@flanksource/clicky-ui 0.3.26 → 0.3.28

package/dist/data/ai/SpecRuntimeEditor.model.js

@@ -1,13 +1,9 @@
-const SPEC_PERMISSION_MODES = [
-  "default",
-  "acceptEdits",
-  "auto",
-  "bypassPermissions",
-  "dontAsk",
-  "plan"
-];
+import { normalizeToolPolicyRules } from "../chat/tool-policy.js";
+import { compactRuntimeSandbox } from "./SpecRuntimeEditor.sandbox-model.js";
+import { SPEC_PERMISSION_MODES, SPEC_SANDBOX_MODES } from "./SpecRuntimeEditor.sandbox-model.js";
 const SPEC_CHECKOUT_MODES = ["none", "remote", "local"];
 const SPEC_WORKTREE_MODES = ["none", "new", "existing"];
+const SPEC_CLONE_MODES = ["clone", "skip"];
 const SPEC_STASH_MODES = [
   "none",
   "untracked",
@@ -39,8 +35,8 @@ function compactAISpecRuntime(value) {
   if (model) spec.model = model;
   const id = cleanString(value.id);
   if (id) spec.id = id;
-  const backend = cleanString(value.backend);
-  if (backend) spec.backend = backend;
+  const specMode = cleanString(value.mode);
+  if (specMode) spec.mode = specMode;
   if (value.temperature != null && Number.isFinite(value.temperature)) {
     spec.temperature = value.temperature;
   }
@@ -60,43 +56,19 @@ function compactAISpecRuntime(value) {
     (_a = value.memory) == null ? void 0 : _a.skills
   );
   if (permissions) spec.permissions = permissions;
+  const toolPolicy = normalizeToolPolicyRules(value.toolPolicy);
+  if (toolPolicy.length > 0) spec.toolPolicy = toolPolicy;
   const setup = compactSetup(value.setup);
   if (setup) spec.setup = setup;
   const workflow = compactWorkflow(value.workflow);
   if (workflow) spec.workflow = workflow;
   const sessionId = cleanString(value.sessionId);
   if (sessionId) spec.sessionId = sessionId;
-  const sandbox = compactSandbox(value.sandbox);
+  const sandbox = compactRuntimeSandbox(value.sandbox);
   if (sandbox !== void 0) spec.sandbox = sandbox;
   if (value.cliArgs && hasKeys(value.cliArgs)) spec.cliArgs = value.cliArgs;
   return spec;
 }
-function compactSandbox(value) {
-  if (value == null) return void 0;
-  if (typeof value === "string") {
-    return cleanString(value) || void 0;
-  }
-  const backend = cleanString(value.backend);
-  if (!backend) return void 0;
-  const agent = cleanString(value.agent);
-  const policy = compactSandboxPolicy(value.policy);
-  if (!agent && !policy) return backend;
-  const sandbox = { backend };
-  if (agent) sandbox.agent = agent;
-  if (policy) sandbox.policy = policy;
-  return sandbox;
-}
-function compactSandboxPolicy(value) {
-  var _a;
-  if (!value) return void 0;
-  const policy = {};
-  const paths = (_a = value.paths) == null ? void 0 : _a.map((path) => cleanString(path)).filter((path) => path !== "");
-  if (paths == null ? void 0 : paths.length) policy.paths = paths;
-  if (value.maxAttempts != null && Number.isFinite(value.maxAttempts) && value.maxAttempts > 0) {
-    policy.maxAttempts = Math.floor(value.maxAttempts);
-  }
-  return hasKeys(policy) ? policy : void 0;
-}
 function compactWorkflow(value) {
   if (!value) return void 0;
   const workflow = {};
@@ -192,8 +164,8 @@ function compactFallbacks(value) {
     const fallback = { model };
     const id = cleanString(item.id);
     if (id) fallback.id = id;
-    const backend = cleanString(item.backend);
-    if (backend) fallback.backend = backend;
+    const itemMode = cleanString(item.mode);
+    if (itemMode) fallback.mode = itemMode;
     if (item.temperature != null && Number.isFinite(item.temperature)) {
       fallback.temperature = item.temperature;
     }
@@ -233,7 +205,8 @@ function compactMemory(value) {
 function compactPermissions(value, legacySkills) {
   if (!value && !(legacySkills == null ? void 0 : legacySkills.length)) return void 0;
   const permissions = {};
-  if ((value == null ? void 0 : value.mode) && value.mode !== "default") permissions.mode = value.mode;
+  const mode = cleanString(value == null ? void 0 : value.mode);
+  if (mode) permissions.mode = mode;
   const presets = compactList(value == null ? void 0 : value.presets);
   if (presets) permissions.presets = presets;
   const tools = compactToolPolicies(value == null ? void 0 : value.tools);
@@ -257,6 +230,9 @@ function compactSetup(value) {
   if (dotenv) setup.dotenv = dotenv;
   const envVars = compactEnvVars(value.envVars);
   if (envVars) setup.envVars = envVars;
+  if (value.connections && hasKeys(value.connections)) {
+    setup.connections = structuredClone(value.connections);
+  }
   const checkout = compactSetupCheckout(value.checkout);
   if (checkout) setup.checkout = checkout;
   return hasKeys(setup) ? setup : void 0;
@@ -286,6 +262,7 @@ function compactEnvVarSource(value) {
   if (kind === "configmap" && key) return { configMapKeyRef: { name, key } };
   if (kind === "serviceaccount") return { serviceAccount: name };
   if (kind === "helm" && key) return { helmRef: { name, key } };
+  if (kind === "op" && rest) return { onePassword: source };
   return void 0;
 }
 function compactStructuredEnvVarSource(value) {
@@ -306,10 +283,12 @@ function compactStructuredEnvVarSource(value) {
   const helmName = cleanString((_e = value.helmRef) == null ? void 0 : _e.name);
   const helmKey = cleanString((_f = value.helmRef) == null ? void 0 : _f.key);
   if (helmName && helmKey) source.helmRef = { name: helmName, key: helmKey };
+  const onePassword = cleanString(value.onePassword);
+  if (onePassword) source.onePassword = onePassword;
   return hasKeys(source) ? source : void 0;
 }
 function compactSetupCheckout(value) {
-  var _a, _b, _c, _d, _e, _f, _g;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k;
   if (!value) return void 0;
   const checkout = {};
   if (value.mode === "remote" || value.mode === "local")
@@ -325,6 +304,8 @@ function compactSetupCheckout(value) {
   if (value.depth != null && Number.isFinite(value.depth) && value.depth > 0) {
     checkout.depth = Math.trunc(value.depth);
   }
+  const since = cleanString(value.since);
+  if (since) checkout.since = since;
   const worktree = {};
   const worktreeMode = (_a = value.worktree) == null ? void 0 : _a.mode;
   if (worktreeMode === "new" || worktreeMode === "existing") {
@@ -337,14 +318,20 @@ function compactSetupCheckout(value) {
   const worktreePath = cleanString((_d = value.worktree) == null ? void 0 : _d.path);
   if (worktreePath) worktree.path = worktreePath;
   if (worktree.mode === "new" && ((_e = value.worktree) == null ? void 0 : _e.keep)) worktree.keep = true;
+  if (((_f = value.worktree) == null ? void 0 : _f.uncommitted) === "clone" || ((_g = value.worktree) == null ? void 0 : _g.uncommitted) === "skip") {
+    worktree.uncommitted = value.worktree.uncommitted;
+  }
+  if (((_h = value.worktree) == null ? void 0 : _h.ignored) === "clone" || ((_i = value.worktree) == null ? void 0 : _i.ignored) === "skip") {
+    worktree.ignored = value.worktree.ignored;
+  }
   if (hasKeys(worktree)) checkout.worktree = worktree;
   const dirty = {};
-  const stash = (_f = value.dirty) == null ? void 0 : _f.stash;
+  const stash = (_j = value.dirty) == null ? void 0 : _j.stash;
   if (stash === "untracked" || stash === "unstaged" || stash === "staged" || stash === "all") {
     dirty.stash = stash;
   }
-  const since = cleanString((_g = value.dirty) == null ? void 0 : _g.since);
-  if (since) dirty.since = since;
+  const dirtySince = cleanString((_k = value.dirty) == null ? void 0 : _k.since);
+  if (dirtySince) dirty.since = dirtySince;
   if (hasKeys(dirty)) checkout.dirty = dirty;
   return hasKeys(checkout) ? checkout : void 0;
 }
@@ -464,12 +451,14 @@ function isSpecResourceMode(value) {
 }
 export {
   SPEC_CHECKOUT_MODES,
+  SPEC_CLONE_MODES,
   SPEC_COMMIT_CONDITIONS,
   SPEC_COMMIT_GATES,
   SPEC_COMMIT_MODES,
   SPEC_COMMIT_PHASES,
   SPEC_COMMIT_STAGES,
   SPEC_PERMISSION_MODES,
+  SPEC_SANDBOX_MODES,
   SPEC_SCHEMA_STRICTNESS,
   SPEC_STASH_MODES,
   SPEC_VERIFY_SCOPES,

package/dist/data/ai/SpecRuntimeEditor.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"SpecRuntimeEditor.model.js","sources":["../../../src/data/ai/SpecRuntimeEditor.model.ts"],"sourcesContent":["import type { ChatBudgetConfig } from \"../chat/types\";\n\nexport const SPEC_PERMISSION_MODES = [\n  \"default\",\n  \"acceptEdits\",\n  \"auto\",\n  \"bypassPermissions\",\n  \"dontAsk\",\n  \"plan\",\n] as const;\n\nexport type SpecPermissionMode = (typeof SPEC_PERMISSION_MODES)[number];\n\nexport const SPEC_TOOL_POLICIES = [\"auto\", \"ask\", \"allow\", \"deny\"] as const;\nexport type SpecToolPolicy = (typeof SPEC_TOOL_POLICIES)[number];\n\nexport const SPEC_RESOURCE_MODES = [\"enabled\", \"disabled\"] as const;\nexport type SpecResourceMode = (typeof SPEC_RESOURCE_MODES)[number];\n\nexport const SPEC_CHECKOUT_MODES = [\"none\", \"remote\", \"local\"] as const;\nexport type SpecCheckoutMode = (typeof SPEC_CHECKOUT_MODES)[number];\n\n/**\n * Sandbox capabilities an adapter may declare. Mirrors captain's\n * registry.SandboxCapability: the editor reads these to decide what to offer —\n * an agent picker needs `remote-exec`, and `isolate-workspace` conflicts with a\n * worktree or setup checkout.\n */\nexport const SPEC_SANDBOX_CAPABILITIES = [\n  \"wrap-command\",\n  \"remote-exec\",\n  \"isolate-workspace\",\n  \"egress-proxy\",\n] as const;\nexport type SpecSandboxCapability = (typeof SPEC_SANDBOX_CAPABILITIES)[number];\n\nexport const SPEC_WORKTREE_MODES = [\"none\", \"new\", \"existing\"] as const;\nexport type SpecWorktreeMode = (typeof SPEC_WORKTREE_MODES)[number];\n\nexport const SPEC_STASH_MODES = [\n  \"none\",\n  \"untracked\",\n  \"unstaged\",\n  \"staged\",\n  \"all\",\n] as const;\nexport type SpecStashMode = (typeof SPEC_STASH_MODES)[number];\n\nexport const SPEC_VERIFY_SCOPES = [\"all\", \"changed\"] as const;\nexport type SpecVerifyScope = (typeof SPEC_VERIFY_SCOPES)[number];\n\n// The lifecycle boundary a commit fires on, mirroring captain's api.CommitPhase:\n// \"turn\" after every loop iteration, \"agent\" once the generate/verify loop ends,\n// \"run\" after the worktree is merged away.\nexport const SPEC_COMMIT_PHASES = [\"turn\", \"agent\", \"run\"] as const;\nexport type SpecCommitPhase = (typeof SPEC_COMMIT_PHASES)[number];\n\nexport const SPEC_COMMIT_MODES = [\"commit\", \"fixup\", \"amend\"] as const;\nexport type SpecCommitMode = (typeof SPEC_COMMIT_MODES)[number];\n\nexport const SPEC_COMMIT_CONDITIONS = [\n  \"always\",\n  \"onSuccess\",\n  \"onVerify\",\n] as const;\nexport type SpecCommitCondition = (typeof SPEC_COMMIT_CONDITIONS)[number];\n\nexport const SPEC_COMMIT_STAGES = [\"worktree\", \"changed\"] as const;\nexport type SpecCommitStage = (typeof SPEC_COMMIT_STAGES)[number];\n\nexport const SPEC_COMMIT_GATES = [\"none\", \"cheap\", \"full\"] as const;\nexport type SpecCommitGates = (typeof SPEC_COMMIT_GATES)[number];\n\nexport const SPEC_SCHEMA_STRICTNESS = [\"warning\", \"error\", \"retry\"] as const;\nexport type SpecSchemaStrictness = (typeof SPEC_SCHEMA_STRICTNESS)[number];\n\nexport type AISpecRuntimePrompt = {\n  user?: string;\n  system?: string;\n  appendSystem?: string;\n  schemaJSON?: unknown;\n  schemaStrictness?: SpecSchemaStrictness | \"\";\n  attachments?: AISpecRuntimeAttachment[];\n};\n\nexport type AISpecRuntimeAttachment = {\n  id?: string;\n  path?: string;\n  url?: string;\n  filename?: string;\n  mediaType?: string;\n  size?: number;\n  sha256?: string;\n};\n\nexport type AISpecRuntimeModelFallback = {\n  model?: string;\n  id?: string;\n  backend?: string;\n  temperature?: number;\n  effort?: string;\n  noCache?: boolean;\n};\n\nexport type AISpecRuntimeMemory = {\n  skills?: string[];\n  skipProject?: boolean;\n  skipUser?: boolean;\n  skipSkills?: boolean;\n  skipHooks?: boolean;\n  skipMemory?: boolean;\n  bare?: boolean;\n};\n\nexport type AISpecRuntimeToolPolicies = Record<string, SpecToolPolicy>;\n\nexport type AISpecRuntimeLegacyToolPermissions = {\n  allow?: string[];\n  deny?: string[];\n  modes?: Record<string, string>;\n};\n\nexport type AISpecRuntimeResourcePolicies = Record<string, SpecResourceMode>;\n\nexport type AISpecRuntimeMCPPermissions = {\n  disabled?: boolean;\n  servers?: string[];\n  [name: string]: SpecResourceMode | string[] | boolean | undefined;\n};\n\nexport type AISpecRuntimePermissions = {\n  mode?: SpecPermissionMode | \"\";\n  presets?: string[];\n  tools?: AISpecRuntimeToolPolicies | AISpecRuntimeLegacyToolPermissions;\n  mcp?: AISpecRuntimeMCPPermissions;\n  plugins?: AISpecRuntimeResourcePolicies | string[];\n  skills?: AISpecRuntimeResourcePolicies | string[];\n};\n\nexport type AISpecRuntimePermissionCatalogItem = {\n  id: string;\n  label?: string;\n  group?: string;\n  description?: string;\n  source?: string;\n  sourcePath?: string;\n  configured?: boolean;\n  available?: boolean;\n  defaultMode?: string;\n};\n\nexport type AISpecRuntimePermissionCatalog = {\n  tools?: AISpecRuntimePermissionCatalogItem[];\n  mcp?: AISpecRuntimePermissionCatalogItem[];\n  plugins?: AISpecRuntimePermissionCatalogItem[];\n  skills?: AISpecRuntimePermissionCatalogItem[];\n};\n\nexport type AISpecRuntimeBudget = ChatBudgetConfig & {\n  maxTurns?: number;\n  timeout?: string;\n};\n\n/**\n * Bounds what a dispatched run may touch. Mirrors captain's api.SandboxPolicy;\n * zero values inherit the backend's configured policy.\n */\nexport type AISpecRuntimeSandboxPolicy = {\n  /** Path allow/deny list, gitignore syntax with `!` negating. */\n  paths?: string[];\n  /** Bound on submit cycles per task. */\n  maxAttempts?: number;\n};\n\n/**\n * The object form of captain's api.SandboxRef. `backend` names a configured\n * sandbox backend or a bare adapter kind; `agent` pins one enrolled agent of a\n * git-agent backend.\n */\nexport type AISpecRuntimeSandbox = {\n  backend?: string;\n  agent?: string;\n  policy?: AISpecRuntimeSandboxPolicy;\n};\n\nexport type AISpecRuntimeSpec = {\n  model?: string;\n  id?: string;\n  backend?: string;\n  /**\n   * Sandbox the run executes under. Accepts a bare selector or the object form,\n   * exactly as api.SandboxRef marshals: a ref carrying only a backend\n   * round-trips as a scalar so `sandbox: git-agent` in a .prompt is not\n   * rewritten into a mapping on save.\n   */\n  sandbox?: string | AISpecRuntimeSandbox;\n  temperature?: number;\n  effort?: string;\n  noCache?: boolean;\n  fallbacks?: AISpecRuntimeModelFallback[];\n  prompt?: AISpecRuntimePrompt;\n  budget?: AISpecRuntimeBudget;\n  memory?: AISpecRuntimeMemory;\n  permissions?: AISpecRuntimePermissions;\n  setup?: AISpecRuntimeSetup;\n  workflow?: AISpecRuntimeWorkflow;\n  sessionId?: string;\n  /** Extra cmux CLI args (api.Spec.cliArgs), keyed by option json name. */\n  cliArgs?: Record<string, unknown>;\n};\n\nexport type AISpecRuntimeEnvVarSource = {\n  secretKeyRef?: { name?: string; key?: string };\n  configMapKeyRef?: { name?: string; key?: string };\n  serviceAccount?: string;\n  helmRef?: { name?: string; key?: string };\n};\n\nexport type AISpecRuntimeEnvVar = {\n  name?: string;\n  value?: string;\n  valueFrom?: string | AISpecRuntimeEnvVarSource;\n};\n\nexport type AISpecRuntimeSetup = {\n  cwd?: string;\n  baseDir?: string;\n  dotenv?: string[];\n  envVars?: AISpecRuntimeEnvVar[];\n  checkout?: {\n    mode?: SpecCheckoutMode | \"\";\n    url?: string;\n    path?: string;\n    connection?: string;\n    ref?: string;\n    depth?: number;\n    worktree?: {\n      mode?: SpecWorktreeMode | \"\";\n      prefix?: string;\n      base?: string;\n      path?: string;\n      keep?: boolean;\n    };\n    dirty?: {\n      stash?: SpecStashMode | \"\";\n      since?: string;\n    };\n  };\n};\n\nexport type AISpecRuntimeVerify = {\n  fixture?: string;\n  scope?: SpecVerifyScope | \"\";\n  maxIterations?: number;\n};\n\n// Mirrors captain's api.Commit: one commit policy keyed to a lifecycle phase.\n// Every field is optional because an omitted field means \"captain's default\",\n// which is why an empty stanza is still meaningful — see compactCommits.\nexport type AISpecRuntimeCommit = {\n  on?: SpecCommitPhase | \"\";\n  mode?: SpecCommitMode | \"\";\n  when?: SpecCommitCondition | \"\";\n  message?: string;\n  anchor?: string;\n  squash?: boolean;\n  base?: string;\n  stage?: SpecCommitStage | \"\";\n  gates?: SpecCommitGates | \"\";\n  dryRun?: boolean;\n};\n\n// Mirrors captain's api.Workflow (verify + commits) so the SpecRuntimeEditor's\n// Verify/Commit sections round-trip through the spec frontmatter. Unlike the\n// prior client-only shape, this is part of the compacted spec.\nexport type AISpecRuntimeWorkflow = {\n  verify?: AISpecRuntimeVerify;\n  commits?: AISpecRuntimeCommit[];\n};\n\nexport type AISpecRuntimeValue = AISpecRuntimeSpec;\n\nexport type AISpecRuntimePayload = {\n  spec?: AISpecRuntimeSpec;\n};\n\nexport function buildAISpecRuntimePayload(\n  value: AISpecRuntimeValue,\n): AISpecRuntimePayload {\n  const payload: AISpecRuntimePayload = {};\n  const spec = compactAISpecRuntime(value);\n  if (hasKeys(spec)) payload.spec = spec;\n  return payload;\n}\n\nexport function compactAISpecRuntime(\n  value: AISpecRuntimeValue,\n): AISpecRuntimeSpec {\n  const spec: AISpecRuntimeSpec = {};\n\n  const model = cleanString(value.model);\n  if (model) spec.model = model;\n  const id = cleanString(value.id);\n  if (id) spec.id = id;\n  const backend = cleanString(value.backend);\n  if (backend) spec.backend = backend;\n  if (value.temperature != null && Number.isFinite(value.temperature)) {\n    spec.temperature = value.temperature;\n  }\n  const effort = cleanString(value.effort);\n  if (effort) spec.effort = effort;\n  if (value.noCache) spec.noCache = true;\n  const fallbacks = compactFallbacks(value.fallbacks);\n  if (fallbacks) spec.fallbacks = fallbacks;\n\n  const prompt = compactPrompt(value.prompt);\n  if (prompt) spec.prompt = prompt;\n  const budget = compactBudget(value.budget);\n  if (budget) spec.budget = budget;\n  const memory = compactMemory(value.memory);\n  if (memory) spec.memory = memory;\n  const permissions = compactPermissions(\n    value.permissions,\n    value.memory?.skills,\n  );\n  if (permissions) spec.permissions = permissions;\n  const setup = compactSetup(value.setup);\n  if (setup) spec.setup = setup;\n  const workflow = compactWorkflow(value.workflow);\n  if (workflow) spec.workflow = workflow;\n  const sessionId = cleanString(value.sessionId);\n  if (sessionId) spec.sessionId = sessionId;\n  const sandbox = compactSandbox(value.sandbox);\n  if (sandbox !== undefined) spec.sandbox = sandbox;\n  if (value.cliArgs && hasKeys(value.cliArgs)) spec.cliArgs = value.cliArgs;\n  return spec;\n}\n\n/**\n * Narrows a sandbox ref to what the Go side will accept, and collapses it back\n * to the scalar form when only a backend is set — the same rule as\n * api.SandboxRef.isScalar. Emitting `{backend: \"git-agent\"}` for a prompt\n * written as `sandbox: git-agent` would rewrite the user's frontmatter on every\n * save, so the shorthand has to survive the round-trip.\n *\n * An overrides-only ref (agent/policy with no backend) resolves to nothing and\n * is dropped: api.SandboxRef.Validate rejects it outright.\n */\nfunction compactSandbox(\n  value: string | AISpecRuntimeSandbox | undefined,\n): string | AISpecRuntimeSandbox | undefined {\n  if (value == null) return undefined;\n  if (typeof value === \"string\") {\n    return cleanString(value) || undefined;\n  }\n  const backend = cleanString(value.backend);\n  if (!backend) return undefined;\n  const agent = cleanString(value.agent);\n  const policy = compactSandboxPolicy(value.policy);\n  if (!agent && !policy) return backend;\n  const sandbox: AISpecRuntimeSandbox = { backend };\n  if (agent) sandbox.agent = agent;\n  if (policy) sandbox.policy = policy;\n  return sandbox;\n}\n\nfunction compactSandboxPolicy(\n  value: AISpecRuntimeSandboxPolicy | undefined,\n): AISpecRuntimeSandboxPolicy | undefined {\n  if (!value) return undefined;\n  const policy: AISpecRuntimeSandboxPolicy = {};\n  const paths = value.paths\n    ?.map((path) => cleanString(path))\n    .filter((path) => path !== \"\");\n  if (paths?.length) policy.paths = paths;\n  // Validate rejects a negative bound, and 0 means \"inherit the backend's\".\n  if (\n    value.maxAttempts != null &&\n    Number.isFinite(value.maxAttempts) &&\n    value.maxAttempts > 0\n  ) {\n    policy.maxAttempts = Math.floor(value.maxAttempts);\n  }\n  return hasKeys(policy) ? policy : undefined;\n}\n\nfunction compactWorkflow(\n  value: AISpecRuntimeWorkflow | undefined,\n): AISpecRuntimeWorkflow | undefined {\n  if (!value) return undefined;\n  const workflow: AISpecRuntimeWorkflow = {};\n  const verify = compactVerify(value.verify);\n  if (verify) workflow.verify = verify;\n  const commits = compactCommits(value.commits);\n  if (commits) workflow.commits = commits;\n  return hasKeys(workflow) ? workflow : undefined;\n}\n\nfunction compactVerify(\n  value: AISpecRuntimeVerify | undefined,\n): AISpecRuntimeVerify | undefined {\n  if (!value) return undefined;\n  const verify: AISpecRuntimeVerify = {};\n  const fixture = cleanString(value.fixture);\n  if (fixture) verify.fixture = fixture;\n  if (value.scope === \"all\" || value.scope === \"changed\")\n    verify.scope = value.scope;\n  if (\n    value.maxIterations != null &&\n    Number.isFinite(value.maxIterations) &&\n    value.maxIterations > 0\n  ) {\n    verify.maxIterations = Math.trunc(value.maxIterations);\n  }\n  return hasKeys(verify) ? verify : undefined;\n}\n\n// Presence in the list is what turns committing on, so an empty stanza survives\n// compaction: `commits: [{}]` reads as \"one commit at the end of the run with\n// every default\". Committing nothing is an absent list, not a stanza of falses.\nfunction compactCommits(\n  value: AISpecRuntimeCommit[] | undefined,\n): AISpecRuntimeCommit[] | undefined {\n  if (!value?.length) return undefined;\n  return value.map(compactCommit);\n}\n\nfunction compactCommit(value: AISpecRuntimeCommit): AISpecRuntimeCommit {\n  const commit: AISpecRuntimeCommit = {};\n  const on = pickEnum(SPEC_COMMIT_PHASES, value.on);\n  if (on) commit.on = on;\n  const mode = pickEnum(SPEC_COMMIT_MODES, value.mode);\n  if (mode) commit.mode = mode;\n  const when = pickEnum(SPEC_COMMIT_CONDITIONS, value.when);\n  if (when) commit.when = when;\n  const message = cleanString(value.message);\n  if (message) commit.message = message;\n  const anchor = cleanString(value.anchor);\n  if (anchor) commit.anchor = anchor;\n  // Squash is a *bool in captain: `squash: false` is the instruction to keep the\n  // fixup chain for review, so it cannot be pruned the way a plain flag is.\n  if (value.squash != null) commit.squash = value.squash;\n  const base = cleanString(value.base);\n  if (base) commit.base = base;\n  const stage = pickEnum(SPEC_COMMIT_STAGES, value.stage);\n  if (stage) commit.stage = stage;\n  const gates = pickEnum(SPEC_COMMIT_GATES, value.gates);\n  if (gates) commit.gates = gates;\n  if (value.dryRun) commit.dryRun = true;\n  return commit;\n}\n\nfunction compactPrompt(\n  value: AISpecRuntimePrompt | undefined,\n): AISpecRuntimePrompt | undefined {\n  if (!value) return undefined;\n  const prompt: AISpecRuntimePrompt = {};\n  const user = cleanString(value.user);\n  if (user) prompt.user = user;\n  const system = cleanString(value.system);\n  if (system) prompt.system = system;\n  const appendSystem = cleanString(value.appendSystem);\n  if (appendSystem) prompt.appendSystem = appendSystem;\n  const schemaJSON = compactJSONValue(value.schemaJSON);\n  if (schemaJSON !== undefined) prompt.schemaJSON = schemaJSON;\n  if (\n    value.schemaStrictness === \"warning\" ||\n    value.schemaStrictness === \"error\" ||\n    value.schemaStrictness === \"retry\"\n  ) {\n    prompt.schemaStrictness = value.schemaStrictness;\n  }\n  const attachments = value.attachments\n    ?.map((attachment) => compactAttachment(attachment))\n    .filter(\n      (attachment): attachment is AISpecRuntimeAttachment =>\n        attachment !== undefined,\n    );\n  if (attachments && attachments.length > 0) prompt.attachments = attachments;\n  return hasKeys(prompt) ? prompt : undefined;\n}\n\nfunction compactAttachment(\n  value: AISpecRuntimeAttachment,\n): AISpecRuntimeAttachment | undefined {\n  const attachment: AISpecRuntimeAttachment = {};\n  for (const key of [\n    \"id\",\n    \"path\",\n    \"url\",\n    \"filename\",\n    \"mediaType\",\n    \"sha256\",\n  ] as const) {\n    const text = cleanString(value[key]);\n    if (text) attachment[key] = text;\n  }\n  if (value.size != null && Number.isFinite(value.size) && value.size >= 0) {\n    attachment.size = value.size;\n  }\n  return attachment.id || attachment.path || attachment.url\n    ? attachment\n    : undefined;\n}\n\nfunction compactFallbacks(\n  value: AISpecRuntimeModelFallback[] | undefined,\n): AISpecRuntimeModelFallback[] | undefined {\n  if (!value) return undefined;\n  const out: AISpecRuntimeModelFallback[] = [];\n  for (const item of value) {\n    const model = cleanString(item.model);\n    if (!model) continue;\n    const fallback: AISpecRuntimeModelFallback = { model };\n    const id = cleanString(item.id);\n    if (id) fallback.id = id;\n    const backend = cleanString(item.backend);\n    if (backend) fallback.backend = backend;\n    if (item.temperature != null && Number.isFinite(item.temperature)) {\n      fallback.temperature = item.temperature;\n    }\n    const effort = cleanString(item.effort);\n    if (effort) fallback.effort = effort;\n    if (item.noCache) fallback.noCache = true;\n    out.push(fallback);\n  }\n  return out.length > 0 ? out : undefined;\n}\n\nfunction compactBudget(\n  value: AISpecRuntimeBudget | undefined,\n): AISpecRuntimeBudget | undefined {\n  if (!value) return undefined;\n  const budget: AISpecRuntimeBudget = {};\n  if (value.cost != null && Number.isFinite(value.cost) && value.cost > 0) {\n    budget.cost = value.cost;\n  }\n  if (\n    value.maxTokens != null &&\n    Number.isFinite(value.maxTokens) &&\n    value.maxTokens > 0\n  ) {\n    budget.maxTokens = Math.trunc(value.maxTokens);\n  }\n  if (\n    value.maxTurns != null &&\n    Number.isFinite(value.maxTurns) &&\n    value.maxTurns > 0\n  ) {\n    budget.maxTurns = Math.trunc(value.maxTurns);\n  }\n  const timeout = cleanString(value.timeout);\n  if (timeout) budget.timeout = timeout;\n  return hasKeys(budget) ? budget : undefined;\n}\n\nfunction compactMemory(\n  value: AISpecRuntimeMemory | undefined,\n): AISpecRuntimeMemory | undefined {\n  if (!value) return undefined;\n  const memory: AISpecRuntimeMemory = {};\n  if (value.skipProject) memory.skipProject = true;\n  if (value.skipUser) memory.skipUser = true;\n  if (value.skipHooks) memory.skipHooks = true;\n  if (value.skipMemory) memory.skipMemory = true;\n  if (value.bare) memory.bare = true;\n  return hasKeys(memory) ? memory : undefined;\n}\n\nfunction compactPermissions(\n  value: AISpecRuntimePermissions | undefined,\n  legacySkills?: string[] | undefined,\n): AISpecRuntimePermissions | undefined {\n  if (!value && !legacySkills?.length) return undefined;\n  const permissions: AISpecRuntimePermissions = {};\n  if (value?.mode && value.mode !== \"default\") permissions.mode = value.mode;\n  const presets = compactList(value?.presets);\n  if (presets) permissions.presets = presets;\n\n  const tools = compactToolPolicies(value?.tools);\n  if (tools) permissions.tools = tools;\n\n  const mcp = compactMCPPermissions(value?.mcp);\n  if (mcp) permissions.mcp = mcp;\n\n  const plugins = compactResourcePolicies(value?.plugins);\n  if (plugins) permissions.plugins = plugins;\n  const skills = compactResourcePolicies(value?.skills, legacySkills);\n  if (skills) permissions.skills = skills;\n  return hasKeys(permissions) ? permissions : undefined;\n}\n\nfunction compactSetup(\n  value: AISpecRuntimeSetup | undefined,\n): AISpecRuntimeSetup | undefined {\n  if (!value) return undefined;\n  const setup: AISpecRuntimeSetup = {};\n  const cwd = cleanString(value.cwd);\n  if (cwd) setup.cwd = cwd;\n  const baseDir = cleanString(value.baseDir);\n  if (baseDir) setup.baseDir = baseDir;\n  const dotenv = compactList(value.dotenv);\n  if (dotenv) setup.dotenv = dotenv;\n  const envVars = compactEnvVars(value.envVars);\n  if (envVars) setup.envVars = envVars;\n  const checkout = compactSetupCheckout(value.checkout);\n  if (checkout) setup.checkout = checkout;\n  return hasKeys(setup) ? setup : undefined;\n}\n\nfunction compactEnvVars(value: AISpecRuntimeEnvVar[] | undefined) {\n  if (!value) return undefined;\n  const out: AISpecRuntimeEnvVar[] = [];\n  for (const item of value) {\n    const name = cleanString(item.name);\n    if (!name) continue;\n    const env: AISpecRuntimeEnvVar = { name };\n    const literal = cleanString(item.value);\n    const valueFrom =\n      typeof item.valueFrom === \"string\"\n        ? compactEnvVarSource(item.valueFrom)\n        : compactStructuredEnvVarSource(item.valueFrom);\n    if (literal) env.value = literal;\n    if (valueFrom) env.valueFrom = valueFrom;\n    if (env.value || env.valueFrom) out.push(env);\n  }\n  return out.length > 0 ? out : undefined;\n}\n\nfunction compactEnvVarSource(\n  value: string | undefined,\n): AISpecRuntimeEnvVarSource | undefined {\n  const source = cleanString(value);\n  if (!source) return undefined;\n  const [kind, rest = \"\"] = source.split(\"://\", 2);\n  const [name = \"\", key = \"\"] = rest.split(\"/\", 2).map((part) => part.trim());\n  if (!name) return undefined;\n  if (kind === \"secret\" && key) return { secretKeyRef: { name, key } };\n  if (kind === \"configmap\" && key) return { configMapKeyRef: { name, key } };\n  if (kind === \"serviceaccount\") return { serviceAccount: name };\n  if (kind === \"helm\" && key) return { helmRef: { name, key } };\n  return undefined;\n}\n\nfunction compactStructuredEnvVarSource(\n  value: AISpecRuntimeEnvVarSource | undefined,\n): AISpecRuntimeEnvVarSource | undefined {\n  if (!value) return undefined;\n  const source: AISpecRuntimeEnvVarSource = {};\n  const secretName = cleanString(value.secretKeyRef?.name);\n  const secretKey = cleanString(value.secretKeyRef?.key);\n  if (secretName && secretKey)\n    source.secretKeyRef = { name: secretName, key: secretKey };\n  const configMapName = cleanString(value.configMapKeyRef?.name);\n  const configMapKey = cleanString(value.configMapKeyRef?.key);\n  if (configMapName && configMapKey) {\n    source.configMapKeyRef = { name: configMapName, key: configMapKey };\n  }\n  const serviceAccount = cleanString(value.serviceAccount);\n  if (serviceAccount) source.serviceAccount = serviceAccount;\n  const helmName = cleanString(value.helmRef?.name);\n  const helmKey = cleanString(value.helmRef?.key);\n  if (helmName && helmKey) source.helmRef = { name: helmName, key: helmKey };\n  return hasKeys(source) ? source : undefined;\n}\n\nfunction compactSetupCheckout(\n  value: AISpecRuntimeSetup[\"checkout\"] | undefined,\n): NonNullable<AISpecRuntimeSetup[\"checkout\"]> | undefined {\n  if (!value) return undefined;\n  const checkout: NonNullable<AISpecRuntimeSetup[\"checkout\"]> = {};\n  if (value.mode === \"remote\" || value.mode === \"local\")\n    checkout.mode = value.mode;\n  const url = cleanString(value.url);\n  if (url) checkout.url = url;\n  const path = cleanString(value.path);\n  if (path) checkout.path = path;\n  const connection = cleanString(value.connection);\n  if (connection) checkout.connection = connection;\n  const ref = cleanString(value.ref);\n  if (ref) checkout.ref = ref;\n  if (value.depth != null && Number.isFinite(value.depth) && value.depth > 0) {\n    checkout.depth = Math.trunc(value.depth);\n  }\n\n  const worktree: NonNullable<\n    NonNullable<AISpecRuntimeSetup[\"checkout\"]>[\"worktree\"]\n  > = {};\n  const worktreeMode = value.worktree?.mode;\n  if (worktreeMode === \"new\" || worktreeMode === \"existing\") {\n    worktree.mode = worktreeMode;\n  }\n  const worktreePrefix = cleanString(value.worktree?.prefix);\n  if (worktreePrefix) worktree.prefix = worktreePrefix;\n  const worktreeBase = cleanString(value.worktree?.base);\n  if (worktreeBase) worktree.base = worktreeBase;\n  const worktreePath = cleanString(value.worktree?.path);\n  if (worktreePath) worktree.path = worktreePath;\n  if (worktree.mode === \"new\" && value.worktree?.keep) worktree.keep = true;\n  if (hasKeys(worktree)) checkout.worktree = worktree;\n\n  const dirty: NonNullable<\n    NonNullable<AISpecRuntimeSetup[\"checkout\"]>[\"dirty\"]\n  > = {};\n  const stash = value.dirty?.stash;\n  if (\n    stash === \"untracked\" ||\n    stash === \"unstaged\" ||\n    stash === \"staged\" ||\n    stash === \"all\"\n  ) {\n    dirty.stash = stash;\n  }\n  const since = cleanString(value.dirty?.since);\n  if (since) dirty.since = since;\n  if (hasKeys(dirty)) checkout.dirty = dirty;\n\n  return hasKeys(checkout) ? checkout : undefined;\n}\n\nfunction compactToolPolicies(\n  value: AISpecRuntimePermissions[\"tools\"] | undefined,\n) {\n  const normalized = normalizeToolPolicies(value);\n  return hasKeys(normalized) ? normalized : undefined;\n}\n\nfunction compactResourcePolicies(\n  value: AISpecRuntimePermissions[\"plugins\"] | undefined,\n  legacyEnabled?: string[] | undefined,\n) {\n  const normalized = normalizeResourcePolicies(value, legacyEnabled);\n  return hasKeys(normalized) ? normalized : undefined;\n}\n\nfunction compactMCPPermissions(\n  value: AISpecRuntimeMCPPermissions | undefined,\n): AISpecRuntimeMCPPermissions | undefined {\n  if (!value) return undefined;\n  const out: AISpecRuntimeMCPPermissions = {};\n  for (const [rawKey, rawValue] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key) continue;\n    if (key === \"servers\") {\n      const servers = Array.isArray(rawValue)\n        ? compactList(\n            rawValue.filter((item): item is string => typeof item === \"string\"),\n          )\n        : undefined;\n      if (servers) out.servers = servers;\n      continue;\n    }\n    if (key === \"disabled\") {\n      if (rawValue === true) out.disabled = true;\n      continue;\n    }\n    if (isSpecResourceMode(rawValue)) out[key] = rawValue;\n  }\n  return hasKeys(out) ? out : undefined;\n}\n\nexport function normalizeToolPolicies(\n  value: AISpecRuntimePermissions[\"tools\"] | undefined,\n): AISpecRuntimeToolPolicies {\n  const out: AISpecRuntimeToolPolicies = {};\n  if (!value) return out;\n  const legacy = value as AISpecRuntimeLegacyToolPermissions;\n  for (const tool of compactList(legacy.allow) ?? []) out[tool] = \"allow\";\n  for (const tool of compactList(legacy.deny) ?? []) out[tool] = \"deny\";\n  for (const [rawKey, rawMode] of Object.entries(legacy.modes ?? {})) {\n    const key = rawKey.trim();\n    if (!key) continue;\n    if (rawMode === \"enabled\") out[key] = \"auto\";\n    if (rawMode === \"ask\") out[key] = \"ask\";\n    if (rawMode === \"disabled\") out[key] = \"deny\";\n  }\n  for (const [rawKey, policy] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key || key === \"allow\" || key === \"deny\" || key === \"modes\") {\n      continue;\n    }\n    if (isSpecToolPolicy(policy)) out[key] = policy;\n  }\n  return out;\n}\n\nexport function normalizeResourcePolicies(\n  value: AISpecRuntimePermissions[\"plugins\"] | undefined,\n  legacyEnabled?: string[] | undefined,\n): AISpecRuntimeResourcePolicies {\n  const out: AISpecRuntimeResourcePolicies = {};\n  for (const id of compactList(legacyEnabled) ?? []) out[id] = \"enabled\";\n  if (!value) return out;\n  if (Array.isArray(value)) {\n    for (const id of compactList(value) ?? []) out[id] = \"enabled\";\n    return out;\n  }\n  for (const [rawKey, rawMode] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key) continue;\n    if (isSpecResourceMode(rawMode)) out[key] = rawMode;\n  }\n  return out;\n}\n\nexport function normalizeMCPPermissions(\n  value: AISpecRuntimeMCPPermissions | undefined,\n): AISpecRuntimeMCPPermissions {\n  const out: AISpecRuntimeMCPPermissions = {};\n  if (!value) return out;\n  const servers = compactList(value.servers);\n  if (servers) out.servers = servers;\n  if (value.disabled) out.disabled = true;\n  for (const [rawKey, rawMode] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key || key === \"servers\" || key === \"disabled\") continue;\n    if (isSpecResourceMode(rawMode)) out[key] = rawMode;\n  }\n  return out;\n}\n\nfunction compactJSONValue(value: unknown) {\n  if (value == null) return undefined;\n  if (typeof value === \"string\") {\n    const raw = value.trim();\n    if (!raw) return undefined;\n    try {\n      return JSON.parse(raw);\n    } catch {\n      return undefined;\n    }\n  }\n  return value;\n}\n\nfunction compactList(value: string[] | undefined) {\n  if (!value) return undefined;\n  const out = Array.from(\n    new Set(value.map((item) => item.trim()).filter(Boolean)),\n  );\n  return out.length > 0 ? out : undefined;\n}\n\nfunction cleanString(value: string | undefined) {\n  return value?.trim() ?? \"\";\n}\n\n// Narrows an editor-held string (which may be \"\" while unset) to a member of an\n// enum, dropping anything the Go side would reject.\nfunction pickEnum<T extends string>(\n  options: readonly T[],\n  value: string | undefined,\n): T | undefined {\n  return options.find((option) => option === value);\n}\n\nfunction hasKeys(value: object) {\n  return Object.keys(value).length > 0;\n}\n\nfunction isSpecToolPolicy(value: unknown): value is SpecToolPolicy {\n  return (\n    value === \"auto\" || value === \"ask\" || value === \"allow\" || value === \"deny\"\n  );\n}\n\nfunction isSpecResourceMode(value: unknown): value is SpecResourceMode {\n  return value === \"enabled\" || value === \"disabled\";\n}\n"],"names":[],"mappings":"AAEO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,sBAAsB,CAAC,QAAQ,UAAU,OAAO;AAiBtD,MAAM,sBAAsB,CAAC,QAAQ,OAAO,UAAU;AAGtD,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,MAAM,qBAAqB,CAAC,OAAO,SAAS;AAM5C,MAAM,qBAAqB,CAAC,QAAQ,SAAS,KAAK;AAGlD,MAAM,oBAAoB,CAAC,UAAU,SAAS,OAAO;AAGrD,MAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAGO,MAAM,qBAAqB,CAAC,YAAY,SAAS;AAGjD,MAAM,oBAAoB,CAAC,QAAQ,SAAS,MAAM;AAGlD,MAAM,yBAAyB,CAAC,WAAW,SAAS,OAAO;AAqN3D,SAAS,0BACd,OACsB;AACtB,QAAM,UAAgC,CAAA;AACtC,QAAM,OAAO,qBAAqB,KAAK;AACvC,MAAI,QAAQ,IAAI,EAAG,SAAQ,OAAO;AAClC,SAAO;AACT;AAEO,SAAS,qBACd,OACmB;AAvSd;AAwSL,QAAM,OAA0B,CAAA;AAEhC,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,MAAI,YAAY,QAAQ;AACxB,QAAM,KAAK,YAAY,MAAM,EAAE;AAC/B,MAAI,SAAS,KAAK;AAClB,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,cAAc,UAAU;AAC5B,MAAI,MAAM,eAAe,QAAQ,OAAO,SAAS,MAAM,WAAW,GAAG;AACnE,SAAK,cAAc,MAAM;AAAA,EAC3B;AACA,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,aAAa,SAAS;AAC1B,MAAI,MAAM,QAAS,MAAK,UAAU;AAClC,QAAM,YAAY,iBAAiB,MAAM,SAAS;AAClD,MAAI,gBAAgB,YAAY;AAEhC,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,aAAa,SAAS;AAC1B,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,aAAa,SAAS;AAC1B,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,aAAa,SAAS;AAC1B,QAAM,cAAc;AAAA,IAClB,MAAM;AAAA,KACN,WAAM,WAAN,mBAAc;AAAA,EAAA;AAEhB,MAAI,kBAAkB,cAAc;AACpC,QAAM,QAAQ,aAAa,MAAM,KAAK;AACtC,MAAI,YAAY,QAAQ;AACxB,QAAM,WAAW,gBAAgB,MAAM,QAAQ;AAC/C,MAAI,eAAe,WAAW;AAC9B,QAAM,YAAY,YAAY,MAAM,SAAS;AAC7C,MAAI,gBAAgB,YAAY;AAChC,QAAM,UAAU,eAAe,MAAM,OAAO;AAC5C,MAAI,YAAY,OAAW,MAAK,UAAU;AAC1C,MAAI,MAAM,WAAW,QAAQ,MAAM,OAAO,EAAG,MAAK,UAAU,MAAM;AAClE,SAAO;AACT;AAYA,SAAS,eACP,OAC2C;AAC3C,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,YAAY,KAAK,KAAK;AAAA,EAC/B;AACA,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,SAAS,qBAAqB,MAAM,MAAM;AAChD,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,QAAM,UAAgC,EAAE,QAAA;AACxC,MAAI,eAAe,QAAQ;AAC3B,MAAI,gBAAgB,SAAS;AAC7B,SAAO;AACT;AAEA,SAAS,qBACP,OACwC;AA9WnC;AA+WL,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAqC,CAAA;AAC3C,QAAM,SAAQ,WAAM,UAAN,mBACV,IAAI,CAAC,SAAS,YAAY,IAAI,GAC/B,OAAO,CAAC,SAAS,SAAS;AAC7B,MAAI,+BAAO,OAAQ,QAAO,QAAQ;AAElC,MACE,MAAM,eAAe,QACrB,OAAO,SAAS,MAAM,WAAW,KACjC,MAAM,cAAc,GACpB;AACA,WAAO,cAAc,KAAK,MAAM,MAAM,WAAW;AAAA,EACnD;AACA,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,gBACP,OACmC;AACnC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,WAAkC,CAAA;AACxC,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,iBAAiB,SAAS;AAC9B,QAAM,UAAU,eAAe,MAAM,OAAO;AAC5C,MAAI,kBAAkB,UAAU;AAChC,SAAO,QAAQ,QAAQ,IAAI,WAAW;AACxC;AAEA,SAAS,cACP,OACiC;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,gBAAgB,UAAU;AAC9B,MAAI,MAAM,UAAU,SAAS,MAAM,UAAU;AAC3C,WAAO,QAAQ,MAAM;AACvB,MACE,MAAM,iBAAiB,QACvB,OAAO,SAAS,MAAM,aAAa,KACnC,MAAM,gBAAgB,GACtB;AACA,WAAO,gBAAgB,KAAK,MAAM,MAAM,aAAa;AAAA,EACvD;AACA,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAKA,SAAS,eACP,OACmC;AACnC,MAAI,EAAC,+BAAO,QAAQ,QAAO;AAC3B,SAAO,MAAM,IAAI,aAAa;AAChC;AAEA,SAAS,cAAc,OAAiD;AACtE,QAAM,SAA8B,CAAA;AACpC,QAAM,KAAK,SAAS,oBAAoB,MAAM,EAAE;AAChD,MAAI,WAAW,KAAK;AACpB,QAAM,OAAO,SAAS,mBAAmB,MAAM,IAAI;AACnD,MAAI,aAAa,OAAO;AACxB,QAAM,OAAO,SAAS,wBAAwB,MAAM,IAAI;AACxD,MAAI,aAAa,OAAO;AACxB,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,gBAAgB,UAAU;AAC9B,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,eAAe,SAAS;AAG5B,MAAI,MAAM,UAAU,KAAM,QAAO,SAAS,MAAM;AAChD,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,MAAI,aAAa,OAAO;AACxB,QAAM,QAAQ,SAAS,oBAAoB,MAAM,KAAK;AACtD,MAAI,cAAc,QAAQ;AAC1B,QAAM,QAAQ,SAAS,mBAAmB,MAAM,KAAK;AACrD,MAAI,cAAc,QAAQ;AAC1B,MAAI,MAAM,OAAQ,QAAO,SAAS;AAClC,SAAO;AACT;AAEA,SAAS,cACP,OACiC;AApc5B;AAqcL,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,MAAI,aAAa,OAAO;AACxB,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,eAAe,SAAS;AAC5B,QAAM,eAAe,YAAY,MAAM,YAAY;AACnD,MAAI,qBAAqB,eAAe;AACxC,QAAM,aAAa,iBAAiB,MAAM,UAAU;AACpD,MAAI,eAAe,OAAW,QAAO,aAAa;AAClD,MACE,MAAM,qBAAqB,aAC3B,MAAM,qBAAqB,WAC3B,MAAM,qBAAqB,SAC3B;AACA,WAAO,mBAAmB,MAAM;AAAA,EAClC;AACA,QAAM,eAAc,WAAM,gBAAN,mBAChB,IAAI,CAAC,eAAe,kBAAkB,UAAU,GACjD;AAAA,IACC,CAAC,eACC,eAAe;AAAA;AAErB,MAAI,eAAe,YAAY,SAAS,UAAU,cAAc;AAChE,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,kBACP,OACqC;AACrC,QAAM,aAAsC,CAAA;AAC5C,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GACU;AACV,UAAM,OAAO,YAAY,MAAM,GAAG,CAAC;AACnC,QAAI,KAAM,YAAW,GAAG,IAAI;AAAA,EAC9B;AACA,MAAI,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,IAAI,KAAK,MAAM,QAAQ,GAAG;AACxE,eAAW,OAAO,MAAM;AAAA,EAC1B;AACA,SAAO,WAAW,MAAM,WAAW,QAAQ,WAAW,MAClD,aACA;AACN;AAEA,SAAS,iBACP,OAC0C;AAC1C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAoC,CAAA;AAC1C,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,UAAM,WAAuC,EAAE,MAAA;AAC/C,UAAM,KAAK,YAAY,KAAK,EAAE;AAC9B,QAAI,aAAa,KAAK;AACtB,UAAM,UAAU,YAAY,KAAK,OAAO;AACxC,QAAI,kBAAkB,UAAU;AAChC,QAAI,KAAK,eAAe,QAAQ,OAAO,SAAS,KAAK,WAAW,GAAG;AACjE,eAAS,cAAc,KAAK;AAAA,IAC9B;AACA,UAAM,SAAS,YAAY,KAAK,MAAM;AACtC,QAAI,iBAAiB,SAAS;AAC9B,QAAI,KAAK,QAAS,UAAS,UAAU;AACrC,QAAI,KAAK,QAAQ;AAAA,EACnB;AACA,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEA,SAAS,cACP,OACiC;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,MAAI,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,IAAI,KAAK,MAAM,OAAO,GAAG;AACvE,WAAO,OAAO,MAAM;AAAA,EACtB;AACA,MACE,MAAM,aAAa,QACnB,OAAO,SAAS,MAAM,SAAS,KAC/B,MAAM,YAAY,GAClB;AACA,WAAO,YAAY,KAAK,MAAM,MAAM,SAAS;AAAA,EAC/C;AACA,MACE,MAAM,YAAY,QAClB,OAAO,SAAS,MAAM,QAAQ,KAC9B,MAAM,WAAW,GACjB;AACA,WAAO,WAAW,KAAK,MAAM,MAAM,QAAQ;AAAA,EAC7C;AACA,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,gBAAgB,UAAU;AAC9B,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,cACP,OACiC;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,MAAI,MAAM,YAAa,QAAO,cAAc;AAC5C,MAAI,MAAM,SAAU,QAAO,WAAW;AACtC,MAAI,MAAM,UAAW,QAAO,YAAY;AACxC,MAAI,MAAM,WAAY,QAAO,aAAa;AAC1C,MAAI,MAAM,KAAM,QAAO,OAAO;AAC9B,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,mBACP,OACA,cACsC;AACtC,MAAI,CAAC,SAAS,EAAC,6CAAc,QAAQ,QAAO;AAC5C,QAAM,cAAwC,CAAA;AAC9C,OAAI,+BAAO,SAAQ,MAAM,SAAS,UAAW,aAAY,OAAO,MAAM;AACtE,QAAM,UAAU,YAAY,+BAAO,OAAO;AAC1C,MAAI,qBAAqB,UAAU;AAEnC,QAAM,QAAQ,oBAAoB,+BAAO,KAAK;AAC9C,MAAI,mBAAmB,QAAQ;AAE/B,QAAM,MAAM,sBAAsB,+BAAO,GAAG;AAC5C,MAAI,iBAAiB,MAAM;AAE3B,QAAM,UAAU,wBAAwB,+BAAO,OAAO;AACtD,MAAI,qBAAqB,UAAU;AACnC,QAAM,SAAS,wBAAwB,+BAAO,QAAQ,YAAY;AAClE,MAAI,oBAAoB,SAAS;AACjC,SAAO,QAAQ,WAAW,IAAI,cAAc;AAC9C;AAEA,SAAS,aACP,OACgC;AAChC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAA4B,CAAA;AAClC,QAAM,MAAM,YAAY,MAAM,GAAG;AACjC,MAAI,WAAW,MAAM;AACrB,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,eAAe,UAAU;AAC7B,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,cAAc,SAAS;AAC3B,QAAM,UAAU,eAAe,MAAM,OAAO;AAC5C,MAAI,eAAe,UAAU;AAC7B,QAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,MAAI,gBAAgB,WAAW;AAC/B,SAAO,QAAQ,KAAK,IAAI,QAAQ;AAClC;AAEA,SAAS,eAAe,OAA0C;AAChE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAA6B,CAAA;AACnC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,YAAY,KAAK,IAAI;AAClC,QAAI,CAAC,KAAM;AACX,UAAM,MAA2B,EAAE,KAAA;AACnC,UAAM,UAAU,YAAY,KAAK,KAAK;AACtC,UAAM,YACJ,OAAO,KAAK,cAAc,WACtB,oBAAoB,KAAK,SAAS,IAClC,8BAA8B,KAAK,SAAS;AAClD,QAAI,aAAa,QAAQ;AACzB,QAAI,eAAe,YAAY;AAC/B,QAAI,IAAI,SAAS,IAAI,UAAW,KAAI,KAAK,GAAG;AAAA,EAC9C;AACA,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEA,SAAS,oBACP,OACuC;AACvC,QAAM,SAAS,YAAY,KAAK;AAChC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,CAAC,MAAM,OAAO,EAAE,IAAI,OAAO,MAAM,OAAO,CAAC;AAC/C,QAAM,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM;AAC1E,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,SAAS,YAAY,IAAK,QAAO,EAAE,cAAc,EAAE,MAAM,MAAI;AACjE,MAAI,SAAS,eAAe,IAAK,QAAO,EAAE,iBAAiB,EAAE,MAAM,MAAI;AACvE,MAAI,SAAS,iBAAkB,QAAO,EAAE,gBAAgB,KAAA;AACxD,MAAI,SAAS,UAAU,IAAK,QAAO,EAAE,SAAS,EAAE,MAAM,MAAI;AAC1D,SAAO;AACT;AAEA,SAAS,8BACP,OACuC;AApoBlC;AAqoBL,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAoC,CAAA;AAC1C,QAAM,aAAa,aAAY,WAAM,iBAAN,mBAAoB,IAAI;AACvD,QAAM,YAAY,aAAY,WAAM,iBAAN,mBAAoB,GAAG;AACrD,MAAI,cAAc;AAChB,WAAO,eAAe,EAAE,MAAM,YAAY,KAAK,UAAA;AACjD,QAAM,gBAAgB,aAAY,WAAM,oBAAN,mBAAuB,IAAI;AAC7D,QAAM,eAAe,aAAY,WAAM,oBAAN,mBAAuB,GAAG;AAC3D,MAAI,iBAAiB,cAAc;AACjC,WAAO,kBAAkB,EAAE,MAAM,eAAe,KAAK,aAAA;AAAA,EACvD;AACA,QAAM,iBAAiB,YAAY,MAAM,cAAc;AACvD,MAAI,uBAAuB,iBAAiB;AAC5C,QAAM,WAAW,aAAY,WAAM,YAAN,mBAAe,IAAI;AAChD,QAAM,UAAU,aAAY,WAAM,YAAN,mBAAe,GAAG;AAC9C,MAAI,YAAY,QAAS,QAAO,UAAU,EAAE,MAAM,UAAU,KAAK,QAAA;AACjE,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,qBACP,OACyD;AA1pBpD;AA2pBL,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,WAAwD,CAAA;AAC9D,MAAI,MAAM,SAAS,YAAY,MAAM,SAAS;AAC5C,aAAS,OAAO,MAAM;AACxB,QAAM,MAAM,YAAY,MAAM,GAAG;AACjC,MAAI,cAAc,MAAM;AACxB,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,MAAI,eAAe,OAAO;AAC1B,QAAM,aAAa,YAAY,MAAM,UAAU;AAC/C,MAAI,qBAAqB,aAAa;AACtC,QAAM,MAAM,YAAY,MAAM,GAAG;AACjC,MAAI,cAAc,MAAM;AACxB,MAAI,MAAM,SAAS,QAAQ,OAAO,SAAS,MAAM,KAAK,KAAK,MAAM,QAAQ,GAAG;AAC1E,aAAS,QAAQ,KAAK,MAAM,MAAM,KAAK;AAAA,EACzC;AAEA,QAAM,WAEF,CAAA;AACJ,QAAM,gBAAe,WAAM,aAAN,mBAAgB;AACrC,MAAI,iBAAiB,SAAS,iBAAiB,YAAY;AACzD,aAAS,OAAO;AAAA,EAClB;AACA,QAAM,iBAAiB,aAAY,WAAM,aAAN,mBAAgB,MAAM;AACzD,MAAI,yBAAyB,SAAS;AACtC,QAAM,eAAe,aAAY,WAAM,aAAN,mBAAgB,IAAI;AACrD,MAAI,uBAAuB,OAAO;AAClC,QAAM,eAAe,aAAY,WAAM,aAAN,mBAAgB,IAAI;AACrD,MAAI,uBAAuB,OAAO;AAClC,MAAI,SAAS,SAAS,WAAS,WAAM,aAAN,mBAAgB,gBAAe,OAAO;AACrE,MAAI,QAAQ,QAAQ,EAAG,UAAS,WAAW;AAE3C,QAAM,QAEF,CAAA;AACJ,QAAM,SAAQ,WAAM,UAAN,mBAAa;AAC3B,MACE,UAAU,eACV,UAAU,cACV,UAAU,YACV,UAAU,OACV;AACA,UAAM,QAAQ;AAAA,EAChB;AACA,QAAM,QAAQ,aAAY,WAAM,UAAN,mBAAa,KAAK;AAC5C,MAAI,aAAa,QAAQ;AACzB,MAAI,QAAQ,KAAK,EAAG,UAAS,QAAQ;AAErC,SAAO,QAAQ,QAAQ,IAAI,WAAW;AACxC;AAEA,SAAS,oBACP,OACA;AACA,QAAM,aAAa,sBAAsB,KAAK;AAC9C,SAAO,QAAQ,UAAU,IAAI,aAAa;AAC5C;AAEA,SAAS,wBACP,OACA,eACA;AACA,QAAM,aAAa,0BAA0B,OAAO,aAAa;AACjE,SAAO,QAAQ,UAAU,IAAI,aAAa;AAC5C;AAEA,SAAS,sBACP,OACyC;AACzC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAmC,CAAA;AACzC,aAAW,CAAC,QAAQ,QAAQ,KAAK,OAAO,QAAQ,KAAK,GAAG;AACtD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,IAAK;AACV,QAAI,QAAQ,WAAW;AACrB,YAAM,UAAU,MAAM,QAAQ,QAAQ,IAClC;AAAA,QACE,SAAS,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AAAA,MAAA,IAEpE;AACJ,UAAI,aAAa,UAAU;AAC3B;AAAA,IACF;AACA,QAAI,QAAQ,YAAY;AACtB,UAAI,aAAa,KAAM,KAAI,WAAW;AACtC;AAAA,IACF;AACA,QAAI,mBAAmB,QAAQ,EAAG,KAAI,GAAG,IAAI;AAAA,EAC/C;AACA,SAAO,QAAQ,GAAG,IAAI,MAAM;AAC9B;AAEO,SAAS,sBACd,OAC2B;AAC3B,QAAM,MAAiC,CAAA;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS;AACf,aAAW,QAAQ,YAAY,OAAO,KAAK,KAAK,GAAI,KAAI,IAAI,IAAI;AAChE,aAAW,QAAQ,YAAY,OAAO,IAAI,KAAK,GAAI,KAAI,IAAI,IAAI;AAC/D,aAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,CAAA,CAAE,GAAG;AAClE,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,IAAK;AACV,QAAI,YAAY,UAAW,KAAI,GAAG,IAAI;AACtC,QAAI,YAAY,MAAO,KAAI,GAAG,IAAI;AAClC,QAAI,YAAY,WAAY,KAAI,GAAG,IAAI;AAAA,EACzC;AACA,aAAW,CAAC,QAAQ,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,OAAO,QAAQ,WAAW,QAAQ,UAAU,QAAQ,SAAS;AAChE;AAAA,IACF;AACA,QAAI,iBAAiB,MAAM,EAAG,KAAI,GAAG,IAAI;AAAA,EAC3C;AACA,SAAO;AACT;AAEO,SAAS,0BACd,OACA,eAC+B;AAC/B,QAAM,MAAqC,CAAA;AAC3C,aAAW,MAAM,YAAY,aAAa,KAAK,CAAA,EAAI,KAAI,EAAE,IAAI;AAC7D,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,MAAM,YAAY,KAAK,KAAK,CAAA,EAAI,KAAI,EAAE,IAAI;AACrD,WAAO;AAAA,EACT;AACA,aAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACrD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,IAAK;AACV,QAAI,mBAAmB,OAAO,EAAG,KAAI,GAAG,IAAI;AAAA,EAC9C;AACA,SAAO;AACT;AAEO,SAAS,wBACd,OAC6B;AAC7B,QAAM,MAAmC,CAAA;AACzC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,aAAa,UAAU;AAC3B,MAAI,MAAM,SAAU,KAAI,WAAW;AACnC,aAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACrD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,OAAO,QAAQ,aAAa,QAAQ,WAAY;AACrD,QAAI,mBAAmB,OAAO,EAAG,KAAI,GAAG,IAAI;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAgB;AACxC,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM,MAAM,KAAA;AAClB,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI;AACF,aAAO,KAAK,MAAM,GAAG;AAAA,IACvB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAA6B;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAA,CAAM,EAAE,OAAO,OAAO,CAAC;AAAA,EAAA;AAE1D,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEA,SAAS,YAAY,OAA2B;AAC9C,UAAO,+BAAO,WAAU;AAC1B;AAIA,SAAS,SACP,SACA,OACe;AACf,SAAO,QAAQ,KAAK,CAAC,WAAW,WAAW,KAAK;AAClD;AAEA,SAAS,QAAQ,OAAe;AAC9B,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS;AACrC;AAEA,SAAS,iBAAiB,OAAyC;AACjE,SACE,UAAU,UAAU,UAAU,SAAS,UAAU,WAAW,UAAU;AAE1E;AAEA,SAAS,mBAAmB,OAA2C;AACrE,SAAO,UAAU,aAAa,UAAU;AAC1C;"}
+{"version":3,"file":"SpecRuntimeEditor.model.js","sources":["../../../src/data/ai/SpecRuntimeEditor.model.ts"],"sourcesContent":["import type { ChatBudgetConfig } from \"../chat/types\";\nimport {\n  normalizeToolPolicyRules,\n  type PermissionPolicy,\n} from \"../chat/tool-policy\";\nimport {\n  compactRuntimeSandbox,\n  type AISpecRuntimeSandbox,\n  type SpecPermissionMode,\n} from \"./SpecRuntimeEditor.sandbox-model\";\n\nexport {\n  SPEC_PERMISSION_MODES,\n  SPEC_SANDBOX_MODES,\n} from \"./SpecRuntimeEditor.sandbox-model\";\nexport type {\n  AISpecRuntimeSandbox,\n  AISpecRuntimeSandboxDispatch,\n  AISpecRuntimeSandboxFilesystemPolicy,\n  AISpecRuntimeSandboxNetworkPolicy,\n  AISpecRuntimeSandboxPolicy,\n  SpecPermissionMode,\n  SpecSandboxFilesystemAccess,\n  SpecSandboxMode,\n  SpecSandboxNetworkAccess,\n} from \"./SpecRuntimeEditor.sandbox-model\";\n\nexport const SPEC_TOOL_POLICIES = [\"auto\", \"ask\", \"allow\", \"deny\"] as const;\nexport type SpecToolPolicy = (typeof SPEC_TOOL_POLICIES)[number];\n\nexport const SPEC_RESOURCE_MODES = [\"enabled\", \"disabled\"] as const;\nexport type SpecResourceMode = (typeof SPEC_RESOURCE_MODES)[number];\n\nexport const SPEC_CHECKOUT_MODES = [\"none\", \"remote\", \"local\"] as const;\nexport type SpecCheckoutMode = (typeof SPEC_CHECKOUT_MODES)[number];\n\n/**\n * Sandbox capabilities an adapter may declare. Mirrors captain's\n * registry.SandboxCapability: the editor reads these to decide what to offer —\n * an agent picker needs `remote-exec`, and `isolate-workspace` conflicts with a\n * worktree or setup checkout.\n */\nexport const SPEC_SANDBOX_CAPABILITIES = [\n  \"wrap-command\",\n  \"remote-exec\",\n  \"isolate-workspace\",\n  \"egress-proxy\",\n] as const;\nexport type SpecSandboxCapability = (typeof SPEC_SANDBOX_CAPABILITIES)[number];\n\nexport const SPEC_WORKTREE_MODES = [\"none\", \"new\", \"existing\"] as const;\nexport type SpecWorktreeMode = (typeof SPEC_WORKTREE_MODES)[number];\n\nexport const SPEC_CLONE_MODES = [\"clone\", \"skip\"] as const;\nexport type SpecCloneMode = (typeof SPEC_CLONE_MODES)[number];\n\nexport const SPEC_STASH_MODES = [\n  \"none\",\n  \"untracked\",\n  \"unstaged\",\n  \"staged\",\n  \"all\",\n] as const;\nexport type SpecStashMode = (typeof SPEC_STASH_MODES)[number];\n\nexport const SPEC_VERIFY_SCOPES = [\"all\", \"changed\"] as const;\nexport type SpecVerifyScope = (typeof SPEC_VERIFY_SCOPES)[number];\n\n// The lifecycle boundary a commit fires on, mirroring captain's api.CommitPhase:\n// \"turn\" after every loop iteration, \"agent\" once the generate/verify loop ends,\n// \"run\" after the worktree is merged away.\nexport const SPEC_COMMIT_PHASES = [\"turn\", \"agent\", \"run\"] as const;\nexport type SpecCommitPhase = (typeof SPEC_COMMIT_PHASES)[number];\n\nexport const SPEC_COMMIT_MODES = [\"commit\", \"fixup\", \"amend\"] as const;\nexport type SpecCommitMode = (typeof SPEC_COMMIT_MODES)[number];\n\nexport const SPEC_COMMIT_CONDITIONS = [\n  \"always\",\n  \"onSuccess\",\n  \"onVerify\",\n] as const;\nexport type SpecCommitCondition = (typeof SPEC_COMMIT_CONDITIONS)[number];\n\nexport const SPEC_COMMIT_STAGES = [\"worktree\", \"changed\"] as const;\nexport type SpecCommitStage = (typeof SPEC_COMMIT_STAGES)[number];\n\nexport const SPEC_COMMIT_GATES = [\"none\", \"cheap\", \"full\"] as const;\nexport type SpecCommitGates = (typeof SPEC_COMMIT_GATES)[number];\n\nexport const SPEC_SCHEMA_STRICTNESS = [\"warning\", \"error\", \"retry\"] as const;\nexport type SpecSchemaStrictness = (typeof SPEC_SCHEMA_STRICTNESS)[number];\n\nexport type AISpecRuntimePrompt = {\n  user?: string;\n  system?: string;\n  appendSystem?: string;\n  schemaJSON?: unknown;\n  schemaStrictness?: SpecSchemaStrictness | \"\";\n  attachments?: AISpecRuntimeAttachment[];\n};\n\nexport type AISpecRuntimeAttachment = {\n  id?: string;\n  path?: string;\n  url?: string;\n  filename?: string;\n  mediaType?: string;\n  size?: number;\n  sha256?: string;\n};\n\nexport type AISpecRuntimeModelFallback = {\n  model?: string;\n  id?: string;\n  /** The canonical runtime mode: api | agent | cli | cmux. */\n  mode?: string;\n  temperature?: number;\n  effort?: string;\n  noCache?: boolean;\n};\n\nexport type AISpecRuntimeMemory = {\n  skills?: string[];\n  skipProject?: boolean;\n  skipUser?: boolean;\n  skipSkills?: boolean;\n  skipHooks?: boolean;\n  skipMemory?: boolean;\n  bare?: boolean;\n};\n\nexport type AISpecRuntimeToolPolicies = Record<string, SpecToolPolicy>;\n\nexport type AISpecRuntimeLegacyToolPermissions = {\n  allow?: string[];\n  deny?: string[];\n  modes?: Record<string, string>;\n};\n\nexport type AISpecRuntimeResourcePolicies = Record<string, SpecResourceMode>;\n\nexport type AISpecRuntimeMCPPermissions = {\n  disabled?: boolean;\n  servers?: string[];\n  [name: string]: SpecResourceMode | string[] | boolean | undefined;\n};\n\nexport type AISpecRuntimePermissions = {\n  // The base posture, independent of the sandbox: isolation bounds what the\n  // process can reach, while the mode decides whether the agent asks before\n  // acting. A run can ask for `plan` with no sandbox at all.\n  mode?: SpecPermissionMode;\n  presets?: string[];\n  tools?: AISpecRuntimeToolPolicies | AISpecRuntimeLegacyToolPermissions;\n  mcp?: AISpecRuntimeMCPPermissions;\n  plugins?: AISpecRuntimeResourcePolicies | string[];\n  skills?: AISpecRuntimeResourcePolicies | string[];\n};\n\nexport type AISpecRuntimePermissionCatalogItem = {\n  id: string;\n  label?: string;\n  group?: string;\n  description?: string;\n  source?: string;\n  sourcePath?: string;\n  configured?: boolean;\n  available?: boolean;\n  defaultMode?: string;\n};\n\nexport type AISpecRuntimePermissionCatalog = {\n  tools?: AISpecRuntimePermissionCatalogItem[];\n  mcp?: AISpecRuntimePermissionCatalogItem[];\n  plugins?: AISpecRuntimePermissionCatalogItem[];\n  skills?: AISpecRuntimePermissionCatalogItem[];\n};\n\nexport type AISpecRuntimeBudget = ChatBudgetConfig & {\n  maxTurns?: number;\n  timeout?: string;\n};\n\nexport type AISpecRuntimeSpec = {\n  model?: string;\n  id?: string;\n  /** The canonical runtime mode: api | agent | cli | cmux. */\n  mode?: string;\n  /**\n   * Unified sandbox settings. A mode-only ref round-trips as a scalar.\n   */\n  sandbox?: string | AISpecRuntimeSandbox;\n  temperature?: number;\n  effort?: string;\n  noCache?: boolean;\n  fallbacks?: AISpecRuntimeModelFallback[];\n  prompt?: AISpecRuntimePrompt;\n  budget?: AISpecRuntimeBudget;\n  memory?: AISpecRuntimeMemory;\n  permissions?: AISpecRuntimePermissions;\n  /** Ordered, last-match-wins Captain tool authority rules. */\n  toolPolicy?: PermissionPolicy;\n  setup?: AISpecRuntimeSetup;\n  workflow?: AISpecRuntimeWorkflow;\n  sessionId?: string;\n  /** Extra cmux CLI args (api.Spec.cliArgs), keyed by option json name. */\n  cliArgs?: Record<string, unknown>;\n};\n\nexport type AISpecRuntimeEnvVarSource = {\n  secretKeyRef?: { name?: string; key?: string };\n  configMapKeyRef?: { name?: string; key?: string };\n  serviceAccount?: string;\n  helmRef?: { name?: string; key?: string };\n  onePassword?: string;\n};\n\nexport type AISpecRuntimeEnvVar = {\n  name?: string;\n  value?: string;\n  valueFrom?: string | AISpecRuntimeEnvVarSource;\n};\n\nexport type AISpecRuntimeConnections = {\n  fromConfigItem?: string;\n  eksPodIdentity?: boolean;\n  serviceAccount?: boolean;\n  aws?: {\n    connection?: string;\n    accessKey?: AISpecRuntimeEnvVar;\n    secretKey?: AISpecRuntimeEnvVar;\n    sessionToken?: AISpecRuntimeEnvVar;\n    assumeRole?: string;\n    region?: string;\n    endpoint?: string;\n    skipTLSVerify?: boolean;\n  };\n  gcp?: {\n    connection?: string;\n    credentials?: AISpecRuntimeEnvVar;\n    endpoint?: string;\n    project?: string;\n    skipTLSVerify?: boolean;\n  };\n  azure?: {\n    connection?: string;\n    clientID?: AISpecRuntimeEnvVar;\n    clientSecret?: AISpecRuntimeEnvVar;\n    tenantID?: string;\n  };\n  kubernetes?: {\n    connection?: string;\n    kubeconfig?: AISpecRuntimeEnvVar;\n    eks?: Record<string, unknown>;\n    gke?: Record<string, unknown>;\n    cnrm?: Record<string, unknown>;\n  };\n};\n\nexport type AISpecRuntimeSetup = {\n  cwd?: string;\n  baseDir?: string;\n  dotenv?: string[];\n  envVars?: AISpecRuntimeEnvVar[];\n  connections?: AISpecRuntimeConnections;\n  checkout?: {\n    mode?: SpecCheckoutMode | \"\";\n    url?: string;\n    path?: string;\n    connection?: string;\n    ref?: string;\n    depth?: number;\n    since?: string;\n    worktree?: {\n      mode?: SpecWorktreeMode | \"\";\n      prefix?: string;\n      base?: string;\n      path?: string;\n      keep?: boolean;\n      uncommitted?: SpecCloneMode | \"\";\n      ignored?: SpecCloneMode | \"\";\n    };\n    dirty?: {\n      stash?: SpecStashMode | \"\";\n      since?: string;\n    };\n  };\n};\n\nexport type AISpecRuntimeVerify = {\n  fixture?: string;\n  scope?: SpecVerifyScope | \"\";\n  maxIterations?: number;\n};\n\n// Mirrors captain's api.Commit: one commit policy keyed to a lifecycle phase.\n// Every field is optional because an omitted field means \"captain's default\",\n// which is why an empty stanza is still meaningful — see compactCommits.\nexport type AISpecRuntimeCommit = {\n  on?: SpecCommitPhase | \"\";\n  mode?: SpecCommitMode | \"\";\n  when?: SpecCommitCondition | \"\";\n  message?: string;\n  anchor?: string;\n  squash?: boolean;\n  base?: string;\n  stage?: SpecCommitStage | \"\";\n  gates?: SpecCommitGates | \"\";\n  dryRun?: boolean;\n};\n\n// Mirrors captain's api.Workflow (verify + commits) so the SpecRuntimeEditor's\n// Verify/Commit sections round-trip through the spec frontmatter. Unlike the\n// prior client-only shape, this is part of the compacted spec.\nexport type AISpecRuntimeWorkflow = {\n  verify?: AISpecRuntimeVerify;\n  commits?: AISpecRuntimeCommit[];\n};\n\nexport type AISpecRuntimeValue = AISpecRuntimeSpec;\n\nexport type AISpecRuntimePayload = {\n  spec?: AISpecRuntimeSpec;\n};\n\nexport function buildAISpecRuntimePayload(\n  value: AISpecRuntimeValue,\n): AISpecRuntimePayload {\n  const payload: AISpecRuntimePayload = {};\n  const spec = compactAISpecRuntime(value);\n  if (hasKeys(spec)) payload.spec = spec;\n  return payload;\n}\n\nexport function compactAISpecRuntime(\n  value: AISpecRuntimeValue,\n): AISpecRuntimeSpec {\n  const spec: AISpecRuntimeSpec = {};\n\n  const model = cleanString(value.model);\n  if (model) spec.model = model;\n  const id = cleanString(value.id);\n  if (id) spec.id = id;\n  const specMode = cleanString(value.mode);\n  if (specMode) spec.mode = specMode;\n  if (value.temperature != null && Number.isFinite(value.temperature)) {\n    spec.temperature = value.temperature;\n  }\n  const effort = cleanString(value.effort);\n  if (effort) spec.effort = effort;\n  if (value.noCache) spec.noCache = true;\n  const fallbacks = compactFallbacks(value.fallbacks);\n  if (fallbacks) spec.fallbacks = fallbacks;\n\n  const prompt = compactPrompt(value.prompt);\n  if (prompt) spec.prompt = prompt;\n  const budget = compactBudget(value.budget);\n  if (budget) spec.budget = budget;\n  const memory = compactMemory(value.memory);\n  if (memory) spec.memory = memory;\n  const permissions = compactPermissions(\n    value.permissions,\n    value.memory?.skills,\n  );\n  if (permissions) spec.permissions = permissions;\n  const toolPolicy = normalizeToolPolicyRules(value.toolPolicy);\n  if (toolPolicy.length > 0) spec.toolPolicy = toolPolicy;\n  const setup = compactSetup(value.setup);\n  if (setup) spec.setup = setup;\n  const workflow = compactWorkflow(value.workflow);\n  if (workflow) spec.workflow = workflow;\n  const sessionId = cleanString(value.sessionId);\n  if (sessionId) spec.sessionId = sessionId;\n  const sandbox = compactRuntimeSandbox(value.sandbox);\n  if (sandbox !== undefined) spec.sandbox = sandbox;\n  if (value.cliArgs && hasKeys(value.cliArgs)) spec.cliArgs = value.cliArgs;\n  return spec;\n}\n\nfunction compactWorkflow(\n  value: AISpecRuntimeWorkflow | undefined,\n): AISpecRuntimeWorkflow | undefined {\n  if (!value) return undefined;\n  const workflow: AISpecRuntimeWorkflow = {};\n  const verify = compactVerify(value.verify);\n  if (verify) workflow.verify = verify;\n  const commits = compactCommits(value.commits);\n  if (commits) workflow.commits = commits;\n  return hasKeys(workflow) ? workflow : undefined;\n}\n\nfunction compactVerify(\n  value: AISpecRuntimeVerify | undefined,\n): AISpecRuntimeVerify | undefined {\n  if (!value) return undefined;\n  const verify: AISpecRuntimeVerify = {};\n  const fixture = cleanString(value.fixture);\n  if (fixture) verify.fixture = fixture;\n  if (value.scope === \"all\" || value.scope === \"changed\")\n    verify.scope = value.scope;\n  if (\n    value.maxIterations != null &&\n    Number.isFinite(value.maxIterations) &&\n    value.maxIterations > 0\n  ) {\n    verify.maxIterations = Math.trunc(value.maxIterations);\n  }\n  return hasKeys(verify) ? verify : undefined;\n}\n\n// Presence in the list is what turns committing on, so an empty stanza survives\n// compaction: `commits: [{}]` reads as \"one commit at the end of the run with\n// every default\". Committing nothing is an absent list, not a stanza of falses.\nfunction compactCommits(\n  value: AISpecRuntimeCommit[] | undefined,\n): AISpecRuntimeCommit[] | undefined {\n  if (!value?.length) return undefined;\n  return value.map(compactCommit);\n}\n\nfunction compactCommit(value: AISpecRuntimeCommit): AISpecRuntimeCommit {\n  const commit: AISpecRuntimeCommit = {};\n  const on = pickEnum(SPEC_COMMIT_PHASES, value.on);\n  if (on) commit.on = on;\n  const mode = pickEnum(SPEC_COMMIT_MODES, value.mode);\n  if (mode) commit.mode = mode;\n  const when = pickEnum(SPEC_COMMIT_CONDITIONS, value.when);\n  if (when) commit.when = when;\n  const message = cleanString(value.message);\n  if (message) commit.message = message;\n  const anchor = cleanString(value.anchor);\n  if (anchor) commit.anchor = anchor;\n  // Squash is a *bool in captain: `squash: false` is the instruction to keep the\n  // fixup chain for review, so it cannot be pruned the way a plain flag is.\n  if (value.squash != null) commit.squash = value.squash;\n  const base = cleanString(value.base);\n  if (base) commit.base = base;\n  const stage = pickEnum(SPEC_COMMIT_STAGES, value.stage);\n  if (stage) commit.stage = stage;\n  const gates = pickEnum(SPEC_COMMIT_GATES, value.gates);\n  if (gates) commit.gates = gates;\n  if (value.dryRun) commit.dryRun = true;\n  return commit;\n}\n\nfunction compactPrompt(\n  value: AISpecRuntimePrompt | undefined,\n): AISpecRuntimePrompt | undefined {\n  if (!value) return undefined;\n  const prompt: AISpecRuntimePrompt = {};\n  const user = cleanString(value.user);\n  if (user) prompt.user = user;\n  const system = cleanString(value.system);\n  if (system) prompt.system = system;\n  const appendSystem = cleanString(value.appendSystem);\n  if (appendSystem) prompt.appendSystem = appendSystem;\n  const schemaJSON = compactJSONValue(value.schemaJSON);\n  if (schemaJSON !== undefined) prompt.schemaJSON = schemaJSON;\n  if (\n    value.schemaStrictness === \"warning\" ||\n    value.schemaStrictness === \"error\" ||\n    value.schemaStrictness === \"retry\"\n  ) {\n    prompt.schemaStrictness = value.schemaStrictness;\n  }\n  const attachments = value.attachments\n    ?.map((attachment) => compactAttachment(attachment))\n    .filter(\n      (attachment): attachment is AISpecRuntimeAttachment =>\n        attachment !== undefined,\n    );\n  if (attachments && attachments.length > 0) prompt.attachments = attachments;\n  return hasKeys(prompt) ? prompt : undefined;\n}\n\nfunction compactAttachment(\n  value: AISpecRuntimeAttachment,\n): AISpecRuntimeAttachment | undefined {\n  const attachment: AISpecRuntimeAttachment = {};\n  for (const key of [\n    \"id\",\n    \"path\",\n    \"url\",\n    \"filename\",\n    \"mediaType\",\n    \"sha256\",\n  ] as const) {\n    const text = cleanString(value[key]);\n    if (text) attachment[key] = text;\n  }\n  if (value.size != null && Number.isFinite(value.size) && value.size >= 0) {\n    attachment.size = value.size;\n  }\n  return attachment.id || attachment.path || attachment.url\n    ? attachment\n    : undefined;\n}\n\nfunction compactFallbacks(\n  value: AISpecRuntimeModelFallback[] | undefined,\n): AISpecRuntimeModelFallback[] | undefined {\n  if (!value) return undefined;\n  const out: AISpecRuntimeModelFallback[] = [];\n  for (const item of value) {\n    const model = cleanString(item.model);\n    if (!model) continue;\n    const fallback: AISpecRuntimeModelFallback = { model };\n    const id = cleanString(item.id);\n    if (id) fallback.id = id;\n    const itemMode = cleanString(item.mode);\n    if (itemMode) fallback.mode = itemMode;\n    if (item.temperature != null && Number.isFinite(item.temperature)) {\n      fallback.temperature = item.temperature;\n    }\n    const effort = cleanString(item.effort);\n    if (effort) fallback.effort = effort;\n    if (item.noCache) fallback.noCache = true;\n    out.push(fallback);\n  }\n  return out.length > 0 ? out : undefined;\n}\n\nfunction compactBudget(\n  value: AISpecRuntimeBudget | undefined,\n): AISpecRuntimeBudget | undefined {\n  if (!value) return undefined;\n  const budget: AISpecRuntimeBudget = {};\n  if (value.cost != null && Number.isFinite(value.cost) && value.cost > 0) {\n    budget.cost = value.cost;\n  }\n  if (\n    value.maxTokens != null &&\n    Number.isFinite(value.maxTokens) &&\n    value.maxTokens > 0\n  ) {\n    budget.maxTokens = Math.trunc(value.maxTokens);\n  }\n  if (\n    value.maxTurns != null &&\n    Number.isFinite(value.maxTurns) &&\n    value.maxTurns > 0\n  ) {\n    budget.maxTurns = Math.trunc(value.maxTurns);\n  }\n  const timeout = cleanString(value.timeout);\n  if (timeout) budget.timeout = timeout;\n  return hasKeys(budget) ? budget : undefined;\n}\n\nfunction compactMemory(\n  value: AISpecRuntimeMemory | undefined,\n): AISpecRuntimeMemory | undefined {\n  if (!value) return undefined;\n  const memory: AISpecRuntimeMemory = {};\n  if (value.skipProject) memory.skipProject = true;\n  if (value.skipUser) memory.skipUser = true;\n  if (value.skipHooks) memory.skipHooks = true;\n  if (value.skipMemory) memory.skipMemory = true;\n  if (value.bare) memory.bare = true;\n  return hasKeys(memory) ? memory : undefined;\n}\n\nfunction compactPermissions(\n  value: AISpecRuntimePermissions | undefined,\n  legacySkills?: string[] | undefined,\n): AISpecRuntimePermissions | undefined {\n  if (!value && !legacySkills?.length) return undefined;\n  const permissions: AISpecRuntimePermissions = {};\n  const mode = cleanString(value?.mode) as SpecPermissionMode | undefined;\n  if (mode) permissions.mode = mode;\n  const presets = compactList(value?.presets);\n  if (presets) permissions.presets = presets;\n\n  const tools = compactToolPolicies(value?.tools);\n  if (tools) permissions.tools = tools;\n\n  const mcp = compactMCPPermissions(value?.mcp);\n  if (mcp) permissions.mcp = mcp;\n\n  const plugins = compactResourcePolicies(value?.plugins);\n  if (plugins) permissions.plugins = plugins;\n  const skills = compactResourcePolicies(value?.skills, legacySkills);\n  if (skills) permissions.skills = skills;\n  return hasKeys(permissions) ? permissions : undefined;\n}\n\nfunction compactSetup(\n  value: AISpecRuntimeSetup | undefined,\n): AISpecRuntimeSetup | undefined {\n  if (!value) return undefined;\n  const setup: AISpecRuntimeSetup = {};\n  const cwd = cleanString(value.cwd);\n  if (cwd) setup.cwd = cwd;\n  const baseDir = cleanString(value.baseDir);\n  if (baseDir) setup.baseDir = baseDir;\n  const dotenv = compactList(value.dotenv);\n  if (dotenv) setup.dotenv = dotenv;\n  const envVars = compactEnvVars(value.envVars);\n  if (envVars) setup.envVars = envVars;\n  if (value.connections && hasKeys(value.connections)) {\n    setup.connections = structuredClone(value.connections);\n  }\n  const checkout = compactSetupCheckout(value.checkout);\n  if (checkout) setup.checkout = checkout;\n  return hasKeys(setup) ? setup : undefined;\n}\n\nfunction compactEnvVars(value: AISpecRuntimeEnvVar[] | undefined) {\n  if (!value) return undefined;\n  const out: AISpecRuntimeEnvVar[] = [];\n  for (const item of value) {\n    const name = cleanString(item.name);\n    if (!name) continue;\n    const env: AISpecRuntimeEnvVar = { name };\n    const literal = cleanString(item.value);\n    const valueFrom =\n      typeof item.valueFrom === \"string\"\n        ? compactEnvVarSource(item.valueFrom)\n        : compactStructuredEnvVarSource(item.valueFrom);\n    if (literal) env.value = literal;\n    if (valueFrom) env.valueFrom = valueFrom;\n    if (env.value || env.valueFrom) out.push(env);\n  }\n  return out.length > 0 ? out : undefined;\n}\n\nfunction compactEnvVarSource(\n  value: string | undefined,\n): AISpecRuntimeEnvVarSource | undefined {\n  const source = cleanString(value);\n  if (!source) return undefined;\n  const [kind, rest = \"\"] = source.split(\"://\", 2);\n  const [name = \"\", key = \"\"] = rest.split(\"/\", 2).map((part) => part.trim());\n  if (!name) return undefined;\n  if (kind === \"secret\" && key) return { secretKeyRef: { name, key } };\n  if (kind === \"configmap\" && key) return { configMapKeyRef: { name, key } };\n  if (kind === \"serviceaccount\") return { serviceAccount: name };\n  if (kind === \"helm\" && key) return { helmRef: { name, key } };\n  if (kind === \"op\" && rest) return { onePassword: source };\n  return undefined;\n}\n\nfunction compactStructuredEnvVarSource(\n  value: AISpecRuntimeEnvVarSource | undefined,\n): AISpecRuntimeEnvVarSource | undefined {\n  if (!value) return undefined;\n  const source: AISpecRuntimeEnvVarSource = {};\n  const secretName = cleanString(value.secretKeyRef?.name);\n  const secretKey = cleanString(value.secretKeyRef?.key);\n  if (secretName && secretKey)\n    source.secretKeyRef = { name: secretName, key: secretKey };\n  const configMapName = cleanString(value.configMapKeyRef?.name);\n  const configMapKey = cleanString(value.configMapKeyRef?.key);\n  if (configMapName && configMapKey) {\n    source.configMapKeyRef = { name: configMapName, key: configMapKey };\n  }\n  const serviceAccount = cleanString(value.serviceAccount);\n  if (serviceAccount) source.serviceAccount = serviceAccount;\n  const helmName = cleanString(value.helmRef?.name);\n  const helmKey = cleanString(value.helmRef?.key);\n  if (helmName && helmKey) source.helmRef = { name: helmName, key: helmKey };\n  const onePassword = cleanString(value.onePassword);\n  if (onePassword) source.onePassword = onePassword;\n  return hasKeys(source) ? source : undefined;\n}\n\nfunction compactSetupCheckout(\n  value: AISpecRuntimeSetup[\"checkout\"] | undefined,\n): NonNullable<AISpecRuntimeSetup[\"checkout\"]> | undefined {\n  if (!value) return undefined;\n  const checkout: NonNullable<AISpecRuntimeSetup[\"checkout\"]> = {};\n  if (value.mode === \"remote\" || value.mode === \"local\")\n    checkout.mode = value.mode;\n  const url = cleanString(value.url);\n  if (url) checkout.url = url;\n  const path = cleanString(value.path);\n  if (path) checkout.path = path;\n  const connection = cleanString(value.connection);\n  if (connection) checkout.connection = connection;\n  const ref = cleanString(value.ref);\n  if (ref) checkout.ref = ref;\n  if (value.depth != null && Number.isFinite(value.depth) && value.depth > 0) {\n    checkout.depth = Math.trunc(value.depth);\n  }\n  const since = cleanString(value.since);\n  if (since) checkout.since = since;\n\n  const worktree: NonNullable<\n    NonNullable<AISpecRuntimeSetup[\"checkout\"]>[\"worktree\"]\n  > = {};\n  const worktreeMode = value.worktree?.mode;\n  if (worktreeMode === \"new\" || worktreeMode === \"existing\") {\n    worktree.mode = worktreeMode;\n  }\n  const worktreePrefix = cleanString(value.worktree?.prefix);\n  if (worktreePrefix) worktree.prefix = worktreePrefix;\n  const worktreeBase = cleanString(value.worktree?.base);\n  if (worktreeBase) worktree.base = worktreeBase;\n  const worktreePath = cleanString(value.worktree?.path);\n  if (worktreePath) worktree.path = worktreePath;\n  if (worktree.mode === \"new\" && value.worktree?.keep) worktree.keep = true;\n  if (\n    value.worktree?.uncommitted === \"clone\" ||\n    value.worktree?.uncommitted === \"skip\"\n  ) {\n    worktree.uncommitted = value.worktree.uncommitted;\n  }\n  if (\n    value.worktree?.ignored === \"clone\" ||\n    value.worktree?.ignored === \"skip\"\n  ) {\n    worktree.ignored = value.worktree.ignored;\n  }\n  if (hasKeys(worktree)) checkout.worktree = worktree;\n\n  const dirty: NonNullable<\n    NonNullable<AISpecRuntimeSetup[\"checkout\"]>[\"dirty\"]\n  > = {};\n  const stash = value.dirty?.stash;\n  if (\n    stash === \"untracked\" ||\n    stash === \"unstaged\" ||\n    stash === \"staged\" ||\n    stash === \"all\"\n  ) {\n    dirty.stash = stash;\n  }\n  const dirtySince = cleanString(value.dirty?.since);\n  if (dirtySince) dirty.since = dirtySince;\n  if (hasKeys(dirty)) checkout.dirty = dirty;\n\n  return hasKeys(checkout) ? checkout : undefined;\n}\n\nfunction compactToolPolicies(\n  value: AISpecRuntimePermissions[\"tools\"] | undefined,\n) {\n  const normalized = normalizeToolPolicies(value);\n  return hasKeys(normalized) ? normalized : undefined;\n}\n\nfunction compactResourcePolicies(\n  value: AISpecRuntimePermissions[\"plugins\"] | undefined,\n  legacyEnabled?: string[] | undefined,\n) {\n  const normalized = normalizeResourcePolicies(value, legacyEnabled);\n  return hasKeys(normalized) ? normalized : undefined;\n}\n\nfunction compactMCPPermissions(\n  value: AISpecRuntimeMCPPermissions | undefined,\n): AISpecRuntimeMCPPermissions | undefined {\n  if (!value) return undefined;\n  const out: AISpecRuntimeMCPPermissions = {};\n  for (const [rawKey, rawValue] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key) continue;\n    if (key === \"servers\") {\n      const servers = Array.isArray(rawValue)\n        ? compactList(\n            rawValue.filter((item): item is string => typeof item === \"string\"),\n          )\n        : undefined;\n      if (servers) out.servers = servers;\n      continue;\n    }\n    if (key === \"disabled\") {\n      if (rawValue === true) out.disabled = true;\n      continue;\n    }\n    if (isSpecResourceMode(rawValue)) out[key] = rawValue;\n  }\n  return hasKeys(out) ? out : undefined;\n}\n\nexport function normalizeToolPolicies(\n  value: AISpecRuntimePermissions[\"tools\"] | undefined,\n): AISpecRuntimeToolPolicies {\n  const out: AISpecRuntimeToolPolicies = {};\n  if (!value) return out;\n  const legacy = value as AISpecRuntimeLegacyToolPermissions;\n  for (const tool of compactList(legacy.allow) ?? []) out[tool] = \"allow\";\n  for (const tool of compactList(legacy.deny) ?? []) out[tool] = \"deny\";\n  for (const [rawKey, rawMode] of Object.entries(legacy.modes ?? {})) {\n    const key = rawKey.trim();\n    if (!key) continue;\n    if (rawMode === \"enabled\") out[key] = \"auto\";\n    if (rawMode === \"ask\") out[key] = \"ask\";\n    if (rawMode === \"disabled\") out[key] = \"deny\";\n  }\n  for (const [rawKey, policy] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key || key === \"allow\" || key === \"deny\" || key === \"modes\") {\n      continue;\n    }\n    if (isSpecToolPolicy(policy)) out[key] = policy;\n  }\n  return out;\n}\n\nexport function normalizeResourcePolicies(\n  value: AISpecRuntimePermissions[\"plugins\"] | undefined,\n  legacyEnabled?: string[] | undefined,\n): AISpecRuntimeResourcePolicies {\n  const out: AISpecRuntimeResourcePolicies = {};\n  for (const id of compactList(legacyEnabled) ?? []) out[id] = \"enabled\";\n  if (!value) return out;\n  if (Array.isArray(value)) {\n    for (const id of compactList(value) ?? []) out[id] = \"enabled\";\n    return out;\n  }\n  for (const [rawKey, rawMode] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key) continue;\n    if (isSpecResourceMode(rawMode)) out[key] = rawMode;\n  }\n  return out;\n}\n\nexport function normalizeMCPPermissions(\n  value: AISpecRuntimeMCPPermissions | undefined,\n): AISpecRuntimeMCPPermissions {\n  const out: AISpecRuntimeMCPPermissions = {};\n  if (!value) return out;\n  const servers = compactList(value.servers);\n  if (servers) out.servers = servers;\n  if (value.disabled) out.disabled = true;\n  for (const [rawKey, rawMode] of Object.entries(value)) {\n    const key = rawKey.trim();\n    if (!key || key === \"servers\" || key === \"disabled\") continue;\n    if (isSpecResourceMode(rawMode)) out[key] = rawMode;\n  }\n  return out;\n}\n\nfunction compactJSONValue(value: unknown) {\n  if (value == null) return undefined;\n  if (typeof value === \"string\") {\n    const raw = value.trim();\n    if (!raw) return undefined;\n    try {\n      return JSON.parse(raw);\n    } catch {\n      return undefined;\n    }\n  }\n  return value;\n}\n\nfunction compactList(value: string[] | undefined) {\n  if (!value) return undefined;\n  const out = Array.from(\n    new Set(value.map((item) => item.trim()).filter(Boolean)),\n  );\n  return out.length > 0 ? out : undefined;\n}\n\nfunction cleanString(value: string | undefined) {\n  return value?.trim() ?? \"\";\n}\n\n// Narrows an editor-held string (which may be \"\" while unset) to a member of an\n// enum, dropping anything the Go side would reject.\nfunction pickEnum<T extends string>(\n  options: readonly T[],\n  value: string | undefined,\n): T | undefined {\n  return options.find((option) => option === value);\n}\n\nfunction hasKeys(value: object) {\n  return Object.keys(value).length > 0;\n}\n\nfunction isSpecToolPolicy(value: unknown): value is SpecToolPolicy {\n  return (\n    value === \"auto\" || value === \"ask\" || value === \"allow\" || value === \"deny\"\n  );\n}\n\nfunction isSpecResourceMode(value: unknown): value is SpecResourceMode {\n  return value === \"enabled\" || value === \"disabled\";\n}\n"],"names":[],"mappings":";;;AAiCO,MAAM,sBAAsB,CAAC,QAAQ,UAAU,OAAO;AAiBtD,MAAM,sBAAsB,CAAC,QAAQ,OAAO,UAAU;AAGtD,MAAM,mBAAmB,CAAC,SAAS,MAAM;AAGzC,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,MAAM,qBAAqB,CAAC,OAAO,SAAS;AAM5C,MAAM,qBAAqB,CAAC,QAAQ,SAAS,KAAK;AAGlD,MAAM,oBAAoB,CAAC,UAAU,SAAS,OAAO;AAGrD,MAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF;AAGO,MAAM,qBAAqB,CAAC,YAAY,SAAS;AAGjD,MAAM,oBAAoB,CAAC,QAAQ,SAAS,MAAM;AAGlD,MAAM,yBAAyB,CAAC,WAAW,SAAS,OAAO;AA4O3D,SAAS,0BACd,OACsB;AACtB,QAAM,UAAgC,CAAA;AACtC,QAAM,OAAO,qBAAqB,KAAK;AACvC,MAAI,QAAQ,IAAI,EAAG,SAAQ,OAAO;AAClC,SAAO;AACT;AAEO,SAAS,qBACd,OACmB;;AACnB,QAAM,OAA0B,CAAA;AAEhC,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,MAAI,YAAY,QAAQ;AACxB,QAAM,KAAK,YAAY,MAAM,EAAE;AAC/B,MAAI,SAAS,KAAK;AAClB,QAAM,WAAW,YAAY,MAAM,IAAI;AACvC,MAAI,eAAe,OAAO;AAC1B,MAAI,MAAM,eAAe,QAAQ,OAAO,SAAS,MAAM,WAAW,GAAG;AACnE,SAAK,cAAc,MAAM;AAAA,EAC3B;AACA,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,aAAa,SAAS;AAC1B,MAAI,MAAM,QAAS,MAAK,UAAU;AAClC,QAAM,YAAY,iBAAiB,MAAM,SAAS;AAClD,MAAI,gBAAgB,YAAY;AAEhC,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,aAAa,SAAS;AAC1B,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,aAAa,SAAS;AAC1B,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,aAAa,SAAS;AAC1B,QAAM,cAAc;AAAA,IAClB,MAAM;AAAA,KACN,WAAM,WAAN,mBAAc;AAAA,EAAA;AAEhB,MAAI,kBAAkB,cAAc;AACpC,QAAM,aAAa,yBAAyB,MAAM,UAAU;AAC5D,MAAI,WAAW,SAAS,EAAG,MAAK,aAAa;AAC7C,QAAM,QAAQ,aAAa,MAAM,KAAK;AACtC,MAAI,YAAY,QAAQ;AACxB,QAAM,WAAW,gBAAgB,MAAM,QAAQ;AAC/C,MAAI,eAAe,WAAW;AAC9B,QAAM,YAAY,YAAY,MAAM,SAAS;AAC7C,MAAI,gBAAgB,YAAY;AAChC,QAAM,UAAU,sBAAsB,MAAM,OAAO;AACnD,MAAI,YAAY,OAAW,MAAK,UAAU;AAC1C,MAAI,MAAM,WAAW,QAAQ,MAAM,OAAO,EAAG,MAAK,UAAU,MAAM;AAClE,SAAO;AACT;AAEA,SAAS,gBACP,OACmC;AACnC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,WAAkC,CAAA;AACxC,QAAM,SAAS,cAAc,MAAM,MAAM;AACzC,MAAI,iBAAiB,SAAS;AAC9B,QAAM,UAAU,eAAe,MAAM,OAAO;AAC5C,MAAI,kBAAkB,UAAU;AAChC,SAAO,QAAQ,QAAQ,IAAI,WAAW;AACxC;AAEA,SAAS,cACP,OACiC;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,gBAAgB,UAAU;AAC9B,MAAI,MAAM,UAAU,SAAS,MAAM,UAAU;AAC3C,WAAO,QAAQ,MAAM;AACvB,MACE,MAAM,iBAAiB,QACvB,OAAO,SAAS,MAAM,aAAa,KACnC,MAAM,gBAAgB,GACtB;AACA,WAAO,gBAAgB,KAAK,MAAM,MAAM,aAAa;AAAA,EACvD;AACA,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAKA,SAAS,eACP,OACmC;AACnC,MAAI,EAAC,+BAAO,QAAQ,QAAO;AAC3B,SAAO,MAAM,IAAI,aAAa;AAChC;AAEA,SAAS,cAAc,OAAiD;AACtE,QAAM,SAA8B,CAAA;AACpC,QAAM,KAAK,SAAS,oBAAoB,MAAM,EAAE;AAChD,MAAI,WAAW,KAAK;AACpB,QAAM,OAAO,SAAS,mBAAmB,MAAM,IAAI;AACnD,MAAI,aAAa,OAAO;AACxB,QAAM,OAAO,SAAS,wBAAwB,MAAM,IAAI;AACxD,MAAI,aAAa,OAAO;AACxB,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,gBAAgB,UAAU;AAC9B,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,eAAe,SAAS;AAG5B,MAAI,MAAM,UAAU,KAAM,QAAO,SAAS,MAAM;AAChD,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,MAAI,aAAa,OAAO;AACxB,QAAM,QAAQ,SAAS,oBAAoB,MAAM,KAAK;AACtD,MAAI,cAAc,QAAQ;AAC1B,QAAM,QAAQ,SAAS,mBAAmB,MAAM,KAAK;AACrD,MAAI,cAAc,QAAQ;AAC1B,MAAI,MAAM,OAAQ,QAAO,SAAS;AAClC,SAAO;AACT;AAEA,SAAS,cACP,OACiC;;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,MAAI,aAAa,OAAO;AACxB,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,eAAe,SAAS;AAC5B,QAAM,eAAe,YAAY,MAAM,YAAY;AACnD,MAAI,qBAAqB,eAAe;AACxC,QAAM,aAAa,iBAAiB,MAAM,UAAU;AACpD,MAAI,eAAe,OAAW,QAAO,aAAa;AAClD,MACE,MAAM,qBAAqB,aAC3B,MAAM,qBAAqB,WAC3B,MAAM,qBAAqB,SAC3B;AACA,WAAO,mBAAmB,MAAM;AAAA,EAClC;AACA,QAAM,eAAc,WAAM,gBAAN,mBAChB,IAAI,CAAC,eAAe,kBAAkB,UAAU,GACjD;AAAA,IACC,CAAC,eACC,eAAe;AAAA;AAErB,MAAI,eAAe,YAAY,SAAS,UAAU,cAAc;AAChE,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,kBACP,OACqC;AACrC,QAAM,aAAsC,CAAA;AAC5C,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,GACU;AACV,UAAM,OAAO,YAAY,MAAM,GAAG,CAAC;AACnC,QAAI,KAAM,YAAW,GAAG,IAAI;AAAA,EAC9B;AACA,MAAI,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,IAAI,KAAK,MAAM,QAAQ,GAAG;AACxE,eAAW,OAAO,MAAM;AAAA,EAC1B;AACA,SAAO,WAAW,MAAM,WAAW,QAAQ,WAAW,MAClD,aACA;AACN;AAEA,SAAS,iBACP,OAC0C;AAC1C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAoC,CAAA;AAC1C,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,UAAM,WAAuC,EAAE,MAAA;AAC/C,UAAM,KAAK,YAAY,KAAK,EAAE;AAC9B,QAAI,aAAa,KAAK;AACtB,UAAM,WAAW,YAAY,KAAK,IAAI;AACtC,QAAI,mBAAmB,OAAO;AAC9B,QAAI,KAAK,eAAe,QAAQ,OAAO,SAAS,KAAK,WAAW,GAAG;AACjE,eAAS,cAAc,KAAK;AAAA,IAC9B;AACA,UAAM,SAAS,YAAY,KAAK,MAAM;AACtC,QAAI,iBAAiB,SAAS;AAC9B,QAAI,KAAK,QAAS,UAAS,UAAU;AACrC,QAAI,KAAK,QAAQ;AAAA,EACnB;AACA,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEA,SAAS,cACP,OACiC;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,MAAI,MAAM,QAAQ,QAAQ,OAAO,SAAS,MAAM,IAAI,KAAK,MAAM,OAAO,GAAG;AACvE,WAAO,OAAO,MAAM;AAAA,EACtB;AACA,MACE,MAAM,aAAa,QACnB,OAAO,SAAS,MAAM,SAAS,KAC/B,MAAM,YAAY,GAClB;AACA,WAAO,YAAY,KAAK,MAAM,MAAM,SAAS;AAAA,EAC/C;AACA,MACE,MAAM,YAAY,QAClB,OAAO,SAAS,MAAM,QAAQ,KAC9B,MAAM,WAAW,GACjB;AACA,WAAO,WAAW,KAAK,MAAM,MAAM,QAAQ;AAAA,EAC7C;AACA,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,gBAAgB,UAAU;AAC9B,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,cACP,OACiC;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAA8B,CAAA;AACpC,MAAI,MAAM,YAAa,QAAO,cAAc;AAC5C,MAAI,MAAM,SAAU,QAAO,WAAW;AACtC,MAAI,MAAM,UAAW,QAAO,YAAY;AACxC,MAAI,MAAM,WAAY,QAAO,aAAa;AAC1C,MAAI,MAAM,KAAM,QAAO,OAAO;AAC9B,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,mBACP,OACA,cACsC;AACtC,MAAI,CAAC,SAAS,EAAC,6CAAc,QAAQ,QAAO;AAC5C,QAAM,cAAwC,CAAA;AAC9C,QAAM,OAAO,YAAY,+BAAO,IAAI;AACpC,MAAI,kBAAkB,OAAO;AAC7B,QAAM,UAAU,YAAY,+BAAO,OAAO;AAC1C,MAAI,qBAAqB,UAAU;AAEnC,QAAM,QAAQ,oBAAoB,+BAAO,KAAK;AAC9C,MAAI,mBAAmB,QAAQ;AAE/B,QAAM,MAAM,sBAAsB,+BAAO,GAAG;AAC5C,MAAI,iBAAiB,MAAM;AAE3B,QAAM,UAAU,wBAAwB,+BAAO,OAAO;AACtD,MAAI,qBAAqB,UAAU;AACnC,QAAM,SAAS,wBAAwB,+BAAO,QAAQ,YAAY;AAClE,MAAI,oBAAoB,SAAS;AACjC,SAAO,QAAQ,WAAW,IAAI,cAAc;AAC9C;AAEA,SAAS,aACP,OACgC;AAChC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAA4B,CAAA;AAClC,QAAM,MAAM,YAAY,MAAM,GAAG;AACjC,MAAI,WAAW,MAAM;AACrB,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,eAAe,UAAU;AAC7B,QAAM,SAAS,YAAY,MAAM,MAAM;AACvC,MAAI,cAAc,SAAS;AAC3B,QAAM,UAAU,eAAe,MAAM,OAAO;AAC5C,MAAI,eAAe,UAAU;AAC7B,MAAI,MAAM,eAAe,QAAQ,MAAM,WAAW,GAAG;AACnD,UAAM,cAAc,gBAAgB,MAAM,WAAW;AAAA,EACvD;AACA,QAAM,WAAW,qBAAqB,MAAM,QAAQ;AACpD,MAAI,gBAAgB,WAAW;AAC/B,SAAO,QAAQ,KAAK,IAAI,QAAQ;AAClC;AAEA,SAAS,eAAe,OAA0C;AAChE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAA6B,CAAA;AACnC,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,YAAY,KAAK,IAAI;AAClC,QAAI,CAAC,KAAM;AACX,UAAM,MAA2B,EAAE,KAAA;AACnC,UAAM,UAAU,YAAY,KAAK,KAAK;AACtC,UAAM,YACJ,OAAO,KAAK,cAAc,WACtB,oBAAoB,KAAK,SAAS,IAClC,8BAA8B,KAAK,SAAS;AAClD,QAAI,aAAa,QAAQ;AACzB,QAAI,eAAe,YAAY;AAC/B,QAAI,IAAI,SAAS,IAAI,UAAW,KAAI,KAAK,GAAG;AAAA,EAC9C;AACA,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEA,SAAS,oBACP,OACuC;AACvC,QAAM,SAAS,YAAY,KAAK;AAChC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,CAAC,MAAM,OAAO,EAAE,IAAI,OAAO,MAAM,OAAO,CAAC;AAC/C,QAAM,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM;AAC1E,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,SAAS,YAAY,IAAK,QAAO,EAAE,cAAc,EAAE,MAAM,MAAI;AACjE,MAAI,SAAS,eAAe,IAAK,QAAO,EAAE,iBAAiB,EAAE,MAAM,MAAI;AACvE,MAAI,SAAS,iBAAkB,QAAO,EAAE,gBAAgB,KAAA;AACxD,MAAI,SAAS,UAAU,IAAK,QAAO,EAAE,SAAS,EAAE,MAAM,MAAI;AAC1D,MAAI,SAAS,QAAQ,KAAM,QAAO,EAAE,aAAa,OAAA;AACjD,SAAO;AACT;AAEA,SAAS,8BACP,OACuC;;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAoC,CAAA;AAC1C,QAAM,aAAa,aAAY,WAAM,iBAAN,mBAAoB,IAAI;AACvD,QAAM,YAAY,aAAY,WAAM,iBAAN,mBAAoB,GAAG;AACrD,MAAI,cAAc;AAChB,WAAO,eAAe,EAAE,MAAM,YAAY,KAAK,UAAA;AACjD,QAAM,gBAAgB,aAAY,WAAM,oBAAN,mBAAuB,IAAI;AAC7D,QAAM,eAAe,aAAY,WAAM,oBAAN,mBAAuB,GAAG;AAC3D,MAAI,iBAAiB,cAAc;AACjC,WAAO,kBAAkB,EAAE,MAAM,eAAe,KAAK,aAAA;AAAA,EACvD;AACA,QAAM,iBAAiB,YAAY,MAAM,cAAc;AACvD,MAAI,uBAAuB,iBAAiB;AAC5C,QAAM,WAAW,aAAY,WAAM,YAAN,mBAAe,IAAI;AAChD,QAAM,UAAU,aAAY,WAAM,YAAN,mBAAe,GAAG;AAC9C,MAAI,YAAY,QAAS,QAAO,UAAU,EAAE,MAAM,UAAU,KAAK,QAAA;AACjE,QAAM,cAAc,YAAY,MAAM,WAAW;AACjD,MAAI,oBAAoB,cAAc;AACtC,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,qBACP,OACyD;;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,WAAwD,CAAA;AAC9D,MAAI,MAAM,SAAS,YAAY,MAAM,SAAS;AAC5C,aAAS,OAAO,MAAM;AACxB,QAAM,MAAM,YAAY,MAAM,GAAG;AACjC,MAAI,cAAc,MAAM;AACxB,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,MAAI,eAAe,OAAO;AAC1B,QAAM,aAAa,YAAY,MAAM,UAAU;AAC/C,MAAI,qBAAqB,aAAa;AACtC,QAAM,MAAM,YAAY,MAAM,GAAG;AACjC,MAAI,cAAc,MAAM;AACxB,MAAI,MAAM,SAAS,QAAQ,OAAO,SAAS,MAAM,KAAK,KAAK,MAAM,QAAQ,GAAG;AAC1E,aAAS,QAAQ,KAAK,MAAM,MAAM,KAAK;AAAA,EACzC;AACA,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,MAAI,gBAAgB,QAAQ;AAE5B,QAAM,WAEF,CAAA;AACJ,QAAM,gBAAe,WAAM,aAAN,mBAAgB;AACrC,MAAI,iBAAiB,SAAS,iBAAiB,YAAY;AACzD,aAAS,OAAO;AAAA,EAClB;AACA,QAAM,iBAAiB,aAAY,WAAM,aAAN,mBAAgB,MAAM;AACzD,MAAI,yBAAyB,SAAS;AACtC,QAAM,eAAe,aAAY,WAAM,aAAN,mBAAgB,IAAI;AACrD,MAAI,uBAAuB,OAAO;AAClC,QAAM,eAAe,aAAY,WAAM,aAAN,mBAAgB,IAAI;AACrD,MAAI,uBAAuB,OAAO;AAClC,MAAI,SAAS,SAAS,WAAS,WAAM,aAAN,mBAAgB,gBAAe,OAAO;AACrE,QACE,WAAM,aAAN,mBAAgB,iBAAgB,aAChC,WAAM,aAAN,mBAAgB,iBAAgB,QAChC;AACA,aAAS,cAAc,MAAM,SAAS;AAAA,EACxC;AACA,QACE,WAAM,aAAN,mBAAgB,aAAY,aAC5B,WAAM,aAAN,mBAAgB,aAAY,QAC5B;AACA,aAAS,UAAU,MAAM,SAAS;AAAA,EACpC;AACA,MAAI,QAAQ,QAAQ,EAAG,UAAS,WAAW;AAE3C,QAAM,QAEF,CAAA;AACJ,QAAM,SAAQ,WAAM,UAAN,mBAAa;AAC3B,MACE,UAAU,eACV,UAAU,cACV,UAAU,YACV,UAAU,OACV;AACA,UAAM,QAAQ;AAAA,EAChB;AACA,QAAM,aAAa,aAAY,WAAM,UAAN,mBAAa,KAAK;AACjD,MAAI,kBAAkB,QAAQ;AAC9B,MAAI,QAAQ,KAAK,EAAG,UAAS,QAAQ;AAErC,SAAO,QAAQ,QAAQ,IAAI,WAAW;AACxC;AAEA,SAAS,oBACP,OACA;AACA,QAAM,aAAa,sBAAsB,KAAK;AAC9C,SAAO,QAAQ,UAAU,IAAI,aAAa;AAC5C;AAEA,SAAS,wBACP,OACA,eACA;AACA,QAAM,aAAa,0BAA0B,OAAO,aAAa;AACjE,SAAO,QAAQ,UAAU,IAAI,aAAa;AAC5C;AAEA,SAAS,sBACP,OACyC;AACzC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAmC,CAAA;AACzC,aAAW,CAAC,QAAQ,QAAQ,KAAK,OAAO,QAAQ,KAAK,GAAG;AACtD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,IAAK;AACV,QAAI,QAAQ,WAAW;AACrB,YAAM,UAAU,MAAM,QAAQ,QAAQ,IAClC;AAAA,QACE,SAAS,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AAAA,MAAA,IAEpE;AACJ,UAAI,aAAa,UAAU;AAC3B;AAAA,IACF;AACA,QAAI,QAAQ,YAAY;AACtB,UAAI,aAAa,KAAM,KAAI,WAAW;AACtC;AAAA,IACF;AACA,QAAI,mBAAmB,QAAQ,EAAG,KAAI,GAAG,IAAI;AAAA,EAC/C;AACA,SAAO,QAAQ,GAAG,IAAI,MAAM;AAC9B;AAEO,SAAS,sBACd,OAC2B;AAC3B,QAAM,MAAiC,CAAA;AACvC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS;AACf,aAAW,QAAQ,YAAY,OAAO,KAAK,KAAK,GAAI,KAAI,IAAI,IAAI;AAChE,aAAW,QAAQ,YAAY,OAAO,IAAI,KAAK,GAAI,KAAI,IAAI,IAAI;AAC/D,aAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,CAAA,CAAE,GAAG;AAClE,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,IAAK;AACV,QAAI,YAAY,UAAW,KAAI,GAAG,IAAI;AACtC,QAAI,YAAY,MAAO,KAAI,GAAG,IAAI;AAClC,QAAI,YAAY,WAAY,KAAI,GAAG,IAAI;AAAA,EACzC;AACA,aAAW,CAAC,QAAQ,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,OAAO,QAAQ,WAAW,QAAQ,UAAU,QAAQ,SAAS;AAChE;AAAA,IACF;AACA,QAAI,iBAAiB,MAAM,EAAG,KAAI,GAAG,IAAI;AAAA,EAC3C;AACA,SAAO;AACT;AAEO,SAAS,0BACd,OACA,eAC+B;AAC/B,QAAM,MAAqC,CAAA;AAC3C,aAAW,MAAM,YAAY,aAAa,KAAK,CAAA,EAAI,KAAI,EAAE,IAAI;AAC7D,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,MAAM,YAAY,KAAK,KAAK,CAAA,EAAI,KAAI,EAAE,IAAI;AACrD,WAAO;AAAA,EACT;AACA,aAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACrD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,IAAK;AACV,QAAI,mBAAmB,OAAO,EAAG,KAAI,GAAG,IAAI;AAAA,EAC9C;AACA,SAAO;AACT;AAEO,SAAS,wBACd,OAC6B;AAC7B,QAAM,MAAmC,CAAA;AACzC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,MAAI,aAAa,UAAU;AAC3B,MAAI,MAAM,SAAU,KAAI,WAAW;AACnC,aAAW,CAAC,QAAQ,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACrD,UAAM,MAAM,OAAO,KAAA;AACnB,QAAI,CAAC,OAAO,QAAQ,aAAa,QAAQ,WAAY;AACrD,QAAI,mBAAmB,OAAO,EAAG,KAAI,GAAG,IAAI;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAgB;AACxC,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM,MAAM,KAAA;AAClB,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI;AACF,aAAO,KAAK,MAAM,GAAG;AAAA,IACvB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAA6B;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAA,CAAM,EAAE,OAAO,OAAO,CAAC;AAAA,EAAA;AAE1D,SAAO,IAAI,SAAS,IAAI,MAAM;AAChC;AAEA,SAAS,YAAY,OAA2B;AAC9C,UAAO,+BAAO,WAAU;AAC1B;AAIA,SAAS,SACP,SACA,OACe;AACf,SAAO,QAAQ,KAAK,CAAC,WAAW,WAAW,KAAK;AAClD;AAEA,SAAS,QAAQ,OAAe;AAC9B,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS;AACrC;AAEA,SAAS,iBAAiB,OAAyC;AACjE,SACE,UAAU,UAAU,UAAU,SAAS,UAAU,WAAW,UAAU;AAE1E;AAEA,SAAS,mBAAmB,OAA2C;AACrE,SAAO,UAAU,aAAa,UAAU;AAC1C;"}

package/dist/data/ai/SpecRuntimeEditor.sandbox-model.cjs

@@ -0,0 +1,276 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const SPEC_PERMISSION_MODES = [
+  "default",
+  "acceptEdits",
+  "auto",
+  "bypassPermissions",
+  "dontAsk",
+  "plan"
+];
+const SPEC_SANDBOX_MODES = [
+  "off",
+  "native",
+  "docker",
+  "git-agent"
+];
+function compactRuntimeSandbox(value) {
+  if (value == null) return void 0;
+  if (typeof value === "string") {
+    const raw = value.trim();
+    return raw ? sandboxMode(raw) : void 0;
+  }
+  assertKnownKeys(
+    value,
+    ["mode", "approval", "backend", "agent", "policy", "dispatch"],
+    "sandbox"
+  );
+  const configured = Object.values(value).some(
+    (item) => item != null && item !== ""
+  );
+  if (!value.mode) {
+    if (configured)
+      throw new Error(
+        "sandbox.mode is required when sandbox settings are configured"
+      );
+    return void 0;
+  }
+  const mode = sandboxMode(value.mode);
+  const approval = permissionMode(value.approval);
+  const backend = cleanString(value.backend);
+  const agent = cleanString(value.agent);
+  const policy = compactNativePolicy(value.policy);
+  const dispatch = compactDispatch(value.dispatch);
+  if (mode === "off") {
+    rejectSandboxFields(mode, { approval, backend, agent, policy, dispatch });
+    return mode;
+  }
+  if (mode === "native") {
+    rejectSandboxFields(mode, { backend, agent, dispatch });
+    return compactSandboxObject({
+      mode,
+      ...approval ? { approval } : {},
+      ...policy ? { policy } : {}
+    });
+  }
+  if (mode === "docker") {
+    rejectSandboxFields(mode, { agent, policy, dispatch });
+    return compactSandboxObject({
+      mode,
+      ...approval ? { approval } : {},
+      ...backend ? { backend } : {}
+    });
+  }
+  rejectSandboxFields(mode, { policy });
+  return compactSandboxObject({
+    mode,
+    ...approval ? { approval } : {},
+    ...backend ? { backend } : {},
+    ...agent ? { agent } : {},
+    ...dispatch ? { dispatch } : {}
+  });
+}
+function compactSandboxObject(value) {
+  const entries = Object.entries(value).filter(
+    ([, item]) => item !== void 0
+  );
+  if (entries.length === 1) return value.mode;
+  return Object.fromEntries(entries);
+}
+function compactNativePolicy(value) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [
+      "required",
+      "filesystem",
+      "network",
+      "commands",
+      "credentials",
+      "platform"
+    ],
+    "sandbox.policy"
+  );
+  const policy = {};
+  if (value.required != null) policy.required = value.required;
+  const filesystem = compactFilesystem(value.filesystem);
+  if (filesystem) policy.filesystem = filesystem;
+  const network = compactNetwork(value.network);
+  if (network) policy.network = network;
+  const commands = compactBooleanAndLists(
+    value.commands,
+    ["excludedFromSandbox"],
+    ["allowUnsandboxed"],
+    "sandbox.policy.commands"
+  );
+  if (commands) policy.commands = commands;
+  const credentials = compactBooleanAndLists(
+    value.credentials,
+    ["deniedFiles", "deniedEnv", "maskedEnv"],
+    [],
+    "sandbox.policy.credentials"
+  );
+  if (credentials) policy.credentials = credentials;
+  const platform = compactBooleanAndLists(
+    value.platform,
+    [],
+    ["allowAppleEvents", "weakerNestedIsolation", "weakerNetworkIsolation"],
+    "sandbox.policy.platform"
+  );
+  if (platform) policy.platform = platform;
+  return hasKeys(policy) ? policy : void 0;
+}
+function compactFilesystem(value) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [
+      "access",
+      "writableRoots",
+      "readableRoots",
+      "deniedReadRoots",
+      "deniedWriteRoots",
+      "includeSystemTemp"
+    ],
+    "sandbox.policy.filesystem"
+  );
+  const filesystem = compactBooleanAndLists(
+    value,
+    ["writableRoots", "readableRoots", "deniedReadRoots", "deniedWriteRoots"],
+    ["includeSystemTemp"],
+    "sandbox.policy.filesystem",
+    ["access"]
+  );
+  const access = value.access;
+  if (access && access !== "read-only" && access !== "workspace-write") {
+    throw new Error(
+      `sandbox.policy.filesystem.access ${JSON.stringify(access)} is invalid`
+    );
+  }
+  if (access) return { ...filesystem, access };
+  return filesystem;
+}
+function compactNetwork(value) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [
+      "access",
+      "allowedDomains",
+      "deniedDomains",
+      "allowedUnixSockets",
+      "allowAllUnixSockets",
+      "allowLocalBinding",
+      "allowedMachServices",
+      "httpProxyPort",
+      "socksProxyPort"
+    ],
+    "sandbox.policy.network"
+  );
+  const network = compactBooleanAndLists(
+    value,
+    [
+      "allowedDomains",
+      "deniedDomains",
+      "allowedUnixSockets",
+      "allowedMachServices"
+    ],
+    ["allowAllUnixSockets", "allowLocalBinding"],
+    "sandbox.policy.network",
+    ["access", "httpProxyPort", "socksProxyPort"]
+  ) ?? {};
+  if (value.access && !["disabled", "restricted", "unrestricted"].includes(value.access)) {
+    throw new Error(
+      `sandbox.policy.network.access ${JSON.stringify(value.access)} is invalid`
+    );
+  }
+  if (value.access) network.access = value.access;
+  for (const key of ["httpProxyPort", "socksProxyPort"]) {
+    const port = value[key];
+    if (port == null) continue;
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error(
+        `sandbox.policy.network.${key} must be between 1 and 65535`
+      );
+    }
+    network[key] = port;
+  }
+  return hasKeys(network) ? network : void 0;
+}
+function compactDispatch(value) {
+  if (!value) return void 0;
+  assertKnownKeys(value, ["paths", "maxAttempts"], "sandbox.dispatch");
+  const dispatch = {};
+  const paths = cleanList(value.paths);
+  if (paths) dispatch.paths = paths;
+  if (value.maxAttempts != null) {
+    if (!Number.isInteger(value.maxAttempts) || value.maxAttempts < 0) {
+      throw new Error(
+        "sandbox.dispatch.maxAttempts must be a non-negative integer"
+      );
+    }
+    if (value.maxAttempts > 0) dispatch.maxAttempts = value.maxAttempts;
+  }
+  return hasKeys(dispatch) ? dispatch : void 0;
+}
+function compactBooleanAndLists(value, listKeys, booleanKeys, path, additionalKeys = []) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [...listKeys, ...booleanKeys, ...additionalKeys],
+    path
+  );
+  const out = {};
+  for (const key of listKeys) {
+    const list = cleanList(
+      value[key]
+    );
+    if (list) out[key] = list;
+  }
+  for (const key of booleanKeys) {
+    const item = value[key];
+    if (item != null) out[key] = item;
+  }
+  return hasKeys(out) ? out : void 0;
+}
+function rejectSandboxFields(mode, values) {
+  var _a;
+  const field = (_a = Object.entries(values).find(
+    ([, value]) => value !== void 0
+  )) == null ? void 0 : _a[0];
+  if (field) throw new Error(`sandbox mode ${mode} does not accept ${field}`);
+}
+function sandboxMode(value) {
+  const mode = SPEC_SANDBOX_MODES.find((item) => item === value);
+  if (!mode)
+    throw new Error(`sandbox.mode ${JSON.stringify(value)} is invalid`);
+  return mode;
+}
+function permissionMode(value) {
+  if (!value) return void 0;
+  const mode = SPEC_PERMISSION_MODES.find((item) => item === value);
+  if (!mode)
+    throw new Error(`sandbox.approval ${JSON.stringify(value)} is invalid`);
+  return mode;
+}
+function assertKnownKeys(value, keys, path) {
+  const unknown = Object.keys(value).find((key) => !keys.includes(key));
+  if (unknown) throw new Error(`${path}.${unknown} is not supported`);
+}
+function cleanList(value) {
+  if (!value) return void 0;
+  const items = Array.from(
+    new Set(value.map((item) => item.trim()).filter(Boolean))
+  );
+  return items.length > 0 ? items : void 0;
+}
+function cleanString(value) {
+  return (value == null ? void 0 : value.trim()) || void 0;
+}
+function hasKeys(value) {
+  return Object.keys(value).length > 0;
+}
+exports.SPEC_PERMISSION_MODES = SPEC_PERMISSION_MODES;
+exports.SPEC_SANDBOX_MODES = SPEC_SANDBOX_MODES;
+exports.compactRuntimeSandbox = compactRuntimeSandbox;
+//# sourceMappingURL=SpecRuntimeEditor.sandbox-model.cjs.map