE,UAAU,EAAE,EACtB,MAAM,EACN,0BAA0B,CAC1B,CAAC;oCACF,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;oCAChC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;gCACxC,CAAC;4BACF,CAAC;iCAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gCAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oCAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gCACtE,CAAC;gCACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gCACtE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oCACzB,UAAU,GAAG,UAAU,CAAC;gCACzB,CAAC;qCAAM,CAAC;oCACP,UAAU;wCACT,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,KAAK,EAAE;4CAC7C,CAAC,CAAC,GAAG,UAAU,GAAG,OAAO,IAAI;4CAC7B,CAAC,CAAC,GAAG,UAAU,KAAK,OAAO,IAAI,CAAC;gCACnC,CAAC;4BACF,CAAC;iCAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gCACjC,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oCACvD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;gCAC7F,CAAC;gCACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oCACzC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;gCACrF,CAAC;gCACD,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;4BACzD,CAAC;iCAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gCAChC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oCAC9B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gCAC5E,CAAC;gCACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oCACzC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gCACpF,CAAC;gCACD,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;4BACpD,CAAC;4BAED,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gCAChC,OAAO;oCACN,OAAO,EAAE;wCACR;4CACC,IAAI,EAAE,MAAM;4CACZ,IAAI,EAAE,kCAAkC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,aAAa,MAAM,kDAAkD,UAAU,CAAC,MAAM,cAAc;yCACzL;qCACD;oCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE;iCAC5D,CAAC;4BACH,CAAC;4BAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gCAClC,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gCAC5C,MAAM,uBAAuB,CAAC,QAAQ,EAAE;oCACvC,OAAO,EAAE,CAAC;oCACV,eAAe,EAAE,YAAY,CAAC,eAAe;oCAC7C,aAAa,EAAE,SAAS;iCACxB,CAAC,CAAC;gCACH,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gCAC7D,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;4BACrF,CAAC;4BAED,IAAI,MAAM,KAAK,QAAQ;gCAAE,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC;;gCACxD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;4BACvC,IAAI,cAAc,IAAI,UAAU,KAAK,aAAa;gCAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC;4BAE5F,OAAO;gCACN,OAAO,EAAE;oCACR;wCACC,IAAI,EAAE,MAAM;wCACZ,IAAI,EAAE,wBAAwB,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,GAAG;qCAC9E;iCACD;gCACD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;6BAC1B,CAAC;wBACH,CAAC,CAAC,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACd,OAAO;4BACN,OAAO,EAAE;gCACR;oCACC,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,8CAA8C,MAAM,CAAC,GAAG,CAAC,EAAE;iCACjE;6BACD;4BACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;yBAC/C,CAAC;oBACH,CAAC;gBACF,CAAC;aACD;SACD,CAAC;IACH,CAAC;CACD","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport { type Static, Type } from \"typebox\";\nimport { configFile } from \"../../agent-paths.ts\";\nimport type { MemoryPromptBudget } from \"../../context/memory-prompt-budget.ts\";\nimport type { ToolDefinition } from \"../../extensions/types.ts\";\nimport {\n\thasInvisibleUnicode,\n\tscanContextFileThreats,\n\tstripInvisibleUnicode,\n} from \"../../security/context-threat-scanner.ts\";\nimport { jaccard, tokenize } from \"../../tools/skill-audit.ts\";\nimport { withFileLock, writeFileAtomic } from \"../../util/atomic-file.ts\";\nimport type { MemoryLifecycleContext, MemoryProvider } from \"../memory-provider.ts\";\nimport { UserMemoryArchive } from \"./user-memory-archive.ts\";\n\n/**\n * Confront-before-write (anti append-rot): if `content` is a near-duplicate of an existing\n * non-empty line (token Jaccard ≥ threshold — i.e. the same fact reworded), supersede that line in\n * place and return the rewritten file; otherwise return null (the caller appends normally).\n */\nexport function supersedeNearDuplicateLine(existing: string, content: string): string | null {\n\tconst NEAR_DUP_THRESHOLD = 0.6;\n\tconst contentTokens = tokenize(content);\n\tif (contentTokens.length === 0) return null;\n\tconst lines = existing.split(\"\\n\");\n\tlet bestIdx = -1;\n\tlet bestScore = NEAR_DUP_THRESHOLD;\n\tfor (let i = 0; i < lines.length; i++) {\n\t\tconst line = lines[i].trim();\n\t\tif (!line) continue;\n\t\t// Never supersede structural Markdown (headings, list markers as headings) — a fact must not\n\t\t// silently overwrite section structure.\n\t\tif (line.startsWith(\"#\")) continue;\n\t\tconst score = jaccard(contentTokens, tokenize(line));\n\t\tif (score >= bestScore) {\n\t\t\tbestScore = score;\n\t\t\tbestIdx = i;\n\t\t}\n\t}\n\tif (bestIdx === -1) return null;\n\tlines[bestIdx] = content;\n\treturn lines.join(\"\\n\");\n}\n\nconst memorySchema = Type.Object({\n\taction: Type.Union([Type.Literal(\"add\"), Type.Literal(\"replace\"), Type.Literal(\"remove\")], {\n\t\tdescription: \"Action to perform: add new content, replace existing content, or remove content\",\n\t}),\n\ttarget: Type.Union([Type.Literal(\"memory\"), Type.Literal(\"user\")], {\n\t\tdescription: \"Target file: 'memory' for MEMORY.md, 'user' for USER.md\",\n\t}),\n\tcontent: Type.Optional(Type.String({ description: \"Content to write (required for 'add' or 'replace')\" })),\n\toldContent: Type.Optional(\n\t\tType.String({ description: \"Exact substring to replace or remove (required for 'replace' or 'remove')\" }),\n\t),\n});\n\ntype MemoryParams = Static<typeof memorySchema>;\n\nexport interface FileStoreProviderOptions {\n\tonDurableMemoryChanged?: () => void;\n}\n\nexport const FILE_STORE_MEMORY_SYSTEM_NOTE =\n\t\"[System Note: Below is a snapshot of persistent memory. Proactively record verified reusable project facts and user preferences with the 'memory' tool; never store transient noise.]\";\n\ninterface ManagedMemoryState {\n\tversion: 1;\n\tcommittedDigest: string;\n\tpendingDigest?: string;\n}\n\ntype ManagedMemoryStateRead =\n\t| { status: \"missing\" }\n\t| { status: \"valid\"; state: ManagedMemoryState }\n\t| { status: \"invalid\"; raw: string };\n\nfunction managedMemoryStatePath(filePath: string): string {\n\treturn `${filePath}.pi-managed.json`;\n}\n\nfunction contentDigest(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\nfunction isMissingFileError(error: unknown): boolean {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error && error.code === \"ENOENT\";\n}\n\nfunction parseManagedMemoryState(raw: string): ManagedMemoryState | undefined {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (typeof parsed !== \"object\" || parsed === null) return undefined;\n\tconst record = parsed as Record<string, unknown>;\n\tif (record.version !== 1 || typeof record.committedDigest !== \"string\") return undefined;\n\tif (record.pendingDigest !== undefined && typeof record.pendingDigest !== \"string\") return undefined;\n\treturn {\n\t\tversion: 1,\n\t\tcommittedDigest: record.committedDigest,\n\t\t...(typeof record.pendingDigest === \"string\" ? { pendingDigest: record.pendingDigest } : {}),\n\t};\n}\n\nasync function readManagedMemoryState(filePath: string): Promise<ManagedMemoryStateRead> {\n\ttry {\n\t\tconst raw = await fs.readFile(managedMemoryStatePath(filePath), \"utf8\");\n\t\tconst state = parseManagedMemoryState(raw);\n\t\treturn state ? { status: \"valid\", state } : { status: \"invalid\", raw };\n\t} catch (error) {\n\t\tif (isMissingFileError(error)) return { status: \"missing\" };\n\t\tthrow error;\n\t}\n}\n\nfunction serializeManagedMemoryState(state: ManagedMemoryState): string {\n\treturn `${JSON.stringify(state)}\\n`;\n}\n\nasync function writeManagedMemoryState(filePath: string, state: ManagedMemoryState): Promise<void> {\n\tawait writeFileAtomic(managedMemoryStatePath(filePath), serializeManagedMemoryState(state), { mode: 0o600 });\n}\n\nfunction reconcileManagedMemoryState(\n\tcurrentDigest: string,\n\tstate: ManagedMemoryState,\n): { recognized: true; state: ManagedMemoryState; changed: boolean } | { recognized: false } {\n\tif (currentDigest === state.committedDigest) {\n\t\tif (state.pendingDigest === undefined) return { recognized: true, state, changed: false };\n\t\treturn {\n\t\t\trecognized: true,\n\t\t\tstate: { version: 1, committedDigest: state.committedDigest },\n\t\t\tchanged: true,\n\t\t};\n\t}\n\tif (state.pendingDigest !== undefined && currentDigest === state.pendingDigest) {\n\t\treturn {\n\t\t\trecognized: true,\n\t\t\tstate: { version: 1, committedDigest: state.pendingDigest },\n\t\t\tchanged: true,\n\t\t};\n\t}\n\treturn { recognized: false };\n}\n\nfunction fitMemoryBlockToBudget(block: string, budget: MemoryPromptBudget | undefined): string {\n\tif (budget === undefined) return block;\n\tif (!budget.enabled || budget.maxLines <= 0 || budget.maxChars <= 0) return \"\";\n\tif (block.split(\"\\n\").length <= budget.maxLines && block.length <= budget.maxChars) return block;\n\t// Micro-context profiles deliberately omit a block that cannot fit whole. Larger constrained\n\t// profiles retain a bounded head and say explicitly that more memory exists on disk.\n\tif (budget.compact) return \"\";\n\n\tconst marker = \"[…memory truncated for capability budget; full files remain on disk]\";\n\tif (budget.maxLines < 2 || budget.maxChars <= marker.length + 1) return \"\";\n\tconst lines: string[] = [];\n\tlet chars = 0;\n\tconst contentCharLimit = budget.maxChars - marker.length - 1;\n\tfor (const line of block.split(\"\\n\")) {\n\t\tif (lines.length >= budget.maxLines - 1) break;\n\t\tconst separatorChars = lines.length > 0 ? 1 : 0;\n\t\tconst remaining = contentCharLimit - chars - separatorChars;\n\t\tif (remaining <= 0) break;\n\t\tconst rendered = line.length <= remaining ? line : `${line.slice(0, Math.max(0, remaining - 1))}…`;\n\t\tlines.push(rendered);\n\t\tchars += separatorChars + rendered.length;\n\t\tif (rendered.length !== line.length) break;\n\t}\n\tif (lines.length === 0) return \"\";\n\tlines.push(marker);\n\treturn lines.join(\"\\n\");\n}\n\nexport class FileStoreProvider implements MemoryProvider {\n\tpublic readonly name = \"file-store\";\n\tpublic readonly egress = \"local\";\n\n\tprivate ctx?: MemoryLifecycleContext;\n\tprivate memoryFilePath = \"\";\n\tprivate userFilePath = \"\";\n\n\tprivate lastWrittenMemory = \"\";\n\tprivate lastWrittenUser = \"\";\n\tprivate userArchive?: UserMemoryArchive;\n\tprivate readonly options: FileStoreProviderOptions;\n\n\t// Character budgets\n\tprivate static readonly BUDGET_MEMORY = 2200;\n\tprivate static readonly BUDGET_USER = 1375;\n\n\tconstructor(options: FileStoreProviderOptions = {}) {\n\t\tthis.options = options;\n\t}\n\n\tpublic isAvailable(): boolean {\n\t\treturn true;\n\t}\n\n\tpublic getCapabilities() {\n\t\treturn { surfaces: [\"context\" as const] };\n\t}\n\n\tpublic async initialize(_sessionId: string, ctx: MemoryLifecycleContext): Promise<void> {\n\t\tthis.ctx = ctx;\n\t\tthis.memoryFilePath = configFile(ctx.agentDir, \"MEMORY.md\");\n\t\tthis.userFilePath = configFile(ctx.agentDir, \"USER.md\");\n\t\tthis.userArchive = new UserMemoryArchive(ctx.agentDir);\n\n\t\tawait fs.mkdir(ctx.agentDir, { recursive: true });\n\t\t[this.lastWrittenMemory, this.lastWrittenUser] = await Promise.all([\n\t\t\tthis.initializeManagedFile(this.memoryFilePath),\n\t\t\tthis.initializeManagedFile(this.userFilePath),\n\t\t]);\n\t}\n\n\tprivate async initializeManagedFile(filePath: string): Promise<string> {\n\t\treturn withFileLock(filePath, async () => {\n\t\t\tlet current = \"\";\n\t\t\ttry {\n\t\t\t\tcurrent = await fs.readFile(filePath, \"utf8\");\n\t\t\t} catch (error) {\n\t\t\t\tif (!isMissingFileError(error)) throw error;\n\t\t\t\tawait writeFileAtomic(filePath, \"\", { mode: 0o600 });\n\t\t\t}\n\n\t\t\tconst currentDigest = contentDigest(current);\n\t\t\tconst stateRead = await readManagedMemoryState(filePath);\n\t\t\tif (stateRead.status === \"missing\") {\n\t\t\t\tawait writeManagedMemoryState(filePath, { version: 1, committedDigest: currentDigest });\n\t\t\t\treturn current;\n\t\t\t}\n\t\t\tif (stateRead.status === \"invalid\") {\n\t\t\t\tawait writeFileAtomic(\n\t\t\t\t\t`${managedMemoryStatePath(filePath)}.bak.${Date.now()}.${randomUUID()}`,\n\t\t\t\t\tstateRead.raw,\n\t\t\t\t\t{ mode: 0o600 },\n\t\t\t\t);\n\t\t\t\tawait writeManagedMemoryState(filePath, { version: 1, committedDigest: currentDigest });\n\t\t\t\treturn current;\n\t\t\t}\n\n\t\t\tconst reconciled = reconcileManagedMemoryState(currentDigest, stateRead.state);\n\t\t\tif (reconciled.recognized && reconciled.changed) {\n\t\t\t\tawait writeManagedMemoryState(filePath, reconciled.state);\n\t\t\t}\n\t\t\treturn current;\n\t\t});\n\t}\n\n\tpublic systemPromptBlock(budget?: MemoryPromptBudget): string {\n\t\tconst sanitize = (content: string) => {\n\t\t\t// Strip hidden/bidi-control chars before injecting memory into the prompt (defence in depth: the\n\t\t\t// write path already blocks them, but a file edited out-of-band could carry them). Strip #31.\n\t\t\tconst lines = stripInvisibleUnicode(content).cleaned.split(\"\\n\");\n\t\t\tconst sanitizedLines = lines.map((line) => {\n\t\t\t\tconst threats = scanContextFileThreats(line);\n\t\t\t\tif (threats.length > 0) {\n\t\t\t\t\treturn `[BLOCKED: potential threat detected (${threats.join(\", \")})]`;\n\t\t\t\t}\n\t\t\t\treturn line;\n\t\t\t});\n\t\t\treturn sanitizedLines.join(\"\\n\");\n\t\t};\n\n\t\t// Read-time budget guard (cost): the memory tool already caps writes at BUDGET_*, but a file edited\n\t\t// externally (or by any path that bypasses the tool) could be arbitrarily large and would then\n\t\t// bloat the system prompt on EVERY turn. Cap the injected view to the same budget so the per-turn\n\t\t// cost stays bounded; the file on disk is untouched and the model is told it was truncated.\n\t\tconst cap = (content: string, limit: number) => {\n\t\t\tif (content.length <= limit) return content;\n\t\t\treturn `${content.slice(0, limit)}\\n[…truncated to ${limit} chars for the prompt; full file is on disk]`;\n\t\t};\n\n\t\tconst mem = cap(sanitize(this.lastWrittenMemory), FileStoreProvider.BUDGET_MEMORY);\n\t\tconst usr = cap(sanitize(this.lastWrittenUser), FileStoreProvider.BUDGET_USER);\n\n\t\tconst blocks: string[] = [];\n\t\tif (mem.trim()) {\n\t\t\tblocks.push(`## MEMORY.md:\\n${mem}`);\n\t\t}\n\t\tif (usr.trim()) {\n\t\t\tblocks.push(`## USER.md:\\n${usr}`);\n\t\t}\n\n\t\tif (blocks.length === 0) {\n\t\t\treturn \"\";\n\t\t}\n\n\t\tconst block = `=== Persistent Memory (file-store) ===\\n${FILE_STORE_MEMORY_SYSTEM_NOTE}\\n\\n${blocks.join(\"\\n\\n\")}`;\n\t\treturn fitMemoryBlockToBudget(block, budget);\n\t}\n\n\tpublic async prefetch(_query: string): Promise<string> {\n\t\t// static system prompt block is sufficient for file-store default; no-op prefetch\n\t\treturn \"\";\n\t}\n\n\tpublic async shutdown(): Promise<void> {\n\t\t// no-op\n\t}\n\n\tpublic getContextMarkers(): string[] {\n\t\treturn [];\n\t}\n\n\tpublic getToolDefinitions(): ToolDefinition[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tname: \"memory\",\n\t\t\t\tlabel: \"Persistent Memory Manager\",\n\t\t\t\tdescription:\n\t\t\t\t\t\"Add, replace, or remove durable project facts and user preferences. Proactively store newly verified reusable facts; USER.md overflow is migrated into indexed OKF shards.\",\n\t\t\t\tparameters: memorySchema,\n\t\t\t\texecute: async (_toolCallId, params: MemoryParams, _signal, _onUpdate, _execCtx) => {\n\t\t\t\t\tif (this.ctx?.isChildSession) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\ttext: \"Error: Writes to persistent memory are not allowed in child sessions (subagents).\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tdetails: { success: false, error: \"Child session write-gated\" },\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\n\t\t\t\t\tconst { action, target, content, oldContent } = params;\n\n\t\t\t\t\t// Strict-scope injection guard on the high-privilege WRITE path (agy #31): a poisoned\n\t\t\t\t\t// memory entry persists across sessions and is injected into every future system prompt,\n\t\t\t\t\t// so block outright rather than strip. Hidden/bidi-control chars have no legitimate place\n\t\t\t\t\t// in a memory note, so reject those too.\n\t\t\t\t\tif ((action === \"add\" || action === \"replace\") && content !== undefined) {\n\t\t\t\t\t\tif (hasInvisibleUnicode(content)) {\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\ttext: \"Error: memory write rejected — contains hidden/bidirectional control characters.\",\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Invisible unicode in memory write\" },\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst threats = scanContextFileThreats(content, \"strict\");\n\t\t\t\t\t\tif (threats.length > 0) {\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\ttext: `Error: memory write rejected — potential injection/exfiltration detected (${threats.join(\", \")}).`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Threat in memory write\" },\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\tconst filePath = target === \"memory\" ? this.memoryFilePath : this.userFilePath;\n\t\t\t\t\tconst budget = target === \"memory\" ? FileStoreProvider.BUDGET_MEMORY : FileStoreProvider.BUDGET_USER;\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn await withFileLock(filePath, async () => {\n\t\t\t\t\t\t\tconst currentOnDisk = await fs.readFile(filePath, \"utf8\");\n\t\t\t\t\t\t\tconst currentDigest = contentDigest(currentOnDisk);\n\t\t\t\t\t\t\tconst stateRead = await readManagedMemoryState(filePath);\n\t\t\t\t\t\t\tlet managedState: ManagedMemoryState | undefined;\n\t\t\t\t\t\t\tif (stateRead.status === \"valid\") {\n\t\t\t\t\t\t\t\tconst reconciled = reconcileManagedMemoryState(currentDigest, stateRead.state);\n\t\t\t\t\t\t\t\tif (reconciled.recognized) {\n\t\t\t\t\t\t\t\t\tmanagedState = reconciled.state;\n\t\t\t\t\t\t\t\t\tif (reconciled.changed) await writeManagedMemoryState(filePath, reconciled.state);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (!managedState) {\n\t\t\t\t\t\t\t\tconst backupPath = `${filePath}.bak.${Date.now()}`;\n\t\t\t\t\t\t\t\tawait writeFileAtomic(backupPath, currentOnDisk, { mode: 0o600 });\n\t\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\t\ttext: `Error: Drift detected. The memory file has been modified out-of-band by an external process. A backup was created at ${backupPath}. Operation aborted.`,\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Drift detected\" },\n\t\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t// A peer session's committed write is authoritative. Refresh this provider's prompt\n\t\t\t\t\t\t\t// snapshot before applying the caller's mutation to that current content.\n\t\t\t\t\t\t\tif (target === \"memory\") this.lastWrittenMemory = currentOnDisk;\n\t\t\t\t\t\t\telse this.lastWrittenUser = currentOnDisk;\n\n\t\t\t\t\t\t\tlet newContent = currentOnDisk;\n\t\t\t\t\t\t\tlet archiveChanged = false;\n\t\t\t\t\t\t\tif (target === \"user\") {\n\t\t\t\t\t\t\t\tif (!this.userArchive) throw new Error(\"User memory archive is not initialized.\");\n\t\t\t\t\t\t\t\tif (action === \"add\") {\n\t\t\t\t\t\t\t\t\tif (content === undefined)\n\t\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'content' is required for action 'add'.\");\n\t\t\t\t\t\t\t\t\tconst result = await this.userArchive.apply(\n\t\t\t\t\t\t\t\t\t\tcurrentOnDisk,\n\t\t\t\t\t\t\t\t\t\t{ action, content },\n\t\t\t\t\t\t\t\t\t\tbudget,\n\t\t\t\t\t\t\t\t\t\tsupersedeNearDuplicateLine,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\tnewContent = result.userContent;\n\t\t\t\t\t\t\t\t\tarchiveChanged = result.archiveChanged;\n\t\t\t\t\t\t\t\t} else if (action === \"replace\") {\n\t\t\t\t\t\t\t\t\tif (content === undefined || oldContent === undefined) {\n\t\t\t\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t\t\t\t\"Parameters 'content' and 'oldContent' are required for action 'replace'.\",\n\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tconst result = await this.userArchive.apply(\n\t\t\t\t\t\t\t\t\t\tcurrentOnDisk,\n\t\t\t\t\t\t\t\t\t\t{ action, content, oldContent },\n\t\t\t\t\t\t\t\t\t\tbudget,\n\t\t\t\t\t\t\t\t\t\tsupersedeNearDuplicateLine,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\tnewContent = result.userContent;\n\t\t\t\t\t\t\t\t\tarchiveChanged = result.archiveChanged;\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tif (oldContent === undefined)\n\t\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'oldContent' is required for action 'remove'.\");\n\t\t\t\t\t\t\t\t\tconst result = await this.userArchive.apply(\n\t\t\t\t\t\t\t\t\t\tcurrentOnDisk,\n\t\t\t\t\t\t\t\t\t\t{ action, oldContent },\n\t\t\t\t\t\t\t\t\t\tbudget,\n\t\t\t\t\t\t\t\t\t\tsupersedeNearDuplicateLine,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\tnewContent = result.userContent;\n\t\t\t\t\t\t\t\t\tarchiveChanged = result.archiveChanged;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else if (action === \"add\") {\n\t\t\t\t\t\t\t\tif (content === undefined) {\n\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'content' is required for action 'add'.\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tconst superseded = supersedeNearDuplicateLine(currentOnDisk, content);\n\t\t\t\t\t\t\t\tif (superseded !== null) {\n\t\t\t\t\t\t\t\t\tnewContent = superseded;\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tnewContent =\n\t\t\t\t\t\t\t\t\t\tnewContent.endsWith(\"\\n\") || newContent === \"\"\n\t\t\t\t\t\t\t\t\t\t\t? `${newContent}${content}\\n`\n\t\t\t\t\t\t\t\t\t\t\t: `${newContent}\\n${content}\\n`;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else if (action === \"replace\") {\n\t\t\t\t\t\t\t\tif (content === undefined || oldContent === undefined) {\n\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameters 'content' and 'oldContent' are required for action 'replace'.\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tif (!currentOnDisk.includes(oldContent)) {\n\t\t\t\t\t\t\t\t\tthrow new Error(`The content to replace ('oldContent') was not found in the file.`);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tnewContent = currentOnDisk.replace(oldContent, content);\n\t\t\t\t\t\t\t} else if (action === \"remove\") {\n\t\t\t\t\t\t\t\tif (oldContent === undefined) {\n\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'oldContent' is required for action 'remove'.\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tif (!currentOnDisk.includes(oldContent)) {\n\t\t\t\t\t\t\t\t\tthrow new Error(`The content to remove ('oldContent') was not found in the file.`);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tnewContent = currentOnDisk.replace(oldContent, \"\");\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tif (newContent.length > budget) {\n\t\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\t\ttext: `Error: Memory budget exceeded. ${target === \"memory\" ? \"MEMORY.md\" : \"USER.md\"} limit is ${budget} characters. Current operation would result in ${newContent.length} characters.`,\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Memory budget exceeded\" },\n\t\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tif (newContent !== currentOnDisk) {\n\t\t\t\t\t\t\t\tconst newDigest = contentDigest(newContent);\n\t\t\t\t\t\t\t\tawait writeManagedMemoryState(filePath, {\n\t\t\t\t\t\t\t\t\tversion: 1,\n\t\t\t\t\t\t\t\t\tcommittedDigest: managedState.committedDigest,\n\t\t\t\t\t\t\t\t\tpendingDigest: newDigest,\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\tawait writeFileAtomic(filePath, newContent, { mode: 0o600 });\n\t\t\t\t\t\t\t\tawait writeManagedMemoryState(filePath, { version: 1, committedDigest: newDigest });\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tif (target === \"memory\") this.lastWrittenMemory = newContent;\n\t\t\t\t\t\t\telse this.lastWrittenUser = newContent;\n\t\t\t\t\t\t\tif (archiveChanged || newContent !== currentOnDisk) this.options.onDurableMemoryChanged?.();\n\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\ttext: `Successfully updated ${target === \"memory\" ? \"MEMORY.md\" : \"USER.md\"}.`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\tdetails: { success: true },\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch (err) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\ttext: `Error: Failed to perform memory operation: ${String(err)}`,\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tdetails: { success: false, error: String(err) },\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t},\n\t\t];\n\t}\n}\n"]}
+{"version":3,"file":"file-store.js","sourceRoot":"","sources":["../../../../src/core/memory/providers/file-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAG1E,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACrB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,OAAe;IAC3E,MAAM,kBAAkB,GAAG,GAAG,CAAC;IAC/B,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,kBAAkB,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,6FAA6F;QAC7F,wCAAwC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;YACxB,SAAS,GAAG,KAAK,CAAC;YAClB,OAAO,GAAG,CAAC,CAAC;QACb,CAAC;IACF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACzB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE;QAC1F,WAAW,EAAE,iFAAiF;KAC9F,CAAC;IACF,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;QAClE,WAAW,EAAE,yDAAyD;KACtE,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC,CAAC;IAC1G,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC,CACzG;CACD,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,6BAA6B,GACzC,uLAAuL,CAAC;AAazL,SAAS,aAAa,CAAC,OAAe;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAW;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACzF,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrG,OAAO;QACN,OAAO,EAAE,CAAC;QACV,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IACtD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5D,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAyB;IAC7D,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,KAAyB;IAClF,MAAM,eAAe,CAAC,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,2BAA2B,CACnC,aAAqB,EACrB,KAAyB;IAEzB,IAAI,aAAa,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1F,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YAC7D,OAAO,EAAE,IAAI;SACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE;YAC3D,OAAO,EAAE,IAAI;SACb,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,MAAsC;IACpF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/E,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,sEAAsE,CAAC;IACtF,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC;YAAE,MAAM;QAC/C,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,gBAAgB,GAAG,KAAK,GAAG,cAAc,CAAC;QAC5D,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,IAAI,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAe7B,oBAAoB;aACI,kBAAa,GAAG,IAAI,AAAP,CAAQ;aACrB,gBAAW,GAAG,IAAI,AAAP,CAAQ;IAE3C,YAAY,OAAO,GAA6B,EAAE;QAlBlC,SAAI,GAAG,YAAY,CAAC;QACpB,WAAM,GAAG,OAAO,CAAC;QAGzB,mBAAc,GAAG,EAAE,CAAC;QACpB,iBAAY,GAAG,EAAE,CAAC;QAClB,oBAAe,GAAG,EAAE,CAAC;QACrB,kBAAa,GAAG,EAAE,CAAC;QAEnB,sBAAiB,GAAG,EAAE,CAAC;QACvB,oBAAe,GAAG,EAAE,CAAC;QAS5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;IAEM,WAAW;QACjB,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,eAAe;QACrB,OAAO,EAAE,QAAQ,EAAE,CAAC,SAAkB,CAAC,EAAE,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,GAA2B;QACtE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,aAAa,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC;YACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC;SACjE,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,QAAgB,EAAE,SAAiB;QACtE,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACxC,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,CAAC;gBACJ,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC5C,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,uBAAuB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;gBACzF,OAAO,OAAO,CAAC;YAChB,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,eAAe,CAAC,GAAG,SAAS,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACxG,MAAM,uBAAuB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;gBACzF,OAAO,OAAO,CAAC;YAChB,CAAC;YAED,MAAM,UAAU,GAAG,2BAA2B,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/E,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,MAAM,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;IAEM,iBAAiB,CAAC,MAA2B;QACnD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE;YACpC,iGAAiG;YACjG,8FAA8F;YAC9F,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACzC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvE,CAAC;gBACD,OAAO,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC;QAEF,oGAAoG;QACpG,+FAA+F;QAC/F,kGAAkG;QAClG,4FAA4F;QAC5F,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE;YAC9C,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;gBAAE,OAAO,OAAO,CAAC;YAC5C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,oBAAoB,KAAK,8CAA8C,CAAC;QAC1G,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAE/E,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACX,CAAC;QAED,MAAM,KAAK,GAAG,2CAA2C,6BAA6B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnH,OAAO,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,MAAc;QACnC,kFAAkF;QAClF,OAAO,EAAE,CAAC;IACX,CAAC;IAEM,KAAK,CAAC,QAAQ;QACpB,QAAQ;IACT,CAAC;IAEM,iBAAiB;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IAEM,kBAAkB;QACxB,OAAO;YACN;gBACC,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EACV,4KAA4K;gBAC7K,UAAU,EAAE,YAAY;gBACxB,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAoB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;oBAClF,IAAI,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,CAAC;wBAC9B,OAAO;4BACN,OAAO,EAAE;gCACR;oCACC,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,mFAAmF;iCACzF;6BACD;4BACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE;yBAC/D,CAAC;oBACH,CAAC;oBAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;oBAEvD,sFAAsF;oBACtF,yFAAyF;oBACzF,0FAA0F;oBAC1F,yCAAyC;oBACzC,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBACzE,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;4BAClC,OAAO;gCACN,OAAO,EAAE;oCACR;wCACC,IAAI,EAAE,MAAM;wCACZ,IAAI,EAAE,kFAAkF;qCACxF;iCACD;gCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE;6BACvE,CAAC;wBACH,CAAC;wBACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;wBAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACxB,OAAO;gCACN,OAAO,EAAE;oCACR;wCACC,IAAI,EAAE,MAAM;wCACZ,IAAI,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;qCACzG;iCACD;gCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE;6BAC5D,CAAC;wBACH,CAAC;oBACF,CAAC;oBAED,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;oBAC/E,MAAM,SAAS,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;oBAClF,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC;oBAErG,IAAI,CAAC;wBACJ,OAAO,MAAM,YAAY,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;4BAC9C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;4BAC1D,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;4BACnD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;4BAC1D,IAAI,YAA4C,CAAC;4BACjD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gCAClC,MAAM,UAAU,GAAG,2BAA2B,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;gCAC/E,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;oCAC3B,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC;oCAChC,IAAI,UAAU,CAAC,OAAO;wCAAE,MAAM,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;gCACpF,CAAC;4BACF,CAAC;4BACD,IAAI,CAAC,YAAY,EAAE,CAAC;gCACnB,MAAM,UAAU,GAAG,GAAG,QAAQ,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gCACnD,MAAM,eAAe,CAAC,UAAU,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gCAClE,OAAO;oCACN,OAAO,EAAE;wCACR;4CACC,IAAI,EAAE,MAAM;4CACZ,IAAI,EAAE,wHAAwH,UAAU,sBAAsB;yCAC9J;qCACD;oCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE;iCACpD,CAAC;4BACH,CAAC;4BAED,oFAAoF;4BACpF,0EAA0E;4BAC1E,IAAI,MAAM,KAAK,QAAQ;gCAAE,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC;;gCAC3D,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC;4BAE1C,IAAI,UAAU,GAAG,aAAa,CAAC;4BAC/B,IAAI,cAAc,GAAG,KAAK,CAAC;4BAC3B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gCACvB,IAAI,CAAC,IAAI,CAAC,WAAW;oCAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gCAClF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oCACtB,IAAI,OAAO,KAAK,SAAS;wCACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;oCACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAC1C,aAAa,EACb,EAAE,MAAM,EAAE,OAAO,EAAE,EACnB,MAAM,EACN,0BAA0B,CAC1B,CAAC;oCACF,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;oCAChC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;gCACxC,CAAC;qCAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oCACjC,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wCACvD,MAAM,IAAI,KAAK,CACd,0EAA0E,CAC1E,CAAC;oCACH,CAAC;oCACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAC1C,aAAa,EACb,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAC/B,MAAM,EACN,0BAA0B,CAC1B,CAAC;oCACF,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;oCAChC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;gCACxC,CAAC;qCAAM,CAAC;oCACP,IAAI,UAAU,KAAK,SAAS;wCAC3B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oCAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAC1C,aAAa,EACb,EAAE,MAAM,EAAE,UAAU,EAAE,EACtB,MAAM,EACN,0BAA0B,CAC1B,CAAC;oCACF,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;oCAChC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;gCACxC,CAAC;4BACF,CAAC;iCAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gCAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oCAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gCACtE,CAAC;gCACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gCACtE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oCACzB,UAAU,GAAG,UAAU,CAAC;gCACzB,CAAC;qCAAM,CAAC;oCACP,UAAU;wCACT,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,KAAK,EAAE;4CAC7C,CAAC,CAAC,GAAG,UAAU,GAAG,OAAO,IAAI;4CAC7B,CAAC,CAAC,GAAG,UAAU,KAAK,OAAO,IAAI,CAAC;gCACnC,CAAC;4BACF,CAAC;iCAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gCACjC,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oCACvD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;gCAC7F,CAAC;gCACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oCACzC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;gCACrF,CAAC;gCACD,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;4BACzD,CAAC;iCAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gCAChC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oCAC9B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gCAC5E,CAAC;gCACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oCACzC,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;gCACpF,CAAC;gCACD,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;4BACpD,CAAC;4BAED,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gCAChC,OAAO;oCACN,OAAO,EAAE;wCACR;4CACC,IAAI,EAAE,MAAM;4CACZ,IAAI,EAAE,kCAAkC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,aAAa,MAAM,kDAAkD,UAAU,CAAC,MAAM,cAAc;yCACzL;qCACD;oCACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE;iCAC5D,CAAC;4BACH,CAAC;4BAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gCAClC,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;gCAC5C,MAAM,uBAAuB,CAAC,SAAS,EAAE;oCACxC,OAAO,EAAE,CAAC;oCACV,eAAe,EAAE,YAAY,CAAC,eAAe;oCAC7C,aAAa,EAAE,SAAS;iCACxB,CAAC,CAAC;gCACH,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gCAC7D,MAAM,uBAAuB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;4BACtF,CAAC;4BAED,IAAI,MAAM,KAAK,QAAQ;gCAAE,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC;;gCACxD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;4BACvC,IAAI,cAAc,IAAI,UAAU,KAAK,aAAa;gCAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC;4BAE5F,OAAO;gCACN,OAAO,EAAE;oCACR;wCACC,IAAI,EAAE,MAAM;wCACZ,IAAI,EAAE,wBAAwB,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,GAAG;qCAC9E;iCACD;gCACD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;6BAC1B,CAAC;wBACH,CAAC,CAAC,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACd,OAAO;4BACN,OAAO,EAAE;gCACR;oCACC,IAAI,EAAE,MAAM;oCACZ,IAAI,EAAE,8CAA8C,MAAM,CAAC,GAAG,CAAC,EAAE;iCACjE;6BACD;4BACD,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;yBAC/C,CAAC;oBACH,CAAC;gBACF,CAAC;aACD;SACD,CAAC;IACH,CAAC;CACD","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport { type Static, Type } from \"typebox\";\nimport { configFile, managedMemoryStateFile } from \"../../agent-paths.ts\";\nimport type { MemoryPromptBudget } from \"../../context/memory-prompt-budget.ts\";\nimport type { ToolDefinition } from \"../../extensions/types.ts\";\nimport {\n\thasInvisibleUnicode,\n\tscanContextFileThreats,\n\tstripInvisibleUnicode,\n} from \"../../security/context-threat-scanner.ts\";\nimport { jaccard, tokenize } from \"../../tools/skill-audit.ts\";\nimport { withFileLock, writeFileAtomic } from \"../../util/atomic-file.ts\";\nimport type { MemoryLifecycleContext, MemoryProvider } from \"../memory-provider.ts\";\nimport { UserMemoryArchive } from \"./user-memory-archive.ts\";\n\n/**\n * Confront-before-write (anti append-rot): if `content` is a near-duplicate of an existing\n * non-empty line (token Jaccard ≥ threshold — i.e. the same fact reworded), supersede that line in\n * place and return the rewritten file; otherwise return null (the caller appends normally).\n */\nexport function supersedeNearDuplicateLine(existing: string, content: string): string | null {\n\tconst NEAR_DUP_THRESHOLD = 0.6;\n\tconst contentTokens = tokenize(content);\n\tif (contentTokens.length === 0) return null;\n\tconst lines = existing.split(\"\\n\");\n\tlet bestIdx = -1;\n\tlet bestScore = NEAR_DUP_THRESHOLD;\n\tfor (let i = 0; i < lines.length; i++) {\n\t\tconst line = lines[i].trim();\n\t\tif (!line) continue;\n\t\t// Never supersede structural Markdown (headings, list markers as headings) — a fact must not\n\t\t// silently overwrite section structure.\n\t\tif (line.startsWith(\"#\")) continue;\n\t\tconst score = jaccard(contentTokens, tokenize(line));\n\t\tif (score >= bestScore) {\n\t\t\tbestScore = score;\n\t\t\tbestIdx = i;\n\t\t}\n\t}\n\tif (bestIdx === -1) return null;\n\tlines[bestIdx] = content;\n\treturn lines.join(\"\\n\");\n}\n\nconst memorySchema = Type.Object({\n\taction: Type.Union([Type.Literal(\"add\"), Type.Literal(\"replace\"), Type.Literal(\"remove\")], {\n\t\tdescription: \"Action to perform: add new content, replace existing content, or remove content\",\n\t}),\n\ttarget: Type.Union([Type.Literal(\"memory\"), Type.Literal(\"user\")], {\n\t\tdescription: \"Target file: 'memory' for MEMORY.md, 'user' for USER.md\",\n\t}),\n\tcontent: Type.Optional(Type.String({ description: \"Content to write (required for 'add' or 'replace')\" })),\n\toldContent: Type.Optional(\n\t\tType.String({ description: \"Exact substring to replace or remove (required for 'replace' or 'remove')\" }),\n\t),\n});\n\ntype MemoryParams = Static<typeof memorySchema>;\n\nexport interface FileStoreProviderOptions {\n\tonDurableMemoryChanged?: () => void;\n}\n\nexport const FILE_STORE_MEMORY_SYSTEM_NOTE =\n\t\"[System Note: Below is a snapshot of persistent memory. Proactively record verified reusable project facts and user preferences with the 'memory' tool; never store transient noise.]\";\n\ninterface ManagedMemoryState {\n\tversion: 1;\n\tcommittedDigest: string;\n\tpendingDigest?: string;\n}\n\ntype ManagedMemoryStateRead =\n\t| { status: \"missing\" }\n\t| { status: \"valid\"; state: ManagedMemoryState }\n\t| { status: \"invalid\"; raw: string };\n\nfunction contentDigest(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\nfunction isMissingFileError(error: unknown): boolean {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error && error.code === \"ENOENT\";\n}\n\nfunction parseManagedMemoryState(raw: string): ManagedMemoryState | undefined {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch {\n\t\treturn undefined;\n\t}\n\tif (typeof parsed !== \"object\" || parsed === null) return undefined;\n\tconst record = parsed as Record<string, unknown>;\n\tif (record.version !== 1 || typeof record.committedDigest !== \"string\") return undefined;\n\tif (record.pendingDigest !== undefined && typeof record.pendingDigest !== \"string\") return undefined;\n\treturn {\n\t\tversion: 1,\n\t\tcommittedDigest: record.committedDigest,\n\t\t...(typeof record.pendingDigest === \"string\" ? { pendingDigest: record.pendingDigest } : {}),\n\t};\n}\n\nasync function readManagedMemoryState(statePath: string): Promise<ManagedMemoryStateRead> {\n\ttry {\n\t\tconst raw = await fs.readFile(statePath, \"utf8\");\n\t\tconst state = parseManagedMemoryState(raw);\n\t\treturn state ? { status: \"valid\", state } : { status: \"invalid\", raw };\n\t} catch (error) {\n\t\tif (isMissingFileError(error)) return { status: \"missing\" };\n\t\tthrow error;\n\t}\n}\n\nfunction serializeManagedMemoryState(state: ManagedMemoryState): string {\n\treturn `${JSON.stringify(state)}\\n`;\n}\n\nasync function writeManagedMemoryState(statePath: string, state: ManagedMemoryState): Promise<void> {\n\tawait writeFileAtomic(statePath, serializeManagedMemoryState(state), { mode: 0o600 });\n}\n\nfunction reconcileManagedMemoryState(\n\tcurrentDigest: string,\n\tstate: ManagedMemoryState,\n): { recognized: true; state: ManagedMemoryState; changed: boolean } | { recognized: false } {\n\tif (currentDigest === state.committedDigest) {\n\t\tif (state.pendingDigest === undefined) return { recognized: true, state, changed: false };\n\t\treturn {\n\t\t\trecognized: true,\n\t\t\tstate: { version: 1, committedDigest: state.committedDigest },\n\t\t\tchanged: true,\n\t\t};\n\t}\n\tif (state.pendingDigest !== undefined && currentDigest === state.pendingDigest) {\n\t\treturn {\n\t\t\trecognized: true,\n\t\t\tstate: { version: 1, committedDigest: state.pendingDigest },\n\t\t\tchanged: true,\n\t\t};\n\t}\n\treturn { recognized: false };\n}\n\nfunction fitMemoryBlockToBudget(block: string, budget: MemoryPromptBudget | undefined): string {\n\tif (budget === undefined) return block;\n\tif (!budget.enabled || budget.maxLines <= 0 || budget.maxChars <= 0) return \"\";\n\tif (block.split(\"\\n\").length <= budget.maxLines && block.length <= budget.maxChars) return block;\n\t// Micro-context profiles deliberately omit a block that cannot fit whole. Larger constrained\n\t// profiles retain a bounded head and say explicitly that more memory exists on disk.\n\tif (budget.compact) return \"\";\n\n\tconst marker = \"[…memory truncated for capability budget; full files remain on disk]\";\n\tif (budget.maxLines < 2 || budget.maxChars <= marker.length + 1) return \"\";\n\tconst lines: string[] = [];\n\tlet chars = 0;\n\tconst contentCharLimit = budget.maxChars - marker.length - 1;\n\tfor (const line of block.split(\"\\n\")) {\n\t\tif (lines.length >= budget.maxLines - 1) break;\n\t\tconst separatorChars = lines.length > 0 ? 1 : 0;\n\t\tconst remaining = contentCharLimit - chars - separatorChars;\n\t\tif (remaining <= 0) break;\n\t\tconst rendered = line.length <= remaining ? line : `${line.slice(0, Math.max(0, remaining - 1))}…`;\n\t\tlines.push(rendered);\n\t\tchars += separatorChars + rendered.length;\n\t\tif (rendered.length !== line.length) break;\n\t}\n\tif (lines.length === 0) return \"\";\n\tlines.push(marker);\n\treturn lines.join(\"\\n\");\n}\n\nexport class FileStoreProvider implements MemoryProvider {\n\tpublic readonly name = \"file-store\";\n\tpublic readonly egress = \"local\";\n\n\tprivate ctx?: MemoryLifecycleContext;\n\tprivate memoryFilePath = \"\";\n\tprivate userFilePath = \"\";\n\tprivate memoryStatePath = \"\";\n\tprivate userStatePath = \"\";\n\n\tprivate lastWrittenMemory = \"\";\n\tprivate lastWrittenUser = \"\";\n\tprivate userArchive?: UserMemoryArchive;\n\tprivate readonly options: FileStoreProviderOptions;\n\n\t// Character budgets\n\tprivate static readonly BUDGET_MEMORY = 2200;\n\tprivate static readonly BUDGET_USER = 1375;\n\n\tconstructor(options: FileStoreProviderOptions = {}) {\n\t\tthis.options = options;\n\t}\n\n\tpublic isAvailable(): boolean {\n\t\treturn true;\n\t}\n\n\tpublic getCapabilities() {\n\t\treturn { surfaces: [\"context\" as const] };\n\t}\n\n\tpublic async initialize(_sessionId: string, ctx: MemoryLifecycleContext): Promise<void> {\n\t\tthis.ctx = ctx;\n\t\tthis.memoryFilePath = configFile(ctx.agentDir, \"MEMORY.md\");\n\t\tthis.userFilePath = configFile(ctx.agentDir, \"USER.md\");\n\t\tthis.memoryStatePath = managedMemoryStateFile(ctx.agentDir, \"MEMORY.md\");\n\t\tthis.userStatePath = managedMemoryStateFile(ctx.agentDir, \"USER.md\");\n\t\tthis.userArchive = new UserMemoryArchive(ctx.agentDir);\n\n\t\tawait fs.mkdir(ctx.agentDir, { recursive: true });\n\t\t[this.lastWrittenMemory, this.lastWrittenUser] = await Promise.all([\n\t\t\tthis.initializeManagedFile(this.memoryFilePath, this.memoryStatePath),\n\t\t\tthis.initializeManagedFile(this.userFilePath, this.userStatePath),\n\t\t]);\n\t}\n\n\tprivate async initializeManagedFile(filePath: string, statePath: string): Promise<string> {\n\t\treturn withFileLock(filePath, async () => {\n\t\t\tlet current = \"\";\n\t\t\ttry {\n\t\t\t\tcurrent = await fs.readFile(filePath, \"utf8\");\n\t\t\t} catch (error) {\n\t\t\t\tif (!isMissingFileError(error)) throw error;\n\t\t\t\tawait writeFileAtomic(filePath, \"\", { mode: 0o600 });\n\t\t\t}\n\n\t\t\tconst currentDigest = contentDigest(current);\n\t\t\tconst stateRead = await readManagedMemoryState(statePath);\n\t\t\tif (stateRead.status === \"missing\") {\n\t\t\t\tawait writeManagedMemoryState(statePath, { version: 1, committedDigest: currentDigest });\n\t\t\t\treturn current;\n\t\t\t}\n\t\t\tif (stateRead.status === \"invalid\") {\n\t\t\t\tawait writeFileAtomic(`${statePath}.bak.${Date.now()}.${randomUUID()}`, stateRead.raw, { mode: 0o600 });\n\t\t\t\tawait writeManagedMemoryState(statePath, { version: 1, committedDigest: currentDigest });\n\t\t\t\treturn current;\n\t\t\t}\n\n\t\t\tconst reconciled = reconcileManagedMemoryState(currentDigest, stateRead.state);\n\t\t\tif (reconciled.recognized && reconciled.changed) {\n\t\t\t\tawait writeManagedMemoryState(statePath, reconciled.state);\n\t\t\t}\n\t\t\treturn current;\n\t\t});\n\t}\n\n\tpublic systemPromptBlock(budget?: MemoryPromptBudget): string {\n\t\tconst sanitize = (content: string) => {\n\t\t\t// Strip hidden/bidi-control chars before injecting memory into the prompt (defence in depth: the\n\t\t\t// write path already blocks them, but a file edited out-of-band could carry them). Strip #31.\n\t\t\tconst lines = stripInvisibleUnicode(content).cleaned.split(\"\\n\");\n\t\t\tconst sanitizedLines = lines.map((line) => {\n\t\t\t\tconst threats = scanContextFileThreats(line);\n\t\t\t\tif (threats.length > 0) {\n\t\t\t\t\treturn `[BLOCKED: potential threat detected (${threats.join(\", \")})]`;\n\t\t\t\t}\n\t\t\t\treturn line;\n\t\t\t});\n\t\t\treturn sanitizedLines.join(\"\\n\");\n\t\t};\n\n\t\t// Read-time budget guard (cost): the memory tool already caps writes at BUDGET_*, but a file edited\n\t\t// externally (or by any path that bypasses the tool) could be arbitrarily large and would then\n\t\t// bloat the system prompt on EVERY turn. Cap the injected view to the same budget so the per-turn\n\t\t// cost stays bounded; the file on disk is untouched and the model is told it was truncated.\n\t\tconst cap = (content: string, limit: number) => {\n\t\t\tif (content.length <= limit) return content;\n\t\t\treturn `${content.slice(0, limit)}\\n[…truncated to ${limit} chars for the prompt; full file is on disk]`;\n\t\t};\n\n\t\tconst mem = cap(sanitize(this.lastWrittenMemory), FileStoreProvider.BUDGET_MEMORY);\n\t\tconst usr = cap(sanitize(this.lastWrittenUser), FileStoreProvider.BUDGET_USER);\n\n\t\tconst blocks: string[] = [];\n\t\tif (mem.trim()) {\n\t\t\tblocks.push(`## MEMORY.md:\\n${mem}`);\n\t\t}\n\t\tif (usr.trim()) {\n\t\t\tblocks.push(`## USER.md:\\n${usr}`);\n\t\t}\n\n\t\tif (blocks.length === 0) {\n\t\t\treturn \"\";\n\t\t}\n\n\t\tconst block = `=== Persistent Memory (file-store) ===\\n${FILE_STORE_MEMORY_SYSTEM_NOTE}\\n\\n${blocks.join(\"\\n\\n\")}`;\n\t\treturn fitMemoryBlockToBudget(block, budget);\n\t}\n\n\tpublic async prefetch(_query: string): Promise<string> {\n\t\t// static system prompt block is sufficient for file-store default; no-op prefetch\n\t\treturn \"\";\n\t}\n\n\tpublic async shutdown(): Promise<void> {\n\t\t// no-op\n\t}\n\n\tpublic getContextMarkers(): string[] {\n\t\treturn [];\n\t}\n\n\tpublic getToolDefinitions(): ToolDefinition[] {\n\t\treturn [\n\t\t\t{\n\t\t\t\tname: \"memory\",\n\t\t\t\tlabel: \"Persistent Memory Manager\",\n\t\t\t\tdescription:\n\t\t\t\t\t\"Add, replace, or remove durable project facts and user preferences. Proactively store newly verified reusable facts; USER.md overflow is migrated into indexed OKF shards.\",\n\t\t\t\tparameters: memorySchema,\n\t\t\t\texecute: async (_toolCallId, params: MemoryParams, _signal, _onUpdate, _execCtx) => {\n\t\t\t\t\tif (this.ctx?.isChildSession) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\ttext: \"Error: Writes to persistent memory are not allowed in child sessions (subagents).\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tdetails: { success: false, error: \"Child session write-gated\" },\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\n\t\t\t\t\tconst { action, target, content, oldContent } = params;\n\n\t\t\t\t\t// Strict-scope injection guard on the high-privilege WRITE path (agy #31): a poisoned\n\t\t\t\t\t// memory entry persists across sessions and is injected into every future system prompt,\n\t\t\t\t\t// so block outright rather than strip. Hidden/bidi-control chars have no legitimate place\n\t\t\t\t\t// in a memory note, so reject those too.\n\t\t\t\t\tif ((action === \"add\" || action === \"replace\") && content !== undefined) {\n\t\t\t\t\t\tif (hasInvisibleUnicode(content)) {\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\ttext: \"Error: memory write rejected — contains hidden/bidirectional control characters.\",\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Invisible unicode in memory write\" },\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst threats = scanContextFileThreats(content, \"strict\");\n\t\t\t\t\t\tif (threats.length > 0) {\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\ttext: `Error: memory write rejected — potential injection/exfiltration detected (${threats.join(\", \")}).`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Threat in memory write\" },\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\n\t\t\t\t\tconst filePath = target === \"memory\" ? this.memoryFilePath : this.userFilePath;\n\t\t\t\t\tconst statePath = target === \"memory\" ? this.memoryStatePath : this.userStatePath;\n\t\t\t\t\tconst budget = target === \"memory\" ? FileStoreProvider.BUDGET_MEMORY : FileStoreProvider.BUDGET_USER;\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\treturn await withFileLock(filePath, async () => {\n\t\t\t\t\t\t\tconst currentOnDisk = await fs.readFile(filePath, \"utf8\");\n\t\t\t\t\t\t\tconst currentDigest = contentDigest(currentOnDisk);\n\t\t\t\t\t\t\tconst stateRead = await readManagedMemoryState(statePath);\n\t\t\t\t\t\t\tlet managedState: ManagedMemoryState | undefined;\n\t\t\t\t\t\t\tif (stateRead.status === \"valid\") {\n\t\t\t\t\t\t\t\tconst reconciled = reconcileManagedMemoryState(currentDigest, stateRead.state);\n\t\t\t\t\t\t\t\tif (reconciled.recognized) {\n\t\t\t\t\t\t\t\t\tmanagedState = reconciled.state;\n\t\t\t\t\t\t\t\t\tif (reconciled.changed) await writeManagedMemoryState(statePath, reconciled.state);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (!managedState) {\n\t\t\t\t\t\t\t\tconst backupPath = `${filePath}.bak.${Date.now()}`;\n\t\t\t\t\t\t\t\tawait writeFileAtomic(backupPath, currentOnDisk, { mode: 0o600 });\n\t\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\t\ttext: `Error: Drift detected. The memory file has been modified out-of-band by an external process. A backup was created at ${backupPath}. Operation aborted.`,\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Drift detected\" },\n\t\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t// A peer session's committed write is authoritative. Refresh this provider's prompt\n\t\t\t\t\t\t\t// snapshot before applying the caller's mutation to that current content.\n\t\t\t\t\t\t\tif (target === \"memory\") this.lastWrittenMemory = currentOnDisk;\n\t\t\t\t\t\t\telse this.lastWrittenUser = currentOnDisk;\n\n\t\t\t\t\t\t\tlet newContent = currentOnDisk;\n\t\t\t\t\t\t\tlet archiveChanged = false;\n\t\t\t\t\t\t\tif (target === \"user\") {\n\t\t\t\t\t\t\t\tif (!this.userArchive) throw new Error(\"User memory archive is not initialized.\");\n\t\t\t\t\t\t\t\tif (action === \"add\") {\n\t\t\t\t\t\t\t\t\tif (content === undefined)\n\t\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'content' is required for action 'add'.\");\n\t\t\t\t\t\t\t\t\tconst result = await this.userArchive.apply(\n\t\t\t\t\t\t\t\t\t\tcurrentOnDisk,\n\t\t\t\t\t\t\t\t\t\t{ action, content },\n\t\t\t\t\t\t\t\t\t\tbudget,\n\t\t\t\t\t\t\t\t\t\tsupersedeNearDuplicateLine,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\tnewContent = result.userContent;\n\t\t\t\t\t\t\t\t\tarchiveChanged = result.archiveChanged;\n\t\t\t\t\t\t\t\t} else if (action === \"replace\") {\n\t\t\t\t\t\t\t\t\tif (content === undefined || oldContent === undefined) {\n\t\t\t\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t\t\t\t\"Parameters 'content' and 'oldContent' are required for action 'replace'.\",\n\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tconst result = await this.userArchive.apply(\n\t\t\t\t\t\t\t\t\t\tcurrentOnDisk,\n\t\t\t\t\t\t\t\t\t\t{ action, content, oldContent },\n\t\t\t\t\t\t\t\t\t\tbudget,\n\t\t\t\t\t\t\t\t\t\tsupersedeNearDuplicateLine,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\tnewContent = result.userContent;\n\t\t\t\t\t\t\t\t\tarchiveChanged = result.archiveChanged;\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tif (oldContent === undefined)\n\t\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'oldContent' is required for action 'remove'.\");\n\t\t\t\t\t\t\t\t\tconst result = await this.userArchive.apply(\n\t\t\t\t\t\t\t\t\t\tcurrentOnDisk,\n\t\t\t\t\t\t\t\t\t\t{ action, oldContent },\n\t\t\t\t\t\t\t\t\t\tbudget,\n\t\t\t\t\t\t\t\t\t\tsupersedeNearDuplicateLine,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\tnewContent = result.userContent;\n\t\t\t\t\t\t\t\t\tarchiveChanged = result.archiveChanged;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else if (action === \"add\") {\n\t\t\t\t\t\t\t\tif (content === undefined) {\n\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'content' is required for action 'add'.\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tconst superseded = supersedeNearDuplicateLine(currentOnDisk, content);\n\t\t\t\t\t\t\t\tif (superseded !== null) {\n\t\t\t\t\t\t\t\t\tnewContent = superseded;\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tnewContent =\n\t\t\t\t\t\t\t\t\t\tnewContent.endsWith(\"\\n\") || newContent === \"\"\n\t\t\t\t\t\t\t\t\t\t\t? `${newContent}${content}\\n`\n\t\t\t\t\t\t\t\t\t\t\t: `${newContent}\\n${content}\\n`;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else if (action === \"replace\") {\n\t\t\t\t\t\t\t\tif (content === undefined || oldContent === undefined) {\n\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameters 'content' and 'oldContent' are required for action 'replace'.\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tif (!currentOnDisk.includes(oldContent)) {\n\t\t\t\t\t\t\t\t\tthrow new Error(`The content to replace ('oldContent') was not found in the file.`);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tnewContent = currentOnDisk.replace(oldContent, content);\n\t\t\t\t\t\t\t} else if (action === \"remove\") {\n\t\t\t\t\t\t\t\tif (oldContent === undefined) {\n\t\t\t\t\t\t\t\t\tthrow new Error(\"Parameter 'oldContent' is required for action 'remove'.\");\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tif (!currentOnDisk.includes(oldContent)) {\n\t\t\t\t\t\t\t\t\tthrow new Error(`The content to remove ('oldContent') was not found in the file.`);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tnewContent = currentOnDisk.replace(oldContent, \"\");\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tif (newContent.length > budget) {\n\t\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\t\ttext: `Error: Memory budget exceeded. ${target === \"memory\" ? \"MEMORY.md\" : \"USER.md\"} limit is ${budget} characters. Current operation would result in ${newContent.length} characters.`,\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\t\tdetails: { success: false, error: \"Memory budget exceeded\" },\n\t\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tif (newContent !== currentOnDisk) {\n\t\t\t\t\t\t\t\tconst newDigest = contentDigest(newContent);\n\t\t\t\t\t\t\t\tawait writeManagedMemoryState(statePath, {\n\t\t\t\t\t\t\t\t\tversion: 1,\n\t\t\t\t\t\t\t\t\tcommittedDigest: managedState.committedDigest,\n\t\t\t\t\t\t\t\t\tpendingDigest: newDigest,\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\tawait writeFileAtomic(filePath, newContent, { mode: 0o600 });\n\t\t\t\t\t\t\t\tawait writeManagedMemoryState(statePath, { version: 1, committedDigest: newDigest });\n\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\tif (target === \"memory\") this.lastWrittenMemory = newContent;\n\t\t\t\t\t\t\telse this.lastWrittenUser = newContent;\n\t\t\t\t\t\t\tif (archiveChanged || newContent !== currentOnDisk) this.options.onDurableMemoryChanged?.();\n\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\t\ttext: `Successfully updated ${target === \"memory\" ? \"MEMORY.md\" : \"USER.md\"}.`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t\tdetails: { success: true },\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch (err) {\n\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\t\ttext: `Error: Failed to perform memory operation: ${String(err)}`,\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tdetails: { success: false, error: String(err) },\n\t\t\t\t\t\t};\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t},\n\t\t];\n\t}\n}\n"]}

package/dist/core/secrets/credential-exposure-guard.d.ts

@@ -9,5 +9,5 @@ export declare function isProtectedCredentialPath(rawPath: string, cwd: string,
 /** Stable model-facing refusal for direct inspection/mutation of credential material. */
 export declare function credentialToolBlockReason(toolName: string, args: unknown, cwd: string, boundary?: CredentialExposureBoundary): string | undefined;
 /** Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */
-export declare function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(tool: AgentTool<TParameters, TDetails>, cwd: string, boundary?: CredentialExposureBoundary): AgentTool<TParameters, TDetails>;
+export declare function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(tool: AgentTool<TParameters, TDetails>, _cwd: string, boundary?: CredentialExposureBoundary): AgentTool<TParameters, TDetails>;
 //# sourceMappingURL=credential-exposure-guard.d.ts.map

package/dist/core/secrets/credential-exposure-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-exposure-guard.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,2BAA2B,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAgCvC,MAAM,WAAW,0BAA0B;IAC1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAWD,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAgCT;AAyHD,yFAAyF;AACzF,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,MAAM,GAAG,SAAS,CAwDpB;AAuCD,wGAAwG;AACxG,wBAAgB,mCAAmC,CAAC,WAAW,SAAS,OAAO,EAAE,QAAQ,EACxF,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EACtC,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAuBlC"}
+{"version":3,"file":"credential-exposure-guard.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,2BAA2B,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAgCvC,MAAM,WAAW,0BAA0B;IAC1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAWD,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAgCT;AAyHD,yFAAyF;AACzF,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,MAAM,GAAG,SAAS,CAwDpB;AAuCD,wGAAwG;AACxG,wBAAgB,mCAAmC,CAAC,WAAW,SAAS,OAAO,EAAE,QAAQ,EACxF,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,0BAA0B,GACnC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAqBlC"}

package/dist/core/secrets/credential-exposure-guard.js

@@ -274,13 +274,10 @@ function redactStructuredDetails(value, redact, budget, depth = 0) {
     return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, redactStructuredDetails(entry, redact, budget, depth + 1)]));
 }
 /** Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */
-export function wrapToolWithCredentialExposureGuard(tool, cwd, boundary) {
+export function wrapToolWithCredentialExposureGuard(tool, _cwd, boundary) {
     return {
         ...tool,
         async execute(toolCallId, params, signal, onUpdate) {
-            const refusal = credentialToolBlockReason(tool.name, params, cwd, boundary);
-            if (refusal)
-                throw new Error(refusal);
             const safeUpdate = onUpdate
                 ? (partial) => {
                     onUpdate(redactResult(partial, boundary));

package/dist/core/secrets/credential-exposure-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-exposure-guard.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAA+B,MAAM,kCAAkC,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,QAAQ;CACR,CAAC,CAAC;AACH,MAAM,oBAAoB,GACzB,0IAA0I,CAAC;AAC5I,MAAM,qBAAqB,GAAG,uFAAuF,CAAC;AACtH,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AACjE,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAChE,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAQjG,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,OAAe,EACf,GAAW,EACX,QAAqC;IAErC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC;YACJ,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,mEAAmE;QACpE,CAAC;IACF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACJ,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACR,wEAAwE;QACzE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,IAAI,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC1G,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC3B,OAAe,EACf,GAAW,EACX,QAAqC;IAErC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,WAAW;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAExF,MAAM,gBAAgB,GAAG,CACxB,UAAoB,EACpB,SAAkB,EACuD,EAAE;QAC3E,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;YAC7E,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9G,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC;oBAAE,OAAO,qBAAqB,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAChD,MAAM,UAAU,GACf,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/F,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,+BAA+B,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;oBACxG,OAAO,iBAAiB,CAAC;gBAC1B,CAAC;gBACD,MAAM,WAAW,GAChB,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnG,MAAM,oBAAoB,GACzB,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBACxB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvF,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB;oBAAE,OAAO,cAAc,CAAC;gBACzG,SAAS;YACV,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG;oBAAE,SAAS;gBAC/D,IAAI,yBAAyB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;oBAAE,OAAO,iBAAiB,CAAC;YAC/E,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,kBAAkB;gBAAE,kBAAkB,GAAG,KAAK,CAAC;;gBAC9C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClC,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,uEAAuE;YACvE,kEAAkE;YAClE,kBAAkB,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5D,SAAS;QACV,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,UAAU,GAAG,EAAE,CAAC;QAChB,kBAAkB,GAAG,KAAK,CAAC;QAC3B,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;IACnC,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAc;IACtD,OAAO,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACzC,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5E,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,GAAW;IAC1D,IAAI,CAAC;QACJ,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,GAAW,EAAE,QAAqC;IACrG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,SAAS,IAAI,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CACxC,QAAgB,EAChB,IAAa,EACb,GAAW,EACX,QAAqC;IAErC,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,yKAAyK,CAAC;QAClL,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxD,CAAC,IAAI,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACnD,CAAC;YACF,OAAO,mGAAmG,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,uLAAuL,CAAC;QAChM,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxD,CAAC,OAAO,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACzD,CAAC;YACF,OAAO,kGAAkG,CAAC;QAC3G,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAClC,OAAO,uKAAuK,CAAC;QAChL,CAAC;QACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;YACzC,OAAO,kIAAkI,CAAC;QAC3I,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YAC3E,OAAO,sIAAsI,CAAC;QAC/I,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IACC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,4BAA4B,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC;YACjD,CAAC,UAAU,KAAK,SAAS,IAAI,yBAAyB,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EACjF,CAAC;YACF,OAAO,uIAAuI,CAAC;QAChJ,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAI,MAA0B,EAAE,QAAqC;IACzF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5B,OAAO;QACN,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChH,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAM;KACrE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,KAAc,EACd,MAAgC,EAChC,MAAyB,EACzB,KAAK,GAAG,CAAC;IAET,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,KAAK,IAAI,yBAAyB,IAAI,MAAM,CAAC,KAAK,GAAG,yBAAyB,EAAE,CAAC;QACpF,OAAO,yCAAyC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,oDAAoD,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAC7G,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,mCAAmC,CAClD,IAAsC,EACtC,GAAW,EACX,QAAqC;IAErC,OAAO;QACN,GAAG,IAAI;QACP,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;YACjD,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5E,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,UAAU,GAAG,QAAQ;gBAC1B,CAAC,CAAC,CAAC,OAAkC,EAAE,EAAE;oBACvC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBACF,CAAC,CAAC,SAAS,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACd,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1F,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC9F,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { realpathSync, statSync } from \"node:fs\";\nimport { basename, isAbsolute, relative, resolve, sep } from \"node:path\";\nimport type { AgentTool, AgentToolResult } from \"@caupulican/pi-agent-core\";\nimport type { TSchema } from \"typebox\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport { parseShellSearchInvocationScope, type ShellContentSearchTool } from \"../tools/search-command-guard.ts\";\nimport { tokenizeShellCommand } from \"../tools/shell-command-parser.ts\";\n\nconst DIRECT_PATH_TOOLS = new Set([\"read\", \"edit\", \"write\", \"ls\"]);\nconst SHELL_INSPECTION_COMMANDS = new Set([\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"less\",\n\t\"more\",\n\t\"sed\",\n\t\"awk\",\n\t\"grep\",\n\t\"rg\",\n\t\"ripgrep\",\n\t\"type\",\n\t\"get-content\",\n\t\"select-string\",\n\t\"source\",\n]);\nconst SHELL_SECRET_READ_RE =\n\t/\\b(?:cat|head|tail|less|more|sed|awk|grep|rg|type|get-content|select-string|source)\\b[^\\n;&|]*(?:^|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_SECRET_READ_RE = /\\b(?:open|read_text|read_bytes)\\s*\\([^\\n)]*(?:^|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_INSPECTION_RE = /\\b(?:open|read_text|read_bytes)\\b/;\nconst QUOTED_TEXT_RE = /([\"'])([^\"'\\\\]*(?:\\\\.[^\"'\\\\]*)*)\\1/g;\nconst MAX_REDACTED_DETAIL_DEPTH = 8;\nconst MAX_REDACTED_DETAIL_NODES = 10_000;\nconst JQ_OPTIONS_WITH_ONE_OPERAND = new Set([\"-L\", \"--indent\"]);\nconst JQ_OPTIONS_WITH_TWO_OPERANDS = new Set([\"--arg\", \"--argjson\", \"--rawfile\", \"--slurpfile\"]);\n\nexport interface CredentialExposureBoundary {\n\tredactSensitiveText(text: string): string;\n\tprotectedFiles?: readonly string[];\n\tprotectedDirectories?: readonly string[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isInside(root: string, target: string): boolean {\n\tconst fromRoot = relative(root, target);\n\treturn fromRoot === \"\" || (!fromRoot.startsWith(`..${sep}`) && fromRoot !== \"..\" && !isAbsolute(fromRoot));\n}\n\nexport function isProtectedCredentialPath(\n\trawPath: string,\n\tcwd: string,\n\tboundary?: CredentialExposureBoundary,\n): boolean {\n\tconst resolved = resolve(cwd, rawPath);\n\tconst candidates = [resolved];\n\ttry {\n\t\tconst canonical = realpathSync.native(resolved);\n\t\tif (canonical !== resolved) candidates.push(canonical);\n\t} catch {\n\t\t// Nonexistent write targets still receive the lexical filename check.\n\t}\n\tconst protectedFiles = (boundary?.protectedFiles ?? []).map((path) => resolve(path));\n\tconst protectedDirectories = (boundary?.protectedDirectories ?? []).map((path) => resolve(path));\n\tfor (const path of [...protectedFiles]) {\n\t\ttry {\n\t\t\tprotectedFiles.push(realpathSync.native(path));\n\t\t} catch {\n\t\t\t// A not-yet-created protected file still retains its lexical path.\n\t\t}\n\t}\n\tfor (const path of [...protectedDirectories]) {\n\t\ttry {\n\t\t\tprotectedDirectories.push(realpathSync.native(path));\n\t\t} catch {\n\t\t\t// A not-yet-created protected directory still retains its lexical root.\n\t\t}\n\t}\n\treturn candidates.some((candidate) => {\n\t\tif (protectedFiles.includes(candidate) || protectedDirectories.some((root) => isInside(root, candidate))) {\n\t\t\treturn true;\n\t\t}\n\t\tconst fileName = basename(candidate);\n\t\treturn fileName === \".env\" || fileName.startsWith(\".env.\") || fileName.endsWith(\".env\");\n\t});\n}\n\nfunction shellCredentialRisk(\n\tcommand: string,\n\tcwd: string,\n\tboundary?: CredentialExposureBoundary,\n): \"broad_search\" | \"credential_path\" | \"process_environment\" | undefined {\n\tconst shellTokens = tokenizeShellCommand(command);\n\tif (!shellTokens) return /\\b(?:grep|rg)\\b/iu.test(command) ? \"broad_search\" : undefined;\n\n\tconst assessInvocation = (\n\t\tinvocation: string[],\n\t\treadsPipe: boolean,\n\t): \"broad_search\" | \"credential_path\" | \"process_environment\" | undefined => {\n\t\tfor (let commandIndex = 0; commandIndex < invocation.length; commandIndex++) {\n\t\t\tconst toolName = (invocation[commandIndex].split(/[\\\\/]/u).at(-1) ?? \"\").toLowerCase().replace(/\\.exe$/u, \"\");\n\t\t\tif (toolName === \"jq\") {\n\t\t\t\tconst filter = jqFilterFromArgs(invocation.slice(commandIndex + 1));\n\t\t\t\tif (filter && jqFilterReadsProcessEnvironment(filter)) return \"process_environment\";\n\t\t\t}\n\t\t\tif (!SHELL_INSPECTION_COMMANDS.has(toolName)) continue;\n\t\t\tconst args = invocation.slice(commandIndex + 1);\n\t\t\tconst searchTool: ShellContentSearchTool | undefined =\n\t\t\t\ttoolName === \"rg\" || toolName === \"ripgrep\" ? \"rg\" : toolName === \"grep\" ? \"grep\" : undefined;\n\t\t\tif (searchTool) {\n\t\t\t\tconst scope = parseShellSearchInvocationScope(searchTool, args, readsPipe);\n\t\t\t\tif (scope.targets.some((target) => target !== \"-\" && isProtectedCredentialPath(target, cwd, boundary))) {\n\t\t\t\t\treturn \"credential_path\";\n\t\t\t\t}\n\t\t\t\tconst hasSafeGlob =\n\t\t\t\t\tscope.positiveGlobs.length > 0 && scope.positiveGlobs.every((glob) => isCredentialSafeGlob(glob));\n\t\t\t\tconst hasOnlyExplicitFiles =\n\t\t\t\t\tscope.targets.length > 0 &&\n\t\t\t\t\tscope.targets.every((target) => target === \"-\" || isExistingRegularFile(target, cwd));\n\t\t\t\tif (!scope.metaOnly && !scope.readsStdin && !hasSafeGlob && !hasOnlyExplicitFiles) return \"broad_search\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfor (const token of args) {\n\t\t\t\tif (!token || token.startsWith(\"-\") || token === \".\") continue;\n\t\t\t\tif (isProtectedCredentialPath(token, cwd, boundary)) return \"credential_path\";\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t};\n\n\tlet invocation: string[] = [];\n\tlet skipRedirectTarget = false;\n\tlet readsPipe = false;\n\tfor (const token of shellTokens) {\n\t\tif (token.kind === \"arg\") {\n\t\t\tif (skipRedirectTarget) skipRedirectTarget = false;\n\t\t\telse invocation.push(token.value);\n\t\t\tcontinue;\n\t\t}\n\t\tif (token.kind === \"redirect\") {\n\t\t\t// Descriptor duplication (`2>&1`) has no following path operand. Other\n\t\t\t// redirects do, and that target must never count as search scope.\n\t\t\tskipRedirectTarget = !/^\\d*[<>]&[\\d-]+$/u.test(token.value);\n\t\t\tcontinue;\n\t\t}\n\t\tconst risk = assessInvocation(invocation, readsPipe);\n\t\tif (risk) return risk;\n\t\tinvocation = [];\n\t\tskipRedirectTarget = false;\n\t\treadsPipe = token.kind === \"pipe\";\n\t}\n\treturn assessInvocation(invocation, readsPipe);\n}\n\nfunction jqFilterFromArgs(args: string[]): string | undefined {\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst token = args[index];\n\t\tif (token === \"--\") return args[index + 1];\n\t\tif (JQ_OPTIONS_WITH_TWO_OPERANDS.has(token)) {\n\t\t\tindex += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (JQ_OPTIONS_WITH_ONE_OPERAND.has(token)) {\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token.startsWith(\"-\")) continue;\n\t\treturn token;\n\t}\n\treturn undefined;\n}\n\nfunction jqFilterReadsProcessEnvironment(filter: string): boolean {\n\treturn /(?:^|[\\s|,(:;[])(?:env|\\$ENV)(?=$|[\\s|),.;[\\]}])/u.test(filter);\n}\n\nfunction isCredentialSafeGlob(glob: string): boolean {\n\tif (/(?:^|[\\\\/])?\\.env(?:\\.|\\*|$)/i.test(glob)) return false;\n\tconst filePattern = glob.replace(/\\\\/g, \"/\").split(\"/\").at(-1) ?? \"\";\n\tconst suffix = filePattern.match(/\\.([A-Za-z0-9_-]+)$/)?.[1]?.toLowerCase();\n\treturn suffix !== undefined && suffix !== \"env\";\n}\n\nfunction isExistingRegularFile(rawPath: string, cwd: string): boolean {\n\ttry {\n\t\treturn statSync(resolve(cwd, rawPath)).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction pythonInspectsCredentialPath(code: string, cwd: string, boundary?: CredentialExposureBoundary): boolean {\n\tif (!PYTHON_INSPECTION_RE.test(code)) return false;\n\tQUOTED_TEXT_RE.lastIndex = 0;\n\tfor (const match of code.matchAll(QUOTED_TEXT_RE)) {\n\t\tconst candidate = match[2]?.replace(/\\\\([\\\\\"'])/g, \"$1\");\n\t\tif (candidate && isProtectedCredentialPath(candidate, cwd, boundary)) return true;\n\t}\n\treturn false;\n}\n\nfunction directPathFromArgs(args: unknown): string | undefined {\n\tif (!isRecord(args)) return undefined;\n\treturn typeof args.path === \"string\" ? args.path : undefined;\n}\n\n/** Stable model-facing refusal for direct inspection/mutation of credential material. */\nexport function credentialToolBlockReason(\n\ttoolName: string,\n\targs: unknown,\n\tcwd: string,\n\tboundary?: CredentialExposureBoundary,\n): string | undefined {\n\tif (toolName === \"secret_store\" || !isRecord(args)) return undefined;\n\tif (DIRECT_PATH_TOOLS.has(toolName)) {\n\t\tconst path = directPathFromArgs(args);\n\t\tif (path && isProtectedCredentialPath(path, cwd, boundary)) {\n\t\t\treturn \"Credential file access is model-blind. Use secret_store to activate an owner-authorized profile, then run the consuming application without inspecting credential data.\";\n\t\t}\n\t}\n\tif (toolName === \"grep\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst glob = typeof args.glob === \"string\" ? args.glob : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, boundary)) ||\n\t\t\t(glob && /(?:^|[\\\\/])?\\.env(?:\\.|\\*|$)/i.test(glob))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing search. Use secret_store metadata instead.\";\n\t\t}\n\t\tif (!(path && isExistingRegularFile(path, cwd)) && !(glob && isCredentialSafeGlob(glob))) {\n\t\t\treturn \"Credential-safe grep requires one explicit regular file or a narrow non-dotenv file glob (for example *.ts). Refine the search instead of scanning a directory without a file filter.\";\n\t\t}\n\t}\n\tif (toolName === \"find\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst pattern = typeof args.pattern === \"string\" ? args.pattern : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, boundary)) ||\n\t\t\t(pattern && /(?:^|[\\\\/])?\\.env(?:\\.|\\*|$)/i.test(pattern))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing discovery. Use secret_store list instead.\";\n\t\t}\n\t}\n\tif (toolName === \"bash\" || toolName === \"powershell\" || toolName === \"run_process\") {\n\t\tconst command = typeof args.command === \"string\" ? args.command : \"\";\n\t\tconst shellRisk = shellCredentialRisk(command, cwd, boundary);\n\t\tif (shellRisk === \"broad_search\") {\n\t\t\treturn \"Credential-safe shell search requires a narrow non-dotenv file glob (for example -g '*.ts') or one explicit regular file. Refine the rg/grep command before retrying.\";\n\t\t}\n\t\tif (shellRisk === \"process_environment\") {\n\t\t\treturn \"Direct jq projection of the process environment is blocked because it can expose credentials. Query bounded JSON inputs instead.\";\n\t\t}\n\t\tif (SHELL_SECRET_READ_RE.test(command) || shellRisk === \"credential_path\") {\n\t\t\treturn \"Direct shell inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming command normally.\";\n\t\t}\n\t}\n\tif (toolName === \"python\") {\n\t\tconst code = typeof args.code === \"string\" ? args.code : \"\";\n\t\tconst scriptPath = typeof args.scriptPath === \"string\" ? args.scriptPath : undefined;\n\t\tif (\n\t\t\tPYTHON_SECRET_READ_RE.test(code) ||\n\t\t\tpythonInspectsCredentialPath(code, cwd, boundary) ||\n\t\t\t(scriptPath !== undefined && isProtectedCredentialPath(scriptPath, cwd, boundary))\n\t\t) {\n\t\t\treturn \"Direct Python inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming program normally.\";\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction redactResult<T>(result: AgentToolResult<T>, boundary?: CredentialExposureBoundary): AgentToolResult<T> {\n\tconst redact = (text: string) => (boundary ? boundary.redactSensitiveText(text) : redactKnownSecrets(text));\n\tconst budget = { nodes: 0 };\n\treturn {\n\t\t...result,\n\t\tcontent: result.content.map((block) => (block.type === \"text\" ? { ...block, text: redact(block.text) } : block)),\n\t\tdetails: redactStructuredDetails(result.details, redact, budget) as T,\n\t};\n}\n\nfunction redactStructuredDetails(\n\tvalue: unknown,\n\tredact: (text: string) => string,\n\tbudget: { nodes: number },\n\tdepth = 0,\n): unknown {\n\tif (typeof value === \"string\") return redact(value);\n\tif (value === null || typeof value !== \"object\") return value;\n\tbudget.nodes++;\n\tif (depth >= MAX_REDACTED_DETAIL_DEPTH || budget.nodes > MAX_REDACTED_DETAIL_NODES) {\n\t\treturn \"[DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map((entry) => redactStructuredDetails(entry, redact, budget, depth + 1));\n\t}\n\tlet prototype: object | null;\n\ttry {\n\t\tprototype = Object.getPrototypeOf(value);\n\t} catch {\n\t\treturn \"[UNREADABLE DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (prototype !== Object.prototype && prototype !== null) return value;\n\treturn Object.fromEntries(\n\t\tObject.entries(value).map(([key, entry]) => [key, redactStructuredDetails(entry, redact, budget, depth + 1)]),\n\t);\n}\n\n/** Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */\nexport function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(\n\ttool: AgentTool<TParameters, TDetails>,\n\tcwd: string,\n\tboundary?: CredentialExposureBoundary,\n): AgentTool<TParameters, TDetails> {\n\treturn {\n\t\t...tool,\n\t\tasync execute(toolCallId, params, signal, onUpdate) {\n\t\t\tconst refusal = credentialToolBlockReason(tool.name, params, cwd, boundary);\n\t\t\tif (refusal) throw new Error(refusal);\n\t\t\tconst safeUpdate = onUpdate\n\t\t\t\t? (partial: AgentToolResult<TDetails>) => {\n\t\t\t\t\t\tonUpdate(redactResult(partial, boundary));\n\t\t\t\t\t}\n\t\t\t\t: undefined;\n\t\t\ttry {\n\t\t\t\treturn redactResult(await tool.execute(toolCallId, params, signal, safeUpdate), boundary);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof Error) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\tboundary ? boundary.redactSensitiveText(error.message) : redactKnownSecrets(error.message),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow new Error(\"Credential-safe tool execution failed without retaining raw error output.\");\n\t\t\t}\n\t\t},\n\t};\n}\n"]}
+{"version":3,"file":"credential-exposure-guard.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAA+B,MAAM,kCAAkC,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,QAAQ;CACR,CAAC,CAAC;AACH,MAAM,oBAAoB,GACzB,0IAA0I,CAAC;AAC5I,MAAM,qBAAqB,GAAG,uFAAuF,CAAC;AACtH,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AACjE,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAChE,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAQjG,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,OAAe,EACf,GAAW,EACX,QAAqC;IAErC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC;YACJ,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,mEAAmE;QACpE,CAAC;IACF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACJ,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACR,wEAAwE;QACzE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,IAAI,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;YAC1G,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC3B,OAAe,EACf,GAAW,EACX,QAAqC;IAErC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,WAAW;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAExF,MAAM,gBAAgB,GAAG,CACxB,UAAoB,EACpB,SAAkB,EACuD,EAAE;QAC3E,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;YAC7E,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9G,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC;oBAAE,OAAO,qBAAqB,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAChD,MAAM,UAAU,GACf,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/F,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,+BAA+B,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;oBACxG,OAAO,iBAAiB,CAAC;gBAC1B,CAAC;gBACD,MAAM,WAAW,GAChB,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnG,MAAM,oBAAoB,GACzB,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBACxB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvF,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB;oBAAE,OAAO,cAAc,CAAC;gBACzG,SAAS;YACV,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG;oBAAE,SAAS;gBAC/D,IAAI,yBAAyB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;oBAAE,OAAO,iBAAiB,CAAC;YAC/E,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,kBAAkB;gBAAE,kBAAkB,GAAG,KAAK,CAAC;;gBAC9C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClC,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,uEAAuE;YACvE,kEAAkE;YAClE,kBAAkB,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5D,SAAS;QACV,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,UAAU,GAAG,EAAE,CAAC;QAChB,kBAAkB,GAAG,KAAK,CAAC;QAC3B,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;IACnC,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAc;IACtD,OAAO,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACzC,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5E,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,GAAW;IAC1D,IAAI,CAAC;QACJ,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,GAAW,EAAE,QAAqC;IACrG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,SAAS,IAAI,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CACxC,QAAgB,EAChB,IAAa,EACb,GAAW,EACX,QAAqC;IAErC,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,yKAAyK,CAAC;QAClL,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxD,CAAC,IAAI,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACnD,CAAC;YACF,OAAO,mGAAmG,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,uLAAuL,CAAC;QAChM,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxD,CAAC,OAAO,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACzD,CAAC;YACF,OAAO,kGAAkG,CAAC;QAC3G,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAClC,OAAO,uKAAuK,CAAC;QAChL,CAAC;QACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;YACzC,OAAO,kIAAkI,CAAC;QAC3I,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YAC3E,OAAO,sIAAsI,CAAC;QAC/I,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IACC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,4BAA4B,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC;YACjD,CAAC,UAAU,KAAK,SAAS,IAAI,yBAAyB,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EACjF,CAAC;YACF,OAAO,uIAAuI,CAAC;QAChJ,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAI,MAA0B,EAAE,QAAqC;IACzF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5B,OAAO;QACN,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChH,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAM;KACrE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,KAAc,EACd,MAAgC,EAChC,MAAyB,EACzB,KAAK,GAAG,CAAC;IAET,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,KAAK,IAAI,yBAAyB,IAAI,MAAM,CAAC,KAAK,GAAG,yBAAyB,EAAE,CAAC;QACpF,OAAO,yCAAyC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,oDAAoD,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAC7G,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,mCAAmC,CAClD,IAAsC,EACtC,IAAY,EACZ,QAAqC;IAErC,OAAO;QACN,GAAG,IAAI;QACP,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;YACjD,MAAM,UAAU,GAAG,QAAQ;gBAC1B,CAAC,CAAC,CAAC,OAAkC,EAAE,EAAE;oBACvC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBACF,CAAC,CAAC,SAAS,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACd,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1F,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC9F,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { realpathSync, statSync } from \"node:fs\";\nimport { basename, isAbsolute, relative, resolve, sep } from \"node:path\";\nimport type { AgentTool, AgentToolResult } from \"@caupulican/pi-agent-core\";\nimport type { TSchema } from \"typebox\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport { parseShellSearchInvocationScope, type ShellContentSearchTool } from \"../tools/search-command-guard.ts\";\nimport { tokenizeShellCommand } from \"../tools/shell-command-parser.ts\";\n\nconst DIRECT_PATH_TOOLS = new Set([\"read\", \"edit\", \"write\", \"ls\"]);\nconst SHELL_INSPECTION_COMMANDS = new Set([\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"less\",\n\t\"more\",\n\t\"sed\",\n\t\"awk\",\n\t\"grep\",\n\t\"rg\",\n\t\"ripgrep\",\n\t\"type\",\n\t\"get-content\",\n\t\"select-string\",\n\t\"source\",\n]);\nconst SHELL_SECRET_READ_RE =\n\t/\\b(?:cat|head|tail|less|more|sed|awk|grep|rg|type|get-content|select-string|source)\\b[^\\n;&|]*(?:^|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_SECRET_READ_RE = /\\b(?:open|read_text|read_bytes)\\s*\\([^\\n)]*(?:^|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_INSPECTION_RE = /\\b(?:open|read_text|read_bytes)\\b/;\nconst QUOTED_TEXT_RE = /([\"'])([^\"'\\\\]*(?:\\\\.[^\"'\\\\]*)*)\\1/g;\nconst MAX_REDACTED_DETAIL_DEPTH = 8;\nconst MAX_REDACTED_DETAIL_NODES = 10_000;\nconst JQ_OPTIONS_WITH_ONE_OPERAND = new Set([\"-L\", \"--indent\"]);\nconst JQ_OPTIONS_WITH_TWO_OPERANDS = new Set([\"--arg\", \"--argjson\", \"--rawfile\", \"--slurpfile\"]);\n\nexport interface CredentialExposureBoundary {\n\tredactSensitiveText(text: string): string;\n\tprotectedFiles?: readonly string[];\n\tprotectedDirectories?: readonly string[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isInside(root: string, target: string): boolean {\n\tconst fromRoot = relative(root, target);\n\treturn fromRoot === \"\" || (!fromRoot.startsWith(`..${sep}`) && fromRoot !== \"..\" && !isAbsolute(fromRoot));\n}\n\nexport function isProtectedCredentialPath(\n\trawPath: string,\n\tcwd: string,\n\tboundary?: CredentialExposureBoundary,\n): boolean {\n\tconst resolved = resolve(cwd, rawPath);\n\tconst candidates = [resolved];\n\ttry {\n\t\tconst canonical = realpathSync.native(resolved);\n\t\tif (canonical !== resolved) candidates.push(canonical);\n\t} catch {\n\t\t// Nonexistent write targets still receive the lexical filename check.\n\t}\n\tconst protectedFiles = (boundary?.protectedFiles ?? []).map((path) => resolve(path));\n\tconst protectedDirectories = (boundary?.protectedDirectories ?? []).map((path) => resolve(path));\n\tfor (const path of [...protectedFiles]) {\n\t\ttry {\n\t\t\tprotectedFiles.push(realpathSync.native(path));\n\t\t} catch {\n\t\t\t// A not-yet-created protected file still retains its lexical path.\n\t\t}\n\t}\n\tfor (const path of [...protectedDirectories]) {\n\t\ttry {\n\t\t\tprotectedDirectories.push(realpathSync.native(path));\n\t\t} catch {\n\t\t\t// A not-yet-created protected directory still retains its lexical root.\n\t\t}\n\t}\n\treturn candidates.some((candidate) => {\n\t\tif (protectedFiles.includes(candidate) || protectedDirectories.some((root) => isInside(root, candidate))) {\n\t\t\treturn true;\n\t\t}\n\t\tconst fileName = basename(candidate);\n\t\treturn fileName === \".env\" || fileName.startsWith(\".env.\") || fileName.endsWith(\".env\");\n\t});\n}\n\nfunction shellCredentialRisk(\n\tcommand: string,\n\tcwd: string,\n\tboundary?: CredentialExposureBoundary,\n): \"broad_search\" | \"credential_path\" | \"process_environment\" | undefined {\n\tconst shellTokens = tokenizeShellCommand(command);\n\tif (!shellTokens) return /\\b(?:grep|rg)\\b/iu.test(command) ? \"broad_search\" : undefined;\n\n\tconst assessInvocation = (\n\t\tinvocation: string[],\n\t\treadsPipe: boolean,\n\t): \"broad_search\" | \"credential_path\" | \"process_environment\" | undefined => {\n\t\tfor (let commandIndex = 0; commandIndex < invocation.length; commandIndex++) {\n\t\t\tconst toolName = (invocation[commandIndex].split(/[\\\\/]/u).at(-1) ?? \"\").toLowerCase().replace(/\\.exe$/u, \"\");\n\t\t\tif (toolName === \"jq\") {\n\t\t\t\tconst filter = jqFilterFromArgs(invocation.slice(commandIndex + 1));\n\t\t\t\tif (filter && jqFilterReadsProcessEnvironment(filter)) return \"process_environment\";\n\t\t\t}\n\t\t\tif (!SHELL_INSPECTION_COMMANDS.has(toolName)) continue;\n\t\t\tconst args = invocation.slice(commandIndex + 1);\n\t\t\tconst searchTool: ShellContentSearchTool | undefined =\n\t\t\t\ttoolName === \"rg\" || toolName === \"ripgrep\" ? \"rg\" : toolName === \"grep\" ? \"grep\" : undefined;\n\t\t\tif (searchTool) {\n\t\t\t\tconst scope = parseShellSearchInvocationScope(searchTool, args, readsPipe);\n\t\t\t\tif (scope.targets.some((target) => target !== \"-\" && isProtectedCredentialPath(target, cwd, boundary))) {\n\t\t\t\t\treturn \"credential_path\";\n\t\t\t\t}\n\t\t\t\tconst hasSafeGlob =\n\t\t\t\t\tscope.positiveGlobs.length > 0 && scope.positiveGlobs.every((glob) => isCredentialSafeGlob(glob));\n\t\t\t\tconst hasOnlyExplicitFiles =\n\t\t\t\t\tscope.targets.length > 0 &&\n\t\t\t\t\tscope.targets.every((target) => target === \"-\" || isExistingRegularFile(target, cwd));\n\t\t\t\tif (!scope.metaOnly && !scope.readsStdin && !hasSafeGlob && !hasOnlyExplicitFiles) return \"broad_search\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfor (const token of args) {\n\t\t\t\tif (!token || token.startsWith(\"-\") || token === \".\") continue;\n\t\t\t\tif (isProtectedCredentialPath(token, cwd, boundary)) return \"credential_path\";\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t};\n\n\tlet invocation: string[] = [];\n\tlet skipRedirectTarget = false;\n\tlet readsPipe = false;\n\tfor (const token of shellTokens) {\n\t\tif (token.kind === \"arg\") {\n\t\t\tif (skipRedirectTarget) skipRedirectTarget = false;\n\t\t\telse invocation.push(token.value);\n\t\t\tcontinue;\n\t\t}\n\t\tif (token.kind === \"redirect\") {\n\t\t\t// Descriptor duplication (`2>&1`) has no following path operand. Other\n\t\t\t// redirects do, and that target must never count as search scope.\n\t\t\tskipRedirectTarget = !/^\\d*[<>]&[\\d-]+$/u.test(token.value);\n\t\t\tcontinue;\n\t\t}\n\t\tconst risk = assessInvocation(invocation, readsPipe);\n\t\tif (risk) return risk;\n\t\tinvocation = [];\n\t\tskipRedirectTarget = false;\n\t\treadsPipe = token.kind === \"pipe\";\n\t}\n\treturn assessInvocation(invocation, readsPipe);\n}\n\nfunction jqFilterFromArgs(args: string[]): string | undefined {\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst token = args[index];\n\t\tif (token === \"--\") return args[index + 1];\n\t\tif (JQ_OPTIONS_WITH_TWO_OPERANDS.has(token)) {\n\t\t\tindex += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (JQ_OPTIONS_WITH_ONE_OPERAND.has(token)) {\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token.startsWith(\"-\")) continue;\n\t\treturn token;\n\t}\n\treturn undefined;\n}\n\nfunction jqFilterReadsProcessEnvironment(filter: string): boolean {\n\treturn /(?:^|[\\s|,(:;[])(?:env|\\$ENV)(?=$|[\\s|),.;[\\]}])/u.test(filter);\n}\n\nfunction isCredentialSafeGlob(glob: string): boolean {\n\tif (/(?:^|[\\\\/])?\\.env(?:\\.|\\*|$)/i.test(glob)) return false;\n\tconst filePattern = glob.replace(/\\\\/g, \"/\").split(\"/\").at(-1) ?? \"\";\n\tconst suffix = filePattern.match(/\\.([A-Za-z0-9_-]+)$/)?.[1]?.toLowerCase();\n\treturn suffix !== undefined && suffix !== \"env\";\n}\n\nfunction isExistingRegularFile(rawPath: string, cwd: string): boolean {\n\ttry {\n\t\treturn statSync(resolve(cwd, rawPath)).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction pythonInspectsCredentialPath(code: string, cwd: string, boundary?: CredentialExposureBoundary): boolean {\n\tif (!PYTHON_INSPECTION_RE.test(code)) return false;\n\tQUOTED_TEXT_RE.lastIndex = 0;\n\tfor (const match of code.matchAll(QUOTED_TEXT_RE)) {\n\t\tconst candidate = match[2]?.replace(/\\\\([\\\\\"'])/g, \"$1\");\n\t\tif (candidate && isProtectedCredentialPath(candidate, cwd, boundary)) return true;\n\t}\n\treturn false;\n}\n\nfunction directPathFromArgs(args: unknown): string | undefined {\n\tif (!isRecord(args)) return undefined;\n\treturn typeof args.path === \"string\" ? args.path : undefined;\n}\n\n/** Stable model-facing refusal for direct inspection/mutation of credential material. */\nexport function credentialToolBlockReason(\n\ttoolName: string,\n\targs: unknown,\n\tcwd: string,\n\tboundary?: CredentialExposureBoundary,\n): string | undefined {\n\tif (toolName === \"secret_store\" || !isRecord(args)) return undefined;\n\tif (DIRECT_PATH_TOOLS.has(toolName)) {\n\t\tconst path = directPathFromArgs(args);\n\t\tif (path && isProtectedCredentialPath(path, cwd, boundary)) {\n\t\t\treturn \"Credential file access is model-blind. Use secret_store to activate an owner-authorized profile, then run the consuming application without inspecting credential data.\";\n\t\t}\n\t}\n\tif (toolName === \"grep\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst glob = typeof args.glob === \"string\" ? args.glob : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, boundary)) ||\n\t\t\t(glob && /(?:^|[\\\\/])?\\.env(?:\\.|\\*|$)/i.test(glob))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing search. Use secret_store metadata instead.\";\n\t\t}\n\t\tif (!(path && isExistingRegularFile(path, cwd)) && !(glob && isCredentialSafeGlob(glob))) {\n\t\t\treturn \"Credential-safe grep requires one explicit regular file or a narrow non-dotenv file glob (for example *.ts). Refine the search instead of scanning a directory without a file filter.\";\n\t\t}\n\t}\n\tif (toolName === \"find\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst pattern = typeof args.pattern === \"string\" ? args.pattern : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, boundary)) ||\n\t\t\t(pattern && /(?:^|[\\\\/])?\\.env(?:\\.|\\*|$)/i.test(pattern))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing discovery. Use secret_store list instead.\";\n\t\t}\n\t}\n\tif (toolName === \"bash\" || toolName === \"powershell\" || toolName === \"run_process\") {\n\t\tconst command = typeof args.command === \"string\" ? args.command : \"\";\n\t\tconst shellRisk = shellCredentialRisk(command, cwd, boundary);\n\t\tif (shellRisk === \"broad_search\") {\n\t\t\treturn \"Credential-safe shell search requires a narrow non-dotenv file glob (for example -g '*.ts') or one explicit regular file. Refine the rg/grep command before retrying.\";\n\t\t}\n\t\tif (shellRisk === \"process_environment\") {\n\t\t\treturn \"Direct jq projection of the process environment is blocked because it can expose credentials. Query bounded JSON inputs instead.\";\n\t\t}\n\t\tif (SHELL_SECRET_READ_RE.test(command) || shellRisk === \"credential_path\") {\n\t\t\treturn \"Direct shell inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming command normally.\";\n\t\t}\n\t}\n\tif (toolName === \"python\") {\n\t\tconst code = typeof args.code === \"string\" ? args.code : \"\";\n\t\tconst scriptPath = typeof args.scriptPath === \"string\" ? args.scriptPath : undefined;\n\t\tif (\n\t\t\tPYTHON_SECRET_READ_RE.test(code) ||\n\t\t\tpythonInspectsCredentialPath(code, cwd, boundary) ||\n\t\t\t(scriptPath !== undefined && isProtectedCredentialPath(scriptPath, cwd, boundary))\n\t\t) {\n\t\t\treturn \"Direct Python inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming program normally.\";\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction redactResult<T>(result: AgentToolResult<T>, boundary?: CredentialExposureBoundary): AgentToolResult<T> {\n\tconst redact = (text: string) => (boundary ? boundary.redactSensitiveText(text) : redactKnownSecrets(text));\n\tconst budget = { nodes: 0 };\n\treturn {\n\t\t...result,\n\t\tcontent: result.content.map((block) => (block.type === \"text\" ? { ...block, text: redact(block.text) } : block)),\n\t\tdetails: redactStructuredDetails(result.details, redact, budget) as T,\n\t};\n}\n\nfunction redactStructuredDetails(\n\tvalue: unknown,\n\tredact: (text: string) => string,\n\tbudget: { nodes: number },\n\tdepth = 0,\n): unknown {\n\tif (typeof value === \"string\") return redact(value);\n\tif (value === null || typeof value !== \"object\") return value;\n\tbudget.nodes++;\n\tif (depth >= MAX_REDACTED_DETAIL_DEPTH || budget.nodes > MAX_REDACTED_DETAIL_NODES) {\n\t\treturn \"[DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map((entry) => redactStructuredDetails(entry, redact, budget, depth + 1));\n\t}\n\tlet prototype: object | null;\n\ttry {\n\t\tprototype = Object.getPrototypeOf(value);\n\t} catch {\n\t\treturn \"[UNREADABLE DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (prototype !== Object.prototype && prototype !== null) return value;\n\treturn Object.fromEntries(\n\t\tObject.entries(value).map(([key, entry]) => [key, redactStructuredDetails(entry, redact, budget, depth + 1)]),\n\t);\n}\n\n/** Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */\nexport function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(\n\ttool: AgentTool<TParameters, TDetails>,\n\t_cwd: string,\n\tboundary?: CredentialExposureBoundary,\n): AgentTool<TParameters, TDetails> {\n\treturn {\n\t\t...tool,\n\t\tasync execute(toolCallId, params, signal, onUpdate) {\n\t\t\tconst safeUpdate = onUpdate\n\t\t\t\t? (partial: AgentToolResult<TDetails>) => {\n\t\t\t\t\t\tonUpdate(redactResult(partial, boundary));\n\t\t\t\t\t}\n\t\t\t\t: undefined;\n\t\t\ttry {\n\t\t\t\treturn redactResult(await tool.execute(toolCallId, params, signal, safeUpdate), boundary);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof Error) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\tboundary ? boundary.redactSensitiveText(error.message) : redactKnownSecrets(error.message),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow new Error(\"Credential-safe tool execution failed without retaining raw error output.\");\n\t\t\t}\n\t\t},\n\t};\n}\n"]}

package/dist/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;GAEG;AA+BH;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAoDhD;AAwID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3E;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAgDnD;AAiND,2GAA2G;AAC3G,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsBtE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CA8B5D;AA0DD;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAC3C,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC9B,CASA"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;GAEG;AAuCH;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAoDhD;AAwID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3E;AAED,wBAAgB,4BAA4B,IAAI,IAAI,CAgDnD;AAiND,2GAA2G;AAC3G,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsBtE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CA6D5D;AA0DD;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAC3C,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC9B,CASA"}

package/dist/migrations.js

@@ -5,7 +5,7 @@ import chalk from "chalk";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, rmdirSync, rmSync, unlinkSync, writeFileSync, } from "fs";
 import { dirname, join } from "path";
 import { CONFIG_DIR_NAME, getAgentDir, getBinDir } from "./config.js";
-import { configBackupsDir, directoryProfilesDir, sessionsDir, stateFile } from "./core/agent-paths.js";
+import { configBackupsDir, directoryProfilesDir, extensionStateDir, isCanonicalAgentRootEntry, managedMemoryStateFile, sessionsDir, stateFile, } from "./core/agent-paths.js";
 import { migrateLegacyContextStores, pruneContextStores } from "./core/context/context-store-retention.js";
 import { migrateKeybindingsConfig } from "./core/keybindings.js";
 import { isLegacyEnvVarNameConfigValue } from "./core/resolve-config-value.js";
@@ -517,6 +517,43 @@ export function migrateAgentDirLayout(agentDir) {
         migrateLegacyAgentFile(agentDir, "auth.json:Zone.Identifier", stateFile(agentDir, "legacy-layout", "sidecars", "auth.json.Zone.Identifier"));
     }
     catch { }
+    for (const fileName of ["MEMORY.md", "USER.md"]) {
+        try {
+            migrateLegacyAgentFile(agentDir, `${fileName}.pi-managed.json`, managedMemoryStateFile(agentDir, fileName));
+        }
+        catch { }
+    }
+    try {
+        if (existsSync(agentDir)) {
+            const entries = readdirSync(agentDir);
+            for (const entry of entries) {
+                if (isCanonicalAgentRootEntry(entry))
+                    continue;
+                if (entry === "MEMORY.md.pi-managed.json" || entry === "USER.md.pi-managed.json") {
+                    const fileName = entry.startsWith("MEMORY") ? "MEMORY.md" : "USER.md";
+                    migrateLegacyAgentFile(agentDir, entry, managedMemoryStateFile(agentDir, fileName));
+                }
+                else {
+                    const fullPath = join(agentDir, entry);
+                    try {
+                        const stats = lstatSync(fullPath);
+                        if (stats.isDirectory() && !stats.isSymbolicLink()) {
+                            const KNOWN_EXTENSIONS = new Set(["automator", "gh-scavenger", "trello"]);
+                            const targetDir = KNOWN_EXTENSIONS.has(entry)
+                                ? extensionStateDir(agentDir, entry)
+                                : stateFile(agentDir, "legacy-layout", entry);
+                            migrateLegacyAgentDirectory(agentDir, entry, targetDir);
+                        }
+                        else if (stats.isFile() && !stats.isSymbolicLink()) {
+                            migrateLegacyAgentFile(agentDir, entry, stateFile(agentDir, "legacy-layout", "root-files", entry));
+                        }
+                    }
+                    catch { }
+                }
+            }
+        }
+    }
+    catch { }
     pruneEmptySessionNamespaces(agentDir);
 }
 /**

package/dist/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACN,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,SAAS,EACT,MAAM,EACN,UAAU,EACV,aAAa,GACb,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,mBAAmB,GACxB,6GAA6G,CAAC;AAC/G,MAAM,kBAAkB,GACvB,8FAA8F,CAAC;AAEhG;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACpC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAErD,mCAAmC;IACnC,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,qBAAqB;IACrB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAI,IAAe,EAAE,CAAC;gBAC5D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YACD,UAAU,CAAC,SAAS,EAAE,GAAG,SAAS,WAAW,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,gBAAgB;QACjB,CAAC;IACF,CAAC;IAED,gCAAgC;IAChC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC9D,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBACpD,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;wBAC9C,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC1B,CAAC;gBACF,CAAC;gBACD,OAAO,QAAQ,CAAC,OAAO,CAAC;gBACxB,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,gBAAgB;QACjB,CAAC;IACF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAQD,SAAS,yBAAyB,CAAC,KAAa;IAC/C,OAAO,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAA+B,EAC/B,GAAW,EACX,QAAgB,EAChB,UAAkC;IAElC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACvB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,QAAgB,EAAE,UAAkC;IACnG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,MAAM,YAAY,GAAG,OAAkC,CAAC;IACxD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS;QAC1C,YAAY,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QACrG,QAAQ,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAY,CAAC;QACtE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,MAAiC,CAAC;QAEnD,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,SAAS;YACjG,MAAM,gBAAgB,GAAG,UAAqC,CAAC;YAC/D,IAAI,gBAAgB,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAClD,qBAAqB,CAAC,gBAAgB,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,UAAU,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAgB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAY,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtF,MAAM,UAAU,GAAG,MAAiC,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/F,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,SAAS;QAC7G,MAAM,cAAc,GAAG,cAAyC,CAAC;QACjE,MAAM,gBAAgB,GAAG,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9E,qBAAqB,CAAC,cAAc,EAAE,QAAQ,EAAE,GAAG,gBAAgB,SAAS,EAAE,UAAU,CAAC,CAAC;QAC1F,oBAAoB,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,gBAAgB,UAAU,EAAE,UAAU,CAAC,CAAC;QAExF,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;oBAAE,SAAS;gBACpG,MAAM,WAAW,GAAG,WAAsC,CAAC;gBAC3D,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrG,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,gBAAgB,WAAW,QAAQ,WAAW,EAAE,UAAU,CAAC,CAAC;YAC1G,CAAC;QACF,CAAC;QAED,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;QACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACrG,KAAK,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvE,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;oBAAE,SAAS;gBAC1G,MAAM,mBAAmB,GAAG,aAAwC,CAAC;gBACrE,oBAAoB,CACnB,mBAAmB,CAAC,OAAO,EAC3B,GAAG,gBAAgB,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EACxE,UAAU,CACV,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,iCAAiC;IACzC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,2BAA2B,CAAC,QAAQ,CAAC,EAAE,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1G,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACjH,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,MAAM,CACX;QACC,iIAAiI;QACjI,GAAG,OAAO;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CACD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3C,OAAO,QAAQ,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC3C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,qEAAqE;IACrE,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACJ,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,wCAAwC;YACxC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE;gBAAE,SAAS;YAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAEvD,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,CAAC;YAE/B,8EAA8E;YAC9E,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAExD,6BAA6B;YAC7B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,gBAAgB;YAChB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,wBAAwB;YAE3D,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACR,oCAAoC;QACrC,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,OAAe,EAAE,KAAa;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAE5C,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC;YACJ,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,uBAAuB,CAAC,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,MAAM,CACX,8BAA8B,KAAK,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACxG,CACD,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEpC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAY,CAAC;QACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO;QACR,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,MAAiC,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACR,0CAA0C;IAC3C,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB;IACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IAElC,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACJ,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC7B,QAAQ,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,gBAAgB;gBACjB,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,yCAAyC;gBACzC,IAAI,CAAC;oBACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;IACrE,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAC/C,MAAM,uCAAuC,GAAG,MAAM,CAAC;AACvD,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAI9C,SAAS,qBAAqB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7F,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC1E,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IAED,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO;QAClC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/G,mBAAmB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,UAAkB,EAAE,SAAiB;IACrF,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;IAC3E,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,+BAA+B,EAAE,MAAM,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,WAAW,MAAM,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,QAAgB,EAAE,UAAkB,EAAE,YAAoB;IAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACnC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE;QAAE,OAAO;IAEvE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACpC,OAAO;IACR,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,cAAc,CAAC,cAAc,EAAE;QAAE,OAAO;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC;YACJ,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACJ,SAAS,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACX,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,UAAkB,EAAE,aAAqB;IAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IACpC,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE;QAAE,OAAO;IAClE,IAAI,MAAM,GAAG,aAAa,CAAC;IAC3B,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9F,IAAI,CAAC,MAAM;YAAE,OAAO;IACrB,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QACJ,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACtB,wFAAwF;QACxF,8FAA8F;QAC9F,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC;YACJ,UAAU,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC;gBACJ,UAAU,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,MAAM,WAAW,CAAC;QACnB,CAAC;IACF,CAAC;AACF,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACrD,KAAK,CAAC,CAAC,EAAE,+BAA+B,CAAC;aACzC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;aACjE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAClG,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACJ,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,mFAAmF;IACpF,CAAC;IACD,IAAI,CAAC;QACJ,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACrC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,sBAAsB,CACrB,QAAQ,EACR,2BAA2B,EAC3B,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,4BAA4B,CAAC,OAAe,EAAE,KAAa;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,iEAAiE,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,yFAAyF;QACzF,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9B,OAAO,CACN,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,0CAA0C;iBAC7I,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACZ,GAAG,KAAK,yFAAyF,CACjG,CAAC;YACH,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qBAAqB;QACtB,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE9C,gCAAgC;IAChC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,wBAAwB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAEhD,mCAAmC;IACnC,MAAM,QAAQ,GAAG;QAChB,GAAG,4BAA4B,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACnD,GAAG,4BAA4B,CAAC,UAAU,EAAE,SAAS,CAAC;KACtD,CAAC;IAEF,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAEzD,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACvB,MAAM,iBAAiB,EAAE,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,EAAE,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IAIxC,qBAAqB,CAAC,WAAW,EAAE,CAAC,CAAC;IACrC,MAAM,qBAAqB,GAAG,qBAAqB,EAAE,CAAC;IACtD,iCAAiC,EAAE,CAAC;IACpC,4BAA4B,EAAE,CAAC;IAC/B,iBAAiB,EAAE,CAAC;IACpB,4BAA4B,EAAE,CAAC;IAC/B,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;AACvD,CAAC","sourcesContent":["/**\n * One-time migrations that run on startup.\n */\n\nimport chalk from \"chalk\";\nimport {\n\tchmodSync,\n\texistsSync,\n\tlstatSync,\n\tmkdirSync,\n\treaddirSync,\n\treadFileSync,\n\trenameSync,\n\trmdirSync,\n\trmSync,\n\tunlinkSync,\n\twriteFileSync,\n} from \"fs\";\nimport { dirname, join } from \"path\";\nimport { CONFIG_DIR_NAME, getAgentDir, getBinDir } from \"./config.ts\";\nimport { configBackupsDir, directoryProfilesDir, sessionsDir, stateFile } from \"./core/agent-paths.ts\";\nimport { migrateLegacyContextStores, pruneContextStores } from \"./core/context/context-store-retention.ts\";\nimport { migrateKeybindingsConfig } from \"./core/keybindings.ts\";\nimport { isLegacyEnvVarNameConfigValue } from \"./core/resolve-config-value.ts\";\nimport { withFileLockSync, writeFileAtomicSync } from \"./core/util/atomic-file.ts\";\nimport { stripJsonComments } from \"./utils/json.ts\";\nimport { waitForStdinEvent } from \"./utils/stdin-events.ts\";\n\nconst MIGRATION_GUIDE_URL =\n\t\"https://github.com/earendil-works/pi-mono/blob/main/packages/coding-agent/CHANGELOG.md#extensions-migration\";\nconst EXTENSIONS_DOC_URL =\n\t\"https://github.com/earendil-works/pi-mono/blob/main/packages/coding-agent/docs/extensions.md\";\n\n/**\n * Migrate legacy oauth.json and settings.json apiKeys to auth.json.\n *\n * @returns Array of provider names that were migrated\n */\nexport function migrateAuthToAuthJson(): string[] {\n\tconst agentDir = getAgentDir();\n\tconst authPath = join(agentDir, \"auth.json\");\n\tconst oauthPath = join(agentDir, \"oauth.json\");\n\tconst settingsPath = join(agentDir, \"settings.json\");\n\n\t// Skip if auth.json already exists\n\tif (existsSync(authPath)) return [];\n\n\tconst migrated: Record<string, unknown> = {};\n\tconst providers: string[] = [];\n\n\t// Migrate oauth.json\n\tif (existsSync(oauthPath)) {\n\t\ttry {\n\t\t\tconst oauth = JSON.parse(readFileSync(oauthPath, \"utf-8\"));\n\t\t\tfor (const [provider, cred] of Object.entries(oauth)) {\n\t\t\t\tmigrated[provider] = { type: \"oauth\", ...(cred as object) };\n\t\t\t\tproviders.push(provider);\n\t\t\t}\n\t\t\trenameSync(oauthPath, `${oauthPath}.migrated`);\n\t\t} catch {\n\t\t\t// Skip on error\n\t\t}\n\t}\n\n\t// Migrate settings.json apiKeys\n\tif (existsSync(settingsPath)) {\n\t\ttry {\n\t\t\tconst content = readFileSync(settingsPath, \"utf-8\");\n\t\t\tconst settings = JSON.parse(content);\n\t\t\tif (settings.apiKeys && typeof settings.apiKeys === \"object\") {\n\t\t\t\tfor (const [provider, key] of Object.entries(settings.apiKeys)) {\n\t\t\t\t\tif (!migrated[provider] && typeof key === \"string\") {\n\t\t\t\t\t\tmigrated[provider] = { type: \"api_key\", key };\n\t\t\t\t\t\tproviders.push(provider);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tdelete settings.apiKeys;\n\t\t\t\twriteFileSync(settingsPath, JSON.stringify(settings, null, 2));\n\t\t\t}\n\t\t} catch {\n\t\t\t// Skip on error\n\t\t}\n\t}\n\n\tif (Object.keys(migrated).length > 0) {\n\t\tmkdirSync(dirname(authPath), { recursive: true });\n\t\twriteFileSync(authPath, JSON.stringify(migrated, null, 2), { mode: 0o600 });\n\t}\n\n\treturn providers;\n}\n\ninterface ConfigValueMigration {\n\tlocation: string;\n\tfrom: string;\n\tto: string;\n}\n\nfunction migrateLegacyEnvVarString(value: string): string | undefined {\n\treturn isLegacyEnvVarNameConfigValue(value) ? `$${value}` : undefined;\n}\n\nfunction migrateStringProperty(\n\trecord: Record<string, unknown>,\n\tkey: string,\n\tlocation: string,\n\tmigrations: ConfigValueMigration[],\n): boolean {\n\tconst value = record[key];\n\tif (typeof value !== \"string\") return false;\n\tconst migrated = migrateLegacyEnvVarString(value);\n\tif (migrated === undefined) return false;\n\trecord[key] = migrated;\n\tmigrations.push({ location, from: value, to: migrated });\n\treturn true;\n}\n\nfunction migrateHeadersConfig(headers: unknown, location: string, migrations: ConfigValueMigration[]): boolean {\n\tif (typeof headers !== \"object\" || headers === null || Array.isArray(headers)) return false;\n\tconst headerRecord = headers as Record<string, unknown>;\n\tlet migrated = false;\n\tfor (const [key, value] of Object.entries(headerRecord)) {\n\t\tif (typeof value !== \"string\") continue;\n\t\tconst migratedValue = migrateLegacyEnvVarString(value);\n\t\tif (migratedValue === undefined) continue;\n\t\theaderRecord[key] = migratedValue;\n\t\tmigrations.push({ location: `${location}[${JSON.stringify(key)}]`, from: value, to: migratedValue });\n\t\tmigrated = true;\n\t}\n\treturn migrated;\n}\n\nfunction migrateAuthJsonConfigValues(agentDir: string): ConfigValueMigration[] {\n\tconst authPath = join(agentDir, \"auth.json\");\n\tif (!existsSync(authPath)) return [];\n\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(authPath, \"utf-8\")) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return [];\n\t\tconst authData = parsed as Record<string, unknown>;\n\n\t\tconst migrations: ConfigValueMigration[] = [];\n\t\tfor (const [provider, credential] of Object.entries(authData)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) continue;\n\t\t\tconst credentialRecord = credential as Record<string, unknown>;\n\t\t\tif (credentialRecord.type !== \"api_key\") continue;\n\t\t\tmigrateStringProperty(credentialRecord, \"key\", `auth.json[${JSON.stringify(provider)}].key`, migrations);\n\t\t}\n\n\t\tif (migrations.length === 0) return [];\n\t\twriteFileSync(authPath, `${JSON.stringify(parsed, null, 2)}\\n`, \"utf-8\");\n\t\tchmodSync(authPath, 0o600);\n\t\treturn migrations;\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nfunction migrateModelsJsonConfigValues(agentDir: string): ConfigValueMigration[] {\n\tconst modelsPath = join(agentDir, \"models.json\");\n\tif (!existsSync(modelsPath)) return [];\n\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(stripJsonComments(readFileSync(modelsPath, \"utf-8\"))) as unknown;\n\t} catch {\n\t\treturn [];\n\t}\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return [];\n\tconst modelsData = parsed as Record<string, unknown>;\n\tconst providers = modelsData.providers;\n\tif (typeof providers !== \"object\" || providers === null || Array.isArray(providers)) return [];\n\n\tconst migrations: ConfigValueMigration[] = [];\n\tfor (const [provider, providerConfig] of Object.entries(providers)) {\n\t\tif (typeof providerConfig !== \"object\" || providerConfig === null || Array.isArray(providerConfig)) continue;\n\t\tconst providerRecord = providerConfig as Record<string, unknown>;\n\t\tconst providerLocation = `models.json.providers[${JSON.stringify(provider)}]`;\n\t\tmigrateStringProperty(providerRecord, \"apiKey\", `${providerLocation}.apiKey`, migrations);\n\t\tmigrateHeadersConfig(providerRecord.headers, `${providerLocation}.headers`, migrations);\n\n\t\tif (Array.isArray(providerRecord.models)) {\n\t\t\tfor (let index = 0; index < providerRecord.models.length; index++) {\n\t\t\t\tconst modelConfig = providerRecord.models[index];\n\t\t\t\tif (typeof modelConfig !== \"object\" || modelConfig === null || Array.isArray(modelConfig)) continue;\n\t\t\t\tconst modelRecord = modelConfig as Record<string, unknown>;\n\t\t\t\tconst modelKey = typeof modelRecord.id === \"string\" ? JSON.stringify(modelRecord.id) : String(index);\n\t\t\t\tmigrateHeadersConfig(modelRecord.headers, `${providerLocation}.models[${modelKey}].headers`, migrations);\n\t\t\t}\n\t\t}\n\n\t\tconst modelOverrides = providerRecord.modelOverrides;\n\t\tif (typeof modelOverrides === \"object\" && modelOverrides !== null && !Array.isArray(modelOverrides)) {\n\t\t\tfor (const [modelId, modelOverride] of Object.entries(modelOverrides)) {\n\t\t\t\tif (typeof modelOverride !== \"object\" || modelOverride === null || Array.isArray(modelOverride)) continue;\n\t\t\t\tconst modelOverrideRecord = modelOverride as Record<string, unknown>;\n\t\t\t\tmigrateHeadersConfig(\n\t\t\t\t\tmodelOverrideRecord.headers,\n\t\t\t\t\t`${providerLocation}.modelOverrides[${JSON.stringify(modelId)}].headers`,\n\t\t\t\t\tmigrations,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\tif (migrations.length === 0) return [];\n\twriteFileSync(modelsPath, `${JSON.stringify(parsed, null, 2)}\\n`, \"utf-8\");\n\treturn migrations;\n}\n\nfunction migrateExplicitEnvVarConfigValues(): void {\n\tconst agentDir = getAgentDir();\n\tconst migrations = [...migrateAuthJsonConfigValues(agentDir), ...migrateModelsJsonConfigValues(agentDir)];\n\tif (migrations.length === 0) return;\n\n\tconst details = migrations.map((migration) => `  - ${migration.location}: ${migration.from} -> ${migration.to}`);\n\tconsole.log(\n\t\tchalk.yellow(\n\t\t\t[\n\t\t\t\t\"Warning: Migrated API key/header environment references to explicit $ENV_VAR syntax. Plain strings will be treated as literals.\",\n\t\t\t\t...details,\n\t\t\t].join(\"\\n\"),\n\t\t),\n\t);\n}\n\n/**\n * Migrate sessions from ~/.pi/agent/*.jsonl to proper session directories.\n *\n * Bug in v0.30.0: Sessions were saved to ~/.pi/agent/ instead of\n * ~/.pi/agent/sessions/<encoded-cwd>/. This migration moves them\n * to the correct location based on the cwd in their session header.\n *\n * See: https://github.com/earendil-works/pi-mono/issues/320\n */\nexport function getMigratedSessionFileName(file: string): string | undefined {\n\tconst fileName = file.split(/[\\\\/]/).pop();\n\treturn fileName || undefined;\n}\n\nexport function migrateSessionsFromAgentRoot(): void {\n\tconst agentDir = getAgentDir();\n\n\t// Find all .jsonl files directly in agentDir (not in subdirectories)\n\tlet files: string[];\n\ttry {\n\t\tfiles = readdirSync(agentDir)\n\t\t\t.filter((f) => f.endsWith(\".jsonl\"))\n\t\t\t.map((f) => join(agentDir, f));\n\t} catch {\n\t\treturn;\n\t}\n\n\tif (files.length === 0) return;\n\n\tfor (const file of files) {\n\t\ttry {\n\t\t\t// Read first line to get session header\n\t\t\tconst content = readFileSync(file, \"utf8\");\n\t\t\tconst firstLine = content.split(\"\\n\")[0];\n\t\t\tif (!firstLine?.trim()) continue;\n\n\t\t\tconst header = JSON.parse(firstLine);\n\t\t\tif (header.type !== \"session\" || !header.cwd) continue;\n\n\t\t\tconst cwd: string = header.cwd;\n\n\t\t\t// Compute the correct session directory (same encoding as session-manager.ts)\n\t\t\tconst safePath = `--${cwd.replace(/^[/\\\\]/, \"\").replace(/[/\\\\:]/g, \"-\")}--`;\n\t\t\tconst correctDir = join(agentDir, \"sessions\", safePath);\n\n\t\t\t// Create directory if needed\n\t\t\tif (!existsSync(correctDir)) {\n\t\t\t\tmkdirSync(correctDir, { recursive: true });\n\t\t\t}\n\n\t\t\t// Move the file\n\t\t\tconst fileName = getMigratedSessionFileName(file);\n\t\t\tif (!fileName) continue;\n\t\t\tconst newPath = join(correctDir, fileName);\n\n\t\t\tif (existsSync(newPath)) continue; // Skip if target exists\n\n\t\t\trenameSync(file, newPath);\n\t\t} catch {\n\t\t\t// Skip files that can't be migrated\n\t\t}\n\t}\n}\n\n/**\n * Migrate commands/ to prompts/ if needed.\n * Works for both regular directories and symlinks.\n */\nfunction migrateCommandsToPrompts(baseDir: string, label: string): boolean {\n\tconst commandsDir = join(baseDir, \"commands\");\n\tconst promptsDir = join(baseDir, \"prompts\");\n\n\tif (existsSync(commandsDir) && !existsSync(promptsDir)) {\n\t\ttry {\n\t\t\trenameSync(commandsDir, promptsDir);\n\t\t\tconsole.log(chalk.green(`Migrated ${label} commands/ → prompts/`));\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tconsole.log(\n\t\t\t\tchalk.yellow(\n\t\t\t\t\t`Warning: Could not migrate ${label} commands/ to prompts/: ${err instanceof Error ? err.message : err}`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\treturn false;\n}\n\nfunction migrateKeybindingsConfigFile(): void {\n\tconst configPath = join(getAgentDir(), \"keybindings.json\");\n\tif (!existsSync(configPath)) return;\n\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(configPath, \"utf-8\")) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\treturn;\n\t\t}\n\t\tconst { config, migrated } = migrateKeybindingsConfig(parsed as Record<string, unknown>);\n\t\tif (!migrated) return;\n\t\twriteFileSync(configPath, `${JSON.stringify(config, null, 2)}\\n`, \"utf-8\");\n\t} catch {\n\t\t// Ignore malformed files during migration\n\t}\n}\n\n/**\n * Move fd/rg binaries from tools/ to bin/ if they exist.\n */\nfunction migrateToolsToBin(): void {\n\tconst agentDir = getAgentDir();\n\tconst toolsDir = join(agentDir, \"tools\");\n\tconst binDir = getBinDir();\n\n\tif (!existsSync(toolsDir)) return;\n\n\tconst binaries = [\"fd\", \"rg\", \"fd.exe\", \"rg.exe\"];\n\tlet movedAny = false;\n\n\tfor (const bin of binaries) {\n\t\tconst oldPath = join(toolsDir, bin);\n\t\tconst newPath = join(binDir, bin);\n\n\t\tif (existsSync(oldPath)) {\n\t\t\tif (!existsSync(binDir)) {\n\t\t\t\tmkdirSync(binDir, { recursive: true });\n\t\t\t}\n\t\t\tif (!existsSync(newPath)) {\n\t\t\t\ttry {\n\t\t\t\t\trenameSync(oldPath, newPath);\n\t\t\t\t\tmovedAny = true;\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore errors\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Target exists, just delete the old one\n\t\t\t\ttry {\n\t\t\t\t\trmSync?.(oldPath, { force: true });\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif (movedAny) {\n\t\tconsole.log(chalk.green(`Migrated managed binaries tools/ → bin/`));\n\t}\n}\n\n/**\n * Root-level machine-managed trust state is relocated into `state/`. If both layouts exist, valid\n * entries are merged under the canonical file's lock and canonical decisions win conflicts.\n */\nconst MAX_SESSION_NAMESPACES_TO_PRUNE = 10_000;\nconst MAX_LEGACY_DIRECTORY_ENTRIES_TO_MIGRATE = 10_000;\nconst MAX_MIGRATION_CONFLICT_SUFFIXES = 1_000;\n\ntype MigratedTrustFile = Record<string, boolean | null>;\n\nfunction readMigratedTrustFile(path: string): MigratedTrustFile | undefined {\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\")) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return undefined;\n\t\tconst trust: MigratedTrustFile = {};\n\t\tfor (const [key, value] of Object.entries(parsed)) {\n\t\t\tif (value !== true && value !== false && value !== null) return undefined;\n\t\t\ttrust[key] = value;\n\t\t}\n\t\treturn trust;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction migrateTrustState(agentDir: string): void {\n\tconst oldPath = join(agentDir, \"trust.json\");\n\tif (!existsSync(oldPath)) return;\n\tconst newPath = stateFile(agentDir, \"trust.json\");\n\tif (!existsSync(newPath)) {\n\t\tmkdirSync(dirname(newPath), { recursive: true });\n\t\trenameSync(oldPath, newPath);\n\t\treturn;\n\t}\n\n\twithFileLockSync(newPath, () => {\n\t\tconst legacy = readMigratedTrustFile(oldPath);\n\t\tconst canonical = readMigratedTrustFile(newPath);\n\t\tif (!legacy || !canonical) return;\n\t\tconst merged = { ...legacy, ...canonical };\n\t\tconst sorted = Object.fromEntries(Object.entries(merged).sort(([left], [right]) => left.localeCompare(right)));\n\t\twriteFileAtomicSync(newPath, `${JSON.stringify(sorted, null, 2)}\\n`);\n\t\tunlinkSync(oldPath);\n\t});\n}\n\nfunction migrationConflictPath(agentDir: string, legacyName: string, entryName: string): string | undefined {\n\tconst conflictDir = stateFile(agentDir, \"migration-conflicts\", legacyName);\n\tfor (let suffix = 0; suffix < MAX_MIGRATION_CONFLICT_SUFFIXES; suffix++) {\n\t\tconst name = suffix === 0 ? entryName : `${entryName}.legacy-${suffix}`;\n\t\tconst candidate = join(conflictDir, name);\n\t\tif (!existsSync(candidate)) return candidate;\n\t}\n\treturn undefined;\n}\n\n/**\n * Relocate one known legacy root without traversing its contents. A whole-root rename is O(1);\n * partial migrations scan a bounded number of top-level entries and preserve collisions under\n * state/migration-conflicts instead of overwriting either copy.\n */\nfunction migrateLegacyAgentDirectory(agentDir: string, legacyName: string, canonicalDir: string): void {\n\tconst legacyDir = join(agentDir, legacyName);\n\tif (!existsSync(legacyDir)) return;\n\tconst legacyStats = lstatSync(legacyDir);\n\tif (!legacyStats.isDirectory() || legacyStats.isSymbolicLink()) return;\n\n\tif (!existsSync(canonicalDir)) {\n\t\tmkdirSync(dirname(canonicalDir), { recursive: true });\n\t\trenameSync(legacyDir, canonicalDir);\n\t\treturn;\n\t}\n\n\tconst canonicalStats = lstatSync(canonicalDir);\n\tif (!canonicalStats.isDirectory() || canonicalStats.isSymbolicLink()) return;\n\tconst entries = readdirSync(legacyDir).slice(0, MAX_LEGACY_DIRECTORY_ENTRIES_TO_MIGRATE);\n\tfor (const entry of entries) {\n\t\tconst source = join(legacyDir, entry);\n\t\tlet target = join(canonicalDir, entry);\n\t\tif (existsSync(target)) {\n\t\t\ttarget = migrationConflictPath(agentDir, legacyName, entry) ?? \"\";\n\t\t\tif (!target) continue;\n\t\t\tmkdirSync(dirname(target), { recursive: true });\n\t\t}\n\t\ttry {\n\t\t\trenameSync(source, target);\n\t\t} catch {}\n\t}\n\n\ttry {\n\t\trmdirSync(legacyDir);\n\t} catch {}\n}\n\nfunction migrateLegacyAgentFile(agentDir: string, legacyName: string, canonicalPath: string): void {\n\tconst legacyPath = join(agentDir, legacyName);\n\tif (!existsSync(legacyPath)) return;\n\tconst legacyStats = lstatSync(legacyPath);\n\tif (!legacyStats.isFile() || legacyStats.isSymbolicLink()) return;\n\tlet target = canonicalPath;\n\tif (existsSync(target)) {\n\t\ttarget = migrationConflictPath(agentDir, \"root-files\", legacyName.replaceAll(\":\", \".\")) ?? \"\";\n\t\tif (!target) return;\n\t}\n\tmkdirSync(dirname(target), { recursive: true });\n\ttry {\n\t\trenameSync(legacyPath, target);\n\t} catch (renameError) {\n\t\t// Windows cannot rename an NTFS alternate data stream into a regular file. Preserve the\n\t\t// bytes first, then remove only the named stream; never move or rewrite the owning auth file.\n\t\twriteFileSync(target, readFileSync(legacyPath), { flag: \"wx\" });\n\t\ttry {\n\t\t\tunlinkSync(legacyPath);\n\t\t} catch {\n\t\t\ttry {\n\t\t\t\tunlinkSync(target);\n\t\t\t} catch {}\n\t\t\tthrow renameError;\n\t\t}\n\t}\n}\n\n/** Remove only empty real per-project session directories; transcript files are never retention-pruned. */\nexport function pruneEmptySessionNamespaces(agentDir: string): string[] {\n\tconst root = sessionsDir(agentDir);\n\tlet candidates: string[];\n\ttry {\n\t\tcandidates = readdirSync(root, { withFileTypes: true })\n\t\t\t.slice(0, MAX_SESSION_NAMESPACES_TO_PRUNE)\n\t\t\t.filter((entry) => entry.isDirectory() && !entry.isSymbolicLink())\n\t\t\t.map((entry) => join(root, entry.name));\n\t} catch {\n\t\treturn [];\n\t}\n\n\tconst removed: string[] = [];\n\tfor (const candidate of candidates) {\n\t\ttry {\n\t\t\tconst stats = lstatSync(candidate);\n\t\t\tif (!stats.isDirectory() || stats.isSymbolicLink() || readdirSync(candidate).length > 0) continue;\n\t\t\trmdirSync(candidate);\n\t\t\tremoved.push(candidate);\n\t\t} catch {}\n\t}\n\treturn removed;\n}\n\n/**\n * Consolidate known machine-managed layout generations. Each migration is independently guarded:\n * startup never fails because cleanup is unavailable, and unknown files/resources remain untouched.\n */\nexport function migrateAgentDirLayout(agentDir: string): void {\n\ttry {\n\t\tmigrateTrustState(agentDir);\n\t} catch {\n\t\t// Best-effort: startup must not fail because one straggler could not be relocated.\n\t}\n\ttry {\n\t\tmigrateLegacyContextStores(agentDir);\n\t\tpruneContextStores(agentDir);\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"backups\", configBackupsDir(agentDir));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"resource-profiles\", directoryProfilesDir(agentDir));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"auto-learn\", stateFile(agentDir, \"legacy-layout\", \"auto-learn\"));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"tmp\", stateFile(agentDir, \"legacy-layout\", \"tmp\"));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentFile(\n\t\t\tagentDir,\n\t\t\t\"auth.json:Zone.Identifier\",\n\t\t\tstateFile(agentDir, \"legacy-layout\", \"sidecars\", \"auth.json.Zone.Identifier\"),\n\t\t);\n\t} catch {}\n\tpruneEmptySessionNamespaces(agentDir);\n}\n\n/**\n * Check for deprecated hooks/ and tools/ directories.\n * Note: tools/ may contain fd/rg binaries extracted by pi, so only warn if it has other files.\n */\nfunction checkDeprecatedExtensionDirs(baseDir: string, label: string): string[] {\n\tconst hooksDir = join(baseDir, \"hooks\");\n\tconst toolsDir = join(baseDir, \"tools\");\n\tconst warnings: string[] = [];\n\n\tif (existsSync(hooksDir)) {\n\t\twarnings.push(`${label} hooks/ directory found. Hooks have been renamed to extensions.`);\n\t}\n\n\tif (existsSync(toolsDir)) {\n\t\t// Check if tools/ contains anything other than fd/rg (which are auto-extracted binaries)\n\t\ttry {\n\t\t\tconst entries = readdirSync(toolsDir);\n\t\t\tconst customTools = entries.filter((e) => {\n\t\t\t\tconst lower = e.toLowerCase();\n\t\t\t\treturn (\n\t\t\t\t\tlower !== \"fd\" && lower !== \"rg\" && lower !== \"fd.exe\" && lower !== \"rg.exe\" && !e.startsWith(\".\") // Ignore .DS_Store and other hidden files\n\t\t\t\t);\n\t\t\t});\n\t\t\tif (customTools.length > 0) {\n\t\t\t\twarnings.push(\n\t\t\t\t\t`${label} tools/ directory contains custom tools. Custom tools have been merged into extensions.`,\n\t\t\t\t);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Ignore read errors\n\t\t}\n\t}\n\n\treturn warnings;\n}\n\n/**\n * Run extension system migrations (commands→prompts) and collect warnings about deprecated directories.\n */\nfunction migrateExtensionSystem(cwd: string): string[] {\n\tconst agentDir = getAgentDir();\n\tconst projectDir = join(cwd, CONFIG_DIR_NAME);\n\n\t// Migrate commands/ to prompts/\n\tmigrateCommandsToPrompts(agentDir, \"Global\");\n\tmigrateCommandsToPrompts(projectDir, \"Project\");\n\n\t// Check for deprecated directories\n\tconst warnings = [\n\t\t...checkDeprecatedExtensionDirs(agentDir, \"Global\"),\n\t\t...checkDeprecatedExtensionDirs(projectDir, \"Project\"),\n\t];\n\n\treturn warnings;\n}\n\n/**\n * Print deprecation warnings and wait for keypress.\n */\nexport async function showDeprecationWarnings(warnings: string[]): Promise<void> {\n\tif (warnings.length === 0) return;\n\n\tfor (const warning of warnings) {\n\t\tconsole.log(chalk.yellow(`Warning: ${warning}`));\n\t}\n\tconsole.log(chalk.yellow(`\\nMove your extensions to the extensions/ directory.`));\n\tconsole.log(chalk.yellow(`Migration guide: ${MIGRATION_GUIDE_URL}`));\n\tconsole.log(chalk.yellow(`Documentation: ${EXTENSIONS_DOC_URL}`));\n\tif (!process.stdin.isTTY || !process.stdout.isTTY) {\n\t\tconsole.log();\n\t\treturn;\n\t}\n\tconsole.log(chalk.dim(`\\nPress any key to continue...`));\n\n\tprocess.stdin.setRawMode?.(true);\n\tprocess.stdin.resume();\n\tawait waitForStdinEvent();\n\tprocess.stdin.setRawMode?.(false);\n\tprocess.stdin.pause();\n\tconsole.log();\n}\n\n/**\n * Run all migrations. Called once on startup.\n *\n * @returns Object with migration results and deprecation warnings\n */\nexport function runMigrations(cwd: string): {\n\tmigratedAuthProviders: string[];\n\tdeprecationWarnings: string[];\n} {\n\tmigrateAgentDirLayout(getAgentDir());\n\tconst migratedAuthProviders = migrateAuthToAuthJson();\n\tmigrateExplicitEnvVarConfigValues();\n\tmigrateSessionsFromAgentRoot();\n\tmigrateToolsToBin();\n\tmigrateKeybindingsConfigFile();\n\tconst deprecationWarnings = migrateExtensionSystem(cwd);\n\treturn { migratedAuthProviders, deprecationWarnings };\n}\n"]}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACN,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,SAAS,EACT,MAAM,EACN,UAAU,EACV,aAAa,GACb,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,sBAAsB,EACtB,WAAW,EACX,SAAS,GACT,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,mBAAmB,GACxB,6GAA6G,CAAC;AAC/G,MAAM,kBAAkB,GACvB,8FAA8F,CAAC;AAEhG;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACpC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAErD,mCAAmC;IACnC,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,qBAAqB;IACrB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAI,IAAe,EAAE,CAAC;gBAC5D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YACD,UAAU,CAAC,SAAS,EAAE,GAAG,SAAS,WAAW,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,gBAAgB;QACjB,CAAC;IACF,CAAC;IAED,gCAAgC;IAChC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC9D,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBACpD,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;wBAC9C,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC1B,CAAC;gBACF,CAAC;gBACD,OAAO,QAAQ,CAAC,OAAO,CAAC;gBACxB,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,gBAAgB;QACjB,CAAC;IACF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAQD,SAAS,yBAAyB,CAAC,KAAa;IAC/C,OAAO,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAA+B,EAC/B,GAAW,EACX,QAAgB,EAChB,UAAkC;IAElC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACvB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,QAAgB,EAAE,UAAkC;IACnG,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5F,MAAM,YAAY,GAAG,OAAkC,CAAC;IACxD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS;QAC1C,YAAY,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QACrG,QAAQ,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAY,CAAC;QACtE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,MAAiC,CAAC;QAEnD,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,SAAS;YACjG,MAAM,gBAAgB,GAAG,UAAqC,CAAC;YAC/D,IAAI,gBAAgB,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YAClD,qBAAqB,CAAC,gBAAgB,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,UAAU,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAgB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAY,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtF,MAAM,UAAU,GAAG,MAAiC,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/F,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAAE,SAAS;QAC7G,MAAM,cAAc,GAAG,cAAyC,CAAC;QACjE,MAAM,gBAAgB,GAAG,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9E,qBAAqB,CAAC,cAAc,EAAE,QAAQ,EAAE,GAAG,gBAAgB,SAAS,EAAE,UAAU,CAAC,CAAC;QAC1F,oBAAoB,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,gBAAgB,UAAU,EAAE,UAAU,CAAC,CAAC;QAExF,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBACnE,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;oBAAE,SAAS;gBACpG,MAAM,WAAW,GAAG,WAAsC,CAAC;gBAC3D,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrG,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,gBAAgB,WAAW,QAAQ,WAAW,EAAE,UAAU,CAAC,CAAC;YAC1G,CAAC;QACF,CAAC;QAED,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC;QACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACrG,KAAK,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvE,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;oBAAE,SAAS;gBAC1G,MAAM,mBAAmB,GAAG,aAAwC,CAAC;gBACrE,oBAAoB,CACnB,mBAAmB,CAAC,OAAO,EAC3B,GAAG,gBAAgB,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EACxE,UAAU,CACV,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,iCAAiC;IACzC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,2BAA2B,CAAC,QAAQ,CAAC,EAAE,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1G,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACjH,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,MAAM,CACX;QACC,iIAAiI;QACjI,GAAG,OAAO;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CACD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3C,OAAO,QAAQ,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC3C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,qEAAqE;IACrE,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACJ,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,wCAAwC;YACxC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE;gBAAE,SAAS;YAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAEvD,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,CAAC;YAE/B,8EAA8E;YAC9E,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAExD,6BAA6B;YAC7B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,gBAAgB;YAChB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAE3C,IAAI,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,wBAAwB;YAE3D,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACR,oCAAoC;QACrC,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,OAAe,EAAE,KAAa;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAE5C,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC;YACJ,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,uBAAuB,CAAC,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,MAAM,CACX,8BAA8B,KAAK,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACxG,CACD,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEpC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAY,CAAC;QACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,OAAO;QACR,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,wBAAwB,CAAC,MAAiC,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACR,0CAA0C;IAC3C,CAAC;AACF,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB;IACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO;IAElC,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAElC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACJ,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC7B,QAAQ,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,gBAAgB;gBACjB,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,yCAAyC;gBACzC,IAAI,CAAC;oBACJ,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS;gBACV,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;IACrE,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAC/C,MAAM,uCAAuC,GAAG,MAAM,CAAC;AACvD,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAI9C,SAAS,qBAAqB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7F,MAAM,KAAK,GAAsB,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC1E,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO;IACR,CAAC;IAED,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO;QAClC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/G,mBAAmB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,UAAkB,EAAE,SAAiB;IACrF,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC;IAC3E,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,+BAA+B,EAAE,MAAM,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,WAAW,MAAM,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,QAAgB,EAAE,UAAkB,EAAE,YAAoB;IAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACnC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE;QAAE,OAAO;IAEvE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,UAAU,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACpC,OAAO;IACR,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,cAAc,CAAC,cAAc,EAAE;QAAE,OAAO;IAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC;YACJ,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACJ,SAAS,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACX,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,UAAkB,EAAE,aAAqB;IAC1F,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IACpC,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE;QAAE,OAAO;IAClE,IAAI,MAAM,GAAG,aAAa,CAAC;IAC3B,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9F,IAAI,CAAC,MAAM;YAAE,OAAO;IACrB,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QACJ,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACtB,wFAAwF;QACxF,8FAA8F;QAC9F,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC;YACJ,UAAU,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC;gBACJ,UAAU,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,MAAM,WAAW,CAAC;QACnB,CAAC;IACF,CAAC;AACF,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QACJ,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACrD,KAAK,CAAC,CAAC,EAAE,+BAA+B,CAAC;aACzC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;aACjE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAClG,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACrD,IAAI,CAAC;QACJ,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,mFAAmF;IACpF,CAAC;IACD,IAAI,CAAC;QACJ,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QACrC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,2BAA2B,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACJ,sBAAsB,CACrB,QAAQ,EACR,2BAA2B,EAC3B,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,2BAA2B,CAAC,CAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,KAAK,MAAM,QAAQ,IAAI,CAAC,WAAW,EAAE,SAAS,CAAU,EAAE,CAAC;QAC1D,IAAI,CAAC;YACJ,sBAAsB,CAAC,QAAQ,EAAE,GAAG,QAAQ,kBAAkB,EAAE,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7G,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACJ,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,yBAAyB,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC/C,IAAI,KAAK,KAAK,2BAA2B,IAAI,KAAK,KAAK,yBAAyB,EAAE,CAAC;oBAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;oBACtE,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACrF,CAAC;qBAAM,CAAC;oBACP,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBACvC,IAAI,CAAC;wBACJ,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;wBAClC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;4BACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;4BAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;gCAC5C,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC;gCACpC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;4BAC/C,2BAA2B,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;wBACzD,CAAC;6BAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;4BACtD,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;wBACpG,CAAC;oBACF,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;gBACX,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,4BAA4B,CAAC,OAAe,EAAE,KAAa;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,iEAAiE,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,yFAAyF;QACzF,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9B,OAAO,CACN,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,0CAA0C;iBAC7I,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CACZ,GAAG,KAAK,yFAAyF,CACjG,CAAC;YACH,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,qBAAqB;QACtB,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE9C,gCAAgC;IAChC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,wBAAwB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAEhD,mCAAmC;IACnC,MAAM,QAAQ,GAAG;QAChB,GAAG,4BAA4B,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACnD,GAAG,4BAA4B,CAAC,UAAU,EAAE,SAAS,CAAC;KACtD,CAAC;IAEF,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAkB;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAEzD,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACvB,MAAM,iBAAiB,EAAE,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,EAAE,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IAIxC,qBAAqB,CAAC,WAAW,EAAE,CAAC,CAAC;IACrC,MAAM,qBAAqB,GAAG,qBAAqB,EAAE,CAAC;IACtD,iCAAiC,EAAE,CAAC;IACpC,4BAA4B,EAAE,CAAC;IAC/B,iBAAiB,EAAE,CAAC;IACpB,4BAA4B,EAAE,CAAC;IAC/B,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;AACvD,CAAC","sourcesContent":["/**\n * One-time migrations that run on startup.\n */\n\nimport chalk from \"chalk\";\nimport {\n\tchmodSync,\n\texistsSync,\n\tlstatSync,\n\tmkdirSync,\n\treaddirSync,\n\treadFileSync,\n\trenameSync,\n\trmdirSync,\n\trmSync,\n\tunlinkSync,\n\twriteFileSync,\n} from \"fs\";\nimport { dirname, join } from \"path\";\nimport { CONFIG_DIR_NAME, getAgentDir, getBinDir } from \"./config.ts\";\nimport {\n\tconfigBackupsDir,\n\tdirectoryProfilesDir,\n\textensionStateDir,\n\tisCanonicalAgentRootEntry,\n\tmanagedMemoryStateFile,\n\tsessionsDir,\n\tstateFile,\n} from \"./core/agent-paths.ts\";\nimport { migrateLegacyContextStores, pruneContextStores } from \"./core/context/context-store-retention.ts\";\nimport { migrateKeybindingsConfig } from \"./core/keybindings.ts\";\nimport { isLegacyEnvVarNameConfigValue } from \"./core/resolve-config-value.ts\";\nimport { withFileLockSync, writeFileAtomicSync } from \"./core/util/atomic-file.ts\";\nimport { stripJsonComments } from \"./utils/json.ts\";\nimport { waitForStdinEvent } from \"./utils/stdin-events.ts\";\n\nconst MIGRATION_GUIDE_URL =\n\t\"https://github.com/earendil-works/pi-mono/blob/main/packages/coding-agent/CHANGELOG.md#extensions-migration\";\nconst EXTENSIONS_DOC_URL =\n\t\"https://github.com/earendil-works/pi-mono/blob/main/packages/coding-agent/docs/extensions.md\";\n\n/**\n * Migrate legacy oauth.json and settings.json apiKeys to auth.json.\n *\n * @returns Array of provider names that were migrated\n */\nexport function migrateAuthToAuthJson(): string[] {\n\tconst agentDir = getAgentDir();\n\tconst authPath = join(agentDir, \"auth.json\");\n\tconst oauthPath = join(agentDir, \"oauth.json\");\n\tconst settingsPath = join(agentDir, \"settings.json\");\n\n\t// Skip if auth.json already exists\n\tif (existsSync(authPath)) return [];\n\n\tconst migrated: Record<string, unknown> = {};\n\tconst providers: string[] = [];\n\n\t// Migrate oauth.json\n\tif (existsSync(oauthPath)) {\n\t\ttry {\n\t\t\tconst oauth = JSON.parse(readFileSync(oauthPath, \"utf-8\"));\n\t\t\tfor (const [provider, cred] of Object.entries(oauth)) {\n\t\t\t\tmigrated[provider] = { type: \"oauth\", ...(cred as object) };\n\t\t\t\tproviders.push(provider);\n\t\t\t}\n\t\t\trenameSync(oauthPath, `${oauthPath}.migrated`);\n\t\t} catch {\n\t\t\t// Skip on error\n\t\t}\n\t}\n\n\t// Migrate settings.json apiKeys\n\tif (existsSync(settingsPath)) {\n\t\ttry {\n\t\t\tconst content = readFileSync(settingsPath, \"utf-8\");\n\t\t\tconst settings = JSON.parse(content);\n\t\t\tif (settings.apiKeys && typeof settings.apiKeys === \"object\") {\n\t\t\t\tfor (const [provider, key] of Object.entries(settings.apiKeys)) {\n\t\t\t\t\tif (!migrated[provider] && typeof key === \"string\") {\n\t\t\t\t\t\tmigrated[provider] = { type: \"api_key\", key };\n\t\t\t\t\t\tproviders.push(provider);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tdelete settings.apiKeys;\n\t\t\t\twriteFileSync(settingsPath, JSON.stringify(settings, null, 2));\n\t\t\t}\n\t\t} catch {\n\t\t\t// Skip on error\n\t\t}\n\t}\n\n\tif (Object.keys(migrated).length > 0) {\n\t\tmkdirSync(dirname(authPath), { recursive: true });\n\t\twriteFileSync(authPath, JSON.stringify(migrated, null, 2), { mode: 0o600 });\n\t}\n\n\treturn providers;\n}\n\ninterface ConfigValueMigration {\n\tlocation: string;\n\tfrom: string;\n\tto: string;\n}\n\nfunction migrateLegacyEnvVarString(value: string): string | undefined {\n\treturn isLegacyEnvVarNameConfigValue(value) ? `$${value}` : undefined;\n}\n\nfunction migrateStringProperty(\n\trecord: Record<string, unknown>,\n\tkey: string,\n\tlocation: string,\n\tmigrations: ConfigValueMigration[],\n): boolean {\n\tconst value = record[key];\n\tif (typeof value !== \"string\") return false;\n\tconst migrated = migrateLegacyEnvVarString(value);\n\tif (migrated === undefined) return false;\n\trecord[key] = migrated;\n\tmigrations.push({ location, from: value, to: migrated });\n\treturn true;\n}\n\nfunction migrateHeadersConfig(headers: unknown, location: string, migrations: ConfigValueMigration[]): boolean {\n\tif (typeof headers !== \"object\" || headers === null || Array.isArray(headers)) return false;\n\tconst headerRecord = headers as Record<string, unknown>;\n\tlet migrated = false;\n\tfor (const [key, value] of Object.entries(headerRecord)) {\n\t\tif (typeof value !== \"string\") continue;\n\t\tconst migratedValue = migrateLegacyEnvVarString(value);\n\t\tif (migratedValue === undefined) continue;\n\t\theaderRecord[key] = migratedValue;\n\t\tmigrations.push({ location: `${location}[${JSON.stringify(key)}]`, from: value, to: migratedValue });\n\t\tmigrated = true;\n\t}\n\treturn migrated;\n}\n\nfunction migrateAuthJsonConfigValues(agentDir: string): ConfigValueMigration[] {\n\tconst authPath = join(agentDir, \"auth.json\");\n\tif (!existsSync(authPath)) return [];\n\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(authPath, \"utf-8\")) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return [];\n\t\tconst authData = parsed as Record<string, unknown>;\n\n\t\tconst migrations: ConfigValueMigration[] = [];\n\t\tfor (const [provider, credential] of Object.entries(authData)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) continue;\n\t\t\tconst credentialRecord = credential as Record<string, unknown>;\n\t\t\tif (credentialRecord.type !== \"api_key\") continue;\n\t\t\tmigrateStringProperty(credentialRecord, \"key\", `auth.json[${JSON.stringify(provider)}].key`, migrations);\n\t\t}\n\n\t\tif (migrations.length === 0) return [];\n\t\twriteFileSync(authPath, `${JSON.stringify(parsed, null, 2)}\\n`, \"utf-8\");\n\t\tchmodSync(authPath, 0o600);\n\t\treturn migrations;\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nfunction migrateModelsJsonConfigValues(agentDir: string): ConfigValueMigration[] {\n\tconst modelsPath = join(agentDir, \"models.json\");\n\tif (!existsSync(modelsPath)) return [];\n\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(stripJsonComments(readFileSync(modelsPath, \"utf-8\"))) as unknown;\n\t} catch {\n\t\treturn [];\n\t}\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return [];\n\tconst modelsData = parsed as Record<string, unknown>;\n\tconst providers = modelsData.providers;\n\tif (typeof providers !== \"object\" || providers === null || Array.isArray(providers)) return [];\n\n\tconst migrations: ConfigValueMigration[] = [];\n\tfor (const [provider, providerConfig] of Object.entries(providers)) {\n\t\tif (typeof providerConfig !== \"object\" || providerConfig === null || Array.isArray(providerConfig)) continue;\n\t\tconst providerRecord = providerConfig as Record<string, unknown>;\n\t\tconst providerLocation = `models.json.providers[${JSON.stringify(provider)}]`;\n\t\tmigrateStringProperty(providerRecord, \"apiKey\", `${providerLocation}.apiKey`, migrations);\n\t\tmigrateHeadersConfig(providerRecord.headers, `${providerLocation}.headers`, migrations);\n\n\t\tif (Array.isArray(providerRecord.models)) {\n\t\t\tfor (let index = 0; index < providerRecord.models.length; index++) {\n\t\t\t\tconst modelConfig = providerRecord.models[index];\n\t\t\t\tif (typeof modelConfig !== \"object\" || modelConfig === null || Array.isArray(modelConfig)) continue;\n\t\t\t\tconst modelRecord = modelConfig as Record<string, unknown>;\n\t\t\t\tconst modelKey = typeof modelRecord.id === \"string\" ? JSON.stringify(modelRecord.id) : String(index);\n\t\t\t\tmigrateHeadersConfig(modelRecord.headers, `${providerLocation}.models[${modelKey}].headers`, migrations);\n\t\t\t}\n\t\t}\n\n\t\tconst modelOverrides = providerRecord.modelOverrides;\n\t\tif (typeof modelOverrides === \"object\" && modelOverrides !== null && !Array.isArray(modelOverrides)) {\n\t\t\tfor (const [modelId, modelOverride] of Object.entries(modelOverrides)) {\n\t\t\t\tif (typeof modelOverride !== \"object\" || modelOverride === null || Array.isArray(modelOverride)) continue;\n\t\t\t\tconst modelOverrideRecord = modelOverride as Record<string, unknown>;\n\t\t\t\tmigrateHeadersConfig(\n\t\t\t\t\tmodelOverrideRecord.headers,\n\t\t\t\t\t`${providerLocation}.modelOverrides[${JSON.stringify(modelId)}].headers`,\n\t\t\t\t\tmigrations,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\tif (migrations.length === 0) return [];\n\twriteFileSync(modelsPath, `${JSON.stringify(parsed, null, 2)}\\n`, \"utf-8\");\n\treturn migrations;\n}\n\nfunction migrateExplicitEnvVarConfigValues(): void {\n\tconst agentDir = getAgentDir();\n\tconst migrations = [...migrateAuthJsonConfigValues(agentDir), ...migrateModelsJsonConfigValues(agentDir)];\n\tif (migrations.length === 0) return;\n\n\tconst details = migrations.map((migration) => `  - ${migration.location}: ${migration.from} -> ${migration.to}`);\n\tconsole.log(\n\t\tchalk.yellow(\n\t\t\t[\n\t\t\t\t\"Warning: Migrated API key/header environment references to explicit $ENV_VAR syntax. Plain strings will be treated as literals.\",\n\t\t\t\t...details,\n\t\t\t].join(\"\\n\"),\n\t\t),\n\t);\n}\n\n/**\n * Migrate sessions from ~/.pi/agent/*.jsonl to proper session directories.\n *\n * Bug in v0.30.0: Sessions were saved to ~/.pi/agent/ instead of\n * ~/.pi/agent/sessions/<encoded-cwd>/. This migration moves them\n * to the correct location based on the cwd in their session header.\n *\n * See: https://github.com/earendil-works/pi-mono/issues/320\n */\nexport function getMigratedSessionFileName(file: string): string | undefined {\n\tconst fileName = file.split(/[\\\\/]/).pop();\n\treturn fileName || undefined;\n}\n\nexport function migrateSessionsFromAgentRoot(): void {\n\tconst agentDir = getAgentDir();\n\n\t// Find all .jsonl files directly in agentDir (not in subdirectories)\n\tlet files: string[];\n\ttry {\n\t\tfiles = readdirSync(agentDir)\n\t\t\t.filter((f) => f.endsWith(\".jsonl\"))\n\t\t\t.map((f) => join(agentDir, f));\n\t} catch {\n\t\treturn;\n\t}\n\n\tif (files.length === 0) return;\n\n\tfor (const file of files) {\n\t\ttry {\n\t\t\t// Read first line to get session header\n\t\t\tconst content = readFileSync(file, \"utf8\");\n\t\t\tconst firstLine = content.split(\"\\n\")[0];\n\t\t\tif (!firstLine?.trim()) continue;\n\n\t\t\tconst header = JSON.parse(firstLine);\n\t\t\tif (header.type !== \"session\" || !header.cwd) continue;\n\n\t\t\tconst cwd: string = header.cwd;\n\n\t\t\t// Compute the correct session directory (same encoding as session-manager.ts)\n\t\t\tconst safePath = `--${cwd.replace(/^[/\\\\]/, \"\").replace(/[/\\\\:]/g, \"-\")}--`;\n\t\t\tconst correctDir = join(agentDir, \"sessions\", safePath);\n\n\t\t\t// Create directory if needed\n\t\t\tif (!existsSync(correctDir)) {\n\t\t\t\tmkdirSync(correctDir, { recursive: true });\n\t\t\t}\n\n\t\t\t// Move the file\n\t\t\tconst fileName = getMigratedSessionFileName(file);\n\t\t\tif (!fileName) continue;\n\t\t\tconst newPath = join(correctDir, fileName);\n\n\t\t\tif (existsSync(newPath)) continue; // Skip if target exists\n\n\t\t\trenameSync(file, newPath);\n\t\t} catch {\n\t\t\t// Skip files that can't be migrated\n\t\t}\n\t}\n}\n\n/**\n * Migrate commands/ to prompts/ if needed.\n * Works for both regular directories and symlinks.\n */\nfunction migrateCommandsToPrompts(baseDir: string, label: string): boolean {\n\tconst commandsDir = join(baseDir, \"commands\");\n\tconst promptsDir = join(baseDir, \"prompts\");\n\n\tif (existsSync(commandsDir) && !existsSync(promptsDir)) {\n\t\ttry {\n\t\t\trenameSync(commandsDir, promptsDir);\n\t\t\tconsole.log(chalk.green(`Migrated ${label} commands/ → prompts/`));\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tconsole.log(\n\t\t\t\tchalk.yellow(\n\t\t\t\t\t`Warning: Could not migrate ${label} commands/ to prompts/: ${err instanceof Error ? err.message : err}`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t}\n\treturn false;\n}\n\nfunction migrateKeybindingsConfigFile(): void {\n\tconst configPath = join(getAgentDir(), \"keybindings.json\");\n\tif (!existsSync(configPath)) return;\n\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(configPath, \"utf-8\")) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\treturn;\n\t\t}\n\t\tconst { config, migrated } = migrateKeybindingsConfig(parsed as Record<string, unknown>);\n\t\tif (!migrated) return;\n\t\twriteFileSync(configPath, `${JSON.stringify(config, null, 2)}\\n`, \"utf-8\");\n\t} catch {\n\t\t// Ignore malformed files during migration\n\t}\n}\n\n/**\n * Move fd/rg binaries from tools/ to bin/ if they exist.\n */\nfunction migrateToolsToBin(): void {\n\tconst agentDir = getAgentDir();\n\tconst toolsDir = join(agentDir, \"tools\");\n\tconst binDir = getBinDir();\n\n\tif (!existsSync(toolsDir)) return;\n\n\tconst binaries = [\"fd\", \"rg\", \"fd.exe\", \"rg.exe\"];\n\tlet movedAny = false;\n\n\tfor (const bin of binaries) {\n\t\tconst oldPath = join(toolsDir, bin);\n\t\tconst newPath = join(binDir, bin);\n\n\t\tif (existsSync(oldPath)) {\n\t\t\tif (!existsSync(binDir)) {\n\t\t\t\tmkdirSync(binDir, { recursive: true });\n\t\t\t}\n\t\t\tif (!existsSync(newPath)) {\n\t\t\t\ttry {\n\t\t\t\t\trenameSync(oldPath, newPath);\n\t\t\t\t\tmovedAny = true;\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore errors\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Target exists, just delete the old one\n\t\t\t\ttry {\n\t\t\t\t\trmSync?.(oldPath, { force: true });\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tif (movedAny) {\n\t\tconsole.log(chalk.green(`Migrated managed binaries tools/ → bin/`));\n\t}\n}\n\n/**\n * Root-level machine-managed trust state is relocated into `state/`. If both layouts exist, valid\n * entries are merged under the canonical file's lock and canonical decisions win conflicts.\n */\nconst MAX_SESSION_NAMESPACES_TO_PRUNE = 10_000;\nconst MAX_LEGACY_DIRECTORY_ENTRIES_TO_MIGRATE = 10_000;\nconst MAX_MIGRATION_CONFLICT_SUFFIXES = 1_000;\n\ntype MigratedTrustFile = Record<string, boolean | null>;\n\nfunction readMigratedTrustFile(path: string): MigratedTrustFile | undefined {\n\ttry {\n\t\tconst parsed = JSON.parse(readFileSync(path, \"utf-8\")) as unknown;\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return undefined;\n\t\tconst trust: MigratedTrustFile = {};\n\t\tfor (const [key, value] of Object.entries(parsed)) {\n\t\t\tif (value !== true && value !== false && value !== null) return undefined;\n\t\t\ttrust[key] = value;\n\t\t}\n\t\treturn trust;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction migrateTrustState(agentDir: string): void {\n\tconst oldPath = join(agentDir, \"trust.json\");\n\tif (!existsSync(oldPath)) return;\n\tconst newPath = stateFile(agentDir, \"trust.json\");\n\tif (!existsSync(newPath)) {\n\t\tmkdirSync(dirname(newPath), { recursive: true });\n\t\trenameSync(oldPath, newPath);\n\t\treturn;\n\t}\n\n\twithFileLockSync(newPath, () => {\n\t\tconst legacy = readMigratedTrustFile(oldPath);\n\t\tconst canonical = readMigratedTrustFile(newPath);\n\t\tif (!legacy || !canonical) return;\n\t\tconst merged = { ...legacy, ...canonical };\n\t\tconst sorted = Object.fromEntries(Object.entries(merged).sort(([left], [right]) => left.localeCompare(right)));\n\t\twriteFileAtomicSync(newPath, `${JSON.stringify(sorted, null, 2)}\\n`);\n\t\tunlinkSync(oldPath);\n\t});\n}\n\nfunction migrationConflictPath(agentDir: string, legacyName: string, entryName: string): string | undefined {\n\tconst conflictDir = stateFile(agentDir, \"migration-conflicts\", legacyName);\n\tfor (let suffix = 0; suffix < MAX_MIGRATION_CONFLICT_SUFFIXES; suffix++) {\n\t\tconst name = suffix === 0 ? entryName : `${entryName}.legacy-${suffix}`;\n\t\tconst candidate = join(conflictDir, name);\n\t\tif (!existsSync(candidate)) return candidate;\n\t}\n\treturn undefined;\n}\n\n/**\n * Relocate one known legacy root without traversing its contents. A whole-root rename is O(1);\n * partial migrations scan a bounded number of top-level entries and preserve collisions under\n * state/migration-conflicts instead of overwriting either copy.\n */\nfunction migrateLegacyAgentDirectory(agentDir: string, legacyName: string, canonicalDir: string): void {\n\tconst legacyDir = join(agentDir, legacyName);\n\tif (!existsSync(legacyDir)) return;\n\tconst legacyStats = lstatSync(legacyDir);\n\tif (!legacyStats.isDirectory() || legacyStats.isSymbolicLink()) return;\n\n\tif (!existsSync(canonicalDir)) {\n\t\tmkdirSync(dirname(canonicalDir), { recursive: true });\n\t\trenameSync(legacyDir, canonicalDir);\n\t\treturn;\n\t}\n\n\tconst canonicalStats = lstatSync(canonicalDir);\n\tif (!canonicalStats.isDirectory() || canonicalStats.isSymbolicLink()) return;\n\tconst entries = readdirSync(legacyDir).slice(0, MAX_LEGACY_DIRECTORY_ENTRIES_TO_MIGRATE);\n\tfor (const entry of entries) {\n\t\tconst source = join(legacyDir, entry);\n\t\tlet target = join(canonicalDir, entry);\n\t\tif (existsSync(target)) {\n\t\t\ttarget = migrationConflictPath(agentDir, legacyName, entry) ?? \"\";\n\t\t\tif (!target) continue;\n\t\t\tmkdirSync(dirname(target), { recursive: true });\n\t\t}\n\t\ttry {\n\t\t\trenameSync(source, target);\n\t\t} catch {}\n\t}\n\n\ttry {\n\t\trmdirSync(legacyDir);\n\t} catch {}\n}\n\nfunction migrateLegacyAgentFile(agentDir: string, legacyName: string, canonicalPath: string): void {\n\tconst legacyPath = join(agentDir, legacyName);\n\tif (!existsSync(legacyPath)) return;\n\tconst legacyStats = lstatSync(legacyPath);\n\tif (!legacyStats.isFile() || legacyStats.isSymbolicLink()) return;\n\tlet target = canonicalPath;\n\tif (existsSync(target)) {\n\t\ttarget = migrationConflictPath(agentDir, \"root-files\", legacyName.replaceAll(\":\", \".\")) ?? \"\";\n\t\tif (!target) return;\n\t}\n\tmkdirSync(dirname(target), { recursive: true });\n\ttry {\n\t\trenameSync(legacyPath, target);\n\t} catch (renameError) {\n\t\t// Windows cannot rename an NTFS alternate data stream into a regular file. Preserve the\n\t\t// bytes first, then remove only the named stream; never move or rewrite the owning auth file.\n\t\twriteFileSync(target, readFileSync(legacyPath), { flag: \"wx\" });\n\t\ttry {\n\t\t\tunlinkSync(legacyPath);\n\t\t} catch {\n\t\t\ttry {\n\t\t\t\tunlinkSync(target);\n\t\t\t} catch {}\n\t\t\tthrow renameError;\n\t\t}\n\t}\n}\n\n/** Remove only empty real per-project session directories; transcript files are never retention-pruned. */\nexport function pruneEmptySessionNamespaces(agentDir: string): string[] {\n\tconst root = sessionsDir(agentDir);\n\tlet candidates: string[];\n\ttry {\n\t\tcandidates = readdirSync(root, { withFileTypes: true })\n\t\t\t.slice(0, MAX_SESSION_NAMESPACES_TO_PRUNE)\n\t\t\t.filter((entry) => entry.isDirectory() && !entry.isSymbolicLink())\n\t\t\t.map((entry) => join(root, entry.name));\n\t} catch {\n\t\treturn [];\n\t}\n\n\tconst removed: string[] = [];\n\tfor (const candidate of candidates) {\n\t\ttry {\n\t\t\tconst stats = lstatSync(candidate);\n\t\t\tif (!stats.isDirectory() || stats.isSymbolicLink() || readdirSync(candidate).length > 0) continue;\n\t\t\trmdirSync(candidate);\n\t\t\tremoved.push(candidate);\n\t\t} catch {}\n\t}\n\treturn removed;\n}\n\n/**\n * Consolidate known machine-managed layout generations. Each migration is independently guarded:\n * startup never fails because cleanup is unavailable, and unknown files/resources remain untouched.\n */\nexport function migrateAgentDirLayout(agentDir: string): void {\n\ttry {\n\t\tmigrateTrustState(agentDir);\n\t} catch {\n\t\t// Best-effort: startup must not fail because one straggler could not be relocated.\n\t}\n\ttry {\n\t\tmigrateLegacyContextStores(agentDir);\n\t\tpruneContextStores(agentDir);\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"backups\", configBackupsDir(agentDir));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"resource-profiles\", directoryProfilesDir(agentDir));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"auto-learn\", stateFile(agentDir, \"legacy-layout\", \"auto-learn\"));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentDirectory(agentDir, \"tmp\", stateFile(agentDir, \"legacy-layout\", \"tmp\"));\n\t} catch {}\n\ttry {\n\t\tmigrateLegacyAgentFile(\n\t\t\tagentDir,\n\t\t\t\"auth.json:Zone.Identifier\",\n\t\t\tstateFile(agentDir, \"legacy-layout\", \"sidecars\", \"auth.json.Zone.Identifier\"),\n\t\t);\n\t} catch {}\n\tfor (const fileName of [\"MEMORY.md\", \"USER.md\"] as const) {\n\t\ttry {\n\t\t\tmigrateLegacyAgentFile(agentDir, `${fileName}.pi-managed.json`, managedMemoryStateFile(agentDir, fileName));\n\t\t} catch {}\n\t}\n\ttry {\n\t\tif (existsSync(agentDir)) {\n\t\t\tconst entries = readdirSync(agentDir);\n\t\t\tfor (const entry of entries) {\n\t\t\t\tif (isCanonicalAgentRootEntry(entry)) continue;\n\t\t\t\tif (entry === \"MEMORY.md.pi-managed.json\" || entry === \"USER.md.pi-managed.json\") {\n\t\t\t\t\tconst fileName = entry.startsWith(\"MEMORY\") ? \"MEMORY.md\" : \"USER.md\";\n\t\t\t\t\tmigrateLegacyAgentFile(agentDir, entry, managedMemoryStateFile(agentDir, fileName));\n\t\t\t\t} else {\n\t\t\t\t\tconst fullPath = join(agentDir, entry);\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst stats = lstatSync(fullPath);\n\t\t\t\t\t\tif (stats.isDirectory() && !stats.isSymbolicLink()) {\n\t\t\t\t\t\t\tconst KNOWN_EXTENSIONS = new Set([\"automator\", \"gh-scavenger\", \"trello\"]);\n\t\t\t\t\t\t\tconst targetDir = KNOWN_EXTENSIONS.has(entry)\n\t\t\t\t\t\t\t\t? extensionStateDir(agentDir, entry)\n\t\t\t\t\t\t\t\t: stateFile(agentDir, \"legacy-layout\", entry);\n\t\t\t\t\t\t\tmigrateLegacyAgentDirectory(agentDir, entry, targetDir);\n\t\t\t\t\t\t} else if (stats.isFile() && !stats.isSymbolicLink()) {\n\t\t\t\t\t\t\tmigrateLegacyAgentFile(agentDir, entry, stateFile(agentDir, \"legacy-layout\", \"root-files\", entry));\n\t\t\t\t\t\t}\n\t\t\t\t\t} catch {}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} catch {}\n\tpruneEmptySessionNamespaces(agentDir);\n}\n\n/**\n * Check for deprecated hooks/ and tools/ directories.\n * Note: tools/ may contain fd/rg binaries extracted by pi, so only warn if it has other files.\n */\nfunction checkDeprecatedExtensionDirs(baseDir: string, label: string): string[] {\n\tconst hooksDir = join(baseDir, \"hooks\");\n\tconst toolsDir = join(baseDir, \"tools\");\n\tconst warnings: string[] = [];\n\n\tif (existsSync(hooksDir)) {\n\t\twarnings.push(`${label} hooks/ directory found. Hooks have been renamed to extensions.`);\n\t}\n\n\tif (existsSync(toolsDir)) {\n\t\t// Check if tools/ contains anything other than fd/rg (which are auto-extracted binaries)\n\t\ttry {\n\t\t\tconst entries = readdirSync(toolsDir);\n\t\t\tconst customTools = entries.filter((e) => {\n\t\t\t\tconst lower = e.toLowerCase();\n\t\t\t\treturn (\n\t\t\t\t\tlower !== \"fd\" && lower !== \"rg\" && lower !== \"fd.exe\" && lower !== \"rg.exe\" && !e.startsWith(\".\") // Ignore .DS_Store and other hidden files\n\t\t\t\t);\n\t\t\t});\n\t\t\tif (customTools.length > 0) {\n\t\t\t\twarnings.push(\n\t\t\t\t\t`${label} tools/ directory contains custom tools. Custom tools have been merged into extensions.`,\n\t\t\t\t);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Ignore read errors\n\t\t}\n\t}\n\n\treturn warnings;\n}\n\n/**\n * Run extension system migrations (commands→prompts) and collect warnings about deprecated directories.\n */\nfunction migrateExtensionSystem(cwd: string): string[] {\n\tconst agentDir = getAgentDir();\n\tconst projectDir = join(cwd, CONFIG_DIR_NAME);\n\n\t// Migrate commands/ to prompts/\n\tmigrateCommandsToPrompts(agentDir, \"Global\");\n\tmigrateCommandsToPrompts(projectDir, \"Project\");\n\n\t// Check for deprecated directories\n\tconst warnings = [\n\t\t...checkDeprecatedExtensionDirs(agentDir, \"Global\"),\n\t\t...checkDeprecatedExtensionDirs(projectDir, \"Project\"),\n\t];\n\n\treturn warnings;\n}\n\n/**\n * Print deprecation warnings and wait for keypress.\n */\nexport async function showDeprecationWarnings(warnings: string[]): Promise<void> {\n\tif (warnings.length === 0) return;\n\n\tfor (const warning of warnings) {\n\t\tconsole.log(chalk.yellow(`Warning: ${warning}`));\n\t}\n\tconsole.log(chalk.yellow(`\\nMove your extensions to the extensions/ directory.`));\n\tconsole.log(chalk.yellow(`Migration guide: ${MIGRATION_GUIDE_URL}`));\n\tconsole.log(chalk.yellow(`Documentation: ${EXTENSIONS_DOC_URL}`));\n\tif (!process.stdin.isTTY || !process.stdout.isTTY) {\n\t\tconsole.log();\n\t\treturn;\n\t}\n\tconsole.log(chalk.dim(`\\nPress any key to continue...`));\n\n\tprocess.stdin.setRawMode?.(true);\n\tprocess.stdin.resume();\n\tawait waitForStdinEvent();\n\tprocess.stdin.setRawMode?.(false);\n\tprocess.stdin.pause();\n\tconsole.log();\n}\n\n/**\n * Run all migrations. Called once on startup.\n *\n * @returns Object with migration results and deprecation warnings\n */\nexport function runMigrations(cwd: string): {\n\tmigratedAuthProviders: string[];\n\tdeprecationWarnings: string[];\n} {\n\tmigrateAgentDirLayout(getAgentDir());\n\tconst migratedAuthProviders = migrateAuthToAuthJson();\n\tmigrateExplicitEnvVarConfigValues();\n\tmigrateSessionsFromAgentRoot();\n\tmigrateToolsToBin();\n\tmigrateKeybindingsConfigFile();\n\tconst deprecationWarnings = migrateExtensionSystem(cwd);\n\treturn { migratedAuthProviders, deprecationWarnings };\n}\n"]}

package/examples/extensions/custom-provider-anthropic/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pi-extension-custom-provider",
-  "version": "0.86.1",
+  "version": "0.86.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pi-extension-custom-provider",
-      "version": "0.86.1",
+      "version": "0.86.2",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.52.0"
       }

package/examples/extensions/custom-provider-anthropic/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-custom-provider-anthropic",
   "private": true,
-  "version": "0.86.1",
+  "version": "0.86.2",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/examples/extensions/custom-provider-gitlab-duo/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-custom-provider-gitlab-duo",
   "private": true,
-  "version": "0.86.1",
+  "version": "0.86.2",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/examples/extensions/sandbox/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "pi-extension-sandbox",
-	"version": "0.86.1",
+	"version": "0.86.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "pi-extension-sandbox",
-			"version": "0.86.1",
+			"version": "0.86.2",
 			"dependencies": {
 				"@anthropic-ai/sandbox-runtime": "^0.0.26"
 			}

package/examples/extensions/sandbox/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "pi-extension-sandbox",
 	"private": true,
-	"version": "0.86.1",
+	"version": "0.86.2",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",

package/examples/extensions/with-deps/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pi-extension-with-deps",
-  "version": "0.86.1",
+  "version": "0.86.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pi-extension-with-deps",
-      "version": "0.86.1",
+      "version": "0.86.2",
       "dependencies": {
         "ms": "^2.1.3"
       },

package/examples/extensions/with-deps/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-with-deps",
   "private": true,
-  "version": "0.86.1",
+  "version": "0.86.2",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/npm-shrinkwrap.json

@@ -1,17 +1,17 @@
 {
 	"name": "@caupulican/pi-adaptative",
-	"version": "0.86.1",
+	"version": "0.86.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@caupulican/pi-adaptative",
-			"version": "0.86.1",
+			"version": "0.86.2",
 			"license": "MIT",
 			"dependencies": {
-				"@caupulican/pi-agent-core": "^0.86.1",
-				"@caupulican/pi-ai": "^0.86.1",
-				"@caupulican/pi-tui": "^0.86.1",
+				"@caupulican/pi-agent-core": "^0.86.2",
+				"@caupulican/pi-ai": "^0.86.2",
+				"@caupulican/pi-tui": "^0.86.2",
 				"@silvia-odwyer/photon-node": "0.3.4",
 				"chalk": "5.6.2",
 				"cross-spawn": "7.0.6",
@@ -547,11 +547,11 @@
 			}
 		},
 		"node_modules/@caupulican/pi-agent-core": {
-			"version": "0.86.1",
-			"resolved": "https://registry.npmjs.org/@caupulican/pi-agent-core/-/pi-agent-core-0.86.1.tgz",
+			"version": "0.86.2",
+			"resolved": "https://registry.npmjs.org/@caupulican/pi-agent-core/-/pi-agent-core-0.86.2.tgz",
 			"license": "MIT",
 			"dependencies": {
-				"@caupulican/pi-ai": "^0.86.1",
+				"@caupulican/pi-ai": "^0.86.2",
 				"ignore": "7.0.5",
 				"typebox": "1.1.38",
 				"yaml": "2.9.0"
@@ -561,8 +561,8 @@
 			}
 		},
 		"node_modules/@caupulican/pi-ai": {
-			"version": "0.86.1",
-			"resolved": "https://registry.npmjs.org/@caupulican/pi-ai/-/pi-ai-0.86.1.tgz",
+			"version": "0.86.2",
+			"resolved": "https://registry.npmjs.org/@caupulican/pi-ai/-/pi-ai-0.86.2.tgz",
 			"license": "MIT",
 			"dependencies": {
 				"@anthropic-ai/sdk": "0.91.1",
@@ -616,8 +616,8 @@
 			}
 		},
 		"node_modules/@caupulican/pi-tui": {
-			"version": "0.86.1",
-			"resolved": "https://registry.npmjs.org/@caupulican/pi-tui/-/pi-tui-0.86.1.tgz",
+			"version": "0.86.2",
+			"resolved": "https://registry.npmjs.org/@caupulican/pi-tui/-/pi-tui-0.86.2.tgz",
 			"license": "MIT",
 			"dependencies": {
 				"get-east-asian-width": "1.6.0",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@caupulican/pi-adaptative",
-	"version": "0.86.1",
+	"version": "0.86.2",
 	"description": "Adaptive fork of Pi coding agent for self-evolving agent harness experiments",
 	"type": "module",
 	"piConfig": {
@@ -84,9 +84,9 @@
 		"postinstall": "node scripts/postinstall-python-runtime.mjs"
 	},
 	"dependencies": {
-		"@caupulican/pi-agent-core": "^0.86.1",
-		"@caupulican/pi-ai": "^0.86.1",
-		"@caupulican/pi-tui": "^0.86.1",
+		"@caupulican/pi-agent-core": "^0.86.2",
+		"@caupulican/pi-ai": "^0.86.2",
+		"@caupulican/pi-tui": "^0.86.2",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "5.6.2",
 		"cross-spawn": "7.0.6",