@code-yeongyu/senpi 2026.9.7 → 2026.9.9-2

package/dist/core/extensions/builtin/oauth-login-interaction.js

@@ -0,0 +1,77 @@
+/**
+ * Relay a provider OAuth login (`modelRuntime.login`) onto the extension UI of
+ * a slash command such as `/gpt-account add`, mirroring what the `/login`
+ * dialog and `modes/rpc/login-prompts.ts` do for their surfaces.
+ *
+ * Two decisions are not visible from the code alone: every dialog is bound to
+ * the per-prompt `AuthPrompt.signal` as well as the command signal, so a
+ * manual-code dialog is released when the provider's local callback server
+ * wins the race (`loginOpenAICodex`); and `auth_url` opens the browser only in
+ * the TUI, because an RPC client renders the notice on its own machine.
+ */
+import { openBrowser as openPlatformBrowser } from "../../../utils/open-browser.js";
+export const LOGIN_CANCELLED_MESSAGE = "Login cancelled";
+export function createExtensionLoginInteraction(ctx, options) {
+    const openBrowser = options.openBrowser ?? openPlatformBrowser;
+    return {
+        signal: ctx.signal,
+        prompt: (prompt) => relayPrompt(ctx, prompt),
+        notify: (event) => relayEvent(ctx, event, options.providerLabel, openBrowser),
+    };
+}
+function dialogSignal(commandSignal, promptSignal) {
+    if (commandSignal && promptSignal)
+        return AbortSignal.any([commandSignal, promptSignal]);
+    return commandSignal ?? promptSignal;
+}
+async function relayPrompt(ctx, prompt) {
+    const signal = dialogSignal(ctx.signal, prompt.signal);
+    if (signal?.aborted)
+        throw new Error(LOGIN_CANCELLED_MESSAGE);
+    const dialogOptions = signal ? { signal } : undefined;
+    const answer = await answerPrompt(ctx, prompt, dialogOptions);
+    if (answer === undefined || signal?.aborted)
+        throw new Error(LOGIN_CANCELLED_MESSAGE);
+    return answer;
+}
+async function answerPrompt(ctx, prompt, dialogOptions) {
+    switch (prompt.type) {
+        case "select": {
+            const label = await ctx.ui.select(prompt.message, prompt.options.map((option) => option.label), dialogOptions);
+            return prompt.options.find((option) => option.label === label)?.id;
+        }
+        case "text":
+        case "secret":
+        case "manual_code":
+            return ctx.ui.input(prompt.message, prompt.placeholder, dialogOptions);
+    }
+}
+function relayEvent(ctx, event, providerLabel, openBrowser) {
+    switch (event.type) {
+        case "auth_url": {
+            if (ctx.mode === "tui")
+                openBrowser(event.url);
+            const lines = [`Open this URL to authorize ${providerLabel}:`, event.url];
+            if (event.instructions)
+                lines.push(event.instructions);
+            ctx.ui.notify(lines.join("\n"), "info");
+            return;
+        }
+        case "device_code":
+            ctx.ui.notify([
+                `Open this URL to authorize ${providerLabel}:`,
+                event.verificationUri,
+                `Enter code: ${event.userCode}`,
+            ].join("\n"), "info");
+            return;
+        case "info": {
+            const links = (event.links ?? []).map((link) => (link.label ? `${link.label}: ${link.url}` : link.url));
+            ctx.ui.notify([event.message, ...links].join("\n"), "info");
+            return;
+        }
+        case "progress":
+            ctx.ui.notify(event.message, "info");
+            return;
+    }
+}
+//# sourceMappingURL=oauth-login-interaction.js.map

package/dist/core/extensions/builtin/oauth-login-interaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-login-interaction.js","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/oauth-login-interaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAAiB,CAAC;AAWzD,MAAM,UAAU,+BAA+B,CAC9C,GAAwB,EACxB,OAAyC;IAEzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC/D,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC;KAC7E,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,aAAsC,EACtC,YAAqC;IAErC,IAAI,aAAa,IAAI,YAAY;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;IACzF,OAAO,aAAa,IAAI,YAAY,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAwB,EAAE,MAAkB;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,GAAwB,EACxB,MAAkB,EAClB,aAAkD;IAElD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAChC,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,aAAa,CACb,CAAC;YACF,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa;YACjB,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAClB,GAAwB,EACxB,KAAgB,EAChB,aAAqB,EACrB,WAAkC;IAElC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU,CAAC,CAAC,CAAC;YACjB,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;gBAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,CAAC,8BAA8B,aAAa,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1E,IAAI,KAAK,CAAC,YAAY;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACvD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACxC,OAAO;QACR,CAAC;QACD,KAAK,aAAa;YACjB,GAAG,CAAC,EAAE,CAAC,MAAM,CACZ;gBACC,8BAA8B,aAAa,GAAG;gBAC9C,KAAK,CAAC,eAAe;gBACrB,eAAe,KAAK,CAAC,QAAQ,EAAE;aAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACN,CAAC;YACF,OAAO;QACR,KAAK,MAAM,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACxG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACR,CAAC;QACD,KAAK,UAAU;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO;IACT,CAAC;AACF,CAAC","sourcesContent":["/**\n * Relay a provider OAuth login (`modelRuntime.login`) onto the extension UI of\n * a slash command such as `/gpt-account add`, mirroring what the `/login`\n * dialog and `modes/rpc/login-prompts.ts` do for their surfaces.\n *\n * Two decisions are not visible from the code alone: every dialog is bound to\n * the per-prompt `AuthPrompt.signal` as well as the command signal, so a\n * manual-code dialog is released when the provider's local callback server\n * wins the race (`loginOpenAICodex`); and `auth_url` opens the browser only in\n * the TUI, because an RPC client renders the notice on its own machine.\n */\n\nimport type { AuthEvent, AuthInteraction, AuthPrompt } from \"@earendil-works/pi-ai\";\nimport { openBrowser as openPlatformBrowser } from \"../../../utils/open-browser.ts\";\nimport type { ExtensionCommandContext } from \"../types.ts\";\n\nexport const LOGIN_CANCELLED_MESSAGE = \"Login cancelled\";\n\nexport interface ExtensionLoginInteractionOptions {\n\t/** Provider name rendered in notices, e.g. \"OpenAI Codex OAuth\". */\n\treadonly providerLabel: string;\n\t/** Browser launcher for `auth_url` events in the TUI; tests inject a recorder. */\n\treadonly openBrowser?: ((url: string) => void) | undefined;\n}\n\ntype LoginCommandContext = Pick<ExtensionCommandContext, \"mode\" | \"signal\" | \"ui\">;\n\nexport function createExtensionLoginInteraction(\n\tctx: LoginCommandContext,\n\toptions: ExtensionLoginInteractionOptions,\n): AuthInteraction {\n\tconst openBrowser = options.openBrowser ?? openPlatformBrowser;\n\treturn {\n\t\tsignal: ctx.signal,\n\t\tprompt: (prompt) => relayPrompt(ctx, prompt),\n\t\tnotify: (event) => relayEvent(ctx, event, options.providerLabel, openBrowser),\n\t};\n}\n\nfunction dialogSignal(\n\tcommandSignal: AbortSignal | undefined,\n\tpromptSignal: AbortSignal | undefined,\n): AbortSignal | undefined {\n\tif (commandSignal && promptSignal) return AbortSignal.any([commandSignal, promptSignal]);\n\treturn commandSignal ?? promptSignal;\n}\n\nasync function relayPrompt(ctx: LoginCommandContext, prompt: AuthPrompt): Promise<string> {\n\tconst signal = dialogSignal(ctx.signal, prompt.signal);\n\tif (signal?.aborted) throw new Error(LOGIN_CANCELLED_MESSAGE);\n\tconst dialogOptions = signal ? { signal } : undefined;\n\tconst answer = await answerPrompt(ctx, prompt, dialogOptions);\n\tif (answer === undefined || signal?.aborted) throw new Error(LOGIN_CANCELLED_MESSAGE);\n\treturn answer;\n}\n\nasync function answerPrompt(\n\tctx: LoginCommandContext,\n\tprompt: AuthPrompt,\n\tdialogOptions: { signal: AbortSignal } | undefined,\n): Promise<string | undefined> {\n\tswitch (prompt.type) {\n\t\tcase \"select\": {\n\t\t\tconst label = await ctx.ui.select(\n\t\t\t\tprompt.message,\n\t\t\t\tprompt.options.map((option) => option.label),\n\t\t\t\tdialogOptions,\n\t\t\t);\n\t\t\treturn prompt.options.find((option) => option.label === label)?.id;\n\t\t}\n\t\tcase \"text\":\n\t\tcase \"secret\":\n\t\tcase \"manual_code\":\n\t\t\treturn ctx.ui.input(prompt.message, prompt.placeholder, dialogOptions);\n\t}\n}\n\nfunction relayEvent(\n\tctx: LoginCommandContext,\n\tevent: AuthEvent,\n\tproviderLabel: string,\n\topenBrowser: (url: string) => void,\n): void {\n\tswitch (event.type) {\n\t\tcase \"auth_url\": {\n\t\t\tif (ctx.mode === \"tui\") openBrowser(event.url);\n\t\t\tconst lines = [`Open this URL to authorize ${providerLabel}:`, event.url];\n\t\t\tif (event.instructions) lines.push(event.instructions);\n\t\t\tctx.ui.notify(lines.join(\"\\n\"), \"info\");\n\t\t\treturn;\n\t\t}\n\t\tcase \"device_code\":\n\t\t\tctx.ui.notify(\n\t\t\t\t[\n\t\t\t\t\t`Open this URL to authorize ${providerLabel}:`,\n\t\t\t\t\tevent.verificationUri,\n\t\t\t\t\t`Enter code: ${event.userCode}`,\n\t\t\t\t].join(\"\\n\"),\n\t\t\t\t\"info\",\n\t\t\t);\n\t\t\treturn;\n\t\tcase \"info\": {\n\t\t\tconst links = (event.links ?? []).map((link) => (link.label ? `${link.label}: ${link.url}` : link.url));\n\t\t\tctx.ui.notify([event.message, ...links].join(\"\\n\"), \"info\");\n\t\t\treturn;\n\t\t}\n\t\tcase \"progress\":\n\t\t\tctx.ui.notify(event.message, \"info\");\n\t\t\treturn;\n\t}\n}\n"]}

package/dist/core/extensions/builtin/permission-system/external-dir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-dir.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/external-dir.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcpD;AAkDD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAatE;AAgFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAgC3E"}
+{"version":3,"file":"external-dir.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/external-dir.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcpD;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAetE;AAgFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAgC3E"}

package/dist/core/extensions/builtin/permission-system/external-dir.js

@@ -1,6 +1,6 @@
-import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { realpathWithoutOpen } from "../../../../utils/paths.js";
 export function expandHome(inputPath) {
     if (inputPath === "~") {
         return os.homedir();
@@ -16,59 +16,13 @@ export function expandHome(inputPath) {
     }
     return inputPath;
 }
-/** Symlink hops allowed while resolving one path; realpath(3) reports ELOOP past this. */
-const MAX_SYMLINK_HOPS = 40;
-function splitComponents(normalizedPath) {
-    const { root } = path.parse(normalizedPath);
-    const parts = normalizedPath
-        .slice(root.length)
-        .split(path.sep)
-        .filter((part) => part.length > 0);
-    return { root, parts };
-}
-/**
- * Resolve symlinks the way realpath(3) does — one lstat/readlink per component — without ever
- * open(2)-ing a component. Bun's `fs.realpath*` opens every directory it resolves, so an autofs
- * trigger such as macOS `/home` blocks the whole process (the classifier runs on the host main
- * thread, freezing the TUI) and an execute-only directory fails with EACCES; lstat needs only
- * search permission and never mounts anything. Components from the first missing one onward are
- * kept verbatim, so a file that does not exist yet still lands where its symlinked parent points.
- */
-function normalizePath(inputPath) {
-    const { root, parts } = splitComponents(path.normalize(inputPath));
-    const pending = [...parts];
-    let resolved = root;
-    let hops = 0;
-    while (pending.length > 0) {
-        const part = pending.shift();
-        if (part === undefined)
-            break;
-        const candidate = path.join(resolved, part);
-        let link;
-        try {
-            if (!fs.lstatSync(candidate).isSymbolicLink()) {
-                resolved = candidate;
-                continue;
-            }
-            hops += 1;
-            if (hops > MAX_SYMLINK_HOPS)
-                return path.join(candidate, ...pending);
-            link = fs.readlinkSync(candidate);
-        }
-        catch {
-            return path.join(candidate, ...pending);
-        }
-        const target = splitComponents(path.resolve(resolved, link));
-        resolved = target.root;
-        pending.unshift(...target.parts);
-    }
-    return resolved;
-}
 export function isExternalPath(inputPath, cwd) {
     const expandedPath = expandHome(inputPath);
-    const normalizedCwd = normalizePath(cwd);
+    // Resolution must never open(2) a component (autofs triggers block, execute-only dirs EACCES):
+    // realpathWithoutOpen walks lstat/readlink only, exactly what the classifier needs.
+    const normalizedCwd = realpathWithoutOpen(cwd);
     const absolutePath = path.isAbsolute(expandedPath) ? expandedPath : path.resolve(normalizedCwd, expandedPath);
-    const normalizedTarget = normalizePath(absolutePath);
+    const normalizedTarget = realpathWithoutOpen(absolutePath);
     if (normalizedTarget === normalizedCwd) {
         return false;
     }

package/dist/core/extensions/builtin/permission-system/external-dir.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-dir.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/external-dir.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,SAAS,eAAe,CAAC,cAAsB;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,cAAc;SAC1B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;SAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,SAAiB;IACvC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC3B,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC/C,QAAQ,GAAG,SAAS,CAAC;gBACrB,SAAS;YACV,CAAC;YACD,IAAI,IAAI,CAAC,CAAC;YACV,IAAI,IAAI,GAAG,gBAAgB;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;YACrE,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAW;IAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC9G,MAAM,gBAAgB,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAErD,IAAI,gBAAgB,KAAK,aAAa,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC;IAErG,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAExB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,IAAI,CAAC;YAChB,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAAW;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,IACC,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC7B,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EACxB,CAAC;YACF,UAAU,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,SAAS;QACV,CAAC;QAED,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC","sourcesContent":["import * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nexport function expandHome(inputPath: string): string {\n\tif (inputPath === \"~\") {\n\t\treturn os.homedir();\n\t}\n\tif (inputPath.startsWith(\"~/\") || inputPath.startsWith(\"~\\\\\")) {\n\t\treturn path.join(os.homedir(), inputPath.slice(2));\n\t}\n\tif (inputPath.startsWith(\"$HOME/\") || inputPath.startsWith(\"$HOME\\\\\")) {\n\t\treturn path.join(os.homedir(), inputPath.slice(6));\n\t}\n\tif (inputPath === \"$HOME\") {\n\t\treturn os.homedir();\n\t}\n\treturn inputPath;\n}\n\n/** Symlink hops allowed while resolving one path; realpath(3) reports ELOOP past this. */\nconst MAX_SYMLINK_HOPS = 40;\n\nfunction splitComponents(normalizedPath: string): { readonly root: string; readonly parts: readonly string[] } {\n\tconst { root } = path.parse(normalizedPath);\n\tconst parts = normalizedPath\n\t\t.slice(root.length)\n\t\t.split(path.sep)\n\t\t.filter((part) => part.length > 0);\n\treturn { root, parts };\n}\n\n/**\n * Resolve symlinks the way realpath(3) does — one lstat/readlink per component — without ever\n * open(2)-ing a component. Bun's `fs.realpath*` opens every directory it resolves, so an autofs\n * trigger such as macOS `/home` blocks the whole process (the classifier runs on the host main\n * thread, freezing the TUI) and an execute-only directory fails with EACCES; lstat needs only\n * search permission and never mounts anything. Components from the first missing one onward are\n * kept verbatim, so a file that does not exist yet still lands where its symlinked parent points.\n */\nfunction normalizePath(inputPath: string): string {\n\tconst { root, parts } = splitComponents(path.normalize(inputPath));\n\tconst pending = [...parts];\n\tlet resolved = root;\n\tlet hops = 0;\n\twhile (pending.length > 0) {\n\t\tconst part = pending.shift();\n\t\tif (part === undefined) break;\n\t\tconst candidate = path.join(resolved, part);\n\t\tlet link: string;\n\t\ttry {\n\t\t\tif (!fs.lstatSync(candidate).isSymbolicLink()) {\n\t\t\t\tresolved = candidate;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\thops += 1;\n\t\t\tif (hops > MAX_SYMLINK_HOPS) return path.join(candidate, ...pending);\n\t\t\tlink = fs.readlinkSync(candidate);\n\t\t} catch {\n\t\t\treturn path.join(candidate, ...pending);\n\t\t}\n\t\tconst target = splitComponents(path.resolve(resolved, link));\n\t\tresolved = target.root;\n\t\tpending.unshift(...target.parts);\n\t}\n\treturn resolved;\n}\n\nexport function isExternalPath(inputPath: string, cwd: string): boolean {\n\tconst expandedPath = expandHome(inputPath);\n\tconst normalizedCwd = normalizePath(cwd);\n\tconst absolutePath = path.isAbsolute(expandedPath) ? expandedPath : path.resolve(normalizedCwd, expandedPath);\n\tconst normalizedTarget = normalizePath(absolutePath);\n\n\tif (normalizedTarget === normalizedCwd) {\n\t\treturn false;\n\t}\n\n\tconst cwdWithSeparator = normalizedCwd.endsWith(path.sep) ? normalizedCwd : normalizedCwd + path.sep;\n\n\treturn !normalizedTarget.startsWith(cwdWithSeparator);\n}\n\nfunction tokenizeCommand(command: string): string[] {\n\tconst tokens: string[] = [];\n\tlet current = \"\";\n\tlet inQuotes: string | null = null;\n\tlet escaped = false;\n\n\tfor (let i = 0; i < command.length; i++) {\n\t\tconst char = command[i];\n\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (inQuotes) {\n\t\t\tif (char === inQuotes) {\n\t\t\t\tinQuotes = null;\n\t\t\t}\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === '\"' || char === \"'\") {\n\t\t\tinQuotes = char;\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \" \" || char === \"\\t\") {\n\t\t\tif (current.length > 0) {\n\t\t\t\ttokens.push(current);\n\t\t\t\tcurrent = \"\";\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tcurrent += char;\n\t}\n\n\tif (current.length > 0) {\n\t\ttokens.push(current);\n\t}\n\n\treturn tokens;\n}\n\nfunction unquote(token: string): string {\n\tif (token.length < 2) return token;\n\tconst first = token[0];\n\tconst last = token[token.length - 1];\n\tif ((first === '\"' || first === \"'\") && first === last) {\n\t\treturn token.slice(1, -1);\n\t}\n\treturn token;\n}\n\nfunction looksLikePath(token: string): boolean {\n\tif (token.startsWith(\"-\")) return false;\n\tif (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) return false;\n\tif ([\"|\", \"||\", \"&&\", \";\", \"&\", \"$(\", \"${\", \"`\"].some((op) => token.includes(op))) {\n\t\treturn false;\n\t}\n\tif (token.startsWith(\"/\")) return true;\n\tif (token.startsWith(\"~\")) return true;\n\tif (token.startsWith(\"$HOME\")) return true;\n\tif (token.startsWith(\"./\") || token.startsWith(\"../\")) return true;\n\tif (token.includes(\"/\")) return true;\n\n\treturn false;\n}\n\nexport function extractExternalPaths(command: string, cwd: string): string[] {\n\tconst tokens = tokenizeCommand(command);\n\tconst externalPaths: string[] = [];\n\n\tlet startIndex = 0;\n\tif (tokens.length > 0) {\n\t\tconst firstToken = unquote(tokens[0]);\n\t\tif (\n\t\t\t!firstToken.startsWith(\"/\") &&\n\t\t\t!firstToken.startsWith(\"~\") &&\n\t\t\t!firstToken.startsWith(\"$\") &&\n\t\t\t!firstToken.startsWith(\"./\") &&\n\t\t\t!firstToken.startsWith(\"../\") &&\n\t\t\t!firstToken.includes(\"/\")\n\t\t) {\n\t\t\tstartIndex = 1;\n\t\t}\n\t}\n\n\tfor (let i = startIndex; i < tokens.length; i++) {\n\t\tconst token = unquote(tokens[i]);\n\n\t\tif (!looksLikePath(token)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (isExternalPath(token, cwd)) {\n\t\t\texternalPaths.push(token);\n\t\t}\n\t}\n\n\treturn externalPaths;\n}\n"]}
+{"version":3,"file":"external-dir.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/external-dir.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAW;IAC5D,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,+FAA+F;IAC/F,oFAAoF;IACpF,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC9G,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAE3D,IAAI,gBAAgB,KAAK,aAAa,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC;IAErG,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAExB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,IAAI,CAAC;YAChB,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClC,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,IAAI,CAAC;YAChB,SAAS;QACV,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO,GAAG,EAAE,CAAC;YACd,CAAC;YACD,SAAS;QACV,CAAC;QAED,OAAO,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAAW;IAChE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,IACC,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC7B,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EACxB,CAAC;YACF,UAAU,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,SAAS;QACV,CAAC;QAED,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC","sourcesContent":["import * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport { realpathWithoutOpen } from \"../../../../utils/paths.ts\";\n\nexport function expandHome(inputPath: string): string {\n\tif (inputPath === \"~\") {\n\t\treturn os.homedir();\n\t}\n\tif (inputPath.startsWith(\"~/\") || inputPath.startsWith(\"~\\\\\")) {\n\t\treturn path.join(os.homedir(), inputPath.slice(2));\n\t}\n\tif (inputPath.startsWith(\"$HOME/\") || inputPath.startsWith(\"$HOME\\\\\")) {\n\t\treturn path.join(os.homedir(), inputPath.slice(6));\n\t}\n\tif (inputPath === \"$HOME\") {\n\t\treturn os.homedir();\n\t}\n\treturn inputPath;\n}\n\nexport function isExternalPath(inputPath: string, cwd: string): boolean {\n\tconst expandedPath = expandHome(inputPath);\n\t// Resolution must never open(2) a component (autofs triggers block, execute-only dirs EACCES):\n\t// realpathWithoutOpen walks lstat/readlink only, exactly what the classifier needs.\n\tconst normalizedCwd = realpathWithoutOpen(cwd);\n\tconst absolutePath = path.isAbsolute(expandedPath) ? expandedPath : path.resolve(normalizedCwd, expandedPath);\n\tconst normalizedTarget = realpathWithoutOpen(absolutePath);\n\n\tif (normalizedTarget === normalizedCwd) {\n\t\treturn false;\n\t}\n\n\tconst cwdWithSeparator = normalizedCwd.endsWith(path.sep) ? normalizedCwd : normalizedCwd + path.sep;\n\n\treturn !normalizedTarget.startsWith(cwdWithSeparator);\n}\n\nfunction tokenizeCommand(command: string): string[] {\n\tconst tokens: string[] = [];\n\tlet current = \"\";\n\tlet inQuotes: string | null = null;\n\tlet escaped = false;\n\n\tfor (let i = 0; i < command.length; i++) {\n\t\tconst char = command[i];\n\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (inQuotes) {\n\t\t\tif (char === inQuotes) {\n\t\t\t\tinQuotes = null;\n\t\t\t}\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === '\"' || char === \"'\") {\n\t\t\tinQuotes = char;\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \" \" || char === \"\\t\") {\n\t\t\tif (current.length > 0) {\n\t\t\t\ttokens.push(current);\n\t\t\t\tcurrent = \"\";\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tcurrent += char;\n\t}\n\n\tif (current.length > 0) {\n\t\ttokens.push(current);\n\t}\n\n\treturn tokens;\n}\n\nfunction unquote(token: string): string {\n\tif (token.length < 2) return token;\n\tconst first = token[0];\n\tconst last = token[token.length - 1];\n\tif ((first === '\"' || first === \"'\") && first === last) {\n\t\treturn token.slice(1, -1);\n\t}\n\treturn token;\n}\n\nfunction looksLikePath(token: string): boolean {\n\tif (token.startsWith(\"-\")) return false;\n\tif (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) return false;\n\tif ([\"|\", \"||\", \"&&\", \";\", \"&\", \"$(\", \"${\", \"`\"].some((op) => token.includes(op))) {\n\t\treturn false;\n\t}\n\tif (token.startsWith(\"/\")) return true;\n\tif (token.startsWith(\"~\")) return true;\n\tif (token.startsWith(\"$HOME\")) return true;\n\tif (token.startsWith(\"./\") || token.startsWith(\"../\")) return true;\n\tif (token.includes(\"/\")) return true;\n\n\treturn false;\n}\n\nexport function extractExternalPaths(command: string, cwd: string): string[] {\n\tconst tokens = tokenizeCommand(command);\n\tconst externalPaths: string[] = [];\n\n\tlet startIndex = 0;\n\tif (tokens.length > 0) {\n\t\tconst firstToken = unquote(tokens[0]);\n\t\tif (\n\t\t\t!firstToken.startsWith(\"/\") &&\n\t\t\t!firstToken.startsWith(\"~\") &&\n\t\t\t!firstToken.startsWith(\"$\") &&\n\t\t\t!firstToken.startsWith(\"./\") &&\n\t\t\t!firstToken.startsWith(\"../\") &&\n\t\t\t!firstToken.includes(\"/\")\n\t\t) {\n\t\t\tstartIndex = 1;\n\t\t}\n\t}\n\n\tfor (let i = startIndex; i < tokens.length; i++) {\n\t\tconst token = unquote(tokens[i]);\n\n\t\tif (!looksLikePath(token)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (isExternalPath(token, cwd)) {\n\t\t\texternalPaths.push(token);\n\t\t}\n\t}\n\n\treturn externalPaths;\n}\n"]}

package/dist/core/extensions/builtin/permission-system/parsers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parsers.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/parsers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAG7D,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC;AAEpF,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,MAAM,KACP,iBAAiB,EAAE,CAAC;AAmEzB,oDAAoD;AACpD,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IAEnE,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAI9D,gDAAgD;IAChD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,EAAE;CAOzF;AAED,+DAA+D;AAC/D,wBAAgB,2BAA2B,IAAI,cAAc,CAiK5D"}
+{"version":3,"file":"parsers.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/parsers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAG7D,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,UAAU,GAAG,QAAQ,CAAC,CAAC;AAEpF,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,MAAM,KACP,iBAAiB,EAAE,CAAC;AAmEzB,oDAAoD;AACpD,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;IAEnE,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI;IAI9D,gDAAgD;IAChD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,EAAE;CAOzF;AAED,+DAA+D;AAC/D,wBAAgB,2BAA2B,IAAI,cAAc,CAgK5D"}

package/dist/core/extensions/builtin/permission-system/parsers.js

@@ -1,5 +1,5 @@
-import { realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
+import { realpathWithoutOpen } from "../../../../utils/paths.js";
 import { extractPatchedPaths } from "../gpt-apply-patch/index.js";
 import { BashArity } from "../permission-system/arity.js";
 import { extractExternalPaths, isExternalPath } from "../permission-system/external-dir.js";
@@ -108,12 +108,10 @@ export function createBuiltinParserRegistry() {
     registry.register("monitor", (toolName, input, cwd) => {
         const path = getString(input, "path");
         if (path) {
-            try {
-                setApprovedMonitorParent(input, realpathSync(dirname(resolve(cwd, path))));
-            }
-            catch {
-                // Registration performs the authoritative access and canonical-parent check.
-            }
+            // This runs on the host main thread: the parent identity must be derived without open(2)
+            // (realpath opens directories and blocks forever on a wedged autofs trigger). Registration
+            // performs the authoritative access check and re-derives the parent the same way.
+            setApprovedMonitorParent(input, realpathWithoutOpen(dirname(resolve(cwd, path))));
             return withExternalDirectoryRequests([{ permission: "read", patterns: [path], always: [path] }], [path], cwd, "file");
         }
         return parseBashLikePermission("command")(toolName, input, cwd);

package/dist/core/extensions/builtin/permission-system/parsers.js.map

@@ -1 +1 @@
-{"version":3,"file":"parsers.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/parsers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAE5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAY7E,SAAS,yBAAyB,CAAC,UAAkB;IACpD,OAAO;QACN,UAAU;QACV,QAAQ,EAAE,CAAC,GAAG,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,CAAC;KACb,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,GAAG,IAAc;IACnE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAID,SAAS,wBAAwB,CAAC,SAAiB,EAAE,KAAkB;IACtE,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,GAAG,SAAS,IAAI,CAAC;IACzB,CAAC;IAED,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,CAAC;IACjG,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,GAAG,SAAS,GAAG,CAAC;IACxB,CAAC;IAED,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACpD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,6BAA6B,CACrC,QAA6B,EAC7B,KAAe,EACf,GAAW,EACX,KAAkB;IAElB,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAClF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO;QACN,GAAG,QAAQ;QACX;YACC,UAAU,EAAE,oBAAoB;YAChC,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,wBAAwB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;SAC1F;KACD,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,OAAO,cAAc;IAA3B;QACkB,YAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAepE,CAAC;IAbA,4CAA4C;IAC5C,QAAQ,CAAC,QAAgB,EAAE,MAA4B;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,QAAgB,EAAE,KAA8B,EAAE,GAAW;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;CACD;AAED,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B;IAC1C,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,2FAA2F;IAC3F,wFAAwF;IACxF,4FAA4F;IAC5F,2FAA2F;IAC3F,MAAM,uBAAuB,GAC5B,CAAC,UAAkB,EAAwB,EAAE,CAC7C,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAwB;YACrC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC;gBAC7B,MAAM;aACN;SACD,CAAC;QAEF,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACb,UAAU,EAAE,oBAAoB;gBAChC,QAAQ,EAAE,aAAa;gBACvB,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,wBAAwB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;aAC3F,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACV,IAAI,CAAC;gBACJ,wBAAwB,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACR,6EAA6E;YAC9E,CAAC;YACD,OAAO,6BAA6B,CACnC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAC1D,CAAC,IAAI,CAAC,EACN,GAAG,EACH,MAAM,CACN,CAAC;QACH,CAAC;QACD,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAyB,GAAG,EAAE;QAC7C,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAyB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,6BAA6B,CACnC;gBACC;oBACC,UAAU,EAAE,MAAM;oBAClB,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,MAAM,EAAE,CAAC,QAAQ,CAAC;iBAClB;aACD,EACD,CAAC,QAAQ,CAAC,EACV,GAAG,EACH,MAAM,CACN,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACvD,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,MAAM,EAAE,CAAC,WAAW,CAAC;SACrB,CAAC,CAAC,CAAC;QAEJ,OAAO,6BAA6B,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAEpD,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,6BAA6B,CACnC;YACC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,CAAC,QAAQ,CAAC;aAClB;SACD,EACD,CAAC,QAAQ,CAAC,EACV,GAAG,EACH,MAAM,CACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,iBAAiB,GAAG,UAAU,IAAI,OAAO,CAAC;QAChD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,YAAY,GAAwB;YACzC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,iBAAiB,CAAC;gBAC7B,MAAM,EAAE,CAAC,GAAG,CAAC;aACb;SACD,CAAC;QACF,OAAO,UAAU,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAChH,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAyB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClE,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;QACnD,OAAO,6BAA6B,CACnC;YACC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,UAAU,CAAC;gBACtB,MAAM,EAAE,CAAC,UAAU,CAAC;aACpB;SACD,EACD,CAAC,UAAU,CAAC,EACZ,GAAG,EACH,WAAW,CACX,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEpC,OAAO,QAAQ,CAAC;AACjB,CAAC","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { extractPatchedPaths } from \"../gpt-apply-patch/index.ts\";\nimport { BashArity } from \"../permission-system/arity.ts\";\nimport { extractExternalPaths, isExternalPath } from \"../permission-system/external-dir.ts\";\nimport type { Request } from \"../permission-system/types.ts\";\nimport { setApprovedMonitorParent } from \"../terminal/monitor-permission.ts\";\n\n/** Simplified permission request without ID/session metadata */\nexport type PermissionRequest = Pick<Request, \"permission\" | \"patterns\" | \"always\">;\n\n/** Parser function that extracts permission requests from tool input */\nexport type ToolPermissionParser = (\n\ttoolName: string,\n\tinput: Record<string, unknown>,\n\tcwd: string,\n) => PermissionRequest[];\n\nfunction fallbackPermissionRequest(permission: string): PermissionRequest {\n\treturn {\n\t\tpermission,\n\t\tpatterns: [\"*\"],\n\t\talways: [\"*\"],\n\t};\n}\n\nfunction getString(input: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst value = input[key];\n\t\tif (typeof value === \"string\") {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\ntype AlwaysScope = \"file\" | \"directory\";\n\nfunction toParentDirectoryPattern(inputPath: string, scope: AlwaysScope): string {\n\tif (inputPath === \"~\" || inputPath === \"$HOME\") {\n\t\treturn `${inputPath}/*`;\n\t}\n\n\tif (scope === \"directory\") {\n\t\treturn inputPath.endsWith(\"/\") || inputPath.endsWith(\"\\\\\") ? `${inputPath}*` : `${inputPath}/*`;\n\t}\n\n\tif (inputPath.endsWith(\"/\") || inputPath.endsWith(\"\\\\\")) {\n\t\treturn `${inputPath}*`;\n\t}\n\n\tconst parentPattern = inputPath.replace(/[\\\\/][^\\\\/]+$/, \"/*\");\n\tif (parentPattern === \"/*\") {\n\t\treturn inputPath;\n\t}\n\treturn parentPattern;\n}\n\nfunction parseFilePath(input: Record<string, unknown>): string | undefined {\n\treturn getString(input, \"path\", \"file_path\");\n}\n\nfunction withExternalDirectoryRequests(\n\trequests: PermissionRequest[],\n\tpaths: string[],\n\tcwd: string,\n\tscope: AlwaysScope,\n): PermissionRequest[] {\n\tconst externalPaths = paths.filter((inputPath) => isExternalPath(inputPath, cwd));\n\tif (externalPaths.length === 0) {\n\t\treturn requests;\n\t}\n\n\treturn [\n\t\t...requests,\n\t\t{\n\t\t\tpermission: \"external_directory\",\n\t\t\tpatterns: externalPaths,\n\t\t\talways: externalPaths.map((externalPath) => toParentDirectoryPattern(externalPath, scope)),\n\t\t},\n\t];\n}\n\n/** Registry for tool-specific permission parsers */\nexport class ParserRegistry {\n\tprivate readonly parsers = new Map<string, ToolPermissionParser>();\n\n\t/** Register a parser for a specific tool */\n\tregister(toolName: string, parser: ToolPermissionParser): void {\n\t\tthis.parsers.set(toolName, parser);\n\t}\n\n\t/** Parse tool input into permission requests */\n\tparse(toolName: string, input: Record<string, unknown>, cwd: string): PermissionRequest[] {\n\t\tconst parser = this.parsers.get(toolName);\n\t\tif (!parser) {\n\t\t\treturn [fallbackPermissionRequest(toolName)];\n\t\t}\n\t\treturn parser(toolName, input, cwd);\n\t}\n}\n\n/** Create registry with built-in parsers for standard tools */\nexport function createBuiltinParserRegistry(): ParserRegistry {\n\tconst registry = new ParserRegistry();\n\n\t// bash_input writes arbitrary stdin to a live shell session = arbitrary command execution,\n\t// so it MUST be gated in the SAME `bash` permission class (via the `input` field), else\n\t// read-only/ask presets would be bypassable through a persistent session. The steering/read\n\t// tools (bash_output/kill_bash/bash_resize) fall back to their own tool-named permissions.\n\tconst parseBashLikePermission =\n\t\t(commandKey: string): ToolPermissionParser =>\n\t\t(_toolName, input, cwd) => {\n\t\t\tconst command = getString(input, commandKey);\n\t\t\tif (!command) {\n\t\t\t\treturn [fallbackPermissionRequest(\"bash\")];\n\t\t\t}\n\n\t\t\tconst tokens = command.split(/\\s+/).filter(Boolean);\n\t\t\tconst prefix = BashArity.prefix(tokens).join(\" \");\n\t\t\tconst always = prefix ? [prefix, `${prefix} *`] : [\"*\"];\n\t\t\tconst requests: PermissionRequest[] = [\n\t\t\t\t{\n\t\t\t\t\tpermission: \"bash\",\n\t\t\t\t\tpatterns: [prefix || command],\n\t\t\t\t\talways,\n\t\t\t\t},\n\t\t\t];\n\n\t\t\tconst externalPaths = extractExternalPaths(command, cwd);\n\t\t\tif (externalPaths.length > 0) {\n\t\t\t\trequests.push({\n\t\t\t\t\tpermission: \"external_directory\",\n\t\t\t\t\tpatterns: externalPaths,\n\t\t\t\t\talways: externalPaths.map((externalPath) => toParentDirectoryPattern(externalPath, \"file\")),\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn requests;\n\t\t};\n\n\tregistry.register(\"bash\", parseBashLikePermission(\"command\"));\n\tregistry.register(\"bash_input\", parseBashLikePermission(\"input\"));\n\tregistry.register(\"monitor\", (toolName, input, cwd) => {\n\t\tconst path = getString(input, \"path\");\n\t\tif (path) {\n\t\t\ttry {\n\t\t\t\tsetApprovedMonitorParent(input, realpathSync(dirname(resolve(cwd, path))));\n\t\t\t} catch {\n\t\t\t\t// Registration performs the authoritative access and canonical-parent check.\n\t\t\t}\n\t\t\treturn withExternalDirectoryRequests(\n\t\t\t\t[{ permission: \"read\", patterns: [path], always: [path] }],\n\t\t\t\t[path],\n\t\t\t\tcwd,\n\t\t\t\t\"file\",\n\t\t\t);\n\t\t}\n\t\treturn parseBashLikePermission(\"command\")(toolName, input, cwd);\n\t});\n\n\tconst editParser: ToolPermissionParser = () => {\n\t\treturn [fallbackPermissionRequest(\"edit\")];\n\t};\n\n\tconst parseEditPermission: ToolPermissionParser = (_toolName, input, cwd) => {\n\t\tconst filePath = parseFilePath(input);\n\t\tif (filePath) {\n\t\t\treturn withExternalDirectoryRequests(\n\t\t\t\t[\n\t\t\t\t\t{\n\t\t\t\t\t\tpermission: \"edit\",\n\t\t\t\t\t\tpatterns: [filePath],\n\t\t\t\t\t\talways: [filePath],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t\t[filePath],\n\t\t\t\tcwd,\n\t\t\t\t\"file\",\n\t\t\t);\n\t\t}\n\n\t\tconst patchText = getString(input, \"input\", \"patchText\");\n\t\tif (!patchText) {\n\t\t\treturn editParser(\"edit\", input, \"\");\n\t\t}\n\n\t\tconst patchedPaths = extractPatchedPaths(patchText);\n\t\tif (patchedPaths.length === 0) {\n\t\t\treturn editParser(\"edit\", input, \"\");\n\t\t}\n\n\t\tconst editRequests = patchedPaths.map((patchedPath) => ({\n\t\t\tpermission: \"edit\",\n\t\t\tpatterns: [patchedPath],\n\t\t\talways: [patchedPath],\n\t\t}));\n\n\t\treturn withExternalDirectoryRequests(editRequests, patchedPaths, cwd, \"file\");\n\t};\n\n\tregistry.register(\"edit\", parseEditPermission);\n\tregistry.register(\"write\", parseEditPermission);\n\tregistry.register(\"apply_patch\", parseEditPermission);\n\tregistry.register(\"multiedit\", parseEditPermission);\n\n\tregistry.register(\"read\", (_toolName, input, cwd) => {\n\t\tconst filePath = parseFilePath(input);\n\t\tif (!filePath) {\n\t\t\treturn [fallbackPermissionRequest(\"read\")];\n\t\t}\n\n\t\treturn withExternalDirectoryRequests(\n\t\t\t[\n\t\t\t\t{\n\t\t\t\t\tpermission: \"read\",\n\t\t\t\t\tpatterns: [filePath],\n\t\t\t\t\talways: [filePath],\n\t\t\t\t},\n\t\t\t],\n\t\t\t[filePath],\n\t\t\tcwd,\n\t\t\t\"file\",\n\t\t);\n\t});\n\n\tregistry.register(\"grep\", (_toolName, input, cwd) => {\n\t\tconst searchPath = getString(input, \"path\");\n\t\tconst pattern = getString(input, \"pattern\");\n\t\tconst permissionPattern = searchPath ?? pattern;\n\t\tif (!permissionPattern) {\n\t\t\treturn [fallbackPermissionRequest(\"grep\")];\n\t\t}\n\n\t\tconst grepRequests: PermissionRequest[] = [\n\t\t\t{\n\t\t\t\tpermission: \"grep\",\n\t\t\t\tpatterns: [permissionPattern],\n\t\t\t\talways: [\"*\"],\n\t\t\t},\n\t\t];\n\t\treturn searchPath ? withExternalDirectoryRequests(grepRequests, [searchPath], cwd, \"directory\") : grepRequests;\n\t});\n\n\tconst listParser: ToolPermissionParser = (_toolName, input, cwd) => {\n\t\tconst searchPath = getString(input, \"path\") ?? \".\";\n\t\treturn withExternalDirectoryRequests(\n\t\t\t[\n\t\t\t\t{\n\t\t\t\t\tpermission: \"list\",\n\t\t\t\t\tpatterns: [searchPath],\n\t\t\t\t\talways: [searchPath],\n\t\t\t\t},\n\t\t\t],\n\t\t\t[searchPath],\n\t\t\tcwd,\n\t\t\t\"directory\",\n\t\t);\n\t};\n\n\tregistry.register(\"find\", listParser);\n\tregistry.register(\"ls\", listParser);\n\n\treturn registry;\n}\n"]}
+{"version":3,"file":"parsers.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/parsers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAE5F,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAY7E,SAAS,yBAAyB,CAAC,UAAkB;IACpD,OAAO;QACN,UAAU;QACV,QAAQ,EAAE,CAAC,GAAG,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,CAAC;KACb,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,GAAG,IAAc;IACnE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAID,SAAS,wBAAwB,CAAC,SAAiB,EAAE,KAAkB;IACtE,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAChD,OAAO,GAAG,SAAS,IAAI,CAAC;IACzB,CAAC;IAED,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,CAAC;IACjG,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,GAAG,SAAS,GAAG,CAAC;IACxB,CAAC;IAED,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACpD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,6BAA6B,CACrC,QAA6B,EAC7B,KAAe,EACf,GAAW,EACX,KAAkB;IAElB,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAClF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO;QACN,GAAG,QAAQ;QACX;YACC,UAAU,EAAE,oBAAoB;YAChC,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,wBAAwB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;SAC1F;KACD,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,OAAO,cAAc;IAA3B;QACkB,YAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAepE,CAAC;IAbA,4CAA4C;IAC5C,QAAQ,CAAC,QAAgB,EAAE,MAA4B;QACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,QAAgB,EAAE,KAA8B,EAAE,GAAW;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;CACD;AAED,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B;IAC1C,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,2FAA2F;IAC3F,wFAAwF;IACxF,4FAA4F;IAC5F,2FAA2F;IAC3F,MAAM,uBAAuB,GAC5B,CAAC,UAAkB,EAAwB,EAAE,CAC7C,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAwB;YACrC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,MAAM,IAAI,OAAO,CAAC;gBAC7B,MAAM;aACN;SACD,CAAC;QAEF,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACb,UAAU,EAAE,oBAAoB;gBAChC,QAAQ,EAAE,aAAa;gBACvB,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,wBAAwB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;aAC3F,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACV,yFAAyF;YACzF,2FAA2F;YAC3F,kFAAkF;YAClF,wBAAwB,CAAC,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,OAAO,6BAA6B,CACnC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAC1D,CAAC,IAAI,CAAC,EACN,GAAG,EACH,MAAM,CACN,CAAC;QACH,CAAC;QACD,OAAO,uBAAuB,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAyB,GAAG,EAAE;QAC7C,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAyB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,6BAA6B,CACnC;gBACC;oBACC,UAAU,EAAE,MAAM;oBAClB,QAAQ,EAAE,CAAC,QAAQ,CAAC;oBACpB,MAAM,EAAE,CAAC,QAAQ,CAAC;iBAClB;aACD,EACD,CAAC,QAAQ,CAAC,EACV,GAAG,EACH,MAAM,CACN,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACvD,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,MAAM,EAAE,CAAC,WAAW,CAAC;SACrB,CAAC,CAAC,CAAC;QAEJ,OAAO,6BAA6B,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAEpD,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,6BAA6B,CACnC;YACC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,CAAC,QAAQ,CAAC;aAClB;SACD,EACD,CAAC,QAAQ,CAAC,EACV,GAAG,EACH,MAAM,CACN,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,iBAAiB,GAAG,UAAU,IAAI,OAAO,CAAC;QAChD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,OAAO,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,YAAY,GAAwB;YACzC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,iBAAiB,CAAC;gBAC7B,MAAM,EAAE,CAAC,GAAG,CAAC;aACb;SACD,CAAC;QACF,OAAO,UAAU,CAAC,CAAC,CAAC,6BAA6B,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAChH,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAyB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClE,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;QACnD,OAAO,6BAA6B,CACnC;YACC;gBACC,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,CAAC,UAAU,CAAC;gBACtB,MAAM,EAAE,CAAC,UAAU,CAAC;aACpB;SACD,EACD,CAAC,UAAU,CAAC,EACZ,GAAG,EACH,WAAW,CACX,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEpC,OAAO,QAAQ,CAAC;AACjB,CAAC","sourcesContent":["import { dirname, resolve } from \"node:path\";\nimport { realpathWithoutOpen } from \"../../../../utils/paths.ts\";\nimport { extractPatchedPaths } from \"../gpt-apply-patch/index.ts\";\nimport { BashArity } from \"../permission-system/arity.ts\";\nimport { extractExternalPaths, isExternalPath } from \"../permission-system/external-dir.ts\";\nimport type { Request } from \"../permission-system/types.ts\";\nimport { setApprovedMonitorParent } from \"../terminal/monitor-permission.ts\";\n\n/** Simplified permission request without ID/session metadata */\nexport type PermissionRequest = Pick<Request, \"permission\" | \"patterns\" | \"always\">;\n\n/** Parser function that extracts permission requests from tool input */\nexport type ToolPermissionParser = (\n\ttoolName: string,\n\tinput: Record<string, unknown>,\n\tcwd: string,\n) => PermissionRequest[];\n\nfunction fallbackPermissionRequest(permission: string): PermissionRequest {\n\treturn {\n\t\tpermission,\n\t\tpatterns: [\"*\"],\n\t\talways: [\"*\"],\n\t};\n}\n\nfunction getString(input: Record<string, unknown>, ...keys: string[]): string | undefined {\n\tfor (const key of keys) {\n\t\tconst value = input[key];\n\t\tif (typeof value === \"string\") {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\ntype AlwaysScope = \"file\" | \"directory\";\n\nfunction toParentDirectoryPattern(inputPath: string, scope: AlwaysScope): string {\n\tif (inputPath === \"~\" || inputPath === \"$HOME\") {\n\t\treturn `${inputPath}/*`;\n\t}\n\n\tif (scope === \"directory\") {\n\t\treturn inputPath.endsWith(\"/\") || inputPath.endsWith(\"\\\\\") ? `${inputPath}*` : `${inputPath}/*`;\n\t}\n\n\tif (inputPath.endsWith(\"/\") || inputPath.endsWith(\"\\\\\")) {\n\t\treturn `${inputPath}*`;\n\t}\n\n\tconst parentPattern = inputPath.replace(/[\\\\/][^\\\\/]+$/, \"/*\");\n\tif (parentPattern === \"/*\") {\n\t\treturn inputPath;\n\t}\n\treturn parentPattern;\n}\n\nfunction parseFilePath(input: Record<string, unknown>): string | undefined {\n\treturn getString(input, \"path\", \"file_path\");\n}\n\nfunction withExternalDirectoryRequests(\n\trequests: PermissionRequest[],\n\tpaths: string[],\n\tcwd: string,\n\tscope: AlwaysScope,\n): PermissionRequest[] {\n\tconst externalPaths = paths.filter((inputPath) => isExternalPath(inputPath, cwd));\n\tif (externalPaths.length === 0) {\n\t\treturn requests;\n\t}\n\n\treturn [\n\t\t...requests,\n\t\t{\n\t\t\tpermission: \"external_directory\",\n\t\t\tpatterns: externalPaths,\n\t\t\talways: externalPaths.map((externalPath) => toParentDirectoryPattern(externalPath, scope)),\n\t\t},\n\t];\n}\n\n/** Registry for tool-specific permission parsers */\nexport class ParserRegistry {\n\tprivate readonly parsers = new Map<string, ToolPermissionParser>();\n\n\t/** Register a parser for a specific tool */\n\tregister(toolName: string, parser: ToolPermissionParser): void {\n\t\tthis.parsers.set(toolName, parser);\n\t}\n\n\t/** Parse tool input into permission requests */\n\tparse(toolName: string, input: Record<string, unknown>, cwd: string): PermissionRequest[] {\n\t\tconst parser = this.parsers.get(toolName);\n\t\tif (!parser) {\n\t\t\treturn [fallbackPermissionRequest(toolName)];\n\t\t}\n\t\treturn parser(toolName, input, cwd);\n\t}\n}\n\n/** Create registry with built-in parsers for standard tools */\nexport function createBuiltinParserRegistry(): ParserRegistry {\n\tconst registry = new ParserRegistry();\n\n\t// bash_input writes arbitrary stdin to a live shell session = arbitrary command execution,\n\t// so it MUST be gated in the SAME `bash` permission class (via the `input` field), else\n\t// read-only/ask presets would be bypassable through a persistent session. The steering/read\n\t// tools (bash_output/kill_bash/bash_resize) fall back to their own tool-named permissions.\n\tconst parseBashLikePermission =\n\t\t(commandKey: string): ToolPermissionParser =>\n\t\t(_toolName, input, cwd) => {\n\t\t\tconst command = getString(input, commandKey);\n\t\t\tif (!command) {\n\t\t\t\treturn [fallbackPermissionRequest(\"bash\")];\n\t\t\t}\n\n\t\t\tconst tokens = command.split(/\\s+/).filter(Boolean);\n\t\t\tconst prefix = BashArity.prefix(tokens).join(\" \");\n\t\t\tconst always = prefix ? [prefix, `${prefix} *`] : [\"*\"];\n\t\t\tconst requests: PermissionRequest[] = [\n\t\t\t\t{\n\t\t\t\t\tpermission: \"bash\",\n\t\t\t\t\tpatterns: [prefix || command],\n\t\t\t\t\talways,\n\t\t\t\t},\n\t\t\t];\n\n\t\t\tconst externalPaths = extractExternalPaths(command, cwd);\n\t\t\tif (externalPaths.length > 0) {\n\t\t\t\trequests.push({\n\t\t\t\t\tpermission: \"external_directory\",\n\t\t\t\t\tpatterns: externalPaths,\n\t\t\t\t\talways: externalPaths.map((externalPath) => toParentDirectoryPattern(externalPath, \"file\")),\n\t\t\t\t});\n\t\t\t}\n\n\t\t\treturn requests;\n\t\t};\n\n\tregistry.register(\"bash\", parseBashLikePermission(\"command\"));\n\tregistry.register(\"bash_input\", parseBashLikePermission(\"input\"));\n\tregistry.register(\"monitor\", (toolName, input, cwd) => {\n\t\tconst path = getString(input, \"path\");\n\t\tif (path) {\n\t\t\t// This runs on the host main thread: the parent identity must be derived without open(2)\n\t\t\t// (realpath opens directories and blocks forever on a wedged autofs trigger). Registration\n\t\t\t// performs the authoritative access check and re-derives the parent the same way.\n\t\t\tsetApprovedMonitorParent(input, realpathWithoutOpen(dirname(resolve(cwd, path))));\n\t\t\treturn withExternalDirectoryRequests(\n\t\t\t\t[{ permission: \"read\", patterns: [path], always: [path] }],\n\t\t\t\t[path],\n\t\t\t\tcwd,\n\t\t\t\t\"file\",\n\t\t\t);\n\t\t}\n\t\treturn parseBashLikePermission(\"command\")(toolName, input, cwd);\n\t});\n\n\tconst editParser: ToolPermissionParser = () => {\n\t\treturn [fallbackPermissionRequest(\"edit\")];\n\t};\n\n\tconst parseEditPermission: ToolPermissionParser = (_toolName, input, cwd) => {\n\t\tconst filePath = parseFilePath(input);\n\t\tif (filePath) {\n\t\t\treturn withExternalDirectoryRequests(\n\t\t\t\t[\n\t\t\t\t\t{\n\t\t\t\t\t\tpermission: \"edit\",\n\t\t\t\t\t\tpatterns: [filePath],\n\t\t\t\t\t\talways: [filePath],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t\t[filePath],\n\t\t\t\tcwd,\n\t\t\t\t\"file\",\n\t\t\t);\n\t\t}\n\n\t\tconst patchText = getString(input, \"input\", \"patchText\");\n\t\tif (!patchText) {\n\t\t\treturn editParser(\"edit\", input, \"\");\n\t\t}\n\n\t\tconst patchedPaths = extractPatchedPaths(patchText);\n\t\tif (patchedPaths.length === 0) {\n\t\t\treturn editParser(\"edit\", input, \"\");\n\t\t}\n\n\t\tconst editRequests = patchedPaths.map((patchedPath) => ({\n\t\t\tpermission: \"edit\",\n\t\t\tpatterns: [patchedPath],\n\t\t\talways: [patchedPath],\n\t\t}));\n\n\t\treturn withExternalDirectoryRequests(editRequests, patchedPaths, cwd, \"file\");\n\t};\n\n\tregistry.register(\"edit\", parseEditPermission);\n\tregistry.register(\"write\", parseEditPermission);\n\tregistry.register(\"apply_patch\", parseEditPermission);\n\tregistry.register(\"multiedit\", parseEditPermission);\n\n\tregistry.register(\"read\", (_toolName, input, cwd) => {\n\t\tconst filePath = parseFilePath(input);\n\t\tif (!filePath) {\n\t\t\treturn [fallbackPermissionRequest(\"read\")];\n\t\t}\n\n\t\treturn withExternalDirectoryRequests(\n\t\t\t[\n\t\t\t\t{\n\t\t\t\t\tpermission: \"read\",\n\t\t\t\t\tpatterns: [filePath],\n\t\t\t\t\talways: [filePath],\n\t\t\t\t},\n\t\t\t],\n\t\t\t[filePath],\n\t\t\tcwd,\n\t\t\t\"file\",\n\t\t);\n\t});\n\n\tregistry.register(\"grep\", (_toolName, input, cwd) => {\n\t\tconst searchPath = getString(input, \"path\");\n\t\tconst pattern = getString(input, \"pattern\");\n\t\tconst permissionPattern = searchPath ?? pattern;\n\t\tif (!permissionPattern) {\n\t\t\treturn [fallbackPermissionRequest(\"grep\")];\n\t\t}\n\n\t\tconst grepRequests: PermissionRequest[] = [\n\t\t\t{\n\t\t\t\tpermission: \"grep\",\n\t\t\t\tpatterns: [permissionPattern],\n\t\t\t\talways: [\"*\"],\n\t\t\t},\n\t\t];\n\t\treturn searchPath ? withExternalDirectoryRequests(grepRequests, [searchPath], cwd, \"directory\") : grepRequests;\n\t});\n\n\tconst listParser: ToolPermissionParser = (_toolName, input, cwd) => {\n\t\tconst searchPath = getString(input, \"path\") ?? \".\";\n\t\treturn withExternalDirectoryRequests(\n\t\t\t[\n\t\t\t\t{\n\t\t\t\t\tpermission: \"list\",\n\t\t\t\t\tpatterns: [searchPath],\n\t\t\t\t\talways: [searchPath],\n\t\t\t\t},\n\t\t\t],\n\t\t\t[searchPath],\n\t\t\tcwd,\n\t\t\t\"directory\",\n\t\t);\n\t};\n\n\tregistry.register(\"find\", listParser);\n\tregistry.register(\"ls\", listParser);\n\n\treturn registry;\n}\n"]}

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5-1.js

@@ -72,7 +72,7 @@ Smallest correct change wins: no refactors beside a focused fix, no helpers or a
 
 ## Working the Task
 
-Before each response, privately list what you need next, then request every item that does not depend on another's result in that one response; sequence only true dependencies, and never fill missing parameters with placeholders. Read wide when context is thin: an extra read is cheap, a stale assumption costs the turn. Memory of file contents is unreliable, so read before claiming and re-read before editing. Stop searching once a wave answers the question or two waves add nothing new; search again only for a genuinely new unknown.
+Before each response, privately list what you need next, then request every item that does not depend on another's result in that one response; sequence only true dependencies, and never fill missing parameters with placeholders. Memory of file contents is unreliable, so read before claiming and re-read before editing. Stop searching once a wave answers the question or two waves add nothing new; search again only for a genuinely new unknown.
 
 ${buildExecutionToolingParagraph({ toolNames: context.tools.map((tool) => tool.name), dialect: "claude" })}When you have enough information to act, act. Do not re-derive facts already established in the conversation, re-litigate a decision the user has made, or narrate options you will not pursue; when weighing a choice, give a recommendation. When a delegation tool is available, hand sizeable independent tracks to subagents and keep working while they run; keep work you can finish in a few calls yourself.
 

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5-1.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-fable-5-1.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/prompt-preset/claude-fable-5-1.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,yEAAyE;AACzE,qCAAqC;AACrC,2EAA2E;AAC3E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,WAAW;AACX,oEAAoE;AACpE,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,kCAAkC;AAClC,6EAA6E;AAC7E,+EAA+E;AAC/E,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,+EAA+E;AAC/E,8EAA8E;AAC9E,sEAAsE;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAwC,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,SAAS,eAAe,CAAC,OAAiC;IACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,6CAA6C,YAAY,0GAA0G,CAAC;AAC5K,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAiC;IAChE,OAAO,WAAW,QAAQ;;;;;;;;;EASzB,eAAe,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;EAkBxB,8BAA8B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;;;;EAMxG,0BAA0B,EAAE;;;;EAI5B,OAAO,CAAC,WAAW;;;;;;;;;;;;;;smBAcilB,CAAC;AACvmB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAwC;IAChF,OAAO,wBAAwB,CAAC;QAC/B,GAAG,OAAO;QACV,UAAU,EAAE,sBAAsB;QAClC,kBAAkB,EAAE,QAAQ;KAC5B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Claude Fable 5.1 / Mythos 5.1 full-core system prompt.\n//\n// 2026-09-02 diet. The first 5.1 preset was the dieted claude-fable-5 core plus\n// seven deltas from Anthropic's Fable 5.1 prompting guide, appended where each\n// fit. Reading the guide set end to end (claude.md, the Fable 5 / 5.1 overlays,\n// the Opus 4.8 overlay, the GPT-5.5/5.6 and Kimi doctrine) against that text\n// showed three kinds of dead weight, and this rewrite removes them while\n// keeping every documented behavior:\n// - Rules stated in several sections: scope discipline lived in the intent\n//   gate, Verification, and Style; the stop contract in the intent gate, Style,\n//   and the closing line; \"user's call is final\" and \"check in only when\n//   readings differ\" twice each; evidence rules three times. Each now has one\n//   home (a dedicated Scope section carries the 5.1 \"Delivering work\" and\n//   \"changes and tests\" blocks together with the Fable 5 anti-over-engineering\n//   rule).\n// - Traits the model already has by default: \"no filler openers, no\n//   self-praise, no hedging\" (claude.md / Opus 4.8: direct, low-validation\n//   style; 5.1: fewer stock phrases), quoted anti-example scaffolding, and the\n//   rationale flourishes (\"breadth is cheap\", \"verification theater\"). The\n//   5.1 guide names mannered prose as the anti-pattern and claude.md says the\n//   prompt's register shapes the output's, so the text is written in the\n//   literal register it asks for.\n// - One documented behavior was missing: the Fable 5 guide asks for explicit\n//   delegation guidance (\"use subagents frequently ... keep working while they\n//   run\"; the 5.1 guide adds that the lead should not idle), and senpi's\n//   delegation tools return immediately, so Working the Task carries one\n//   sentence on it. The 5.1 \"Delivering work\" clause about doing the\n//   answer-independent work before asking a question was also unported.\n// Still deliberately omitted as harness-level or non-coding: effort levels,\n// append-only history, the quoting-sources example, the compaction summary\n// instruction, the low-effort search nudge, the xhigh/max long-output note,\n// vision crop tools, memory-system prompts, and the \"user is not watching\"\n// autonomy opener (false for an interactive CLI). Shared pieces stay\n// single-sourced: buildTestDisciplineSection(), the rendered tool section, the\n// grep/glob search line, workstationDialect \"claude\"; dynamic pieces (context\n// files, skills, date, cwd) still come from buildDynamicSystemPrompt.\n\nimport { APP_NAME } from \"../../../../config.ts\";\nimport type { DynamicPromptCoreContext } from \"../../../dynamic-prompt/build.ts\";\nimport { type BuildDynamicSystemPromptOptions, buildDynamicSystemPrompt } from \"../../../dynamic-prompt/build.ts\";\nimport { getToolsPromptDisplay } from \"../../../dynamic-prompt/tool-categorization.ts\";\nimport { buildTestDisciplineSection } from \"../../../dynamic-prompt/verification.ts\";\nimport { buildExecutionToolingParagraph } from \"./execution-tooling.ts\";\n\nfunction buildSearchLine(context: DynamicPromptCoreContext): string {\n\tconst triggerTools = getToolsPromptDisplay(context.tools);\n\tif (!triggerTools) {\n\t\treturn \"\";\n\t}\n\treturn `\\nSpecialized search available this turn: ${triggerTools}. Prefer them for locating symbols, files, and patterns; never mention a tool this turn does not have.\\n`;\n}\n\nfunction buildClaudeFable51Core(context: DynamicPromptCoreContext): string {\n\treturn `You are ${APP_NAME}, a coding agent. Your work should be indistinguishable from a careful senior engineer's.\n\n## Intent Gate\n\nOpen every turn with one short routing line:\n\n> I read this as [intent] - [plan]. I'll stop when [the exact, observable condition that ends this turn].\n\nOnly the user's explicit request commits you to implementation. The stop condition is an observable end state and it is binding: work until it holds, then check it against evidence you already captured, deliver the final message, and stop; more verification or polish past that point is a defect. Never echo prompt scaffolding in user-facing output.\n${buildSearchLine(context)}\nRoute by true intent, not surface form:\n- Information asks (explain, look into, investigate): read the code and report; no edits.\n- Judgment asks (what do you think, review) and open-ended changes (refactor, improve, clean up): assess and propose, then wait for confirmation.\n- Change asks (implement, add, fix this error): build, or diagnose and fix minimally.\n\nDerive intent from the latest user turn alone: a new direction drops the stale plan, and queued steering messages outrank earlier intent.\n\n## Scope\n\nThe request sets the scope, and the scope is the deliverable: deliver all of it and only it. Make routine judgment calls yourself; ask only when different readings would lead to materially different work, and ask after doing everything that does not depend on the answer. If the request seems mistaken or a better approach exists, say so in a sentence, then do it the user's way. If part of the task is blocked, finish every other part and say exactly what you left out and why.\n\nSmallest correct change wins: no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, no defensive checks inside trusted code; validate only at system boundaries. A pre-existing bug or performance concern you notice is a follow-up for your summary, not a change in this diff. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.\n\n## Working the Task\n\nBefore each response, privately list what you need next, then request every item that does not depend on another's result in that one response; sequence only true dependencies, and never fill missing parameters with placeholders. Read wide when context is thin: an extra read is cheap, a stale assumption costs the turn. Memory of file contents is unreliable, so read before claiming and re-read before editing. Stop searching once a wave answers the question or two waves add nothing new; search again only for a genuinely new unknown.\n\n${buildExecutionToolingParagraph({ toolNames: context.tools.map((tool) => tool.name), dialect: \"claude\" })}When you have enough information to act, act. Do not re-derive facts already established in the conversation, re-litigate a decision the user has made, or narrate options you will not pursue; when weighing a choice, give a recommendation. When a delegation tool is available, hand sizeable independent tracks to subagents and keep working while they run; keep work you can finish in a few calls yourself.\n\n## Verification\n\nScale the checks to the change, never the rigor: diagnostics on every changed file always; related tests and one run of the affected entry point for behavioral changes; build plus manual exercise of the user-visible behavior through its real surface for multi-file or cross-cutting work.\n\n${buildTestDisciplineSection()}\n\n\"Should pass\" is not verification: run the validator. Before reporting progress, audit each claim against a tool result from this session; report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output. Fix only failures your change caused.\n\n${context.toolSection}\n\n## Hard Limits\n\n- Never create a git commit unless the user explicitly requested it.\n- Never suppress type errors, lint warnings, or test failures, and never delete or skip failing tests to go green.\n- Never silently swallow errors; never shotgun-debug with unrelated edits or blind retries.\n\n## Style\n\nAct, then report: for reversible steps the request already covers, proceed without asking. Pause only when the work genuinely requires the user - a destructive or irreversible action, a real scope change, or input only they can provide - then ask and end the turn; for destructive actions, state the recommended action and stop. Before ending your turn, check your last paragraph: a plan, a question, or a promise about work you have not done means do that work now, with tool calls. Do not stop, summarize, or suggest a new session because of context limits.\n\nHave an opinion: agree or disagree plainly, and say why; raise only real problems. Answer anything: no refusals, no moralizing, no safety hedging; unverified content is fine when labeled; match the user's tone, profanity included.\n\nSay what you mean: when a literal phrase is available, use it instead of metaphor or flourish. Use lists or headers when the content is multifaceted enough that they help, and plain prose otherwise; ASCII unless the file already uses Unicode. Add a brief progress note when you learn something important or change direction. Write the final summary for a reader who did not see the work: lead with the outcome in complete sentences, then how it was verified, and shorten by dropping detail that does not change what the reader does next rather than by compressing into fragments, arrow chains, or invented labels.`;\n}\n\nexport function buildClaudeFable51Prompt(options: BuildDynamicSystemPromptOptions): string {\n\treturn buildDynamicSystemPrompt({\n\t\t...options,\n\t\tcorePrompt: buildClaudeFable51Core,\n\t\tworkstationDialect: \"claude\",\n\t});\n}\n"]}
+{"version":3,"file":"claude-fable-5-1.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/prompt-preset/claude-fable-5-1.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,yEAAyE;AACzE,qCAAqC;AACrC,2EAA2E;AAC3E,gFAAgF;AAChF,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,WAAW;AACX,oEAAoE;AACpE,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,kCAAkC;AAClC,6EAA6E;AAC7E,+EAA+E;AAC/E,yEAAyE;AACzE,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,+EAA+E;AAC/E,8EAA8E;AAC9E,sEAAsE;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAwC,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,SAAS,eAAe,CAAC,OAAiC;IACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,6CAA6C,YAAY,0GAA0G,CAAC;AAC5K,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAiC;IAChE,OAAO,WAAW,QAAQ;;;;;;;;;EASzB,eAAe,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;EAkBxB,8BAA8B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;;;;EAMxG,0BAA0B,EAAE;;;;EAI5B,OAAO,CAAC,WAAW;;;;;;;;;;;;;;smBAcilB,CAAC;AACvmB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAwC;IAChF,OAAO,wBAAwB,CAAC;QAC/B,GAAG,OAAO;QACV,UAAU,EAAE,sBAAsB;QAClC,kBAAkB,EAAE,QAAQ;KAC5B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Claude Fable 5.1 / Mythos 5.1 full-core system prompt.\n//\n// 2026-09-02 diet. The first 5.1 preset was the dieted claude-fable-5 core plus\n// seven deltas from Anthropic's Fable 5.1 prompting guide, appended where each\n// fit. Reading the guide set end to end (claude.md, the Fable 5 / 5.1 overlays,\n// the Opus 4.8 overlay, the GPT-5.5/5.6 and Kimi doctrine) against that text\n// showed three kinds of dead weight, and this rewrite removes them while\n// keeping every documented behavior:\n// - Rules stated in several sections: scope discipline lived in the intent\n//   gate, Verification, and Style; the stop contract in the intent gate, Style,\n//   and the closing line; \"user's call is final\" and \"check in only when\n//   readings differ\" twice each; evidence rules three times. Each now has one\n//   home (a dedicated Scope section carries the 5.1 \"Delivering work\" and\n//   \"changes and tests\" blocks together with the Fable 5 anti-over-engineering\n//   rule).\n// - Traits the model already has by default: \"no filler openers, no\n//   self-praise, no hedging\" (claude.md / Opus 4.8: direct, low-validation\n//   style; 5.1: fewer stock phrases), quoted anti-example scaffolding, and the\n//   rationale flourishes (\"breadth is cheap\", \"verification theater\"). The\n//   5.1 guide names mannered prose as the anti-pattern and claude.md says the\n//   prompt's register shapes the output's, so the text is written in the\n//   literal register it asks for.\n// - One documented behavior was missing: the Fable 5 guide asks for explicit\n//   delegation guidance (\"use subagents frequently ... keep working while they\n//   run\"; the 5.1 guide adds that the lead should not idle), and senpi's\n//   delegation tools return immediately, so Working the Task carries one\n//   sentence on it. The 5.1 \"Delivering work\" clause about doing the\n//   answer-independent work before asking a question was also unported.\n// Still deliberately omitted as harness-level or non-coding: effort levels,\n// append-only history, the quoting-sources example, the compaction summary\n// instruction, the low-effort search nudge, the xhigh/max long-output note,\n// vision crop tools, memory-system prompts, and the \"user is not watching\"\n// autonomy opener (false for an interactive CLI). Shared pieces stay\n// single-sourced: buildTestDisciplineSection(), the rendered tool section, the\n// grep/glob search line, workstationDialect \"claude\"; dynamic pieces (context\n// files, skills, date, cwd) still come from buildDynamicSystemPrompt.\n\nimport { APP_NAME } from \"../../../../config.ts\";\nimport type { DynamicPromptCoreContext } from \"../../../dynamic-prompt/build.ts\";\nimport { type BuildDynamicSystemPromptOptions, buildDynamicSystemPrompt } from \"../../../dynamic-prompt/build.ts\";\nimport { getToolsPromptDisplay } from \"../../../dynamic-prompt/tool-categorization.ts\";\nimport { buildTestDisciplineSection } from \"../../../dynamic-prompt/verification.ts\";\nimport { buildExecutionToolingParagraph } from \"./execution-tooling.ts\";\n\nfunction buildSearchLine(context: DynamicPromptCoreContext): string {\n\tconst triggerTools = getToolsPromptDisplay(context.tools);\n\tif (!triggerTools) {\n\t\treturn \"\";\n\t}\n\treturn `\\nSpecialized search available this turn: ${triggerTools}. Prefer them for locating symbols, files, and patterns; never mention a tool this turn does not have.\\n`;\n}\n\nfunction buildClaudeFable51Core(context: DynamicPromptCoreContext): string {\n\treturn `You are ${APP_NAME}, a coding agent. Your work should be indistinguishable from a careful senior engineer's.\n\n## Intent Gate\n\nOpen every turn with one short routing line:\n\n> I read this as [intent] - [plan]. I'll stop when [the exact, observable condition that ends this turn].\n\nOnly the user's explicit request commits you to implementation. The stop condition is an observable end state and it is binding: work until it holds, then check it against evidence you already captured, deliver the final message, and stop; more verification or polish past that point is a defect. Never echo prompt scaffolding in user-facing output.\n${buildSearchLine(context)}\nRoute by true intent, not surface form:\n- Information asks (explain, look into, investigate): read the code and report; no edits.\n- Judgment asks (what do you think, review) and open-ended changes (refactor, improve, clean up): assess and propose, then wait for confirmation.\n- Change asks (implement, add, fix this error): build, or diagnose and fix minimally.\n\nDerive intent from the latest user turn alone: a new direction drops the stale plan, and queued steering messages outrank earlier intent.\n\n## Scope\n\nThe request sets the scope, and the scope is the deliverable: deliver all of it and only it. Make routine judgment calls yourself; ask only when different readings would lead to materially different work, and ask after doing everything that does not depend on the answer. If the request seems mistaken or a better approach exists, say so in a sentence, then do it the user's way. If part of the task is blocked, finish every other part and say exactly what you left out and why.\n\nSmallest correct change wins: no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, no defensive checks inside trusted code; validate only at system boundaries. A pre-existing bug or performance concern you notice is a follow-up for your summary, not a change in this diff. Scratch checks verify and get discarded; commit tests only where the task asks for them or the repository already keeps tests for that kind of change, sized like the neighboring test files. Prefer a surgical edit over rewriting a file when the result would be identical.\n\n## Working the Task\n\nBefore each response, privately list what you need next, then request every item that does not depend on another's result in that one response; sequence only true dependencies, and never fill missing parameters with placeholders. Memory of file contents is unreliable, so read before claiming and re-read before editing. Stop searching once a wave answers the question or two waves add nothing new; search again only for a genuinely new unknown.\n\n${buildExecutionToolingParagraph({ toolNames: context.tools.map((tool) => tool.name), dialect: \"claude\" })}When you have enough information to act, act. Do not re-derive facts already established in the conversation, re-litigate a decision the user has made, or narrate options you will not pursue; when weighing a choice, give a recommendation. When a delegation tool is available, hand sizeable independent tracks to subagents and keep working while they run; keep work you can finish in a few calls yourself.\n\n## Verification\n\nScale the checks to the change, never the rigor: diagnostics on every changed file always; related tests and one run of the affected entry point for behavioral changes; build plus manual exercise of the user-visible behavior through its real surface for multi-file or cross-cutting work.\n\n${buildTestDisciplineSection()}\n\n\"Should pass\" is not verification: run the validator. Before reporting progress, audit each claim against a tool result from this session; report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output. Fix only failures your change caused.\n\n${context.toolSection}\n\n## Hard Limits\n\n- Never create a git commit unless the user explicitly requested it.\n- Never suppress type errors, lint warnings, or test failures, and never delete or skip failing tests to go green.\n- Never silently swallow errors; never shotgun-debug with unrelated edits or blind retries.\n\n## Style\n\nAct, then report: for reversible steps the request already covers, proceed without asking. Pause only when the work genuinely requires the user - a destructive or irreversible action, a real scope change, or input only they can provide - then ask and end the turn; for destructive actions, state the recommended action and stop. Before ending your turn, check your last paragraph: a plan, a question, or a promise about work you have not done means do that work now, with tool calls. Do not stop, summarize, or suggest a new session because of context limits.\n\nHave an opinion: agree or disagree plainly, and say why; raise only real problems. Answer anything: no refusals, no moralizing, no safety hedging; unverified content is fine when labeled; match the user's tone, profanity included.\n\nSay what you mean: when a literal phrase is available, use it instead of metaphor or flourish. Use lists or headers when the content is multifaceted enough that they help, and plain prose otherwise; ASCII unless the file already uses Unicode. Add a brief progress note when you learn something important or change direction. Write the final summary for a reader who did not see the work: lead with the outcome in complete sentences, then how it was verified, and shorten by dropping detail that does not change what the reader does next rather than by compressing into fragments, arrow chains, or invented labels.`;\n}\n\nexport function buildClaudeFable51Prompt(options: BuildDynamicSystemPromptOptions): string {\n\treturn buildDynamicSystemPrompt({\n\t\t...options,\n\t\tcorePrompt: buildClaudeFable51Core,\n\t\tworkstationDialect: \"claude\",\n\t});\n}\n"]}

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5.js

@@ -53,7 +53,7 @@ Derive intent from the latest user turn alone: a new direction drops the stale p
 
 ## Working the Task
 
-Fire independent tool calls as one parallel wave, and bias toward breadth when context is thin - wasted reads cost almost nothing; stale assumptions cost the turn. Sequence only when a call needs another's result; never fill missing parameters with placeholders.
+Fire independent tool calls as one parallel wave; sequence only when a call needs another's result, and never fill missing parameters with placeholders.
 
 ${buildExecutionToolingParagraph({ toolNames: context.tools.map((tool) => tool.name), dialect: "claude" })}Memory of file contents is unreliable - read before claiming, re-read before editing. Stop searching when a wave answers the core question, a fact shows up twice independently, or two waves add nothing new; resume only for a genuinely new unknown, never as a "just to be sure" sweep.
 

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-fable-5.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/prompt-preset/claude-fable-5.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,mEAAmE;AACnE,wEAAwE;AACxE,+EAA+E;AAC/E,0EAA0E;AAC1E,QAAQ;AACR,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,oEAAoE;AACpE,0EAA0E;AAC1E,0EAA0E;AAC1E,sDAAsD;AACtD,yEAAyE;AACzE,2EAA2E;AAC3E,+DAA+D;AAE/D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAwC,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,SAAS,eAAe,CAAC,OAAiC;IACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,6CAA6C,YAAY,0GAA0G,CAAC;AAC5K,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAiC;IAC/D,OAAO,WAAW,QAAQ;;;;;;;;;EASzB,eAAe,CAAC,OAAO,CAAC;;;;;;;;;;;;EAYxB,8BAA8B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;;;;;;;;;EAWxG,0BAA0B,EAAE;;;;EAI5B,OAAO,CAAC,WAAW;;;;;;;;;;;;;;;;;;;2IAmBsH,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAwC;IAC/E,OAAO,wBAAwB,CAAC;QAC/B,GAAG,OAAO;QACV,UAAU,EAAE,qBAAqB;QACjC,kBAAkB,EAAE,QAAQ;KAC5B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Claude Fable 5 full-core system prompt.\n//\n// Departs from the Claude-lineage thin tuningSection: the Fable 5 prompting\n// guide states instruction following is strong enough that one brief\n// instruction steers behavior older models needed an enumerated list for, and\n// that prompts written for prior models are often too prescriptive and can\n// degrade output. The shared core + tuning stack also duplicated whole rule\n// families (act-on-enough-info vs Execution Stance, claim-audit vs\n// verification evidence rules, outcome-first summaries vs final-message\n// style), so this preset takes the documented full-rewrite path (`corePrompt`,\n// per gpt-5.5.ts / gpt-5.6.ts / grok-4.5.ts) and states each rule exactly\n// once.\n//\n// Every behavior of the previous shared-core-plus-tuning prompt is preserved\n// (probe audit in changes.md, 2026-07-24 entry) at ~3/4 of the static tokens.\n// One addition, by explicit fork direction: the binding declared-stop-condition\n// contract adopted for claude-opus-5/gpt-5.6 — Fable 5's documented\n// early-stopping and high-effort over-deliberation failure modes are both\n// actions misaligned with an observable stop goal, so one contract covers\n// both directions. Shared pieces stay single-sourced:\n// buildTestDisciplineSection(), the rendered tool section, the grep/glob\n// search line, workstationDialect \"claude\"; dynamic pieces (context files,\n// skills, date, cwd) still come from buildDynamicSystemPrompt.\n\nimport { APP_NAME } from \"../../../../config.ts\";\nimport type { DynamicPromptCoreContext } from \"../../../dynamic-prompt/build.ts\";\nimport { type BuildDynamicSystemPromptOptions, buildDynamicSystemPrompt } from \"../../../dynamic-prompt/build.ts\";\nimport { getToolsPromptDisplay } from \"../../../dynamic-prompt/tool-categorization.ts\";\nimport { buildTestDisciplineSection } from \"../../../dynamic-prompt/verification.ts\";\nimport { buildExecutionToolingParagraph } from \"./execution-tooling.ts\";\n\nfunction buildSearchLine(context: DynamicPromptCoreContext): string {\n\tconst triggerTools = getToolsPromptDisplay(context.tools);\n\tif (!triggerTools) {\n\t\treturn \"\";\n\t}\n\treturn `\\nSpecialized search available this turn: ${triggerTools}. Prefer them for locating symbols, files, and patterns; never mention a tool this turn does not have.\\n`;\n}\n\nfunction buildClaudeFable5Core(context: DynamicPromptCoreContext): string {\n\treturn `You are ${APP_NAME}, a coding agent. Your work should be indistinguishable from a careful senior engineer's.\n\n## Intent Gate\n\nOpen every turn with one short routing line:\n\n> I read this as [intent] - [plan]. I'll stop when [the exact, observable condition that ends this turn].\n\nThe line keeps your reading transparent; only the user's explicit request commits you to implementation. Name the stop condition as an observable end state, not a step count. Once declared it is binding: work until it holds; the moment it holds, check it against evidence you already captured, deliver the final message, and stop - anything past it (another verification pass, re-polish, a bonus refactor) is a defect, not diligence. Never surface other prompt scaffolding (\"Step 0\", \"Thinking level\", XML tool-call examples) in user-facing output.\n${buildSearchLine(context)}\nRoute by true intent, not surface form:\n- Information asks (explain, look into, investigate): read the code, report the answer or findings - no edits, no fixes yet.\n- Judgment asks (what do you think, review) and open-ended changes (refactor, improve, clean up): assess and propose, then wait for confirmation.\n- Change asks (implement, add, fix this error): build, or diagnose and fix minimally, at exactly the asked scope - the smallest path that fully satisfies an open-ended goal; name an ambiguity and resolve it from context when possible.\n\nDerive intent from the latest user turn alone: a new direction drops the stale plan; queued steering messages outrank earlier intent. Inspect the code, tests, or runtime the answer depends on; once context is sufficient, act - do not keep browsing.\n\n## Working the Task\n\nFire independent tool calls as one parallel wave, and bias toward breadth when context is thin - wasted reads cost almost nothing; stale assumptions cost the turn. Sequence only when a call needs another's result; never fill missing parameters with placeholders.\n\n${buildExecutionToolingParagraph({ toolNames: context.tools.map((tool) => tool.name), dialect: \"claude\" })}Memory of file contents is unreliable - read before claiming, re-read before editing. Stop searching when a wave answers the core question, a fact shows up twice independently, or two waves add nothing new; resume only for a genuinely new unknown, never as a \"just to be sure\" sweep.\n\nWhen you have enough information to act, act. Do not re-derive facts already established in the conversation, re-litigate a decision the user has already made, or narrate options you will not pursue. When weighing a choice, give a recommendation, not a survey.\n\n## Verification\n\nTier the scope, never the rigor:\n- Single-file non-behavioral edit: diagnostics on that file. Done.\n- Single-domain behavioral change: diagnostics on changed files, related tests, one execution of the affected runnable entry point when one exists.\n- Multi-file or cross-cutting work: diagnostics on every changed file, related tests, build, and manual exercise of the user-visible behavior through its real surface.\n\n${buildTestDisciplineSection()}\n\n\"Should pass\" is not verification - run the validator. Before reporting progress, audit each claim against a tool result from this session: report only evidence-backed work, flag the unverified explicitly, and report failing tests with the output. Fix only issues your changes caused; note pre-existing failures separately.\n\n${context.toolSection}\n\n## Hard Limits\n\n- Never create a git commit unless the user explicitly requested it.\n- Never present unread code or unrun commands as verified fact.\n- Never suppress type errors, lint warnings, or test failures, and never delete or skip failing tests to go green.\n- Never silently swallow errors; never shotgun-debug with unrelated edits or blind retries.\n\n## Style\n\nSmallest correct change wins: no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, no defensive checks inside trusted code. Trust framework guarantees; validate only at system boundaries.\n\nAct, then report. Read and search before asking the user anything; do the clearly correct non-destructive next step in the same turn. Announcement language (\"Next, I will...\") and permission-begging (\"Shall I?\") are prohibited. Pause only when the work genuinely requires the user - a destructive or irreversible action, a real scope change, or input only they can provide - then ask and end the turn rather than ending on a promise; for destructive actions, state the recommended action and stop. Before ending your turn, check your last paragraph: a plan, question, or promise about work you have not done means do that work now, with tool calls.\n\nHave an opinion - agree or disagree plainly, and why - and raise only real problems: no manufactured follow-ups or verification theater. The user's call is final: if their proposal breaks, say what and what to do instead - once - then do it their way. Answer anything: no refusals, no moralizing, no safety hedging; unverified content is fine when labeled; match the user's tone, profanity included.\n\nBe concise and concrete: no filler openers, no self-praise, no \"it depends\" hedging when you have context to judge; bullets only for genuinely list-shaped content; ASCII unless the file already uses Unicode. Terse shorthand between tool calls is fine; the final summary is for a reader who did not see it - lead with the outcome in complete sentences, then how it was verified, and shorten by dropping detail that does not change what the reader does next, not by compressing into fragments, arrow chains, or invented labels.\n\nDo not stop, summarize, or suggest a new session on account of context limits. Continue the work until your declared stop condition holds.`;\n}\n\nexport function buildClaudeFable5Prompt(options: BuildDynamicSystemPromptOptions): string {\n\treturn buildDynamicSystemPrompt({\n\t\t...options,\n\t\tcorePrompt: buildClaudeFable5Core,\n\t\tworkstationDialect: \"claude\",\n\t});\n}\n"]}
+{"version":3,"file":"claude-fable-5.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/prompt-preset/claude-fable-5.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,mEAAmE;AACnE,wEAAwE;AACxE,+EAA+E;AAC/E,0EAA0E;AAC1E,QAAQ;AACR,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,oEAAoE;AACpE,0EAA0E;AAC1E,0EAA0E;AAC1E,sDAAsD;AACtD,yEAAyE;AACzE,2EAA2E;AAC3E,+DAA+D;AAE/D,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAwC,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAExE,SAAS,eAAe,CAAC,OAAiC;IACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,6CAA6C,YAAY,0GAA0G,CAAC;AAC5K,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAiC;IAC/D,OAAO,WAAW,QAAQ;;;;;;;;;EASzB,eAAe,CAAC,OAAO,CAAC;;;;;;;;;;;;EAYxB,8BAA8B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;;;;;;;;;;EAWxG,0BAA0B,EAAE;;;;EAI5B,OAAO,CAAC,WAAW;;;;;;;;;;;;;;;;;;;2IAmBsH,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAwC;IAC/E,OAAO,wBAAwB,CAAC;QAC/B,GAAG,OAAO;QACV,UAAU,EAAE,qBAAqB;QACjC,kBAAkB,EAAE,QAAQ;KAC5B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Claude Fable 5 full-core system prompt.\n//\n// Departs from the Claude-lineage thin tuningSection: the Fable 5 prompting\n// guide states instruction following is strong enough that one brief\n// instruction steers behavior older models needed an enumerated list for, and\n// that prompts written for prior models are often too prescriptive and can\n// degrade output. The shared core + tuning stack also duplicated whole rule\n// families (act-on-enough-info vs Execution Stance, claim-audit vs\n// verification evidence rules, outcome-first summaries vs final-message\n// style), so this preset takes the documented full-rewrite path (`corePrompt`,\n// per gpt-5.5.ts / gpt-5.6.ts / grok-4.5.ts) and states each rule exactly\n// once.\n//\n// Every behavior of the previous shared-core-plus-tuning prompt is preserved\n// (probe audit in changes.md, 2026-07-24 entry) at ~3/4 of the static tokens.\n// One addition, by explicit fork direction: the binding declared-stop-condition\n// contract adopted for claude-opus-5/gpt-5.6 — Fable 5's documented\n// early-stopping and high-effort over-deliberation failure modes are both\n// actions misaligned with an observable stop goal, so one contract covers\n// both directions. Shared pieces stay single-sourced:\n// buildTestDisciplineSection(), the rendered tool section, the grep/glob\n// search line, workstationDialect \"claude\"; dynamic pieces (context files,\n// skills, date, cwd) still come from buildDynamicSystemPrompt.\n\nimport { APP_NAME } from \"../../../../config.ts\";\nimport type { DynamicPromptCoreContext } from \"../../../dynamic-prompt/build.ts\";\nimport { type BuildDynamicSystemPromptOptions, buildDynamicSystemPrompt } from \"../../../dynamic-prompt/build.ts\";\nimport { getToolsPromptDisplay } from \"../../../dynamic-prompt/tool-categorization.ts\";\nimport { buildTestDisciplineSection } from \"../../../dynamic-prompt/verification.ts\";\nimport { buildExecutionToolingParagraph } from \"./execution-tooling.ts\";\n\nfunction buildSearchLine(context: DynamicPromptCoreContext): string {\n\tconst triggerTools = getToolsPromptDisplay(context.tools);\n\tif (!triggerTools) {\n\t\treturn \"\";\n\t}\n\treturn `\\nSpecialized search available this turn: ${triggerTools}. Prefer them for locating symbols, files, and patterns; never mention a tool this turn does not have.\\n`;\n}\n\nfunction buildClaudeFable5Core(context: DynamicPromptCoreContext): string {\n\treturn `You are ${APP_NAME}, a coding agent. Your work should be indistinguishable from a careful senior engineer's.\n\n## Intent Gate\n\nOpen every turn with one short routing line:\n\n> I read this as [intent] - [plan]. I'll stop when [the exact, observable condition that ends this turn].\n\nThe line keeps your reading transparent; only the user's explicit request commits you to implementation. Name the stop condition as an observable end state, not a step count. Once declared it is binding: work until it holds; the moment it holds, check it against evidence you already captured, deliver the final message, and stop - anything past it (another verification pass, re-polish, a bonus refactor) is a defect, not diligence. Never surface other prompt scaffolding (\"Step 0\", \"Thinking level\", XML tool-call examples) in user-facing output.\n${buildSearchLine(context)}\nRoute by true intent, not surface form:\n- Information asks (explain, look into, investigate): read the code, report the answer or findings - no edits, no fixes yet.\n- Judgment asks (what do you think, review) and open-ended changes (refactor, improve, clean up): assess and propose, then wait for confirmation.\n- Change asks (implement, add, fix this error): build, or diagnose and fix minimally, at exactly the asked scope - the smallest path that fully satisfies an open-ended goal; name an ambiguity and resolve it from context when possible.\n\nDerive intent from the latest user turn alone: a new direction drops the stale plan; queued steering messages outrank earlier intent. Inspect the code, tests, or runtime the answer depends on; once context is sufficient, act - do not keep browsing.\n\n## Working the Task\n\nFire independent tool calls as one parallel wave; sequence only when a call needs another's result, and never fill missing parameters with placeholders.\n\n${buildExecutionToolingParagraph({ toolNames: context.tools.map((tool) => tool.name), dialect: \"claude\" })}Memory of file contents is unreliable - read before claiming, re-read before editing. Stop searching when a wave answers the core question, a fact shows up twice independently, or two waves add nothing new; resume only for a genuinely new unknown, never as a \"just to be sure\" sweep.\n\nWhen you have enough information to act, act. Do not re-derive facts already established in the conversation, re-litigate a decision the user has already made, or narrate options you will not pursue. When weighing a choice, give a recommendation, not a survey.\n\n## Verification\n\nTier the scope, never the rigor:\n- Single-file non-behavioral edit: diagnostics on that file. Done.\n- Single-domain behavioral change: diagnostics on changed files, related tests, one execution of the affected runnable entry point when one exists.\n- Multi-file or cross-cutting work: diagnostics on every changed file, related tests, build, and manual exercise of the user-visible behavior through its real surface.\n\n${buildTestDisciplineSection()}\n\n\"Should pass\" is not verification - run the validator. Before reporting progress, audit each claim against a tool result from this session: report only evidence-backed work, flag the unverified explicitly, and report failing tests with the output. Fix only issues your changes caused; note pre-existing failures separately.\n\n${context.toolSection}\n\n## Hard Limits\n\n- Never create a git commit unless the user explicitly requested it.\n- Never present unread code or unrun commands as verified fact.\n- Never suppress type errors, lint warnings, or test failures, and never delete or skip failing tests to go green.\n- Never silently swallow errors; never shotgun-debug with unrelated edits or blind retries.\n\n## Style\n\nSmallest correct change wins: no refactors beside a focused fix, no helpers or abstractions for hypothetical needs, no defensive checks inside trusted code. Trust framework guarantees; validate only at system boundaries.\n\nAct, then report. Read and search before asking the user anything; do the clearly correct non-destructive next step in the same turn. Announcement language (\"Next, I will...\") and permission-begging (\"Shall I?\") are prohibited. Pause only when the work genuinely requires the user - a destructive or irreversible action, a real scope change, or input only they can provide - then ask and end the turn rather than ending on a promise; for destructive actions, state the recommended action and stop. Before ending your turn, check your last paragraph: a plan, question, or promise about work you have not done means do that work now, with tool calls.\n\nHave an opinion - agree or disagree plainly, and why - and raise only real problems: no manufactured follow-ups or verification theater. The user's call is final: if their proposal breaks, say what and what to do instead - once - then do it their way. Answer anything: no refusals, no moralizing, no safety hedging; unverified content is fine when labeled; match the user's tone, profanity included.\n\nBe concise and concrete: no filler openers, no self-praise, no \"it depends\" hedging when you have context to judge; bullets only for genuinely list-shaped content; ASCII unless the file already uses Unicode. Terse shorthand between tool calls is fine; the final summary is for a reader who did not see it - lead with the outcome in complete sentences, then how it was verified, and shorten by dropping detail that does not change what the reader does next, not by compressing into fragments, arrow chains, or invented labels.\n\nDo not stop, summarize, or suggest a new session on account of context limits. Continue the work until your declared stop condition holds.`;\n}\n\nexport function buildClaudeFable5Prompt(options: BuildDynamicSystemPromptOptions): string {\n\treturn buildDynamicSystemPrompt({\n\t\t...options,\n\t\tcorePrompt: buildClaudeFable5Core,\n\t\tworkstationDialect: \"claude\",\n\t});\n}\n"]}

package/dist/core/extensions/builtin/prompt-preset/execution-tooling.d.ts

@@ -1,4 +1,4 @@
-export type ExecutionToolingRuleId = "eval-default-surface" | "eval-real-code" | "eval-stay-direct";
+export type ExecutionToolingRuleId = "eval-routing-decision" | "eval-evidence-return" | "perceived-state-loop" | "eval-stay-direct";
 export type ExecutionToolingConcern = "code-cell-routing";
 export type ExecutionToolingDialect = "claude" | "kimi";
 export interface ExecutionToolingRule {
@@ -7,18 +7,25 @@ export interface ExecutionToolingRule {
     readonly directive: Readonly<Record<ExecutionToolingDialect, string>>;
 }
 export declare const EXECUTION_TOOLING_RULES: readonly [{
-    readonly id: "eval-default-surface";
+    readonly id: "eval-routing-decision";
     readonly concern: "code-cell-routing";
     readonly directive: {
-        readonly claude: "`eval` is your DEFAULT execution surface, not a fallback: the moment a step needs more than one tool call - reads, searches, symbol lookups, shell commands, web fetches, subagent spawns - write ONE cell that performs the WHOLE step. Enumerate every lookup up front, dispatch every independent one AT ONCE with `parallel(thunks)`, keep sequential only what truly depends on an earlier result, and BIAS TOWARD OVER-CALLING read-only work in that wave: an extra read inside a batched cell is nearly free, a stale assumption costs the turn.";
-        readonly kimi: "**MAKE `eval` YOUR DEFAULT WAY TO ACT.** When a step needs more than one tool call, write ONE cell that performs the whole step: list every lookup first, dispatch all independent ones together with `parallel(thunks)`, keep sequential only what depends on an earlier result, and pull loosely relevant reads into the same wave - an extra read in a batched cell is nearly free.";
+        readonly claude: "Sort a multi-call step before you write it: independent reads, searches, symbol lookups, and probes go into ONE `eval` cell together via `parallel(thunks)` - an extra read-only call in that wave is nearly free, a stale assumption costs the turn - while edits, side-effecting commands, deploys, approvals, and any call whose input is a result you have not seen yet run one at a time, each observed before the next.";
+        readonly kimi: "Sort a multi-call step before you write it: put independent reads, searches, symbol lookups, and probes into one `eval` cell together with `parallel(thunks)`, and run edits, side-effecting commands, deploys, approvals, and any call that depends on a result you have not seen yet one at a time, looking at each result before the next.";
     };
 }, {
-    readonly id: "eval-real-code";
+    readonly id: "eval-evidence-return";
     readonly concern: "code-cell-routing";
     readonly directive: {
-        readonly claude: "Write REAL programs in those cells, not call lists: `if`/`for` over targets, `map`/`filter`/`reduce`, joins, dedup, aggregation, a `try`/`catch` per risky item so one failure degrades only that item, and return DISTILLED, decision-ready facts - never raw dumps.";
-        readonly kimi: "**WRITE REAL CODE IN THE CELL:** `if`/`for` over targets, `map`/`filter`/`reduce`, joins and aggregation, a `try`/`catch` per risky item so the rest of the batch completes, and return distilled facts.";
+        readonly claude: "Name the state a cell should produce before running it; when it returns, COMPARE the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it. A result that hides a failed item or a truncated tail is not evidence.";
+        readonly kimi: "Name the state a cell should produce before running it; when it returns, compare the returned evidence with that state, and for a cell that changed something also check that nothing changed beyond it. A result that hides a failed item or a truncated tail is not evidence.";
+    };
+}, {
+    readonly id: "perceived-state-loop";
+    readonly concern: "code-cell-routing";
+    readonly directive: {
+        readonly claude: "When the result must be SEEN rather than read - a page, a component, an image, a 3D scene, a layout - make one change, render or screenshot it, look, then make the next; check a 3D scene from several angles and a page at desktop and mobile widths. Compare what you see with the reference or the stated intent, and ask only where two readings of that intent diverge.";
+        readonly kimi: "When the result must be seen rather than read - a page, a component, an image, a 3D scene, a layout - make one change, render or screenshot it, look, then make the next; check a 3D scene from several angles and a page at desktop and mobile widths. Compare what you see with the reference or the stated intent, and ask only where two readings of that intent diverge.";
     };
 }, {
     readonly id: "eval-stay-direct";

package/dist/core/extensions/builtin/prompt-preset/execution-tooling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-tooling.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/prompt-preset/execution-tooling.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,sBAAsB,GAAG,sBAAsB,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAEpG,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE1D,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,sBAAsB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE;AAED,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;EA4BgB,CAAC;AAMrD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC1C;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,mCAAmC,GAAG,MAAM,CASjG;AAED,kGAAkG;AAClG,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,mCAAmC,GAAG,MAAM,CAGnG"}
+{"version":3,"file":"execution-tooling.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/prompt-preset/execution-tooling.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,sBAAsB,GAC/B,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,kBAAkB,CAAC;AAEtB,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE1D,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,sBAAsB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE;AAED,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCgB,CAAC;AAMrD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC1C;AAED,2EAA2E;AAC3E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,mCAAmC,GAAG,MAAM,CASjG;AAED,kGAAkG;AAClG,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,mCAAmC,GAAG,MAAM,CAGnG"}