@epoch-agent/infra 0.1.0

package/dist/index.js

@@ -0,0 +1,3099 @@
+import { platform, homedir, tmpdir } from 'os';
+import { join, dirname, delimiter, resolve as resolve$1, isAbsolute, basename, win32, posix, relative } from 'path';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, openSync, closeSync, writeSync, renameSync, rmSync, chmodSync, lstatSync, realpathSync, accessSync, constants } from 'fs';
+import Database from 'better-sqlite3';
+import { execFileSync, execFile, spawn } from 'child_process';
+import { TextDecoder } from 'util';
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import { load } from 'js-yaml';
+import { randomBytes, createCipheriv, createDecipheriv, createHash } from 'crypto';
+
+// src/paths.ts
+function resolveHomeDir() {
+  const explicit = process.env.EPOCH_HOME;
+  if (explicit) return explicit;
+  const profile = process.env.EPOCH_PROFILE || "default";
+  if (profile !== "default") return join(homedir(), ".epoch", "profiles", profile);
+  return join(homedir(), ".epoch");
+}
+function resolveProfile() {
+  return process.env.EPOCH_PROFILE || "default";
+}
+function configPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "config.yaml");
+}
+function envPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, ".env");
+}
+function dbPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "sessions.db");
+}
+function memoriesDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "memories");
+}
+function skillsDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "skills");
+}
+function policiesDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "policies");
+}
+function hooksPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "hooks.json");
+}
+function keybindingsPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "keybindings.json");
+}
+function agentsDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "agents");
+}
+function commandsDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "commands");
+}
+function mcpConfigPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "mcp.json");
+}
+function pluginsDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "plugins");
+}
+function pluginsStatePath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "plugins.json");
+}
+function marketplacesPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "marketplaces.json");
+}
+function approvalsPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "approvals.json");
+}
+function trustPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "trusted-folders.json");
+}
+function trustedImportsPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "trusted-imports.json");
+}
+function workspacesPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "workspaces.json");
+}
+function budgetStatePath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "budget.json");
+}
+function mcpAuthPath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "mcp-auth.json");
+}
+function mcpSchemaCachePath(homeDir = resolveHomeDir()) {
+  return join(homeDir, "cache", "mcp-schema-cache.json");
+}
+function artifactsDir(sessionId, homeDir = resolveHomeDir()) {
+  return bySession(join(homeDir, "artifacts"), sessionId);
+}
+function checkpointsDir(sessionId, homeDir = resolveHomeDir()) {
+  return bySession(join(homeDir, "checkpoints"), sessionId);
+}
+function worktreesDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "worktrees");
+}
+function automationDir(homeDir = resolveHomeDir()) {
+  return join(homeDir, "automation");
+}
+function automationWorkDir(taskId, homeDir = resolveHomeDir()) {
+  return byTask(automationDir(homeDir), taskId);
+}
+function automationLogsDir(taskId, homeDir = resolveHomeDir()) {
+  return byTask(join(automationDir(homeDir), "logs"), taskId);
+}
+function byTask(base, taskId) {
+  const safe = taskId.replace(/[^A-Za-z0-9_-]/g, "_");
+  return join(base, safe.length > 0 ? safe : "unknown");
+}
+function bySession(base, sessionId) {
+  if (sessionId === void 0) return base;
+  const safe = sessionId.replace(/[^A-Za-z0-9_-]/g, "_");
+  return join(base, safe.length > 0 ? safe : "unknown");
+}
+var PROJECT_DIR_NAME = ".epoch";
+function projectSettingsPath(projectRoot) {
+  return join(projectRoot, PROJECT_DIR_NAME, "settings.json");
+}
+function projectLocalSettingsPath(projectRoot) {
+  return join(projectRoot, PROJECT_DIR_NAME, "settings.local.json");
+}
+function projectSchemasDir(projectRoot) {
+  return join(projectRoot, PROJECT_DIR_NAME, "schemas");
+}
+function projectCommandsDir(projectRoot) {
+  return join(projectRoot, PROJECT_DIR_NAME, "commands");
+}
+function projectSkillsDir(projectRoot) {
+  return join(projectRoot, PROJECT_DIR_NAME, "skills");
+}
+function projectHooksPath(projectRoot) {
+  return join(projectRoot, PROJECT_DIR_NAME, "hooks.json");
+}
+function projectPoliciesDir(projectRoot) {
+  return join(projectRoot, PROJECT_DIR_NAME, "policies");
+}
+function managedSettingsPath(os = platform()) {
+  const FILE = "managed-settings.json";
+  if (os === "win32") {
+    return join(process.env.ProgramData || "C:\\ProgramData", "epoch", FILE);
+  }
+  if (os === "darwin") return join("/Library", "Application Support", "epoch", FILE);
+  return join("/etc", "epoch", FILE);
+}
+var DEFAULT_YAML = "provider:\n  type: openai\n  apiKey: ''\nmodel: gpt-4o-mini\nmaxTurns: 50\n";
+function setScalar(yaml, key, value) {
+  const pattern = new RegExp(`^${key}:.*$`, "m");
+  if (pattern.test(yaml)) return yaml.replace(pattern, `${key}: ${value}`);
+  return yaml.trimEnd() + `
+${key}: ${value}
+`;
+}
+function setSectionField(yaml, section, field, value) {
+  const entry = `  ${field}: ${value}`;
+  const header = new RegExp(`^${section}:[ \\t]*$`, "m");
+  if (!header.test(yaml)) {
+    return `${yaml.trimEnd()}
+${section}:
+${entry}
+`;
+  }
+  const existing = new RegExp(`^(${section}:[ \\t]*\\n(?:[ \\t]+.*\\n)*?)[ \\t]+${field}:.*$`, "m");
+  if (existing.test(yaml)) return yaml.replace(existing, `$1${entry}`);
+  return yaml.replace(header, `${section}:
+${entry}`);
+}
+function readKey(yaml, key) {
+  const dot = key.indexOf(".");
+  if (dot === -1) {
+    return cleanValue(new RegExp(`^${key}:[ \\t]*(.*)$`, "m").exec(yaml)?.[1]);
+  }
+  const section = key.slice(0, dot);
+  const field = key.slice(dot + 1);
+  const block = new RegExp(`^${section}:[ \\t]*\\n((?:[ \\t]+.*\\n?)*)`, "m").exec(yaml)?.[1];
+  if (block === void 0) return void 0;
+  return cleanValue(new RegExp(`^[ \\t]+${field}:[ \\t]*(.*)$`, "m").exec(block)?.[1]);
+}
+function cleanValue(raw) {
+  if (raw === void 0) return void 0;
+  const trimmed = raw.trim();
+  const quoted = /^(['"])(.*)\1$/.exec(trimmed);
+  const value = quoted ? quoted[2] ?? "" : trimmed.replace(/\s+#.*$/, "").trim();
+  return value === "" ? void 0 : value;
+}
+function unsetScalar(yaml, key) {
+  const pattern = new RegExp(`^${key}:.*\\n?`, "m");
+  return yaml.replace(pattern, "");
+}
+function unsetSectionField(yaml, section, field) {
+  const pattern = new RegExp(
+    `^(${section}:[ \\t]*\\n(?:[ \\t]+.*\\n)*?)[ \\t]+${field}:.*\\n?`,
+    "m"
+  );
+  return dropEmptySection(yaml.replace(pattern, "$1"), section);
+}
+function dropEmptySection(yaml, section) {
+  const empty = new RegExp(`^${section}:[ \\t]*(?:\\n(?![ \\t]+\\S)|(?![\\s\\S]))`, "m");
+  return yaml.replace(empty, "");
+}
+function readConfigYaml(path) {
+  return existsSync(path) ? readFileSync(path, "utf-8") : DEFAULT_YAML;
+}
+function writeConfigYaml(path, yaml) {
+  writeFileSync(path, yaml, "utf-8");
+}
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+var MAX_NAME_ATTEMPTS = 8;
+function sanitize(name) {
+  return name.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 64);
+}
+function resolveExisting(path, onExisting) {
+  if (onExisting !== "reuse") return void 0;
+  try {
+    return lstatSync(path).isFile() ? path : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function openArtifact(dir, name, extension, onExisting = "unique") {
+  try {
+    mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+  } catch {
+    return void 0;
+  }
+  const stem = sanitize(name);
+  for (let attempt = 0; attempt < MAX_NAME_ATTEMPTS; attempt += 1) {
+    const suffix = attempt === 0 ? "" : `-${attempt}`;
+    const path = join(dir, `${stem}${suffix}${extension}`);
+    let fd;
+    try {
+      fd = openSync(path, "wx", FILE_MODE);
+    } catch (err) {
+      if (err.code !== "EEXIST") return void 0;
+      const reused = resolveExisting(path, onExisting);
+      if (reused) return { path: reused, append: () => {
+      }, close: () => {
+      } };
+      continue;
+    }
+    return makeHandle(path, fd);
+  }
+  return void 0;
+}
+function makeHandle(path, fd) {
+  let open = true;
+  return {
+    path,
+    append(data) {
+      if (!open) return;
+      try {
+        writeSync(fd, typeof data === "string" ? Buffer.from(data, "utf-8") : data);
+      } catch {
+        open = false;
+      }
+    },
+    close() {
+      if (!open) return;
+      open = false;
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  };
+}
+function writeArtifact(dir, name, extension, data, onExisting = "unique") {
+  const handle = openArtifact(dir, name, extension, onExisting);
+  if (!handle) return void 0;
+  handle.append(data);
+  handle.close();
+  return handle.path;
+}
+
+// src/text-slice.ts
+function isHighSurrogate(code) {
+  return code >= 55296 && code <= 56319;
+}
+function isLowSurrogate(code) {
+  return code >= 56320 && code <= 57343;
+}
+function headEnd(text, count) {
+  let index = 0;
+  let seen = 0;
+  while (index < text.length && seen < count) {
+    const isPair = isHighSurrogate(text.charCodeAt(index)) && index + 1 < text.length;
+    index += isPair ? 2 : 1;
+    seen += 1;
+  }
+  return index;
+}
+function tailStart(text, count) {
+  let index = text.length;
+  let seen = 0;
+  while (index > 0 && seen < count) {
+    const isPair = isLowSurrogate(text.charCodeAt(index - 1)) && index - 2 >= 0;
+    index -= isPair ? 2 : 1;
+    seen += 1;
+  }
+  return index;
+}
+function countCodePoints(text) {
+  let count = 0;
+  for (let i = 0; i < text.length; i += 1) {
+    if (isHighSurrogate(text.charCodeAt(i)) && i + 1 < text.length) i += 1;
+    count += 1;
+  }
+  return count;
+}
+function headCodePoints(text, count) {
+  if (count <= 0) return "";
+  return text.slice(0, headEnd(text, count));
+}
+function tailCodePoints(text, count) {
+  if (count <= 0) return "";
+  return text.slice(tailStart(text, count));
+}
+function keepHeadAndTail(text, head, tail, join9) {
+  const total = countCodePoints(text);
+  if (total <= head + tail) return text;
+  const front = headCodePoints(text, head);
+  const back = tailCodePoints(text, tail);
+  return `${front}${join9(total - head - tail)}${back}`;
+}
+var pool = /* @__PURE__ */ new Map();
+function openDatabase(path) {
+  if (path === ":memory:") {
+    const db2 = new Database(path);
+    db2.pragma("foreign_keys = ON");
+    return db2;
+  }
+  const existing = pool.get(path);
+  if (existing) {
+    existing.refs++;
+    return existing.db;
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  const db = new Database(path);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  pool.set(path, { db, refs: 1 });
+  return db;
+}
+function releaseDatabase(path) {
+  const entry = pool.get(path);
+  if (!entry) return;
+  entry.refs--;
+  if (entry.refs > 0) return;
+  pool.delete(path);
+  try {
+    entry.db.close();
+  } catch {
+  }
+}
+function refCount(path) {
+  return pool.get(path)?.refs ?? 0;
+}
+function closeAllDatabases() {
+  for (const [path, entry] of pool) {
+    try {
+      entry.db.close();
+    } catch {
+    }
+    pool.delete(path);
+  }
+}
+var MIGRATION_TABLE = `
+  CREATE TABLE IF NOT EXISTS _epoch_migrations (
+    namespace   TEXT    NOT NULL,
+    version     INTEGER NOT NULL,
+    description TEXT    NOT NULL,
+    applied_at  TEXT    NOT NULL,
+    id          TEXT,
+    PRIMARY KEY (namespace, version)
+  );
+`;
+function ensureIdColumn(db) {
+  const columns = db.prepare("PRAGMA table_info(_epoch_migrations)").all();
+  if (!columns.some((c) => c.name === "id")) {
+    db.exec("ALTER TABLE _epoch_migrations ADD COLUMN id TEXT");
+  }
+}
+function reconcile(db, namespace, migrations) {
+  const rows = db.prepare("SELECT version, id, description FROM _epoch_migrations WHERE namespace = ?").all(namespace);
+  const byId = /* @__PURE__ */ new Map();
+  const legacyByDescription = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    if (row.id !== null) byId.set(row.id, row);
+    else if (!legacyByDescription.has(row.description))
+      legacyByDescription.set(row.description, row);
+  }
+  const pending2 = [];
+  const repairs = [];
+  const claimed = /* @__PURE__ */ new Set();
+  for (const m of migrations) {
+    const row = byId.get(m.id) ?? legacyByDescription.get(m.description);
+    if (!row) {
+      pending2.push(m);
+      continue;
+    }
+    claimed.add(row.version);
+    if (row.id !== m.id || row.version !== m.version || row.description !== m.description) {
+      repairs.push({ from: row.version, to: m });
+    }
+  }
+  const unclaimed = rows.filter((r) => !claimed.has(r.version));
+  for (const m of pending2) {
+    const blocker = unclaimed.find((r) => r.version === m.version);
+    if (blocker) {
+      throw new Error(
+        `\u8FC1\u79FB\u7248\u672C\u53F7\u649E\u4E86\uFF1A${namespace} \u7684 v${m.version} \u60F3\u7ED9\u300C${m.id}\u300D\u7528\uFF0C\u800C\u5E93\u91CC v${m.version} \u8BB0\u7684\u662F\u300C${blocker.description}\u300D\uFF08id=${blocker.id ?? "\u65E0\uFF0C\u8001\u5E93"}\uFF09\u3002\u8FD9\u4E2A\u5E93\u8DD1\u8FC7\u522B\u7684\u5206\u652F\uFF0C\u6216\u8005\u67D0\u6761\u8FC1\u79FB\u7684 id \u88AB\u6539\u8FC7\u4E86\u3002\u522B\u9760\u6539\u7248\u672C\u53F7\u7ED5\u8FC7\u53BB \u2014\u2014 \u5148\u5F04\u6E05\u5E93\u91CC\u90A3\u6761\u5230\u5E95\u505A\u8FC7\u4EC0\u4E48`
+      );
+    }
+  }
+  if (repairs.length > 0) {
+    const park = db.prepare(
+      "UPDATE _epoch_migrations SET version = ? WHERE namespace = ? AND version = ?"
+    );
+    const place = db.prepare(
+      "UPDATE _epoch_migrations SET version = ?, id = ?, description = ? WHERE namespace = ? AND version = ?"
+    );
+    const parkBase = Math.min(0, ...rows.map((r) => r.version)) - 1;
+    db.transaction(() => {
+      repairs.forEach((r, i) => park.run(parkBase - i, namespace, r.from));
+      repairs.forEach(
+        (r, i) => place.run(r.to.version, r.to.id, r.to.description, namespace, parkBase - i)
+      );
+    })();
+  }
+  return pending2;
+}
+function migrate(db, namespace, migrations) {
+  db.exec(MIGRATION_TABLE);
+  ensureIdColumn(db);
+  const ordered = [...migrations].sort((a, b) => a.version - b.version);
+  for (const key of ["id", "version"]) {
+    const seen = /* @__PURE__ */ new Map();
+    for (const m of ordered) {
+      const other = seen.get(m[key]);
+      if (other) {
+        throw new Error(
+          `${namespace} \u6709\u4E24\u6761\u8FC1\u79FB\u7684 ${key} \u90FD\u662F ${String(m[key])}\uFF1A\u300C${other.description}\u300D\u548C\u300C${m.description}\u300D\u3002\u4E24\u4E2A\u5206\u652F\u5404\u5199\u4E86\u4E00\u6761\u662F\u5E38\u4E8B \u2014\u2014 version \u76F4\u63A5\u6539\u53F7\uFF08\u8BA4\u8D26\u9760 id\uFF0C\u6539\u53F7\u5B89\u5168\uFF09\uFF1Bid \u649E\u4E86\u8BF4\u660E\u662F\u590D\u5236\u7C98\u8D34\u6F0F\u6539\uFF0C\u6362\u4E00\u4E2A`
+        );
+      }
+      seen.set(m[key], m);
+    }
+  }
+  const record = db.prepare(
+    "INSERT INTO _epoch_migrations (namespace, version, description, applied_at, id) VALUES (?, ?, ?, ?, ?)"
+  );
+  for (const m of reconcile(db, namespace, ordered)) {
+    const run2 = db.transaction(() => {
+      m.up(db);
+      record.run(namespace, m.version, m.description, (/* @__PURE__ */ new Date()).toISOString(), m.id);
+    });
+    run2();
+  }
+}
+function schemaVersion(db, namespace) {
+  db.exec(MIGRATION_TABLE);
+  const row = db.prepare("SELECT MAX(version) AS v FROM _epoch_migrations WHERE namespace = ?").get(namespace);
+  return row?.v ?? 0;
+}
+
+// src/mask.ts
+function maskApiKey(key) {
+  if (!key || key.length < 8) return "***";
+  return `${key.slice(0, 3)}-***${key.slice(-4)}`;
+}
+var SENSITIVE_WORDS = [
+  "key",
+  "token",
+  "secret",
+  "password",
+  "passwd",
+  "credential",
+  "auth",
+  "bearer",
+  "apikey"
+];
+function isSensitiveKey(name) {
+  const lower = name.toLowerCase();
+  return SENSITIVE_WORDS.some((word) => lower.includes(word));
+}
+function maskSensitive(data) {
+  const masked = {};
+  for (const [k, v] of Object.entries(data)) {
+    if (isSensitiveKey(k)) {
+      masked[k] = typeof v === "string" ? maskApiKey(v) : "***";
+    } else {
+      masked[k] = v;
+    }
+  }
+  return masked;
+}
+
+// src/logger.ts
+var currentLevel = "info";
+function setLogLevel(level) {
+  currentLevel = level;
+}
+var LEVEL_RANK = { debug: 0, info: 1, warn: 2, error: 3 };
+function shouldLog(level) {
+  return LEVEL_RANK[level] >= LEVEL_RANK[currentLevel];
+}
+function emit(entry) {
+  const line = JSON.stringify({
+    ...entry,
+    data: entry.data ? maskSensitive(entry.data) : void 0
+  });
+  if (entry.level === "error") process.stderr.write(line + "\n");
+  else process.stdout.write(line + "\n");
+}
+function createLogger(module) {
+  return {
+    debug(msg, data) {
+      if (shouldLog("debug"))
+        emit({ level: "debug", module, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString(), data });
+    },
+    info(msg, data) {
+      if (shouldLog("info"))
+        emit({ level: "info", module, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString(), data });
+    },
+    warn(msg, data) {
+      if (shouldLog("warn"))
+        emit({ level: "warn", module, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString(), data });
+    },
+    error(msg, data) {
+      if (shouldLog("error"))
+        emit({ level: "error", module, message: msg, timestamp: (/* @__PURE__ */ new Date()).toISOString(), data });
+    }
+  };
+}
+var IS_WINDOWS = platform() === "win32";
+var WINDOWS_HIDE_FLAGS = IS_WINDOWS ? { windowsHide: true } : {};
+function getPythonCommand() {
+  if (IS_WINDOWS) return "python";
+  return "python3";
+}
+var SHELL_KINDS = ["cmd", "powershell", "pwsh"];
+var SHELL_EXECUTABLES = {
+  cmd: "cmd.exe",
+  // Windows PowerShell 5.1，随系统自带
+  powershell: "powershell.exe",
+  // PowerShell 7+，要自己装
+  pwsh: "pwsh.exe"
+};
+var configuredShell = null;
+function setShell(kind) {
+  if (!IS_WINDOWS) return;
+  configuredShell = kind ?? null;
+}
+function resolveShellKind() {
+  if (!IS_WINDOWS) return "cmd";
+  const fromEnv = SHELL_KINDS.find((k) => k === process.env["EPOCH_SHELL"]);
+  return fromEnv ?? configuredShell ?? "cmd";
+}
+function getDefaultShell() {
+  return IS_WINDOWS ? SHELL_EXECUTABLES[resolveShellKind()] : "/bin/sh";
+}
+function probeShell(kind) {
+  if (!IS_WINDOWS) return null;
+  const exe = SHELL_EXECUTABLES[kind];
+  const dirs = (process.env["PATH"] ?? "").split(delimiter).filter(Boolean);
+  for (const dir of dirs) {
+    if (existsSync(join(dir, exe))) return null;
+  }
+  return `shell: \u914D\u7F6E\u7684 ${kind}\uFF08${exe}\uFF09\u4E0D\u5728 PATH \u4E0A\uFF0C\u5DF2\u56DE\u9000\u5230 cmd.exe`;
+}
+var PS_EXIT_TRAILER = [
+  "$__epochOk = $?",
+  "$__epochCode = $LASTEXITCODE",
+  "if ($null -eq $__epochCode) { if ($__epochOk) { exit 0 } else { exit 1 } }",
+  "exit $__epochCode"
+].join("\r\n");
+function powershellCommandArg(command) {
+  const escape = (s) => s.replaceAll('"', String.raw`\"`);
+  return `-NoProfile -NonInteractive -Command "${escape(command)}\r
+${escape(PS_EXIT_TRAILER)}"`;
+}
+function shellSpawnArgs(command) {
+  if (!IS_WINDOWS) return { file: getDefaultShell(), args: ["-c", command], options: {} };
+  const file = getDefaultShell();
+  if (resolveShellKind() === "cmd") {
+    return {
+      file,
+      args: ["/d", "/s", "/c", `"${command}"`],
+      options: { windowsVerbatimArguments: true }
+    };
+  }
+  return {
+    file,
+    args: [powershellCommandArg(command)],
+    options: { windowsVerbatimArguments: true }
+  };
+}
+function shellPtyArgs(command) {
+  if (!IS_WINDOWS) return { file: getDefaultShell(), args: ["-c", command] };
+  const file = getDefaultShell();
+  if (resolveShellKind() === "cmd") return { file, args: `/d /s /c "${command}"` };
+  return { file, args: powershellCommandArg(command) };
+}
+function normalizeForMatch(path) {
+  return path.replaceAll("\\", "/").toLowerCase();
+}
+function encodingForCodePage(codePage) {
+  const table = {
+    65001: "utf-8",
+    936: "gbk",
+    // 简体中文
+    950: "big5",
+    // 繁体中文
+    932: "shift_jis",
+    // 日文
+    949: "euc-kr",
+    // 韩文
+    866: "ibm866",
+    // 西里尔 OEM
+    874: "windows-874",
+    1250: "windows-1250",
+    1251: "windows-1251",
+    1252: "windows-1252",
+    1253: "windows-1253",
+    1254: "windows-1254",
+    1255: "windows-1255",
+    1256: "windows-1256",
+    1257: "windows-1257",
+    1258: "windows-1258"
+  };
+  return table[codePage] ?? "utf-8";
+}
+var cachedConsoleEncoding = null;
+function detectConsoleEncoding() {
+  if (!IS_WINDOWS) return "utf-8";
+  if (cachedConsoleEncoding !== null) return cachedConsoleEncoding;
+  let encoding = "utf-8";
+  try {
+    const out = execFileSync("chcp.com", { encoding: "latin1", windowsHide: true, timeout: 3e3 });
+    const nums = out.match(/\d+/g);
+    const last = nums?.[nums.length - 1];
+    if (last) encoding = encodingForCodePage(Number(last));
+  } catch {
+  }
+  cachedConsoleEncoding = encoding;
+  return encoding;
+}
+var EMPTY = Buffer.alloc(0);
+function makeDecoder(encoding) {
+  try {
+    return new TextDecoder(encoding);
+  } catch {
+    return new TextDecoder("utf-8");
+  }
+}
+function asciiPrefixLength(bytes) {
+  let i = 0;
+  while (i < bytes.length && bytes[i] < 128) i++;
+  return i;
+}
+function createStreamDecoder(fallbackEncoding = detectConsoleEncoding()) {
+  let decoder = null;
+  let pending2 = EMPTY;
+  const decide = (rest) => {
+    try {
+      const probe = new TextDecoder("utf-8", { fatal: true }).decode(rest, { stream: true });
+      return probe.length === 0 ? null : makeDecoder("utf-8");
+    } catch {
+      return makeDecoder(fallbackEncoding);
+    }
+  };
+  return {
+    write(chunk) {
+      if (decoder) return decoder.decode(chunk, { stream: true });
+      const buf = pending2.length === 0 ? chunk : Buffer.concat([pending2, chunk]);
+      const cut = asciiPrefixLength(buf);
+      const ascii = buf.subarray(0, cut).toString("latin1");
+      const rest = buf.subarray(cut);
+      if (rest.length === 0) {
+        pending2 = EMPTY;
+        return ascii;
+      }
+      const chosen = decide(rest);
+      if (!chosen) {
+        pending2 = rest;
+        return ascii;
+      }
+      decoder = chosen;
+      pending2 = EMPTY;
+      return ascii + chosen.decode(rest, { stream: true });
+    },
+    end() {
+      const final = decoder ?? makeDecoder("utf-8");
+      decoder = final;
+      const tail = pending2;
+      pending2 = EMPTY;
+      return (tail.length > 0 ? final.decode(tail, { stream: true }) : "") + final.decode();
+    }
+  };
+}
+var RIPGREP_INSTALL_HINT = IS_WINDOWS ? "winget install BurntSushi.ripgrep.MSVC\uFF08\u6216 scoop install ripgrep\uFF09" : process.platform === "darwin" ? "brew install ripgrep" : "apt install ripgrep / dnf install ripgrep / pacman -S ripgrep";
+function ensureExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+  }
+  try {
+    chmodSync(path, 493);
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function probeSystem(env, windows, exists) {
+  const api = windows ? win32 : posix;
+  const dirs = (env["PATH"] ?? "").split(api.delimiter).filter(Boolean);
+  const exts = windows ? (env["PATHEXT"] ?? ".EXE;.CMD;.BAT").split(";").filter(Boolean) : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      if (exists(api.join(dir, `rg${ext.toLowerCase()}`))) return true;
+    }
+  }
+  return false;
+}
+var RIPGREP_VENDOR_TARGETS = [
+  { platform: "win32", arch: "x64", pkg: "@epoch-agent/vendor-ripgrep-win32-x64" },
+  { platform: "win32", arch: "arm64", pkg: "@epoch-agent/vendor-ripgrep-win32-x64" },
+  { platform: "darwin", arch: "x64", pkg: "@epoch-agent/vendor-ripgrep-darwin-x64" },
+  { platform: "darwin", arch: "arm64", pkg: "@epoch-agent/vendor-ripgrep-darwin-arm64" }
+];
+function vendorPackageFor(platform10, arch) {
+  return RIPGREP_VENDOR_TARGETS.find((t2) => t2.platform === platform10 && t2.arch === arch)?.pkg ?? null;
+}
+var require_ = createRequire(import.meta.url);
+function defaultResolveVendor(specifier) {
+  const manifest = `${specifier}/package.json`;
+  const roots = [require_, createRequire(join(process.cwd(), "noop.js"))];
+  for (const resolver of roots) {
+    try {
+      return resolver.resolve(manifest);
+    } catch {
+    }
+  }
+  return null;
+}
+function readVendorVersion(manifestPath) {
+  try {
+    const pkg = require_(manifestPath);
+    return typeof pkg.version === "string" ? pkg.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolve(options) {
+  const env = options.env ?? process.env;
+  const platform10 = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const exists = options.fileExists ?? existsSync;
+  const resolveVendor = options.resolveVendor ?? defaultResolveVendor;
+  const makeExecutable = options.makeExecutable ?? ensureExecutable;
+  if (probeSystem(env, platform10 === "win32", exists)) {
+    return { mode: "system", command: "rg" };
+  }
+  const vendor = vendorPackageFor(platform10, arch);
+  if (vendor) {
+    let manifest = null;
+    try {
+      manifest = resolveVendor(vendor);
+    } catch {
+      manifest = null;
+    }
+    if (manifest) {
+      const api = platform10 === "win32" ? win32 : posix;
+      const binary = api.join(api.dirname(manifest), "bin", platform10 === "win32" ? "rg.exe" : "rg");
+      if (exists(binary) && (platform10 === "win32" || makeExecutable(binary))) {
+        const version = readVendorVersion(manifest);
+        return { mode: "builtin", command: binary, ...version ? { version } : {} };
+      }
+    }
+  }
+  return { mode: "missing", command: "rg", hint: RIPGREP_INSTALL_HINT };
+}
+var cached = null;
+function resolveRipgrep(options) {
+  if (options) return resolve(options);
+  cached ??= resolve({});
+  return cached;
+}
+function resetRipgrepCache() {
+  cached = null;
+}
+var SIGKILL_TIMEOUT_MS = 200;
+var PROBE_TIMEOUT_MS = 5e3;
+var MAX_TREE_DEPTH = 32;
+var MAX_TREE_SIZE = 512;
+var SNAPSHOT_MAX_BUFFER = 8 * 1024 * 1024;
+var WMIC_SNAPSHOT_ARGS = [
+  "process",
+  "get",
+  "CreationDate,ParentProcessId,ProcessId",
+  "/format:csv"
+];
+var POWERSHELL_SNAPSHOT_ARGS = [
+  "-NoProfile",
+  "-NonInteractive",
+  "-Command",
+  'Get-CimInstance Win32_Process | ForEach-Object { "$($_.ProcessId) $($_.ParentProcessId) $($_.CreationDate.Ticks)" }'
+];
+function isRealChildPid(pid) {
+  return typeof pid === "number" && Number.isInteger(pid) && pid > 1;
+}
+async function killProcessTree(options) {
+  const { pid, pty, detached = false, platform: platform10 = platform() } = options;
+  if (!isRealChildPid(pid)) return;
+  if (platform10 === "win32") {
+    const descendants2 = await collectProcessTree(pid, platform10);
+    tryPtyKill(pty);
+    await killPids([...descendants2, pid], { signal: "SIGKILL" });
+    await runProbe("taskkill", ["/pid", String(pid), "/f", "/t"]);
+    return;
+  }
+  const descendants = await collectProcessTree(pid, platform10);
+  await killPids([...descendants, pid], options, {
+    // 只有 detached 才允许碰 -pid —— 这一行就是文件头那条约束的落点
+    ...detached ? { groupLeaderPid: pid } : {},
+    ...pty ? { pty } : {}
+  });
+}
+async function killPids(pids, options = {}, extra = {}) {
+  const { escalate = false, isExited = () => false, killTimeoutMs = SIGKILL_TIMEOUT_MS } = options;
+  const targets = pids.filter(isRealChildPid);
+  const first = options.signal ?? (escalate ? "SIGTERM" : "SIGKILL");
+  sweep(targets, first, extra);
+  if (!escalate || isExited()) return;
+  await delay(killTimeoutMs);
+  if (isExited()) return;
+  sweep(targets, "SIGKILL", extra);
+}
+function sweep(targets, signal, extra) {
+  if (extra.groupLeaderPid !== void 0) sendSignal(-extra.groupLeaderPid, signal);
+  for (const target of targets) sendSignal(target, signal);
+  tryPtyKill(extra.pty, signal);
+}
+function sendSignal(target, signal) {
+  try {
+    process.kill(target, signal);
+  } catch {
+  }
+}
+function tryPtyKill(pty, signal) {
+  if (!pty) return;
+  try {
+    pty.kill(signal);
+  } catch {
+  }
+}
+async function collectProcessTree(rootPid, platform10 = platform()) {
+  if (!isRealChildPid(rootPid)) return [];
+  const listChildren = platform10 === "win32" ? await snapshotLister() : listChildrenViaPgrep;
+  const found = [];
+  const seen = /* @__PURE__ */ new Set([rootPid]);
+  let frontier = [rootPid];
+  for (let depth = 0; depth < MAX_TREE_DEPTH && frontier.length > 0; depth++) {
+    const next = [];
+    for (const parent of frontier) {
+      for (const child of await listChildren(parent)) {
+        if (seen.has(child) || found.length >= MAX_TREE_SIZE) continue;
+        seen.add(child);
+        found.push(child);
+        next.push(child);
+      }
+    }
+    frontier = next;
+  }
+  return found.reverse();
+}
+var listChildrenViaPgrep = async (parentPid) => {
+  const stdout = await runProbe("pgrep", ["-P", String(parentPid)]);
+  return stdout.split("\n").map((line) => Number.parseInt(line.trim(), 10)).filter(isRealChildPid);
+};
+async function snapshotLister() {
+  const childrenOf = buildChildrenMap(await readWindowsSnapshot());
+  return (parentPid) => Promise.resolve(childrenOf.get(parentPid) ?? []);
+}
+async function readWindowsSnapshot() {
+  const fast = parseWmicCsv(await runProbe("wmic", WMIC_SNAPSHOT_ARGS, SNAPSHOT_MAX_BUFFER));
+  if (fast.length > 0) return fast;
+  const slow = await runProbe("powershell", POWERSHELL_SNAPSHOT_ARGS, SNAPSHOT_MAX_BUFFER);
+  return parseCimLines(slow);
+}
+function buildChildrenMap(records) {
+  const bornOf = /* @__PURE__ */ new Map();
+  for (const record of records) bornOf.set(record.pid, record.born);
+  const childrenOf = /* @__PURE__ */ new Map();
+  for (const { pid, ppid, born } of records) {
+    if (!isRealChildPid(pid) || !isRealChildPid(ppid)) continue;
+    const parentBorn = bornOf.get(ppid);
+    if (parentBorn === void 0 || parentBorn === "" || born === "" || born < parentBorn) continue;
+    const siblings = childrenOf.get(ppid);
+    if (siblings) siblings.push(pid);
+    else childrenOf.set(ppid, [pid]);
+  }
+  return childrenOf;
+}
+function parseWmicCsv(stdout) {
+  const lines = stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+  const header = lines[lines.findIndex((line) => line.includes("ProcessId"))];
+  if (header === void 0) return [];
+  const columns = header.split(",").map((column) => column.trim());
+  const [atPid, atPpid, atBorn] = [
+    columns.indexOf("ProcessId"),
+    columns.indexOf("ParentProcessId"),
+    columns.indexOf("CreationDate")
+  ];
+  if (atPid < 0 || atPpid < 0 || atBorn < 0) return [];
+  return lines.slice(lines.indexOf(header) + 1).map((line) => {
+    const cells = line.split(",");
+    return {
+      pid: Number.parseInt(cells[atPid] ?? "", 10),
+      ppid: Number.parseInt(cells[atPpid] ?? "", 10),
+      // `20260807071417.130820+480` → 留到秒的那 14 位就够比大小了
+      born: normalizeBorn((cells[atBorn] ?? "").slice(0, 14))
+    };
+  });
+}
+function parseCimLines(stdout) {
+  const records = [];
+  for (const line of stdout.split("\n")) {
+    const [pid, ppid, born, ...rest] = line.trim().split(/\s+/);
+    if (born === void 0 || rest.length > 0) continue;
+    records.push({
+      pid: Number.parseInt(pid ?? "", 10),
+      ppid: Number.parseInt(ppid ?? "", 10),
+      born: normalizeBorn(born)
+    });
+  }
+  return records;
+}
+function normalizeBorn(raw) {
+  const trimmed = raw.trim();
+  return /^\d+$/.test(trimmed) ? trimmed.padStart(20, "0") : "";
+}
+function runProbe(file, args2, maxBuffer) {
+  return new Promise((resolve5) => {
+    try {
+      const options = {
+        timeout: PROBE_TIMEOUT_MS,
+        windowsHide: true,
+        ...maxBuffer === void 0 ? {} : { maxBuffer }
+      };
+      execFile(file, args2, options, (err, stdout) => {
+        resolve5(err ? "" : String(stdout));
+      });
+    } catch {
+      resolve5("");
+    }
+  });
+}
+function delay(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+
+// src/shell-parse.ts
+function defaultFlavor() {
+  return IS_WINDOWS ? "windows" : "posix";
+}
+var WRAPPER_RE = /^\s*(?:(?:(?:\S+[/\\])?(?:sh|bash|zsh|dash|ksh))\s+-c|cmd(?:\.exe)?\s+\/[cCkK]|(?:powershell|pwsh)(?:\.exe)?\s+(?:-NoProfile\s+)?-Command)\s+/i;
+function stripShellWrapper(command) {
+  const match = command.match(WRAPPER_RE);
+  if (!match) return command.trim();
+  let rest = command.slice(match[0].length).trim();
+  if (rest.length >= 2) {
+    const first = rest[0];
+    const last = rest[rest.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      rest = rest.slice(1, -1);
+    }
+  }
+  return rest;
+}
+function detectPosixSubstitution(command) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < command.length; i++) {
+    const char = command[i];
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (inSingle) continue;
+    if (char === "\\" && i + 1 < command.length) {
+      if (!inDouble || ["$", "`", '"', "\\", "\n"].includes(command[i + 1] ?? "")) {
+        i++;
+        continue;
+      }
+    }
+    if (char === "$" && command[i + 1] === "(") return true;
+    if (!inDouble && (char === "<" || char === ">") && command[i + 1] === "(") return true;
+    if (char === "`") return true;
+  }
+  return false;
+}
+var PS_KEYWORD_RE = /\b(if|elseif|else|foreach|for|while|do|switch|try|catch|finally|until|trap|function|filter)(\s+[-\w]+)*\s*$/i;
+function detectWindowsSubstitution(command) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < command.length; i++) {
+    const char = command[i];
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      continue;
+    }
+    if (inSingle) continue;
+    if (char === "`" && i + 1 < command.length) {
+      i++;
+      continue;
+    }
+    if (char === "$" && command[i + 1] === "(") return true;
+    if (!inDouble && char === "@" && command[i + 1] === "(") return true;
+    if (!inDouble && char === "(") {
+      const before = command.slice(0, i).trimEnd();
+      if (before.endsWith("(")) continue;
+      if (PS_KEYWORD_RE.test(before)) continue;
+      return true;
+    }
+  }
+  return false;
+}
+var SEPARATORS = ["&&", "||", ";", "|", "&"];
+var REDIRECTS = ["2>&1", ">>", "2>", ">", "<"];
+function tokenize(input, flavor) {
+  const tokens = [];
+  let cur = "";
+  let curHasContent = false;
+  let inSingle = false;
+  let inDouble = false;
+  const flush = () => {
+    if (curHasContent) tokens.push({ text: cur });
+    cur = "";
+    curHasContent = false;
+  };
+  for (let i = 0; i < input.length; i++) {
+    const char = input[i];
+    if (char === "'" && !inDouble) {
+      inSingle = !inSingle;
+      curHasContent = true;
+      continue;
+    }
+    if (char === '"' && !inSingle) {
+      inDouble = !inDouble;
+      curHasContent = true;
+      continue;
+    }
+    if (char === "\\" && flavor === "posix" && !inSingle && i + 1 < input.length) {
+      cur += input[i + 1];
+      curHasContent = true;
+      i++;
+      continue;
+    }
+    if (inSingle || inDouble) {
+      cur += char;
+      curHasContent = true;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      flush();
+      continue;
+    }
+    const rest = input.slice(i);
+    const redirect = REDIRECTS.find((r) => rest.startsWith(r));
+    if (redirect) {
+      flush();
+      tokens.push({ text: redirect, op: redirect });
+      i += redirect.length - 1;
+      continue;
+    }
+    const sep = SEPARATORS.find((s) => rest.startsWith(s));
+    if (sep) {
+      flush();
+      tokens.push({ text: sep, op: sep });
+      i += sep.length - 1;
+      continue;
+    }
+    cur += char;
+    curHasContent = true;
+  }
+  if (inSingle || inDouble) return null;
+  flush();
+  return tokens;
+}
+var ENV_ASSIGN_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+function deriveRoot(words) {
+  let i = 0;
+  while (i < words.length && ENV_ASSIGN_RE.test(words[i])) i++;
+  const assignments = words.slice(0, i);
+  const name = words[i];
+  if (name === void 0) return { root: "", argv: [], assignments };
+  const base = name.split(/[/\\]/).pop() ?? name;
+  return { root: base.toLowerCase(), argv: words.slice(i), assignments };
+}
+function parseShellCommand(command, flavor) {
+  const kind = flavor ?? defaultFlavor();
+  const stripped = stripShellWrapper(command);
+  const hasSubstitution = kind === "windows" ? detectWindowsSubstitution(stripped) : detectPosixSubstitution(stripped);
+  const tokens = tokenize(stripped, kind);
+  if (tokens === null) {
+    return { segments: [], hasSubstitution, parseError: "\u5F15\u53F7\u4E0D\u95ED\u5408", stripped };
+  }
+  const segments = [];
+  let words = [];
+  let redirects = [];
+  let pipedInto = false;
+  let nextPiped = false;
+  const closeSegment = () => {
+    if (words.length > 0 || redirects.length > 0) {
+      const { root, argv, assignments } = deriveRoot(words);
+      segments.push({ root, argv, assignments, raw: words.join(" "), pipedInto, redirects });
+    }
+    words = [];
+    redirects = [];
+    pipedInto = nextPiped;
+    nextPiped = false;
+  };
+  for (let i = 0; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (!tok.op) {
+      words.push(tok.text);
+      continue;
+    }
+    if (REDIRECTS.includes(tok.op)) {
+      const target = tokens[i + 1];
+      if (target && !target.op) {
+        redirects.push(target.text);
+        i++;
+      }
+      continue;
+    }
+    nextPiped = tok.op === "|";
+    closeSegment();
+  }
+  closeSegment();
+  return { segments, hasSubstitution, stripped };
+}
+function splitWords(input, flavor) {
+  const tokens = tokenize(input, flavor ?? defaultFlavor());
+  return tokens === null ? null : tokens.map((t2) => t2.text);
+}
+function hasSideEffectChannel(parsed) {
+  if (parsed.segments.length > 1) return true;
+  return parsed.segments.some((s) => s.redirects.length > 0);
+}
+
+// src/command-safety.ts
+function rootMatches(rule, root) {
+  if (typeof rule === "string") return root === rule;
+  if (rule instanceof RegExp) return rule.test(root);
+  return rule.includes(root);
+}
+var args = (seg) => seg.argv.slice(1);
+var isShortCluster = (a) => /^-[a-zA-Z]+$/.test(a);
+function hasRecursiveForce(seg) {
+  let recursive = false;
+  let force = false;
+  for (const a of args(seg)) {
+    if (a === "--recursive") recursive = true;
+    else if (a === "--force") force = true;
+    else if (isShortCluster(a)) {
+      if (/[rR]/.test(a)) recursive = true;
+      if (/f/.test(a)) force = true;
+    }
+  }
+  return recursive && force;
+}
+function isDangerousRmTarget(t2) {
+  if (t2 === "/" || t2 === "/*") return true;
+  if (t2 === "~" || t2 === "~/" || t2 === "~/*") return true;
+  if (/^\$\{?HOME\}?$/i.test(t2)) return true;
+  return /^\/(bin|boot|dev|etc|lib|proc|root|sbin|sys|usr|var)(\/\*)?\/?$/.test(t2);
+}
+var isEmptyVarSlash = (t2) => /^\$\{?\w+\}?\/$/.test(t2);
+var isRawDevice = (t2) => /^\/dev\/(sd[a-z]|nvme\d|disk\d|hd[a-z])/.test(t2);
+var SHELLS = ["sh", "bash", "zsh", "ksh", "dash", "ash", "fish"];
+var INTERPRETERS = ["python", "python2", "python3", "perl", "ruby", "node"];
+var FETCHERS = ["curl", "wget", "fetch"];
+var INLINE_CODE_EXEC = [
+  { root: "python", flags: ["-c"] },
+  { root: "python2", flags: ["-c"] },
+  { root: "python3", flags: ["-c"] },
+  { root: "node", flags: ["-e", "--eval", "-p", "--print"] },
+  { root: "deno", flags: ["eval"] },
+  { root: "bun", flags: ["-e", "--eval"] },
+  { root: "perl", flags: ["-e", "-E"] },
+  { root: "ruby", flags: ["-e"] },
+  { root: "php", flags: ["-r"] }
+];
+function inlineCodeExecOf(seg) {
+  const entry = INLINE_CODE_EXEC.find((e) => e.root === seg.root);
+  if (!entry) return null;
+  return args(seg).some((a) => entry.flags.includes(a)) ? seg.root : null;
+}
+var CODE_EXEC_ROOTS = [
+  // 解释器
+  "python",
+  "python2",
+  "python3",
+  "node",
+  "deno",
+  "bun",
+  "tsx",
+  "ruby",
+  "perl",
+  "php",
+  "lua",
+  // 包运行器 —— 后面跟什么都能跑
+  "npx",
+  "bunx",
+  "npm run",
+  "yarn run",
+  "pnpm run",
+  "bun run",
+  // shell 与远程执行
+  ...SHELLS,
+  "ssh",
+  "eval",
+  "exec",
+  "env",
+  "xargs",
+  // 提权
+  "sudo",
+  "doas",
+  "su",
+  // PowerShell
+  "powershell",
+  "pwsh"
+];
+function hasWinSwitch(seg, name, exact = false) {
+  const want = name.toLowerCase();
+  return args(seg).some((a) => {
+    const m = /^[/-](.+)$/.exec(a);
+    if (!m) return false;
+    const got = m[1].toLowerCase().split(":")[0] ?? "";
+    if (exact) return got === want;
+    return got.length > 0 && want.startsWith(got);
+  });
+}
+function winSwitchValue(seg, name) {
+  const want = name.toLowerCase();
+  const list = args(seg);
+  for (let i = 0; i < list.length; i++) {
+    const a = list[i];
+    const m = /^[/-](.+)$/.exec(a);
+    if (!m) continue;
+    const [head, ...tail] = m[1].split(":");
+    if (head.toLowerCase() !== want) continue;
+    return tail.length > 0 ? tail.join(":") : list[i + 1];
+  }
+  return void 0;
+}
+function isDangerousWinTarget(t2) {
+  const s = t2.toLowerCase();
+  if (/^[a-z]:\\?\*?$/.test(s)) return true;
+  if (/^%(userprofile|systemdrive|systemroot|windir|appdata|programfiles)%/.test(s)) return true;
+  if (/^\$env:(userprofile|systemroot|appdata)/.test(s)) return true;
+  return /^[a-z]:\\(windows|users|program files)(\\|$)/.test(s);
+}
+var hasDangerousWinTarget = (seg) => args(seg).some(isDangerousWinTarget);
+var ENCODED_COMMAND_RULE = {
+  root: ["powershell", "pwsh"],
+  when: (s) => args(s).some((a) => {
+    const m = /^[/-](.+)$/.exec(a);
+    if (!m) return false;
+    const got = m[1].toLowerCase();
+    return got.length > 0 && got.startsWith("e") && "encodedcommand".startsWith(got);
+  }),
+  desc: "PowerShell \u7F16\u7801\u547D\u4EE4\uFF08-EncodedCommand\uFF09\uFF0C\u5185\u5BB9\u4E0D\u53EF\u8BFB"
+};
+var POSIX_RULES = [
+  {
+    root: "rm",
+    when: (s) => hasRecursiveForce(s) && args(s).some(isDangerousRmTarget),
+    desc: "\u9012\u5F52\u5220\u9664\u6839\u76EE\u5F55\u6216\u7CFB\u7EDF\u76EE\u5F55"
+  },
+  {
+    root: "rm",
+    when: (s) => hasRecursiveForce(s) && args(s).some(isEmptyVarSlash),
+    desc: "rm -rf $VAR/ \u2014\u2014 \u53D8\u91CF\u4E3A\u7A7A\u65F6\u7B49\u4E8E\u5220\u6839"
+  },
+  {
+    // `find / -delete` / `find / -exec rm` —— 老实现整条漏了
+    root: "find",
+    when: (s) => args(s).some(isDangerousRmTarget) && args(s).some((a) => a === "-delete" || a === "-exec" || a === "-execdir"),
+    desc: "\u5728\u7CFB\u7EDF\u76EE\u5F55\u4E0A\u6279\u91CF\u5220\u9664\uFF08find -delete / -exec\uFF09"
+  },
+  { root: /^mkfs(\.\w+)?$/, desc: "\u683C\u5F0F\u5316\u6587\u4EF6\u7CFB\u7EDF" },
+  {
+    root: "dd",
+    when: (s) => args(s).some((a) => a.startsWith("of=/dev/")),
+    desc: "\u76F4\u63A5\u5199\u88F8\u8BBE\u5907"
+  },
+  { root: "dd", when: (s) => args(s).some((a) => a.startsWith("if=")), desc: "\u78C1\u76D8\u7EA7\u8BFB\u5199" },
+  { root: "shred", desc: "\u4E0D\u53EF\u6062\u590D\u5730\u64E6\u9664\u6587\u4EF6" },
+  { root: ["fdisk", "parted"], desc: "\u78C1\u76D8\u5206\u533A\u64CD\u4F5C" },
+  {
+    root: "diskutil",
+    when: (s) => (args(s)[0] ?? "").toLowerCase().startsWith("erase"),
+    desc: "\u78C1\u76D8\u5206\u533A\u64CD\u4F5C"
+  },
+  { root: "chmod", when: (s) => args(s).includes("777"), desc: "\u5168\u6743\u9650\u5F00\u653E" },
+  {
+    root: "chown",
+    when: (s) => args(s).some((a) => a === "root" || a.startsWith("root:")),
+    desc: "\u6539\u5F52\u5C5E\u4E3A root"
+  },
+  ENCODED_COMMAND_RULE,
+  { root: ["sudo", "doas"], desc: "\u63D0\u6743\u6267\u884C\uFF08sudo / doas / su -\uFF09" },
+  { root: "su", when: (s) => args(s).includes("-"), desc: "\u63D0\u6743\u6267\u884C\uFF08sudo / doas / su -\uFF09" },
+  {
+    // 下载后直接执行：上一段是下载工具，这一段是被管道喂进来的 shell
+    root: SHELLS,
+    when: (s, prev) => s.pipedInto && prev !== void 0 && FETCHERS.includes(prev.root),
+    desc: "\u4E0B\u8F7D\u540E\u76F4\u63A5\u6267\u884C\uFF08curl | sh\uFF09"
+  },
+  {
+    root: INTERPRETERS,
+    when: (s, prev) => s.pipedInto && prev !== void 0 && FETCHERS.includes(prev.root),
+    desc: "\u4E0B\u8F7D\u540E\u76F4\u63A5\u4EA4\u7ED9\u89E3\u91CA\u5668\u6267\u884C"
+  },
+  {
+    // 通用「管道进 shell」。放在上面两条之后，让来源明确的先给出更准确的描述
+    root: SHELLS,
+    when: (s) => s.pipedInto,
+    desc: "\u628A\u4EFB\u610F\u8F93\u51FA\u7BA1\u9053\u8FDB shell \u6267\u884C"
+  },
+  {
+    root: "git",
+    when: (s) => args(s)[0] === "push" && args(s).some((a) => a === "--force" || a === "-f" || a === "+"),
+    desc: "\u5F3A\u5236\u63A8\u9001"
+  },
+  {
+    root: "git",
+    when: (s) => {
+      const [sub, ...rest] = args(s);
+      if (sub === "reset") return rest.includes("--hard");
+      if (sub === "clean") return rest.some((a) => isShortCluster(a) && a.includes("f"));
+      return false;
+    },
+    desc: "\u4E22\u5F03\u672A\u63D0\u4EA4\u6539\u52A8"
+  },
+  { root: ["shutdown", "reboot", "halt", "poweroff"], desc: "\u5173\u673A / \u91CD\u542F" },
+  {
+    root: ["kill", "killall"],
+    when: (s) => args(s).includes("-9") && args(s).some((a) => a === "-1" || a === "1"),
+    desc: "\u6740\u6389\u5168\u90E8\u8FDB\u7A0B / init"
+  },
+  {
+    root: ["iptables", "ip6tables", "nft", "pfctl"],
+    when: (s) => args(s).some((a) => a === "-F" || a === "--flush"),
+    desc: "\u6E05\u7A7A\u9632\u706B\u5899\u89C4\u5219"
+  },
+  {
+    root: ["launchctl", "systemctl"],
+    when: (s) => ["disable", "unload"].includes(args(s)[0] ?? ""),
+    desc: "\u7981\u7528\u7CFB\u7EDF\u670D\u52A1"
+  },
+  { root: "history", when: (s) => args(s).includes("-c"), desc: "\u6E05\u9664\u547D\u4EE4\u5386\u53F2\uFF08\u63A9\u76D6\u75D5\u8FF9\uFF09" },
+  {
+    root: "tee",
+    when: (s) => args(s).some((a) => a.startsWith("/etc/")),
+    desc: "\u6539\u5199 /etc \u4E0B\u7684\u7CFB\u7EDF\u914D\u7F6E"
+  },
+  {
+    // 重定向到裸设备 / 历史文件。这条不看 root，任何命令都可能这么写
+    root: /.*/,
+    when: (s) => s.redirects.some((r) => isRawDevice(r) || /(^|\/)\.?\w*history$/.test(r)),
+    desc: "\u5199\u5165\u78C1\u76D8\u8BBE\u5907\u6216\u7BE1\u6539\u5386\u53F2\u6587\u4EF6"
+  }
+];
+var WINDOWS_RULES = [
+  {
+    root: ["del", "erase", "rd", "rmdir"],
+    when: hasDangerousWinTarget,
+    desc: "\u9012\u5F52\u5220\u9664\u76D8\u6839 / \u7CFB\u7EDF\u76EE\u5F55 / \u7528\u6237\u76EE\u5F55"
+  },
+  {
+    root: "remove-item",
+    when: (s) => hasWinSwitch(s, "recurse") && hasDangerousWinTarget(s),
+    desc: "PowerShell \u9012\u5F52\u5220\u9664\u76D8\u6839 / \u7CFB\u7EDF\u76EE\u5F55"
+  },
+  {
+    root: "format",
+    when: (s) => args(s).some((a) => /^[a-z]:$/i.test(a)),
+    desc: "\u683C\u5F0F\u5316\u78C1\u76D8"
+  },
+  { root: "diskpart", desc: "\u78C1\u76D8\u5206\u533A\u64CD\u4F5C" },
+  { root: "cipher", when: (s) => hasWinSwitch(s, "w", true), desc: "\u64E6\u9664\u78C1\u76D8\u7A7A\u95F2\u7A7A\u95F4\uFF08\u4E0D\u53EF\u6062\u590D\uFF09" },
+  {
+    root: "vssadmin",
+    when: (s) => (args(s)[0] ?? "").toLowerCase() === "delete",
+    desc: "\u5220\u9664\u5377\u5F71\u526F\u672C\uFF08\u52D2\u7D22\u8F6F\u4EF6\u6807\u51C6\u52A8\u4F5C\uFF0C\u5220\u5B8C\u65E0\u6CD5\u56DE\u6EDA\uFF09"
+  },
+  {
+    root: "wmic",
+    when: (s) => args(s).map((a) => a.toLowerCase()).join(" ").includes("shadowcopy delete"),
+    desc: "\u5220\u9664\u5377\u5F71\u526F\u672C\uFF08\u52D2\u7D22\u8F6F\u4EF6\u6807\u51C6\u52A8\u4F5C\uFF0C\u5220\u5B8C\u65E0\u6CD5\u56DE\u6EDA\uFF09"
+  },
+  {
+    root: "reg",
+    when: (s) => (args(s)[0] ?? "").toLowerCase() === "delete" && hasWinSwitch(s, "f", true),
+    desc: "\u5F3A\u5236\u5220\u9664\u6CE8\u518C\u8868\u9879"
+  },
+  { root: "bcdedit", desc: "\u6539\u542F\u52A8\u914D\u7F6E\uFF08\u53EF\u80FD\u5BFC\u81F4\u7CFB\u7EDF\u8D77\u4E0D\u6765\uFF09" },
+  { root: "sc", when: (s) => (args(s)[0] ?? "").toLowerCase() === "delete", desc: "\u5220\u9664\u7CFB\u7EDF\u670D\u52A1" },
+  { root: "takeown", when: (s) => hasWinSwitch(s, "r", true), desc: "\u9012\u5F52\u593A\u53D6\u6587\u4EF6\u6240\u6709\u6743" },
+  {
+    root: "icacls",
+    when: (s) => hasWinSwitch(s, "grant") && args(s).some((a) => /^(everyone|users)(:|$)/i.test(a)),
+    desc: "\u7ED9 everyone / users \u6388\u6743"
+  },
+  {
+    root: "netsh",
+    when: (s) => {
+      const lower = args(s).map((a) => a.toLowerCase());
+      return (lower[0] === "advfirewall" || lower[0] === "firewall") && lower.some((a) => a === "off" || a === "disable");
+    },
+    desc: "\u5173\u95ED\u9632\u706B\u5899"
+  },
+  {
+    root: "set-mppreference",
+    when: (s) => hasWinSwitch(s, "disablerealtimemonitoring"),
+    desc: "\u5173\u95ED Defender \u5B9E\u65F6\u9632\u62A4"
+  },
+  {
+    root: "net",
+    when: (s) => ["user", "localgroup"].includes((args(s)[0] ?? "").toLowerCase()) && hasWinSwitch(s, "add", true),
+    desc: "\u65B0\u589E\u8D26\u6237 / \u52A0\u5165\u7BA1\u7406\u5458\u7EC4"
+  },
+  { root: "runas", desc: "\u63D0\u6743\u6267\u884C\uFF08runas\uFF09" },
+  {
+    root: "start-process",
+    when: (s) => (winSwitchValue(s, "verb") ?? "").toLowerCase() === "runas",
+    desc: "\u63D0\u6743\u6267\u884C\uFF08Start-Process -Verb RunAs\uFF09"
+  },
+  {
+    root: ["iex", "invoke-expression"],
+    when: (s) => s.pipedInto,
+    desc: "\u4E0B\u8F7D\u540E\u76F4\u63A5\u6267\u884C\uFF08iwr | iex\uFF09"
+  },
+  {
+    root: ["powershell", "pwsh", "cmd"],
+    when: (s, prev) => s.pipedInto && prev !== void 0 && ["curl", "wget", "iwr", "irm", "invoke-webrequest", "invoke-restmethod"].includes(prev.root),
+    desc: "\u4E0B\u8F7D\u540E\u76F4\u63A5\u4EA4\u7ED9 shell \u6267\u884C"
+  },
+  {
+    root: "certutil",
+    when: (s) => hasWinSwitch(s, "urlcache"),
+    desc: "certutil \u4E0B\u8F7D\uFF08\u5E38\u89C1\u514D\u6740\u4E0B\u8F7D\u5668\uFF09"
+  },
+  { root: "bitsadmin", when: (s) => hasWinSwitch(s, "transfer"), desc: "bitsadmin \u540E\u53F0\u4E0B\u8F7D" },
+  ENCODED_COMMAND_RULE,
+  {
+    root: ["powershell", "pwsh"],
+    when: (s) => hasWinSwitch(s, "noprofile") || (winSwitchValue(s, "windowstyle") ?? "").toLowerCase() === "hidden" || (winSwitchValue(s, "w") ?? "").toLowerCase() === "hidden",
+    desc: "PowerShell \u9690\u85CF\u7A97\u53E3 / \u8DF3\u8FC7\u914D\u7F6E\u6267\u884C"
+  },
+  {
+    root: ["powershell", "pwsh"],
+    when: (s) => ["bypass", "unrestricted"].includes(
+      (winSwitchValue(s, "executionpolicy") ?? "").toLowerCase()
+    ),
+    desc: "\u7ED5\u8FC7 PowerShell \u6267\u884C\u7B56\u7565"
+  },
+  { root: "mshta", desc: "mshta \u6267\u884C\u8FDC\u7A0B\u811A\u672C\uFF08LOLBin\uFF09" },
+  { root: "rundll32", desc: "rundll32 \u6267\u884C\u4EFB\u610F DLL \u5BFC\u51FA\uFF08LOLBin\uFF09" },
+  {
+    root: "regsvr32",
+    when: (s) => args(s).some((a) => /^[/-]i:/i.test(a)),
+    desc: "regsvr32 \u8FDC\u7A0B scriptlet\uFF08LOLBin\uFF09"
+  },
+  {
+    root: "shutdown",
+    when: (s) => hasWinSwitch(s, "s", true) || hasWinSwitch(s, "r", true),
+    desc: "\u5173\u673A / \u91CD\u542F"
+  },
+  { root: ["restart-computer", "stop-computer"], desc: "\u5173\u673A / \u91CD\u542F" },
+  {
+    root: "schtasks",
+    when: (s) => hasWinSwitch(s, "create", true),
+    desc: "\u521B\u5EFA\u8BA1\u5212\u4EFB\u52A1\uFF08\u6301\u4E45\u5316\uFF09"
+  },
+  { root: ["new-scheduledtask", "register-scheduledtask"], desc: "\u6CE8\u518C\u8BA1\u5212\u4EFB\u52A1\uFF08\u6301\u4E45\u5316\uFF09" }
+];
+var WHOLE_STRING_RULES = [
+  { pattern: /:\s*\(\s*\)\s*\{.*\}\s*;?\s*:/, desc: "fork bomb" }
+];
+var WINDOWS_TABLE = [...WINDOWS_RULES, ...POSIX_RULES];
+function parseForSafety(command, platform10) {
+  const parsed = parseShellCommand(command, platform10 === "win32" ? "windows" : "posix");
+  if (platform10 !== "win32" || parsed.hasSubstitution) return parsed;
+  const asPosix = parseShellCommand(command, "posix");
+  return asPosix.hasSubstitution ? { ...parsed, hasSubstitution: true } : parsed;
+}
+var currentPlatform = () => IS_WINDOWS ? "win32" : "posix";
+function checkDangerousCommand(command, opts) {
+  const platform10 = opts?.platform ?? currentPlatform();
+  const parsed = parseForSafety(command, platform10);
+  for (const { pattern, desc } of WHOLE_STRING_RULES) {
+    if (pattern.test(parsed.stripped)) return { dangerous: true, desc };
+  }
+  const table = platform10 === "win32" ? WINDOWS_TABLE : POSIX_RULES;
+  for (let i = 0; i < parsed.segments.length; i++) {
+    const seg = parsed.segments[i];
+    const prev = i > 0 ? parsed.segments[i - 1] : void 0;
+    for (const rule of table) {
+      if (!rootMatches(rule.root, seg.root)) continue;
+      if (rule.when && !rule.when(seg, prev)) continue;
+      return { dangerous: true, desc: rule.desc };
+    }
+  }
+  return { dangerous: false };
+}
+var READONLY_ROOTS = /* @__PURE__ */ new Set([
+  "ls",
+  "ll",
+  "cat",
+  "bat",
+  "head",
+  "tail",
+  "wc",
+  "grep",
+  "rg",
+  "ag",
+  "find",
+  "fd",
+  "tree",
+  "file",
+  "stat",
+  "type",
+  "which",
+  "whereis",
+  "pwd",
+  "echo",
+  "date",
+  "whoami",
+  "id",
+  "uname",
+  "hostname",
+  "df",
+  "du",
+  "free",
+  "uptime",
+  "ps",
+  "top",
+  "htop",
+  "env",
+  "printenv"
+]);
+var READONLY_SUBCOMMANDS = {
+  node: ["-v", "--version"],
+  npm: ["ls", "list", "view", "info", "outdated"],
+  pnpm: ["ls", "list", "why", "outdated"],
+  yarn: ["list", "info"],
+  git: [
+    "status",
+    "log",
+    "diff",
+    "show",
+    "branch",
+    "remote",
+    "blame",
+    "describe",
+    "rev-parse",
+    "ls-files",
+    "shortlog",
+    "tag"
+  ]
+};
+function isReadOnlyCommand(command) {
+  const parsed = parseForSafety(command, currentPlatform());
+  if (parsed.parseError !== void 0 || parsed.hasSubstitution) return false;
+  if (hasSideEffectChannel(parsed)) return false;
+  if (parsed.segments.length === 0) return false;
+  return parsed.segments.every((seg) => {
+    if (READONLY_ROOTS.has(seg.root)) return true;
+    const subs = READONLY_SUBCOMMANDS[seg.root];
+    if (!subs) return false;
+    const first = seg.argv[1];
+    if (first === void 0) return false;
+    if (seg.root === "git" && first === "stash") return seg.argv[2] === "list";
+    if (seg.root === "git" && first === "config") return seg.argv.includes("--get");
+    return subs.includes(first);
+  });
+}
+var OBFUSCATION_PATTERNS = [
+  { pattern: /\beval\b/, desc: "eval \u52A8\u6001\u6267\u884C" },
+  { pattern: /\bexec\s+\$/, desc: "exec \u6267\u884C\u53D8\u91CF" },
+  { pattern: /\bbase64\s+(-d|--decode)/, desc: "base64 \u89E3\u7801" },
+  { pattern: /\b(xxd|od)\s+-r/, desc: "\u5341\u516D\u8FDB\u5236\u8FD8\u539F" },
+  { pattern: /\|\s*(ba|z|k|da)?sh\b/, desc: "\u7BA1\u9053\u8FDB shell" },
+  { pattern: /\\x[0-9a-f]{2}/i, desc: "\u5341\u516D\u8FDB\u5236\u8F6C\u4E49\u5B57\u7B26" },
+  { pattern: /\$\{[^}]*[:#%/][^}]*\}/, desc: "\u53D8\u91CF\u5C55\u5F00\u505A\u5B57\u7B26\u4E32\u62FC\u88C5" },
+  { pattern: /\bprintf\b[^|;&]*\|/, desc: "printf \u6784\u9020\u540E\u7BA1\u9053" },
+  { pattern: /\bcurl\b[^|;&]*\|/, desc: "\u4E0B\u8F7D\u540E\u7BA1\u9053" }
+];
+function checkObfuscation(command) {
+  const parsed = parseForSafety(command, currentPlatform());
+  if (parsed.parseError !== void 0) return `\u65E0\u6CD5\u89E3\u6790\uFF08${parsed.parseError}\uFF09`;
+  if (parsed.hasSubstitution) {
+    return /`/.test(parsed.stripped) && !/\$\(/.test(parsed.stripped) ? "\u53CD\u5F15\u53F7\u547D\u4EE4\u66FF\u6362" : "\u547D\u4EE4\u66FF\u6362 $(...)";
+  }
+  for (const seg of parsed.segments) {
+    const interpreter = inlineCodeExecOf(seg);
+    if (interpreter !== null) return `${interpreter} \u6267\u884C\u5185\u8054\u4EE3\u7801\uFF08\u5185\u5BB9\u65E0\u6CD5\u9759\u6001\u5206\u6790\uFF09`;
+  }
+  const norm = command.replace(/\s+/g, " ").trim();
+  for (const { pattern, desc } of OBFUSCATION_PATTERNS) {
+    if (pattern.test(norm)) return desc;
+  }
+  return null;
+}
+var BWRAP_CANDIDATES = ["/usr/bin/bwrap", "/bin/bwrap", "/usr/local/bin/bwrap"];
+var bwrapPath;
+function realpathOrSelf(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function isInside(target, dir) {
+  const rel = relative(resolve$1(dir), resolve$1(target));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function probeBubblewrap() {
+  if (bwrapPath !== void 0) return bwrapPath;
+  if (platform() !== "linux") {
+    bwrapPath = null;
+    return bwrapPath;
+  }
+  for (const candidate of BWRAP_CANDIDATES) {
+    if (!existsSync(candidate)) continue;
+    try {
+      execFileSync(candidate, ["--ro-bind", "/", "/", "--", "/bin/true"], {
+        stdio: "ignore",
+        timeout: 5e3
+      });
+      bwrapPath = candidate;
+      return bwrapPath;
+    } catch {
+    }
+  }
+  bwrapPath = null;
+  return bwrapPath;
+}
+function buildBwrapArgs(command, commandArgs, opts) {
+  const home = resolve$1(homedir());
+  const args2 = [];
+  args2.push("--ro-bind", "/", "/");
+  args2.push("--dev", "/dev");
+  args2.push("--proc", "/proc");
+  if (opts.reads !== "unrestricted" && home !== "/" && existsSync(home)) {
+    args2.push("--tmpfs", home);
+  }
+  const real = realpathOrSelf(command);
+  for (const p of [dirname(dirname(real)), dirname(real), real]) {
+    if (isInside(p, home) && existsSync(p)) {
+      args2.push("--ro-bind", p, p);
+    }
+  }
+  for (const dir of opts.readableDirs ?? []) {
+    const abs = resolve$1(dir);
+    if (abs === home || abs === "/") continue;
+    if (existsSync(abs)) args2.push("--ro-bind", abs, abs);
+  }
+  for (const abs of new Set(opts.writableDirs.map((d) => resolve$1(d)))) {
+    if (existsSync(abs)) args2.push("--bind", abs, abs);
+  }
+  if (!opts.allowNetwork) args2.push("--unshare-net");
+  args2.push("--unshare-pid", "--unshare-uts", "--unshare-ipc");
+  args2.push("--die-with-parent");
+  args2.push("--new-session");
+  args2.push("--cap-drop", "ALL");
+  if (opts.cwd) args2.push("--chdir", resolve$1(opts.cwd));
+  args2.push("--", command, ...commandArgs);
+  return args2;
+}
+function isolateWithBubblewrap(command, commandArgs, opts) {
+  const bwrap = probeBubblewrap();
+  if (!bwrap) return null;
+  return { command: bwrap, args: buildBwrapArgs(command, commandArgs, opts) };
+}
+var SYSTEM_READ_PATHS = [
+  "/usr",
+  "/System",
+  "/Library",
+  "/bin",
+  "/sbin",
+  "/opt",
+  "/private/var/db",
+  "/private/var/folders",
+  "/private/var/select",
+  // xcode-select 要读它，否则 macOS 自带 python3 起不来
+  "/private/etc",
+  // macOS 自带的 /usr/bin/python3 是个 Xcode shim：它会去跑 xcodebuild，
+  // 需要读整个 Xcode.app（Info.plist + SharedFrameworks）。
+  // Xcode.app 是公开的应用包，放行读取不泄露任何用户数据。
+  "/Applications/Xcode.app",
+  "/Library/Developer"
+];
+function ancestorsOf(paths) {
+  const out = /* @__PURE__ */ new Set(["/"]);
+  for (const p of paths) {
+    let cur = p;
+    for (; ; ) {
+      const parent = dirname(cur);
+      if (parent === cur) break;
+      out.add(parent);
+      cur = parent;
+    }
+  }
+  return [...out];
+}
+var READ_DEVICES = ["/dev/null", "/dev/urandom", "/dev/random", "/dev/tty"];
+var SENSITIVE_HOME_PATHS = [
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".azure",
+  ".kube",
+  ".docker",
+  ".config/gcloud",
+  ".npmrc",
+  ".pypirc",
+  ".netrc",
+  ".git-credentials",
+  ".gitconfig",
+  "Library/Keychains",
+  "Library/Application Support/Google/Chrome",
+  "Library/Application Support/Firefox",
+  "Library/Cookies",
+  "Library/Messages",
+  // agent 自己的数据：会话、记忆、审批、API key 都在这。
+  // 注意沙箱目录本身就在 ~/.epoch/sandbox 下，所以 buildProfile 必须
+  // 在这条 deny **之后**重新 allow writableDirs，否则连自己的 code.js 都读不到。
+  ".epoch"
+];
+var SENSITIVE_ABS_PATHS = ["/etc/shadow", "/etc/sudoers", "/private/etc/master.passwd"];
+function sb(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function realpathOrSelf2(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function pathVariants(p) {
+  const real = realpathOrSelf2(p);
+  const set = /* @__PURE__ */ new Set([p, real]);
+  if (real.startsWith("/private/")) set.add(real.slice("/private".length));
+  else set.add(join("/private", real));
+  return [...set];
+}
+function expandSubpaths(paths) {
+  return paths.flatMap(pathVariants).map((d) => `(subpath ${sb(d)})`).join(" ");
+}
+function readSection(opts, readable) {
+  if (opts.reads === "unrestricted") {
+    return [
+      ";; ---- \u8BFB\u53D6\uFF1A\u4E0D\u8BBE\u9650\uFF08\u6C99\u7BB1\u6A21\u5F0F\u53EA\u7BA1\u5199\u5165\uFF0C\u5224\u636E\u89C1 SeatbeltOptions.reads\uFF09----",
+      "(allow file-read*)",
+      ""
+    ];
+  }
+  const readableLiterals = READ_DEVICES.map((d) => `(literal ${sb(d)})`).join(" ");
+  const ancestorLiterals = ancestorsOf(readable.flatMap(pathVariants)).map((d) => `(literal ${sb(d)})`).join(" ");
+  return [
+    ";; ---- \u8BFB\u53D6\uFF1A\u9ED8\u8BA4\u5168\u7981\uFF0C\u53EA\u653E\u5F00\u7CFB\u7EDF\u5E93 / \u89E3\u91CA\u5668 / \u6C99\u7BB1 / \u5DE5\u4F5C\u533A ----",
+    "(deny file-read*)",
+    `(allow file-read* ${expandSubpaths(readable)} ${readableLiterals})`,
+    ";; \u7956\u5148\u76EE\u5F55\u672C\u8EAB\u653E\u884C\uFF08\u8DEF\u5F84\u89E3\u6790\u9700\u8981\uFF09\u2014\u2014\u53EA\u662F\u76EE\u5F55\u8282\u70B9\uFF0C\u4E0D\u542B\u5176\u5B50\u6811",
+    `(allow file-read* ${ancestorLiterals})`,
+    ""
+  ];
+}
+function sensitiveReadSection(opts) {
+  if (opts.reads === "unrestricted") return [];
+  const home = homedir();
+  const sensitiveReads = [
+    ...SENSITIVE_HOME_PATHS.flatMap((rel) => pathVariants(join(home, rel))),
+    ...SENSITIVE_ABS_PATHS.flatMap(pathVariants)
+  ].map((p) => `(subpath ${sb(p)})`).join("\n    ");
+  return [
+    ";; ---- \u515C\u5E95\uFF1A\u51ED\u8BC1 / \u9690\u79C1\u76EE\u5F55\u59CB\u7EC8\u4E0D\u53EF\u8BFB\uFF08\u540E\u5339\u914D\u4F18\u5148\uFF0C\u538B\u5728 allow \u4E4B\u540E\uFF09----",
+    `(deny file-read*
+    ${sensitiveReads})`,
+    ""
+  ];
+}
+function networkSection(allowNetwork) {
+  if (allowNetwork) return [";; ---- \u7F51\u7EDC ----", "(allow network*)"];
+  return [
+    ";; ---- \u7F51\u7EDC ----",
+    "(deny network*)",
+    // 留一个本机 unix socket，否则解析库初始化就可能失败
+    '(allow network-outbound (literal "/private/var/run/mDNSResponder"))'
+  ];
+}
+function buildProfile(opts) {
+  const readable = [...SYSTEM_READ_PATHS, ...opts.writableDirs, ...opts.readableDirs ?? []];
+  const writableLiterals = ["/dev/null", "/dev/zero", ...READ_DEVICES, "/dev/dtracehelper"].map((d) => `(literal ${sb(d)})`).join(" ");
+  const lines = [
+    "(version 1)",
+    ";; \u975E\u6587\u4EF6\u64CD\u4F5C\u653E\u884C\u2014\u2014\u6574\u4F53 deny-default \u4F1A\u8BA9 Node \u76F4\u63A5 SIGABRT\uFF0C\u89C1\u6A21\u5757\u6CE8\u91CA\u3002",
+    "(allow default)",
+    "",
+    ...readSection(opts, readable),
+    ";; ---- \u5199\u5165\uFF1A\u9ED8\u8BA4\u5168\u7981\uFF0C\u53EA\u653E\u5F00\u6C99\u7BB1\u76EE\u5F55\u4E0E\u4E34\u65F6\u76EE\u5F55 ----",
+    "(deny file-write*)",
+    `(allow file-write* ${expandSubpaths(opts.writableDirs)} ${writableLiterals})`,
+    "",
+    ...sensitiveReadSection(opts),
+    ...networkSection(opts.allowNetwork),
+    "",
+    ";; ---- \u660E\u786E\u7981\u6B62\u7684\u9AD8\u5371\u52A8\u4F5C ----",
+    "(deny file-write-setugid)",
+    '(deny process-exec* (literal "/usr/bin/sudo") (literal "/usr/bin/su"))',
+    "(deny mach-priv-host-port)",
+    ""
+  ];
+  return lines.join("\n");
+}
+var probed = null;
+function probeSeatbelt() {
+  if (probed !== null) return probed;
+  if (platform() !== "darwin") {
+    probed = false;
+    return probed;
+  }
+  try {
+    execFileSync("/usr/bin/sandbox-exec", ["-p", "(version 1)(allow default)", "/usr/bin/true"], {
+      stdio: "ignore",
+      timeout: 5e3
+    });
+    probed = true;
+  } catch {
+    probed = false;
+  }
+  return probed;
+}
+function interpreterReadPaths(command) {
+  const real = realpathOrSelf2(command);
+  const binDir = dirname(real);
+  const prefix = dirname(binDir);
+  const paths = [real, binDir, prefix];
+  let cur = prefix;
+  for (let i = 0; i < 6; i++) {
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    if (/\.(framework|app)$/.test(cur)) {
+      paths.push(cur);
+      break;
+    }
+    cur = parent;
+  }
+  return paths;
+}
+function isolateWithSeatbelt(command, args2, opts) {
+  if (!probeSeatbelt()) return null;
+  const readableDirs = opts.reads === "unrestricted" ? opts.readableDirs : [...opts.readableDirs ?? [], ...interpreterReadPaths(command)];
+  return {
+    command: "/usr/bin/sandbox-exec",
+    args: [
+      "-p",
+      buildProfile({ ...opts, ...readableDirs ? { readableDirs } : {} }),
+      command,
+      ...args2
+    ]
+  };
+}
+
+// src/sandbox/backend.ts
+function detectBackend() {
+  if (platform() === "darwin" && probeSeatbelt()) return "seatbelt";
+  if (platform() === "linux" && probeBubblewrap()) return "bubblewrap";
+  return "none";
+}
+function isolate(command, args2, opts) {
+  switch (detectBackend()) {
+    case "seatbelt":
+      return isolateWithSeatbelt(command, args2, opts);
+    case "bubblewrap":
+      return isolateWithBubblewrap(command, args2, opts);
+    default:
+      return null;
+  }
+}
+
+// src/sandbox/classify.ts
+var DENIAL_SIGNATURES = {
+  seatbelt: [/Operation not permitted/i, /\bEPERM\b/],
+  bubblewrap: [/Read-only file system/i, /\bEROFS\b/],
+  none: []
+};
+var RUNNER_FAILURE_RULES = {
+  seatbelt: {
+    fatal: [/^sandbox-exec:/],
+    // sandbox-exec 在 macOS 上已标记 deprecated，它可能（现在或将来）
+    // 往 stderr 打一句提示。那是**信息**不是失败，见方案 46 验收 7
+    benign: [/^sandbox-exec:.*\bdeprecat/i]
+  },
+  bubblewrap: {
+    fatal: [/^bwrap:/],
+    // bwrap 在部分内核上会为无害的降级打一行提示（比如某个 unshare 跳过了）
+    benign: [/^bwrap:.*\b(?:skipping|ignoring|deprecat)/i]
+  },
+  none: { fatal: [], benign: [] }
+};
+function matchesAny(line, patterns) {
+  return patterns.some((re) => re.test(line));
+}
+function classifyFailure(input) {
+  const { exitCode, stderr, denialSignatures, runnerFailureRules: rules } = input;
+  const allowed = rules.allowedExitCodes ?? [0];
+  if (allowed.includes(exitCode)) return { kind: "command-failed" };
+  const lines = stderr.split("\n").map((l) => l.trimEnd());
+  const survivors = lines.filter((l) => l.trim() !== "" && !matchesAny(l, rules.benign));
+  const fatalLine = survivors.find((l) => matchesAny(l, rules.fatal));
+  if (fatalLine !== void 0) return { kind: "runner-failed", evidence: fatalLine };
+  const deniedLine = lines.find((l) => matchesAny(l, denialSignatures));
+  if (deniedLine !== void 0) return { kind: "sandbox-denied", evidence: deniedLine };
+  return { kind: "command-failed" };
+}
+function sandboxModeForLevel(level) {
+  switch (level) {
+    case "plan":
+      return "read-only";
+    case "bypass":
+      return "danger-full-access";
+    case "auto":
+    case "default":
+    case "acceptEdits":
+      return "workspace-write";
+    default:
+      return "workspace-write";
+  }
+}
+var TOOLCHAIN_CACHE_DIRS = [
+  ".cache",
+  ".npm",
+  ".pnpm-store",
+  ".local/share/pnpm",
+  ".yarn",
+  ".bun/install/cache",
+  ".deno",
+  ".cargo/registry",
+  ".gradle/caches",
+  ".m2/repository",
+  "Library/Caches",
+  "Library/pnpm"
+];
+function enforcementFor(mode) {
+  if (mode === "read-only") return "partial";
+  return "full";
+}
+function writableDirsFor(policy) {
+  if (policy.mode === "read-only") return [];
+  const home = homedir();
+  const roots = [policy.workspaceRoot, ...policy.extraRoots ?? []].filter((d) => typeof d === "string" && d !== "").map((d) => resolve$1(d));
+  const caches = TOOLCHAIN_CACHE_DIRS.map((rel) => join(home, rel));
+  return [.../* @__PURE__ */ new Set([...roots, resolve$1(tmpdir()), ...caches])];
+}
+function confine(command, args2, policy) {
+  const backend = detectBackend();
+  if (policy.mode === "danger-full-access") {
+    return { confined: false, backend, mode: policy.mode, reason: "mode-disabled" };
+  }
+  const opts = {
+    writableDirs: writableDirsFor(policy),
+    allowNetwork: policy.allowNetwork,
+    reads: "unrestricted",
+    ...policy.cwd ? { cwd: policy.cwd } : {}
+  };
+  const wrapped = backend === "seatbelt" ? isolateWithSeatbelt(command, args2, opts) : backend === "bubblewrap" ? isolateWithBubblewrap(command, args2, opts) : null;
+  if (!wrapped) {
+    return { confined: false, backend, mode: policy.mode, reason: "no-backend" };
+  }
+  return {
+    confined: true,
+    command: wrapped.command,
+    args: wrapped.args,
+    backend,
+    mode: policy.mode,
+    enforcement: enforcementFor(policy.mode),
+    writableDirs: opts.writableDirs,
+    denialSignatures: DENIAL_SIGNATURES[backend],
+    runnerFailureRules: RUNNER_FAILURE_RULES[backend]
+  };
+}
+var EXEC_PATH_AS_NODE_ENV = {
+  ELECTRON_RUN_AS_NODE: "1"
+};
+var tracked = /* @__PURE__ */ new Map();
+function startLongLivedProcess(opts) {
+  const child = spawn(opts.file, [...opts.args], {
+    stdio: ["ignore", "pipe", "pipe"],
+    // 见文件头：和前台命令同一个决定，不 detach
+    detached: false,
+    ...opts.cwd ? { cwd: opts.cwd } : {},
+    ...opts.spawnOptions
+  });
+  const pid = child.pid ?? 0;
+  if (pid > 0) tracked.set(pid, child);
+  const pump = (stream) => {
+    child[stream]?.on("data", (buf) => {
+      opts.onOutput?.(buf.toString("utf8"), stream);
+    });
+  };
+  pump("stdout");
+  pump("stderr");
+  child.on("exit", (code, signal) => {
+    tracked.delete(pid);
+    opts.onExit?.(code, signal);
+  });
+  child.on("error", () => {
+    tracked.delete(pid);
+    opts.onExit?.(null, null);
+  });
+  return { pid, child };
+}
+async function killTrackedProcess(pid) {
+  const child = tracked.get(pid);
+  tracked.delete(pid);
+  await killProcessTree({
+    pid,
+    detached: false,
+    escalate: true,
+    ...child ? { isExited: () => child.exitCode !== null || child.signalCode !== null } : {}
+  });
+}
+function trackedProcessCount() {
+  return tracked.size;
+}
+async function killAllTrackedProcesses() {
+  const pids = [...tracked.keys()];
+  await Promise.all(pids.map((pid) => killTrackedProcess(pid)));
+}
+function within(root, abs) {
+  const rel = relative(root, abs);
+  return !rel.startsWith("..") && !isAbsolute(rel);
+}
+function isInWorkspace(target, workDir, extraRoots = []) {
+  if (!target) return true;
+  const root = resolve$1(workDir);
+  const abs = isAbsolute(target) ? resolve$1(target) : resolve$1(root, target);
+  if (within(root, abs)) return true;
+  return extraRoots.some((r) => within(resolve$1(r), abs));
+}
+
+// src/schema.ts
+function parseLenient(schema, input, fallback) {
+  const result = schema.safeParse(input);
+  if (result.success) return { value: result.data, issues: [] };
+  return { value: fallback, issues: toIssues(result.error.issues) };
+}
+function parseStrict(schema, input, label) {
+  const result = schema.safeParse(input);
+  if (result.success) return result.data;
+  const issues = toIssues(result.error.issues);
+  const detail = issues.map((i) => `  - ${i.path}: ${i.message}`).join("\n");
+  throw new Error(`${label} \u6821\u9A8C\u5931\u8D25\uFF08${issues.length} \u5904\uFF09\uFF1A
+${detail}`);
+}
+var DEFAULT_ISSUE_LIMIT = 8;
+function formatIssues(label, issues, limit = DEFAULT_ISSUE_LIMIT) {
+  return issueDetails(issues, limit).map((d) => `${label}: ${d}`);
+}
+function issueDetails(issues, limit = DEFAULT_ISSUE_LIMIT) {
+  if (issues.length === 0) return [];
+  const shown = issues.slice(0, limit).map((i) => `${i.path} \u2014\u2014 ${i.message}`);
+  const rest = issues.length - shown.length;
+  if (rest > 0) shown.push(`\u8FD8\u6709 ${rest} \u5904\u95EE\u9898\u672A\u5217\u51FA`);
+  return shown;
+}
+function unknownKeyIssues(known, input, prefix = "") {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return [];
+  const knownSet = new Set(known);
+  return Object.keys(input).filter((key) => !knownSet.has(key)).map((key) => ({
+    path: prefix ? `${prefix}.${key}` : key,
+    message: "\u672A\u77E5\u914D\u7F6E\u9879\uFF0C\u5DF2\u5FFD\u7565\uFF08\u4E0D\u5F71\u54CD\u5176\u4ED6\u914D\u7F6E\u751F\u6548\uFF09"
+  }));
+}
+var MAX_NEST_DEPTH = 5;
+function toIssues(issues, prefix = [], depth = 0) {
+  const out = [];
+  for (const issue of issues) {
+    const fullPath = [...prefix, ...issue.path];
+    const nested = depth < MAX_NEST_DEPTH ? expandNested(issue, fullPath, depth) : [];
+    if (nested.length > 0) out.push(...nested);
+    else out.push({ path: joinPath(fullPath), message: issue.message });
+  }
+  return dedupe(out);
+}
+function expandNested(issue, fullPath, depth) {
+  if (issue.code === "invalid_union") {
+    return issue.errors.flatMap((branch) => toIssues(branch, fullPath, depth + 1));
+  }
+  if (issue.code === "invalid_key" || issue.code === "invalid_element") {
+    return toIssues(issue.issues, fullPath, depth + 1);
+  }
+  return [];
+}
+function joinPath(path) {
+  return path.length > 0 ? path.map((seg) => String(seg)).join(".") : "(root)";
+}
+function dedupe(issues) {
+  const seen = /* @__PURE__ */ new Set();
+  return issues.filter((issue) => {
+    const key = `${issue.path} ${issue.message}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+// src/async.ts
+async function withTimeout(promise, ms, fallback) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise((resolve5) => {
+        timer = setTimeout(() => resolve5(fallback), ms);
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function safeInit(name, factory, diags) {
+  try {
+    const instance = factory();
+    diags.ok(name);
+    return instance;
+  } catch (err) {
+    diags.failed(
+      name,
+      `FAILED (${err instanceof Error ? err.message : String(err)})`,
+      "init-failed"
+    );
+    return null;
+  }
+}
+var LANGS = ["zh", "en"];
+var DEFAULT_LANG = "zh";
+function isLang(value) {
+  return LANGS.includes(value);
+}
+var catalogs = /* @__PURE__ */ new Map();
+var pending = [];
+var localesDirCache;
+var currentLangValue;
+function localesDir() {
+  if (localesDirCache !== void 0) return localesDirCache ?? void 0;
+  const override = process.env.EPOCH_LOCALES_DIR;
+  if (override) {
+    localesDirCache = existsSync(override) ? override : null;
+    return localesDirCache ?? void 0;
+  }
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 8; depth += 1) {
+    if (basename(dir) === "node_modules") break;
+    const candidate = join(dir, "locales");
+    if (existsSync(join(candidate, `${DEFAULT_LANG}.yaml`))) {
+      localesDirCache = candidate;
+      return candidate;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  localesDirCache = null;
+  return void 0;
+}
+function flatten(value, prefix, out) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return;
+  for (const [key, child] of Object.entries(value)) {
+    const path = prefix ? `${prefix}.${key}` : key;
+    if (typeof child === "string") out[path] = child;
+    else flatten(child, path, out);
+  }
+}
+function loadCatalog(lang) {
+  const cached2 = catalogs.get(lang);
+  if (cached2) return cached2;
+  const result = readCatalog(lang);
+  catalogs.set(lang, result);
+  return result;
+}
+function readCatalog(lang) {
+  const dir = localesDir();
+  if (!dir) {
+    pending.push({ code: "locales-missing", render: () => t("i18n.locales_missing") });
+    return { entries: {}, error: "\u627E\u4E0D\u5230 locales \u76EE\u5F55" };
+  }
+  const file = `${lang}.yaml`;
+  const path = join(dir, file);
+  if (!existsSync(path)) {
+    pending.push({
+      code: "catalog-missing",
+      render: () => t("i18n.catalog_missing", { file, lang })
+    });
+    return { entries: {}, error: `${path} \u4E0D\u5B58\u5728` };
+  }
+  let parsed;
+  try {
+    parsed = load(readFileSync(path, "utf-8"));
+  } catch (err) {
+    const reason = (err instanceof Error ? err.message : String(err)).split("\n")[0] ?? "";
+    pending.push({
+      code: "catalog-invalid",
+      render: () => t("i18n.catalog_invalid", { file, reason })
+    });
+    return { entries: {}, error: reason };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    const reason = "\u9876\u5C42\u4E0D\u662F\u952E\u503C\u5BF9";
+    pending.push({
+      code: "catalog-invalid",
+      render: () => t("i18n.catalog_invalid", { file, reason })
+    });
+    return { entries: {}, error: reason };
+  }
+  const entries = {};
+  flatten(parsed, "", entries);
+  return { entries };
+}
+function resetI18n() {
+  catalogs.clear();
+  pending = [];
+  localesDirCache = void 0;
+  currentLangValue = void 0;
+}
+var PLACEHOLDER = /\{(\w+)\}/g;
+function placeholdersOf(text) {
+  const found = [];
+  for (const match of text.matchAll(PLACEHOLDER)) {
+    const name = match[1];
+    if (name && !found.includes(name)) found.push(name);
+  }
+  return found;
+}
+function t(key, vars, lang) {
+  const target = lang ?? currentLang();
+  const text = loadCatalog(target).entries[key] ?? loadCatalog(DEFAULT_LANG).entries[key] ?? key;
+  if (!vars) return text;
+  return text.replace(PLACEHOLDER, (whole, name) => {
+    const value = vars[name];
+    return value === void 0 ? whole : String(value);
+  });
+}
+function currentLang() {
+  currentLangValue ??= resolveLang();
+  return currentLangValue;
+}
+function setLang(lang) {
+  currentLangValue = lang;
+}
+function systemLocaleSignals() {
+  const env = process.env;
+  const signals = [env.LC_ALL, env.LC_MESSAGES, env.LANG, env.LANGUAGE].filter(
+    (v) => typeof v === "string" && v.length > 0
+  );
+  try {
+    signals.push(new Intl.DateTimeFormat().resolvedOptions().locale);
+  } catch {
+  }
+  return signals;
+}
+function langFromLocale(tag) {
+  const primary = tag.split(/[.@]/)[0]?.replace("_", "-").toLowerCase() ?? "";
+  if (!primary || primary === "c" || primary === "posix") return void 0;
+  if (primary === "zh" || primary.startsWith("zh-")) return "zh";
+  return "en";
+}
+function resolveLang(configured, signals) {
+  const fromEnv = process.env.EPOCH_LANGUAGE;
+  if (fromEnv && isLang(fromEnv)) return fromEnv;
+  if (configured && isLang(configured)) return configured;
+  for (const tag of signals ?? systemLocaleSignals()) {
+    const lang = langFromLocale(tag);
+    if (lang) return lang;
+  }
+  return DEFAULT_LANG;
+}
+function i18nDiagnostics() {
+  return pending.map((item) => ({ code: item.code, detail: item.render() }));
+}
+var SECRET_SERVICE = "epoch-agent";
+function secretServiceFor(homeDir) {
+  if (homeDir === join(homedir(), ".epoch")) return SECRET_SERVICE;
+  const profile = process.env.EPOCH_PROFILE;
+  if (!process.env.EPOCH_HOME && profile && profile !== "default") {
+    const safe = profile.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
+    return `${SECRET_SERVICE}:${safe}`;
+  }
+  return `${SECRET_SERVICE}:${createHash("sha256").update(homeDir).digest("hex").slice(0, 12)}`;
+}
+var SECRET_MODE = 384;
+var PROBE_TIMEOUT_MS2 = 3e3;
+var POWERSHELL_TIMEOUT_MS = 15e3;
+var OP_TIMEOUT_MS = 1e4;
+var BACKEND_ENV_VAR = "EPOCH_SECRET_BACKEND";
+function assertValidSecretName(name) {
+  if (!/^[A-Za-z0-9._:-]{1,128}$/.test(name)) {
+    throw new Error(`\u975E\u6CD5\u7684\u51ED\u636E\u540D "${name}"\uFF1A\u53EA\u5141\u8BB8 A-Z a-z 0-9 . _ : - \uFF0C\u4E14 1~128 \u5B57\u7B26`);
+  }
+}
+function secretIndexPath(homeDir) {
+  return join(homeDir, "secrets-index.json");
+}
+function dpapiStorePath(homeDir) {
+  return join(homeDir, "secrets.dpapi.json");
+}
+
+// src/secret/catalog.ts
+var FILE_VERSION = 1;
+var SecretCatalog = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  cache = null;
+  /** 已登记的名字，顺序稳定（排序过），方便 `epoch config secret list` 输出稳定 */
+  read() {
+    if (this.cache) return [...this.cache];
+    this.cache = parse(this.filePath);
+    return [...this.cache];
+  }
+  add(name) {
+    const names = this.read();
+    if (names.includes(name)) return;
+    this.write([...names, name]);
+  }
+  remove(name) {
+    const names = this.read();
+    if (!names.includes(name)) return;
+    this.write(names.filter((n) => n !== name));
+  }
+  /** 整体替换。预取自愈用：把「钥匙串里真读得出来」的那份写回去 */
+  replace(names) {
+    const next = [...new Set(names)].sort();
+    if (sameList(this.read(), next)) return;
+    this.write(next);
+  }
+  /** 仅供测试：丢掉内存缓存，强制重新读盘 */
+  invalidate() {
+    this.cache = null;
+  }
+  /**
+   * 原子写 + 建文件时就 0600。
+   *
+   * mode 在**创建时**生效，写完再 chmod 会留 TOCTOU 窗口
+   * [对标 hermes mcp_oauth.py:388 的 `_write_secure_json`]。
+   */
+  write(names) {
+    const sorted = [...names].sort();
+    const file = { version: FILE_VERSION, names: sorted };
+    mkdirSync(dirname(this.filePath), { recursive: true });
+    const tmp = `${this.filePath}.${process.pid}.tmp`;
+    try {
+      writeFileSync(tmp, JSON.stringify(file, null, 2), {
+        encoding: "utf-8",
+        mode: SECRET_MODE
+      });
+      renameSync(tmp, this.filePath);
+    } catch (err) {
+      rmSync(tmp, { force: true });
+      throw new Error(
+        `\u51ED\u636E\u7D22\u5F15 ${this.filePath} \u5199\u5165\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    this.cache = sorted;
+  }
+};
+function parse(filePath) {
+  if (!existsSync(filePath)) return [];
+  try {
+    const raw = JSON.parse(readFileSync(filePath, "utf-8"));
+    const names = raw.names;
+    if (!Array.isArray(names)) return [];
+    return [...new Set(names.filter((n) => typeof n === "string" && n.length > 0))].sort().slice(0, 512);
+  } catch {
+    return [];
+  }
+}
+function sameList(a, b) {
+  return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+function run(file, args2, opts) {
+  return new Promise((resolve5) => {
+    const child = execFile(
+      file,
+      args2,
+      {
+        timeout: opts.timeoutMs,
+        // 凭据值可能几 KB（OAuth token 串），默认 1MB 够用但显式写出来更清楚
+        maxBuffer: 1024 * 1024,
+        encoding: "utf-8",
+        // Windows 上别弹黑框：PowerShell 冷启动会闪一个控制台窗口
+        ...WINDOWS_HIDE_FLAGS
+      },
+      (err, stdout, stderr) => {
+        resolve5({
+          ...classify(err),
+          stdout: String(stdout ?? ""),
+          stderr: String(stderr ?? "")
+        });
+      }
+    );
+    if (opts.stdin !== void 0) {
+      child.stdin?.on("error", () => {
+      });
+      child.stdin?.end(opts.stdin);
+    }
+  });
+}
+function classify(err) {
+  if (!err) return { code: 0, timedOut: false, missing: false };
+  const e = err;
+  const missing = e.code === "ENOENT";
+  const timedOut = Boolean(e.killed) || e.signal === "SIGTERM";
+  return {
+    code: typeof e.code === "number" ? e.code : null,
+    timedOut: timedOut && !missing,
+    missing
+  };
+}
+function describeFailure(file, r) {
+  if (r.missing) return `\u627E\u4E0D\u5230 ${file}`;
+  if (r.timedOut) return `${file} \u8D85\u65F6\u672A\u8FD4\u56DE`;
+  const detail = r.stderr.trim().split("\n")[0]?.slice(0, 200);
+  return `${file} \u9000\u51FA\u7801 ${r.code}${detail ? `\uFF08${detail}\uFF09` : ""}`;
+}
+
+// src/secret/dpapi.ts
+var FILE_VERSION2 = 1;
+var SHELLS2 = ["powershell.exe", "pwsh"];
+var PS_FLAGS = ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command"];
+var PROTECT_SCRIPT = [
+  '$ErrorActionPreference="Stop";',
+  "$in=[Console]::In.ReadToEnd().Trim();",
+  "(ConvertTo-SecureString -String $in -AsPlainText -Force | ConvertFrom-SecureString)"
+].join("");
+var UNPROTECT_SCRIPT = [
+  '$ErrorActionPreference="Stop";',
+  "$in=[Console]::In.ReadToEnd().Trim();",
+  "$s=ConvertTo-SecureString -String $in;",
+  "$b=[Runtime.InteropServices.Marshal]::SecureStringToBSTR($s);",
+  "try{[Runtime.InteropServices.Marshal]::PtrToStringBSTR($b)}",
+  "finally{[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($b)}"
+].join("");
+var DpapiStore = class {
+  constructor(filePath, shell) {
+    this.filePath = filePath;
+    this.shell = shell;
+  }
+  filePath;
+  shell;
+  backend = "dpapi";
+  encrypted = true;
+  detail = "Windows DPAPI\uFF08\u5DF2\u52A0\u5BC6\uFF0C\u7ED1\u5B9A\u5F53\u524D\u7528\u6237\u8D26\u6237\uFF09";
+  cache = null;
+  async get(name) {
+    assertValidSecretName(name);
+    const blob = this.load().secrets[name];
+    if (!blob) return void 0;
+    const r = await this.ps(UNPROTECT_SCRIPT, blob);
+    if (r.code !== 0) throw new Error(`\u8BFB\u53D6\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(this.shell, r)}`);
+    return Buffer.from(r.stdout.trim(), "base64").toString("utf-8");
+  }
+  async set(name, value) {
+    assertValidSecretName(name);
+    const r = await this.ps(PROTECT_SCRIPT, Buffer.from(value, "utf-8").toString("base64"));
+    if (r.code !== 0) throw new Error(`\u5199\u5165\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(this.shell, r)}`);
+    const file = this.load();
+    file.secrets[name] = stripBlank(r.stdout);
+    this.save(file);
+  }
+  delete(name) {
+    assertValidSecretName(name);
+    const file = this.load();
+    if (name in file.secrets) {
+      delete file.secrets[name];
+      this.save(file);
+    }
+    return Promise.resolve();
+  }
+  /** 密文就在自己的文件里，名字直接是 key —— 这个后端不需要 catalog.ts 的索引 */
+  list() {
+    return Promise.resolve(Object.keys(this.load().secrets).sort());
+  }
+  ps(script, stdin) {
+    return run(this.shell, [...PS_FLAGS, script], { timeoutMs: POWERSHELL_TIMEOUT_MS, stdin });
+  }
+  load() {
+    if (this.cache) return this.cache;
+    this.cache = readDpapiFile(this.filePath);
+    return this.cache;
+  }
+  /** 原子写 + 建文件时就 0600（Windows 上 mode 是空操作，但这份代码也跑在测试里） */
+  save(file) {
+    mkdirSync(dirname(this.filePath), { recursive: true });
+    const tmp = `${this.filePath}.${process.pid}.tmp`;
+    try {
+      writeFileSync(tmp, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: SECRET_MODE });
+      renameSync(tmp, this.filePath);
+    } catch (err) {
+      rmSync(tmp, { force: true });
+      throw new Error(
+        `\u51ED\u636E\u6587\u4EF6 ${this.filePath} \u5199\u5165\u5931\u8D25\uFF1A${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    this.cache = file;
+  }
+};
+function readDpapiFile(filePath) {
+  const empty = { version: FILE_VERSION2, secrets: {} };
+  if (!existsSync(filePath)) return empty;
+  try {
+    const raw = JSON.parse(readFileSync(filePath, "utf-8"));
+    const secrets = raw.secrets;
+    if (typeof secrets !== "object" || secrets === null) return empty;
+    const out = {};
+    for (const [k, v] of Object.entries(secrets)) {
+      if (typeof v === "string" && v.length > 0) out[k] = v;
+    }
+    return { version: FILE_VERSION2, secrets: out };
+  } catch {
+    return empty;
+  }
+}
+async function probeDpapi() {
+  if (platform() !== "win32") return { reason: "\u4E0D\u662F Windows" };
+  const expect = randomBytes(8).toString("hex");
+  const payload = Buffer.from(expect, "utf-8").toString("base64");
+  let last = "\u672A\u627E\u5230 PowerShell\uFF08powershell.exe / pwsh \u90FD\u4E0D\u53EF\u7528\uFF09";
+  for (const shell of SHELLS2) {
+    const sealed = await run(shell, [...PS_FLAGS, PROTECT_SCRIPT], {
+      timeoutMs: POWERSHELL_TIMEOUT_MS,
+      stdin: payload
+    });
+    if (sealed.missing) continue;
+    if (sealed.code !== 0) {
+      last = `\u52A0\u5BC6\u63A2\u6D4B\u5931\u8D25\uFF08${describeFailure(shell, sealed)}\uFF09`;
+      continue;
+    }
+    const back = await run(shell, [...PS_FLAGS, UNPROTECT_SCRIPT], {
+      timeoutMs: POWERSHELL_TIMEOUT_MS,
+      stdin: stripBlank(sealed.stdout)
+    });
+    if (back.code !== 0) {
+      last = `\u89E3\u5BC6\u63A2\u6D4B\u5931\u8D25\uFF08${describeFailure(shell, back)}\uFF09`;
+      continue;
+    }
+    if (Buffer.from(back.stdout.trim(), "base64").toString("utf-8") !== expect) {
+      last = "\u52A0\u89E3\u5BC6\u63A2\u6D4B\u7684\u503C\u5BF9\u4E0D\u4E0A";
+      continue;
+    }
+    return { shell };
+  }
+  return { reason: last };
+}
+function stripBlank(s) {
+  return s.replace(/\s+/g, "");
+}
+var SECURITY = "/usr/bin/security";
+var NOT_FOUND = 44;
+var KeychainStore = class {
+  /**
+   * @param service 钥匙串里的服务名。**按家目录分命名空间**，见
+   *                [types.ts](./types.js) 的 `secretServiceFor()` ——
+   *                钥匙串是全局的，写死一个名字会让多 profile 共用同一批凭据
+   */
+  constructor(catalog, service) {
+    this.catalog = catalog;
+    this.service = service;
+  }
+  catalog;
+  service;
+  backend = "keychain";
+  encrypted = true;
+  detail = "macOS Keychain\uFF08\u5DF2\u52A0\u5BC6\uFF09";
+  async get(name) {
+    assertValidSecretName(name);
+    const r = await run(SECURITY, ["find-generic-password", "-s", this.service, "-a", name, "-w"], {
+      timeoutMs: OP_TIMEOUT_MS
+    });
+    if (r.code === NOT_FOUND) return void 0;
+    if (r.code !== 0) throw new Error(`\u8BFB\u53D6\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(SECURITY, r)}`);
+    return decode(r.stdout);
+  }
+  async set(name, value) {
+    assertValidSecretName(name);
+    const r = await run(
+      SECURITY,
+      [
+        "add-generic-password",
+        "-U",
+        "-s",
+        this.service,
+        "-a",
+        name,
+        "-D",
+        "epoch-agent credential",
+        "-w",
+        encode(value)
+      ],
+      { timeoutMs: OP_TIMEOUT_MS }
+    );
+    if (r.code !== 0) throw new Error(`\u5199\u5165\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(SECURITY, r)}`);
+    this.catalog.add(name);
+  }
+  async delete(name) {
+    assertValidSecretName(name);
+    const r = await run(SECURITY, ["delete-generic-password", "-s", this.service, "-a", name], {
+      timeoutMs: OP_TIMEOUT_MS
+    });
+    if (r.code !== 0 && r.code !== NOT_FOUND) {
+      throw new Error(`\u5220\u9664\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(SECURITY, r)}`);
+    }
+    this.catalog.remove(name);
+  }
+  /** 见 catalog.ts：钥匙串本身没有便宜的列举方式，索引是提示、`get` 才是权威 */
+  list() {
+    return Promise.resolve(this.catalog.read());
+  }
+  /** 预取时发现索引里有、钥匙串里没有的名字，就地剔掉（自愈） */
+  healCatalog(available) {
+    this.catalog.replace(available);
+  }
+};
+async function probeKeychain(service) {
+  if (platform() !== "darwin") return "\u4E0D\u662F macOS";
+  const dk = await run(SECURITY, ["default-keychain"], { timeoutMs: PROBE_TIMEOUT_MS2 });
+  if (dk.code !== 0 || dk.stdout.trim() === "") {
+    return `\u6CA1\u6709\u9ED8\u8BA4\u94A5\u5319\u4E32\uFF08${describeFailure(SECURITY, dk)}\uFF09`;
+  }
+  const account = `__probe__${randomBytes(8).toString("hex")}`;
+  const expect = randomBytes(8).toString("hex");
+  const args2 = ["-s", service, "-a", account];
+  const added = await run(SECURITY, ["add-generic-password", "-U", ...args2, "-w", encode(expect)], {
+    timeoutMs: PROBE_TIMEOUT_MS2
+  });
+  if (added.code !== 0) return `\u5199\u5165\u63A2\u6D4B\u5931\u8D25\uFF08${describeFailure(SECURITY, added)}\uFF09`;
+  const read = await run(SECURITY, ["find-generic-password", ...args2, "-w"], {
+    timeoutMs: PROBE_TIMEOUT_MS2
+  });
+  await run(SECURITY, ["delete-generic-password", ...args2], { timeoutMs: PROBE_TIMEOUT_MS2 });
+  if (read.code !== 0) return `\u8BFB\u53D6\u63A2\u6D4B\u5931\u8D25\uFF08${describeFailure(SECURITY, read)}\uFF09`;
+  if (decode(read.stdout) !== expect) return "\u8BFB\u5199\u63A2\u6D4B\u7684\u503C\u5BF9\u4E0D\u4E0A";
+  return null;
+}
+function encode(value) {
+  return Buffer.from(value, "utf-8").toString("base64");
+}
+function decode(stdout) {
+  return Buffer.from(stdout.trim(), "base64").toString("utf-8");
+}
+var SECRET_TOOL = "secret-tool";
+var LibsecretStore = class {
+  /**
+   * @param service Secret Service 里的 `service` 属性值。**按家目录分命名空间**，
+   *                见 [types.ts](./types.js) 的 `secretServiceFor()`
+   */
+  constructor(catalog, service) {
+    this.catalog = catalog;
+    this.service = service;
+  }
+  catalog;
+  service;
+  backend = "libsecret";
+  encrypted = true;
+  detail = "Linux libsecret / Secret Service\uFF08\u5DF2\u52A0\u5BC6\uFF09";
+  /** 条目的属性对。用 service + account 两个属性，和 macOS 那边同一套心智 */
+  attrs(name) {
+    return ["service", this.service, "account", name];
+  }
+  async get(name) {
+    assertValidSecretName(name);
+    const r = await run(SECRET_TOOL, ["lookup", ...this.attrs(name)], { timeoutMs: OP_TIMEOUT_MS });
+    if (r.code === 0) return decode2(r.stdout);
+    if (r.stdout.trim() === "" && !r.timedOut && !r.missing) return void 0;
+    throw new Error(`\u8BFB\u53D6\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(SECRET_TOOL, r)}`);
+  }
+  async set(name, value) {
+    assertValidSecretName(name);
+    const r = await run(
+      SECRET_TOOL,
+      ["store", `--label=${this.service}: ${name}`, ...this.attrs(name)],
+      { timeoutMs: OP_TIMEOUT_MS, stdin: encode2(value) }
+    );
+    if (r.code !== 0) throw new Error(`\u5199\u5165\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(SECRET_TOOL, r)}`);
+    this.catalog.add(name);
+  }
+  async delete(name) {
+    assertValidSecretName(name);
+    const r = await run(SECRET_TOOL, ["clear", ...this.attrs(name)], { timeoutMs: OP_TIMEOUT_MS });
+    if (r.code !== 0 && (r.timedOut || r.missing)) {
+      throw new Error(`\u5220\u9664\u51ED\u636E ${name} \u5931\u8D25\uFF1A${describeFailure(SECRET_TOOL, r)}`);
+    }
+    this.catalog.remove(name);
+  }
+  /**
+   * `secret-tool search --all` 能列，但输出格式随 libsecret 版本变，
+   * 而且要多走一次 D-Bus 往返。索引更便宜也更稳定 —— 见 catalog.ts。
+   */
+  list() {
+    return Promise.resolve(this.catalog.read());
+  }
+  /** 预取时发现索引里有、keyring 里没有的名字，就地剔掉（自愈） */
+  healCatalog(available) {
+    this.catalog.replace(available);
+  }
+};
+async function probeLibsecret(service) {
+  if (platform() === "darwin" || platform() === "win32") return "\u4E0D\u662F Linux";
+  const account = `__probe__${randomBytes(8).toString("hex")}`;
+  const expect = randomBytes(8).toString("hex");
+  const args2 = ["service", service, "account", account];
+  const stored = await run(SECRET_TOOL, ["store", `--label=${service} probe`, ...args2], {
+    timeoutMs: PROBE_TIMEOUT_MS2,
+    stdin: encode2(expect)
+  });
+  if (stored.missing) {
+    return "\u672A\u627E\u5230 secret-tool\uFF08\u88C5\u6CD5\uFF1Aapt install libsecret-tools / dnf install libsecret\uFF09";
+  }
+  if (stored.timedOut) {
+    return "secret-tool \u65E0\u54CD\u5E94\uFF0C\u591A\u534A\u662F\u6CA1\u6709 D-Bus \u6216 keyring \u672A\u89E3\u9501\uFF08headless / SSH \u4F1A\u8BDD\u5E38\u89C1\uFF09";
+  }
+  if (stored.code !== 0) return `\u5199\u5165\u63A2\u6D4B\u5931\u8D25\uFF08${describeFailure(SECRET_TOOL, stored)}\uFF09`;
+  const read = await run(SECRET_TOOL, ["lookup", ...args2], { timeoutMs: PROBE_TIMEOUT_MS2 });
+  await run(SECRET_TOOL, ["clear", ...args2], { timeoutMs: PROBE_TIMEOUT_MS2 });
+  if (read.code !== 0) return `\u8BFB\u53D6\u63A2\u6D4B\u5931\u8D25\uFF08${describeFailure(SECRET_TOOL, read)}\uFF09`;
+  if (decode2(read.stdout) !== expect) return "\u8BFB\u5199\u63A2\u6D4B\u7684\u503C\u5BF9\u4E0D\u4E0A";
+  return null;
+}
+function encode2(value) {
+  return Buffer.from(value, "utf-8").toString("base64");
+}
+function decode2(stdout) {
+  return Buffer.from(stdout.trim(), "base64").toString("utf-8");
+}
+var PlaintextStore = class {
+  /**
+   * @param reason 为什么降级。**必须带修复方法** —— 只说「明文」而不说怎么修，
+   *               用户除了忍着没有别的选择
+   */
+  constructor(envFilePath, reason) {
+    this.envFilePath = envFilePath;
+    this.detail = `\u660E\u6587\u964D\u7EA7 \u2014\u2014 ${reason}\uFF0C\u51ED\u636E\u4ECD\u662F\u660E\u6587\uFF08${envFilePath}\uFF0C\u6743\u9650 0600\uFF09`;
+  }
+  envFilePath;
+  backend = "plaintext";
+  encrypted = false;
+  detail;
+  get(name) {
+    return Promise.resolve(parseEnvText(readText(this.envFilePath))[name]);
+  }
+  set(name, value) {
+    writeEnvFile(this.envFilePath, setEnvVarText(readText(this.envFilePath), name, value));
+    return Promise.resolve();
+  }
+  delete(name) {
+    const text = readText(this.envFilePath);
+    if (!existsSync(this.envFilePath)) return Promise.resolve();
+    writeEnvFile(this.envFilePath, removeEnvVarText(text, name));
+    return Promise.resolve();
+  }
+  list() {
+    return Promise.resolve(Object.keys(parseEnvText(readText(this.envFilePath))).sort());
+  }
+};
+function isAssignmentTo(line, name) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#")) return false;
+  const eq = trimmed.indexOf("=");
+  if (eq === -1) return false;
+  return trimmed.slice(0, eq).trim() === name;
+}
+function setEnvVarText(text, name, value) {
+  const entry = `${name}=${value}`;
+  let replaced = false;
+  const kept = text.split("\n").filter((line) => {
+    if (!isAssignmentTo(line, name)) return true;
+    if (replaced) return false;
+    replaced = true;
+    return true;
+  });
+  const out = kept.map((line) => isAssignmentTo(line, name) ? entry : line);
+  if (!replaced) {
+    while (out.length > 0 && out[out.length - 1]?.trim() === "") out.pop();
+    out.push(entry);
+  }
+  while (out.length > 0 && out[out.length - 1]?.trim() === "") out.pop();
+  return out.join("\n") + "\n";
+}
+function removeEnvVarText(text, name) {
+  const out = text.split("\n").filter((line) => !isAssignmentTo(line, name));
+  while (out.length > 0 && out[out.length - 1]?.trim() === "") out.pop();
+  return out.length === 0 ? "" : out.join("\n") + "\n";
+}
+function parseEnvText(text) {
+  const result = {};
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    result[trimmed.slice(0, eq).trim()] = trimmed.slice(eq + 1).trim().replace(/^["']|["']$/g, "");
+  }
+  return result;
+}
+function writeEnvFile(path, text) {
+  writeFileSync(path, text, { encoding: "utf-8", mode: SECRET_MODE });
+  try {
+    chmodSync(path, SECRET_MODE);
+  } catch {
+  }
+}
+function readText(path) {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return "";
+  }
+}
+var ENVELOPE_PREFIX = "epoch-enc:v1:";
+var ALGORITHM = "aes-256-gcm";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var dataKey = null;
+function setDataKey(key) {
+  if (key !== null && key.length !== KEY_BYTES) {
+    throw new Error(`\u6570\u636E\u5BC6\u94A5\u957F\u5EA6\u5FC5\u987B\u662F ${KEY_BYTES} \u5B57\u8282\uFF0C\u5B9E\u9645 ${key.length}`);
+  }
+  dataKey = key;
+}
+function getDataKey() {
+  return dataKey;
+}
+function generateDataKey() {
+  return randomBytes(KEY_BYTES).toString("base64");
+}
+function parseDataKey(encoded) {
+  if (!encoded) return null;
+  try {
+    const buf = Buffer.from(encoded, "base64");
+    return buf.length === KEY_BYTES ? buf : null;
+  } catch {
+    return null;
+  }
+}
+function sealEnvelope(key, plaintext) {
+  const iv = randomBytes(IV_BYTES);
+  const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: TAG_BYTES });
+  const body = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  return ENVELOPE_PREFIX + Buffer.concat([iv, cipher.getAuthTag(), body]).toString("base64");
+}
+function isEnvelope(text) {
+  return text.startsWith(ENVELOPE_PREFIX);
+}
+function openEnvelope(key, blob) {
+  if (!isEnvelope(blob)) throw new Error("\u4E0D\u662F epoch \u4FE1\u5C01\u5BC6\u6587");
+  const raw = Buffer.from(blob.slice(ENVELOPE_PREFIX.length), "base64");
+  if (raw.length < IV_BYTES + TAG_BYTES) throw new Error("\u4FE1\u5C01\u5BC6\u6587\u957F\u5EA6\u4E0D\u8DB3");
+  const iv = raw.subarray(0, IV_BYTES);
+  const tag = raw.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
+  const body = raw.subarray(IV_BYTES + TAG_BYTES);
+  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: TAG_BYTES });
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(body), decipher.final()]).toString("utf-8");
+}
+async function migrateEnvSecrets(opts) {
+  const { envFilePath, store, names, stamp } = opts;
+  if (!existsSync(envFilePath)) return { migrated: [] };
+  const fromEnv = parseEnvText(readOrEmpty(envFilePath));
+  const candidates = names.filter((n) => Boolean(fromEnv[n]));
+  if (candidates.length === 0) return { migrated: [] };
+  let existing;
+  try {
+    existing = new Set(await store.list());
+  } catch (err) {
+    return { migrated: [], warning: `\u8BFB\u53D6\u5DF2\u6709\u51ED\u636E\u5931\u8D25\uFF0C\u8DF3\u8FC7\u8FC1\u79FB\uFF08${message(err)}\uFF09` };
+  }
+  const todo = candidates.filter((n) => !existing.has(n));
+  if (todo.length === 0) return { migrated: [] };
+  const migrated = [];
+  for (const name of todo) {
+    const value = fromEnv[name];
+    if (!value) continue;
+    try {
+      await store.set(name, value);
+      migrated.push(name);
+    } catch (err) {
+      return {
+        migrated,
+        warning: `\u8FC1\u79FB ${name} \u5931\u8D25\uFF0C\u5DF2\u505C\u6B62\u4E14\u4FDD\u7559 ${envFilePath}\uFF08${message(err)}\uFF09`
+      };
+    }
+  }
+  const backupPath = uniquePath(`${envFilePath}.migrated-${stamp}`);
+  try {
+    renameSync(envFilePath, backupPath);
+  } catch (err) {
+    return { migrated, warning: `\u5DF2\u8FC1\u5165\u94A5\u5319\u4E32\uFF0C\u4F46 ${envFilePath} \u6539\u540D\u5931\u8D25\uFF08${message(err)}\uFF09` };
+  }
+  return { migrated, backupPath };
+}
+function uniquePath(base) {
+  if (!existsSync(base)) return base;
+  for (let i = 2; i < 100; i++) {
+    const candidate = `${base}.${i}`;
+    if (!existsSync(candidate)) return candidate;
+  }
+  return `${base}.${process.pid}`;
+}
+function readOrEmpty(path) {
+  try {
+    return readFileSync(path, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function message(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/secret/index.ts
+async function createSecretStore(opts = {}) {
+  if (opts.inject) return opts.inject;
+  const homeDir = opts.homeDir ?? resolveHomeDir();
+  const forced = readForcedBackend();
+  if (forced === "plaintext") {
+    return new PlaintextStore(envPath(homeDir), `${BACKEND_ENV_VAR}=plaintext \u663E\u5F0F\u6307\u5B9A`);
+  }
+  const reason = await tryBackends(homeDir, forced);
+  if (typeof reason !== "string") return reason;
+  return new PlaintextStore(envPath(homeDir), reason);
+}
+async function tryBackends(homeDir, forced) {
+  const want = (id) => forced === null || forced === id;
+  const catalog = new SecretCatalog(secretIndexPath(homeDir));
+  const service = secretServiceFor(homeDir);
+  if (want("keychain") && platform() === "darwin") {
+    const why = await probeKeychain(service);
+    if (why === null) return new KeychainStore(catalog, service);
+    return why;
+  }
+  if (want("dpapi") && platform() === "win32") {
+    const { shell, reason } = await probeDpapi();
+    if (shell) return new DpapiStore(dpapiStorePath(homeDir), shell);
+    return reason ?? "DPAPI \u4E0D\u53EF\u7528";
+  }
+  if (want("libsecret") && platform() !== "darwin" && platform() !== "win32") {
+    const why = await probeLibsecret(service);
+    if (why === null) return new LibsecretStore(catalog, service);
+    return why;
+  }
+  return forced === null ? `\u672C\u5E73\u53F0\uFF08${platform()}\uFF09\u6CA1\u6709\u53EF\u7528\u7684\u51ED\u636E\u540E\u7AEF` : `${BACKEND_ENV_VAR}=${forced} \u5728\u672C\u5E73\u53F0\uFF08${platform()}\uFF09\u7528\u4E0D\u4E86`;
+}
+function readForcedBackend() {
+  const raw = process.env[BACKEND_ENV_VAR]?.trim().toLowerCase();
+  if (!raw || raw === "auto") return null;
+  const known = ["keychain", "dpapi", "libsecret", "plaintext"];
+  return known.find((k) => k === raw) ?? null;
+}
+async function prefetchProviderSecrets(store, names) {
+  let stored;
+  try {
+    stored = await store.list();
+  } catch (err) {
+    return { values: {}, warning: `\u5217\u4E3E\u51ED\u636E\u5931\u8D25\uFF08${message2(err)}\uFF09` };
+  }
+  const wanted = stored.filter((n) => names.includes(n));
+  const values2 = {};
+  const missing = [];
+  for (const name of wanted) {
+    try {
+      const value = await store.get(name);
+      if (value) values2[name] = value;
+      else missing.push(name);
+    } catch (err) {
+      return { values: values2, warning: `\u8BFB\u53D6 ${name} \u5931\u8D25\uFF08${message2(err)}\uFF09` };
+    }
+  }
+  if (missing.length > 0) {
+    try {
+      store.healCatalog?.(stored.filter((n) => !missing.includes(n)));
+    } catch {
+    }
+  }
+  return { values: values2 };
+}
+function listStoredSecretNames(homeDir = resolveHomeDir()) {
+  const names = new Set(new SecretCatalog(secretIndexPath(homeDir)).read());
+  try {
+    const raw = JSON.parse(readFileSync(dpapiStorePath(homeDir), "utf-8"));
+    const secrets = raw.secrets;
+    if (secrets) for (const k of Object.keys(secrets)) names.add(k);
+  } catch {
+  }
+  return [...names].sort();
+}
+var current = null;
+function setSecretStore(store) {
+  current = store;
+}
+function getSecretStore() {
+  return current;
+}
+var values = {};
+function setSecretValues(next) {
+  values = { ...next };
+}
+function getSecretValues() {
+  return values;
+}
+function resetSecretState() {
+  current = null;
+  values = {};
+}
+function message2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * 衍生自 gemini-cli `packages/core/src/utils/process-utils.ts` 的
+ * `killProcessGroup()`。已做的修改：
+ *   - 增加 `detached` 开关且**默认 false**：只有调用方明确声明子进程是
+ *     `detached: true` 起的，才允许 `process.kill(-pid)`。原版无条件杀进程组，
+ *     对非 detached 的子进程等于杀自己（见下方「为什么默认不杀进程组」）。
+ *   - `platform` 改成可注入入参，让 Windows 分支在 Mac 上也能被用例覆盖到。
+ *   - 入口挡死 `pid <= 1`（原版没挡，`kill(-0)` / `kill(-1)` 的后果见下）。
+ *   - 后代收集从递归 DFS 改成带 `seen` 去重的 BFS，并加深度 / 数量上限，
+ *     且拆成独立导出的 `collectProcessTree()` —— 「先优雅关闭、关完再清扫」
+ *     的场景必须能把收集和下手分成两步（见 `killPids`）。
+ *   - 不引 gemini-cli 的 `spawnAsync`（它挂着沙箱管理器依赖，跟 infra 的
+ *     零内部依赖定位冲突），改用 `execFile` 的手写 promise 包装。
+ *   - Windows 的进程树采集（`readWindowsSnapshot` / `buildChildrenMap` 及其两个
+ *     解析器）是**原创**，gemini-cli 没有对应实现 —— 它在 Windows 上只有
+ *     `taskkill /t` 一条路。
+ * Modifications Copyright 2024-2026 bowen.
+ */
+/**
+ * 剥掉 `bash -c "真正的命令"` 这类外壳。
+ *
+ * 不剥的话 `bash -c "rm -rf /"` 的 root 是 `bash`，危险表一条都命不中。
+ *
+ * @license Apache-2.0 (adapted from google-gemini/gemini-cli shell-utils.ts stripShellWrapper)
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ * Modifications Copyright 2024-2026 bowen
+ */
+/**
+ * 引号感知地判断有没有命令替换。
+ *
+ * 逐字符走一遍状态机而不是打正则：`echo '$(not a substitution)'` 里那对括号
+ * 在单引号内，bash 不会执行它，正则区分不了。
+ *
+ * @license Apache-2.0 (adapted from google-gemini/gemini-cli shell-utils.ts detectBashSubstitution)
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ * Modifications Copyright 2024-2026 bowen
+ */
+/**
+ * PowerShell 的子表达式：`$( )` / `@( )` / 裸 `( )`。
+ *
+ * 裸括号那一条要排掉控制流关键字（`if (...)`、`foreach (...)`），
+ * 否则任何带条件的脚本都会被判成「有替换」。
+ *
+ * @license Apache-2.0 (adapted from google-gemini/gemini-cli shell-utils.ts detectPowerShellSubstitution)
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ * Modifications Copyright 2024-2026 bowen
+ */
+
+export { CODE_EXEC_ROOTS, DEFAULT_LANG, DEFAULT_YAML, DENIAL_SIGNATURES, ENVELOPE_PREFIX, EXEC_PATH_AS_NODE_ENV, IS_WINDOWS, LANGS, PROJECT_DIR_NAME, PlaintextStore, RIPGREP_INSTALL_HINT, RUNNER_FAILURE_RULES, SECRET_MODE, SECRET_SERVICE, SHELL_KINDS, SIGKILL_TIMEOUT_MS, SecretCatalog, TOOLCHAIN_CACHE_DIRS, WINDOWS_HIDE_FLAGS, agentsDir, approvalsPath, artifactsDir, assertValidSecretName, automationDir, automationLogsDir, automationWorkDir, budgetStatePath, buildBwrapArgs, buildProfile, checkDangerousCommand, checkObfuscation, checkpointsDir, classifyFailure, closeAllDatabases, collectProcessTree, commandsDir, configPath, confine, countCodePoints, createLogger, createSecretStore, createStreamDecoder, currentLang, dbPath, detectBackend, detectConsoleEncoding, encodingForCodePage, envPath, formatIssues, generateDataKey, getDataKey, getDefaultShell, getPythonCommand, getSecretStore, getSecretValues, hasSideEffectChannel, headCodePoints, hooksPath, i18nDiagnostics, isEnvelope, isInWorkspace, isLang, isReadOnlyCommand, isSensitiveKey, isolate, issueDetails, keepHeadAndTail, keybindingsPath, killAllTrackedProcesses, killPids, killProcessTree, killTrackedProcess, listStoredSecretNames, loadCatalog, localesDir, managedSettingsPath, marketplacesPath, maskApiKey, maskSensitive, mcpAuthPath, mcpConfigPath, mcpSchemaCachePath, memoriesDir, migrate, migrateEnvSecrets, normalizeForMatch, openArtifact, openDatabase, openEnvelope, parseDataKey, parseEnvText, parseLenient, parseShellCommand, parseStrict, placeholdersOf, pluginsDir, pluginsStatePath, policiesDir, powershellCommandArg, prefetchProviderSecrets, probeBubblewrap, probeSeatbelt, probeShell, projectCommandsDir, projectHooksPath, projectLocalSettingsPath, projectPoliciesDir, projectSchemasDir, projectSettingsPath, projectSkillsDir, readConfigYaml, readKey, refCount, releaseDatabase, removeEnvVarText, resetI18n, resetRipgrepCache, resetSecretState, resolveHomeDir, resolveLang, resolveProfile, resolveRipgrep, resolveShellKind, safeInit, sandboxModeForLevel, schemaVersion, sealEnvelope, setDataKey, setEnvVarText, setLang, setLogLevel, setScalar, setSecretStore, setSecretValues, setSectionField, setShell, shellPtyArgs, shellSpawnArgs, skillsDir, splitWords, startLongLivedProcess, stripShellWrapper, systemLocaleSignals, t, tailCodePoints, trackedProcessCount, trustPath, trustedImportsPath, unknownKeyIssues, unsetScalar, unsetSectionField, withTimeout, workspacesPath, worktreesDir, writeArtifact, writeConfigYaml, writeEnvFile };