@intentic/claude-plugin 1.331.0 → 1.333.0

package/dist/notes-evidence.mjs

@@ -8,6 +8,16 @@ import { join as join3 } from "node:path";
 import { readdirSync, readFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 
+// ../../_tools/base/src/errors.ts
+var errnoCode = (error) => {
+  const code = typeof error === `object` && error !== null ? error.code : void 0;
+  return typeof code === `string` ? code : void 0;
+};
+var isMissing = (error) => {
+  const code = errnoCode(error);
+  return code === `ENOENT` || code === `ENOTDIR`;
+};
+
 // ../../_search/iq/src/recall/transcript/lines.ts
 var asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 var asString = (value) => typeof value === "string" ? value : void 0;
@@ -198,10 +208,6 @@ var parse = (raw) => {
     return void 0;
   }
 };
-var isMissing = (error) => {
-  const code = typeof error === "object" && error !== null ? error.code : void 0;
-  return code === "ENOENT" || code === "ENOTDIR";
-};
 var promptOf2 = (line) => {
   const prompt = promptOf(line);
   return prompt?.kind === "typed" || prompt?.kind === "command" ? prompt.text : void 0;
@@ -570,7 +576,42 @@ var SECRET_NAME = String.raw`[A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_-
 var ASSIGN = String.raw`["']?\s*[:=](?![=>])\s*`;
 var QUOTED_VALUE = String.raw`(["'\x60])([^"'\x60\n]{6,})\2`;
 var BARE_VALUE = String.raw`[\w+/=~-]{6,}(?![\w+/=~(-])`;
-var ISSUER_PREFIX = /^(?:sk-|pk-|rk-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[abposr]-|AKIA|ASIA|eyJ|AIza|ya29\.|glpat-|dop_v1_|shpat_|SG\.|npm_)/;
+var CREDENTIAL_ISSUERS = [
+  { prefix: "npm_", body: "[A-Za-z0-9]{30,}" },
+  { prefix: "ghp_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "gho_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghu_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghs_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghr_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "github_pat_", body: "[A-Za-z0-9_]{50,}" },
+  { prefix: "glpat-", body: "[A-Za-z0-9_-]{16,}" },
+  { prefix: "xoxa-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxb-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxo-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxp-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxr-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxs-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "sk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "pk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "rk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "sk_live_", body: "[A-Za-z0-9]{16,}" },
+  { prefix: "rk_live_", body: "[A-Za-z0-9]{16,}" },
+  { prefix: "AKIA", body: String.raw`[0-9A-Z]{16}\b` },
+  { prefix: "ASIA", body: String.raw`[0-9A-Z]{16}\b` },
+  { prefix: "AIza", body: String.raw`[0-9A-Za-z_-]{35}\b` },
+  { prefix: "ya29.", body: "[0-9A-Za-z_-]{20,}" },
+  { prefix: "hf_", body: "[A-Za-z0-9]{30,}" },
+  { prefix: "dop_v1_", body: "[a-f0-9]{60,}" },
+  { prefix: "shpat_", body: "[a-fA-F0-9]{32,}" },
+  // SendGrid: a key id and its secret, dot-separated.
+  { prefix: "SG.", body: String.raw`[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}` },
+  // A JWT: three base64url segments, the first two of which decode from `{"` and so always begin `eyJ` and `ey`.
+  { prefix: "eyJ", body: String.raw`[A-Za-z0-9_-]{9,}\.ey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*` }
+];
+var CREDENTIAL_ISSUER_PREFIXES = CREDENTIAL_ISSUERS.map(({ prefix }) => prefix);
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+var ISSUER_PREFIX = new RegExp(`^(?:${CREDENTIAL_ISSUER_PREFIXES.map(escapeRegExp).join("|")})`);
+var ISSUED_TOKENS = CREDENTIAL_ISSUERS.map(({ prefix, body }) => new RegExp(String.raw`(?<![\w-])${escapeRegExp(prefix)}${body}`, "g"));
 var NUMERIC_VALUE = /^[\d_,.]+$/;
 var STRUCTURAL_VALUE = /[\s/\\${}]/;
 var ENV_NAME_VALUE = /^[A-Z0-9_]+$/;
@@ -583,13 +624,38 @@ var SECRET_PATTERNS = [
     // Quoted and bare arrive in different groups because only the quoted one has a quote to put back.
     (match, assignment, quote, quoted, bare) => looksLikeCredential(quoted ?? bare) ? `${assignment}${quote ?? ""}***${quote ?? ""}` : match
   ],
-  [/\bAKIA[0-9A-Z]{16}\b/g, "***"],
+  ...ISSUED_TOKENS.map((token) => [token, "***"]),
   // Same rule for a bearer value: prose about tokens carries no digit, every real bearer token does.
   [/\b(Bearer\s+)(?=[\w.-]*\d)[\w.-]{8,}/gi, "$1***"],
-  [/\b(https?:\/\/[^:@\s/]+:)[^@\s]+@/gi, "$1***@"]
+  // scheme://user:password@host for any scheme (a postgres DSN as much as an https remote). Any length, unlike the
+  // contract's three-character floor: output reaching a model is not a file someone meant to publish. A `/` ends the
+  // password, so `http://host:3000/@scope/pkg` is a port and a path, and a reference already standing in is kept.
+  [/\b([a-z][a-z0-9+.-]*:\/\/[^:@\s/]+:)(?!\{\{secret:)[^@\s/]+@/gi, "$1***@"]
 ];
-var redactText = (text, values = []) => text.split("\n").map((line) => redactLine(line, values)).join("\n");
-var redactLine = (line, values = []) => {
+var MASKED_NEXT = String.raw`(?!(?:\s|\\[nr])*\*\*\*)`;
+var ARMOR_LINES = String.raw`(?:(?:\s|\\[nr])+(?:[A-Za-z-]+:[^\n\\]*|[A-Za-z0-9+/=]+(?=[ \t]*(?:[\r\n"'\x60<>,;})\]]|\\[nr]|$))))*`;
+var PRIVATE_KEY_BLOCK = new RegExp(
+  String.raw`(-----BEGIN ((?:[A-Z0-9]+ )*)PRIVATE KEY( BLOCK)?-----)${MASKED_NEXT}(?:[\s\S]*?(-----END \2PRIVATE KEY\3-----)|${ARMOR_LINES})`,
+  "g"
+);
+var PUTTY_KEY = new RegExp(String.raw`(PuTTY-User-Key-File-\d:)${MASKED_NEXT}[^\n\\]*${ARMOR_LINES}`, "g");
+var maskKeyBlocks = (text) => (
+  // The cheap test first: almost no output holds a key, and the block patterns scan the whole body.
+  text.includes("PRIVATE KEY") || text.includes("PuTTY-User-Key-File-") ? text.replace(
+    PRIVATE_KEY_BLOCK,
+    (_block, header, _label, _kind, footer) => footer === void 0 ? `${header}
+***` : `${header}
+***
+${footer}`
+  ).replace(PUTTY_KEY, "$1 ***") : text
+);
+var redactLines = (lines, values = []) => {
+  const joined = lines.join("\n");
+  const keyed = maskKeyBlocks(joined);
+  return (keyed === joined ? lines : keyed.split("\n")).map((line) => redactLine(line, values));
+};
+var redactText = (text, values = []) => redactLines(text.split("\n"), values).join("\n");
+var redactLine = (line, values) => {
   let masked = line;
   for (const { target, replacement } of values) {
     if (masked.includes(target)) {
@@ -637,12 +703,6 @@ import { join as join2 } from "node:path";
 var fieldNotesFile = (project) => join2(project, ".claude", "intentic", "field-notes.toon");
 var transcriptDir = (project, env = process.env) => join2(env["CLAUDE_CONFIG_DIR"] ?? join2(homedir(), ".claude"), "projects", project.replace(/[^a-zA-Z0-9]/g, "-"));
 
-// src/runtime.ts
-var isMissing2 = (error) => {
-  const code = typeof error === "object" && error !== null ? error.code : void 0;
-  return code === "ENOENT" || code === "ENOTDIR";
-};
-
 // src/notes-evidence.ts
 var MAX_SESSIONS = 200;
 var BUDGET_CHARS = 12e3;
@@ -768,7 +828,7 @@ var sessionFiles = (dir) => {
   try {
     names = readdirSync2(dir).filter((name) => name.endsWith(".jsonl"));
   } catch (error) {
-    if (isMissing2(error)) {
+    if (isMissing(error)) {
       return [];
     }
     throw error;

package/dist/post-bash.mjs

@@ -7,6 +7,7 @@ import { join as join4 } from "node:path";
 import { createHash } from "node:crypto";
 import { closeSync, fstatSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import * as util from "node:util";
 var ANSI = /\x1b(?:\[[0-9;?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[@-Z\\-_])/g;
 var collapseCr = (line) => {
   const frames = line.split("\r");
@@ -270,27 +271,90 @@ var SECRET_NAME = String.raw`[A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API[_-
 var ASSIGN = String.raw`["']?\s*[:=](?![=>])\s*`;
 var QUOTED_VALUE = String.raw`(["'\x60])([^"'\x60\n]{6,})\2`;
 var BARE_VALUE = String.raw`[\w+/=~-]{6,}(?![\w+/=~(-])`;
-var ISSUER_PREFIX = /^(?:sk-|pk-|rk-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[abposr]-|AKIA|ASIA|eyJ|AIza|ya29\.|glpat-|dop_v1_|shpat_|SG\.|npm_)/;
+var CREDENTIAL_ISSUERS = [
+  { prefix: "npm_", body: "[A-Za-z0-9]{30,}" },
+  { prefix: "ghp_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "gho_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghu_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghs_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "ghr_", body: "[A-Za-z0-9]{20,}" },
+  { prefix: "github_pat_", body: "[A-Za-z0-9_]{50,}" },
+  { prefix: "glpat-", body: "[A-Za-z0-9_-]{16,}" },
+  { prefix: "xoxa-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxb-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxo-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxp-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxr-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "xoxs-", body: "[A-Za-z0-9-]{10,}" },
+  { prefix: "sk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "pk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "rk-", body: "[A-Za-z0-9_-]{20,}" },
+  { prefix: "sk_live_", body: "[A-Za-z0-9]{16,}" },
+  { prefix: "rk_live_", body: "[A-Za-z0-9]{16,}" },
+  { prefix: "AKIA", body: String.raw`[0-9A-Z]{16}\b` },
+  { prefix: "ASIA", body: String.raw`[0-9A-Z]{16}\b` },
+  { prefix: "AIza", body: String.raw`[0-9A-Za-z_-]{35}\b` },
+  { prefix: "ya29.", body: "[0-9A-Za-z_-]{20,}" },
+  { prefix: "hf_", body: "[A-Za-z0-9]{30,}" },
+  { prefix: "dop_v1_", body: "[a-f0-9]{60,}" },
+  { prefix: "shpat_", body: "[a-fA-F0-9]{32,}" },
+  // SendGrid: a key id and its secret, dot-separated.
+  { prefix: "SG.", body: String.raw`[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}` },
+  // A JWT: three base64url segments, the first two of which decode from `{"` and so always begin `eyJ` and `ey`.
+  { prefix: "eyJ", body: String.raw`[A-Za-z0-9_-]{9,}\.ey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*` }
+];
+var CREDENTIAL_ISSUER_PREFIXES = CREDENTIAL_ISSUERS.map(({ prefix }) => prefix);
+var escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+var ISSUER_PREFIX = new RegExp(`^(?:${CREDENTIAL_ISSUER_PREFIXES.map(escapeRegExp).join("|")})`);
+var ISSUED_TOKENS = CREDENTIAL_ISSUERS.map(({ prefix, body }) => new RegExp(String.raw`(?<![\w-])${escapeRegExp(prefix)}${body}`, "g"));
 var NUMERIC_VALUE = /^[\d_,.]+$/;
 var STRUCTURAL_VALUE = /[\s/\\${}]/;
 var ENV_NAME_VALUE = /^[A-Z0-9_]+$/;
 var ENTROPIC_VALUE = /^(?=[^\n]*\d)(?=[^\n]*[A-Za-z])/;
 var HANDWRITTEN_MAX = 12;
 var looksLikeCredential = (value) => ISSUER_PREFIX.test(value) || value.length > HANDWRITTEN_MAX && ENTROPIC_VALUE.test(value) && !NUMERIC_VALUE.test(value) && !STRUCTURAL_VALUE.test(value) && !ENV_NAME_VALUE.test(value);
+var secretReference = (name) => `{{secret:${name}}}`;
 var SECRET_PATTERNS = [
   [
     new RegExp(`\\b(${SECRET_NAME}${ASSIGN})(?:${QUOTED_VALUE}|(${BARE_VALUE}))`, "gi"),
     // Quoted and bare arrive in different groups because only the quoted one has a quote to put back.
     (match, assignment, quote, quoted, bare) => looksLikeCredential(quoted ?? bare) ? `${assignment}${quote ?? ""}***${quote ?? ""}` : match
   ],
-  [/\bAKIA[0-9A-Z]{16}\b/g, "***"],
+  ...ISSUED_TOKENS.map((token) => [token, "***"]),
   // Same rule for a bearer value: prose about tokens carries no digit, every real bearer token does.
   [/\b(Bearer\s+)(?=[\w.-]*\d)[\w.-]{8,}/gi, "$1***"],
-  [/\b(https?:\/\/[^:@\s/]+:)[^@\s]+@/gi, "$1***@"]
+  // scheme://user:password@host for any scheme (a postgres DSN as much as an https remote). Any length, unlike the
+  // contract's three-character floor: output reaching a model is not a file someone meant to publish. A `/` ends the
+  // password, so `http://host:3000/@scope/pkg` is a port and a path, and a reference already standing in is kept.
+  [/\b([a-z][a-z0-9+.-]*:\/\/[^:@\s/]+:)(?!\{\{secret:)[^@\s/]+@/gi, "$1***@"]
 ];
+var MASKED_NEXT = String.raw`(?!(?:\s|\\[nr])*\*\*\*)`;
+var ARMOR_LINES = String.raw`(?:(?:\s|\\[nr])+(?:[A-Za-z-]+:[^\n\\]*|[A-Za-z0-9+/=]+(?=[ \t]*(?:[\r\n"'\x60<>,;})\]]|\\[nr]|$))))*`;
+var PRIVATE_KEY_BLOCK = new RegExp(
+  String.raw`(-----BEGIN ((?:[A-Z0-9]+ )*)PRIVATE KEY( BLOCK)?-----)${MASKED_NEXT}(?:[\s\S]*?(-----END \2PRIVATE KEY\3-----)|${ARMOR_LINES})`,
+  "g"
+);
+var PUTTY_KEY = new RegExp(String.raw`(PuTTY-User-Key-File-\d:)${MASKED_NEXT}[^\n\\]*${ARMOR_LINES}`, "g");
+var maskKeyBlocks = (text) => (
+  // The cheap test first: almost no output holds a key, and the block patterns scan the whole body.
+  text.includes("PRIVATE KEY") || text.includes("PuTTY-User-Key-File-") ? text.replace(
+    PRIVATE_KEY_BLOCK,
+    (_block, header, _label, _kind, footer) => footer === void 0 ? `${header}
+***` : `${header}
+***
+${footer}`
+  ).replace(PUTTY_KEY, "$1 ***") : text
+);
 var SECRET_VALUE_MIN = 12;
+var SECRET_STORES = [
+  { root: "desiredState", path: ".env", layout: "env", source: "env" },
+  // Pasted on a need's card or the Secrets view (src/secrets/sandbox-secrets.ts).
+  { root: "auth", path: "sandbox-secrets.json", layout: "flat", source: "sandbox" },
+  { root: "desiredState", path: ".secrets.json", layout: "flat", source: "generated" },
+  { root: "auth", path: "capability-secrets.json", layout: "vault", source: "capability" }
+];
 var secretValueCache = /* @__PURE__ */ new Map();
-var readIfChanged = (path, name) => {
+var readIfChanged = (path, layout) => {
   try {
     const descriptor = openSync(path, "r");
     try {
@@ -300,7 +364,7 @@ var readIfChanged = (path, name) => {
       if (cached?.stamp === stamp) {
         return cached.values;
       }
-      const values = harvest(readFileSync(descriptor, "utf8"), path, name);
+      const values = harvest(readFileSync(descriptor, "utf8"), layout);
       secretValueCache.set(path, { stamp, values });
       return values;
     } finally {
@@ -325,33 +389,19 @@ var surfaceForms = (value) => {
   }
   return forms;
 };
-var harvest = (text, path, name) => {
-  const named = [];
-  if (path.endsWith("capability-secrets.json")) {
-    for (const [id, entry] of Object.entries(JSON.parse(text))) {
-      if (entry === null || typeof entry !== "object") {
-        continue;
-      }
-      for (const [field, value] of Object.entries(entry)) {
-        if (typeof value === "string") {
-          named.push([name(id, field), value]);
-        }
-      }
-    }
-  } else if (path.endsWith(".json")) {
-    for (const [key, value] of Object.entries(JSON.parse(text))) {
-      if (typeof value === "string") {
-        named.push([name(key), value]);
-      }
-    }
-  } else {
-    for (const line of text.split("\n")) {
-      const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
-      if (match !== null) {
-        named.push([name(match[1]), (match[2] ?? "").trim().replace(/^(["'])([\s\S]*)\1$/, "$2")]);
-      }
-    }
+var namedValues = (text, layout) => {
+  if (layout === "env") {
+    return Object.entries(util.parseEnv(text));
   }
+  const parsed = JSON.parse(text);
+  if (layout === "flat") {
+    return Object.entries(parsed).filter(([, value]) => typeof value === "string");
+  }
+  return Object.entries(parsed).flatMap(
+    ([id, entry]) => entry === null || typeof entry !== "object" ? [] : Object.entries(entry).flatMap(([field, value]) => typeof value === "string" ? [[`${id}/${field}`, value]] : [])
+  );
+};
+var harvest = (text, layout) => {
   const byTarget = /* @__PURE__ */ new Map();
   const add = (target, replacement) => {
     const trimmed = target.trim();
@@ -359,9 +409,9 @@ var harvest = (text, path, name) => {
       byTarget.set(trimmed, { target: trimmed, replacement });
     }
   };
-  for (const [reference, value] of named) {
+  for (const [name, value] of namedValues(text, layout)) {
     for (const form of surfaceForms(value.trim())) {
-      add(form, `{{secret:${reference}}}`);
+      add(form, secretReference(name));
     }
     if (value.includes("\n")) {
       for (const line of value.split("\n")) {
@@ -372,16 +422,21 @@ var harvest = (text, path, name) => {
   return [...byTarget.values()].toSorted((a, b) => b.target.length - a.target.length);
 };
 var secretValues = (env = process.env) => {
-  const authRoot = env.AGENT_AUTH_DIR !== void 0 && env.AGENT_AUTH_DIR !== "" ? env.AGENT_AUTH_DIR : join(env.WORKSPACE_ROOT ?? "/work", ".intentic/secrets/auth");
-  const repo = join(env.WORKSPACE_ROOT ?? "/work", "desired-state");
-  return [
-    ...readIfChanged(join(authRoot, "capability-secrets.json"), (id, field) => `${id}/${field}`),
-    ...readIfChanged(join(repo, ".env"), (key) => key),
-    ...readIfChanged(join(repo, ".secrets.json"), (key) => key)
-  ].toSorted((a, b) => b.target.length - a.target.length);
-};
-var redactText = (text, values = []) => text.split("\n").map((line) => redactLine(line, values)).join("\n");
-var redactLine = (line, values = []) => {
+  const roots = {
+    auth: env.AGENT_AUTH_DIR !== void 0 && env.AGENT_AUTH_DIR !== "" ? env.AGENT_AUTH_DIR : join(env.WORKSPACE_ROOT ?? "/work", ".intentic/secrets/auth"),
+    desiredState: join(env.WORKSPACE_ROOT ?? "/work", "desired-state")
+  };
+  return SECRET_STORES.flatMap(({ root, path, layout }) => readIfChanged(join(roots[root], path), layout)).toSorted(
+    (a, b) => b.target.length - a.target.length
+  );
+};
+var redactLines = (lines, values = []) => {
+  const joined = lines.join("\n");
+  const keyed = maskKeyBlocks(joined);
+  return (keyed === joined ? lines : keyed.split("\n")).map((line) => redactLine(line, values));
+};
+var redactText = (text, values = []) => redactLines(text.split("\n"), values).join("\n");
+var redactLine = (line, values) => {
   let masked = line;
   for (const { target, replacement } of values) {
     if (masked.includes(target)) {
@@ -492,7 +547,7 @@ var cleanLines = (lines, { command, exitCode, enabled, values = [] }) => {
   if (enabled.has("redact")) {
     out = ran(
       "redact",
-      out.map((line) => redactLine(line, values))
+      redactLines(out, values)
     );
   }
   return { lines: out, stages };
@@ -747,6 +802,9 @@ if (process.argv[1]?.endsWith("agent-output-filter") || process.argv[1]?.endsWit
   await main();
 }
 
+// ../../_tools/base/src/errors.ts
+var errorMessage = (error) => error instanceof Error ? error.message : String(error);
+
 // src/features.ts
 var OPTIONS = {
   output_cleaners: {
@@ -865,7 +923,7 @@ var runHook = async (handle) => {
 `);
     }
   } catch (error) {
-    process.stderr.write(`intentic: ${error instanceof Error ? error.message : String(error)}
+    process.stderr.write(`intentic: ${errorMessage(error)}
 `);
   }
 };

package/dist/prompt-submit.mjs

@@ -6,6 +6,11 @@ import { spawnSync } from "node:child_process";
 // src/runtime.ts
 import { accessSync, closeSync, constants, mkdirSync, openSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { delimiter, dirname, join } from "node:path";
+
+// ../../_tools/base/src/errors.ts
+var errorMessage = (error) => error instanceof Error ? error.message : String(error);
+
+// src/runtime.ts
 var onPath = (name, env = process.env) => {
   const extensions = process.platform === "win32" ? (env["PATHEXT"] ?? ".EXE;.CMD;.BAT").split(";") : [""];
   for (const dir of (env["PATH"] ?? "").split(delimiter)) {
@@ -136,7 +141,7 @@ var runHook = async (handle) => {
 `);
     }
   } catch (error) {
-    process.stderr.write(`intentic: ${error instanceof Error ? error.message : String(error)}
+    process.stderr.write(`intentic: ${errorMessage(error)}
 `);
   }
 };