@flanksource/clicky-ui 0.3.27 → 0.3.28

package/dist/data/ai/SpecRuntimeEditor.sandbox-model.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpecRuntimeEditor.sandbox-model.cjs","sources":["../../../src/data/ai/SpecRuntimeEditor.sandbox-model.ts"],"sourcesContent":["export const SPEC_PERMISSION_MODES = [\n  \"default\",\n  \"acceptEdits\",\n  \"auto\",\n  \"bypassPermissions\",\n  \"dontAsk\",\n  \"plan\",\n] as const;\n\nexport type SpecPermissionMode = (typeof SPEC_PERMISSION_MODES)[number];\n\nexport const SPEC_SANDBOX_MODES = [\n  \"off\",\n  \"native\",\n  \"docker\",\n  \"git-agent\",\n] as const;\n\nexport type SpecSandboxMode = (typeof SPEC_SANDBOX_MODES)[number];\nexport type SpecSandboxFilesystemAccess = \"read-only\" | \"workspace-write\";\nexport type SpecSandboxNetworkAccess =\n  | \"disabled\"\n  | \"restricted\"\n  | \"unrestricted\";\n\nexport type AISpecRuntimeSandboxFilesystemPolicy = {\n  access?: SpecSandboxFilesystemAccess;\n  writableRoots?: string[];\n  readableRoots?: string[];\n  deniedReadRoots?: string[];\n  deniedWriteRoots?: string[];\n  includeSystemTemp?: boolean;\n};\n\nexport type AISpecRuntimeSandboxNetworkPolicy = {\n  access?: SpecSandboxNetworkAccess;\n  allowedDomains?: string[];\n  deniedDomains?: string[];\n  allowedUnixSockets?: string[];\n  allowAllUnixSockets?: boolean;\n  allowLocalBinding?: boolean;\n  allowedMachServices?: string[];\n  httpProxyPort?: number;\n  socksProxyPort?: number;\n};\n\nexport type AISpecRuntimeSandboxPolicy = {\n  required?: boolean;\n  filesystem?: AISpecRuntimeSandboxFilesystemPolicy;\n  network?: AISpecRuntimeSandboxNetworkPolicy;\n  commands?: {\n    excludedFromSandbox?: string[];\n    allowUnsandboxed?: boolean;\n  };\n  credentials?: {\n    deniedFiles?: string[];\n    deniedEnv?: string[];\n    maskedEnv?: string[];\n  };\n  platform?: {\n    allowAppleEvents?: boolean;\n    weakerNestedIsolation?: boolean;\n    weakerNetworkIsolation?: boolean;\n  };\n};\n\nexport type AISpecRuntimeSandboxDispatch = {\n  paths?: string[];\n  maxAttempts?: number;\n};\n\nexport type AISpecRuntimeSandbox = {\n  mode?: SpecSandboxMode;\n  approval?: SpecPermissionMode;\n  backend?: string;\n  agent?: string;\n  policy?: AISpecRuntimeSandboxPolicy;\n  dispatch?: AISpecRuntimeSandboxDispatch;\n};\n\nexport function compactRuntimeSandbox(\n  value: string | AISpecRuntimeSandbox | undefined,\n): string | AISpecRuntimeSandbox | undefined {\n  if (value == null) return undefined;\n  if (typeof value === \"string\") {\n    const raw = value.trim();\n    return raw ? sandboxMode(raw) : undefined;\n  }\n  assertKnownKeys(\n    value,\n    [\"mode\", \"approval\", \"backend\", \"agent\", \"policy\", \"dispatch\"],\n    \"sandbox\",\n  );\n  const configured = Object.values(value).some(\n    (item) => item != null && item !== \"\",\n  );\n  if (!value.mode) {\n    if (configured)\n      throw new Error(\n        \"sandbox.mode is required when sandbox settings are configured\",\n      );\n    return undefined;\n  }\n  const mode = sandboxMode(value.mode);\n  const approval = permissionMode(value.approval);\n  const backend = cleanString(value.backend);\n  const agent = cleanString(value.agent);\n  const policy = compactNativePolicy(value.policy);\n  const dispatch = compactDispatch(value.dispatch);\n\n  if (mode === \"off\") {\n    rejectSandboxFields(mode, { approval, backend, agent, policy, dispatch });\n    return mode;\n  }\n  if (mode === \"native\") {\n    rejectSandboxFields(mode, { backend, agent, dispatch });\n    return compactSandboxObject({\n      mode,\n      ...(approval ? { approval } : {}),\n      ...(policy ? { policy } : {}),\n    });\n  }\n  if (mode === \"docker\") {\n    rejectSandboxFields(mode, { agent, policy, dispatch });\n    return compactSandboxObject({\n      mode,\n      ...(approval ? { approval } : {}),\n      ...(backend ? { backend } : {}),\n    });\n  }\n  rejectSandboxFields(mode, { policy });\n  return compactSandboxObject({\n    mode,\n    ...(approval ? { approval } : {}),\n    ...(backend ? { backend } : {}),\n    ...(agent ? { agent } : {}),\n    ...(dispatch ? { dispatch } : {}),\n  });\n}\n\nfunction compactSandboxObject(\n  value: AISpecRuntimeSandbox,\n): string | AISpecRuntimeSandbox {\n  const entries = Object.entries(value).filter(\n    ([, item]) => item !== undefined,\n  );\n  if (entries.length === 1) return value.mode!;\n  return Object.fromEntries(entries) as AISpecRuntimeSandbox;\n}\n\nfunction compactNativePolicy(\n  value: AISpecRuntimeSandboxPolicy | undefined,\n): AISpecRuntimeSandboxPolicy | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [\n      \"required\",\n      \"filesystem\",\n      \"network\",\n      \"commands\",\n      \"credentials\",\n      \"platform\",\n    ],\n    \"sandbox.policy\",\n  );\n  const policy: AISpecRuntimeSandboxPolicy = {};\n  if (value.required != null) policy.required = value.required;\n  const filesystem = compactFilesystem(value.filesystem);\n  if (filesystem) policy.filesystem = filesystem;\n  const network = compactNetwork(value.network);\n  if (network) policy.network = network;\n  const commands = compactBooleanAndLists(\n    value.commands,\n    [\"excludedFromSandbox\"],\n    [\"allowUnsandboxed\"],\n    \"sandbox.policy.commands\",\n  );\n  if (commands) policy.commands = commands;\n  const credentials = compactBooleanAndLists(\n    value.credentials,\n    [\"deniedFiles\", \"deniedEnv\", \"maskedEnv\"],\n    [],\n    \"sandbox.policy.credentials\",\n  );\n  if (credentials) policy.credentials = credentials;\n  const platform = compactBooleanAndLists(\n    value.platform,\n    [],\n    [\"allowAppleEvents\", \"weakerNestedIsolation\", \"weakerNetworkIsolation\"],\n    \"sandbox.policy.platform\",\n  );\n  if (platform) policy.platform = platform;\n  return hasKeys(policy) ? policy : undefined;\n}\n\nfunction compactFilesystem(\n  value: AISpecRuntimeSandboxFilesystemPolicy | undefined,\n): AISpecRuntimeSandboxFilesystemPolicy | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [\n      \"access\",\n      \"writableRoots\",\n      \"readableRoots\",\n      \"deniedReadRoots\",\n      \"deniedWriteRoots\",\n      \"includeSystemTemp\",\n    ],\n    \"sandbox.policy.filesystem\",\n  );\n  const filesystem = compactBooleanAndLists(\n    value,\n    [\"writableRoots\", \"readableRoots\", \"deniedReadRoots\", \"deniedWriteRoots\"],\n    [\"includeSystemTemp\"],\n    \"sandbox.policy.filesystem\",\n    [\"access\"],\n  ) as AISpecRuntimeSandboxFilesystemPolicy | undefined;\n  const access = value.access;\n  if (access && access !== \"read-only\" && access !== \"workspace-write\") {\n    throw new Error(\n      `sandbox.policy.filesystem.access ${JSON.stringify(access)} is invalid`,\n    );\n  }\n  if (access) return { ...filesystem, access };\n  return filesystem;\n}\n\nfunction compactNetwork(\n  value: AISpecRuntimeSandboxNetworkPolicy | undefined,\n): AISpecRuntimeSandboxNetworkPolicy | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [\n      \"access\",\n      \"allowedDomains\",\n      \"deniedDomains\",\n      \"allowedUnixSockets\",\n      \"allowAllUnixSockets\",\n      \"allowLocalBinding\",\n      \"allowedMachServices\",\n      \"httpProxyPort\",\n      \"socksProxyPort\",\n    ],\n    \"sandbox.policy.network\",\n  );\n  const network = (compactBooleanAndLists(\n    value,\n    [\n      \"allowedDomains\",\n      \"deniedDomains\",\n      \"allowedUnixSockets\",\n      \"allowedMachServices\",\n    ],\n    [\"allowAllUnixSockets\", \"allowLocalBinding\"],\n    \"sandbox.policy.network\",\n    [\"access\", \"httpProxyPort\", \"socksProxyPort\"],\n  ) ?? {}) as AISpecRuntimeSandboxNetworkPolicy;\n  if (\n    value.access &&\n    ![\"disabled\", \"restricted\", \"unrestricted\"].includes(value.access)\n  ) {\n    throw new Error(\n      `sandbox.policy.network.access ${JSON.stringify(value.access)} is invalid`,\n    );\n  }\n  if (value.access) network.access = value.access;\n  for (const key of [\"httpProxyPort\", \"socksProxyPort\"] as const) {\n    const port = value[key];\n    if (port == null) continue;\n    if (!Number.isInteger(port) || port < 1 || port > 65535) {\n      throw new Error(\n        `sandbox.policy.network.${key} must be between 1 and 65535`,\n      );\n    }\n    network[key] = port;\n  }\n  return hasKeys(network) ? network : undefined;\n}\n\nfunction compactDispatch(\n  value: AISpecRuntimeSandboxDispatch | undefined,\n): AISpecRuntimeSandboxDispatch | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(value, [\"paths\", \"maxAttempts\"], \"sandbox.dispatch\");\n  const dispatch: AISpecRuntimeSandboxDispatch = {};\n  const paths = cleanList(value.paths);\n  if (paths) dispatch.paths = paths;\n  if (value.maxAttempts != null) {\n    if (!Number.isInteger(value.maxAttempts) || value.maxAttempts < 0) {\n      throw new Error(\n        \"sandbox.dispatch.maxAttempts must be a non-negative integer\",\n      );\n    }\n    if (value.maxAttempts > 0) dispatch.maxAttempts = value.maxAttempts;\n  }\n  return hasKeys(dispatch) ? dispatch : undefined;\n}\n\nfunction compactBooleanAndLists<T extends object>(\n  value: T | undefined,\n  listKeys: readonly string[],\n  booleanKeys: readonly string[],\n  path: string,\n  additionalKeys: readonly string[] = [],\n): T | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [...listKeys, ...booleanKeys, ...additionalKeys],\n    path,\n  );\n  const out: Record<string, unknown> = {};\n  for (const key of listKeys) {\n    const list = cleanList(\n      (value as Record<string, unknown>)[key] as string[] | undefined,\n    );\n    if (list) out[key] = list;\n  }\n  for (const key of booleanKeys) {\n    const item = (value as Record<string, unknown>)[key];\n    if (item != null) out[key] = item;\n  }\n  return hasKeys(out) ? (out as T) : undefined;\n}\n\nfunction rejectSandboxFields(\n  mode: SpecSandboxMode,\n  values: Record<string, unknown>,\n) {\n  const field = Object.entries(values).find(\n    ([, value]) => value !== undefined,\n  )?.[0];\n  if (field) throw new Error(`sandbox mode ${mode} does not accept ${field}`);\n}\n\nfunction sandboxMode(value: string): SpecSandboxMode {\n  const mode = SPEC_SANDBOX_MODES.find((item) => item === value);\n  if (!mode)\n    throw new Error(`sandbox.mode ${JSON.stringify(value)} is invalid`);\n  return mode;\n}\n\nfunction permissionMode(\n  value: string | undefined,\n): SpecPermissionMode | undefined {\n  if (!value) return undefined;\n  const mode = SPEC_PERMISSION_MODES.find((item) => item === value);\n  if (!mode)\n    throw new Error(`sandbox.approval ${JSON.stringify(value)} is invalid`);\n  return mode;\n}\n\nfunction assertKnownKeys(value: object, keys: readonly string[], path: string) {\n  const unknown = Object.keys(value).find((key) => !keys.includes(key));\n  if (unknown) throw new Error(`${path}.${unknown} is not supported`);\n}\n\nfunction cleanList(value: string[] | undefined) {\n  if (!value) return undefined;\n  const items = Array.from(\n    new Set(value.map((item) => item.trim()).filter(Boolean)),\n  );\n  return items.length > 0 ? items : undefined;\n}\n\nfunction cleanString(value: string | undefined) {\n  return value?.trim() || undefined;\n}\n\nfunction hasKeys(value: object) {\n  return Object.keys(value).length > 0;\n}\n"],"names":[],"mappings":";;AAAO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgEO,SAAS,sBACd,OAC2C;AAC3C,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM,MAAM,KAAA;AAClB,WAAO,MAAM,YAAY,GAAG,IAAI;AAAA,EAClC;AACA;AAAA,IACE;AAAA,IACA,CAAC,QAAQ,YAAY,WAAW,SAAS,UAAU,UAAU;AAAA,IAC7D;AAAA,EAAA;AAEF,QAAM,aAAa,OAAO,OAAO,KAAK,EAAE;AAAA,IACtC,CAAC,SAAS,QAAQ,QAAQ,SAAS;AAAA,EAAA;AAErC,MAAI,CAAC,MAAM,MAAM;AACf,QAAI;AACF,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAEJ,WAAO;AAAA,EACT;AACA,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,QAAM,WAAW,eAAe,MAAM,QAAQ;AAC9C,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,SAAS,oBAAoB,MAAM,MAAM;AAC/C,QAAM,WAAW,gBAAgB,MAAM,QAAQ;AAE/C,MAAI,SAAS,OAAO;AAClB,wBAAoB,MAAM,EAAE,UAAU,SAAS,OAAO,QAAQ,UAAU;AACxE,WAAO;AAAA,EACT;AACA,MAAI,SAAS,UAAU;AACrB,wBAAoB,MAAM,EAAE,SAAS,OAAO,UAAU;AACtD,WAAO,qBAAqB;AAAA,MAC1B;AAAA,MACA,GAAI,WAAW,EAAE,SAAA,IAAa,CAAA;AAAA,MAC9B,GAAI,SAAS,EAAE,WAAW,CAAA;AAAA,IAAC,CAC5B;AAAA,EACH;AACA,MAAI,SAAS,UAAU;AACrB,wBAAoB,MAAM,EAAE,OAAO,QAAQ,UAAU;AACrD,WAAO,qBAAqB;AAAA,MAC1B;AAAA,MACA,GAAI,WAAW,EAAE,SAAA,IAAa,CAAA;AAAA,MAC9B,GAAI,UAAU,EAAE,YAAY,CAAA;AAAA,IAAC,CAC9B;AAAA,EACH;AACA,sBAAoB,MAAM,EAAE,QAAQ;AACpC,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,GAAI,WAAW,EAAE,SAAA,IAAa,CAAA;AAAA,IAC9B,GAAI,UAAU,EAAE,QAAA,IAAY,CAAA;AAAA,IAC5B,GAAI,QAAQ,EAAE,MAAA,IAAU,CAAA;AAAA,IACxB,GAAI,WAAW,EAAE,aAAa,CAAA;AAAA,EAAC,CAChC;AACH;AAEA,SAAS,qBACP,OAC+B;AAC/B,QAAM,UAAU,OAAO,QAAQ,KAAK,EAAE;AAAA,IACpC,CAAC,CAAA,EAAG,IAAI,MAAM,SAAS;AAAA,EAAA;AAEzB,MAAI,QAAQ,WAAW,EAAG,QAAO,MAAM;AACvC,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,oBACP,OACwC;AACxC,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF;AAAA,EAAA;AAEF,QAAM,SAAqC,CAAA;AAC3C,MAAI,MAAM,YAAY,KAAM,QAAO,WAAW,MAAM;AACpD,QAAM,aAAa,kBAAkB,MAAM,UAAU;AACrD,MAAI,mBAAmB,aAAa;AACpC,QAAM,UAAU,eAAe,MAAM,OAAO;AAC5C,MAAI,gBAAgB,UAAU;AAC9B,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN,CAAC,qBAAqB;AAAA,IACtB,CAAC,kBAAkB;AAAA,IACnB;AAAA,EAAA;AAEF,MAAI,iBAAiB,WAAW;AAChC,QAAM,cAAc;AAAA,IAClB,MAAM;AAAA,IACN,CAAC,eAAe,aAAa,WAAW;AAAA,IACxC,CAAA;AAAA,IACA;AAAA,EAAA;AAEF,MAAI,oBAAoB,cAAc;AACtC,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN,CAAA;AAAA,IACA,CAAC,oBAAoB,yBAAyB,wBAAwB;AAAA,IACtE;AAAA,EAAA;AAEF,MAAI,iBAAiB,WAAW;AAChC,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,kBACP,OACkD;AAClD,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF;AAAA,EAAA;AAEF,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,CAAC,iBAAiB,iBAAiB,mBAAmB,kBAAkB;AAAA,IACxE,CAAC,mBAAmB;AAAA,IACpB;AAAA,IACA,CAAC,QAAQ;AAAA,EAAA;AAEX,QAAM,SAAS,MAAM;AACrB,MAAI,UAAU,WAAW,eAAe,WAAW,mBAAmB;AACpE,UAAM,IAAI;AAAA,MACR,oCAAoC,KAAK,UAAU,MAAM,CAAC;AAAA,IAAA;AAAA,EAE9D;AACA,MAAI,OAAQ,QAAO,EAAE,GAAG,YAAY,OAAA;AACpC,SAAO;AACT;AAEA,SAAS,eACP,OAC+C;AAC/C,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF;AAAA,EAAA;AAEF,QAAM,UAAW;AAAA,IACf;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF,CAAC,uBAAuB,mBAAmB;AAAA,IAC3C;AAAA,IACA,CAAC,UAAU,iBAAiB,gBAAgB;AAAA,EAAA,KACzC,CAAA;AACL,MACE,MAAM,UACN,CAAC,CAAC,YAAY,cAAc,cAAc,EAAE,SAAS,MAAM,MAAM,GACjE;AACA,UAAM,IAAI;AAAA,MACR,iCAAiC,KAAK,UAAU,MAAM,MAAM,CAAC;AAAA,IAAA;AAAA,EAEjE;AACA,MAAI,MAAM,OAAQ,SAAQ,SAAS,MAAM;AACzC,aAAW,OAAO,CAAC,iBAAiB,gBAAgB,GAAY;AAC9D,UAAM,OAAO,MAAM,GAAG;AACtB,QAAI,QAAQ,KAAM;AAClB,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO;AACvD,YAAM,IAAI;AAAA,QACR,0BAA0B,GAAG;AAAA,MAAA;AAAA,IAEjC;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB;AACA,SAAO,QAAQ,OAAO,IAAI,UAAU;AACtC;AAEA,SAAS,gBACP,OAC0C;AAC1C,MAAI,CAAC,MAAO,QAAO;AACnB,kBAAgB,OAAO,CAAC,SAAS,aAAa,GAAG,kBAAkB;AACnE,QAAM,WAAyC,CAAA;AAC/C,QAAM,QAAQ,UAAU,MAAM,KAAK;AACnC,MAAI,gBAAgB,QAAQ;AAC5B,MAAI,MAAM,eAAe,MAAM;AAC7B,QAAI,CAAC,OAAO,UAAU,MAAM,WAAW,KAAK,MAAM,cAAc,GAAG;AACjE,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AACA,QAAI,MAAM,cAAc,EAAG,UAAS,cAAc,MAAM;AAAA,EAC1D;AACA,SAAO,QAAQ,QAAQ,IAAI,WAAW;AACxC;AAEA,SAAS,uBACP,OACA,UACA,aACA,MACA,iBAAoC,IACrB;AACf,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA,CAAC,GAAG,UAAU,GAAG,aAAa,GAAG,cAAc;AAAA,IAC/C;AAAA,EAAA;AAEF,QAAM,MAA+B,CAAA;AACrC,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAO;AAAA,MACV,MAAkC,GAAG;AAAA,IAAA;AAExC,QAAI,KAAM,KAAI,GAAG,IAAI;AAAA,EACvB;AACA,aAAW,OAAO,aAAa;AAC7B,UAAM,OAAQ,MAAkC,GAAG;AACnD,QAAI,QAAQ,KAAM,KAAI,GAAG,IAAI;AAAA,EAC/B;AACA,SAAO,QAAQ,GAAG,IAAK,MAAY;AACrC;AAEA,SAAS,oBACP,MACA,QACA;;AACA,QAAM,SAAQ,YAAO,QAAQ,MAAM,EAAE;AAAA,IACnC,CAAC,CAAA,EAAG,KAAK,MAAM,UAAU;AAAA,EAAA,MADb,mBAEV;AACJ,MAAI,aAAa,IAAI,MAAM,gBAAgB,IAAI,oBAAoB,KAAK,EAAE;AAC5E;AAEA,SAAS,YAAY,OAAgC;AACnD,QAAM,OAAO,mBAAmB,KAAK,CAAC,SAAS,SAAS,KAAK;AAC7D,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,gBAAgB,KAAK,UAAU,KAAK,CAAC,aAAa;AACpE,SAAO;AACT;AAEA,SAAS,eACP,OACgC;AAChC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,sBAAsB,KAAK,CAAC,SAAS,SAAS,KAAK;AAChE,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,oBAAoB,KAAK,UAAU,KAAK,CAAC,aAAa;AACxE,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe,MAAyB,MAAc;AAC7E,QAAM,UAAU,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC;AACpE,MAAI,eAAe,IAAI,MAAM,GAAG,IAAI,IAAI,OAAO,mBAAmB;AACpE;AAEA,SAAS,UAAU,OAA6B;AAC9C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM;AAAA,IAClB,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAA,CAAM,EAAE,OAAO,OAAO,CAAC;AAAA,EAAA;AAE1D,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,SAAS,YAAY,OAA2B;AAC9C,UAAO,+BAAO,WAAU;AAC1B;AAEA,SAAS,QAAQ,OAAe;AAC9B,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS;AACrC;;;;"}

package/dist/data/ai/SpecRuntimeEditor.sandbox-model.d.ts

@@ -0,0 +1,58 @@
+export declare const SPEC_PERMISSION_MODES: readonly ["default", "acceptEdits", "auto", "bypassPermissions", "dontAsk", "plan"];
+export type SpecPermissionMode = (typeof SPEC_PERMISSION_MODES)[number];
+export declare const SPEC_SANDBOX_MODES: readonly ["off", "native", "docker", "git-agent"];
+export type SpecSandboxMode = (typeof SPEC_SANDBOX_MODES)[number];
+export type SpecSandboxFilesystemAccess = "read-only" | "workspace-write";
+export type SpecSandboxNetworkAccess = "disabled" | "restricted" | "unrestricted";
+export type AISpecRuntimeSandboxFilesystemPolicy = {
+    access?: SpecSandboxFilesystemAccess;
+    writableRoots?: string[];
+    readableRoots?: string[];
+    deniedReadRoots?: string[];
+    deniedWriteRoots?: string[];
+    includeSystemTemp?: boolean;
+};
+export type AISpecRuntimeSandboxNetworkPolicy = {
+    access?: SpecSandboxNetworkAccess;
+    allowedDomains?: string[];
+    deniedDomains?: string[];
+    allowedUnixSockets?: string[];
+    allowAllUnixSockets?: boolean;
+    allowLocalBinding?: boolean;
+    allowedMachServices?: string[];
+    httpProxyPort?: number;
+    socksProxyPort?: number;
+};
+export type AISpecRuntimeSandboxPolicy = {
+    required?: boolean;
+    filesystem?: AISpecRuntimeSandboxFilesystemPolicy;
+    network?: AISpecRuntimeSandboxNetworkPolicy;
+    commands?: {
+        excludedFromSandbox?: string[];
+        allowUnsandboxed?: boolean;
+    };
+    credentials?: {
+        deniedFiles?: string[];
+        deniedEnv?: string[];
+        maskedEnv?: string[];
+    };
+    platform?: {
+        allowAppleEvents?: boolean;
+        weakerNestedIsolation?: boolean;
+        weakerNetworkIsolation?: boolean;
+    };
+};
+export type AISpecRuntimeSandboxDispatch = {
+    paths?: string[];
+    maxAttempts?: number;
+};
+export type AISpecRuntimeSandbox = {
+    mode?: SpecSandboxMode;
+    approval?: SpecPermissionMode;
+    backend?: string;
+    agent?: string;
+    policy?: AISpecRuntimeSandboxPolicy;
+    dispatch?: AISpecRuntimeSandboxDispatch;
+};
+export declare function compactRuntimeSandbox(value: string | AISpecRuntimeSandbox | undefined): string | AISpecRuntimeSandbox | undefined;
+//# sourceMappingURL=SpecRuntimeEditor.sandbox-model.d.ts.map

package/dist/data/ai/SpecRuntimeEditor.sandbox-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpecRuntimeEditor.sandbox-model.d.ts","sourceRoot":"","sources":["../../../src/data/ai/SpecRuntimeEditor.sandbox-model.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,qFAOxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,kBAAkB,mDAKrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,MAAM,2BAA2B,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAC1E,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,MAAM,oCAAoC,GAAG;IACjD,MAAM,CAAC,EAAE,2BAA2B,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,oCAAoC,CAAC;IAClD,OAAO,CAAC,EAAE,iCAAiC,CAAC;IAC5C,QAAQ,CAAC,EAAE;QACT,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,sBAAsB,CAAC,EAAE,OAAO,CAAC;KAClC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,0BAA0B,CAAC;IACpC,QAAQ,CAAC,EAAE,4BAA4B,CAAC;CACzC,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,GAC/C,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAwD3C"}

package/dist/data/ai/SpecRuntimeEditor.sandbox-model.js

@@ -0,0 +1,276 @@
+const SPEC_PERMISSION_MODES = [
+  "default",
+  "acceptEdits",
+  "auto",
+  "bypassPermissions",
+  "dontAsk",
+  "plan"
+];
+const SPEC_SANDBOX_MODES = [
+  "off",
+  "native",
+  "docker",
+  "git-agent"
+];
+function compactRuntimeSandbox(value) {
+  if (value == null) return void 0;
+  if (typeof value === "string") {
+    const raw = value.trim();
+    return raw ? sandboxMode(raw) : void 0;
+  }
+  assertKnownKeys(
+    value,
+    ["mode", "approval", "backend", "agent", "policy", "dispatch"],
+    "sandbox"
+  );
+  const configured = Object.values(value).some(
+    (item) => item != null && item !== ""
+  );
+  if (!value.mode) {
+    if (configured)
+      throw new Error(
+        "sandbox.mode is required when sandbox settings are configured"
+      );
+    return void 0;
+  }
+  const mode = sandboxMode(value.mode);
+  const approval = permissionMode(value.approval);
+  const backend = cleanString(value.backend);
+  const agent = cleanString(value.agent);
+  const policy = compactNativePolicy(value.policy);
+  const dispatch = compactDispatch(value.dispatch);
+  if (mode === "off") {
+    rejectSandboxFields(mode, { approval, backend, agent, policy, dispatch });
+    return mode;
+  }
+  if (mode === "native") {
+    rejectSandboxFields(mode, { backend, agent, dispatch });
+    return compactSandboxObject({
+      mode,
+      ...approval ? { approval } : {},
+      ...policy ? { policy } : {}
+    });
+  }
+  if (mode === "docker") {
+    rejectSandboxFields(mode, { agent, policy, dispatch });
+    return compactSandboxObject({
+      mode,
+      ...approval ? { approval } : {},
+      ...backend ? { backend } : {}
+    });
+  }
+  rejectSandboxFields(mode, { policy });
+  return compactSandboxObject({
+    mode,
+    ...approval ? { approval } : {},
+    ...backend ? { backend } : {},
+    ...agent ? { agent } : {},
+    ...dispatch ? { dispatch } : {}
+  });
+}
+function compactSandboxObject(value) {
+  const entries = Object.entries(value).filter(
+    ([, item]) => item !== void 0
+  );
+  if (entries.length === 1) return value.mode;
+  return Object.fromEntries(entries);
+}
+function compactNativePolicy(value) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [
+      "required",
+      "filesystem",
+      "network",
+      "commands",
+      "credentials",
+      "platform"
+    ],
+    "sandbox.policy"
+  );
+  const policy = {};
+  if (value.required != null) policy.required = value.required;
+  const filesystem = compactFilesystem(value.filesystem);
+  if (filesystem) policy.filesystem = filesystem;
+  const network = compactNetwork(value.network);
+  if (network) policy.network = network;
+  const commands = compactBooleanAndLists(
+    value.commands,
+    ["excludedFromSandbox"],
+    ["allowUnsandboxed"],
+    "sandbox.policy.commands"
+  );
+  if (commands) policy.commands = commands;
+  const credentials = compactBooleanAndLists(
+    value.credentials,
+    ["deniedFiles", "deniedEnv", "maskedEnv"],
+    [],
+    "sandbox.policy.credentials"
+  );
+  if (credentials) policy.credentials = credentials;
+  const platform = compactBooleanAndLists(
+    value.platform,
+    [],
+    ["allowAppleEvents", "weakerNestedIsolation", "weakerNetworkIsolation"],
+    "sandbox.policy.platform"
+  );
+  if (platform) policy.platform = platform;
+  return hasKeys(policy) ? policy : void 0;
+}
+function compactFilesystem(value) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [
+      "access",
+      "writableRoots",
+      "readableRoots",
+      "deniedReadRoots",
+      "deniedWriteRoots",
+      "includeSystemTemp"
+    ],
+    "sandbox.policy.filesystem"
+  );
+  const filesystem = compactBooleanAndLists(
+    value,
+    ["writableRoots", "readableRoots", "deniedReadRoots", "deniedWriteRoots"],
+    ["includeSystemTemp"],
+    "sandbox.policy.filesystem",
+    ["access"]
+  );
+  const access = value.access;
+  if (access && access !== "read-only" && access !== "workspace-write") {
+    throw new Error(
+      `sandbox.policy.filesystem.access ${JSON.stringify(access)} is invalid`
+    );
+  }
+  if (access) return { ...filesystem, access };
+  return filesystem;
+}
+function compactNetwork(value) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [
+      "access",
+      "allowedDomains",
+      "deniedDomains",
+      "allowedUnixSockets",
+      "allowAllUnixSockets",
+      "allowLocalBinding",
+      "allowedMachServices",
+      "httpProxyPort",
+      "socksProxyPort"
+    ],
+    "sandbox.policy.network"
+  );
+  const network = compactBooleanAndLists(
+    value,
+    [
+      "allowedDomains",
+      "deniedDomains",
+      "allowedUnixSockets",
+      "allowedMachServices"
+    ],
+    ["allowAllUnixSockets", "allowLocalBinding"],
+    "sandbox.policy.network",
+    ["access", "httpProxyPort", "socksProxyPort"]
+  ) ?? {};
+  if (value.access && !["disabled", "restricted", "unrestricted"].includes(value.access)) {
+    throw new Error(
+      `sandbox.policy.network.access ${JSON.stringify(value.access)} is invalid`
+    );
+  }
+  if (value.access) network.access = value.access;
+  for (const key of ["httpProxyPort", "socksProxyPort"]) {
+    const port = value[key];
+    if (port == null) continue;
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      throw new Error(
+        `sandbox.policy.network.${key} must be between 1 and 65535`
+      );
+    }
+    network[key] = port;
+  }
+  return hasKeys(network) ? network : void 0;
+}
+function compactDispatch(value) {
+  if (!value) return void 0;
+  assertKnownKeys(value, ["paths", "maxAttempts"], "sandbox.dispatch");
+  const dispatch = {};
+  const paths = cleanList(value.paths);
+  if (paths) dispatch.paths = paths;
+  if (value.maxAttempts != null) {
+    if (!Number.isInteger(value.maxAttempts) || value.maxAttempts < 0) {
+      throw new Error(
+        "sandbox.dispatch.maxAttempts must be a non-negative integer"
+      );
+    }
+    if (value.maxAttempts > 0) dispatch.maxAttempts = value.maxAttempts;
+  }
+  return hasKeys(dispatch) ? dispatch : void 0;
+}
+function compactBooleanAndLists(value, listKeys, booleanKeys, path, additionalKeys = []) {
+  if (!value) return void 0;
+  assertKnownKeys(
+    value,
+    [...listKeys, ...booleanKeys, ...additionalKeys],
+    path
+  );
+  const out = {};
+  for (const key of listKeys) {
+    const list = cleanList(
+      value[key]
+    );
+    if (list) out[key] = list;
+  }
+  for (const key of booleanKeys) {
+    const item = value[key];
+    if (item != null) out[key] = item;
+  }
+  return hasKeys(out) ? out : void 0;
+}
+function rejectSandboxFields(mode, values) {
+  var _a;
+  const field = (_a = Object.entries(values).find(
+    ([, value]) => value !== void 0
+  )) == null ? void 0 : _a[0];
+  if (field) throw new Error(`sandbox mode ${mode} does not accept ${field}`);
+}
+function sandboxMode(value) {
+  const mode = SPEC_SANDBOX_MODES.find((item) => item === value);
+  if (!mode)
+    throw new Error(`sandbox.mode ${JSON.stringify(value)} is invalid`);
+  return mode;
+}
+function permissionMode(value) {
+  if (!value) return void 0;
+  const mode = SPEC_PERMISSION_MODES.find((item) => item === value);
+  if (!mode)
+    throw new Error(`sandbox.approval ${JSON.stringify(value)} is invalid`);
+  return mode;
+}
+function assertKnownKeys(value, keys, path) {
+  const unknown = Object.keys(value).find((key) => !keys.includes(key));
+  if (unknown) throw new Error(`${path}.${unknown} is not supported`);
+}
+function cleanList(value) {
+  if (!value) return void 0;
+  const items = Array.from(
+    new Set(value.map((item) => item.trim()).filter(Boolean))
+  );
+  return items.length > 0 ? items : void 0;
+}
+function cleanString(value) {
+  return (value == null ? void 0 : value.trim()) || void 0;
+}
+function hasKeys(value) {
+  return Object.keys(value).length > 0;
+}
+export {
+  SPEC_PERMISSION_MODES,
+  SPEC_SANDBOX_MODES,
+  compactRuntimeSandbox
+};
+//# sourceMappingURL=SpecRuntimeEditor.sandbox-model.js.map

package/dist/data/ai/SpecRuntimeEditor.sandbox-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpecRuntimeEditor.sandbox-model.js","sources":["../../../src/data/ai/SpecRuntimeEditor.sandbox-model.ts"],"sourcesContent":["export const SPEC_PERMISSION_MODES = [\n  \"default\",\n  \"acceptEdits\",\n  \"auto\",\n  \"bypassPermissions\",\n  \"dontAsk\",\n  \"plan\",\n] as const;\n\nexport type SpecPermissionMode = (typeof SPEC_PERMISSION_MODES)[number];\n\nexport const SPEC_SANDBOX_MODES = [\n  \"off\",\n  \"native\",\n  \"docker\",\n  \"git-agent\",\n] as const;\n\nexport type SpecSandboxMode = (typeof SPEC_SANDBOX_MODES)[number];\nexport type SpecSandboxFilesystemAccess = \"read-only\" | \"workspace-write\";\nexport type SpecSandboxNetworkAccess =\n  | \"disabled\"\n  | \"restricted\"\n  | \"unrestricted\";\n\nexport type AISpecRuntimeSandboxFilesystemPolicy = {\n  access?: SpecSandboxFilesystemAccess;\n  writableRoots?: string[];\n  readableRoots?: string[];\n  deniedReadRoots?: string[];\n  deniedWriteRoots?: string[];\n  includeSystemTemp?: boolean;\n};\n\nexport type AISpecRuntimeSandboxNetworkPolicy = {\n  access?: SpecSandboxNetworkAccess;\n  allowedDomains?: string[];\n  deniedDomains?: string[];\n  allowedUnixSockets?: string[];\n  allowAllUnixSockets?: boolean;\n  allowLocalBinding?: boolean;\n  allowedMachServices?: string[];\n  httpProxyPort?: number;\n  socksProxyPort?: number;\n};\n\nexport type AISpecRuntimeSandboxPolicy = {\n  required?: boolean;\n  filesystem?: AISpecRuntimeSandboxFilesystemPolicy;\n  network?: AISpecRuntimeSandboxNetworkPolicy;\n  commands?: {\n    excludedFromSandbox?: string[];\n    allowUnsandboxed?: boolean;\n  };\n  credentials?: {\n    deniedFiles?: string[];\n    deniedEnv?: string[];\n    maskedEnv?: string[];\n  };\n  platform?: {\n    allowAppleEvents?: boolean;\n    weakerNestedIsolation?: boolean;\n    weakerNetworkIsolation?: boolean;\n  };\n};\n\nexport type AISpecRuntimeSandboxDispatch = {\n  paths?: string[];\n  maxAttempts?: number;\n};\n\nexport type AISpecRuntimeSandbox = {\n  mode?: SpecSandboxMode;\n  approval?: SpecPermissionMode;\n  backend?: string;\n  agent?: string;\n  policy?: AISpecRuntimeSandboxPolicy;\n  dispatch?: AISpecRuntimeSandboxDispatch;\n};\n\nexport function compactRuntimeSandbox(\n  value: string | AISpecRuntimeSandbox | undefined,\n): string | AISpecRuntimeSandbox | undefined {\n  if (value == null) return undefined;\n  if (typeof value === \"string\") {\n    const raw = value.trim();\n    return raw ? sandboxMode(raw) : undefined;\n  }\n  assertKnownKeys(\n    value,\n    [\"mode\", \"approval\", \"backend\", \"agent\", \"policy\", \"dispatch\"],\n    \"sandbox\",\n  );\n  const configured = Object.values(value).some(\n    (item) => item != null && item !== \"\",\n  );\n  if (!value.mode) {\n    if (configured)\n      throw new Error(\n        \"sandbox.mode is required when sandbox settings are configured\",\n      );\n    return undefined;\n  }\n  const mode = sandboxMode(value.mode);\n  const approval = permissionMode(value.approval);\n  const backend = cleanString(value.backend);\n  const agent = cleanString(value.agent);\n  const policy = compactNativePolicy(value.policy);\n  const dispatch = compactDispatch(value.dispatch);\n\n  if (mode === \"off\") {\n    rejectSandboxFields(mode, { approval, backend, agent, policy, dispatch });\n    return mode;\n  }\n  if (mode === \"native\") {\n    rejectSandboxFields(mode, { backend, agent, dispatch });\n    return compactSandboxObject({\n      mode,\n      ...(approval ? { approval } : {}),\n      ...(policy ? { policy } : {}),\n    });\n  }\n  if (mode === \"docker\") {\n    rejectSandboxFields(mode, { agent, policy, dispatch });\n    return compactSandboxObject({\n      mode,\n      ...(approval ? { approval } : {}),\n      ...(backend ? { backend } : {}),\n    });\n  }\n  rejectSandboxFields(mode, { policy });\n  return compactSandboxObject({\n    mode,\n    ...(approval ? { approval } : {}),\n    ...(backend ? { backend } : {}),\n    ...(agent ? { agent } : {}),\n    ...(dispatch ? { dispatch } : {}),\n  });\n}\n\nfunction compactSandboxObject(\n  value: AISpecRuntimeSandbox,\n): string | AISpecRuntimeSandbox {\n  const entries = Object.entries(value).filter(\n    ([, item]) => item !== undefined,\n  );\n  if (entries.length === 1) return value.mode!;\n  return Object.fromEntries(entries) as AISpecRuntimeSandbox;\n}\n\nfunction compactNativePolicy(\n  value: AISpecRuntimeSandboxPolicy | undefined,\n): AISpecRuntimeSandboxPolicy | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [\n      \"required\",\n      \"filesystem\",\n      \"network\",\n      \"commands\",\n      \"credentials\",\n      \"platform\",\n    ],\n    \"sandbox.policy\",\n  );\n  const policy: AISpecRuntimeSandboxPolicy = {};\n  if (value.required != null) policy.required = value.required;\n  const filesystem = compactFilesystem(value.filesystem);\n  if (filesystem) policy.filesystem = filesystem;\n  const network = compactNetwork(value.network);\n  if (network) policy.network = network;\n  const commands = compactBooleanAndLists(\n    value.commands,\n    [\"excludedFromSandbox\"],\n    [\"allowUnsandboxed\"],\n    \"sandbox.policy.commands\",\n  );\n  if (commands) policy.commands = commands;\n  const credentials = compactBooleanAndLists(\n    value.credentials,\n    [\"deniedFiles\", \"deniedEnv\", \"maskedEnv\"],\n    [],\n    \"sandbox.policy.credentials\",\n  );\n  if (credentials) policy.credentials = credentials;\n  const platform = compactBooleanAndLists(\n    value.platform,\n    [],\n    [\"allowAppleEvents\", \"weakerNestedIsolation\", \"weakerNetworkIsolation\"],\n    \"sandbox.policy.platform\",\n  );\n  if (platform) policy.platform = platform;\n  return hasKeys(policy) ? policy : undefined;\n}\n\nfunction compactFilesystem(\n  value: AISpecRuntimeSandboxFilesystemPolicy | undefined,\n): AISpecRuntimeSandboxFilesystemPolicy | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [\n      \"access\",\n      \"writableRoots\",\n      \"readableRoots\",\n      \"deniedReadRoots\",\n      \"deniedWriteRoots\",\n      \"includeSystemTemp\",\n    ],\n    \"sandbox.policy.filesystem\",\n  );\n  const filesystem = compactBooleanAndLists(\n    value,\n    [\"writableRoots\", \"readableRoots\", \"deniedReadRoots\", \"deniedWriteRoots\"],\n    [\"includeSystemTemp\"],\n    \"sandbox.policy.filesystem\",\n    [\"access\"],\n  ) as AISpecRuntimeSandboxFilesystemPolicy | undefined;\n  const access = value.access;\n  if (access && access !== \"read-only\" && access !== \"workspace-write\") {\n    throw new Error(\n      `sandbox.policy.filesystem.access ${JSON.stringify(access)} is invalid`,\n    );\n  }\n  if (access) return { ...filesystem, access };\n  return filesystem;\n}\n\nfunction compactNetwork(\n  value: AISpecRuntimeSandboxNetworkPolicy | undefined,\n): AISpecRuntimeSandboxNetworkPolicy | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [\n      \"access\",\n      \"allowedDomains\",\n      \"deniedDomains\",\n      \"allowedUnixSockets\",\n      \"allowAllUnixSockets\",\n      \"allowLocalBinding\",\n      \"allowedMachServices\",\n      \"httpProxyPort\",\n      \"socksProxyPort\",\n    ],\n    \"sandbox.policy.network\",\n  );\n  const network = (compactBooleanAndLists(\n    value,\n    [\n      \"allowedDomains\",\n      \"deniedDomains\",\n      \"allowedUnixSockets\",\n      \"allowedMachServices\",\n    ],\n    [\"allowAllUnixSockets\", \"allowLocalBinding\"],\n    \"sandbox.policy.network\",\n    [\"access\", \"httpProxyPort\", \"socksProxyPort\"],\n  ) ?? {}) as AISpecRuntimeSandboxNetworkPolicy;\n  if (\n    value.access &&\n    ![\"disabled\", \"restricted\", \"unrestricted\"].includes(value.access)\n  ) {\n    throw new Error(\n      `sandbox.policy.network.access ${JSON.stringify(value.access)} is invalid`,\n    );\n  }\n  if (value.access) network.access = value.access;\n  for (const key of [\"httpProxyPort\", \"socksProxyPort\"] as const) {\n    const port = value[key];\n    if (port == null) continue;\n    if (!Number.isInteger(port) || port < 1 || port > 65535) {\n      throw new Error(\n        `sandbox.policy.network.${key} must be between 1 and 65535`,\n      );\n    }\n    network[key] = port;\n  }\n  return hasKeys(network) ? network : undefined;\n}\n\nfunction compactDispatch(\n  value: AISpecRuntimeSandboxDispatch | undefined,\n): AISpecRuntimeSandboxDispatch | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(value, [\"paths\", \"maxAttempts\"], \"sandbox.dispatch\");\n  const dispatch: AISpecRuntimeSandboxDispatch = {};\n  const paths = cleanList(value.paths);\n  if (paths) dispatch.paths = paths;\n  if (value.maxAttempts != null) {\n    if (!Number.isInteger(value.maxAttempts) || value.maxAttempts < 0) {\n      throw new Error(\n        \"sandbox.dispatch.maxAttempts must be a non-negative integer\",\n      );\n    }\n    if (value.maxAttempts > 0) dispatch.maxAttempts = value.maxAttempts;\n  }\n  return hasKeys(dispatch) ? dispatch : undefined;\n}\n\nfunction compactBooleanAndLists<T extends object>(\n  value: T | undefined,\n  listKeys: readonly string[],\n  booleanKeys: readonly string[],\n  path: string,\n  additionalKeys: readonly string[] = [],\n): T | undefined {\n  if (!value) return undefined;\n  assertKnownKeys(\n    value,\n    [...listKeys, ...booleanKeys, ...additionalKeys],\n    path,\n  );\n  const out: Record<string, unknown> = {};\n  for (const key of listKeys) {\n    const list = cleanList(\n      (value as Record<string, unknown>)[key] as string[] | undefined,\n    );\n    if (list) out[key] = list;\n  }\n  for (const key of booleanKeys) {\n    const item = (value as Record<string, unknown>)[key];\n    if (item != null) out[key] = item;\n  }\n  return hasKeys(out) ? (out as T) : undefined;\n}\n\nfunction rejectSandboxFields(\n  mode: SpecSandboxMode,\n  values: Record<string, unknown>,\n) {\n  const field = Object.entries(values).find(\n    ([, value]) => value !== undefined,\n  )?.[0];\n  if (field) throw new Error(`sandbox mode ${mode} does not accept ${field}`);\n}\n\nfunction sandboxMode(value: string): SpecSandboxMode {\n  const mode = SPEC_SANDBOX_MODES.find((item) => item === value);\n  if (!mode)\n    throw new Error(`sandbox.mode ${JSON.stringify(value)} is invalid`);\n  return mode;\n}\n\nfunction permissionMode(\n  value: string | undefined,\n): SpecPermissionMode | undefined {\n  if (!value) return undefined;\n  const mode = SPEC_PERMISSION_MODES.find((item) => item === value);\n  if (!mode)\n    throw new Error(`sandbox.approval ${JSON.stringify(value)} is invalid`);\n  return mode;\n}\n\nfunction assertKnownKeys(value: object, keys: readonly string[], path: string) {\n  const unknown = Object.keys(value).find((key) => !keys.includes(key));\n  if (unknown) throw new Error(`${path}.${unknown} is not supported`);\n}\n\nfunction cleanList(value: string[] | undefined) {\n  if (!value) return undefined;\n  const items = Array.from(\n    new Set(value.map((item) => item.trim()).filter(Boolean)),\n  );\n  return items.length > 0 ? items : undefined;\n}\n\nfunction cleanString(value: string | undefined) {\n  return value?.trim() || undefined;\n}\n\nfunction hasKeys(value: object) {\n  return Object.keys(value).length > 0;\n}\n"],"names":[],"mappings":"AAAO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgEO,SAAS,sBACd,OAC2C;AAC3C,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM,MAAM,KAAA;AAClB,WAAO,MAAM,YAAY,GAAG,IAAI;AAAA,EAClC;AACA;AAAA,IACE;AAAA,IACA,CAAC,QAAQ,YAAY,WAAW,SAAS,UAAU,UAAU;AAAA,IAC7D;AAAA,EAAA;AAEF,QAAM,aAAa,OAAO,OAAO,KAAK,EAAE;AAAA,IACtC,CAAC,SAAS,QAAQ,QAAQ,SAAS;AAAA,EAAA;AAErC,MAAI,CAAC,MAAM,MAAM;AACf,QAAI;AACF,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAEJ,WAAO;AAAA,EACT;AACA,QAAM,OAAO,YAAY,MAAM,IAAI;AACnC,QAAM,WAAW,eAAe,MAAM,QAAQ;AAC9C,QAAM,UAAU,YAAY,MAAM,OAAO;AACzC,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,SAAS,oBAAoB,MAAM,MAAM;AAC/C,QAAM,WAAW,gBAAgB,MAAM,QAAQ;AAE/C,MAAI,SAAS,OAAO;AAClB,wBAAoB,MAAM,EAAE,UAAU,SAAS,OAAO,QAAQ,UAAU;AACxE,WAAO;AAAA,EACT;AACA,MAAI,SAAS,UAAU;AACrB,wBAAoB,MAAM,EAAE,SAAS,OAAO,UAAU;AACtD,WAAO,qBAAqB;AAAA,MAC1B;AAAA,MACA,GAAI,WAAW,EAAE,SAAA,IAAa,CAAA;AAAA,MAC9B,GAAI,SAAS,EAAE,WAAW,CAAA;AAAA,IAAC,CAC5B;AAAA,EACH;AACA,MAAI,SAAS,UAAU;AACrB,wBAAoB,MAAM,EAAE,OAAO,QAAQ,UAAU;AACrD,WAAO,qBAAqB;AAAA,MAC1B;AAAA,MACA,GAAI,WAAW,EAAE,SAAA,IAAa,CAAA;AAAA,MAC9B,GAAI,UAAU,EAAE,YAAY,CAAA;AAAA,IAAC,CAC9B;AAAA,EACH;AACA,sBAAoB,MAAM,EAAE,QAAQ;AACpC,SAAO,qBAAqB;AAAA,IAC1B;AAAA,IACA,GAAI,WAAW,EAAE,SAAA,IAAa,CAAA;AAAA,IAC9B,GAAI,UAAU,EAAE,QAAA,IAAY,CAAA;AAAA,IAC5B,GAAI,QAAQ,EAAE,MAAA,IAAU,CAAA;AAAA,IACxB,GAAI,WAAW,EAAE,aAAa,CAAA;AAAA,EAAC,CAChC;AACH;AAEA,SAAS,qBACP,OAC+B;AAC/B,QAAM,UAAU,OAAO,QAAQ,KAAK,EAAE;AAAA,IACpC,CAAC,CAAA,EAAG,IAAI,MAAM,SAAS;AAAA,EAAA;AAEzB,MAAI,QAAQ,WAAW,EAAG,QAAO,MAAM;AACvC,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,oBACP,OACwC;AACxC,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF;AAAA,EAAA;AAEF,QAAM,SAAqC,CAAA;AAC3C,MAAI,MAAM,YAAY,KAAM,QAAO,WAAW,MAAM;AACpD,QAAM,aAAa,kBAAkB,MAAM,UAAU;AACrD,MAAI,mBAAmB,aAAa;AACpC,QAAM,UAAU,eAAe,MAAM,OAAO;AAC5C,MAAI,gBAAgB,UAAU;AAC9B,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN,CAAC,qBAAqB;AAAA,IACtB,CAAC,kBAAkB;AAAA,IACnB;AAAA,EAAA;AAEF,MAAI,iBAAiB,WAAW;AAChC,QAAM,cAAc;AAAA,IAClB,MAAM;AAAA,IACN,CAAC,eAAe,aAAa,WAAW;AAAA,IACxC,CAAA;AAAA,IACA;AAAA,EAAA;AAEF,MAAI,oBAAoB,cAAc;AACtC,QAAM,WAAW;AAAA,IACf,MAAM;AAAA,IACN,CAAA;AAAA,IACA,CAAC,oBAAoB,yBAAyB,wBAAwB;AAAA,IACtE;AAAA,EAAA;AAEF,MAAI,iBAAiB,WAAW;AAChC,SAAO,QAAQ,MAAM,IAAI,SAAS;AACpC;AAEA,SAAS,kBACP,OACkD;AAClD,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF;AAAA,EAAA;AAEF,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,CAAC,iBAAiB,iBAAiB,mBAAmB,kBAAkB;AAAA,IACxE,CAAC,mBAAmB;AAAA,IACpB;AAAA,IACA,CAAC,QAAQ;AAAA,EAAA;AAEX,QAAM,SAAS,MAAM;AACrB,MAAI,UAAU,WAAW,eAAe,WAAW,mBAAmB;AACpE,UAAM,IAAI;AAAA,MACR,oCAAoC,KAAK,UAAU,MAAM,CAAC;AAAA,IAAA;AAAA,EAE9D;AACA,MAAI,OAAQ,QAAO,EAAE,GAAG,YAAY,OAAA;AACpC,SAAO;AACT;AAEA,SAAS,eACP,OAC+C;AAC/C,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF;AAAA,EAAA;AAEF,QAAM,UAAW;AAAA,IACf;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,IAEF,CAAC,uBAAuB,mBAAmB;AAAA,IAC3C;AAAA,IACA,CAAC,UAAU,iBAAiB,gBAAgB;AAAA,EAAA,KACzC,CAAA;AACL,MACE,MAAM,UACN,CAAC,CAAC,YAAY,cAAc,cAAc,EAAE,SAAS,MAAM,MAAM,GACjE;AACA,UAAM,IAAI;AAAA,MACR,iCAAiC,KAAK,UAAU,MAAM,MAAM,CAAC;AAAA,IAAA;AAAA,EAEjE;AACA,MAAI,MAAM,OAAQ,SAAQ,SAAS,MAAM;AACzC,aAAW,OAAO,CAAC,iBAAiB,gBAAgB,GAAY;AAC9D,UAAM,OAAO,MAAM,GAAG;AACtB,QAAI,QAAQ,KAAM;AAClB,QAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,OAAO;AACvD,YAAM,IAAI;AAAA,QACR,0BAA0B,GAAG;AAAA,MAAA;AAAA,IAEjC;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB;AACA,SAAO,QAAQ,OAAO,IAAI,UAAU;AACtC;AAEA,SAAS,gBACP,OAC0C;AAC1C,MAAI,CAAC,MAAO,QAAO;AACnB,kBAAgB,OAAO,CAAC,SAAS,aAAa,GAAG,kBAAkB;AACnE,QAAM,WAAyC,CAAA;AAC/C,QAAM,QAAQ,UAAU,MAAM,KAAK;AACnC,MAAI,gBAAgB,QAAQ;AAC5B,MAAI,MAAM,eAAe,MAAM;AAC7B,QAAI,CAAC,OAAO,UAAU,MAAM,WAAW,KAAK,MAAM,cAAc,GAAG;AACjE,YAAM,IAAI;AAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AACA,QAAI,MAAM,cAAc,EAAG,UAAS,cAAc,MAAM;AAAA,EAC1D;AACA,SAAO,QAAQ,QAAQ,IAAI,WAAW;AACxC;AAEA,SAAS,uBACP,OACA,UACA,aACA,MACA,iBAAoC,IACrB;AACf,MAAI,CAAC,MAAO,QAAO;AACnB;AAAA,IACE;AAAA,IACA,CAAC,GAAG,UAAU,GAAG,aAAa,GAAG,cAAc;AAAA,IAC/C;AAAA,EAAA;AAEF,QAAM,MAA+B,CAAA;AACrC,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAO;AAAA,MACV,MAAkC,GAAG;AAAA,IAAA;AAExC,QAAI,KAAM,KAAI,GAAG,IAAI;AAAA,EACvB;AACA,aAAW,OAAO,aAAa;AAC7B,UAAM,OAAQ,MAAkC,GAAG;AACnD,QAAI,QAAQ,KAAM,KAAI,GAAG,IAAI;AAAA,EAC/B;AACA,SAAO,QAAQ,GAAG,IAAK,MAAY;AACrC;AAEA,SAAS,oBACP,MACA,QACA;AA3UK;AA4UL,QAAM,SAAQ,YAAO,QAAQ,MAAM,EAAE;AAAA,IACnC,CAAC,CAAA,EAAG,KAAK,MAAM,UAAU;AAAA,EAAA,MADb,mBAEV;AACJ,MAAI,aAAa,IAAI,MAAM,gBAAgB,IAAI,oBAAoB,KAAK,EAAE;AAC5E;AAEA,SAAS,YAAY,OAAgC;AACnD,QAAM,OAAO,mBAAmB,KAAK,CAAC,SAAS,SAAS,KAAK;AAC7D,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,gBAAgB,KAAK,UAAU,KAAK,CAAC,aAAa;AACpE,SAAO;AACT;AAEA,SAAS,eACP,OACgC;AAChC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,sBAAsB,KAAK,CAAC,SAAS,SAAS,KAAK;AAChE,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,oBAAoB,KAAK,UAAU,KAAK,CAAC,aAAa;AACxE,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe,MAAyB,MAAc;AAC7E,QAAM,UAAU,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC;AACpE,MAAI,eAAe,IAAI,MAAM,GAAG,IAAI,IAAI,OAAO,mBAAmB;AACpE;AAEA,SAAS,UAAU,OAA6B;AAC9C,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM;AAAA,IAClB,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,KAAA,CAAM,EAAE,OAAO,OAAO,CAAC;AAAA,EAAA;AAE1D,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,SAAS,YAAY,OAA2B;AAC9C,UAAO,+BAAO,WAAU;AAC1B;AAEA,SAAS,QAAQ,OAAe;AAC9B,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS;AACrC;"}

package/dist/data/ai/ThreadPicker.cjs

@@ -23,25 +23,33 @@ function ThreadPicker({
   const [threads, setThreads] = react.useState([]);
   const [loading, setLoading] = react.useState(false);
   const [renaming, setRenaming] = react.useState();
+  const loadRequest = react.useRef(0);
   const canRename = source ? Boolean(source.rename) : Boolean(api);
   const listUrl = query ? `${api}?${query}` : api;
   const fetchThreads = react.useCallback(async () => {
+    const request = ++loadRequest.current;
     setLoading(true);
     try {
+      let loaded;
       if (source) {
-        setThreads(await source.load());
+        loaded = await source.load();
       } else {
         const res = await fetch(listUrl);
-        if (res.ok) setThreads(await res.json());
+        if (!res.ok) throw new Error(`load failed with status ${res.status}`);
+        loaded = await res.json();
       }
+      if (request === loadRequest.current) setThreads(loaded);
     } catch (err) {
       console.warn("clicky-ui: failed to load threads", err);
     } finally {
-      setLoading(false);
+      if (request === loadRequest.current) setLoading(false);
     }
   }, [source, listUrl]);
   react.useEffect(() => {
     void fetchThreads();
+    return () => {
+      loadRequest.current += 1;
+    };
   }, [fetchThreads, refreshToken]);
   const commitRename = react.useCallback(async () => {
     var _a, _b;
@@ -73,9 +81,8 @@ function ThreadPicker({
     }
   }, [api, renaming, source, threads]);
   const handleDelete = react.useCallback(
-    async (id, e) => {
+    async (id) => {
       var _a;
-      e.stopPropagation();
       try {
         if (source) {
           await ((_a = source.remove) == null ? void 0 : _a.call(source, id));
@@ -135,54 +142,60 @@ function ThreadPicker({
         threads.map((t) => /* @__PURE__ */ jsxRuntime.jsxs(
           "div",
           {
-            role: "button",
-            tabIndex: 0,
             className: utils.cn(
-              "group/thread flex w-full cursor-pointer items-center gap-2 px-3 py-1.5 text-left text-xs hover:bg-accent",
+              "group/thread flex w-full items-center gap-1 px-1 py-0.5 text-left text-xs hover:bg-accent",
               t.id === threadId && "font-semibold"
             ),
-            onClick: () => {
-              onSelect(t.id);
-              closeMenu();
-            },
-            onKeyDown: (e) => {
-              if (e.key === "Enter" || e.key === " ") {
-                e.preventDefault();
-                onSelect(t.id);
-                closeMenu();
-              }
-            },
             children: [
-              /* @__PURE__ */ jsxRuntime.jsx(Icon.Icon, { icon: UiComment.UiComment, className: "size-3 shrink-0" }),
-              (renaming == null ? void 0 : renaming.id) === t.id ? /* @__PURE__ */ jsxRuntime.jsx(
-                "input",
-                {
-                  autoFocus: true,
-                  "aria-label": "Conversation title",
-                  className: "flex-1 rounded border border-border bg-background px-1 py-0.5 text-xs",
-                  value: renaming.title,
-                  onClick: (e) => e.stopPropagation(),
-                  onChange: (e) => setRenaming({ id: t.id, title: e.target.value }),
-                  onBlur: () => setRenaming(void 0),
-                  onKeyDown: (e) => {
-                    e.stopPropagation();
-                    if (e.key === "Enter") void commitRename();
-                    if (e.key === "Escape") setRenaming(void 0);
+              (renaming == null ? void 0 : renaming.id) === t.id ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex min-w-0 flex-1 items-center gap-2 px-2 py-1", children: [
+                /* @__PURE__ */ jsxRuntime.jsx(Icon.Icon, { icon: UiComment.UiComment, className: "size-3 shrink-0" }),
+                /* @__PURE__ */ jsxRuntime.jsx(
+                  "input",
+                  {
+                    autoFocus: true,
+                    "aria-label": "Conversation title",
+                    className: "min-w-0 flex-1 rounded border border-border bg-background px-1 py-0.5 text-xs",
+                    value: renaming.title,
+                    onClick: (e) => e.stopPropagation(),
+                    onChange: (e) => setRenaming({ id: t.id, title: e.target.value }),
+                    onBlur: () => setRenaming(void 0),
+                    onKeyDown: (e) => {
+                      e.stopPropagation();
+                      if (e.key === "Enter") void commitRename();
+                      if (e.key === "Escape") setRenaming(void 0);
+                    }
                   }
+                ),
+                t.totalCostUsd != null && t.totalCostUsd > 0 && /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "shrink-0 text-[10px] text-muted-foreground", children: [
+                  "$",
+                  t.totalCostUsd.toFixed(2)
+                ] })
+              ] }) : /* @__PURE__ */ jsxRuntime.jsxs(
+                "button",
+                {
+                  type: "button",
+                  className: "flex min-w-0 flex-1 items-center gap-2 px-2 py-1 text-left",
+                  onClick: () => {
+                    onSelect(t.id);
+                    closeMenu();
+                  },
+                  children: [
+                    /* @__PURE__ */ jsxRuntime.jsx(Icon.Icon, { icon: UiComment.UiComment, className: "size-3 shrink-0" }),
+                    /* @__PURE__ */ jsxRuntime.jsx("span", { className: "min-w-0 flex-1 truncate", children: t.title || "Untitled" }),
+                    t.totalCostUsd != null && t.totalCostUsd > 0 && /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "shrink-0 text-[10px] text-muted-foreground", children: [
+                      "$",
+                      t.totalCostUsd.toFixed(2)
+                    ] })
+                  ]
                 }
-              ) : /* @__PURE__ */ jsxRuntime.jsx("span", { className: "flex-1 truncate", children: t.title || "Untitled" }),
-              t.totalCostUsd != null && t.totalCostUsd > 0 && /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "shrink-0 text-[10px] text-muted-foreground", children: [
-                "$",
-                t.totalCostUsd.toFixed(2)
-              ] }),
+              ),
               canRename && (renaming == null ? void 0 : renaming.id) !== t.id && /* @__PURE__ */ jsxRuntime.jsx(
                 "button",
                 {
                   type: "button",
                   "aria-label": "Rename conversation",
                   className: "shrink-0 rounded p-0.5 text-muted-foreground opacity-0 hover:text-foreground group-hover/thread:opacity-100",
-                  onClick: (e) => {
-                    e.stopPropagation();
+                  onClick: () => {
                     setRenaming({ id: t.id, title: t.title ?? "" });
                   },
                   children: /* @__PURE__ */ jsxRuntime.jsx(Icon.Icon, { icon: UiPencilSimpleLine.UiPencilSimpleLine, className: "size-3" })
@@ -194,7 +207,7 @@ function ThreadPicker({
                   type: "button",
                   "aria-label": "Delete conversation",
                   className: "shrink-0 rounded p-0.5 text-muted-foreground opacity-0 hover:text-destructive group-hover/thread:opacity-100",
-                  onClick: (e) => void handleDelete(t.id, e),
+                  onClick: () => void handleDelete(t.id),
                   children: /* @__PURE__ */ jsxRuntime.jsx(Icon.Icon, { icon: UiTrash.UiTrash, className: "size-3" })
                 }
               )