@code-yeongyu/senpi 2026.8.18 → 2026.8.20-2

package/dist/core/extensions/builtin/config-reload/watch-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"watch-engine.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/config-reload/watch-engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAc,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAqDnE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,aAAa,GAAe;IACjC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;IAChE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IAC1B,OAAO,CAAgB;IACvB,aAAa,GAAmB,EAAE,CAAC;IACnC,UAAU,CAAmB;IAC7B,aAAa,CAA+B;IAC5C,QAAQ,CAAyC;IACjD,SAAS,CAA2B;IACpC,MAAM,CAAa;IACnB,WAAW,CAAS;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC/D,MAAM,CAA4C;IAClD,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,OAAuC;QAClD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7C,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO;gBACN,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACJ,IAAI,CAAC,aAAa,CAAC,IAAI,CACtB,IAAI,CAAC,UAAU,CACd,KAAK,CAAC,MAAM,CAAC,IAAI,EACjB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;oBACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAC3C,CAAC,EACD,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CACpD,CACD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK;QACJ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACR,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,CAAC;QACD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC;gBACJ,WAAW,EAAE,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;IACF,CAAC;IAED,mBAAmB;QAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,KAAkB,EAAE,UAAkB,EAAE,QAAuB;QACvE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC/D,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;IAClB,CAAC;IAED,SAAS;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED,gBAAgB;QACf,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkD,CAAC;QAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC;gBAClB,YAAY;gBACZ,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;gBAClE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;aAClE,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,cAAc,CACb,KAAkB,EAClB,QAA4B,EAC5B,OAA4D;QAE5D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE9G,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACpG,OAAO;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACrG,CAAC;IAED,aAAa,CAAC,MAA2B,EAAE,QAAqB,EAAE,KAAkB;QACnF,MAAM,MAAM,GAAe,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAChF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAA2B;QAChC,MAAM,MAAM,GAAe,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAChF,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,SAAS,CACR,MAA2B,EAC3B,YAAoB,EACpB,OAAe,EACf,MAAkB,EAClB,KAAmB;QAEnB,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO;QACR,CAAC;QACD,IAAI,KAAY,CAAC;QACjB,IAAI,CAAC;YACJ,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,OAAO;QACR,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,KAAK,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,0BAA0B,GAAG,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzG,IAAI,0BAA0B,EAAE,CAAC;YAChC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtC,OAAO;QACR,CAAC;QACD,IAAI,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACjD,OAAO;QACR,CAAC;QACD,IAAI,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACxE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACtF,SAAS;gBACV,CAAC;gBACD,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACtE,IACC,KAAK,CAAC,WAAW,EAAE;oBACnB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAC1B,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,YAAY,CAAC,EACxD,CAAC;oBACF,SAAS;gBACV,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrF,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,QAAQ,CACP,cAA2C,EAC3C,mBAAwC,EACxC,UAAuC,EACvC,eAAoC,EACpC,OAA4D;QAE5D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACxC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,MAA2B,EAAE,OAAe;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IACC,MAAM,CAAC,SAAS;YAChB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,EACjG,CAAC;YACF,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,6BAA6B,CAAC,MAA2B,EAAE,OAAe;QACzE,OAAO,CACN,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,CAC3G,CAAC;IACH,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,IAAY;QACxC,IAAI,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACR,kDAAkD;QACnD,CAAC;IACF,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAChH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC7C,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { lstatSync, readdirSync, readFileSync, type Stats } from \"node:fs\";\nimport { basename, isAbsolute, join, normalize, resolve, sep } from \"node:path\";\n\nexport { createFsWatchEventSource } from \"./watch-event-source.ts\";\n\nexport type WatchTarget = {\n\treadonly id: string;\n\treadonly kind: \"dir\" | \"dir-recursive\";\n\treadonly path: string;\n\treadonly allowList?: readonly string[];\n\treadonly filter?: (relPath: string) => boolean;\n};\n\nexport type WatchEventListener = (eventType: string, filename: string | null) => void;\n\nexport type WatchEventSource = (\n\tpath: string,\n\tlistener: WatchEventListener,\n\toptions?: { readonly recursive: boolean },\n) => () => void;\n\nexport type WatchClock = {\n\tsetTimeout(callback: () => void, delayMs: number): ReturnType<typeof setTimeout>;\n\tclearTimeout(timer: ReturnType<typeof setTimeout>): void;\n};\n\nexport type RealChange = {\n\treadonly changedPaths: readonly string[];\n\treadonly created: readonly string[];\n\treadonly deleted: readonly string[];\n};\n\nexport type ConfigReloadWatchEngineOptions = {\n\treadonly targets: readonly WatchTarget[];\n\treadonly subscribe: WatchEventSource;\n\treadonly onRealChange: (change: RealChange) => void;\n\treadonly onError?: (error: unknown, path: string) => void;\n\treadonly debounceMs?: number;\n\treadonly clock?: WatchClock;\n\t/** Test seam. Production callers use SHA-256 of file bytes. */\n\treadonly hashFile?: (path: string) => string;\n};\n\ntype TargetState = {\n\treadonly target: ResolvedWatchTarget;\n\treadonly hashes: Map<string, string>;\n\treadonly allowedDirectories: Set<string>;\n};\n\ntype ResolvedWatchTarget = Omit<WatchTarget, \"path\"> & { readonly path: string };\n\ntype ScanResult = {\n\treadonly hashes: Map<string, string>;\n\treadonly allowedDirectories: Set<string>;\n};\n\nconst DEFAULT_DEBOUNCE_MS = 200;\nconst DEFAULT_CLOCK: WatchClock = {\n\tsetTimeout: (callback, delayMs) => setTimeout(callback, delayMs),\n\tclearTimeout: (timer) => clearTimeout(timer),\n};\n\n/**\n * Hash-gates filesystem events. Targets are directories by design: watching a\n * file directly breaks when editors atomically rename a replacement over it.\n */\nexport class ConfigReloadWatchEngine {\n\treadonly #states: TargetState[];\n\treadonly #unsubscribes: (() => void)[] = [];\n\treadonly #subscribe: WatchEventSource;\n\treadonly #onRealChange: (change: RealChange) => void;\n\treadonly #onError: (error: unknown, path: string) => void;\n\treadonly #hashFile: (path: string) => string;\n\treadonly #clock: WatchClock;\n\treadonly #debounceMs: number;\n\treadonly #pending = new Map<TargetState, Set<string> | null>();\n\t#timer: ReturnType<typeof setTimeout> | undefined;\n\t#closed = false;\n\n\tconstructor(options: ConfigReloadWatchEngineOptions) {\n\t\tthis.#subscribe = options.subscribe;\n\t\tthis.#onRealChange = options.onRealChange;\n\t\tthis.#onError = options.onError ?? (() => {});\n\t\tthis.#hashFile = options.hashFile ?? hashFile;\n\t\tthis.#clock = options.clock ?? DEFAULT_CLOCK;\n\t\tthis.#debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;\n\t\tthis.#states = options.targets.map((target) => {\n\t\t\tconst resolvedTarget = { ...target, path: resolve(target.path) };\n\t\t\tconst scan = this.#scan(resolvedTarget);\n\t\t\treturn {\n\t\t\t\ttarget: resolvedTarget,\n\t\t\t\thashes: scan.hashes,\n\t\t\t\tallowedDirectories: scan.allowedDirectories,\n\t\t\t};\n\t\t});\n\n\t\tfor (const state of this.#states) {\n\t\t\ttry {\n\t\t\t\tthis.#unsubscribes.push(\n\t\t\t\t\tthis.#subscribe(\n\t\t\t\t\t\tstate.target.path,\n\t\t\t\t\t\t(eventType, filename) => {\n\t\t\t\t\t\t\tthis.#onEvent(state, eventType, filename);\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ recursive: state.target.kind === \"dir-recursive\" },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t} catch (error) {\n\t\t\t\tthis.#reportError(error, state.target.path);\n\t\t\t}\n\t\t}\n\t}\n\n\tclose(): void {\n\t\tif (this.#closed) {\n\t\t\treturn;\n\t\t}\n\t\tthis.#closed = true;\n\t\tif (this.#timer) {\n\t\t\tthis.#clock.clearTimeout(this.#timer);\n\t\t\tthis.#timer = undefined;\n\t\t}\n\t\tfor (const unsubscribe of this.#unsubscribes.splice(0)) {\n\t\t\ttry {\n\t\t\t\tunsubscribe();\n\t\t\t} catch (error) {\n\t\t\t\tthis.#reportError(error, \"watch subscription\");\n\t\t\t}\n\t\t}\n\t}\n\n\tgetBaselineSnapshot(): ReadonlyMap<string, string> {\n\t\tconst snapshot = new Map<string, string>();\n\t\tfor (const state of this.#states) {\n\t\t\tfor (const [path, hash] of state.hashes) {\n\t\t\t\tsnapshot.set(path, hash);\n\t\t\t}\n\t\t}\n\t\treturn snapshot;\n\t}\n\n\t#onEvent(state: TargetState, _eventType: string, filename: string | null): void {\n\t\tif (this.#closed) {\n\t\t\treturn;\n\t\t}\n\t\tif (filename === null) {\n\t\t\tthis.#pending.set(state, null);\n\t\t} else if (this.#pending.get(state) !== null) {\n\t\t\tconst affected = this.#pending.get(state) ?? new Set<string>();\n\t\t\tconst relPath = normalizeRelativePath(filename);\n\t\t\tif (relPath && this.#matches(state.target, relPath)) {\n\t\t\t\taffected.add(relPath);\n\t\t\t\tthis.#pending.set(state, affected);\n\t\t\t}\n\t\t}\n\t\tthis.#schedule();\n\t}\n\n\t#schedule(): void {\n\t\tif (this.#timer) {\n\t\t\tthis.#clock.clearTimeout(this.#timer);\n\t\t}\n\t\tthis.#timer = this.#clock.setTimeout(() => {\n\t\t\tthis.#timer = undefined;\n\t\t\tthis.#evaluatePending();\n\t\t}, this.#debounceMs);\n\t}\n\n\t#evaluatePending(): void {\n\t\tif (this.#closed) {\n\t\t\treturn;\n\t\t}\n\t\tconst changes = new Map<string, { created: boolean; deleted: boolean }>();\n\t\tfor (const [state, affected] of this.#pending) {\n\t\t\tthis.#evaluateState(state, affected, changes);\n\t\t}\n\t\tthis.#pending.clear();\n\t\tif (changes.size > 0) {\n\t\t\tconst changedPaths = [...changes.keys()].sort();\n\t\t\tthis.#onRealChange({\n\t\t\t\tchangedPaths,\n\t\t\t\tcreated: changedPaths.filter((path) => changes.get(path)?.created),\n\t\t\t\tdeleted: changedPaths.filter((path) => changes.get(path)?.deleted),\n\t\t\t});\n\t\t}\n\t}\n\n\t#evaluateState(\n\t\tstate: TargetState,\n\t\taffected: Set<string> | null,\n\t\tchanges: Map<string, { created: boolean; deleted: boolean }>,\n\t): void {\n\t\tconst previousHashes = new Map(state.hashes);\n\t\tconst previousDirectories = new Set(state.allowedDirectories);\n\t\tconst next = affected === null ? this.#scan(state.target) : this.#scanAffected(state.target, affected, state);\n\n\t\tif (affected === null) {\n\t\t\tstate.hashes.clear();\n\t\t\tfor (const [path, hash] of next.hashes) {\n\t\t\t\tstate.hashes.set(path, hash);\n\t\t\t}\n\t\t\tstate.allowedDirectories.clear();\n\t\t\tfor (const path of next.allowedDirectories) {\n\t\t\t\tstate.allowedDirectories.add(path);\n\t\t\t}\n\t\t\tthis.#compare(previousHashes, previousDirectories, state.hashes, state.allowedDirectories, changes);\n\t\t\treturn;\n\t\t}\n\n\t\tconst prefixes = [...affected].map((relPath) => join(state.target.path, relPath));\n\t\tfor (const path of [...state.hashes.keys()]) {\n\t\t\tif (prefixes.some((prefix) => isWithin(path, prefix))) {\n\t\t\t\tstate.hashes.delete(path);\n\t\t\t}\n\t\t}\n\t\tfor (const path of [...state.allowedDirectories]) {\n\t\t\tif (prefixes.some((prefix) => isWithin(path, prefix))) {\n\t\t\t\tstate.allowedDirectories.delete(path);\n\t\t\t}\n\t\t}\n\t\tfor (const [path, hash] of next.hashes) {\n\t\t\tstate.hashes.set(path, hash);\n\t\t}\n\t\tfor (const path of next.allowedDirectories) {\n\t\t\tstate.allowedDirectories.add(path);\n\t\t}\n\t\tthis.#compare(previousHashes, previousDirectories, state.hashes, state.allowedDirectories, changes);\n\t}\n\n\t#scanAffected(target: ResolvedWatchTarget, affected: Set<string>, state: TargetState): ScanResult {\n\t\tconst result: ScanResult = { hashes: new Map(), allowedDirectories: new Set() };\n\t\tfor (const relPath of affected) {\n\t\t\tconst absolutePath = join(target.path, relPath);\n\t\t\tthis.#scanPath(target, absolutePath, relPath, result, state);\n\t\t}\n\t\treturn result;\n\t}\n\n\t#scan(target: ResolvedWatchTarget): ScanResult {\n\t\tconst result: ScanResult = { hashes: new Map(), allowedDirectories: new Set() };\n\t\tthis.#scanPath(target, target.path, \"\", result);\n\t\treturn result;\n\t}\n\n\t#scanPath(\n\t\ttarget: ResolvedWatchTarget,\n\t\tabsolutePath: string,\n\t\trelPath: string,\n\t\tresult: ScanResult,\n\t\tstate?: TargetState,\n\t): void {\n\t\tif (relPath && !this.#matches(target, relPath)) {\n\t\t\treturn;\n\t\t}\n\t\tlet entry: Stats;\n\t\ttry {\n\t\t\tentry = lstatSync(absolutePath);\n\t\t} catch (error) {\n\t\t\tif (state && !isMissing(error)) {\n\t\t\t\tthis.#reportError(error, absolutePath);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tif (entry.isSymbolicLink()) {\n\t\t\treturn;\n\t\t}\n\t\tif (entry.isFile()) {\n\t\t\ttry {\n\t\t\t\tresult.hashes.set(absolutePath, this.#hashFile(absolutePath));\n\t\t\t} catch (error) {\n\t\t\t\tthis.#reportError(error, absolutePath);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tif (!entry.isDirectory()) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst dotDirectory = relPath !== \"\" && basename(relPath).startsWith(\".\");\n\t\tconst explicitlyAllowedDirectory = relPath !== \"\" && this.#isExplicitlyAllowedDirectory(target, relPath);\n\t\tif (explicitlyAllowedDirectory) {\n\t\t\tresult.allowedDirectories.add(absolutePath);\n\t\t}\n\t\tif (relPath && target.kind === \"dir\") {\n\t\t\treturn;\n\t\t}\n\t\tif (dotDirectory && !explicitlyAllowedDirectory) {\n\t\t\treturn;\n\t\t}\n\t\ttry {\n\t\t\tfor (const child of readdirSync(absolutePath, { withFileTypes: true })) {\n\t\t\t\tif (child.isSymbolicLink() || child.name === \"node_modules\" || child.name === \".git\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst childRelPath = relPath ? join(relPath, child.name) : child.name;\n\t\t\t\tif (\n\t\t\t\t\tchild.isDirectory() &&\n\t\t\t\t\tchild.name.startsWith(\".\") &&\n\t\t\t\t\t!this.#isExplicitlyAllowedDirectory(target, childRelPath)\n\t\t\t\t) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tthis.#scanPath(target, join(absolutePath, child.name), childRelPath, result, state);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tthis.#reportError(error, absolutePath);\n\t\t}\n\t}\n\n\t#compare(\n\t\tpreviousHashes: ReadonlyMap<string, string>,\n\t\tpreviousDirectories: ReadonlySet<string>,\n\t\tnextHashes: ReadonlyMap<string, string>,\n\t\tnextDirectories: ReadonlySet<string>,\n\t\tchanges: Map<string, { created: boolean; deleted: boolean }>,\n\t): void {\n\t\tfor (const [path, hash] of nextHashes) {\n\t\t\tconst oldHash = previousHashes.get(path);\n\t\t\tif (oldHash !== hash) {\n\t\t\t\tchanges.set(path, { created: oldHash === undefined, deleted: false });\n\t\t\t}\n\t\t}\n\t\tfor (const path of previousHashes.keys()) {\n\t\t\tif (!nextHashes.has(path)) {\n\t\t\t\tchanges.set(path, { created: false, deleted: true });\n\t\t\t}\n\t\t}\n\t\tfor (const path of nextDirectories) {\n\t\t\tif (!previousDirectories.has(path)) {\n\t\t\t\tchanges.set(path, { created: true, deleted: false });\n\t\t\t}\n\t\t}\n\t\tfor (const path of previousDirectories) {\n\t\t\tif (!nextDirectories.has(path)) {\n\t\t\t\tchanges.set(path, { created: false, deleted: true });\n\t\t\t}\n\t\t}\n\t}\n\n\t#matches(target: ResolvedWatchTarget, relPath: string): boolean {\n\t\tif (!target.kind.includes(\"recursive\") && relPath.includes(sep)) {\n\t\t\treturn false;\n\t\t}\n\t\tif (\n\t\t\ttarget.allowList &&\n\t\t\t!target.allowList.some((allowed) => relPath === allowed || relPath.startsWith(`${allowed}${sep}`))\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\t\treturn target.filter?.(relPath) ?? true;\n\t}\n\n\t#isExplicitlyAllowedDirectory(target: ResolvedWatchTarget, relPath: string): boolean {\n\t\treturn (\n\t\t\ttarget.allowList?.some((allowed) => relPath === allowed || relPath.startsWith(`${allowed}${sep}`)) ?? false\n\t\t);\n\t}\n\n\t#reportError(error: unknown, path: string): void {\n\t\ttry {\n\t\t\tthis.#onError(error, path);\n\t\t} catch {\n\t\t\t// Error reporting must not take down the watcher.\n\t\t}\n\t}\n}\n\nfunction hashFile(path: string): string {\n\treturn createHash(\"sha256\").update(readFileSync(path)).digest(\"hex\");\n}\n\nfunction normalizeRelativePath(filename: string): string | undefined {\n\tif (isAbsolute(filename)) {\n\t\treturn undefined;\n\t}\n\tconst normalized = normalize(filename);\n\treturn normalized === \".\" || normalized === \"..\" || normalized.startsWith(`..${sep}`) ? undefined : normalized;\n}\n\nfunction isWithin(path: string, prefix: string): boolean {\n\treturn path === prefix || path.startsWith(`${prefix}${sep}`);\n}\n\nfunction isMissing(error: unknown): boolean {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error && error.code === \"ENOENT\";\n}\n"]}
+{"version":3,"file":"watch-engine.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/config-reload/watch-engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAc,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AA+DnE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,aAAa,GAAe;IACjC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;IAChE,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IAC1B,OAAO,CAAgB;IACvB,aAAa,GAAmB,EAAE,CAAC;IACnC,UAAU,CAAmB;IAC7B,aAAa,CAA+B;IAC5C,QAAQ,CAAyC;IACjD,SAAS,CAA2B;IACpC,MAAM,CAAa;IACnB,WAAW,CAAS;IACpB,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC/D,MAAM,CAA4C;IAClD,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,OAAuC;QAClD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7C,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO;gBACN,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,kBAAkB,EAAE,IAAI,GAAG,EAAsB;gBACjD,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC/C,CAAC;IACF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAkB,EAAE,WAAgC;QAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC;QACxD,6EAA6E;QAC7E,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACV,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAClC,SAAS,EACT,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;oBACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACtD,CAAC,EACD,EAAE,SAAS,EAAE,KAAK,EAAE,CACpB,CAAC;gBACF,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBACrD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC;QACF,CAAC;IACF,CAAC;IAED,qFAAqF;IACrF,cAAc,CAAC,KAAkB,EAAE,IAAyB;QAC3D,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,IAAI,SAAS,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5D,SAAS;YACV,CAAC;YACD,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,CAAC;gBACJ,WAAW,EAAE,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;;;;OAMG;IACH,KAAK;QACJ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,OAAO,IAAI,OAAO,CAAO,CAAC,MAAM,EAAE,EAAE;YACnC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBAC3B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACJ,WAAW,EAAE,CAAC;oBACf,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;oBAChD,CAAC;gBACF,CAAC;gBACD,MAAM,EAAE,CAAC;YACV,CAAC,EAAE,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,mBAAmB;QAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,QAAQ,CAAC,KAAkB,EAAE,UAAkB,EAAE,QAAuB,EAAE,gBAAyB;QAClG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC/D,4EAA4E;YAC5E,wDAAwD;YACxD,MAAM,OAAO,GAAG,qBAAqB,CACpC,gBAAgB,IAAI,gBAAgB,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI;gBACzD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC;gBAC/D,CAAC,CAAC,QAAQ,CACX,CAAC;YACF,IAAI,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;IAClB,CAAC;IAED,SAAS;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;YACzC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED,gBAAgB;QACf,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkD,CAAC;QAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC;gBAClB,YAAY;gBACZ,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;gBAClE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;aAClE,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,cAAc,CACb,KAAkB,EAClB,QAA4B,EAC5B,OAA4D;QAE5D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE9G,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;YACnD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACpG,OAAO;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5C,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACrG,CAAC;IAED,aAAa,CAAC,MAA2B,EAAE,QAAqB,EAAE,KAAkB;QACnF,MAAM,MAAM,GAAe,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC/G,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAA2B;QAChC,MAAM,MAAM,GAAe,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAC/G,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,SAAS,CACR,MAA2B,EAC3B,YAAoB,EACpB,OAAe,EACf,MAAkB,EAClB,KAAmB;QAEnB,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO;QACR,CAAC;QACD,IAAI,KAAY,CAAC;QACjB,IAAI,CAAC;YACJ,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,OAAO;QACR,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,KAAK,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,0BAA0B,GAAG,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzG,IAAI,0BAA0B,EAAE,CAAC;YAChC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtC,OAAO;QACR,CAAC;QACD,IAAI,YAAY,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACjD,OAAO;QACR,CAAC;QACD,4EAA4E;QAC5E,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACxE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACtF,SAAS;gBACV,CAAC;gBACD,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACtE,IACC,KAAK,CAAC,WAAW,EAAE;oBACnB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAC1B,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,YAAY,CAAC,EACxD,CAAC;oBACF,SAAS;gBACV,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrF,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,QAAQ,CACP,cAA2C,EAC3C,mBAAwC,EACxC,UAAuC,EACvC,eAAoC,EACpC,OAA4D;QAE5D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACxC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,MAA2B,EAAE,OAAe;QACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IACC,MAAM,CAAC,SAAS;YAChB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,EACjG,CAAC;YACF,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,6BAA6B,CAAC,MAA2B,EAAE,OAAe;QACzE,OAAO,CACN,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,CAC3G,CAAC;IACH,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,IAAY;QACxC,IAAI,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACR,kDAAkD;QACnD,CAAC;IACF,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAChH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC7C,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAClG,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { lstatSync, readdirSync, readFileSync, type Stats } from \"node:fs\";\nimport { basename, isAbsolute, join, normalize, relative, resolve, sep } from \"node:path\";\n\nexport { createFsWatchEventSource } from \"./watch-event-source.ts\";\n\nexport type WatchTarget = {\n\treadonly id: string;\n\treadonly kind: \"dir\" | \"dir-recursive\";\n\treadonly path: string;\n\treadonly allowList?: readonly string[];\n\treadonly filter?: (relPath: string) => boolean;\n};\n\nexport type WatchEventListener = (eventType: string, filename: string | null) => void;\n\nexport type WatchEventSource = (\n\tpath: string,\n\tlistener: WatchEventListener,\n\toptions?: { readonly recursive: boolean },\n) => () => void;\n\nexport type WatchClock = {\n\tsetTimeout(callback: () => void, delayMs: number): ReturnType<typeof setTimeout>;\n\tclearTimeout(timer: ReturnType<typeof setTimeout>): void;\n};\n\nexport type RealChange = {\n\treadonly changedPaths: readonly string[];\n\treadonly created: readonly string[];\n\treadonly deleted: readonly string[];\n};\n\nexport type ConfigReloadWatchEngineOptions = {\n\treadonly targets: readonly WatchTarget[];\n\treadonly subscribe: WatchEventSource;\n\treadonly onRealChange: (change: RealChange) => void;\n\treadonly onError?: (error: unknown, path: string) => void;\n\treadonly debounceMs?: number;\n\treadonly clock?: WatchClock;\n\t/** Test seam. Production callers use SHA-256 of file bytes. */\n\treadonly hashFile?: (path: string) => string;\n};\n\ntype TargetState = {\n\treadonly target: ResolvedWatchTarget;\n\treadonly hashes: Map<string, string>;\n\treadonly allowedDirectories: Set<string>;\n\t/**\n\t * Directories the scan actually descended into, which are exactly the\n\t * directories worth handing to the OS. Recursive targets subscribe per entry\n\t * here instead of registering their whole subtree.\n\t */\n\treadonly watchedDirectories: Map<string, () => void>;\n\t/** Directories currently in scope, refreshed by every scan. */\n\tscannedDirectories: Set<string>;\n};\n\ntype ResolvedWatchTarget = Omit<WatchTarget, \"path\"> & { readonly path: string };\n\ntype ScanResult = {\n\treadonly hashes: Map<string, string>;\n\treadonly allowedDirectories: Set<string>;\n\t/** Directories visited by the scan, i.e. the in-scope directory set. */\n\treadonly scannedDirectories: Set<string>;\n};\n\nconst DEFAULT_DEBOUNCE_MS = 200;\nconst DEFAULT_CLOCK: WatchClock = {\n\tsetTimeout: (callback, delayMs) => setTimeout(callback, delayMs),\n\tclearTimeout: (timer) => clearTimeout(timer),\n};\n\n/**\n * Hash-gates filesystem events. Targets are directories by design: watching a\n * file directly breaks when editors atomically rename a replacement over it.\n */\nexport class ConfigReloadWatchEngine {\n\treadonly #states: TargetState[];\n\treadonly #unsubscribes: (() => void)[] = [];\n\treadonly #subscribe: WatchEventSource;\n\treadonly #onRealChange: (change: RealChange) => void;\n\treadonly #onError: (error: unknown, path: string) => void;\n\treadonly #hashFile: (path: string) => string;\n\treadonly #clock: WatchClock;\n\treadonly #debounceMs: number;\n\treadonly #pending = new Map<TargetState, Set<string> | null>();\n\t#timer: ReturnType<typeof setTimeout> | undefined;\n\t#closed = false;\n\n\tconstructor(options: ConfigReloadWatchEngineOptions) {\n\t\tthis.#subscribe = options.subscribe;\n\t\tthis.#onRealChange = options.onRealChange;\n\t\tthis.#onError = options.onError ?? (() => {});\n\t\tthis.#hashFile = options.hashFile ?? hashFile;\n\t\tthis.#clock = options.clock ?? DEFAULT_CLOCK;\n\t\tthis.#debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;\n\t\tthis.#states = options.targets.map((target) => {\n\t\t\tconst resolvedTarget = { ...target, path: resolve(target.path) };\n\t\t\tconst scan = this.#scan(resolvedTarget);\n\t\t\treturn {\n\t\t\t\ttarget: resolvedTarget,\n\t\t\t\thashes: scan.hashes,\n\t\t\t\tallowedDirectories: scan.allowedDirectories,\n\t\t\t\twatchedDirectories: new Map<string, () => void>(),\n\t\t\t\tscannedDirectories: scan.scannedDirectories,\n\t\t\t};\n\t\t});\n\n\t\tfor (const state of this.#states) {\n\t\t\tthis.#attach(state, state.scannedDirectories);\n\t\t}\n\t}\n\n\t/**\n\t * Subscribes to exactly the in-scope directories.\n\t *\n\t * A `dir-recursive` target used to hand its root to `fs.watch({recursive:true})`,\n\t * which registers the entire subtree with the OS watcher (FSEvents on macOS).\n\t * The target `filter` only discards events after delivery, so an extensions or\n\t * skills directory containing `node_modules` still cost a full-subtree\n\t * registration per session. The scan already knows which directories are in\n\t * scope — it skips `node_modules`, `.git`, symlinks, and filtered paths — so\n\t * watching that set directly gives identical coverage at a fraction of the\n\t * OS-level cost.\n\t */\n\t#attach(state: TargetState, directories: ReadonlySet<string>): void {\n\t\tconst recursive = state.target.kind === \"dir-recursive\";\n\t\t// The root is always watched so that creations directly beneath it are seen.\n\t\tconst wanted = recursive ? new Set([state.target.path, ...directories]) : new Set([state.target.path]);\n\t\tfor (const directory of wanted) {\n\t\t\tif (state.watchedDirectories.has(directory)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst unsubscribe = this.#subscribe(\n\t\t\t\t\tdirectory,\n\t\t\t\t\t(eventType, filename) => {\n\t\t\t\t\t\tthis.#onEvent(state, eventType, filename, directory);\n\t\t\t\t\t},\n\t\t\t\t\t{ recursive: false },\n\t\t\t\t);\n\t\t\t\tstate.watchedDirectories.set(directory, unsubscribe);\n\t\t\t\tthis.#unsubscribes.push(unsubscribe);\n\t\t\t} catch (error) {\n\t\t\t\tthis.#reportError(error, directory);\n\t\t\t}\n\t\t}\n\t}\n\n\t/** Drops subscriptions for directories that left scope (deleted or filtered out). */\n\t#detachMissing(state: TargetState, live: ReadonlySet<string>): void {\n\t\tfor (const [directory, unsubscribe] of [...state.watchedDirectories]) {\n\t\t\tif (directory === state.target.path || live.has(directory)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tstate.watchedDirectories.delete(directory);\n\t\t\tconst index = this.#unsubscribes.indexOf(unsubscribe);\n\t\t\tif (index >= 0) {\n\t\t\t\tthis.#unsubscribes.splice(index, 1);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tunsubscribe();\n\t\t\t} catch (error) {\n\t\t\t\tthis.#reportError(error, directory);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Marks the engine inert synchronously, then drains the unsubscribe loop off\n\t * the caller's stack. A single `fs.watch` unsubscribe can block for seconds on\n\t * a loaded machine, and a reload awaits this call; every dispatch path already\n\t * checks `#closed`, so the still-attached subscriptions are silent while the\n\t * returned promise settles. Await it only to observe teardown completion.\n\t */\n\tclose(): Promise<void> {\n\t\tif (this.#closed) {\n\t\t\treturn Promise.resolve();\n\t\t}\n\t\tthis.#closed = true;\n\t\tif (this.#timer) {\n\t\t\tthis.#clock.clearTimeout(this.#timer);\n\t\t\tthis.#timer = undefined;\n\t\t}\n\t\tconst unsubscribes = this.#unsubscribes.splice(0);\n\t\treturn new Promise<void>((settle) => {\n\t\t\tthis.#clock.setTimeout(() => {\n\t\t\t\tfor (const unsubscribe of unsubscribes) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tunsubscribe();\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tthis.#reportError(error, \"watch subscription\");\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tsettle();\n\t\t\t}, 0);\n\t\t});\n\t}\n\n\tgetBaselineSnapshot(): ReadonlyMap<string, string> {\n\t\tconst snapshot = new Map<string, string>();\n\t\tfor (const state of this.#states) {\n\t\t\tfor (const [path, hash] of state.hashes) {\n\t\t\t\tsnapshot.set(path, hash);\n\t\t\t}\n\t\t}\n\t\treturn snapshot;\n\t}\n\n\t#onEvent(state: TargetState, _eventType: string, filename: string | null, watchedDirectory?: string): void {\n\t\tif (this.#closed) {\n\t\t\treturn;\n\t\t}\n\t\tif (filename === null) {\n\t\t\tthis.#pending.set(state, null);\n\t\t} else if (this.#pending.get(state) !== null) {\n\t\t\tconst affected = this.#pending.get(state) ?? new Set<string>();\n\t\t\t// Per-directory subscriptions report names relative to their own directory,\n\t\t\t// so re-anchor them to the target root before matching.\n\t\t\tconst relPath = normalizeRelativePath(\n\t\t\t\twatchedDirectory && watchedDirectory !== state.target.path\n\t\t\t\t\t? join(relative(state.target.path, watchedDirectory), filename)\n\t\t\t\t\t: filename,\n\t\t\t);\n\t\t\tif (relPath && this.#matches(state.target, relPath)) {\n\t\t\t\taffected.add(relPath);\n\t\t\t\tthis.#pending.set(state, affected);\n\t\t\t}\n\t\t}\n\t\tthis.#schedule();\n\t}\n\n\t#schedule(): void {\n\t\tif (this.#timer) {\n\t\t\tthis.#clock.clearTimeout(this.#timer);\n\t\t}\n\t\tthis.#timer = this.#clock.setTimeout(() => {\n\t\t\tthis.#timer = undefined;\n\t\t\tthis.#evaluatePending();\n\t\t}, this.#debounceMs);\n\t}\n\n\t#evaluatePending(): void {\n\t\tif (this.#closed) {\n\t\t\treturn;\n\t\t}\n\t\tconst changes = new Map<string, { created: boolean; deleted: boolean }>();\n\t\tfor (const [state, affected] of this.#pending) {\n\t\t\tthis.#evaluateState(state, affected, changes);\n\t\t}\n\t\tthis.#pending.clear();\n\t\tif (changes.size > 0) {\n\t\t\tconst changedPaths = [...changes.keys()].sort();\n\t\t\tthis.#onRealChange({\n\t\t\t\tchangedPaths,\n\t\t\t\tcreated: changedPaths.filter((path) => changes.get(path)?.created),\n\t\t\t\tdeleted: changedPaths.filter((path) => changes.get(path)?.deleted),\n\t\t\t});\n\t\t}\n\t}\n\n\t#evaluateState(\n\t\tstate: TargetState,\n\t\taffected: Set<string> | null,\n\t\tchanges: Map<string, { created: boolean; deleted: boolean }>,\n\t): void {\n\t\tconst previousHashes = new Map(state.hashes);\n\t\tconst previousDirectories = new Set(state.allowedDirectories);\n\t\tconst next = affected === null ? this.#scan(state.target) : this.#scanAffected(state.target, affected, state);\n\n\t\tif (affected === null) {\n\t\t\tstate.hashes.clear();\n\t\t\tfor (const [path, hash] of next.hashes) {\n\t\t\t\tstate.hashes.set(path, hash);\n\t\t\t}\n\t\t\tstate.allowedDirectories.clear();\n\t\t\tfor (const path of next.allowedDirectories) {\n\t\t\t\tstate.allowedDirectories.add(path);\n\t\t\t}\n\t\t\tstate.scannedDirectories = next.scannedDirectories;\n\t\t\tthis.#detachMissing(state, state.scannedDirectories);\n\t\t\tthis.#attach(state, state.scannedDirectories);\n\t\t\tthis.#compare(previousHashes, previousDirectories, state.hashes, state.allowedDirectories, changes);\n\t\t\treturn;\n\t\t}\n\n\t\tconst prefixes = [...affected].map((relPath) => join(state.target.path, relPath));\n\t\tfor (const path of [...state.hashes.keys()]) {\n\t\t\tif (prefixes.some((prefix) => isWithin(path, prefix))) {\n\t\t\t\tstate.hashes.delete(path);\n\t\t\t}\n\t\t}\n\t\tfor (const path of [...state.allowedDirectories]) {\n\t\t\tif (prefixes.some((prefix) => isWithin(path, prefix))) {\n\t\t\t\tstate.allowedDirectories.delete(path);\n\t\t\t}\n\t\t}\n\t\tfor (const path of [...state.scannedDirectories]) {\n\t\t\tif (prefixes.some((prefix) => isWithin(path, prefix))) {\n\t\t\t\tstate.scannedDirectories.delete(path);\n\t\t\t}\n\t\t}\n\t\tfor (const [path, hash] of next.hashes) {\n\t\t\tstate.hashes.set(path, hash);\n\t\t}\n\t\tfor (const path of next.allowedDirectories) {\n\t\t\tstate.allowedDirectories.add(path);\n\t\t}\n\t\tfor (const path of next.scannedDirectories) {\n\t\t\tstate.scannedDirectories.add(path);\n\t\t}\n\t\t// A partial rescan can both create and remove directories in scope, so the\n\t\t// subscription set is reconciled in both directions here too.\n\t\tthis.#detachMissing(state, state.scannedDirectories);\n\t\tthis.#attach(state, state.scannedDirectories);\n\t\tthis.#compare(previousHashes, previousDirectories, state.hashes, state.allowedDirectories, changes);\n\t}\n\n\t#scanAffected(target: ResolvedWatchTarget, affected: Set<string>, state: TargetState): ScanResult {\n\t\tconst result: ScanResult = { hashes: new Map(), allowedDirectories: new Set(), scannedDirectories: new Set() };\n\t\tfor (const relPath of affected) {\n\t\t\tconst absolutePath = join(target.path, relPath);\n\t\t\tthis.#scanPath(target, absolutePath, relPath, result, state);\n\t\t}\n\t\treturn result;\n\t}\n\n\t#scan(target: ResolvedWatchTarget): ScanResult {\n\t\tconst result: ScanResult = { hashes: new Map(), allowedDirectories: new Set(), scannedDirectories: new Set() };\n\t\tthis.#scanPath(target, target.path, \"\", result);\n\t\treturn result;\n\t}\n\n\t#scanPath(\n\t\ttarget: ResolvedWatchTarget,\n\t\tabsolutePath: string,\n\t\trelPath: string,\n\t\tresult: ScanResult,\n\t\tstate?: TargetState,\n\t): void {\n\t\tif (relPath && !this.#matches(target, relPath)) {\n\t\t\treturn;\n\t\t}\n\t\tlet entry: Stats;\n\t\ttry {\n\t\t\tentry = lstatSync(absolutePath);\n\t\t} catch (error) {\n\t\t\tif (state && !isMissing(error)) {\n\t\t\t\tthis.#reportError(error, absolutePath);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tif (entry.isSymbolicLink()) {\n\t\t\treturn;\n\t\t}\n\t\tif (entry.isFile()) {\n\t\t\ttry {\n\t\t\t\tresult.hashes.set(absolutePath, this.#hashFile(absolutePath));\n\t\t\t} catch (error) {\n\t\t\t\tthis.#reportError(error, absolutePath);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tif (!entry.isDirectory()) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst dotDirectory = relPath !== \"\" && basename(relPath).startsWith(\".\");\n\t\tconst explicitlyAllowedDirectory = relPath !== \"\" && this.#isExplicitlyAllowedDirectory(target, relPath);\n\t\tif (explicitlyAllowedDirectory) {\n\t\t\tresult.allowedDirectories.add(absolutePath);\n\t\t}\n\t\tif (relPath && target.kind === \"dir\") {\n\t\t\treturn;\n\t\t}\n\t\tif (dotDirectory && !explicitlyAllowedDirectory) {\n\t\t\treturn;\n\t\t}\n\t\t// Recorded before descending: this is the set the OS watcher subscribes to.\n\t\tresult.scannedDirectories.add(absolutePath);\n\t\ttry {\n\t\t\tfor (const child of readdirSync(absolutePath, { withFileTypes: true })) {\n\t\t\t\tif (child.isSymbolicLink() || child.name === \"node_modules\" || child.name === \".git\") {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tconst childRelPath = relPath ? join(relPath, child.name) : child.name;\n\t\t\t\tif (\n\t\t\t\t\tchild.isDirectory() &&\n\t\t\t\t\tchild.name.startsWith(\".\") &&\n\t\t\t\t\t!this.#isExplicitlyAllowedDirectory(target, childRelPath)\n\t\t\t\t) {\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tthis.#scanPath(target, join(absolutePath, child.name), childRelPath, result, state);\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tthis.#reportError(error, absolutePath);\n\t\t}\n\t}\n\n\t#compare(\n\t\tpreviousHashes: ReadonlyMap<string, string>,\n\t\tpreviousDirectories: ReadonlySet<string>,\n\t\tnextHashes: ReadonlyMap<string, string>,\n\t\tnextDirectories: ReadonlySet<string>,\n\t\tchanges: Map<string, { created: boolean; deleted: boolean }>,\n\t): void {\n\t\tfor (const [path, hash] of nextHashes) {\n\t\t\tconst oldHash = previousHashes.get(path);\n\t\t\tif (oldHash !== hash) {\n\t\t\t\tchanges.set(path, { created: oldHash === undefined, deleted: false });\n\t\t\t}\n\t\t}\n\t\tfor (const path of previousHashes.keys()) {\n\t\t\tif (!nextHashes.has(path)) {\n\t\t\t\tchanges.set(path, { created: false, deleted: true });\n\t\t\t}\n\t\t}\n\t\tfor (const path of nextDirectories) {\n\t\t\tif (!previousDirectories.has(path)) {\n\t\t\t\tchanges.set(path, { created: true, deleted: false });\n\t\t\t}\n\t\t}\n\t\tfor (const path of previousDirectories) {\n\t\t\tif (!nextDirectories.has(path)) {\n\t\t\t\tchanges.set(path, { created: false, deleted: true });\n\t\t\t}\n\t\t}\n\t}\n\n\t#matches(target: ResolvedWatchTarget, relPath: string): boolean {\n\t\tif (!target.kind.includes(\"recursive\") && relPath.includes(sep)) {\n\t\t\treturn false;\n\t\t}\n\t\tif (\n\t\t\ttarget.allowList &&\n\t\t\t!target.allowList.some((allowed) => relPath === allowed || relPath.startsWith(`${allowed}${sep}`))\n\t\t) {\n\t\t\treturn false;\n\t\t}\n\t\treturn target.filter?.(relPath) ?? true;\n\t}\n\n\t#isExplicitlyAllowedDirectory(target: ResolvedWatchTarget, relPath: string): boolean {\n\t\treturn (\n\t\t\ttarget.allowList?.some((allowed) => relPath === allowed || relPath.startsWith(`${allowed}${sep}`)) ?? false\n\t\t);\n\t}\n\n\t#reportError(error: unknown, path: string): void {\n\t\ttry {\n\t\t\tthis.#onError(error, path);\n\t\t} catch {\n\t\t\t// Error reporting must not take down the watcher.\n\t\t}\n\t}\n}\n\nfunction hashFile(path: string): string {\n\treturn createHash(\"sha256\").update(readFileSync(path)).digest(\"hex\");\n}\n\nfunction normalizeRelativePath(filename: string): string | undefined {\n\tif (isAbsolute(filename)) {\n\t\treturn undefined;\n\t}\n\tconst normalized = normalize(filename);\n\treturn normalized === \".\" || normalized === \"..\" || normalized.startsWith(`..${sep}`) ? undefined : normalized;\n}\n\nfunction isWithin(path: string, prefix: string): boolean {\n\treturn path === prefix || path.startsWith(`${prefix}${sep}`);\n}\n\nfunction isMissing(error: unknown): boolean {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error && error.code === \"ENOENT\";\n}\n"]}

package/dist/core/extensions/builtin/config-reload/watch-event-source.d.ts

@@ -10,6 +10,6 @@ export type FsWatchEventSourceOptions = {
     readonly platform?: NodeJS.Platform;
     readonly createRecursiveWorker?: RecursiveWatchWorkerFactory;
 };
-/** Production event source. Linux recursive setup runs off the interactive main thread. */
+/** Production event source. Recursive setup and teardown run off the interactive main thread. */
 export declare function createFsWatchEventSource(onError?: (error: unknown, path: string) => void, options?: FsWatchEventSourceOptions): WatchEventSource;
 //# sourceMappingURL=watch-event-source.d.ts.map

package/dist/core/extensions/builtin/config-reload/watch-event-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch-event-source.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/config-reload/watch-event-source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,WAAW,oBAAoB;IACpC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3D,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,MAAM,2BAA2B,GAAG,MAAM,oBAAoB,CAAC;AAErE,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;CAC7D,CAAC;AAsEF,2FAA2F;AAC3F,wBAAgB,wBAAwB,CACvC,OAAO,GAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,IAAe,EAC1D,OAAO,GAAE,yBAA8B,GACrC,gBAAgB,CAkDlB"}
+{"version":3,"file":"watch-event-source.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/config-reload/watch-event-source.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,MAAM,WAAW,oBAAoB;IACpC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI,CAAC;IACjE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3D,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,MAAM,2BAA2B,GAAG,MAAM,oBAAoB,CAAC;AAErE,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;CAC7D,CAAC;AA4EF,iGAAiG;AACjG,wBAAgB,wBAAwB,CACvC,OAAO,GAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,IAAe,EAC1D,OAAO,GAAE,yBAA8B,GACrC,gBAAgB,CAkDlB"}

package/dist/core/extensions/builtin/config-reload/watch-event-source.js

@@ -62,7 +62,12 @@ function isRecursiveWatchMessage(message) {
         "filename" in message &&
         (message.filename === null || typeof message.filename === "string"));
 }
-/** Production event source. Linux recursive setup runs off the interactive main thread. */
+/**
+ * Platforms whose recursive fs.watch handles are expensive to create and tear down on the
+ * interactive main thread: inotify tree walks on Linux, FSEvents stream teardown on macOS.
+ */
+const WORKER_OFFLOADED_RECURSIVE_PLATFORMS = new Set(["linux", "darwin"]);
+/** Production event source. Recursive setup and teardown run off the interactive main thread. */
 export function createFsWatchEventSource(onError = () => { }, options = {}) {
     const recursiveSubscriptions = new Map();
     let recursiveWorker;
@@ -91,7 +96,7 @@ export function createFsWatchEventSource(onError = () => { }, options = {}) {
         return worker;
     };
     return (path, listener, watchOptions) => {
-        if ((options.platform ?? process.platform) === "linux" && watchOptions?.recursive) {
+        if (WORKER_OFFLOADED_RECURSIVE_PLATFORMS.has(options.platform ?? process.platform) && watchOptions?.recursive) {
             const id = nextSubscriptionId++;
             const worker = ensureRecursiveWorker();
             recursiveSubscriptions.set(id, { path, listener });

package/dist/core/extensions/builtin/config-reload/watch-event-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"watch-event-source.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/config-reload/watch-event-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAqBtE,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CrC,CAAC;AAEF,SAAS,0BAA0B;IAClC,OAAO,IAAI,MAAM,CAAC,6BAA6B,EAAE;QAChD,IAAI,EAAE,IAAI;KACV,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC;IACjG,OAAO,CACN,OAAO,CAAC,IAAI,KAAK,OAAO;QACxB,WAAW,IAAI,OAAO;QACtB,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,UAAU,IAAI,OAAO;QACrB,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACnE,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,wBAAwB,CACvC,UAAkD,GAAG,EAAE,GAAE,CAAC,EAC1D,UAAqC,EAAE;IAEvC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA4E,CAAC;IACnH,IAAI,eAAiD,CAAC;IACtD,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,MAAM,qBAAqB,GAAG,GAAyB,EAAE;QACxD,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAC5C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,0BAA0B,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YAChC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;gBAAE,OAAO;YAC9C,MAAM,YAAY,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY;gBAAE,OAAO;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC3D,OAAO;YACR,CAAC;YACD,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,KAAK,MAAM,YAAY,IAAI,sBAAsB,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QACH,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YACnF,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACvC,sBAAsB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,GAAG,EAAE;gBACX,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,OAAO;gBAC/C,IAAI,sBAAsB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACrC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5C,OAAO;gBACR,CAAC;gBACD,eAAe,GAAG,SAAS,CAAC;gBAC5B,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CACpC,IAAI,EACJ,QAAQ,EACR,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAC7D,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,IAAI,KAAK,EAAE,CAC/C,CAAC;QACF,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC;AACH,CAAC","sourcesContent":["import { Worker } from \"node:worker_threads\";\nimport { watchWithErrorHandler } from \"../../../../utils/fs-watch.ts\";\nimport type { WatchEventListener, WatchEventSource } from \"./watch-engine.ts\";\n\nexport interface RecursiveWatchWorker {\n\ton(event: \"message\", listener: (message: unknown) => void): this;\n\ton(event: \"error\", listener: (error: Error) => void): this;\n\tpostMessage(message: unknown): void;\n\tterminate(): Promise<number>;\n}\n\nexport type RecursiveWatchWorkerFactory = () => RecursiveWatchWorker;\n\nexport type FsWatchEventSourceOptions = {\n\treadonly platform?: NodeJS.Platform;\n\treadonly createRecursiveWorker?: RecursiveWatchWorkerFactory;\n};\n\ntype RecursiveWatchMessage =\n\t| { readonly kind: \"event\"; readonly id: number; readonly eventType: string; readonly filename: string | null }\n\t| { readonly kind: \"error\"; readonly id: number; readonly message: string };\n\nconst RECURSIVE_WATCH_WORKER_SOURCE = `\nconst { watch } = require(\"node:fs\");\nconst { parentPort } = require(\"node:worker_threads\");\n\nif (!parentPort) throw new Error(\"Recursive watch worker requires a parent port\");\n\nconst watchers = new Map();\nparentPort.on(\"message\", (message) => {\n\tif (message.kind === \"unwatch\") {\n\t\twatchers.get(message.id)?.close();\n\t\twatchers.delete(message.id);\n\t\treturn;\n\t}\n\tif (message.kind !== \"watch\") return;\n\ttry {\n\t\tconst watcher = watch(\n\t\t\tmessage.path,\n\t\t\t{ recursive: true, encoding: \"utf8\" },\n\t\t\t(eventType, filename) => {\n\t\t\t\tparentPort.postMessage({\n\t\t\t\t\tkind: \"event\",\n\t\t\t\t\tid: message.id,\n\t\t\t\t\teventType,\n\t\t\t\t\tfilename: typeof filename === \"string\" ? filename : null,\n\t\t\t\t});\n\t\t\t},\n\t\t);\n\t\twatcher.on(\"error\", (error) => {\n\t\t\tparentPort.postMessage({\n\t\t\t\tkind: \"error\",\n\t\t\t\tid: message.id,\n\t\t\t\tmessage: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t});\n\t\twatchers.set(message.id, watcher);\n\t} catch (error) {\n\t\tparentPort.postMessage({\n\t\t\tkind: \"error\",\n\t\t\tid: message.id,\n\t\t\tmessage: error instanceof Error ? error.message : String(error),\n\t\t});\n\t}\n});\n`;\n\nfunction createRecursiveWatchWorker(): RecursiveWatchWorker {\n\treturn new Worker(RECURSIVE_WATCH_WORKER_SOURCE, {\n\t\teval: true,\n\t});\n}\n\nfunction isRecursiveWatchMessage(message: unknown): message is RecursiveWatchMessage {\n\tif (typeof message !== \"object\" || message === null || !(\"kind\" in message)) return false;\n\tif (!(\"id\" in message) || typeof message.id !== \"number\") return false;\n\tif (message.kind === \"error\") return \"message\" in message && typeof message.message === \"string\";\n\treturn (\n\t\tmessage.kind === \"event\" &&\n\t\t\"eventType\" in message &&\n\t\ttypeof message.eventType === \"string\" &&\n\t\t\"filename\" in message &&\n\t\t(message.filename === null || typeof message.filename === \"string\")\n\t);\n}\n\n/** Production event source. Linux recursive setup runs off the interactive main thread. */\nexport function createFsWatchEventSource(\n\tonError: (error: unknown, path: string) => void = () => {},\n\toptions: FsWatchEventSourceOptions = {},\n): WatchEventSource {\n\tconst recursiveSubscriptions = new Map<number, { readonly path: string; readonly listener: WatchEventListener }>();\n\tlet recursiveWorker: RecursiveWatchWorker | undefined;\n\tlet nextSubscriptionId = 1;\n\n\tconst ensureRecursiveWorker = (): RecursiveWatchWorker => {\n\t\tif (recursiveWorker) return recursiveWorker;\n\t\tconst worker = (options.createRecursiveWorker ?? createRecursiveWatchWorker)();\n\t\tworker.on(\"message\", (message) => {\n\t\t\tif (!isRecursiveWatchMessage(message)) return;\n\t\t\tconst subscription = recursiveSubscriptions.get(message.id);\n\t\t\tif (!subscription) return;\n\t\t\tif (message.kind === \"event\") {\n\t\t\t\tsubscription.listener(message.eventType, message.filename);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tonError(new Error(message.message), subscription.path);\n\t\t});\n\t\tworker.on(\"error\", (error) => {\n\t\t\tfor (const subscription of recursiveSubscriptions.values()) onError(error, subscription.path);\n\t\t});\n\t\trecursiveWorker = worker;\n\t\treturn worker;\n\t};\n\n\treturn (path, listener, watchOptions) => {\n\t\tif ((options.platform ?? process.platform) === \"linux\" && watchOptions?.recursive) {\n\t\t\tconst id = nextSubscriptionId++;\n\t\t\tconst worker = ensureRecursiveWorker();\n\t\t\trecursiveSubscriptions.set(id, { path, listener });\n\t\t\tworker.postMessage({ kind: \"watch\", id, path });\n\t\t\treturn () => {\n\t\t\t\tif (!recursiveSubscriptions.delete(id)) return;\n\t\t\t\tif (recursiveSubscriptions.size > 0) {\n\t\t\t\t\tworker.postMessage({ kind: \"unwatch\", id });\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\trecursiveWorker = undefined;\n\t\t\t\tvoid worker.terminate().catch((error: unknown) => onError(error, path));\n\t\t\t};\n\t\t}\n\n\t\tconst watcher = watchWithErrorHandler(\n\t\t\tpath,\n\t\t\tlistener,\n\t\t\t() => onError(new Error(`fs.watch failed for ${path}`), path),\n\t\t\t{ recursive: watchOptions?.recursive ?? false },\n\t\t);\n\t\treturn () => watcher?.close();\n\t};\n}\n"]}
+{"version":3,"file":"watch-event-source.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/config-reload/watch-event-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAqBtE,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CrC,CAAC;AAEF,SAAS,0BAA0B;IAClC,OAAO,IAAI,MAAM,CAAC,6BAA6B,EAAE;QAChD,IAAI,EAAE,IAAI;KACV,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC;IACjG,OAAO,CACN,OAAO,CAAC,IAAI,KAAK,OAAO;QACxB,WAAW,IAAI,OAAO;QACtB,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,UAAU,IAAI,OAAO;QACrB,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACnE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,oCAAoC,GAAiC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExG,iGAAiG;AACjG,MAAM,UAAU,wBAAwB,CACvC,UAAkD,GAAG,EAAE,GAAE,CAAC,EAC1D,UAAqC,EAAE;IAEvC,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA4E,CAAC;IACnH,IAAI,eAAiD,CAAC;IACtD,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAE3B,MAAM,qBAAqB,GAAG,GAAyB,EAAE;QACxD,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAC5C,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,0BAA0B,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YAChC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;gBAAE,OAAO;YAC9C,MAAM,YAAY,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY;gBAAE,OAAO;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC3D,OAAO;YACR,CAAC;YACD,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,KAAK,MAAM,YAAY,IAAI,sBAAsB,CAAC,MAAM,EAAE;gBAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QACH,eAAe,GAAG,MAAM,CAAC;QACzB,OAAO,MAAM,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QACvC,IAAI,oCAAoC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;YAC/G,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACvC,sBAAsB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,GAAG,EAAE;gBACX,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,OAAO;gBAC/C,IAAI,sBAAsB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACrC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5C,OAAO;gBACR,CAAC;gBACD,eAAe,GAAG,SAAS,CAAC;gBAC5B,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CACpC,IAAI,EACJ,QAAQ,EACR,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAC7D,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,IAAI,KAAK,EAAE,CAC/C,CAAC;QACF,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC,CAAC;AACH,CAAC","sourcesContent":["import { Worker } from \"node:worker_threads\";\nimport { watchWithErrorHandler } from \"../../../../utils/fs-watch.ts\";\nimport type { WatchEventListener, WatchEventSource } from \"./watch-engine.ts\";\n\nexport interface RecursiveWatchWorker {\n\ton(event: \"message\", listener: (message: unknown) => void): this;\n\ton(event: \"error\", listener: (error: Error) => void): this;\n\tpostMessage(message: unknown): void;\n\tterminate(): Promise<number>;\n}\n\nexport type RecursiveWatchWorkerFactory = () => RecursiveWatchWorker;\n\nexport type FsWatchEventSourceOptions = {\n\treadonly platform?: NodeJS.Platform;\n\treadonly createRecursiveWorker?: RecursiveWatchWorkerFactory;\n};\n\ntype RecursiveWatchMessage =\n\t| { readonly kind: \"event\"; readonly id: number; readonly eventType: string; readonly filename: string | null }\n\t| { readonly kind: \"error\"; readonly id: number; readonly message: string };\n\nconst RECURSIVE_WATCH_WORKER_SOURCE = `\nconst { watch } = require(\"node:fs\");\nconst { parentPort } = require(\"node:worker_threads\");\n\nif (!parentPort) throw new Error(\"Recursive watch worker requires a parent port\");\n\nconst watchers = new Map();\nparentPort.on(\"message\", (message) => {\n\tif (message.kind === \"unwatch\") {\n\t\twatchers.get(message.id)?.close();\n\t\twatchers.delete(message.id);\n\t\treturn;\n\t}\n\tif (message.kind !== \"watch\") return;\n\ttry {\n\t\tconst watcher = watch(\n\t\t\tmessage.path,\n\t\t\t{ recursive: true, encoding: \"utf8\" },\n\t\t\t(eventType, filename) => {\n\t\t\t\tparentPort.postMessage({\n\t\t\t\t\tkind: \"event\",\n\t\t\t\t\tid: message.id,\n\t\t\t\t\teventType,\n\t\t\t\t\tfilename: typeof filename === \"string\" ? filename : null,\n\t\t\t\t});\n\t\t\t},\n\t\t);\n\t\twatcher.on(\"error\", (error) => {\n\t\t\tparentPort.postMessage({\n\t\t\t\tkind: \"error\",\n\t\t\t\tid: message.id,\n\t\t\t\tmessage: error instanceof Error ? error.message : String(error),\n\t\t\t});\n\t\t});\n\t\twatchers.set(message.id, watcher);\n\t} catch (error) {\n\t\tparentPort.postMessage({\n\t\t\tkind: \"error\",\n\t\t\tid: message.id,\n\t\t\tmessage: error instanceof Error ? error.message : String(error),\n\t\t});\n\t}\n});\n`;\n\nfunction createRecursiveWatchWorker(): RecursiveWatchWorker {\n\treturn new Worker(RECURSIVE_WATCH_WORKER_SOURCE, {\n\t\teval: true,\n\t});\n}\n\nfunction isRecursiveWatchMessage(message: unknown): message is RecursiveWatchMessage {\n\tif (typeof message !== \"object\" || message === null || !(\"kind\" in message)) return false;\n\tif (!(\"id\" in message) || typeof message.id !== \"number\") return false;\n\tif (message.kind === \"error\") return \"message\" in message && typeof message.message === \"string\";\n\treturn (\n\t\tmessage.kind === \"event\" &&\n\t\t\"eventType\" in message &&\n\t\ttypeof message.eventType === \"string\" &&\n\t\t\"filename\" in message &&\n\t\t(message.filename === null || typeof message.filename === \"string\")\n\t);\n}\n\n/**\n * Platforms whose recursive fs.watch handles are expensive to create and tear down on the\n * interactive main thread: inotify tree walks on Linux, FSEvents stream teardown on macOS.\n */\nconst WORKER_OFFLOADED_RECURSIVE_PLATFORMS: ReadonlySet<NodeJS.Platform> = new Set([\"linux\", \"darwin\"]);\n\n/** Production event source. Recursive setup and teardown run off the interactive main thread. */\nexport function createFsWatchEventSource(\n\tonError: (error: unknown, path: string) => void = () => {},\n\toptions: FsWatchEventSourceOptions = {},\n): WatchEventSource {\n\tconst recursiveSubscriptions = new Map<number, { readonly path: string; readonly listener: WatchEventListener }>();\n\tlet recursiveWorker: RecursiveWatchWorker | undefined;\n\tlet nextSubscriptionId = 1;\n\n\tconst ensureRecursiveWorker = (): RecursiveWatchWorker => {\n\t\tif (recursiveWorker) return recursiveWorker;\n\t\tconst worker = (options.createRecursiveWorker ?? createRecursiveWatchWorker)();\n\t\tworker.on(\"message\", (message) => {\n\t\t\tif (!isRecursiveWatchMessage(message)) return;\n\t\t\tconst subscription = recursiveSubscriptions.get(message.id);\n\t\t\tif (!subscription) return;\n\t\t\tif (message.kind === \"event\") {\n\t\t\t\tsubscription.listener(message.eventType, message.filename);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tonError(new Error(message.message), subscription.path);\n\t\t});\n\t\tworker.on(\"error\", (error) => {\n\t\t\tfor (const subscription of recursiveSubscriptions.values()) onError(error, subscription.path);\n\t\t});\n\t\trecursiveWorker = worker;\n\t\treturn worker;\n\t};\n\n\treturn (path, listener, watchOptions) => {\n\t\tif (WORKER_OFFLOADED_RECURSIVE_PLATFORMS.has(options.platform ?? process.platform) && watchOptions?.recursive) {\n\t\t\tconst id = nextSubscriptionId++;\n\t\t\tconst worker = ensureRecursiveWorker();\n\t\t\trecursiveSubscriptions.set(id, { path, listener });\n\t\t\tworker.postMessage({ kind: \"watch\", id, path });\n\t\t\treturn () => {\n\t\t\t\tif (!recursiveSubscriptions.delete(id)) return;\n\t\t\t\tif (recursiveSubscriptions.size > 0) {\n\t\t\t\t\tworker.postMessage({ kind: \"unwatch\", id });\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\trecursiveWorker = undefined;\n\t\t\t\tvoid worker.terminate().catch((error: unknown) => onError(error, path));\n\t\t\t};\n\t\t}\n\n\t\tconst watcher = watchWithErrorHandler(\n\t\t\tpath,\n\t\t\tlistener,\n\t\t\t() => onError(new Error(`fs.watch failed for ${path}`), path),\n\t\t\t{ recursive: watchOptions?.recursive ?? false },\n\t\t);\n\t\treturn () => watcher?.close();\n\t};\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.d.ts

@@ -72,6 +72,13 @@ export declare function sanitizeCursorCliDenyCommands(entries: readonly string[]
  * - Force disabled in agent mode is allowed but warns once per session.
  * - Unproven sandbox modes are ignored with one warning per distinct value.
  */
+/**
+ * True while the settings guarantee an unattended agent-mode refusal: force is
+ * requested outside plan mode but `noApprovalAcknowledgedAt` was never set.
+ * Shared by the execution policy and the fallback-eligibility hook so the two
+ * can never disagree about when the lane refuses.
+ */
+export declare function cursorCliForceRefusalPending(input: Pick<CursorCliExecutionPolicyInput, "forceExecution" | "noApprovalAcknowledgedAt" | "executionMode">): boolean;
 export declare function resolveCursorCliExecutionPolicy(input: CursorCliExecutionPolicyInput, session: CursorCliGuardrailSession, denyCommands?: readonly string[]): CursorCliExecutionDecision;
 /**
  * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,2BAA2B,EAA4C,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAA2B,CAAC;AAExG,eAAO,MAAM,wCAAwC,gKACyG,CAAC;AAE/J,eAAO,MAAM,qCAAqC,qLAC6H,CAAC;AAEhL,+FAA+F;AAC/F,eAAO,MAAM,uCAAuC,iMACyI,CAAC;AAE9L,MAAM,MAAM,6BAA6B,GACtC,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,CAAC;AAE3B,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,sCAAsC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClF,mGAAmG;IACnG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,wBAAgB,+BAA+B,IAAI,yBAAyB,CAoB3E;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAC3E;IACA,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD,CAAC;AAEL,wFAAwF;AACxF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAG,sCAAsC,CAAU;IAChE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAEhC,OAAO,EAAE,yBAAyB;CAK9C;AAKD,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,SAAS,MAAM,EAAE,CAiBnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,yBAAyB,EAClC,YAAY,GAAE,SAAS,MAAM,EAAO,GAClC,0BAA0B,CA2B5B;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAmB5F"}
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,2BAA2B,EAA4C,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,eAAO,MAAM,8BAA8B,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAA2B,CAAC;AAExG,eAAO,MAAM,wCAAwC,gKACyG,CAAC;AAE/J,eAAO,MAAM,qCAAqC,qLAC6H,CAAC;AAEhL,+FAA+F;AAC/F,eAAO,MAAM,uCAAuC,iMACyI,CAAC;AAE9L,MAAM,MAAM,6BAA6B,GACtC,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,CAAC;AAE3B,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,sCAAsC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAClF,mGAAmG;IACnG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,wBAAgB,+BAA+B,IAAI,yBAAyB,CAoB3E;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAC3E;IACA,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACvD,CAAC;AAEL,wFAAwF;AACxF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,QAAQ,CAAC,IAAI,EAAG,sCAAsC,CAAU;IAChE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;gBAEhC,OAAO,EAAE,yBAAyB;CAK9C;AAKD,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,SAAS,MAAM,EAAE,CAiBnB;AAED;;;;;;;;;;GAUG;AACH;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC3C,KAAK,EAAE,IAAI,CAAC,6BAA6B,EAAE,gBAAgB,GAAG,0BAA0B,GAAG,eAAe,CAAC,GACzG,OAAO,CAET;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,6BAA6B,EACpC,OAAO,EAAE,yBAAyB,EAClC,YAAY,GAAE,SAAS,MAAM,EAAO,GAClC,0BAA0B,CA2B5B;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAmB5F"}

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js

@@ -74,10 +74,19 @@ export function sanitizeCursorCliDenyCommands(entries, warn) {
  * - Force disabled in agent mode is allowed but warns once per session.
  * - Unproven sandbox modes are ignored with one warning per distinct value.
  */
+/**
+ * True while the settings guarantee an unattended agent-mode refusal: force is
+ * requested outside plan mode but `noApprovalAcknowledgedAt` was never set.
+ * Shared by the execution policy and the fallback-eligibility hook so the two
+ * can never disagree about when the lane refuses.
+ */
+export function cursorCliForceRefusalPending(input) {
+    return input.executionMode !== "plan" && input.forceExecution && input.noApprovalAcknowledgedAt === undefined;
+}
 export function resolveCursorCliExecutionPolicy(input, session, denyCommands = []) {
     const planMode = input.executionMode === "plan";
     const wantsForce = !planMode && input.forceExecution;
-    if (wantsForce && input.noApprovalAcknowledgedAt === undefined) {
+    if (cursorCliForceRefusalPending(input)) {
         const refusal = {
             kind: "refusal",
             code: "no_approval_acknowledgement_required",

package/dist/core/extensions/builtin/cursor-cli-oauth/guardrails.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoC,wCAAwC,EAAE,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAqC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,wCAAwC,GACpD,6JAA6J,CAAC;AAE/J,MAAM,CAAC,MAAM,qCAAqC,GACjD,8KAA8K,CAAC;AAEhL,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uCAAuC,GACnD,4LAA4L,CAAC;AA6B9L,MAAM,UAAU,+BAA+B;IAC9C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,OAAe,EAAE,MAAc,IAAI,EAAW,EAAE;QAClG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,wCAAwC,CACnE,IAAI,GAAG,CAAC,8BAA8B,CAAC,EACvC,CAAC,OAAO,EAAE,EAAE;QACX,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CACD,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,mBAAmB;KACnB,CAAC;AACH,CAAC;AAqBD,wFAAwF;AACxF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAIxD,YAAY,OAAkC;QAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAJf,SAAI,GAAG,sCAA+C,CAAC;QAK/D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAC5C,OAA0B,EAC1B,IAAgC;IAEhC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,4EAA4E,CAAC,CAAC;YACrF,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CACL,uGAAuG,OAAO,EAAE,CAChH,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC9C,KAAoC,EACpC,OAAkC,EAClC,eAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,UAAU,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,OAAO,GAA8B;YAC1C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EAAE,GAAG,wCAAwC,IAAI,qCAAqC,EAAE;YAC/F,mBAAmB,EAAE,qCAAqC;SAC1D,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACrF,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,UAAU;QACjB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW;QACX,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC/B,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEpE,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACtC,OAAO,SAAS,OAAO,GAAG,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,YAA+B;IACrF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,+DAA+D;QAChE,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,MAAM,GAA4B;QACvC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;KACvE,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type CursorCliOauthExecutionMode, createCursorCliOauthSandboxModeValidator } from \"./settings.ts\";\n\n/**\n * Guardrails for unattended Cursor CLI execution.\n *\n * The Cursor CLI runs its own tools the moment `--force` is on the argv, so\n * that decision is never implicit: it requires the explicit\n * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a\n * disabled force merely warns. Command denylists ride along through the\n * per-account HOME's `cli-config.json`, strictly in the probe-proven shape\n * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).\n */\n\n/** Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). */\nexport const CURSOR_CLI_OAUTH_SANDBOX_MODES: readonly [\"enabled\", \"disabled\"] = [\"enabled\", \"disabled\"];\n\nexport const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION =\n\t\"The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.\";\n\nexport const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP =\n\t'Set \"cursorCliOauthProvider.noApprovalAcknowledgedAt\" to the current ISO-8601 timestamp (for example \"2026-08-17T12:00:00.000Z\") in senpi settings to acknowledge this once.';\n\n/** One warning per session when force is disabled in agent mode (contracts block, task 18). */\nexport const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING =\n\t'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to \"plan\" for planning turns that do not need execution.';\n\nexport type CursorCliGuardrailWarningCode =\n\t| \"force_execution_disabled\"\n\t| \"sandbox_mode_ignored\"\n\t| \"deny_command_rejected\";\n\nexport type CursorCliGuardrailWarning = {\n\treadonly kind: \"warning\";\n\treadonly code: CursorCliGuardrailWarningCode;\n\treadonly message: string;\n};\n\nexport type CursorCliExecutionRefusal = {\n\treadonly kind: \"refusal\";\n\treadonly code: \"no_approval_acknowledgement_required\";\n\treadonly message: string;\n\treadonly acknowledgementStep: string;\n};\n\nexport type CursorCliGuardrailSession = {\n\t/** Every warning emitted so far in this session; one-time gates live here. */\n\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t/** Emit a warning once per deduplication key; returns whether it was emitted. */\n\twarn(code: CursorCliGuardrailWarningCode, message: string, key?: string): boolean;\n\t/** Validate a sandbox mode against the probe-proven allowlist, warning once per rejected value. */\n\tvalidateSandboxMode(value: string | undefined): string | undefined;\n};\n\nexport function createCursorCliGuardrailSession(): CursorCliGuardrailSession {\n\tconst warnings: CursorCliGuardrailWarning[] = [];\n\tconst emitted = new Set<string>();\n\tconst warn = (code: CursorCliGuardrailWarningCode, message: string, key: string = code): boolean => {\n\t\tif (emitted.has(key)) return false;\n\t\temitted.add(key);\n\t\twarnings.push({ kind: \"warning\", code, message });\n\t\treturn true;\n\t};\n\tconst validateSandboxMode = createCursorCliOauthSandboxModeValidator(\n\t\tnew Set(CURSOR_CLI_OAUTH_SANDBOX_MODES),\n\t\t(message) => {\n\t\t\twarn(\"sandbox_mode_ignored\", message, `sandbox_mode_ignored:${message}`);\n\t\t},\n\t);\n\treturn {\n\t\twarnings,\n\t\twarn,\n\t\tvalidateSandboxMode,\n\t};\n}\n\nexport type CursorCliExecutionPolicyInput = {\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string | undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly sandboxMode: string | undefined;\n};\n\nexport type CursorCliExecutionDecision =\n\t| { readonly status: \"refused\"; readonly refusal: CursorCliExecutionRefusal }\n\t| {\n\t\t\treadonly status: \"allowed\";\n\t\t\treadonly force: boolean;\n\t\t\treadonly executionMode: CursorCliOauthExecutionMode;\n\t\t\treadonly sandboxMode: string | undefined;\n\t\t\treadonly denyCommands: readonly string[];\n\t\t\t/** Warnings accumulated in the session so far (not only this decision). */\n\t\t\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t  };\n\n/** Typed refusal for an unacknowledged force attempt; never confused with a warning. */\nexport class CursorCliExecutionRefusalError extends Error {\n\treadonly code = \"no_approval_acknowledgement_required\" as const;\n\treadonly refusal: CursorCliExecutionRefusal;\n\n\tconstructor(refusal: CursorCliExecutionRefusal) {\n\t\tsuper(refusal.message);\n\t\tthis.name = \"CursorCliExecutionRefusalError\";\n\t\tthis.refusal = refusal;\n\t}\n}\n\n/** Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. */\nconst GLOB_METACHARACTERS = /[*?[]/u;\n\nexport function sanitizeCursorCliDenyCommands(\n\tentries: readonly string[],\n\twarn?: (message: string) => void,\n): readonly string[] {\n\tconst kept: string[] = [];\n\tfor (const entry of entries) {\n\t\tconst command = entry.trim();\n\t\tif (command.length === 0) {\n\t\t\twarn?.(\"Ignoring an empty Cursor CLI deny command entry (exact full commands only)\");\n\t\t\tcontinue;\n\t\t}\n\t\tif (GLOB_METACHARACTERS.test(command)) {\n\t\t\twarn?.(\n\t\t\t\t`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tkept.push(command);\n\t}\n\treturn kept;\n}\n\n/**\n * Decide whether a turn may run unattended.\n *\n * - `--force` is emitted only in agent mode, only when force is requested, and\n *   only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a\n *   typed refusal naming the acknowledgement step.\n * - Plan mode never emits `--force` (the CLI only plans), so it needs no\n *   acknowledgement.\n * - Force disabled in agent mode is allowed but warns once per session.\n * - Unproven sandbox modes are ignored with one warning per distinct value.\n */\nexport function resolveCursorCliExecutionPolicy(\n\tinput: CursorCliExecutionPolicyInput,\n\tsession: CursorCliGuardrailSession,\n\tdenyCommands: readonly string[] = [],\n): CursorCliExecutionDecision {\n\tconst planMode = input.executionMode === \"plan\";\n\tconst wantsForce = !planMode && input.forceExecution;\n\tif (wantsForce && input.noApprovalAcknowledgedAt === undefined) {\n\t\tconst refusal: CursorCliExecutionRefusal = {\n\t\t\tkind: \"refusal\",\n\t\t\tcode: \"no_approval_acknowledgement_required\",\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,\n\t\t\tacknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,\n\t\t};\n\t\treturn { status: \"refused\", refusal };\n\t}\n\tif (!planMode && !input.forceExecution) {\n\t\tsession.warn(\"force_execution_disabled\", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);\n\t}\n\tconst sandboxMode = session.validateSandboxMode(input.sandboxMode);\n\tconst sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {\n\t\tsession.warn(\"deny_command_rejected\", message, `deny_command_rejected:${message}`);\n\t});\n\treturn {\n\t\tstatus: \"allowed\",\n\t\tforce: wantsForce,\n\t\texecutionMode: input.executionMode,\n\t\tsandboxMode,\n\t\tdenyCommands: sanitizedDenyCommands,\n\t\twarnings: [...session.warnings],\n\t};\n}\n\nconst CLI_CONFIG_RELATIVE_PATH = join(\".cursor\", \"cli-config.json\");\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction shellDenyEntry(command: string): string {\n\treturn `Shell(${command})`;\n}\n\n/**\n * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's\n * `cli-config.json`.\n *\n * The CLI rewrites this file during every invocation (task 2 observed its own\n * keys appearing and `cli-config.json.bad` sidecars for malformed content), so\n * this must run immediately before each spawn, composing with the home-store\n * prepare pass that re-writes `auth.json` on the same cadence. Writes only the\n * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`\n * entries) and preserves every CLI-owned key already present. Writes nothing\n * when no deny commands are configured.\n */\nexport function applyCursorCliDenyConfig(home: string, denyCommands: readonly string[]): void {\n\tif (denyCommands.length === 0) return;\n\tconst configPath = join(home, CLI_CONFIG_RELATIVE_PATH);\n\tlet existing: Record<string, unknown> = {};\n\tif (existsSync(configPath)) {\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(readFileSync(configPath, \"utf8\"));\n\t\t\tif (isRecord(parsed)) existing = parsed;\n\t\t} catch {\n\t\t\t// The CLI quarantines unparseable config as cli-config.json.bad and\n\t\t\t// proceeds with defaults; start from the proven minimal shape.\n\t\t}\n\t}\n\tconst permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};\n\tconst config: Record<string, unknown> = {\n\t\t...existing,\n\t\tpermissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },\n\t};\n\twriteFileSync(configPath, `${JSON.stringify(config, null, \"\\t\")}\\n`, \"utf8\");\n}\n"]}
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAoC,wCAAwC,EAAE,MAAM,eAAe,CAAC;AAE3G;;;;;;;;;GASG;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAqC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,wCAAwC,GACpD,6JAA6J,CAAC;AAE/J,MAAM,CAAC,MAAM,qCAAqC,GACjD,8KAA8K,CAAC;AAEhL,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uCAAuC,GACnD,4LAA4L,CAAC;AA6B9L,MAAM,UAAU,+BAA+B;IAC9C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmC,EAAE,OAAe,EAAE,MAAc,IAAI,EAAW,EAAE;QAClG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,wCAAwC,CACnE,IAAI,GAAG,CAAC,8BAA8B,CAAC,EACvC,CAAC,OAAO,EAAE,EAAE;QACX,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,wBAAwB,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CACD,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,mBAAmB;KACnB,CAAC;AACH,CAAC;AAqBD,wFAAwF;AACxF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAIxD,YAAY,OAAkC;QAC7C,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAJf,SAAI,GAAG,sCAA+C,CAAC;QAK/D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC,MAAM,UAAU,6BAA6B,CAC5C,OAA0B,EAC1B,IAAgC;IAEhC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC,4EAA4E,CAAC,CAAC;YACrF,SAAS;QACV,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CACL,uGAAuG,OAAO,EAAE,CAChH,CAAC;YACF,SAAS;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC3C,KAA2G;IAE3G,OAAO,KAAK,CAAC,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,KAAoC,EACpC,OAAkC,EAClC,eAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC;IACrD,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAA8B;YAC1C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,sCAAsC;YAC5C,OAAO,EAAE,GAAG,wCAAwC,IAAI,qCAAqC,EAAE;YAC/F,mBAAmB,EAAE,qCAAqC;SAC1D,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACrF,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,UAAU;QACjB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW;QACX,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;KAC/B,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEpE,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACtC,OAAO,SAAS,OAAO,GAAG,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,YAA+B;IACrF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACrE,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,GAAG,MAAM,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,+DAA+D;QAChE,CAAC;IACF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,MAAM,GAA4B;QACvC,GAAG,QAAQ;QACX,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;KACvE,CAAC;IACF,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["import { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type CursorCliOauthExecutionMode, createCursorCliOauthSandboxModeValidator } from \"./settings.ts\";\n\n/**\n * Guardrails for unattended Cursor CLI execution.\n *\n * The Cursor CLI runs its own tools the moment `--force` is on the argv, so\n * that decision is never implicit: it requires the explicit\n * `noApprovalAcknowledgedAt` acknowledgement, plan mode never forces, and a\n * disabled force merely warns. Command denylists ride along through the\n * per-account HOME's `cli-config.json`, strictly in the probe-proven shape\n * (task 2: `permissions.deny` with exact full-command `Shell(...)` entries).\n */\n\n/** Sandbox modes the installed CLI accepts (task 2 probe: allowed choices are exactly these). */\nexport const CURSOR_CLI_OAUTH_SANDBOX_MODES: readonly [\"enabled\", \"disabled\"] = [\"enabled\", \"disabled\"];\n\nexport const CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION =\n\t\"The Cursor CLI executes its own tools autonomously: with --force there is no senpi approval, no senpi sandboxing, and no tool-level audit for what it runs.\";\n\nexport const CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP =\n\t'Set \"cursorCliOauthProvider.noApprovalAcknowledgedAt\" to the current ISO-8601 timestamp (for example \"2026-08-17T12:00:00.000Z\") in senpi settings to acknowledge this once.';\n\n/** One warning per session when force is disabled in agent mode (contracts block, task 18). */\nexport const CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING =\n\t'cursor-cli-oauth: forceExecution is disabled in agent mode, so the Cursor CLI will auto-reject every tool call; set executionMode to \"plan\" for planning turns that do not need execution.';\n\nexport type CursorCliGuardrailWarningCode =\n\t| \"force_execution_disabled\"\n\t| \"sandbox_mode_ignored\"\n\t| \"deny_command_rejected\";\n\nexport type CursorCliGuardrailWarning = {\n\treadonly kind: \"warning\";\n\treadonly code: CursorCliGuardrailWarningCode;\n\treadonly message: string;\n};\n\nexport type CursorCliExecutionRefusal = {\n\treadonly kind: \"refusal\";\n\treadonly code: \"no_approval_acknowledgement_required\";\n\treadonly message: string;\n\treadonly acknowledgementStep: string;\n};\n\nexport type CursorCliGuardrailSession = {\n\t/** Every warning emitted so far in this session; one-time gates live here. */\n\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t/** Emit a warning once per deduplication key; returns whether it was emitted. */\n\twarn(code: CursorCliGuardrailWarningCode, message: string, key?: string): boolean;\n\t/** Validate a sandbox mode against the probe-proven allowlist, warning once per rejected value. */\n\tvalidateSandboxMode(value: string | undefined): string | undefined;\n};\n\nexport function createCursorCliGuardrailSession(): CursorCliGuardrailSession {\n\tconst warnings: CursorCliGuardrailWarning[] = [];\n\tconst emitted = new Set<string>();\n\tconst warn = (code: CursorCliGuardrailWarningCode, message: string, key: string = code): boolean => {\n\t\tif (emitted.has(key)) return false;\n\t\temitted.add(key);\n\t\twarnings.push({ kind: \"warning\", code, message });\n\t\treturn true;\n\t};\n\tconst validateSandboxMode = createCursorCliOauthSandboxModeValidator(\n\t\tnew Set(CURSOR_CLI_OAUTH_SANDBOX_MODES),\n\t\t(message) => {\n\t\t\twarn(\"sandbox_mode_ignored\", message, `sandbox_mode_ignored:${message}`);\n\t\t},\n\t);\n\treturn {\n\t\twarnings,\n\t\twarn,\n\t\tvalidateSandboxMode,\n\t};\n}\n\nexport type CursorCliExecutionPolicyInput = {\n\treadonly forceExecution: boolean;\n\treadonly noApprovalAcknowledgedAt: string | undefined;\n\treadonly executionMode: CursorCliOauthExecutionMode;\n\treadonly sandboxMode: string | undefined;\n};\n\nexport type CursorCliExecutionDecision =\n\t| { readonly status: \"refused\"; readonly refusal: CursorCliExecutionRefusal }\n\t| {\n\t\t\treadonly status: \"allowed\";\n\t\t\treadonly force: boolean;\n\t\t\treadonly executionMode: CursorCliOauthExecutionMode;\n\t\t\treadonly sandboxMode: string | undefined;\n\t\t\treadonly denyCommands: readonly string[];\n\t\t\t/** Warnings accumulated in the session so far (not only this decision). */\n\t\t\treadonly warnings: readonly CursorCliGuardrailWarning[];\n\t  };\n\n/** Typed refusal for an unacknowledged force attempt; never confused with a warning. */\nexport class CursorCliExecutionRefusalError extends Error {\n\treadonly code = \"no_approval_acknowledgement_required\" as const;\n\treadonly refusal: CursorCliExecutionRefusal;\n\n\tconstructor(refusal: CursorCliExecutionRefusal) {\n\t\tsuper(refusal.message);\n\t\tthis.name = \"CursorCliExecutionRefusalError\";\n\t\tthis.refusal = refusal;\n\t}\n}\n\n/** Glob breadth is unproven (task 2 probed exact full commands only), so glob-bearing entries are dropped. */\nconst GLOB_METACHARACTERS = /[*?[]/u;\n\nexport function sanitizeCursorCliDenyCommands(\n\tentries: readonly string[],\n\twarn?: (message: string) => void,\n): readonly string[] {\n\tconst kept: string[] = [];\n\tfor (const entry of entries) {\n\t\tconst command = entry.trim();\n\t\tif (command.length === 0) {\n\t\t\twarn?.(\"Ignoring an empty Cursor CLI deny command entry (exact full commands only)\");\n\t\t\tcontinue;\n\t\t}\n\t\tif (GLOB_METACHARACTERS.test(command)) {\n\t\t\twarn?.(\n\t\t\t\t`Ignoring glob-bearing Cursor CLI deny command (exact full commands only; glob support is unproven): ${command}`,\n\t\t\t);\n\t\t\tcontinue;\n\t\t}\n\t\tkept.push(command);\n\t}\n\treturn kept;\n}\n\n/**\n * Decide whether a turn may run unattended.\n *\n * - `--force` is emitted only in agent mode, only when force is requested, and\n *   only after `noApprovalAcknowledgedAt` is set; otherwise the decision is a\n *   typed refusal naming the acknowledgement step.\n * - Plan mode never emits `--force` (the CLI only plans), so it needs no\n *   acknowledgement.\n * - Force disabled in agent mode is allowed but warns once per session.\n * - Unproven sandbox modes are ignored with one warning per distinct value.\n */\n/**\n * True while the settings guarantee an unattended agent-mode refusal: force is\n * requested outside plan mode but `noApprovalAcknowledgedAt` was never set.\n * Shared by the execution policy and the fallback-eligibility hook so the two\n * can never disagree about when the lane refuses.\n */\nexport function cursorCliForceRefusalPending(\n\tinput: Pick<CursorCliExecutionPolicyInput, \"forceExecution\" | \"noApprovalAcknowledgedAt\" | \"executionMode\">,\n): boolean {\n\treturn input.executionMode !== \"plan\" && input.forceExecution && input.noApprovalAcknowledgedAt === undefined;\n}\n\nexport function resolveCursorCliExecutionPolicy(\n\tinput: CursorCliExecutionPolicyInput,\n\tsession: CursorCliGuardrailSession,\n\tdenyCommands: readonly string[] = [],\n): CursorCliExecutionDecision {\n\tconst planMode = input.executionMode === \"plan\";\n\tconst wantsForce = !planMode && input.forceExecution;\n\tif (cursorCliForceRefusalPending(input)) {\n\t\tconst refusal: CursorCliExecutionRefusal = {\n\t\t\tkind: \"refusal\",\n\t\t\tcode: \"no_approval_acknowledgement_required\",\n\t\t\tmessage: `${CURSOR_CLI_OAUTH_NO_APPROVAL_EXPLANATION} ${CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP}`,\n\t\t\tacknowledgementStep: CURSOR_CLI_OAUTH_ACKNOWLEDGEMENT_STEP,\n\t\t};\n\t\treturn { status: \"refused\", refusal };\n\t}\n\tif (!planMode && !input.forceExecution) {\n\t\tsession.warn(\"force_execution_disabled\", CURSOR_CLI_OAUTH_FORCE_DISABLED_WARNING);\n\t}\n\tconst sandboxMode = session.validateSandboxMode(input.sandboxMode);\n\tconst sanitizedDenyCommands = sanitizeCursorCliDenyCommands(denyCommands, (message) => {\n\t\tsession.warn(\"deny_command_rejected\", message, `deny_command_rejected:${message}`);\n\t});\n\treturn {\n\t\tstatus: \"allowed\",\n\t\tforce: wantsForce,\n\t\texecutionMode: input.executionMode,\n\t\tsandboxMode,\n\t\tdenyCommands: sanitizedDenyCommands,\n\t\twarnings: [...session.warnings],\n\t};\n}\n\nconst CLI_CONFIG_RELATIVE_PATH = join(\".cursor\", \"cli-config.json\");\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction shellDenyEntry(command: string): string {\n\treturn `Shell(${command})`;\n}\n\n/**\n * Pre-spawn hook: (re-)apply the deny list to the sandbox HOME's\n * `cli-config.json`.\n *\n * The CLI rewrites this file during every invocation (task 2 observed its own\n * keys appearing and `cli-config.json.bad` sidecars for malformed content), so\n * this must run immediately before each spawn, composing with the home-store\n * prepare pass that re-writes `auth.json` on the same cadence. Writes only the\n * probe-proven shape (`permissions.deny` with exact `Shell(<full command>)`\n * entries) and preserves every CLI-owned key already present. Writes nothing\n * when no deny commands are configured.\n */\nexport function applyCursorCliDenyConfig(home: string, denyCommands: readonly string[]): void {\n\tif (denyCommands.length === 0) return;\n\tconst configPath = join(home, CLI_CONFIG_RELATIVE_PATH);\n\tlet existing: Record<string, unknown> = {};\n\tif (existsSync(configPath)) {\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(readFileSync(configPath, \"utf8\"));\n\t\t\tif (isRecord(parsed)) existing = parsed;\n\t\t} catch {\n\t\t\t// The CLI quarantines unparseable config as cli-config.json.bad and\n\t\t\t// proceeds with defaults; start from the proven minimal shape.\n\t\t}\n\t}\n\tconst permissions = isRecord(existing.permissions) ? { ...existing.permissions } : {};\n\tconst config: Record<string, unknown> = {\n\t\t...existing,\n\t\tpermissions: { ...permissions, deny: denyCommands.map(shellDenyEntry) },\n\t};\n\twriteFileSync(configPath, `${JSON.stringify(config, null, \"\\t\")}\\n`, \"utf8\");\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/index.d.ts

@@ -9,6 +9,7 @@ export type CursorCliOauthExtensionDeps = {
     readonly agentDir?: string;
     readonly store?: CredentialStore;
     readonly readCurrent?: () => Promise<Credential | undefined>;
+    readonly readNativeCredential?: () => Credential | undefined | Promise<Credential | undefined>;
     readonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;
     readonly resolveExecutable?: (settings: {
         executablePath?: string;

package/dist/core/extensions/builtin/cursor-cli-oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;AAKxE,OAAO,EACN,KAAK,8BAA8B,EAInC,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,mEAAmE;AACnE,MAAM,MAAM,2BAA2B,GAAG;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,8BAA8B,CAAC;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;CAC/E,CAAC;AAKF;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,GAAE,2BAAgC,GAAG,IAAI,CAmD9G;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAEtE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;AAOxE,OAAO,EACN,KAAK,8BAA8B,EAInC,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,mEAAmE;AACnE,MAAM,MAAM,2BAA2B,GAAG;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC7D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC/F,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,8BAA8B,CAAC;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;CAC/E,CAAC;AAKF;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,GAAE,2BAAgC,GAAG,IAAI,CA4E9G;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAEtE"}

package/dist/core/extensions/builtin/cursor-cli-oauth/index.js

@@ -2,7 +2,9 @@ import { getAgentDir } from "../../../../config.js";
 import { AuthStorage } from "../../../auth-storage.js";
 import { registerCursorCliAccountCommand } from "./account-command.js";
 import { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from "./executable.js";
+import { cursorCliForceRefusalPending } from "./guardrails.js";
 import { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from "./models.js";
+import { createCursorCliOauthCredentialReader } from "./native-bootstrap.js";
 import { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from "./oauth-login.js";
 import { loadCursorCliOauthProviderSettingsFromDisk, persistCursorCliNoApprovalAcknowledgement, persistCursorCliOauthEnabled, } from "./settings.js";
 import { streamCursorCliOauth } from "./stream.js";
@@ -18,7 +20,25 @@ export function registerCursorCliOauthExtension(pi, deps = {}) {
     const cwd = deps.cwd ?? process.cwd();
     const agentDir = deps.agentDir ?? getAgentDir();
     const store = deps.store ?? AuthStorage.create();
-    const readCurrent = deps.readCurrent ?? (async () => store.read(CURSOR_CLI_OAUTH_PROVIDER_ID));
+    const readCurrent = deps.readCurrent ??
+        createCursorCliOauthCredentialReader({
+            store,
+            readNativeCredential: deps.readNativeCredential ?? (() => store.read("cursor")),
+            // Copying the host's native Cursor credential IS the ambient lane, so it
+            // requires the explicit flag - never merely a logged-in cursor-agent.
+            canBootstrap: () => {
+                const settings = loadSettings(cwd);
+                if (!settings.enabled || settings.explicitlyDisabled)
+                    return false;
+                try {
+                    resolveExecutable(settings);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            },
+        });
     const loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;
     const resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;
     // Todo 21: /cursor-account command plus the reload/shutdown teardown for
@@ -32,6 +52,14 @@ export function registerCursorCliOauthExtension(pi, deps = {}) {
             // Settings, accounts, and the executable are re-resolved inside every
             // turn; nothing captured here outlives a settings or credential change.
             streamSimple: (model, context, options) => streamCursorCliOauth(model, context, options, { cwd, agentDir, store }),
+            // A kill-switched lane, or one whose unacknowledged --force gate
+            // guarantees a refusal, must not consume an implicit fallback-expansion
+            // slot it can never serve. Only deterministic settings-level states
+            // exclude; explicit selection and /login stay available either way.
+            fallbackEligible: () => {
+                const current = loadSettings(cwd);
+                return !current.explicitlyDisabled && !cursorCliForceRefusalPending(current);
+            },
             oauth: createCursorCliOauthConfig({
                 readCurrent,
                 readSettings: () => loadSettings(cwd),

package/dist/core/extensions/builtin/cursor-cli-oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAahE,MAAM,wBAAwB,GAAG,CAAC,QAAqC,EAAU,EAAE,CAClF,4BAA4B,CAAC,EAAE,GAAG,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAgB,EAAE,OAAoC,EAAE;IACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0CAA0C,CAAC;IACrF,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;IAE7E,yEAAyE;IACzE,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,CAAC,MAAsC,EAAQ,EAAE;QACjE,EAAE,CAAC,gBAAgB,CAAC,4BAA4B,EAAE;YACjD,OAAO,EAAE,4BAA4B;YACrC,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,sEAAsE;YACtE,wEAAwE;YACxE,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CACzC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxE,KAAK,EAAE,0BAA0B,CAAC;gBACjC,WAAW;gBACX,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;gBACrC,iBAAiB;gBACjB,sBAAsB,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC1G,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC;aACvE,CAAC;SACF,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,kDAAkD;IAClD,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,4BAA4B,CAAC;QACjC,QAAQ;QACR,QAAQ,EAAE;YACT,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;SACvC;QACD,IAAI,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAAE;KACjG,CAAC;SACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACX,mFAAmF;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAgB;IAC/D,+BAA+B,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport type { ExtensionAPI, ProviderModelConfig } from \"../../types.ts\";\nimport { registerCursorCliAccountCommand } from \"./account-command.ts\";\nimport { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from \"./executable.ts\";\nimport { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from \"./models.ts\";\nimport { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from \"./oauth-login.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\nimport { streamCursorCliOauth } from \"./stream.ts\";\n\nexport { CURSOR_CLI_OAUTH_PROVIDER_ID } from \"./oauth-login.ts\";\nexport type { CursorCliStreamDeps } from \"./stream.ts\";\n\n/** Injectable seams; every default resolves real on-disk state. */\nexport type CursorCliOauthExtensionDeps = {\n\treadonly cwd?: string;\n\treadonly agentDir?: string;\n\treadonly store?: CredentialStore;\n\treadonly readCurrent?: () => Promise<Credential | undefined>;\n\treadonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;\n\treadonly resolveExecutable?: (settings: { executablePath?: string }) => string;\n};\n\nconst defaultResolveExecutable = (settings: { executablePath?: string }): string =>\n\tresolveCursorAgentExecutable({ ...defaultCursorAgentExecutableDeps(), settings });\n\n/**\n * Registers the cursor-cli-oauth provider lane. Registration is unconditional:\n * the provider ships with the offline model fallback and reports availability\n * through the oauth `check`, so a missing cursor-agent binary never hides the\n * lane - it only makes `check` name the install guidance.\n */\nexport function registerCursorCliOauthExtension(pi: ExtensionAPI, deps: CursorCliOauthExtensionDeps = {}): void {\n\tconst cwd = deps.cwd ?? process.cwd();\n\tconst agentDir = deps.agentDir ?? getAgentDir();\n\tconst store = deps.store ?? AuthStorage.create();\n\tconst readCurrent = deps.readCurrent ?? (async () => store.read(CURSOR_CLI_OAUTH_PROVIDER_ID));\n\tconst loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;\n\tconst resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;\n\n\t// Todo 21: /cursor-account command plus the reload/shutdown teardown for\n\t// this extension generation (minimal additive wiring).\n\tregisterCursorCliAccountCommand(pi);\n\n\tconst register = (models: readonly ProviderModelConfig[]): void => {\n\t\tpi.registerProvider(CURSOR_CLI_OAUTH_PROVIDER_ID, {\n\t\t\tbaseUrl: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tapi: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tmodels: models.map((entry) => ({ ...entry })),\n\t\t\t// Settings, accounts, and the executable are re-resolved inside every\n\t\t\t// turn; nothing captured here outlives a settings or credential change.\n\t\t\tstreamSimple: (model, context, options) =>\n\t\t\t\tstreamCursorCliOauth(model, context, options, { cwd, agentDir, store }),\n\t\t\toauth: createCursorCliOauthConfig({\n\t\t\t\treadCurrent,\n\t\t\t\treadSettings: () => loadSettings(cwd),\n\t\t\t\tresolveExecutable,\n\t\t\t\tpersistAcknowledgement: (acknowledgedAt) => persistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t\t\t\tpersistEnabled: (enabled) => persistCursorCliOauthEnabled(cwd, enabled),\n\t\t\t}),\n\t\t});\n\t};\n\n\t// Register immediately with the offline fallback so a missing, hanging, or\n\t// broken cursor-agent can never delay or block provider registration; the\n\t// probe-backed catalog replaces it once resolved.\n\tregister(STATIC_CURSOR_CLI_MODELS);\n\tconst settings = loadSettings(cwd);\n\tvoid resolveCursorCliModelCatalog({\n\t\tagentDir,\n\t\tsettings: {\n\t\t\tmodelCatalogTtlHours: settings.modelCatalogTtlHours,\n\t\t\texecutablePath: settings.executablePath,\n\t\t},\n\t\tdeps: { resolveExecutable: () => resolveExecutable({ executablePath: settings.executablePath }) },\n\t})\n\t\t.then((models) => {\n\t\t\tconst resolved = models.map((entry) => entry.id).join(\"\\n\");\n\t\t\tif (resolved !== STATIC_CURSOR_CLI_MODELS.map((entry) => entry.id).join(\"\\n\")) register(models);\n\t\t})\n\t\t.catch(() => {\n\t\t\t// The loader degrades to the static fallback itself; keep the registered fallback.\n\t\t});\n}\n\nexport default function cursorCliOauthExtension(pi: ExtensionAPI): void {\n\tregisterCursorCliOauthExtension(pi);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,oCAAoC,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAEN,0CAA0C,EAC1C,yCAAyC,EACzC,4BAA4B,GAC5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAchE,MAAM,wBAAwB,GAAG,CAAC,QAAqC,EAAU,EAAE,CAClF,4BAA4B,CAAC,EAAE,GAAG,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAgB,EAAE,OAAoC,EAAE;IACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;IACjD,MAAM,WAAW,GAChB,IAAI,CAAC,WAAW;QAChB,oCAAoC,CAAC;YACpC,KAAK;YACL,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/E,yEAAyE;YACzE,sEAAsE;YACtE,YAAY,EAAE,GAAG,EAAE;gBAClB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,kBAAkB;oBAAE,OAAO,KAAK,CAAC;gBACnE,IAAI,CAAC;oBACJ,iBAAiB,CAAC,QAAQ,CAAC,CAAC;oBAC5B,OAAO,IAAI,CAAC;gBACb,CAAC;gBAAC,MAAM,CAAC;oBACR,OAAO,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;SACD,CAAC,CAAC;IACJ,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,0CAA0C,CAAC;IACrF,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,wBAAwB,CAAC;IAE7E,yEAAyE;IACzE,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,CAAC,MAAsC,EAAQ,EAAE;QACjE,EAAE,CAAC,gBAAgB,CAAC,4BAA4B,EAAE;YACjD,OAAO,EAAE,4BAA4B;YACrC,GAAG,EAAE,4BAA4B;YACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,sEAAsE;YACtE,wEAAwE;YACxE,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CACzC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACxE,iEAAiE;YACjE,wEAAwE;YACxE,oEAAoE;YACpE,oEAAoE;YACpE,gBAAgB,EAAE,GAAG,EAAE;gBACtB,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClC,OAAO,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC;YAC9E,CAAC;YACD,KAAK,EAAE,0BAA0B,CAAC;gBACjC,WAAW;gBACX,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC;gBACrC,iBAAiB;gBACjB,sBAAsB,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,yCAAyC,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC1G,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC;aACvE,CAAC;SACF,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,kDAAkD;IAClD,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,4BAA4B,CAAC;QACjC,QAAQ;QACR,QAAQ,EAAE;YACT,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YACnD,cAAc,EAAE,QAAQ,CAAC,cAAc;SACvC;QACD,IAAI,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAAE;KACjG,CAAC;SACA,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACX,mFAAmF;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAAC,EAAgB;IAC/D,+BAA+B,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC","sourcesContent":["import type { Credential, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { getAgentDir } from \"../../../../config.ts\";\nimport { AuthStorage } from \"../../../auth-storage.ts\";\nimport type { ExtensionAPI, ProviderModelConfig } from \"../../types.ts\";\nimport { registerCursorCliAccountCommand } from \"./account-command.ts\";\nimport { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from \"./executable.ts\";\nimport { cursorCliForceRefusalPending } from \"./guardrails.ts\";\nimport { resolveCursorCliModelCatalog, STATIC_CURSOR_CLI_MODELS } from \"./models.ts\";\nimport { createCursorCliOauthCredentialReader } from \"./native-bootstrap.ts\";\nimport { CURSOR_CLI_OAUTH_PROVIDER_ID, createCursorCliOauthConfig } from \"./oauth-login.ts\";\nimport {\n\ttype CursorCliOauthProviderSettings,\n\tloadCursorCliOauthProviderSettingsFromDisk,\n\tpersistCursorCliNoApprovalAcknowledgement,\n\tpersistCursorCliOauthEnabled,\n} from \"./settings.ts\";\nimport { streamCursorCliOauth } from \"./stream.ts\";\n\nexport { CURSOR_CLI_OAUTH_PROVIDER_ID } from \"./oauth-login.ts\";\nexport type { CursorCliStreamDeps } from \"./stream.ts\";\n\n/** Injectable seams; every default resolves real on-disk state. */\nexport type CursorCliOauthExtensionDeps = {\n\treadonly cwd?: string;\n\treadonly agentDir?: string;\n\treadonly store?: CredentialStore;\n\treadonly readCurrent?: () => Promise<Credential | undefined>;\n\treadonly readNativeCredential?: () => Credential | undefined | Promise<Credential | undefined>;\n\treadonly loadSettings?: (cwd: string) => CursorCliOauthProviderSettings;\n\treadonly resolveExecutable?: (settings: { executablePath?: string }) => string;\n};\n\nconst defaultResolveExecutable = (settings: { executablePath?: string }): string =>\n\tresolveCursorAgentExecutable({ ...defaultCursorAgentExecutableDeps(), settings });\n\n/**\n * Registers the cursor-cli-oauth provider lane. Registration is unconditional:\n * the provider ships with the offline model fallback and reports availability\n * through the oauth `check`, so a missing cursor-agent binary never hides the\n * lane - it only makes `check` name the install guidance.\n */\nexport function registerCursorCliOauthExtension(pi: ExtensionAPI, deps: CursorCliOauthExtensionDeps = {}): void {\n\tconst cwd = deps.cwd ?? process.cwd();\n\tconst agentDir = deps.agentDir ?? getAgentDir();\n\tconst store = deps.store ?? AuthStorage.create();\n\tconst readCurrent =\n\t\tdeps.readCurrent ??\n\t\tcreateCursorCliOauthCredentialReader({\n\t\t\tstore,\n\t\t\treadNativeCredential: deps.readNativeCredential ?? (() => store.read(\"cursor\")),\n\t\t\t// Copying the host's native Cursor credential IS the ambient lane, so it\n\t\t\t// requires the explicit flag - never merely a logged-in cursor-agent.\n\t\t\tcanBootstrap: () => {\n\t\t\t\tconst settings = loadSettings(cwd);\n\t\t\t\tif (!settings.enabled || settings.explicitlyDisabled) return false;\n\t\t\t\ttry {\n\t\t\t\t\tresolveExecutable(settings);\n\t\t\t\t\treturn true;\n\t\t\t\t} catch {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t},\n\t\t});\n\tconst loadSettings = deps.loadSettings ?? loadCursorCliOauthProviderSettingsFromDisk;\n\tconst resolveExecutable = deps.resolveExecutable ?? defaultResolveExecutable;\n\n\t// Todo 21: /cursor-account command plus the reload/shutdown teardown for\n\t// this extension generation (minimal additive wiring).\n\tregisterCursorCliAccountCommand(pi);\n\n\tconst register = (models: readonly ProviderModelConfig[]): void => {\n\t\tpi.registerProvider(CURSOR_CLI_OAUTH_PROVIDER_ID, {\n\t\t\tbaseUrl: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tapi: CURSOR_CLI_OAUTH_PROVIDER_ID,\n\t\t\tmodels: models.map((entry) => ({ ...entry })),\n\t\t\t// Settings, accounts, and the executable are re-resolved inside every\n\t\t\t// turn; nothing captured here outlives a settings or credential change.\n\t\t\tstreamSimple: (model, context, options) =>\n\t\t\t\tstreamCursorCliOauth(model, context, options, { cwd, agentDir, store }),\n\t\t\t// A kill-switched lane, or one whose unacknowledged --force gate\n\t\t\t// guarantees a refusal, must not consume an implicit fallback-expansion\n\t\t\t// slot it can never serve. Only deterministic settings-level states\n\t\t\t// exclude; explicit selection and /login stay available either way.\n\t\t\tfallbackEligible: () => {\n\t\t\t\tconst current = loadSettings(cwd);\n\t\t\t\treturn !current.explicitlyDisabled && !cursorCliForceRefusalPending(current);\n\t\t\t},\n\t\t\toauth: createCursorCliOauthConfig({\n\t\t\t\treadCurrent,\n\t\t\t\treadSettings: () => loadSettings(cwd),\n\t\t\t\tresolveExecutable,\n\t\t\t\tpersistAcknowledgement: (acknowledgedAt) => persistCursorCliNoApprovalAcknowledgement(cwd, acknowledgedAt),\n\t\t\t\tpersistEnabled: (enabled) => persistCursorCliOauthEnabled(cwd, enabled),\n\t\t\t}),\n\t\t});\n\t};\n\n\t// Register immediately with the offline fallback so a missing, hanging, or\n\t// broken cursor-agent can never delay or block provider registration; the\n\t// probe-backed catalog replaces it once resolved.\n\tregister(STATIC_CURSOR_CLI_MODELS);\n\tconst settings = loadSettings(cwd);\n\tvoid resolveCursorCliModelCatalog({\n\t\tagentDir,\n\t\tsettings: {\n\t\t\tmodelCatalogTtlHours: settings.modelCatalogTtlHours,\n\t\t\texecutablePath: settings.executablePath,\n\t\t},\n\t\tdeps: { resolveExecutable: () => resolveExecutable({ executablePath: settings.executablePath }) },\n\t})\n\t\t.then((models) => {\n\t\t\tconst resolved = models.map((entry) => entry.id).join(\"\\n\");\n\t\t\tif (resolved !== STATIC_CURSOR_CLI_MODELS.map((entry) => entry.id).join(\"\\n\")) register(models);\n\t\t})\n\t\t.catch(() => {\n\t\t\t// The loader degrades to the static fallback itself; keep the registered fallback.\n\t\t});\n}\n\nexport default function cursorCliOauthExtension(pi: ExtensionAPI): void {\n\tregisterCursorCliOauthExtension(pi);\n}\n"]}

package/dist/core/extensions/builtin/cursor-cli-oauth/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/models.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAW1D,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AAqDF,eAAO,MAAM,wBAAwB,EAAE,SAAS,mBAAmB,EAElE,CAAC;AAEF,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAiBpF;AA6ID,0FAA0F;AAC1F,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,mCAAmC,GAC1C,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAkCzC"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/cursor-cli-oauth/models.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAU1D,MAAM,MAAM,6BAA6B,GAAG;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACvC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,mCAAmC,GAAG;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACnD,CAAC;AA+DF,eAAO,MAAM,wBAAwB,EAAE,SAAS,mBAAmB,EAA+C,CAAC;AAEnH,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAiBpF;AA6ID,0FAA0F;AAC1F,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,mCAAmC,GAC1C,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAkCzC"}

package/dist/core/extensions/builtin/cursor-cli-oauth/models.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { mkdir, mkdtemp, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { normalizeCursorCatalog } from "@earendil-works/pi-ai";
 import { defaultCursorAgentExecutableDeps, resolveCursorAgentExecutable } from "./executable.js";
 const MODEL_PROBE_TIMEOUT_MS = 15_000;
 const DEFAULT_MODEL_CATALOG_TTL_HOURS = 24;
@@ -9,7 +10,6 @@ const ANSI_ESCAPE_SEQUENCE = /\u001B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g;
 const MODEL_LINE = /^(\S+)\s+-\s+(.+)$/;
 const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._/:+-]*$/;
 const MISLEADING_ERROR_LINE = /^\s*(?:error|failed|failure)(?=\s|:|-|$)/i;
-const REASONING_SUFFIX = /(?:^|-)(?:thinking(?:-(?:low|medium|high|xhigh|max))?|low|medium|high|xhigh|max)(?:-fast)?$/i;
 const STATIC_MODEL_DEFINITIONS = [
     { id: "auto", label: "Auto" },
     { id: "composer-2.5", label: "Composer 2.5 (200K context)" },
@@ -30,27 +30,33 @@ const STATIC_MODEL_DEFINITIONS = [
 function stripAnsi(value) {
     return value.replace(ANSI_ESCAPE_SEQUENCE, "");
 }
-function contextWindowFor(id, label) {
-    if (/\b1\s*M\b/i.test(label))
-        return 1_000_000;
-    if (id.toLowerCase().startsWith("claude-") && /\b300\s*K\b/i.test(label))
-        return 300_000;
-    if (id.toLowerCase().startsWith("gpt-") && /\b272\s*K\b/i.test(label))
-        return 272_000;
-    return 200_000;
-}
-function modelEntry(id, label) {
-    return {
-        id,
-        name: label,
-        reasoning: REASONING_SUFFIX.test(id),
+function normalizeEntries(raw) {
+    return normalizeCursorCatalog(raw.map(({ id, label }) => ({ id, name: label, input: ["text"], cursorMaxMode: false }))).map((entry) => ({
+        id: entry.id,
+        name: entry.name,
+        reasoning: entry.reasoning,
+        ...(entry.thinkingLevelMap ? { thinkingLevelMap: entry.thinkingLevelMap } : {}),
         input: ["text"],
         cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: contextWindowFor(id, label),
+        contextWindow: entry.window,
         maxTokens: 64_000,
-    };
+        ...(entry.representativeVariantId !== undefined && entry.representativeVariantId !== entry.id
+            ? { upstreamModelId: entry.representativeVariantId }
+            : {}),
+        compat: {
+            ...(entry.capabilityId !== undefined && entry.representativeVariantId !== undefined
+                ? {
+                    cursorReasoning: {
+                        capabilityId: entry.capabilityId,
+                        ...(entry.thinkingMode !== undefined ? { thinkingMode: entry.thinkingMode } : {}),
+                        representativeVariantId: entry.representativeVariantId,
+                    },
+                }
+                : {}),
+        },
+    }));
 }
-export const STATIC_CURSOR_CLI_MODELS = STATIC_MODEL_DEFINITIONS.map(({ id, label }) => modelEntry(id, label));
+export const STATIC_CURSOR_CLI_MODELS = normalizeEntries(STATIC_MODEL_DEFINITIONS);
 /** Parse the complete `cursor-agent models` listing into extension provider entries. */
 export function parseCursorAgentModelsListing(listing) {
     const plainListing = stripAnsi(listing);
@@ -58,7 +64,7 @@ export function parseCursorAgentModelsListing(listing) {
     if (lines.some((line) => MISLEADING_ERROR_LINE.test(line)))
         return [];
     const seen = new Set();
-    const models = [];
+    const raw = [];
     for (const rawLine of lines) {
         const match = MODEL_LINE.exec(rawLine.trim());
         if (!match)
@@ -68,9 +74,9 @@ export function parseCursorAgentModelsListing(listing) {
         if (!MODEL_ID.test(id) || label.length === 0 || seen.has(id))
             continue;
         seen.add(id);
-        models.push(modelEntry(id, label));
+        raw.push({ id, label });
     }
-    return models;
+    return normalizeEntries(raw);
 }
 async function runModelsProbe(executable, stdoutPath, timeoutMs) {
     const output = await open(stdoutPath, "w");
@@ -161,7 +167,7 @@ function parseCachedCatalog(contents) {
     if (typeof cachedAt !== "number" || !Number.isFinite(cachedAt) || !Array.isArray(models) || models.length === 0) {
         return undefined;
     }
-    const normalized = [];
+    const rawCached = [];
     const seen = new Set();
     for (const candidate of models) {
         if (typeof candidate !== "object" || candidate === null || !("id" in candidate) || !("name" in candidate)) {
@@ -177,9 +183,9 @@ function parseCachedCatalog(contents) {
             return undefined;
         }
         seen.add(id);
-        normalized.push(modelEntry(id, name));
+        rawCached.push({ id, label: name });
     }
-    return { cachedAt, models: normalized };
+    return { cachedAt, models: normalizeEntries(rawCached) };
 }
 async function readFreshCache(cachePath, now, ttlMs, deps) {
     try {