@iowarp/clio-coder 0.3.3 → 0.3.6

package/dist/chunk-TZSKNMZG.js

@@ -0,0 +1,434 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  filterEntriesToActivePath
+} from "./chunk-W6GROXXM.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
+
+// src/domains/context/working-set/fold.ts
+init_esm_shims();
+function refKey(ref) {
+  return ref.entry;
+}
+function parseRefKey(key) {
+  const trimmed = key.trim();
+  if (trimmed.length === 0 || /\s/.test(trimmed)) return null;
+  return { entry: trimmed };
+}
+function foldWorkingSet(entries, activeLeafTurnId) {
+  const active = filterEntriesToActivePath(entries, activeLeafTurnId);
+  const evicted = /* @__PURE__ */ new Map();
+  let evictionEvents = 0;
+  let itemsEvicted = 0;
+  let recalls = 0;
+  let lastPolicyId = null;
+  let lastEvictionTurnId = null;
+  for (const entry of active) {
+    if (entry.kind === "contextEviction") {
+      evictionEvents += 1;
+      lastPolicyId = entry.policyId;
+      lastEvictionTurnId = entry.turnId;
+      for (const item of entry.evicted) {
+        itemsEvicted += 1;
+        evicted.set(refKey(item.ref), {
+          reason: item.reason,
+          marker: item.marker,
+          ...item.by === void 0 ? {} : { by: item.by },
+          tokensFreed: item.tokensFreed,
+          evictedAtTurnId: entry.turnId,
+          policyId: entry.policyId
+        });
+      }
+      continue;
+    }
+    if (entry.kind === "contextRecall") recalls += 1;
+  }
+  return { evicted, evictionEvents, itemsEvicted, recalls, lastPolicyId, lastEvictionTurnId };
+}
+
+// src/domains/context/working-set/path-index.ts
+init_esm_shims();
+import { basename, isAbsolute, join, normalize, resolve } from "node:path";
+
+// src/domains/context/working-set/horizon.ts
+init_esm_shims();
+function isTurnStart(entry) {
+  if (entry.kind === "bashExecution" || entry.kind === "branchSummary") return true;
+  return entry.kind === "message" && entry.role === "user";
+}
+function protectionCutoffIndex(entries, protectLastTurns) {
+  const horizon = Math.max(1, Math.floor(protectLastTurns));
+  let seen = 0;
+  for (let i = entries.length - 1; i >= 0; i -= 1) {
+    const entry = entries[i];
+    if (!entry || !isTurnStart(entry)) continue;
+    seen += 1;
+    if (seen >= horizon) return i;
+  }
+  return 0;
+}
+
+// src/domains/context/working-set/payload.ts
+init_esm_shims();
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function toolResultPayload(payload) {
+  const obj = isRecord(payload) ? payload : { result: payload };
+  const result = obj.result ?? obj.output ?? obj.out ?? obj.content ?? payload;
+  const toolName = typeof obj.toolName === "string" && obj.toolName || typeof obj.name === "string" && obj.name || typeof obj.tool === "string" && obj.tool || "tool";
+  return { obj, result, toolName };
+}
+function textFromContent(content) {
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const block of content) {
+    if (!isRecord(block)) continue;
+    if (block.type === "text" && typeof block.text === "string") parts.push(block.text);
+  }
+  return parts.join("");
+}
+function stringifyBody(value) {
+  if (value === void 0 || value === null) return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value) ?? "";
+  } catch {
+    return String(value);
+  }
+}
+function toolResultText(result) {
+  if (typeof result === "string") return result;
+  if (!isRecord(result)) return stringifyBody(result);
+  const contentText = textFromContent(result.content);
+  if (contentText.length > 0) return contentText;
+  if (typeof result.text === "string") return result.text;
+  if (typeof result.output === "string") return result.output;
+  if (typeof result.message === "string") return result.message;
+  return stringifyBody(result);
+}
+function toolResultBodyTokens(payload) {
+  return Math.ceil(toolResultText(toolResultPayload(payload).result).length / 4);
+}
+function nestedRecord(parent, key) {
+  if (parent === null) return null;
+  const value = parent[key];
+  return isRecord(value) ? value : null;
+}
+function stringField(record, key) {
+  if (record === null) return void 0;
+  const value = record[key];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function offloadPathOf(payload) {
+  const details = nestedRecord(isRecord(payload.result) ? payload.result : null, "details");
+  return stringField(nestedRecord(details, "resultDisposition"), "offloadPath") ?? stringField(nestedRecord(details, "observation"), "offloadPath") ?? stringField(nestedRecord(details, "resultSize"), "offloadPath") ?? stringField(nestedRecord(payload.obj, "resultSummary"), "offloadPath");
+}
+function primaryPathOf(payload) {
+  const details = nestedRecord(isRecord(payload.result) ? payload.result : null, "details");
+  const paths = details?.paths;
+  if (!Array.isArray(paths) || paths.length !== 1) return void 0;
+  const first = paths[0];
+  return typeof first === "string" && first.length > 0 ? first : void 0;
+}
+function isThinkingBlock(block) {
+  return isRecord(block) && block.type === "thinking";
+}
+function hasThinking(payload) {
+  const obj = isRecord(payload) ? payload : null;
+  if (obj === null) return false;
+  if (Array.isArray(obj.content) && obj.content.some(isThinkingBlock)) return true;
+  return typeof obj.thinking === "string" && obj.thinking.length > 0;
+}
+function withoutThinkingBlocks(content) {
+  if (!Array.isArray(content)) return void 0;
+  return content.filter((block) => !isThinkingBlock(block));
+}
+function hasLegacyCompactionMarker(payload) {
+  if (!isRecord(payload)) return false;
+  if (isRecord(payload.contextCompaction)) return true;
+  if (isRecord(nestedRecord(payload, "resultSummary")?.contextCompaction)) return true;
+  const result = payload.result ?? payload.output ?? payload.out;
+  return isRecord(nestedRecord(isRecord(result) ? result : null, "details")?.contextCompaction);
+}
+
+// src/domains/context/working-set/path-index.ts
+function rangeEnd(range) {
+  return range.limit === null ? Number.POSITIVE_INFINITY : range.offset + range.limit;
+}
+function isFullRead(range) {
+  return range !== null && range.offset === 0 && range.limit === null;
+}
+function covers(later, earlier) {
+  if (isFullRead(later)) return true;
+  if (later === null || earlier === null) return false;
+  return later.offset <= earlier.offset && rangeEnd(later) >= rangeEnd(earlier);
+}
+var LISTING_COMMANDS = /* @__PURE__ */ new Set(["ls", "find", "tree", "fd", "rg", "grep"]);
+var MATCH_LINE_COMMANDS = /* @__PURE__ */ new Set(["rg", "grep"]);
+var TOOL_OPS = /* @__PURE__ */ new Map([
+  ["read", "read"],
+  ["grep", "grep"],
+  ["find", "find"],
+  ["ls", "ls"],
+  ["code_nav", "code_nav"],
+  ["write", "write"],
+  ["edit", "edit"],
+  ["artifact", "write"],
+  ["bash", "bash"],
+  ["git", "bash"],
+  ["verify", "bash"]
+]);
+var CODE_NAV_PATH_MODES = /* @__PURE__ */ new Set(["path", "outline", "deps", "dependents"]);
+var LISTING_OPS = /* @__PURE__ */ new Set(["grep", "find", "ls", "bash"]);
+function canonicalize(value, cwd) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return "";
+  if (isAbsolute(trimmed)) return normalize(trimmed);
+  return cwd === null ? normalize(trimmed) : resolve(cwd, trimmed);
+}
+function usableCwd(options) {
+  const cwd = options?.cwd;
+  if (typeof cwd !== "string" || cwd.trim().length === 0 || !isAbsolute(cwd)) return null;
+  return normalize(cwd);
+}
+function stableStringify(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (isRecord(value)) {
+    const keys = Object.keys(value).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+  }
+  if (value === void 0) return "null";
+  return JSON.stringify(value) ?? "null";
+}
+function callFacts(toolName, args) {
+  return { toolName, args, argsKey: args === void 0 ? "" : stableStringify(args) };
+}
+function stringField2(record, ...keys) {
+  if (record === null) return null;
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  }
+  return null;
+}
+function payloadRecord(payload) {
+  return isRecord(payload) ? payload : null;
+}
+function collectToolCalls(entries) {
+  const calls = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (entry.kind !== "message") continue;
+    const obj = payloadRecord(entry.payload);
+    if (entry.role === "tool_call" && obj !== null) {
+      const id = stringField2(obj, "toolCallId", "tool_call_id", "id") ?? entry.turnId;
+      const name = stringField2(obj, "name", "toolName", "tool") ?? "tool";
+      calls.set(id, callFacts(name, obj.args ?? obj.arguments ?? obj.input));
+      continue;
+    }
+    if (entry.role !== "assistant" || obj === null || !Array.isArray(obj.content)) continue;
+    for (const block of obj.content) {
+      if (!isRecord(block) || block.type !== "toolCall") continue;
+      const id = stringField2(block, "id", "toolCallId") ?? entry.turnId;
+      const name = stringField2(block, "name", "toolName") ?? "tool";
+      calls.set(id, callFacts(name, block.arguments ?? block.args ?? block.input));
+    }
+  }
+  return calls;
+}
+function callPathsByToolCallId(entries) {
+  const paths = /* @__PURE__ */ new Map();
+  for (const [id, call] of collectToolCalls(entries)) {
+    const named = stringField2(isRecord(call.args) ? call.args : null, "path", "file_path", "filePath");
+    if (named !== null) paths.set(id, named);
+  }
+  return paths;
+}
+function observedPath(op, args, cwd) {
+  if (op === "bash") {
+    const explicit = stringField2(args, "cwd");
+    return explicit === null ? "" : canonicalize(explicit, cwd);
+  }
+  if (op === "code_nav") {
+    const mode = stringField2(args, "mode");
+    if (mode === null || !CODE_NAV_PATH_MODES.has(mode)) return "";
+    const query = stringField2(args, "query");
+    return query === null ? "" : canonicalize(query, cwd);
+  }
+  const named = stringField2(args, "path", "file_path", "filePath");
+  if (named !== null) return canonicalize(named, cwd);
+  if (op === "grep" || op === "find" || op === "ls") return cwd ?? ".";
+  return "";
+}
+function readRange(args) {
+  if (args === null) return { offset: 0, limit: null };
+  const tail = args.tail;
+  if (typeof tail === "number" && Number.isFinite(tail) && tail > 0) return null;
+  const rawOffset = args.offset;
+  const rawLimit = args.limit;
+  const offset = typeof rawOffset === "number" && Number.isFinite(rawOffset) && rawOffset > 1 ? Math.floor(rawOffset) - 1 : 0;
+  const limit = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : null;
+  return { offset, limit };
+}
+function looksLikeConcreteFilePath(line) {
+  const text = line.trim();
+  if (text.length === 0) return false;
+  if (text.startsWith("[")) return false;
+  if (text.endsWith("/")) return false;
+  return !/\s/.test(text);
+}
+function pathFromMatchLine(line) {
+  const match = /^([^\s:]+):\d+[:-]/.exec(line.trim());
+  return match?.[1] ?? null;
+}
+function surfacedPaths(op, args, text, root, cwd) {
+  const lines = text.split("\n");
+  const matchLines = op === "grep" || op === "bash" && isMatchLineCommand(args);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const raw = matchLines ? pathFromMatchLine(line) ?? candidateWholeLine(line) : candidateWholeLine(line);
+    if (raw === null) continue;
+    const resolved = resolveSurfaced(raw, root, cwd);
+    if (resolved.length === 0 || seen.has(resolved)) continue;
+    seen.add(resolved);
+    out.push(resolved);
+  }
+  return out;
+}
+function candidateWholeLine(line) {
+  return looksLikeConcreteFilePath(line) ? line.trim() : null;
+}
+function isMatchLineCommand(args) {
+  const verb = commandVerb(args);
+  return verb !== null && MATCH_LINE_COMMANDS.has(verb);
+}
+function commandVerb(args) {
+  const command = stringField2(args, "command");
+  if (command === null) return null;
+  const first = command.trimStart().split(/\s+/)[0];
+  return first === void 0 || first.length === 0 ? null : basename(first);
+}
+function resolveSurfaced(value, root, cwd) {
+  if (isAbsolute(value)) return normalize(value);
+  if (root.length === 0) return canonicalize(value, cwd);
+  if (basename(root) === value) return canonicalize(root, cwd);
+  return canonicalize(join(root, value), cwd);
+}
+function shouldParseSurfaced(op, args, isError) {
+  if (isError || !LISTING_OPS.has(op)) return false;
+  if (op !== "bash") return true;
+  const verb = commandVerb(args);
+  return verb !== null && LISTING_COMMANDS.has(verb);
+}
+function fileEntryOp(operation) {
+  if (operation === "read") return "read";
+  if (operation === "edit") return "edit";
+  return "write";
+}
+function toolResultObservation(entry, context) {
+  const obj = payloadRecord(entry.payload);
+  const toolCallId = stringField2(obj, "toolCallId", "tool_call_id", "id");
+  const call = toolCallId === null ? void 0 : context.calls.get(toolCallId);
+  const toolName = stringField2(obj, "toolName", "name", "tool") ?? call?.toolName ?? "tool";
+  const op = TOOL_OPS.get(toolName);
+  if (op === void 0) return null;
+  const args = call !== void 0 && isRecord(call.args) ? call.args : null;
+  const isError = obj?.isError === true || obj?.error === true;
+  const isBlocked = obj?.outcome === "blocked" || typeof obj?.blockReason === "string";
+  const path = observedPath(op, args, context.cwd);
+  const surfaced = shouldParseSurfaced(op, args, isError) ? surfacedPaths(op, args, toolResultText(obj?.result ?? entry.payload), path, context.cwd) : [];
+  return {
+    ref: { entry: entry.turnId },
+    toolCallId,
+    toolName,
+    op,
+    path,
+    range: op === "read" ? readRange(args) : null,
+    surfaced,
+    isError,
+    isBlocked,
+    turnIndex: context.turnIndex,
+    entryIndex: context.entryIndex,
+    argsKey: call?.argsKey ?? ""
+  };
+}
+function buildPathIndex(entries, options) {
+  const cwd = usableCwd(options);
+  const calls = collectToolCalls(entries);
+  const observations = [];
+  const byRef = /* @__PURE__ */ new Map();
+  const byPath = /* @__PURE__ */ new Map();
+  const turnIndexOf = /* @__PURE__ */ new Map();
+  let turnIndex = 0;
+  for (let entryIndex = 0; entryIndex < entries.length; entryIndex += 1) {
+    const entry = entries[entryIndex];
+    if (entry === void 0) continue;
+    turnIndexOf.set(entry.turnId, turnIndex);
+    let observation = null;
+    if (entry.kind === "fileEntry") {
+      observation = {
+        ref: { entry: entry.turnId },
+        toolCallId: null,
+        toolName: "fileEntry",
+        op: fileEntryOp(entry.operation),
+        path: canonicalize(entry.path, cwd),
+        range: null,
+        surfaced: [],
+        isError: false,
+        isBlocked: false,
+        turnIndex,
+        entryIndex,
+        argsKey: ""
+      };
+    } else if (entry.kind === "message" && entry.role === "tool_result") {
+      observation = toolResultObservation(entry, { entryIndex, turnIndex, cwd, calls });
+    }
+    if (observation !== null) {
+      observations.push(observation);
+      byRef.set(observation.ref.entry, observation);
+      if (observation.path.length > 0) {
+        const bucket = byPath.get(observation.path);
+        if (bucket === void 0) byPath.set(observation.path, [observation]);
+        else bucket.push(observation);
+      }
+    }
+    if (isTurnStart(entry)) turnIndex += 1;
+  }
+  return { observations, byRef, byPath, turnIndexOf, turnCount: turnIndex };
+}
+
+// src/domains/context/working-set/contract.ts
+init_esm_shims();
+var EMPTY_WORKING_SET_VIEW = Object.freeze({
+  evicted: /* @__PURE__ */ new Map(),
+  evictionEvents: 0,
+  itemsEvicted: 0,
+  recalls: 0,
+  lastPolicyId: null,
+  lastEvictionTurnId: null
+});
+
+export {
+  refKey,
+  parseRefKey,
+  foldWorkingSet,
+  EMPTY_WORKING_SET_VIEW,
+  isTurnStart,
+  protectionCutoffIndex,
+  isRecord,
+  toolResultPayload,
+  toolResultText,
+  toolResultBodyTokens,
+  offloadPathOf,
+  primaryPathOf,
+  hasThinking,
+  withoutThinkingBlocks,
+  hasLegacyCompactionMarker,
+  covers,
+  callPathsByToolCallId,
+  buildPathIndex
+};
+//# sourceMappingURL=chunk-TZSKNMZG.js.map

package/dist/{chunk-7MNJORFF.js → chunk-UL3WSD3F.js}

@@ -7,9 +7,13 @@ import {
 init_esm_shims();
 var VERIFICATION_SCRIPT_FAMILY_HINT = "test*/lint*/build*/typecheck*/check*/format*/ci*";
 var VERIFICATION_SCRIPT_PATTERN = /^(?:test|lint|build|typecheck|check|format|ci)(?:[:.-].*)?$/;
+var PROJECT_VERIFIER_CHECK_ID_PATTERN = /^[a-z0-9][a-z0-9._:-]*$/;
 function isVerificationScriptName(name) {
   return VERIFICATION_SCRIPT_PATTERN.test(name);
 }
+function isProjectVerifierCheckId(name) {
+  return PROJECT_VERIFIER_CHECK_ID_PATTERN.test(name);
+}
 function declaredVerificationScripts(scripts) {
   return Object.keys(scripts).filter((name) => isVerificationScriptName(name)).sort((a, b) => a.localeCompare(b));
 }
@@ -17,6 +21,7 @@ function declaredVerificationScripts(scripts) {
 export {
   VERIFICATION_SCRIPT_FAMILY_HINT,
   isVerificationScriptName,
+  isProjectVerifierCheckId,
   declaredVerificationScripts
 };
-//# sourceMappingURL=chunk-7MNJORFF.js.map
+//# sourceMappingURL=chunk-UL3WSD3F.js.map

package/dist/{chunk-VJWL6YS5.js → chunk-UUVG37B4.js}

@@ -7,7 +7,7 @@ import {
   WORKSPACE_EXCLUDED_DIRS,
   enumerateWorkspaceFiles,
   enumerateWorkspaceFilesAsync
-} from "./chunk-EKMEHE4H.js";
+} from "./chunk-33YXPOE3.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -241,4 +241,4 @@ export {
   computeFingerprintCached,
   isStale
 };
-//# sourceMappingURL=chunk-VJWL6YS5.js.map
+//# sourceMappingURL=chunk-UUVG37B4.js.map

package/dist/{chunk-COU2UHX6.js → chunk-VEZEGCGW.js}

@@ -1,4 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  clampTimerDelayMs
+} from "./chunk-FQ4SKYE4.js";
 import {
   clioStateDir
 } from "./chunk-BNAZZHFG.js";
@@ -390,11 +393,176 @@ function withManagedGitCommitAttributionEnvironment(source, options = {}) {
   return { env, diagnostic: null };
 }
 
+// src/core/safe-exec.ts
+init_esm_shims();
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { performance } from "node:perf_hooks";
+var SAFE_EXEC_DEFAULT_TIMEOUT_MS = 12e4;
+var SAFE_EXEC_DEFAULT_MAX_OUTPUT_BYTES = 6e5;
+var ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "CI",
+  "NO_COLOR"
+];
+function buildSafeToolEnv(extra = {}) {
+  const env = {};
+  for (const key of ENV_ALLOWLIST) {
+    const value = process.env[key];
+    if (value !== void 0) env[key] = value;
+  }
+  for (const [key, value] of Object.entries(extra)) {
+    if (!/^[A-Z_][A-Z0-9_]*$/i.test(key)) continue;
+    env[key] = value;
+  }
+  env.AI_AGENT = AI_AGENT_NAME;
+  return env;
+}
+function resolveSafeCwd(cwd, workspaceRoot = process.cwd()) {
+  const root = path.resolve(workspaceRoot);
+  const resolved = cwd === void 0 ? root : path.isAbsolute(cwd) ? path.resolve(cwd) : path.resolve(root, cwd);
+  const rel = path.relative(root, resolved);
+  if (rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel)) return resolved;
+  throw new Error(`cwd escapes workspace root: ${resolved}`);
+}
+function runCommandVector(file, args, options = {}) {
+  return new Promise((resolve2) => {
+    const startedAt = performance.now();
+    const cwd = resolveSafeCwd(options.cwd, options.workspaceRoot);
+    const timeoutMs = clampTimerDelayMs(options.timeoutMs ?? SAFE_EXEC_DEFAULT_TIMEOUT_MS);
+    const maxOutputBytes = options.maxOutputBytes ?? SAFE_EXEC_DEFAULT_MAX_OUTPUT_BYTES;
+    const attribution = withManagedGitCommitAttributionEnvironment(buildSafeToolEnv(options.env), {
+      cwd,
+      enabled: gitCommitAttributionEnabled(process.env)
+    });
+    reportCommitAttributionDiagnostic(attribution.diagnostic);
+    let aborted = false;
+    let timedOut = false;
+    let outputCapped = false;
+    let outputBytes = 0;
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    let killSent = false;
+    let timeoutId = null;
+    let killGraceTimer = null;
+    const child = spawn(file, [...args], {
+      cwd,
+      env: attribution.env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const clearKillGraceTimer = () => {
+      if (killGraceTimer) clearTimeout(killGraceTimer);
+      killGraceTimer = null;
+    };
+    const sendSignal = (signalName) => {
+      const pid = child.pid;
+      if (pid && process.platform !== "win32") {
+        try {
+          process.kill(-pid, signalName);
+          return;
+        } catch {
+        }
+      }
+      child.kill(signalName);
+    };
+    const killChild = () => {
+      if (killSent) return;
+      killSent = true;
+      sendSignal("SIGTERM");
+      killGraceTimer = setTimeout(() => sendSignal("SIGKILL"), 3e3);
+    };
+    const onAbort = () => {
+      aborted = true;
+      killChild();
+    };
+    if (timeoutMs > 0) {
+      timeoutId = setTimeout(() => {
+        timedOut = true;
+        killChild();
+      }, timeoutMs);
+    }
+    if (options.signal?.aborted) onAbort();
+    else options.signal?.addEventListener("abort", onAbort, { once: true });
+    const appendChunk = (target, chunk) => {
+      outputBytes += chunk.byteLength;
+      if (outputBytes > maxOutputBytes) {
+        outputCapped = true;
+        killChild();
+        return;
+      }
+      if (target === "stdout") stdout += chunk.toString("utf8");
+      else stderr += chunk.toString("utf8");
+    };
+    child.stdout?.on("data", (chunk) => appendChunk("stdout", chunk));
+    child.stderr?.on("data", (chunk) => appendChunk("stderr", chunk));
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutId) clearTimeout(timeoutId);
+      clearKillGraceTimer();
+      options.signal?.removeEventListener("abort", onAbort);
+      resolve2({
+        file,
+        args: [...args],
+        cwd,
+        stdout,
+        stderr: stderr.length > 0 ? stderr : error.message,
+        exitCode: null,
+        signal: null,
+        aborted,
+        timedOut,
+        outputCapped,
+        durationMs: Math.round(performance.now() - startedAt)
+      });
+    });
+    child.on("close", (code, signalName) => {
+      if (settled) return;
+      settled = true;
+      if (timeoutId) clearTimeout(timeoutId);
+      clearKillGraceTimer();
+      options.signal?.removeEventListener("abort", onAbort);
+      resolve2({
+        file,
+        args: [...args],
+        cwd,
+        stdout,
+        stderr,
+        exitCode: code,
+        signal: signalName,
+        aborted,
+        timedOut,
+        outputCapped,
+        durationMs: Math.round(performance.now() - startedAt)
+      });
+    });
+  });
+}
+function combineSafeOutput(result) {
+  const { stdout, stderr } = result;
+  return stderr.length > 0 ? `${stdout}${stdout.endsWith("\n") || stdout.length === 0 ? "" : "\n"}${stderr}` : stdout;
+}
+
 export {
   attributeCommitMessage,
   reportCommitAttributionDiagnostic,
   setGitCommitAttributionEnabled,
   gitCommitAttributionEnabled,
-  withManagedGitCommitAttributionEnvironment
+  withManagedGitCommitAttributionEnvironment,
+  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+  SAFE_EXEC_DEFAULT_MAX_OUTPUT_BYTES,
+  buildSafeToolEnv,
+  resolveSafeCwd,
+  runCommandVector,
+  combineSafeOutput
 };
-//# sourceMappingURL=chunk-COU2UHX6.js.map
+//# sourceMappingURL=chunk-VEZEGCGW.js.map