@cnwenf/occ 2.1.344 → 2.1.346

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-globalThis.MACRO={"VERSION":"2.1.344","BINARY_NAME":"occ","BUILD_TIME":"2026-09-19T22:11:10.563Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
+globalThis.MACRO={"VERSION":"2.1.346","BINARY_NAME":"occ","BUILD_TIME":"2026-09-21T18:17:57.821Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
 // @bun
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -57751,496 +57751,246 @@ var init_managedPath = __esm(() => {
   });
 });
 
-// src/utils/lazySchema.ts
-function lazySchema(factory2) {
-  let cached2;
-  return () => cached2 ??= factory2();
-}
-
-// src/entrypoints/sandboxTypes.ts
-var SandboxNetworkConfigSchema, SandboxFilesystemConfigSchema, SandboxSettingsSchema;
-var init_sandboxTypes = __esm(() => {
-  init_v4();
-  SandboxNetworkConfigSchema = lazySchema(() => exports_external.object({
-    allowedDomains: exports_external.array(exports_external.string()).optional(),
-    deniedDomains: exports_external.array(exports_external.string()).optional().describe("Domains to block even when a broader allowedDomains wildcard would otherwise permit them."),
-    allowManagedDomainsOnly: exports_external.boolean().optional().describe("When true (and set in managed settings), only allowedDomains and WebFetch(domain:...) allow rules from managed settings are respected. " + "User, project, local, and flag settings domains are ignored. Denied domains are still respected from all sources."),
-    strictAllowlist: exports_external.boolean().optional().describe("When true, the sandbox runtime deterministically denies hosts not in allowedDomains instead of prompting. " + "Enforced for sandboxed commands only \u2014 in-process tools such as WebFetch are not gated by this setting. " + "Only honored from user, managed/policy, or CLI (--settings) settings \u2014 " + "project settings (.claude/settings.json and .claude/settings.local.json) are ignored."),
-    allowUnixSockets: exports_external.array(exports_external.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),
-    allowAllUnixSockets: exports_external.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),
-    allowLocalBinding: exports_external.boolean().optional(),
-    httpProxyPort: exports_external.number().optional(),
-    socksProxyPort: exports_external.number().optional()
-  }).optional());
-  SandboxFilesystemConfigSchema = lazySchema(() => exports_external.object({
-    disabled: exports_external.boolean().optional().describe("macOS and Linux/WSL only: skip filesystem isolation entirely while " + "keeping network and seccomp isolation. Ignored on native Windows, " + "where the sandboxed process runs as a separate user with no " + "inherent rights, so skipping the filesystem rules would withhold " + "every access grant rather than loosen them \u2014 filesystem isolation " + "stays on there."),
-    allowWrite: exports_external.array(exports_external.string()).optional().describe("Additional paths to allow writing within the sandbox. " + "Merged with paths from Edit(...) allow permission rules."),
-    denyWrite: exports_external.array(exports_external.string()).optional().describe("Additional paths to deny writing within the sandbox. " + "Merged with paths from Edit(...) deny permission rules."),
-    denyRead: exports_external.array(exports_external.string()).optional().describe("Additional paths to deny reading within the sandbox. " + "Merged with paths from Read(...) deny permission rules."),
-    allowRead: exports_external.array(exports_external.string()).optional().describe("Paths to re-allow reading within denyRead regions. " + "Takes precedence over denyRead for matching paths."),
-    allowManagedReadPathsOnly: exports_external.boolean().optional().describe("When true (set in managed settings), only allowRead paths from policySettings are used.")
-  }).optional());
-  SandboxSettingsSchema = lazySchema(() => exports_external.object({
-    enabled: exports_external.boolean().optional(),
-    failIfUnavailable: exports_external.boolean().optional().describe("Exit with an error at startup if sandbox.enabled is true but the sandbox cannot start " + "(missing dependencies, unsupported platform, or platform not in enabledPlatforms). " + "When false (default), a warning is shown and commands run unsandboxed. " + "Intended for managed-settings deployments that require sandboxing as a hard gate."),
-    autoAllowBashIfSandboxed: exports_external.boolean().optional(),
-    allowUnsandboxedCommands: exports_external.boolean().optional().describe("Allow commands to run outside the sandbox via the dangerouslyDisableSandbox parameter. " + "When false, the dangerouslyDisableSandbox parameter is completely ignored and all commands must run sandboxed. " + "Default: true."),
-    network: SandboxNetworkConfigSchema(),
-    filesystem: SandboxFilesystemConfigSchema(),
-    ignoreViolations: exports_external.record(exports_external.string(), exports_external.array(exports_external.string())).optional(),
-    enableWeakerNestedSandbox: exports_external.boolean().optional(),
-    enableWeakerNetworkIsolation: exports_external.boolean().optional().describe("macOS only: Allow access to com.apple.trustd.agent in the sandbox. " + "Needed for Go-based CLI tools (gh, gcloud, terraform, etc.) to verify TLS certificates " + "when using httpProxyPort with a MITM proxy and custom CA. " + "**Reduces security** \u2014 opens a potential data exfiltration vector through the trustd service. Default: false"),
-    allowAppleEvents: exports_external.boolean().optional().describe("macOS only: Allow sandboxed commands to send Apple Events to other " + "applications via the Apple Event service. Default: false"),
-    excludedCommands: exports_external.array(exports_external.string()).optional(),
-    credentials: exports_external.object({
-      enabled: exports_external.boolean().optional().describe("When true, block sandboxed commands from reading credential files and secret env vars.")
-    }).optional(),
-    ripgrep: exports_external.object({
-      command: exports_external.string(),
-      args: exports_external.array(exports_external.string()).optional()
-    }).optional().describe("Custom ripgrep configuration for bundled ripgrep support")
-  }).passthrough());
-});
-
-// src/utils/bundledMode.ts
-function isRunningWithBun() {
-  return process.versions.bun !== undefined;
-}
-function isInBundledMode() {
-  return typeof Bun !== "undefined" && Array.isArray(Bun.embeddedFiles) && Bun.embeddedFiles.length > 0;
-}
-
-// src/utils/findExecutable.ts
-function findExecutable2(exe, args) {
-  const resolved = whichSync(exe);
-  return { cmd: resolved ?? exe, args };
+// src/utils/plugins/marketplacePolicyValidation.ts
+function stripTrailingDots(host) {
+  let end = host.length;
+  while (end > 0 && host[end - 1] === ".")
+    end--;
+  return host.slice(0, end);
 }
-var init_findExecutable = __esm(() => {
-  init_which();
-});
-
-// src/utils/env.ts
-import { homedir as homedir8 } from "os";
-import { join as join17 } from "path";
-async function isCommandAvailable(command) {
+function normalizeHostname(raw) {
+  const host = stripTrailingDots(raw.replace(/[\t\n\r]/g, "").toLowerCase());
+  if (host === "" || INVALID_HOST_CHARS.test(host))
+    return host;
   try {
-    return !!await which(command);
+    const parsed = new URL(`https://${host}`);
+    if (parsed.username !== "" || parsed.password !== "" || parsed.port !== "" || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "")
+      return host;
+    return stripTrailingDots(parsed.hostname);
   } catch {
-    return false;
+    return host;
   }
 }
-function isConductor() {
-  return process.env.__CFBundleIdentifier === "com.conductor.app";
-}
-function detectTerminal() {
-  if (process.env.CURSOR_TRACE_ID)
-    return "cursor";
-  if (process.env.VSCODE_GIT_ASKPASS_MAIN?.includes("cursor")) {
-    return "cursor";
-  }
-  if (process.env.VSCODE_GIT_ASKPASS_MAIN?.includes("windsurf")) {
-    return "windsurf";
+function normalizeHostForComparison(raw) {
+  const cached2 = hostNormalizeCache.get(raw);
+  if (cached2 !== undefined)
+    return cached2;
+  let host = normalizeHostname(raw);
+  while (host.startsWith("www."))
+    host = host.slice(4);
+  if (hostNormalizeCache.size >= HOST_NORMALIZE_CACHE_LIMIT) {
+    hostNormalizeCache.clear();
   }
-  if (process.env.VSCODE_GIT_ASKPASS_MAIN?.includes("antigravity")) {
-    return "antigravity";
+  hostNormalizeCache.set(raw, host);
+  return host;
+}
+function hostMatches(raw, expected) {
+  return normalizeHostForComparison(raw) === expected;
+}
+function isGitHubHost(raw) {
+  return hostMatches(raw, GITHUB_HOST);
+}
+function isGitHubOrSshGitHubHost(raw) {
+  return isGitHubHost(raw) || normalizeHostname(raw) === GITHUB_SSH_HOST;
+}
+function hasSuspiciousHostChars(value) {
+  return /[%\x00-\x1f\x7f-\u{10FFFF}]/u.test(value);
+}
+function hasBackslashSmuggling(raw) {
+  const url3 = raw.replace(/^[\x00-\x20]+/, "");
+  const schemeEnd = url3.indexOf("://");
+  if (schemeEnd === -1)
+    return false;
+  let rest = url3.slice(schemeEnd + 3);
+  const scheme = url3.slice(0, schemeEnd).toLowerCase();
+  if (URL_LIKE_PROTOCOLS.has(scheme)) {
+    const slashes = rest.match(/^[/\\]+/)?.[0] ?? "";
+    if (slashes.includes("\\"))
+      return true;
+    rest = rest.slice(slashes.length);
   }
-  const bundleId = process.env.__CFBundleIdentifier?.toLowerCase();
-  if (bundleId?.includes("vscodium"))
-    return "codium";
-  if (bundleId?.includes("windsurf"))
-    return "windsurf";
-  if (bundleId?.includes("com.google.android.studio"))
-    return "androidstudio";
-  if (bundleId) {
-    for (const ide of JETBRAINS_IDES) {
-      if (bundleId.includes(ide))
-        return ide;
+  const pathStart = rest.search(/[/?#]/);
+  return (pathStart === -1 ? rest : rest.slice(0, pathStart)).includes("\\");
+}
+function isSuspiciousGitUrl(url3) {
+  if (url3.includes("://")) {
+    if (hasBackslashSmuggling(url3))
+      return true;
+    try {
+      const parsed = new URL(url3);
+      if (parsed.protocol === "http:" || parsed.protocol === "https:")
+        return false;
+      return hasSuspiciousHostChars(parsed.hostname);
+    } catch {
+      return true;
     }
   }
-  if (process.env.VisualStudioVersion) {
-    return "visualstudio";
-  }
-  if (process.env.TERMINAL_EMULATOR === "JetBrains-JediTerm") {
-    if (process.platform === "darwin")
-      return "pycharm";
-    return "pycharm";
-  }
-  if (process.env.TERM === "xterm-ghostty") {
-    return "ghostty";
-  }
-  if (process.env.TERM?.includes("kitty")) {
-    return "kitty";
-  }
-  if (process.env.TERM_PROGRAM) {
-    return process.env.TERM_PROGRAM;
-  }
-  if (process.env.TMUX)
-    return "tmux";
-  if (process.env.STY)
-    return "screen";
-  if (process.env.KONSOLE_VERSION)
-    return "konsole";
-  if (process.env.GNOME_TERMINAL_SERVICE)
-    return "gnome-terminal";
-  if (process.env.XTERM_VERSION)
-    return "xterm";
-  if (process.env.VTE_VERSION)
-    return "vte-based";
-  if (process.env.TERMINATOR_UUID)
-    return "terminator";
-  if (process.env.KITTY_WINDOW_ID) {
-    return "kitty";
-  }
-  if (process.env.ALACRITTY_LOG)
-    return "alacritty";
-  if (process.env.TILIX_ID)
-    return "tilix";
-  if (process.env.WT_SESSION)
-    return "windows-terminal";
-  if (process.env.SESSIONNAME && process.env.TERM === "cygwin")
-    return "cygwin";
-  if (process.env.MSYSTEM)
-    return process.env.MSYSTEM.toLowerCase();
-  if (process.env.ConEmuANSI || process.env.ConEmuPID || process.env.ConEmuTask) {
-    return "conemu";
-  }
-  if (process.env.WSL_DISTRO_NAME)
-    return `wsl-${process.env.WSL_DISTRO_NAME}`;
-  if (isSSHSession()) {
-    return "ssh-session";
-  }
-  if (process.env.TERM) {
-    const term = process.env.TERM;
-    if (term.includes("alacritty"))
-      return "alacritty";
-    if (term.includes("rxvt"))
-      return "rxvt";
-    if (term.includes("termite"))
-      return "termite";
-    return process.env.TERM;
-  }
-  if (!process.stdout.isTTY)
-    return "non-interactive";
-  return null;
+  const colonIndex = url3.indexOf(":");
+  const atIndex = url3.indexOf("@");
+  if (colonIndex >= 0 && atIndex > colonIndex)
+    return true;
+  const host = url3.match(/^(?:[^@]+@)?([^:]+):/)?.[1];
+  return host ? hasSuspiciousHostChars(host) : false;
 }
-function isSSHSession() {
-  return !!(process.env.SSH_CONNECTION || process.env.SSH_CLIENT || process.env.SSH_TTY);
+function normalizeGithubAwareHost(raw) {
+  const host = normalizeHostname(raw);
+  return isGitHubHost(host) ? GITHUB_HOST : host;
 }
-function getHostPlatformForAnalytics() {
-  const override = process.env.CLAUDE_CODE_HOST_PLATFORM;
-  if (override === "win32" || override === "darwin" || override === "linux") {
-    return override;
-  }
-  return env4.platform;
+function normalizeGithubHostForUrl(raw) {
+  const host = normalizeGithubAwareHost(raw);
+  return host === GITHUB_SSH_HOST ? GITHUB_HOST : host;
 }
-var getGlobalClaudeFile, hasInternetAccess, detectPackageManagers, detectRuntimes, isWslEnvironment, isNpmFromWindowsPath, JETBRAINS_IDES, detectDeploymentEnvironment, env4;
-var init_env = __esm(() => {
-  init_memoize();
-  init_oauth();
-  init_envUtils();
-  init_findExecutable();
-  init_fsOperations();
-  init_which();
-  getGlobalClaudeFile = memoize_default(() => {
-    if (getFsImplementation().existsSync(join17(getClaudeConfigHomeDir(), ".config.json"))) {
-      return join17(getClaudeConfigHomeDir(), ".config.json");
+function normalizePathSegments(path9) {
+  const segments = [];
+  for (const segment of path9.split("/")) {
+    if (segment === ".")
+      continue;
+    if (segment === "..") {
+      segments.pop();
+      continue;
     }
-    const filename = `.claude${fileSuffixForOauthConfig()}.json`;
-    const p = join17(process.env.CLAUDE_CONFIG_DIR || homedir8(), filename);
-    return p;
-  });
-  hasInternetAccess = memoize_default(async () => {
+    segments.push(segment);
+  }
+  return segments.filter((segment) => segment !== "").join("/");
+}
+function stripDotGitSuffix(path9) {
+  let length = path9.length;
+  for (;; ) {
+    let end = length;
+    while (end > 0 && path9.charCodeAt(end - 1) === 47)
+      end--;
+    if (end >= 4 && path9.startsWith(".git", end - 4))
+      end -= 4;
+    if (end === length)
+      return length === path9.length ? path9 : path9.slice(0, length);
+    length = end;
+  }
+}
+function normalizeUrlForComparison(raw, options) {
+  if (raw.includes("://")) {
     try {
-      const { default: axiosClient } = await Promise.resolve().then(() => (init_axios2(), exports_axios));
-      await axiosClient.head("http://1.1.1.1", {
-        signal: AbortSignal.timeout(1000)
-      });
-      return true;
+      const parsed = new URL(raw);
+      parsed.hostname = normalizeGithubHostForUrl(parsed.hostname);
+      parsed.username = "";
+      parsed.password = "";
+      parsed.search = "";
+      parsed.hash = "";
+      try {
+        parsed.pathname = decodeURIComponent(parsed.pathname);
+      } catch {}
+      const normalized = normalizePathSegments(parsed.pathname);
+      parsed.pathname = options?.stripDotGit ? stripDotGitSuffix(normalized) : normalized;
+      return parsed.toString();
     } catch {
-      return false;
+      return raw;
     }
-  });
-  detectPackageManagers = memoize_default(async () => {
-    const packageManagers = [];
-    if (await isCommandAvailable("npm"))
-      packageManagers.push("npm");
-    if (await isCommandAvailable("yarn"))
-      packageManagers.push("yarn");
-    if (await isCommandAvailable("pnpm"))
-      packageManagers.push("pnpm");
-    return packageManagers;
-  });
-  detectRuntimes = memoize_default(async () => {
-    const runtimes = [];
-    if (await isCommandAvailable("bun"))
-      runtimes.push("bun");
-    if (await isCommandAvailable("deno"))
-      runtimes.push("deno");
-    if (await isCommandAvailable("node"))
-      runtimes.push("node");
-    return runtimes;
-  });
-  isWslEnvironment = memoize_default(() => {
+  }
+  const scpLike = raw.match(/^[^@]+@([^:]+)(:.*)$/s);
+  return scpLike ? `${normalizeGithubHostForUrl(scpLike[1] ?? "")}${scpLike[2]}` : raw;
+}
+function parseScpLikeGitUrl(raw) {
+  const match = SCP_LIKE_GIT_URL_PATTERN.exec(raw);
+  return match ? { user: match[1], host: match[2], path: match[3] } : null;
+}
+function normalizeGitUrl(raw) {
+  if (isSuspiciousGitUrl(raw))
+    return raw;
+  if (raw.includes("://")) {
     try {
-      return getFsImplementation().existsSync("/proc/sys/fs/binfmt_misc/WSLInterop");
-    } catch (_error) {
-      return false;
+      const parsed = new URL(raw);
+      parsed.hostname = normalizeGithubAwareHost(parsed.hostname);
+      if (CREDENTIAL_STRIP_PROTOCOLS.has(parsed.protocol) || isGitHubHost(parsed.hostname)) {
+        parsed.username = "";
+        parsed.password = "";
+      }
+      return parsed.toString();
+    } catch {
+      return raw;
     }
-  });
-  isNpmFromWindowsPath = memoize_default(() => {
+  }
+  const scpLike = parseScpLikeGitUrl(raw);
+  if (!scpLike)
+    return raw;
+  const host = scpLike.host.toLowerCase().replace(/\.+$/, "");
+  return isGitHubHost(host) ? `${GITHUB_HOST}:${scpLike.path}` : `${scpLike.user}@${host}:${scpLike.path}`;
+}
+function gitUrlHasWildcard(url3) {
+  if (url3.includes("://")) {
+    if (hasBackslashSmuggling(url3))
+      return false;
+    let hostname3;
     try {
-      if (!isWslEnvironment()) {
-        return false;
-      }
-      const { cmd } = findExecutable2("npm", []);
-      return cmd.startsWith("/mnt/c/");
-    } catch (_error) {
+      hostname3 = new URL(url3).hostname;
+    } catch {
       return false;
     }
-  });
-  JETBRAINS_IDES = [
-    "pycharm",
-    "intellij",
-    "webstorm",
-    "phpstorm",
-    "rubymine",
-    "clion",
-    "goland",
-    "rider",
-    "datagrip",
-    "appcode",
-    "dataspell",
-    "aqua",
-    "gateway",
-    "fleet",
-    "jetbrains",
-    "androidstudio"
-  ];
-  detectDeploymentEnvironment = memoize_default(() => {
-    if (isEnvTruthy(process.env.CODESPACES))
-      return "codespaces";
-    if (process.env.GITPOD_WORKSPACE_ID)
-      return "gitpod";
-    if (process.env.REPL_ID || process.env.REPL_SLUG)
-      return "replit";
-    if (process.env.PROJECT_DOMAIN)
-      return "glitch";
-    if (isEnvTruthy(process.env.VERCEL))
-      return "vercel";
-    if (process.env.RAILWAY_ENVIRONMENT_NAME || process.env.RAILWAY_SERVICE_NAME) {
-      return "railway";
-    }
-    if (isEnvTruthy(process.env.RENDER))
-      return "render";
-    if (isEnvTruthy(process.env.NETLIFY))
-      return "netlify";
-    if (process.env.DYNO)
-      return "heroku";
-    if (process.env.FLY_APP_NAME || process.env.FLY_MACHINE_ID)
-      return "fly.io";
-    if (isEnvTruthy(process.env.CF_PAGES))
-      return "cloudflare-pages";
-    if (process.env.DENO_DEPLOYMENT_ID)
-      return "deno-deploy";
-    if (process.env.AWS_LAMBDA_FUNCTION_NAME)
-      return "aws-lambda";
-    if (process.env.AWS_EXECUTION_ENV === "AWS_ECS_FARGATE")
-      return "aws-fargate";
-    if (process.env.AWS_EXECUTION_ENV === "AWS_ECS_EC2")
-      return "aws-ecs";
+    if (!isGitHubOrSshGitHubHost(hostname3))
+      return false;
+    if (normalizeUrlForComparison(url3, { stripDotGit: true }).includes("*"))
+      return true;
+    const normalized = normalizeGitUrl(url3);
     try {
-      const uuid3 = getFsImplementation().readFileSync("/sys/hypervisor/uuid", { encoding: "utf8" }).trim().toLowerCase();
-      if (uuid3.startsWith("ec2"))
-        return "aws-ec2";
-    } catch {}
-    if (process.env.K_SERVICE)
-      return "gcp-cloud-run";
-    if (process.env.GOOGLE_CLOUD_PROJECT)
-      return "gcp";
-    if (process.env.WEBSITE_SITE_NAME || process.env.WEBSITE_SKU)
-      return "azure-app-service";
-    if (process.env.AZURE_FUNCTIONS_ENVIRONMENT)
-      return "azure-functions";
-    if (process.env.APP_URL?.includes("ondigitalocean.app")) {
-      return "digitalocean-app-platform";
+      const parsed = new URL(normalized);
+      return parsed.hostname.includes("*") || parsed.pathname.includes("*");
+    } catch {
+      return normalized.includes("*");
     }
-    if (process.env.SPACE_CREATOR_USER_ID)
-      return "huggingface-spaces";
-    if (isEnvTruthy(process.env.GITHUB_ACTIONS))
-      return "github-actions";
-    if (isEnvTruthy(process.env.GITLAB_CI))
-      return "gitlab-ci";
-    if (process.env.CIRCLECI)
-      return "circleci";
-    if (process.env.BUILDKITE)
-      return "buildkite";
-    if (isEnvTruthy(process.env.CI))
-      return "ci";
-    if (process.env.KUBERNETES_SERVICE_HOST)
-      return "kubernetes";
-    try {
-      if (getFsImplementation().existsSync("/.dockerenv"))
-        return "docker";
-    } catch {}
-    if (env4.platform === "darwin")
-      return "unknown-darwin";
-    if (env4.platform === "linux")
-      return "unknown-linux";
-    if (env4.platform === "win32")
-      return "unknown-win32";
-    return "unknown";
-  });
-  env4 = {
-    hasInternetAccess,
-    isCI: isEnvTruthy(process.env.CI),
-    platform: ["win32", "darwin"].includes(process.platform) ? process.platform : "linux",
-    arch: process.arch,
-    nodeVersion: process.version,
-    terminal: detectTerminal(),
-    isSSH: isSSHSession,
-    getPackageManagers: detectPackageManagers,
-    getRuntimes: detectRuntimes,
-    isRunningWithBun: memoize_default(isRunningWithBun),
-    isWslEnvironment,
-    isNpmFromWindowsPath,
-    isConductor,
-    detectDeploymentEnvironment
-  };
-});
-
-// src/constants/figures.ts
-var BLACK_CIRCLE, BULLET_OPERATOR = "\u2219", TEARDROP_ASTERISK = "\u273B", UP_ARROW = "\u2191", DOWN_ARROW = "\u2193", LIGHTNING_BOLT = "\u21AF", EFFORT_LOW = "\u25CB", EFFORT_MEDIUM = "\u25D0", EFFORT_HIGH = "\u25CF", EFFORT_XHIGH = "\u25C9", EFFORT_MAX = "\u25C8", PAUSE_ICON = "\u23F8", REFRESH_ARROW = "\u21BB", CHANNEL_ARROW = "\u2190", DIAMOND_OPEN = "\u25C7", DIAMOND_FILLED = "\u25C6", REFERENCE_MARK = "\u203B", BLOCKQUOTE_BAR = "\u258E", BRIDGE_SPINNER_FRAMES, BRIDGE_READY_INDICATOR = "\xB7\u2714\uFE0E\xB7", BRIDGE_FAILED_INDICATOR = "\xD7";
-var init_figures2 = __esm(() => {
-  init_env();
-  BLACK_CIRCLE = env4.platform === "darwin" ? "\u23FA" : "\u25CF";
-  BRIDGE_SPINNER_FRAMES = [
-    "\xB7|\xB7",
-    "\xB7/\xB7",
-    "\xB7\u2014\xB7",
-    "\xB7\\\xB7"
-  ];
-});
-
-// src/types/permissions.ts
-var exports_permissions = {};
-__export(exports_permissions, {
-  PERMISSION_MODES_CLI_CHOICES: () => PERMISSION_MODES_CLI_CHOICES,
-  PERMISSION_MODES: () => PERMISSION_MODES,
-  INTERNAL_PERMISSION_MODES: () => INTERNAL_PERMISSION_MODES,
-  EXTERNAL_PERMISSION_MODES: () => EXTERNAL_PERMISSION_MODES
-});
-var EXTERNAL_PERMISSION_MODES, INTERNAL_PERMISSION_MODES, PERMISSION_MODES, PERMISSION_MODES_CLI_CHOICES;
-var init_permissions = __esm(() => {
-  EXTERNAL_PERMISSION_MODES = [
-    "acceptEdits",
-    "auto",
-    "bypassPermissions",
-    "default",
-    "dontAsk",
-    "plan"
-  ];
-  INTERNAL_PERMISSION_MODES = [
-    ...EXTERNAL_PERMISSION_MODES
-  ];
-  PERMISSION_MODES = INTERNAL_PERMISSION_MODES;
-  PERMISSION_MODES_CLI_CHOICES = PERMISSION_MODES.map((mode) => mode === "default" ? "manual" : mode);
-});
-
-// src/utils/permissions/PermissionMode.ts
-function isExternalPermissionMode(mode) {
-  if (process.env.USER_TYPE !== "ant") {
-    return true;
   }
-  return mode !== "auto" && mode !== "bubble";
-}
-function getModeConfig(mode) {
-  return PERMISSION_MODE_CONFIG[mode] ?? PERMISSION_MODE_CONFIG.default;
-}
-function toExternalPermissionMode(mode) {
-  return getModeConfig(mode).external;
-}
-function normalizePermissionModeInput(str) {
-  return str === PERMISSION_MODE_MANUAL_ALIAS ? "default" : str;
-}
-function permissionModeFromString(str) {
-  const normalized = normalizePermissionModeInput(str);
-  return PERMISSION_MODES.includes(normalized) ? normalized : "default";
-}
-function permissionModeTitle(mode) {
-  return getModeConfig(mode).title;
+  const match = url3.match(SCP_LIKE_HOST_PATTERN);
+  const host = match?.[1];
+  const path9 = match?.[2];
+  if (!host || path9 === undefined || !isGitHubOrSshGitHubHost(host))
+    return false;
+  let decoded = path9;
+  try {
+    decoded = decodeURIComponent(path9);
+  } catch {}
+  return decoded.includes("*");
 }
-function isDefaultMode(mode) {
-  return mode === "default" || mode === undefined;
+function regexCompiles(pattern) {
+  try {
+    new RegExp(pattern);
+    return true;
+  } catch {
+    return false;
+  }
 }
-function permissionModeSymbol(mode) {
-  return getModeConfig(mode).symbol;
+function isValidWildcardOwner(owner) {
+  return OWNER_CHARS_PATTERN.test(owner) && !owner.startsWith("-") && owner !== "." && owner !== "..";
 }
-function permissionModeIndicator(mode) {
-  return getModeConfig(mode).indicator;
+function parseGitHubOwnerWildcard(repo) {
+  if (!repo.endsWith("/*"))
+    return null;
+  const owner = repo.slice(0, -2);
+  return isValidWildcardOwner(owner) ? owner : null;
 }
-function getModeColor(mode) {
-  return getModeConfig(mode).color;
+function checkMarketplaceEntryEnforceability(entry) {
+  const pattern = entry.source === "hostPattern" ? entry.hostPattern : entry.source === "pathPattern" ? entry.pathPattern : null;
+  if (pattern !== null && !regexCompiles(pattern))
+    return `${entry.source}: regex does not compile; the entry cannot be enforced`;
+  if (entry.source === "github" && entry.repo.includes("*") && parseGitHubOwnerWildcard(entry.repo) === null)
+    return 'github: an owner wildcard must be exactly "<owner>/*"; the entry cannot be enforced';
+  if (entry.source === "git" && gitUrlHasWildcard(entry.url))
+    return 'git: wildcards are only supported in github-form entries, as "<owner>/*"; the entry cannot be enforced';
+  if ((entry.source === "github" || entry.source === "git") && entry.ref !== undefined && entry.ref.includes("*"))
+    return `${entry.source}: ref contains "*", which git does not allow in ref names; the entry cannot be enforced`;
+  return null;
 }
-var permissionModeSchema, externalPermissionModeSchema, PERMISSION_MODE_MANUAL_ALIAS = "manual", PERMISSION_MODE_CONFIG;
-var init_PermissionMode = __esm(() => {
-  init_featureFlags();
-  init_v4();
-  init_figures2();
-  init_permissions();
-  permissionModeSchema = lazySchema(() => v4_default.enum(PERMISSION_MODES));
-  externalPermissionModeSchema = lazySchema(() => v4_default.enum(EXTERNAL_PERMISSION_MODES));
-  PERMISSION_MODE_CONFIG = {
-    default: {
-      title: "Manual",
-      shortTitle: "Manual",
-      symbol: PAUSE_ICON,
-      color: "text",
-      external: "default",
-      indicator: "manual mode"
-    },
-    plan: {
-      title: "Plan Mode",
-      shortTitle: "Plan",
-      symbol: PAUSE_ICON,
-      color: "planMode",
-      external: "plan",
-      indicator: "plan mode"
-    },
-    acceptEdits: {
-      title: "Accept edits",
-      shortTitle: "Accept",
-      symbol: "\u23F5\u23F5",
-      color: "autoAccept",
-      external: "acceptEdits",
-      indicator: "accept edits"
-    },
-    bypassPermissions: {
-      title: "Bypass Permissions",
-      shortTitle: "Bypass",
-      symbol: "\u23F5\u23F5",
-      color: "error",
-      external: "bypassPermissions",
-      indicator: "bypass permissions"
-    },
-    dontAsk: {
-      title: "Don't Ask",
-      shortTitle: "DontAsk",
-      symbol: "\u23F5\u23F5",
-      color: "error",
-      external: "dontAsk",
-      indicator: "don't ask"
-    },
-    ...feature("TRANSCRIPT_CLASSIFIER") ? {
-      auto: {
-        title: "Auto mode",
-        shortTitle: "Auto",
-        symbol: "\u23F5\u23F5",
-        color: "warning",
-        external: "default",
-        indicator: "auto mode"
-      }
-    } : {}
-  };
+var GITHUB_HOST = "github.com", GITHUB_SSH_HOST = "ssh.github.com", INVALID_HOST_CHARS, URL_LIKE_PROTOCOLS, CREDENTIAL_STRIP_PROTOCOLS, OWNER_CHARS_PATTERN, SCP_LIKE_GIT_URL_PATTERN, SCP_LIKE_HOST_PATTERN, HOST_NORMALIZE_CACHE_LIMIT = 50, hostNormalizeCache;
+var init_marketplacePolicyValidation = __esm(() => {
+  INVALID_HOST_CHARS = /[:/\\?#@\s]/;
+  URL_LIKE_PROTOCOLS = new Set(["http", "https", "ws", "wss", "ftp"]);
+  CREDENTIAL_STRIP_PROTOCOLS = new Set([
+    "http:",
+    "https:",
+    "git:",
+    "git+http:",
+    "git+https:"
+  ]);
+  OWNER_CHARS_PATTERN = /^[A-Za-z0-9._-]+$/;
+  SCP_LIKE_GIT_URL_PATTERN = /^([^@:/[\]]+)@([^@:/[\]]+):(.*)$/s;
+  SCP_LIKE_HOST_PATTERN = /^(?:[^@]+@)?([^@:/]+):(.*)$/s;
+  hostNormalizeCache = new Map;
 });
 
 // src/entrypoints/agentSdkTypes.js
@@ -58282,6 +58032,12 @@ var init_agentSdkTypes = __esm(() => {
   ];
 });
 
+// src/utils/lazySchema.ts
+function lazySchema(factory2) {
+  let cached2;
+  return () => cached2 ??= factory2();
+}
+
 // src/utils/shell/shellProvider.ts
 var SHELL_TYPES, DEFAULT_HOOK_SHELL = "bash";
 var init_shellProvider = __esm(() => {
@@ -58906,6 +58662,317 @@ var init_schemas3 = __esm(() => {
   KnownMarketplacesFileSchema = lazySchema(() => exports_external.record(exports_external.string(), KnownMarketplaceSchema()));
 });
 
+// src/utils/settings/sanitizeWarningText.ts
+function sanitizeForWarningText(text) {
+  return text.replace(C0_CONTROL_CHARS_RE, "");
+}
+var C0_CONTROL_CHARS_RE;
+var init_sanitizeWarningText = __esm(() => {
+  C0_CONTROL_CHARS_RE = /[\u0000-\u001f]/g;
+});
+
+// src/utils/settings/marketplacePolicySanitizer.ts
+function firstIssueDetail(issues) {
+  for (const issue2 of issues) {
+    const prefix = issue2.path.length > 0 ? `${issue2.path.map(String).join(".")}: ` : "";
+    if (issue2.code === "invalid_union") {
+      for (const branch of issue2.errors) {
+        const detail = firstIssueDetail(branch);
+        if (detail !== null)
+          return `${prefix}${detail}`;
+      }
+      const noted = issue2;
+      if (typeof noted.note === "string" && noted.note !== "")
+        return `${prefix}${noted.note}`;
+    }
+    if (issue2.message !== "")
+      return `${prefix}${issue2.message}`;
+  }
+  return null;
+}
+function sanitizeMarketplacePolicy(data, filePath) {
+  if (!data || typeof data !== "object")
+    return [];
+  const obj = data;
+  const warnings = [];
+  for (const key of POLICY_KEYS) {
+    if (!(key in obj))
+      continue;
+    const raw = obj[key];
+    if (raw === null) {
+      delete obj[key];
+      continue;
+    }
+    if (!Array.isArray(raw)) {
+      if (key === "strictKnownMarketplaces") {
+        obj[key] = [];
+      } else {
+        delete obj[key];
+      }
+      warnings.push({
+        file: filePath,
+        path: key,
+        message: key === "strictKnownMarketplaces" ? STRICT_PRESENT_INVALID_MESSAGE : BLOCKED_PRESENT_INVALID_MESSAGE,
+        invalidValue: raw
+      });
+      continue;
+    }
+    const kept = [];
+    for (const [index2, entry] of raw.entries()) {
+      const parsed = MarketplaceSourceSchema().safeParse(entry);
+      if (!parsed.success) {
+        warnings.push({
+          file: filePath,
+          path: `${key}[${index2}]`,
+          message: `Invalid entry was ignored: ${sanitizeForWarningText(firstIssueDetail(parsed.error.issues) ?? "failed validation")}`,
+          invalidValue: entry
+        });
+        continue;
+      }
+      const problem = checkMarketplaceEntryEnforceability(parsed.data);
+      if (problem === null) {
+        kept.push(parsed.data);
+        continue;
+      }
+      if (key === "blockedMarketplaces") {
+        kept.push(parsed.data);
+        warnings.push({
+          file: filePath,
+          path: `${key}[${index2}]`,
+          message: `Unenforceable entry was kept: ${sanitizeForWarningText(problem)}; it can never match a marketplace source, but marketplace restrictions stay active`,
+          invalidValue: entry
+        });
+      } else {
+        warnings.push({
+          file: filePath,
+          path: `${key}[${index2}]`,
+          message: `Invalid entry was ignored: ${sanitizeForWarningText(problem)}`,
+          invalidValue: entry
+        });
+      }
+    }
+    obj[key] = kept;
+  }
+  return warnings;
+}
+var POLICY_KEYS, STRICT_PRESENT_INVALID_MESSAGE = '"strictKnownMarketplaces" was present but invalid; enforcing an empty allowlist (no marketplaces admitted) until it is fixed.', BLOCKED_PRESENT_INVALID_MESSAGE = '"blockedMarketplaces" was present but invalid and was dropped; its entries cannot be enforced until it is fixed.';
+var init_marketplacePolicySanitizer = __esm(() => {
+  init_marketplacePolicyValidation();
+  init_schemas3();
+  init_sanitizeWarningText();
+  POLICY_KEYS = ["strictKnownMarketplaces", "blockedMarketplaces"];
+});
+
+// src/utils/settings/sanitizeAllowlists.ts
+function issueDetail(error49) {
+  const issue2 = error49.issues[0];
+  if (issue2 === undefined)
+    return "failed validation";
+  return issue2.path.length > 0 ? `${issue2.path.join(".")}: ${issue2.message}` : issue2.message;
+}
+function validateAllowlistEntry(key, entry) {
+  if (key === "allowedChannelPlugins") {
+    if (typeof entry === "string") {
+      const at = entry.indexOf("@");
+      const plugin = entry.slice(0, at);
+      const marketplace = entry.slice(at + 1);
+      if (at > 0 && marketplace.length > 0) {
+        return {
+          ok: true,
+          value: { marketplace, plugin },
+          notice: `"allowedChannelPlugins" entry "${sanitizeForWarningText(entry)}" was accepted; prefer the documented object form {"plugin": "${sanitizeForWarningText(plugin)}", "marketplace": "${sanitizeForWarningText(marketplace)}"}.`
+        };
+      }
+    }
+    const parsed2 = CHANNEL_PLUGIN_ENTRY.safeParse(entry);
+    return parsed2.success ? { ok: true, value: parsed2.data } : { ok: false, detail: issueDetail(parsed2.error) };
+  }
+  const parsed = STRING_ENTRY.safeParse(entry);
+  return parsed.success ? { ok: true, value: parsed.data } : { ok: false, detail: issueDetail(parsed.error) };
+}
+function sanitizeSecurityAllowlists(data, filePath) {
+  if (!data || typeof data !== "object")
+    return [];
+  const obj = data;
+  const warnings = [];
+  for (const { key, emptyReason } of ALLOWLIST_SPECS) {
+    if (!(key in obj))
+      continue;
+    const raw = obj[key];
+    if (!Array.isArray(raw)) {
+      obj[key] = [];
+      warnings.push({
+        file: filePath,
+        path: key,
+        message: `"${key}" was present but invalid; enforcing an empty allowlist (${emptyReason}) until it is fixed.`,
+        invalidValue: raw
+      });
+      continue;
+    }
+    const valid = [];
+    for (const [index2, entry] of raw.entries()) {
+      const result = validateAllowlistEntry(key, entry);
+      if (result.ok) {
+        valid.push(result.value);
+        if (result.notice !== undefined) {
+          warnings.push({
+            file: filePath,
+            path: `${key}[${index2}]`,
+            message: result.notice
+          });
+        }
+      } else {
+        warnings.push({
+          file: filePath,
+          path: `${key}[${index2}]`,
+          message: `Invalid entry was ignored: ${sanitizeForWarningText(result.detail)}`,
+          invalidValue: entry
+        });
+      }
+    }
+    if (raw.length > 0 && valid.length === 0) {
+      warnings.push({
+        file: filePath,
+        path: key,
+        message: `Every entry of "${key}" was invalid; enforcing an empty allowlist (${emptyReason}) until it is fixed.`
+      });
+    }
+    obj[key] = valid;
+  }
+  return warnings;
+}
+var STRING_ENTRY, CHANNEL_PLUGIN_ENTRY, ALLOWLIST_SPECS;
+var init_sanitizeAllowlists = __esm(() => {
+  init_v4();
+  init_sanitizeWarningText();
+  STRING_ENTRY = exports_external.string();
+  CHANNEL_PLUGIN_ENTRY = exports_external.object({
+    marketplace: exports_external.string(),
+    plugin: exports_external.string()
+  });
+  ALLOWLIST_SPECS = [
+    { key: "allowedHttpHookUrls", emptyReason: "no HTTP hooks may run" },
+    {
+      key: "httpHookAllowedEnvVars",
+      emptyReason: "no environment variables may be interpolated into HTTP hook headers"
+    },
+    { key: "allowedChannelPlugins", emptyReason: "no channel plugins admitted" }
+  ];
+});
+
+// src/utils/stringUtils.ts
+function escapeRegExp(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function capitalize(str) {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+function plural(n2, word, pluralWord = word + "s") {
+  return n2 === 1 ? word : pluralWord;
+}
+function firstLineOf(s) {
+  const nl = s.indexOf(`
+`);
+  return nl === -1 ? s : s.slice(0, nl);
+}
+function countCharInString(str, char, start = 0) {
+  let count3 = 0;
+  let i2 = str.indexOf(char, start);
+  while (i2 !== -1) {
+    count3++;
+    i2 = str.indexOf(char, i2 + 1);
+  }
+  return count3;
+}
+function normalizeFullWidthDigits(input) {
+  return input.replace(/[\uFF10-\uFF19]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) - 65248));
+}
+function normalizeFullWidthSpace(input) {
+  return input.replace(/\u3000/g, " ");
+}
+function safeJoinLines(lines, delimiter = ",", maxSize = MAX_STRING_LENGTH) {
+  const truncationMarker = "...[truncated]";
+  let result = "";
+  for (const line of lines) {
+    const delimiterToAdd = result ? delimiter : "";
+    const fullAddition = delimiterToAdd + line;
+    if (result.length + fullAddition.length <= maxSize) {
+      result += fullAddition;
+    } else {
+      const remainingSpace = maxSize - result.length - delimiterToAdd.length - truncationMarker.length;
+      if (remainingSpace > 0) {
+        result += delimiterToAdd + line.slice(0, remainingSpace) + truncationMarker;
+      } else {
+        result += truncationMarker;
+      }
+      return result;
+    }
+  }
+  return result;
+}
+
+class EndTruncatingAccumulator {
+  maxSize;
+  content = "";
+  isTruncated = false;
+  totalBytesReceived = 0;
+  constructor(maxSize = MAX_STRING_LENGTH) {
+    this.maxSize = maxSize;
+  }
+  append(data) {
+    const str = typeof data === "string" ? data : data.toString();
+    this.totalBytesReceived += str.length;
+    if (this.isTruncated && this.content.length >= this.maxSize) {
+      return;
+    }
+    if (this.content.length + str.length > this.maxSize) {
+      const remainingSpace = this.maxSize - this.content.length;
+      if (remainingSpace > 0) {
+        this.content += str.slice(0, remainingSpace);
+      }
+      this.isTruncated = true;
+    } else {
+      this.content += str;
+    }
+  }
+  toString() {
+    if (!this.isTruncated) {
+      return this.content;
+    }
+    const truncatedBytes = this.totalBytesReceived - this.maxSize;
+    const truncatedKB = Math.round(truncatedBytes / 1024);
+    return this.content + `
+... [output truncated - ${truncatedKB}KB removed]`;
+  }
+  clear() {
+    this.content = "";
+    this.isTruncated = false;
+    this.totalBytesReceived = 0;
+  }
+  get length() {
+    return this.content.length;
+  }
+  get truncated() {
+    return this.isTruncated;
+  }
+  get totalBytes() {
+    return this.totalBytesReceived;
+  }
+}
+function truncateToLines(text, maxLines) {
+  const lines = text.split(`
+`);
+  if (lines.length <= maxLines) {
+    return text;
+  }
+  return lines.slice(0, maxLines).join(`
+`) + "\u2026";
+}
+var MAX_STRING_LENGTH;
+var init_stringUtils = __esm(() => {
+  MAX_STRING_LENGTH = 2 ** 25;
+});
+
 // src/services/mcp/normalization.ts
 function normalizeNameForMCP(name) {
   let normalized = name.replace(/[^a-zA-Z0-9_-]/g, "_");
@@ -59129,119 +59196,6 @@ var init_permissionRuleParser = __esm(() => {
   };
 });
 
-// src/utils/stringUtils.ts
-function escapeRegExp(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function capitalize(str) {
-  return str.charAt(0).toUpperCase() + str.slice(1);
-}
-function plural(n2, word, pluralWord = word + "s") {
-  return n2 === 1 ? word : pluralWord;
-}
-function firstLineOf(s) {
-  const nl = s.indexOf(`
-`);
-  return nl === -1 ? s : s.slice(0, nl);
-}
-function countCharInString(str, char, start = 0) {
-  let count3 = 0;
-  let i2 = str.indexOf(char, start);
-  while (i2 !== -1) {
-    count3++;
-    i2 = str.indexOf(char, i2 + 1);
-  }
-  return count3;
-}
-function normalizeFullWidthDigits(input) {
-  return input.replace(/[\uFF10-\uFF19]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) - 65248));
-}
-function normalizeFullWidthSpace(input) {
-  return input.replace(/\u3000/g, " ");
-}
-function safeJoinLines(lines, delimiter = ",", maxSize = MAX_STRING_LENGTH) {
-  const truncationMarker = "...[truncated]";
-  let result = "";
-  for (const line of lines) {
-    const delimiterToAdd = result ? delimiter : "";
-    const fullAddition = delimiterToAdd + line;
-    if (result.length + fullAddition.length <= maxSize) {
-      result += fullAddition;
-    } else {
-      const remainingSpace = maxSize - result.length - delimiterToAdd.length - truncationMarker.length;
-      if (remainingSpace > 0) {
-        result += delimiterToAdd + line.slice(0, remainingSpace) + truncationMarker;
-      } else {
-        result += truncationMarker;
-      }
-      return result;
-    }
-  }
-  return result;
-}
-
-class EndTruncatingAccumulator {
-  maxSize;
-  content = "";
-  isTruncated = false;
-  totalBytesReceived = 0;
-  constructor(maxSize = MAX_STRING_LENGTH) {
-    this.maxSize = maxSize;
-  }
-  append(data) {
-    const str = typeof data === "string" ? data : data.toString();
-    this.totalBytesReceived += str.length;
-    if (this.isTruncated && this.content.length >= this.maxSize) {
-      return;
-    }
-    if (this.content.length + str.length > this.maxSize) {
-      const remainingSpace = this.maxSize - this.content.length;
-      if (remainingSpace > 0) {
-        this.content += str.slice(0, remainingSpace);
-      }
-      this.isTruncated = true;
-    } else {
-      this.content += str;
-    }
-  }
-  toString() {
-    if (!this.isTruncated) {
-      return this.content;
-    }
-    const truncatedBytes = this.totalBytesReceived - this.maxSize;
-    const truncatedKB = Math.round(truncatedBytes / 1024);
-    return this.content + `
-... [output truncated - ${truncatedKB}KB removed]`;
-  }
-  clear() {
-    this.content = "";
-    this.isTruncated = false;
-    this.totalBytesReceived = 0;
-  }
-  get length() {
-    return this.content.length;
-  }
-  get truncated() {
-    return this.isTruncated;
-  }
-  get totalBytes() {
-    return this.totalBytesReceived;
-  }
-}
-function truncateToLines(text, maxLines) {
-  const lines = text.split(`
-`);
-  if (lines.length <= maxLines) {
-    return text;
-  }
-  return lines.slice(0, maxLines).join(`
-`) + "\u2026";
-}
-var MAX_STRING_LENGTH;
-var init_stringUtils = __esm(() => {
-  MAX_STRING_LENGTH = 2 ** 25;
-});
-
 // src/utils/settings/toolValidationConfig.ts
 function isFilePatternTool(toolName) {
   return TOOL_VALIDATION_CONFIG.filePatternTools.includes(toolName);
@@ -59528,6 +59482,492 @@ var init_permissionValidation = __esm(() => {
   }));
 });
 
+// src/entrypoints/sandboxTypes.ts
+var SandboxNetworkConfigSchema, SandboxFilesystemConfigSchema, SandboxSettingsSchema;
+var init_sandboxTypes = __esm(() => {
+  init_v4();
+  SandboxNetworkConfigSchema = lazySchema(() => exports_external.object({
+    allowedDomains: exports_external.array(exports_external.string()).optional(),
+    deniedDomains: exports_external.array(exports_external.string()).optional().describe("Domains to block even when a broader allowedDomains wildcard would otherwise permit them."),
+    allowManagedDomainsOnly: exports_external.boolean().optional().describe("When true (and set in managed settings), only allowedDomains and WebFetch(domain:...) allow rules from managed settings are respected. " + "User, project, local, and flag settings domains are ignored. Denied domains are still respected from all sources."),
+    strictAllowlist: exports_external.boolean().optional().describe("When true, the sandbox runtime deterministically denies hosts not in allowedDomains instead of prompting. " + "Enforced for sandboxed commands only \u2014 in-process tools such as WebFetch are not gated by this setting. " + "Only honored from user, managed/policy, or CLI (--settings) settings \u2014 " + "project settings (.claude/settings.json and .claude/settings.local.json) are ignored."),
+    allowUnixSockets: exports_external.array(exports_external.string()).optional().describe("macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path)."),
+    allowAllUnixSockets: exports_external.boolean().optional().describe("If true, allow all Unix sockets (disables blocking on both platforms)."),
+    allowLocalBinding: exports_external.boolean().optional(),
+    httpProxyPort: exports_external.number().optional(),
+    socksProxyPort: exports_external.number().optional()
+  }).optional());
+  SandboxFilesystemConfigSchema = lazySchema(() => exports_external.object({
+    disabled: exports_external.boolean().optional().describe("macOS and Linux/WSL only: skip filesystem isolation entirely while " + "keeping network and seccomp isolation. Ignored on native Windows, " + "where the sandboxed process runs as a separate user with no " + "inherent rights, so skipping the filesystem rules would withhold " + "every access grant rather than loosen them \u2014 filesystem isolation " + "stays on there."),
+    allowWrite: exports_external.array(exports_external.string()).optional().describe("Additional paths to allow writing within the sandbox. " + "Merged with paths from Edit(...) allow permission rules."),
+    denyWrite: exports_external.array(exports_external.string()).optional().describe("Additional paths to deny writing within the sandbox. " + "Merged with paths from Edit(...) deny permission rules."),
+    denyRead: exports_external.array(exports_external.string()).optional().describe("Additional paths to deny reading within the sandbox. " + "Merged with paths from Read(...) deny permission rules."),
+    allowRead: exports_external.array(exports_external.string()).optional().describe("Paths to re-allow reading within denyRead regions. " + "Takes precedence over denyRead for matching paths."),
+    allowManagedReadPathsOnly: exports_external.boolean().optional().describe("When true (set in managed settings), only allowRead paths from policySettings are used.")
+  }).optional());
+  SandboxSettingsSchema = lazySchema(() => exports_external.object({
+    enabled: exports_external.boolean().optional(),
+    failIfUnavailable: exports_external.boolean().optional().describe("Exit with an error at startup if sandbox.enabled is true but the sandbox cannot start " + "(missing dependencies, unsupported platform, or platform not in enabledPlatforms). " + "When false (default), a warning is shown and commands run unsandboxed. " + "Intended for managed-settings deployments that require sandboxing as a hard gate."),
+    autoAllowBashIfSandboxed: exports_external.boolean().optional(),
+    allowUnsandboxedCommands: exports_external.boolean().optional().describe("Allow commands to run outside the sandbox via the dangerouslyDisableSandbox parameter. " + "When false, the dangerouslyDisableSandbox parameter is completely ignored and all commands must run sandboxed. " + "Default: true."),
+    network: SandboxNetworkConfigSchema(),
+    filesystem: SandboxFilesystemConfigSchema(),
+    ignoreViolations: exports_external.record(exports_external.string(), exports_external.array(exports_external.string())).optional(),
+    enableWeakerNestedSandbox: exports_external.boolean().optional(),
+    enableWeakerNetworkIsolation: exports_external.boolean().optional().describe("macOS only: Allow access to com.apple.trustd.agent in the sandbox. " + "Needed for Go-based CLI tools (gh, gcloud, terraform, etc.) to verify TLS certificates " + "when using httpProxyPort with a MITM proxy and custom CA. " + "**Reduces security** \u2014 opens a potential data exfiltration vector through the trustd service. Default: false"),
+    allowAppleEvents: exports_external.boolean().optional().describe("macOS only: Allow sandboxed commands to send Apple Events to other " + "applications via the Apple Event service. Default: false"),
+    excludedCommands: exports_external.array(exports_external.string()).optional(),
+    credentials: exports_external.object({
+      enabled: exports_external.boolean().optional().describe("When true, block sandboxed commands from reading credential files and secret env vars.")
+    }).optional(),
+    ripgrep: exports_external.object({
+      command: exports_external.string(),
+      args: exports_external.array(exports_external.string()).optional()
+    }).optional().describe("Custom ripgrep configuration for bundled ripgrep support")
+  }).passthrough());
+});
+
+// src/utils/bundledMode.ts
+function isRunningWithBun() {
+  return process.versions.bun !== undefined;
+}
+function isInBundledMode() {
+  return typeof Bun !== "undefined" && Array.isArray(Bun.embeddedFiles) && Bun.embeddedFiles.length > 0;
+}
+
+// src/utils/findExecutable.ts
+function findExecutable2(exe, args) {
+  const resolved = whichSync(exe);
+  return { cmd: resolved ?? exe, args };
+}
+var init_findExecutable = __esm(() => {
+  init_which();
+});
+
+// src/utils/env.ts
+import { homedir as homedir8 } from "os";
+import { join as join17 } from "path";
+async function isCommandAvailable(command) {
+  try {
+    return !!await which(command);
+  } catch {
+    return false;
+  }
+}
+function isConductor() {
+  return process.env.__CFBundleIdentifier === "com.conductor.app";
+}
+function detectTerminal() {
+  if (process.env.CURSOR_TRACE_ID)
+    return "cursor";
+  if (process.env.VSCODE_GIT_ASKPASS_MAIN?.includes("cursor")) {
+    return "cursor";
+  }
+  if (process.env.VSCODE_GIT_ASKPASS_MAIN?.includes("windsurf")) {
+    return "windsurf";
+  }
+  if (process.env.VSCODE_GIT_ASKPASS_MAIN?.includes("antigravity")) {
+    return "antigravity";
+  }
+  const bundleId = process.env.__CFBundleIdentifier?.toLowerCase();
+  if (bundleId?.includes("vscodium"))
+    return "codium";
+  if (bundleId?.includes("windsurf"))
+    return "windsurf";
+  if (bundleId?.includes("com.google.android.studio"))
+    return "androidstudio";
+  if (bundleId) {
+    for (const ide of JETBRAINS_IDES) {
+      if (bundleId.includes(ide))
+        return ide;
+    }
+  }
+  if (process.env.VisualStudioVersion) {
+    return "visualstudio";
+  }
+  if (process.env.TERMINAL_EMULATOR === "JetBrains-JediTerm") {
+    if (process.platform === "darwin")
+      return "pycharm";
+    return "pycharm";
+  }
+  if (process.env.TERM === "xterm-ghostty") {
+    return "ghostty";
+  }
+  if (process.env.TERM?.includes("kitty")) {
+    return "kitty";
+  }
+  if (process.env.TERM_PROGRAM) {
+    return process.env.TERM_PROGRAM;
+  }
+  if (process.env.TMUX)
+    return "tmux";
+  if (process.env.STY)
+    return "screen";
+  if (process.env.KONSOLE_VERSION)
+    return "konsole";
+  if (process.env.GNOME_TERMINAL_SERVICE)
+    return "gnome-terminal";
+  if (process.env.XTERM_VERSION)
+    return "xterm";
+  if (process.env.VTE_VERSION)
+    return "vte-based";
+  if (process.env.TERMINATOR_UUID)
+    return "terminator";
+  if (process.env.KITTY_WINDOW_ID) {
+    return "kitty";
+  }
+  if (process.env.ALACRITTY_LOG)
+    return "alacritty";
+  if (process.env.TILIX_ID)
+    return "tilix";
+  if (process.env.WT_SESSION)
+    return "windows-terminal";
+  if (process.env.SESSIONNAME && process.env.TERM === "cygwin")
+    return "cygwin";
+  if (process.env.MSYSTEM)
+    return process.env.MSYSTEM.toLowerCase();
+  if (process.env.ConEmuANSI || process.env.ConEmuPID || process.env.ConEmuTask) {
+    return "conemu";
+  }
+  if (process.env.WSL_DISTRO_NAME)
+    return `wsl-${process.env.WSL_DISTRO_NAME}`;
+  if (isSSHSession()) {
+    return "ssh-session";
+  }
+  if (process.env.TERM) {
+    const term = process.env.TERM;
+    if (term.includes("alacritty"))
+      return "alacritty";
+    if (term.includes("rxvt"))
+      return "rxvt";
+    if (term.includes("termite"))
+      return "termite";
+    return process.env.TERM;
+  }
+  if (!process.stdout.isTTY)
+    return "non-interactive";
+  return null;
+}
+function isSSHSession() {
+  return !!(process.env.SSH_CONNECTION || process.env.SSH_CLIENT || process.env.SSH_TTY);
+}
+function getHostPlatformForAnalytics() {
+  const override = process.env.CLAUDE_CODE_HOST_PLATFORM;
+  if (override === "win32" || override === "darwin" || override === "linux") {
+    return override;
+  }
+  return env4.platform;
+}
+var getGlobalClaudeFile, hasInternetAccess, detectPackageManagers, detectRuntimes, isWslEnvironment, isNpmFromWindowsPath, JETBRAINS_IDES, detectDeploymentEnvironment, env4;
+var init_env = __esm(() => {
+  init_memoize();
+  init_oauth();
+  init_envUtils();
+  init_findExecutable();
+  init_fsOperations();
+  init_which();
+  getGlobalClaudeFile = memoize_default(() => {
+    if (getFsImplementation().existsSync(join17(getClaudeConfigHomeDir(), ".config.json"))) {
+      return join17(getClaudeConfigHomeDir(), ".config.json");
+    }
+    const filename = `.claude${fileSuffixForOauthConfig()}.json`;
+    const p = join17(process.env.CLAUDE_CONFIG_DIR || homedir8(), filename);
+    return p;
+  });
+  hasInternetAccess = memoize_default(async () => {
+    try {
+      const { default: axiosClient } = await Promise.resolve().then(() => (init_axios2(), exports_axios));
+      await axiosClient.head("http://1.1.1.1", {
+        signal: AbortSignal.timeout(1000)
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  });
+  detectPackageManagers = memoize_default(async () => {
+    const packageManagers = [];
+    if (await isCommandAvailable("npm"))
+      packageManagers.push("npm");
+    if (await isCommandAvailable("yarn"))
+      packageManagers.push("yarn");
+    if (await isCommandAvailable("pnpm"))
+      packageManagers.push("pnpm");
+    return packageManagers;
+  });
+  detectRuntimes = memoize_default(async () => {
+    const runtimes = [];
+    if (await isCommandAvailable("bun"))
+      runtimes.push("bun");
+    if (await isCommandAvailable("deno"))
+      runtimes.push("deno");
+    if (await isCommandAvailable("node"))
+      runtimes.push("node");
+    return runtimes;
+  });
+  isWslEnvironment = memoize_default(() => {
+    try {
+      return getFsImplementation().existsSync("/proc/sys/fs/binfmt_misc/WSLInterop");
+    } catch (_error) {
+      return false;
+    }
+  });
+  isNpmFromWindowsPath = memoize_default(() => {
+    try {
+      if (!isWslEnvironment()) {
+        return false;
+      }
+      const { cmd } = findExecutable2("npm", []);
+      return cmd.startsWith("/mnt/c/");
+    } catch (_error) {
+      return false;
+    }
+  });
+  JETBRAINS_IDES = [
+    "pycharm",
+    "intellij",
+    "webstorm",
+    "phpstorm",
+    "rubymine",
+    "clion",
+    "goland",
+    "rider",
+    "datagrip",
+    "appcode",
+    "dataspell",
+    "aqua",
+    "gateway",
+    "fleet",
+    "jetbrains",
+    "androidstudio"
+  ];
+  detectDeploymentEnvironment = memoize_default(() => {
+    if (isEnvTruthy(process.env.CODESPACES))
+      return "codespaces";
+    if (process.env.GITPOD_WORKSPACE_ID)
+      return "gitpod";
+    if (process.env.REPL_ID || process.env.REPL_SLUG)
+      return "replit";
+    if (process.env.PROJECT_DOMAIN)
+      return "glitch";
+    if (isEnvTruthy(process.env.VERCEL))
+      return "vercel";
+    if (process.env.RAILWAY_ENVIRONMENT_NAME || process.env.RAILWAY_SERVICE_NAME) {
+      return "railway";
+    }
+    if (isEnvTruthy(process.env.RENDER))
+      return "render";
+    if (isEnvTruthy(process.env.NETLIFY))
+      return "netlify";
+    if (process.env.DYNO)
+      return "heroku";
+    if (process.env.FLY_APP_NAME || process.env.FLY_MACHINE_ID)
+      return "fly.io";
+    if (isEnvTruthy(process.env.CF_PAGES))
+      return "cloudflare-pages";
+    if (process.env.DENO_DEPLOYMENT_ID)
+      return "deno-deploy";
+    if (process.env.AWS_LAMBDA_FUNCTION_NAME)
+      return "aws-lambda";
+    if (process.env.AWS_EXECUTION_ENV === "AWS_ECS_FARGATE")
+      return "aws-fargate";
+    if (process.env.AWS_EXECUTION_ENV === "AWS_ECS_EC2")
+      return "aws-ecs";
+    try {
+      const uuid3 = getFsImplementation().readFileSync("/sys/hypervisor/uuid", { encoding: "utf8" }).trim().toLowerCase();
+      if (uuid3.startsWith("ec2"))
+        return "aws-ec2";
+    } catch {}
+    if (process.env.K_SERVICE)
+      return "gcp-cloud-run";
+    if (process.env.GOOGLE_CLOUD_PROJECT)
+      return "gcp";
+    if (process.env.WEBSITE_SITE_NAME || process.env.WEBSITE_SKU)
+      return "azure-app-service";
+    if (process.env.AZURE_FUNCTIONS_ENVIRONMENT)
+      return "azure-functions";
+    if (process.env.APP_URL?.includes("ondigitalocean.app")) {
+      return "digitalocean-app-platform";
+    }
+    if (process.env.SPACE_CREATOR_USER_ID)
+      return "huggingface-spaces";
+    if (isEnvTruthy(process.env.GITHUB_ACTIONS))
+      return "github-actions";
+    if (isEnvTruthy(process.env.GITLAB_CI))
+      return "gitlab-ci";
+    if (process.env.CIRCLECI)
+      return "circleci";
+    if (process.env.BUILDKITE)
+      return "buildkite";
+    if (isEnvTruthy(process.env.CI))
+      return "ci";
+    if (process.env.KUBERNETES_SERVICE_HOST)
+      return "kubernetes";
+    try {
+      if (getFsImplementation().existsSync("/.dockerenv"))
+        return "docker";
+    } catch {}
+    if (env4.platform === "darwin")
+      return "unknown-darwin";
+    if (env4.platform === "linux")
+      return "unknown-linux";
+    if (env4.platform === "win32")
+      return "unknown-win32";
+    return "unknown";
+  });
+  env4 = {
+    hasInternetAccess,
+    isCI: isEnvTruthy(process.env.CI),
+    platform: ["win32", "darwin"].includes(process.platform) ? process.platform : "linux",
+    arch: process.arch,
+    nodeVersion: process.version,
+    terminal: detectTerminal(),
+    isSSH: isSSHSession,
+    getPackageManagers: detectPackageManagers,
+    getRuntimes: detectRuntimes,
+    isRunningWithBun: memoize_default(isRunningWithBun),
+    isWslEnvironment,
+    isNpmFromWindowsPath,
+    isConductor,
+    detectDeploymentEnvironment
+  };
+});
+
+// src/constants/figures.ts
+var BLACK_CIRCLE, BULLET_OPERATOR = "\u2219", TEARDROP_ASTERISK = "\u273B", UP_ARROW = "\u2191", DOWN_ARROW = "\u2193", LIGHTNING_BOLT = "\u21AF", EFFORT_LOW = "\u25CB", EFFORT_MEDIUM = "\u25D0", EFFORT_HIGH = "\u25CF", EFFORT_XHIGH = "\u25C9", EFFORT_MAX = "\u25C8", PAUSE_ICON = "\u23F8", REFRESH_ARROW = "\u21BB", CHANNEL_ARROW = "\u2190", DIAMOND_OPEN = "\u25C7", DIAMOND_FILLED = "\u25C6", REFERENCE_MARK = "\u203B", BLOCKQUOTE_BAR = "\u258E", BRIDGE_SPINNER_FRAMES, BRIDGE_READY_INDICATOR = "\xB7\u2714\uFE0E\xB7", BRIDGE_FAILED_INDICATOR = "\xD7";
+var init_figures2 = __esm(() => {
+  init_env();
+  BLACK_CIRCLE = env4.platform === "darwin" ? "\u23FA" : "\u25CF";
+  BRIDGE_SPINNER_FRAMES = [
+    "\xB7|\xB7",
+    "\xB7/\xB7",
+    "\xB7\u2014\xB7",
+    "\xB7\\\xB7"
+  ];
+});
+
+// src/types/permissions.ts
+var exports_permissions = {};
+__export(exports_permissions, {
+  PERMISSION_MODES_CLI_CHOICES: () => PERMISSION_MODES_CLI_CHOICES,
+  PERMISSION_MODES: () => PERMISSION_MODES,
+  INTERNAL_PERMISSION_MODES: () => INTERNAL_PERMISSION_MODES,
+  EXTERNAL_PERMISSION_MODES: () => EXTERNAL_PERMISSION_MODES
+});
+var EXTERNAL_PERMISSION_MODES, INTERNAL_PERMISSION_MODES, PERMISSION_MODES, PERMISSION_MODES_CLI_CHOICES;
+var init_permissions = __esm(() => {
+  EXTERNAL_PERMISSION_MODES = [
+    "acceptEdits",
+    "auto",
+    "bypassPermissions",
+    "default",
+    "dontAsk",
+    "plan"
+  ];
+  INTERNAL_PERMISSION_MODES = [
+    ...EXTERNAL_PERMISSION_MODES
+  ];
+  PERMISSION_MODES = INTERNAL_PERMISSION_MODES;
+  PERMISSION_MODES_CLI_CHOICES = PERMISSION_MODES.map((mode) => mode === "default" ? "manual" : mode);
+});
+
+// src/utils/permissions/PermissionMode.ts
+function isExternalPermissionMode(mode) {
+  if (process.env.USER_TYPE !== "ant") {
+    return true;
+  }
+  return mode !== "auto" && mode !== "bubble";
+}
+function getModeConfig(mode) {
+  return PERMISSION_MODE_CONFIG[mode] ?? PERMISSION_MODE_CONFIG.default;
+}
+function toExternalPermissionMode(mode) {
+  return getModeConfig(mode).external;
+}
+function normalizePermissionModeInput(str) {
+  return str === PERMISSION_MODE_MANUAL_ALIAS ? "default" : str;
+}
+function permissionModeFromString(str) {
+  const normalized = normalizePermissionModeInput(str);
+  return PERMISSION_MODES.includes(normalized) ? normalized : "default";
+}
+function permissionModeTitle(mode) {
+  return getModeConfig(mode).title;
+}
+function isDefaultMode(mode) {
+  return mode === "default" || mode === undefined;
+}
+function permissionModeSymbol(mode) {
+  return getModeConfig(mode).symbol;
+}
+function permissionModeIndicator(mode) {
+  return getModeConfig(mode).indicator;
+}
+function getModeColor(mode) {
+  return getModeConfig(mode).color;
+}
+var permissionModeSchema, externalPermissionModeSchema, PERMISSION_MODE_MANUAL_ALIAS = "manual", PERMISSION_MODE_CONFIG;
+var init_PermissionMode = __esm(() => {
+  init_featureFlags();
+  init_v4();
+  init_figures2();
+  init_permissions();
+  permissionModeSchema = lazySchema(() => v4_default.enum(PERMISSION_MODES));
+  externalPermissionModeSchema = lazySchema(() => v4_default.enum(EXTERNAL_PERMISSION_MODES));
+  PERMISSION_MODE_CONFIG = {
+    default: {
+      title: "Manual",
+      shortTitle: "Manual",
+      symbol: PAUSE_ICON,
+      color: "text",
+      external: "default",
+      indicator: "manual mode"
+    },
+    plan: {
+      title: "Plan Mode",
+      shortTitle: "Plan",
+      symbol: PAUSE_ICON,
+      color: "planMode",
+      external: "plan",
+      indicator: "plan mode"
+    },
+    acceptEdits: {
+      title: "Accept edits",
+      shortTitle: "Accept",
+      symbol: "\u23F5\u23F5",
+      color: "autoAccept",
+      external: "acceptEdits",
+      indicator: "accept edits"
+    },
+    bypassPermissions: {
+      title: "Bypass Permissions",
+      shortTitle: "Bypass",
+      symbol: "\u23F5\u23F5",
+      color: "error",
+      external: "bypassPermissions",
+      indicator: "bypass permissions"
+    },
+    dontAsk: {
+      title: "Don't Ask",
+      shortTitle: "DontAsk",
+      symbol: "\u23F5\u23F5",
+      color: "error",
+      external: "dontAsk",
+      indicator: "don't ask"
+    },
+    ...feature("TRANSCRIPT_CLASSIFIER") ? {
+      auto: {
+        title: "Auto mode",
+        shortTitle: "Auto",
+        symbol: "\u23F5\u23F5",
+        color: "warning",
+        external: "default",
+        indicator: "auto mode"
+      }
+    } : {}
+  };
+});
+
 // src/utils/settings/types.ts
 function isMcpServerNameEntry(entry) {
   return "serverName" in entry && entry.serverName !== undefined;
@@ -60084,11 +60524,11 @@ function filterInvalidPermissionRules(data, filePath) {
       }
       const result = validatePermissionRule(rule);
       if (!result.valid) {
-        let message = `Invalid permission rule "${rule}" was skipped`;
+        let message = `Invalid permission rule "${sanitizeForWarningText(rule)}" was skipped`;
         if (result.error)
-          message += `: ${result.error}`;
+          message += `: ${sanitizeForWarningText(result.error)}`;
         if (result.suggestion)
-          message += `. ${result.suggestion}`;
+          message += `. ${sanitizeForWarningText(result.suggestion)}`;
         warnings.push({
           file: filePath,
           path: `permissions.${key}`,
@@ -60106,11 +60546,26 @@ var init_validation2 = __esm(() => {
   init_slowOperations();
   init_stringUtils();
   init_permissionValidation();
+  init_sanitizeWarningText();
   init_schemaOutput();
   init_types2();
   init_validationTips();
 });
 
+// src/utils/settings/policySourceSanitizer.ts
+function sanitizePolicySourceData(data, sourcePath) {
+  return [
+    ...filterInvalidPermissionRules(data, sourcePath),
+    ...sanitizeSecurityAllowlists(data, sourcePath),
+    ...sanitizeMarketplacePolicy(data, sourcePath)
+  ];
+}
+var init_policySourceSanitizer = __esm(() => {
+  init_marketplacePolicySanitizer();
+  init_sanitizeAllowlists();
+  init_validation2();
+});
+
 // src/utils/settings/mdm/constants.ts
 import { homedir as homedir9, userInfo } from "os";
 import { join as join18 } from "path";
@@ -60259,17 +60714,18 @@ async function refreshMdmSettings() {
   return consumeRawReadResult(raw);
 }
 function parseCommandOutputAsSettings(stdout, sourcePath) {
-  const data = safeParseJSON(stdout, false);
-  if (!data || typeof data !== "object") {
+  const parsed = safeParseJSON(stdout, false);
+  if (!parsed || typeof parsed !== "object") {
     return { settings: {}, errors: [] };
   }
-  const ruleWarnings = filterInvalidPermissionRules(data, sourcePath);
+  const data = clone(parsed);
+  const sanitizeWarnings = sanitizePolicySourceData(data, sourcePath);
   const parseResult = SettingsSchema().safeParse(data);
   if (!parseResult.success) {
     const errors3 = formatZodError(parseResult.error, sourcePath);
-    return { settings: {}, errors: [...ruleWarnings, ...errors3] };
+    return { settings: {}, errors: [...sanitizeWarnings, ...errors3] };
   }
-  return { settings: parseResult.data, errors: ruleWarnings };
+  return { settings: parseResult.data, errors: sanitizeWarnings };
 }
 function parseRegQueryStdout(stdout, valueName = "Settings") {
   const lines = stdout.split(/\r?\n/);
@@ -60346,8 +60802,10 @@ var init_settings = __esm(() => {
   init_fileRead();
   init_fsOperations();
   init_json();
+  init_slowOperations();
   init_startupProfiler();
   init_managedPath();
+  init_policySourceSanitizer();
   init_types2();
   init_validation2();
   init_constants4();
@@ -60355,435 +60813,6 @@ var init_settings = __esm(() => {
   EMPTY_RESULT = Object.freeze({ settings: {}, errors: [] });
 });
 
-// src/utils/plugins/marketplacePolicyValidation.ts
-function stripTrailingDots(host) {
-  let end = host.length;
-  while (end > 0 && host[end - 1] === ".")
-    end--;
-  return host.slice(0, end);
-}
-function normalizeHostname(raw) {
-  const host = stripTrailingDots(raw.replace(/[\t\n\r]/g, "").toLowerCase());
-  if (host === "" || INVALID_HOST_CHARS.test(host))
-    return host;
-  try {
-    const parsed = new URL(`https://${host}`);
-    if (parsed.username !== "" || parsed.password !== "" || parsed.port !== "" || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "")
-      return host;
-    return stripTrailingDots(parsed.hostname);
-  } catch {
-    return host;
-  }
-}
-function normalizeHostForComparison(raw) {
-  const cached2 = hostNormalizeCache.get(raw);
-  if (cached2 !== undefined)
-    return cached2;
-  let host = normalizeHostname(raw);
-  while (host.startsWith("www."))
-    host = host.slice(4);
-  if (hostNormalizeCache.size >= HOST_NORMALIZE_CACHE_LIMIT) {
-    hostNormalizeCache.clear();
-  }
-  hostNormalizeCache.set(raw, host);
-  return host;
-}
-function hostMatches(raw, expected) {
-  return normalizeHostForComparison(raw) === expected;
-}
-function isGitHubHost(raw) {
-  return hostMatches(raw, GITHUB_HOST);
-}
-function isGitHubOrSshGitHubHost(raw) {
-  return isGitHubHost(raw) || normalizeHostname(raw) === GITHUB_SSH_HOST;
-}
-function hasSuspiciousHostChars(value) {
-  return /[%\x00-\x1f\x7f-\u{10FFFF}]/u.test(value);
-}
-function hasBackslashSmuggling(raw) {
-  const url3 = raw.replace(/^[\x00-\x20]+/, "");
-  const schemeEnd = url3.indexOf("://");
-  if (schemeEnd === -1)
-    return false;
-  let rest = url3.slice(schemeEnd + 3);
-  const scheme = url3.slice(0, schemeEnd).toLowerCase();
-  if (URL_LIKE_PROTOCOLS.has(scheme)) {
-    const slashes = rest.match(/^[/\\]+/)?.[0] ?? "";
-    if (slashes.includes("\\"))
-      return true;
-    rest = rest.slice(slashes.length);
-  }
-  const pathStart = rest.search(/[/?#]/);
-  return (pathStart === -1 ? rest : rest.slice(0, pathStart)).includes("\\");
-}
-function isSuspiciousGitUrl(url3) {
-  if (url3.includes("://")) {
-    if (hasBackslashSmuggling(url3))
-      return true;
-    try {
-      const parsed = new URL(url3);
-      if (parsed.protocol === "http:" || parsed.protocol === "https:")
-        return false;
-      return hasSuspiciousHostChars(parsed.hostname);
-    } catch {
-      return true;
-    }
-  }
-  const colonIndex = url3.indexOf(":");
-  const atIndex = url3.indexOf("@");
-  if (colonIndex >= 0 && atIndex > colonIndex)
-    return true;
-  const host = url3.match(/^(?:[^@]+@)?([^:]+):/)?.[1];
-  return host ? hasSuspiciousHostChars(host) : false;
-}
-function normalizeGithubAwareHost(raw) {
-  const host = normalizeHostname(raw);
-  return isGitHubHost(host) ? GITHUB_HOST : host;
-}
-function normalizeGithubHostForUrl(raw) {
-  const host = normalizeGithubAwareHost(raw);
-  return host === GITHUB_SSH_HOST ? GITHUB_HOST : host;
-}
-function normalizePathSegments(path9) {
-  const segments = [];
-  for (const segment of path9.split("/")) {
-    if (segment === ".")
-      continue;
-    if (segment === "..") {
-      segments.pop();
-      continue;
-    }
-    segments.push(segment);
-  }
-  return segments.filter((segment) => segment !== "").join("/");
-}
-function stripDotGitSuffix(path9) {
-  let length = path9.length;
-  for (;; ) {
-    let end = length;
-    while (end > 0 && path9.charCodeAt(end - 1) === 47)
-      end--;
-    if (end >= 4 && path9.startsWith(".git", end - 4))
-      end -= 4;
-    if (end === length)
-      return length === path9.length ? path9 : path9.slice(0, length);
-    length = end;
-  }
-}
-function normalizeUrlForComparison(raw, options) {
-  if (raw.includes("://")) {
-    try {
-      const parsed = new URL(raw);
-      parsed.hostname = normalizeGithubHostForUrl(parsed.hostname);
-      parsed.username = "";
-      parsed.password = "";
-      parsed.search = "";
-      parsed.hash = "";
-      try {
-        parsed.pathname = decodeURIComponent(parsed.pathname);
-      } catch {}
-      const normalized = normalizePathSegments(parsed.pathname);
-      parsed.pathname = options?.stripDotGit ? stripDotGitSuffix(normalized) : normalized;
-      return parsed.toString();
-    } catch {
-      return raw;
-    }
-  }
-  const scpLike = raw.match(/^[^@]+@([^:]+)(:.*)$/s);
-  return scpLike ? `${normalizeGithubHostForUrl(scpLike[1] ?? "")}${scpLike[2]}` : raw;
-}
-function parseScpLikeGitUrl(raw) {
-  const match = SCP_LIKE_GIT_URL_PATTERN.exec(raw);
-  return match ? { user: match[1], host: match[2], path: match[3] } : null;
-}
-function normalizeGitUrl(raw) {
-  if (isSuspiciousGitUrl(raw))
-    return raw;
-  if (raw.includes("://")) {
-    try {
-      const parsed = new URL(raw);
-      parsed.hostname = normalizeGithubAwareHost(parsed.hostname);
-      if (CREDENTIAL_STRIP_PROTOCOLS.has(parsed.protocol) || isGitHubHost(parsed.hostname)) {
-        parsed.username = "";
-        parsed.password = "";
-      }
-      return parsed.toString();
-    } catch {
-      return raw;
-    }
-  }
-  const scpLike = parseScpLikeGitUrl(raw);
-  if (!scpLike)
-    return raw;
-  const host = scpLike.host.toLowerCase().replace(/\.+$/, "");
-  return isGitHubHost(host) ? `${GITHUB_HOST}:${scpLike.path}` : `${scpLike.user}@${host}:${scpLike.path}`;
-}
-function gitUrlHasWildcard(url3) {
-  if (url3.includes("://")) {
-    if (hasBackslashSmuggling(url3))
-      return false;
-    let hostname3;
-    try {
-      hostname3 = new URL(url3).hostname;
-    } catch {
-      return false;
-    }
-    if (!isGitHubOrSshGitHubHost(hostname3))
-      return false;
-    if (normalizeUrlForComparison(url3, { stripDotGit: true }).includes("*"))
-      return true;
-    const normalized = normalizeGitUrl(url3);
-    try {
-      const parsed = new URL(normalized);
-      return parsed.hostname.includes("*") || parsed.pathname.includes("*");
-    } catch {
-      return normalized.includes("*");
-    }
-  }
-  const match = url3.match(SCP_LIKE_HOST_PATTERN);
-  const host = match?.[1];
-  const path9 = match?.[2];
-  if (!host || path9 === undefined || !isGitHubOrSshGitHubHost(host))
-    return false;
-  let decoded = path9;
-  try {
-    decoded = decodeURIComponent(path9);
-  } catch {}
-  return decoded.includes("*");
-}
-function regexCompiles(pattern) {
-  try {
-    new RegExp(pattern);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isValidWildcardOwner(owner) {
-  return OWNER_CHARS_PATTERN.test(owner) && !owner.startsWith("-") && owner !== "." && owner !== "..";
-}
-function parseGitHubOwnerWildcard(repo) {
-  if (!repo.endsWith("/*"))
-    return null;
-  const owner = repo.slice(0, -2);
-  return isValidWildcardOwner(owner) ? owner : null;
-}
-function checkMarketplaceEntryEnforceability(entry) {
-  const pattern = entry.source === "hostPattern" ? entry.hostPattern : entry.source === "pathPattern" ? entry.pathPattern : null;
-  if (pattern !== null && !regexCompiles(pattern))
-    return `${entry.source}: regex does not compile; the entry cannot be enforced`;
-  if (entry.source === "github" && entry.repo.includes("*") && parseGitHubOwnerWildcard(entry.repo) === null)
-    return 'github: an owner wildcard must be exactly "<owner>/*"; the entry cannot be enforced';
-  if (entry.source === "git" && gitUrlHasWildcard(entry.url))
-    return 'git: wildcards are only supported in github-form entries, as "<owner>/*"; the entry cannot be enforced';
-  if ((entry.source === "github" || entry.source === "git") && entry.ref !== undefined && entry.ref.includes("*"))
-    return `${entry.source}: ref contains "*", which git does not allow in ref names; the entry cannot be enforced`;
-  return null;
-}
-var GITHUB_HOST = "github.com", GITHUB_SSH_HOST = "ssh.github.com", INVALID_HOST_CHARS, URL_LIKE_PROTOCOLS, CREDENTIAL_STRIP_PROTOCOLS, OWNER_CHARS_PATTERN, SCP_LIKE_GIT_URL_PATTERN, SCP_LIKE_HOST_PATTERN, HOST_NORMALIZE_CACHE_LIMIT = 50, hostNormalizeCache;
-var init_marketplacePolicyValidation = __esm(() => {
-  INVALID_HOST_CHARS = /[:/\\?#@\s]/;
-  URL_LIKE_PROTOCOLS = new Set(["http", "https", "ws", "wss", "ftp"]);
-  CREDENTIAL_STRIP_PROTOCOLS = new Set([
-    "http:",
-    "https:",
-    "git:",
-    "git+http:",
-    "git+https:"
-  ]);
-  OWNER_CHARS_PATTERN = /^[A-Za-z0-9._-]+$/;
-  SCP_LIKE_GIT_URL_PATTERN = /^([^@:/[\]]+)@([^@:/[\]]+):(.*)$/s;
-  SCP_LIKE_HOST_PATTERN = /^(?:[^@]+@)?([^@:/]+):(.*)$/s;
-  hostNormalizeCache = new Map;
-});
-
-// src/utils/settings/marketplacePolicySanitizer.ts
-function firstIssueDetail(issues) {
-  for (const issue2 of issues) {
-    const prefix = issue2.path.length > 0 ? `${issue2.path.map(String).join(".")}: ` : "";
-    if (issue2.code === "invalid_union") {
-      for (const branch of issue2.errors) {
-        const detail = firstIssueDetail(branch);
-        if (detail !== null)
-          return `${prefix}${detail}`;
-      }
-      const noted = issue2;
-      if (typeof noted.note === "string" && noted.note !== "")
-        return `${prefix}${noted.note}`;
-    }
-    if (issue2.message !== "")
-      return `${prefix}${issue2.message}`;
-  }
-  return null;
-}
-function sanitizeMarketplacePolicy(data, filePath) {
-  if (!data || typeof data !== "object")
-    return [];
-  const obj = data;
-  const warnings = [];
-  for (const key of POLICY_KEYS) {
-    if (!(key in obj))
-      continue;
-    const raw = obj[key];
-    if (raw === null) {
-      delete obj[key];
-      continue;
-    }
-    if (!Array.isArray(raw)) {
-      if (key === "strictKnownMarketplaces") {
-        obj[key] = [];
-      } else {
-        delete obj[key];
-      }
-      warnings.push({
-        file: filePath,
-        path: key,
-        message: key === "strictKnownMarketplaces" ? STRICT_PRESENT_INVALID_MESSAGE : BLOCKED_PRESENT_INVALID_MESSAGE,
-        invalidValue: raw
-      });
-      continue;
-    }
-    const kept = [];
-    for (const [index2, entry] of raw.entries()) {
-      const parsed = MarketplaceSourceSchema().safeParse(entry);
-      if (!parsed.success) {
-        warnings.push({
-          file: filePath,
-          path: `${key}[${index2}]`,
-          message: `Invalid entry was ignored: ${firstIssueDetail(parsed.error.issues) ?? "failed validation"}`,
-          invalidValue: entry
-        });
-        continue;
-      }
-      const problem = checkMarketplaceEntryEnforceability(parsed.data);
-      if (problem === null) {
-        kept.push(parsed.data);
-        continue;
-      }
-      if (key === "blockedMarketplaces") {
-        kept.push(parsed.data);
-        warnings.push({
-          file: filePath,
-          path: `${key}[${index2}]`,
-          message: `Unenforceable entry was kept: ${problem}; it can never match a marketplace source, but marketplace restrictions stay active`,
-          invalidValue: entry
-        });
-      } else {
-        warnings.push({
-          file: filePath,
-          path: `${key}[${index2}]`,
-          message: `Invalid entry was ignored: ${problem}`,
-          invalidValue: entry
-        });
-      }
-    }
-    obj[key] = kept;
-  }
-  return warnings;
-}
-var POLICY_KEYS, STRICT_PRESENT_INVALID_MESSAGE = '"strictKnownMarketplaces" was present but invalid; enforcing an empty allowlist (no marketplaces admitted) until it is fixed.', BLOCKED_PRESENT_INVALID_MESSAGE = '"blockedMarketplaces" was present but invalid and was dropped; its entries cannot be enforced until it is fixed.';
-var init_marketplacePolicySanitizer = __esm(() => {
-  init_marketplacePolicyValidation();
-  init_schemas3();
-  POLICY_KEYS = ["strictKnownMarketplaces", "blockedMarketplaces"];
-});
-
-// src/utils/settings/sanitizeAllowlists.ts
-function issueDetail(error49) {
-  const issue2 = error49.issues[0];
-  if (issue2 === undefined)
-    return "failed validation";
-  return issue2.path.length > 0 ? `${issue2.path.join(".")}: ${issue2.message}` : issue2.message;
-}
-function validateAllowlistEntry(key, entry) {
-  if (key === "allowedChannelPlugins") {
-    if (typeof entry === "string") {
-      const at = entry.indexOf("@");
-      const plugin = entry.slice(0, at);
-      const marketplace = entry.slice(at + 1);
-      if (at > 0 && marketplace.length > 0) {
-        return {
-          ok: true,
-          value: { marketplace, plugin },
-          notice: `"allowedChannelPlugins" entry "${entry}" was accepted; prefer the documented object form {"plugin": "${plugin}", "marketplace": "${marketplace}"}.`
-        };
-      }
-    }
-    const parsed2 = CHANNEL_PLUGIN_ENTRY.safeParse(entry);
-    return parsed2.success ? { ok: true, value: parsed2.data } : { ok: false, detail: issueDetail(parsed2.error) };
-  }
-  const parsed = STRING_ENTRY.safeParse(entry);
-  return parsed.success ? { ok: true, value: parsed.data } : { ok: false, detail: issueDetail(parsed.error) };
-}
-function sanitizeSecurityAllowlists(data, filePath) {
-  if (!data || typeof data !== "object")
-    return [];
-  const obj = data;
-  const warnings = [];
-  for (const { key, emptyReason } of ALLOWLIST_SPECS) {
-    if (!(key in obj))
-      continue;
-    const raw = obj[key];
-    if (!Array.isArray(raw)) {
-      obj[key] = [];
-      warnings.push({
-        file: filePath,
-        path: key,
-        message: `"${key}" was present but invalid; enforcing an empty allowlist (${emptyReason}) until it is fixed.`,
-        invalidValue: raw
-      });
-      continue;
-    }
-    const valid = [];
-    for (const [index2, entry] of raw.entries()) {
-      const result = validateAllowlistEntry(key, entry);
-      if (result.ok) {
-        valid.push(result.value);
-        if (result.notice !== undefined) {
-          warnings.push({
-            file: filePath,
-            path: `${key}[${index2}]`,
-            message: result.notice
-          });
-        }
-      } else {
-        warnings.push({
-          file: filePath,
-          path: `${key}[${index2}]`,
-          message: `Invalid entry was ignored: ${result.detail}`,
-          invalidValue: entry
-        });
-      }
-    }
-    if (raw.length > 0 && valid.length === 0) {
-      warnings.push({
-        file: filePath,
-        path: key,
-        message: `Every entry of "${key}" was invalid; enforcing an empty allowlist (${emptyReason}) until it is fixed.`
-      });
-    }
-    obj[key] = valid;
-  }
-  return warnings;
-}
-var STRING_ENTRY, CHANNEL_PLUGIN_ENTRY, ALLOWLIST_SPECS;
-var init_sanitizeAllowlists = __esm(() => {
-  init_v4();
-  STRING_ENTRY = exports_external.string();
-  CHANNEL_PLUGIN_ENTRY = exports_external.object({
-    marketplace: exports_external.string(),
-    plugin: exports_external.string()
-  });
-  ALLOWLIST_SPECS = [
-    { key: "allowedHttpHookUrls", emptyReason: "no HTTP hooks may run" },
-    {
-      key: "httpHookAllowedEnvVars",
-      emptyReason: "no environment variables may be interpolated into HTTP hook headers"
-    },
-    { key: "allowedChannelPlugins", emptyReason: "no channel plugins admitted" }
-  ];
-});
-
 // src/utils/settings/settings.ts
 var exports_settings = {};
 __export(exports_settings, {
@@ -60918,30 +60947,20 @@ function parseSettingsFileUncached(path9) {
     if (content.trim() === "") {
       return { settings: {}, errors: [] };
     }
-    const data = safeParseJSON(content, false);
-    const ruleWarnings = filterInvalidPermissionRules(data, path9);
-    const allowlistWarnings = sanitizeSecurityAllowlists(data, path9);
-    const marketplacePolicyWarnings = sanitizeMarketplacePolicy(data, path9);
+    const parsed = safeParseJSON(content, false);
+    const data = parsed && typeof parsed === "object" ? clone(parsed) : parsed;
+    const sanitizeWarnings = sanitizePolicySourceData(data, path9);
     const result = SettingsSchema().safeParse(data);
     if (!result.success) {
       const errors3 = formatZodError(result.error, path9);
       return {
         settings: null,
-        errors: [
-          ...ruleWarnings,
-          ...allowlistWarnings,
-          ...marketplacePolicyWarnings,
-          ...errors3
-        ]
+        errors: [...sanitizeWarnings, ...errors3]
       };
     }
     return {
       settings: result.data,
-      errors: [
-        ...ruleWarnings,
-        ...allowlistWarnings,
-        ...marketplacePolicyWarnings
-      ]
+      errors: sanitizeWarnings
     };
   } catch (error49) {
     handleFileSystemError(error49, path9);
@@ -61004,8 +61023,13 @@ function getSettingsForSource(source) {
 }
 function getSettingsForSourceUncached(source) {
   if (source === "policySettings") {
-    const remoteSettings = getRemoteManagedSettingsSyncFromCache();
-    if (remoteSettings && Object.keys(remoteSettings).length > 0) {
+    const cachedRemote = getRemoteManagedSettingsSyncFromCache();
+    if (cachedRemote && Object.keys(cachedRemote).length > 0) {
+      const remoteSettings = clone(cachedRemote);
+      const remoteWarnings = sanitizePolicySourceData(remoteSettings, "remote managed settings");
+      for (const warning of remoteWarnings) {
+        logForDebugging(`[settings] ${warning.file}: ${warning.path}: ${warning.message}`);
+      }
       return remoteSettings;
     }
     const mdmResult = getMdmSettings();
@@ -61202,13 +61226,16 @@ function loadSettingsFromDisk() {
       if (source === "policySettings") {
         let policySettings = null;
         const policyErrors = [];
-        const remoteSettings = getRemoteManagedSettingsSyncFromCache();
-        if (remoteSettings && Object.keys(remoteSettings).length > 0) {
+        const cachedRemote = getRemoteManagedSettingsSyncFromCache();
+        if (cachedRemote && Object.keys(cachedRemote).length > 0) {
+          const remoteSettings = clone(cachedRemote);
+          const remoteWarnings = sanitizePolicySourceData(remoteSettings, "remote managed settings");
           const result = SettingsSchema().safeParse(remoteSettings);
           if (result.success) {
             policySettings = result.data;
+            policyErrors.push(...remoteWarnings);
           } else {
-            policyErrors.push(...formatZodError(result.error, "remote managed settings"));
+            policyErrors.push(...remoteWarnings, ...formatZodError(result.error, "remote managed settings"));
           }
         }
         if (!policySettings) {
@@ -61568,8 +61595,7 @@ var init_settings2 = __esm(() => {
   init_managedPath();
   init_settings();
   init_settingsCache();
-  init_marketplacePolicySanitizer();
-  init_sanitizeAllowlists();
+  init_policySourceSanitizer();
   init_types2();
   init_validation2();
   MAX_SETTINGS_FILE_BYTES = 2 * 1024 * 1024;
@@ -193323,6 +193349,8 @@ function resetGetMemoryFilesCache(reason = "session_start") {
   hasLoggedAgentsMdMode = false;
   hasLoggedAgentsMdLoad = false;
   agentsMdNoticeRoot = undefined;
+  lastAgentsMdNotice = undefined;
+  lastAgentsMdDeprecation = undefined;
   clearMemoryFileCaches();
 }
 function getLargeMemoryFiles(files, threshold = MIN_MEMORY_CHARACTER_COUNT) {
@@ -195005,6 +195033,23 @@ function getProjectDirsUpToHome(subdir, cwd2) {
   }
   return dirs;
 }
+function addWorktreeMainRepoFallback(projectDirs, subdir, cwd2) {
+  const gitRoot = findGitRoot(cwd2);
+  const canonicalRoot = findCanonicalGitRoot(cwd2);
+  if (!gitRoot || !canonicalRoot || canonicalRoot === gitRoot) {
+    return projectDirs;
+  }
+  const worktreeSubdir = normalizePathForComparison(join34(gitRoot, ".claude", subdir));
+  const worktreeHasSubdir = projectDirs.some((dir) => normalizePathForComparison(dir) === worktreeSubdir);
+  if (worktreeHasSubdir) {
+    return projectDirs;
+  }
+  const mainClaudeSubdir = join34(canonicalRoot, ".claude", subdir);
+  if (projectDirs.includes(mainClaudeSubdir)) {
+    return projectDirs;
+  }
+  return [...projectDirs, mainClaudeSubdir];
+}
 async function findMarkdownFilesNative(dir, signal) {
   const files = [];
   const visitedDirs = new Set;
@@ -195122,19 +195167,7 @@ var init_markdownConfigLoader = __esm(() => {
     const searchStartTime = Date.now();
     const userDir = join34(getClaudeConfigHomeDir(), subdir);
     const managedDir = join34(getManagedFilePath(), ".claude", subdir);
-    const projectDirs = getProjectDirsUpToHome(subdir, cwd2);
-    const gitRoot = findGitRoot(cwd2);
-    const canonicalRoot = findCanonicalGitRoot(cwd2);
-    if (gitRoot && canonicalRoot && canonicalRoot !== gitRoot) {
-      const worktreeSubdir = normalizePathForComparison(join34(gitRoot, ".claude", subdir));
-      const worktreeHasSubdir = projectDirs.some((dir) => normalizePathForComparison(dir) === worktreeSubdir);
-      if (!worktreeHasSubdir) {
-        const mainClaudeSubdir = join34(canonicalRoot, ".claude", subdir);
-        if (!projectDirs.includes(mainClaudeSubdir)) {
-          projectDirs.push(mainClaudeSubdir);
-        }
-      }
-    }
+    const projectDirs = addWorktreeMainRepoFallback(getProjectDirsUpToHome(subdir, cwd2), subdir, cwd2);
     const [managedFiles, userFiles, projectFilesNested] = await Promise.all([
       loadMarkdownFiles(managedDir).then((_2) => _2.map((file2) => ({
         ...file2,
@@ -612907,7 +612940,7 @@ var init_loadSkillsDir = __esm(() => {
   getSkillDirCommands = memoize_default(async (cwd2) => {
     const userSkillsDir = join117(getClaudeConfigHomeDir(), "skills");
     const managedSkillsDir = join117(getManagedFilePath(), ".claude", "skills");
-    const projectSkillsDirs = getProjectDirsUpToHome("skills", cwd2);
+    const projectSkillsDirs = addWorktreeMainRepoFallback(getProjectDirsUpToHome("skills", cwd2), "skills", cwd2);
     logForDebugging(`Loading skills from: managed=${managedSkillsDir}, user=${userSkillsDir}, project=[${projectSkillsDirs.join(", ")}]`);
     const additionalDirs = getAdditionalDirectoriesForClaudeMd();
     const skillsLocked = isRestrictedToPluginOnly("skills");
@@ -738754,7 +738787,6 @@ __export(exports_worktree, {
   createTmuxSessionForWorktree: () => createTmuxSessionForWorktree,
   createAgentWorktree: () => createAgentWorktree,
   copyWorktreeIncludeFiles: () => copyWorktreeIncludeFiles,
-  copyUntrackedProjectSkills: () => copyUntrackedProjectSkills,
   cleanupWorktree: () => cleanupWorktree,
   cleanupStaleAgentWorktrees: () => cleanupStaleAgentWorktrees
 });
@@ -739001,33 +739033,6 @@ async function copyWorktreeIncludeFiles(repoRoot, worktreePath) {
   }
   return copied;
 }
-async function copyUntrackedProjectSkills(repoRoot, worktreePath) {
-  const skillsPathspec = ".claude/skills";
-  const listed = await execFileNoThrowWithCwd(gitExe(), ["ls-files", "--others", "--exclude-standard", "--", skillsPathspec], { cwd: repoRoot });
-  if (listed.code !== 0 || !listed.stdout.trim()) {
-    return [];
-  }
-  const copied = [];
-  for (const relativePath2 of listed.stdout.trim().split(`
-`).filter(Boolean)) {
-    if (containsPathTraversal(relativePath2)) {
-      continue;
-    }
-    const srcPath = join167(repoRoot, relativePath2);
-    const destPath = join167(worktreePath, relativePath2);
-    try {
-      await mkdirRecursive(dirname74(destPath));
-      await copyFile11(srcPath, destPath);
-      copied.push(relativePath2);
-    } catch (e4) {
-      logForDebugging(`Failed to copy untracked skill ${relativePath2} to worktree: ${errorMessage(e4)}`, { level: "warn" });
-    }
-  }
-  if (copied.length > 0) {
-    logForDebugging(`Copied ${copied.length} untracked project skill file(s) into worktree: ${copied.join(", ")}`);
-  }
-  return copied;
-}
 async function performPostCreationSetup(repoRoot, worktreePath) {
   const localSettingsRelativePath = getRelativeSettingsFilePathForSource("localSettings");
   const sourceSettingsLocal = join167(repoRoot, localSettingsRelativePath);
@@ -739075,7 +739080,6 @@ async function performPostCreationSetup(repoRoot, worktreePath) {
     await symlinkDirectories(repoRoot, worktreePath, dirsToSymlink);
   }
   await copyWorktreeIncludeFiles(repoRoot, worktreePath);
-  await copyUntrackedProjectSkills(repoRoot, worktreePath);
   if (feature("COMMIT_ATTRIBUTION")) {
     const worktreeHooksDir = hooksPath === huskyPath ? join167(worktreePath, ".husky") : undefined;
     Promise.resolve().then(() => (init_postCommitAttribution(), exports_postCommitAttribution)).then((m5) => m5.installPrepareCommitMsgHook(worktreePath, worktreeHooksDir).catch((error52) => {
@@ -826546,13 +826550,13 @@ function canBatchWith(head, next2) {
   return next2 !== undefined && next2.mode === "prompt" && next2.workload === head.workload && next2.isMeta === head.isMeta;
 }
 async function runHeadless(inputPrompt, getAppState, setAppState, commands7, tools, sdkMcpConfigs, agents2, options) {
+  registerHeadlessCostSaveOnExit();
   if (process.env.USER_TYPE === "ant" && isEnvTruthy(process.env.CLAUDE_CODE_EXIT_AFTER_FIRST_RENDER)) {
     process.stderr.write(`
 Startup time: ${Math.round(process.uptime() * 1000)}ms
 `);
     process.exit(0);
   }
-  registerHeadlessCostSaveOnExit();
   if (typeof inputPrompt === "string" && shouldTriggerUltracodeFromPrompt(inputPrompt)) {
     enableUltracodeForSession();
     logEvent2("tengu_ultracode_keyword_triggered", {
@@ -836920,7 +836924,7 @@ var _FEATURE_ALLOWLIST = new Set([
 var feature2 = (name3) => _FEATURE_ALLOWLIST.has(name3);
 if (typeof globalThis.MACRO === "undefined") {
   globalThis.MACRO = {
-    VERSION: "2.1.276",
+    VERSION: "2.1.278",
     BINARY_NAME: "occ",
     BUILD_TIME: new Date().toISOString(),
     FEEDBACK_CHANNEL: "",