@iowarp/clio-coder 0.4.6 → 0.4.8

package/dist/chunk-M6TAYK66.js

@@ -1,807 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  canonicalizeExistingPath
-} from "./chunk-KQ6IDQIB.js";
-import {
-  artifactDefaultPath
-} from "./chunk-NTTS3O53.js";
-import {
-  isVerificationScriptName
-} from "./chunk-M4KFUXS7.js";
-import {
-  ToolNames
-} from "./chunk-EHOSNVVM.js";
-import {
-  init_esm_shims
-} from "./chunk-ECBHH7LU.js";
-
-// src/domains/safety/protected-artifacts.ts
-init_esm_shims();
-import path from "node:path";
-var COMMAND_SEPARATORS = /* @__PURE__ */ new Set([";", "&", "&&", "||", "|"]);
-var SHELL_WRAPPERS = /* @__PURE__ */ new Set(["command", "builtin", "sudo", "doas"]);
-var SHELL_REDIRECTIONS = /* @__PURE__ */ new Set([">", ">>", "<", "<<", "<<<", "<&", ">&", "<>", ">|", "&>", "&>>"]);
-var SHELL_WRITE_REDIRECTIONS = /* @__PURE__ */ new Set([">", ">>", ">&", "<>", ">|", "&>", "&>>"]);
-function toolMutationPaths(toolName, args) {
-  if (toolName === ToolNames.Artifact) {
-    return [mutationPathArg(args) ?? artifactDefaultPath(args?.kind)];
-  }
-  if (toolName === ToolNames.Write || toolName === ToolNames.Edit) {
-    const candidate = mutationPathArg(args);
-    return candidate === null ? [] : [candidate];
-  }
-  return [];
-}
-function protectedArtifactMutationBlockReason(state, toolName, args) {
-  if (state.artifacts.length === 0) return null;
-  for (const candidate of toolMutationPaths(toolName, args)) {
-    if (isProtectedPath(state, candidate)) {
-      return `protected artifact blocked: ${toolName} would modify protected path ${candidate}`;
-    }
-  }
-  if (toolName !== ToolNames.Bash) return null;
-  const command = typeof args?.command === "string" && args.command.length > 0 ? args.command : null;
-  if (command === null) return null;
-  const classification = classifyDestructiveCommand(command, state.artifacts);
-  if (classification.kind === "benign") return null;
-  const affected = classification.matches.map((match) => match.artifactPath).join(", ");
-  return `protected artifact blocked: ${classification.operation} would affect ${affected}`;
-}
-function mutationPathArg(args) {
-  if (!args) return null;
-  const candidate = args.path ?? args.file_path ?? args.filePath;
-  return typeof candidate === "string" && candidate.length > 0 ? candidate : null;
-}
-function protectArtifact(state, artifact) {
-  const artifacts = artifactMap(state.artifacts);
-  const key = normalizePathKey(artifact.path);
-  if (key !== null) artifacts.set(key, cloneArtifact(artifact));
-  return stateFromMap(artifacts);
-}
-function isProtectedPath(state, artifactPath) {
-  const candidate = normalizePathKey(artifactPath);
-  if (candidate === null) return false;
-  for (const artifact of normalizedArtifacts(state.artifacts)) {
-    if (isSameOrDescendant(candidate, artifact.key)) return true;
-  }
-  return false;
-}
-function classifyDestructiveCommand(command, protectedArtifacts) {
-  const artifacts = normalizedArtifacts(protectedArtifacts);
-  if (artifacts.length === 0) return { kind: "benign", matches: [] };
-  for (const tokens of splitSegments(scanShellLike(command))) {
-    const segment = shellCommandArguments(tokens);
-    const redirect = classifyRedirect(tokens, artifacts);
-    if (redirect.kind === "destructive") return redirect;
-    const commandIndex = commandTokenIndex(segment);
-    if (commandIndex === null) continue;
-    const executable = basenameToken(segment[commandIndex]);
-    if (executable === "rm") {
-      const result = classifyPathOperation(
-        "rm",
-        "rm can remove protected artifacts",
-        pathArgs(segment, commandIndex),
-        artifacts
-      );
-      if (result.kind === "destructive") return result;
-      continue;
-    }
-    if (executable === "mv") {
-      const result = classifyPathOperation(
-        "mv",
-        "mv can move or overwrite protected artifacts",
-        pathArgs(segment, commandIndex),
-        artifacts
-      );
-      if (result.kind === "destructive") return result;
-      continue;
-    }
-    if (executable === "truncate") {
-      const result = classifyPathOperation(
-        "truncate",
-        "truncate can overwrite protected artifacts",
-        pathArgs(segment, commandIndex),
-        artifacts
-      );
-      if (result.kind === "destructive") return result;
-      continue;
-    }
-    if (executable === "cp") {
-      const args = pathArgs(segment, commandIndex);
-      const destination = args.at(-1);
-      const result = classifyPathOperation(
-        "cp",
-        "cp can overwrite protected artifacts",
-        destination === void 0 ? [] : [destination],
-        artifacts
-      );
-      if (result.kind === "destructive") return result;
-      continue;
-    }
-    if (executable === "git") {
-      const result = classifyGitOperation(segment.slice(commandIndex + 1), artifacts);
-      if (result.kind === "destructive") return result;
-      continue;
-    }
-    if (executable === "find") {
-      const result = classifyFindDelete(segment.slice(commandIndex + 1), artifacts);
-      if (result.kind === "destructive") return result;
-    }
-  }
-  return { kind: "benign", matches: [] };
-}
-function detectValidationCommand(command, scope = "finish-contract") {
-  for (const tokens of splitSegments(scanShellLike(command))) {
-    const segment = shellCommandArguments(tokens);
-    const commandIndex = commandTokenIndex(segment);
-    if (commandIndex === null) continue;
-    const executable = basenameToken(segment[commandIndex]);
-    const args = segment.slice(commandIndex + 1);
-    const matched = validationMatch(executable, args) ?? (scope === "grounding" ? groundingMatch(executable, args) : null);
-    if (matched !== null) return { kind: "validation", matched };
-  }
-  return { kind: "none" };
-}
-function extractCommandWriteTargets(command) {
-  const targets = [];
-  for (const segment of expandedShellSegments(command)) {
-    collectRedirectTargets(segment, targets);
-    const argv = shellCommandArguments(segment);
-    collectInvokedWriteTargets(argv, targets);
-    collectInPlaceEditTargets(argv, targets);
-  }
-  return targets.filter(isInterestingWriteTarget);
-}
-var INNER_SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
-var INNER_SHELL_MAX_DEPTH = 3;
-function segmentShellScript(segment) {
-  const commandIndex = commandTokenIndex(segment);
-  if (commandIndex === null) return null;
-  if (!INNER_SHELLS.has(basenameToken(segment[commandIndex]))) return null;
-  for (let index = commandIndex + 1; index < segment.length; index += 1) {
-    const token = segment[index];
-    if (token === void 0) continue;
-    if (token.startsWith("-") && token.length > 1) {
-      if (!token.slice(1).includes("c")) continue;
-      const script = segment[index + 1];
-      return script !== void 0 && script.length > 0 ? script : null;
-    }
-    return null;
-  }
-  return null;
-}
-function expandedShellSegments(command, depth = 0) {
-  const segments = splitSegments(scanShellLike(command));
-  if (depth >= INNER_SHELL_MAX_DEPTH) return segments;
-  const out = [];
-  for (const segment of segments) {
-    out.push(segment);
-    const script = segmentShellScript(shellCommandArguments(segment));
-    if (script !== null) out.push(...expandedShellSegments(script, depth + 1));
-  }
-  return out;
-}
-function inlineShellScript(command) {
-  const segments = splitSegments(scanShellLike(command));
-  if (segments.length !== 1) return null;
-  const segment = segments[0];
-  if (segment === void 0) return null;
-  return segmentShellScript(shellCommandArguments(segment));
-}
-function extractCommandCdTargets(command) {
-  const targets = [];
-  for (const tokens of expandedShellSegments(command)) {
-    const segment = shellCommandArguments(tokens);
-    const commandIndex = commandTokenIndex(segment);
-    if (commandIndex === null) continue;
-    const executable = basenameToken(segment[commandIndex]);
-    if (executable !== "cd" && executable !== "pushd") continue;
-    const target = pathArgs(segment, commandIndex).at(0);
-    targets.push(target ?? "~");
-  }
-  return targets;
-}
-function extractCommandDeleteTargets(command) {
-  const targets = [];
-  for (const tokens of expandedShellSegments(command)) {
-    const segment = shellCommandArguments(tokens);
-    const commandIndex = commandTokenIndex(segment);
-    if (commandIndex === null) continue;
-    const executable = basenameToken(segment[commandIndex]);
-    if (executable === "rm") {
-      targets.push(...pathArgs(segment, commandIndex));
-      continue;
-    }
-    if (executable === "mv") {
-      const args = pathArgs(segment, commandIndex);
-      if (args.length >= 2) targets.push(...args.slice(0, -1));
-      continue;
-    }
-    if (executable === "find" && segment.includes("-delete")) {
-      targets.push(...findRoots(segment.slice(commandIndex + 1)));
-    }
-  }
-  return targets.filter(isInterestingWriteTarget);
-}
-function invokesClioSkillMutation(command) {
-  for (const segment of expandedShellSegments(command)) {
-    const argv = shellCommandArguments(segment);
-    const index = commandTokenIndex(argv);
-    if (index === null) continue;
-    let args = argv.slice(index);
-    const executable = basenameToken(args[0]);
-    if (executable === "npx" || executable === "npm" && args[1] === "exec") {
-      args = args.slice(executable === "npm" ? 2 : 1);
-      while (args[0]?.startsWith("-")) args = args.slice(1);
-    }
-    const program = args[0] ?? "";
-    if (basenameToken(program) === "node" || basenameToken(program) === "tsx") {
-      if (!/(?:^|\/)(?:src|dist)\/cli\/index\.(?:js|ts)$/.test(args[1] ?? "")) continue;
-      args = args.slice(2);
-    } else if (/^(?:@iowarp\/)?clio-coder(?:@[^/]+)?$/.test(program) || basenameToken(program) === "clio-coder") {
-      args = args.slice(1);
-    } else continue;
-    if (args.includes("--version") || args.includes("-v")) continue;
-    let rootHelp = false;
-    let firstRootFlag;
-    while (args[0]?.startsWith("-")) {
-      const flag = args[0];
-      if (flag === "--all" || flag === "--help" || flag === "-h") firstRootFlag ??= flag;
-      rootHelp = firstRootFlag === "--help" || firstRootFlag === "-h";
-      args = args.slice(flag === "--skill" || flag === "--api-key" ? 2 : 1);
-    }
-    if (rootHelp) continue;
-    if (args[0] !== "skills" && args[0] !== "library") continue;
-    if (resourceCliMutatesSkills(args[0], args.slice(1))) return true;
-  }
-  return false;
-}
-function shellCommandArguments(segment) {
-  const args = [];
-  for (let index = 0; index < segment.length; index += 1) {
-    const token = segment[index];
-    if (token === void 0) continue;
-    if (token.operator && SHELL_REDIRECTIONS.has(token.value)) {
-      const previous = args.at(-1);
-      if (previous && previous.end === token.start && !previous.quoted && /^\d+$/.test(previous.value)) args.pop();
-      if (segment[index + 1]?.operator === false) index += 1;
-      continue;
-    }
-    args.push(token);
-  }
-  return args.map((token) => token.value);
-}
-function resourceCliMutatesSkills(resource, args) {
-  const valueOptions = resource === "skills" ? ["--name", "--category", "--scenario", "--target", "--workspace", "--timeout"] : ["--kind", "--from"];
-  let verb;
-  let confirmed = false;
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === void 0) continue;
-    if (valueOptions.includes(arg)) {
-      index += 1;
-      continue;
-    }
-    if (arg === "--help" || arg === "-h") return false;
-    if (arg === "--yes") confirmed = true;
-    if (!arg.startsWith("-")) verb ??= arg;
-  }
-  if (resource === "skills") return verb === "install" || verb === "update" || verb === "sync";
-  return verb === "add" && confirmed;
-}
-var STANDARD_DEV_TARGETS = /* @__PURE__ */ new Set(["/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty", "/dev/zero"]);
-function collectRedirectTargets(segment, out) {
-  for (let index = 0; index < segment.length - 1; index += 1) {
-    const target = redirectWriteTarget(segment[index], segment[index + 1]);
-    if (target !== null) out.push(target);
-  }
-}
-function redirectWriteTarget(operator, target) {
-  if (!operator?.operator || target === void 0 || target.operator || !SHELL_WRITE_REDIRECTIONS.has(operator.value))
-    return null;
-  if (operator.value === ">&" && /^(?:\d+-?|-)$/u.test(target.value)) return null;
-  return target.value;
-}
-function collectInvokedWriteTargets(segment, out) {
-  const cmdIndex = commandTokenIndex(segment);
-  if (cmdIndex === null) return;
-  const executable = basenameToken(segment[cmdIndex]);
-  if (executable === "tee") {
-    for (const arg of pathArgs(segment, cmdIndex)) out.push(arg);
-    return;
-  }
-  if (executable === "mkdir" || executable === "touch") {
-    for (const arg of pathArgs(segment, cmdIndex)) out.push(arg);
-    return;
-  }
-  if (executable === "ln") {
-    const args = pathArgs(segment, cmdIndex);
-    const destination = args.at(-1);
-    if (args.length >= 2 && destination !== void 0) out.push(destination);
-    return;
-  }
-  if (executable === "cp" || executable === "mv") {
-    const args = pathArgs(segment, cmdIndex);
-    const destination = args.at(-1);
-    if (args.length >= 2 && destination !== void 0) out.push(destination);
-  }
-}
-function collectInPlaceEditTargets(segment, out) {
-  const cmdIndex = commandTokenIndex(segment);
-  if (cmdIndex === null) return;
-  if (basenameToken(segment[cmdIndex]) !== "sed") return;
-  if (!hasSedInPlaceFlag(segment, cmdIndex)) return;
-  for (const operand of sedFileOperands(segment, cmdIndex)) out.push(operand);
-}
-function hasSedInPlaceFlag(segment, cmdIndex) {
-  for (let index = cmdIndex + 1; index < segment.length; index += 1) {
-    const token = segment[index];
-    if (token === void 0) continue;
-    if (token === "--") break;
-    if (token === "--in-place" || token.startsWith("--in-place=")) return true;
-    if (token.startsWith("--")) continue;
-    if (token.startsWith("-") && token.length > 1 && token.slice(1).includes("i")) return true;
-  }
-  return false;
-}
-function sedFileOperands(segment, cmdIndex) {
-  const operands = [];
-  let sawScriptFlag = false;
-  let endOfOptions = false;
-  for (let index = cmdIndex + 1; index < segment.length; index += 1) {
-    const token = segment[index];
-    if (token === void 0) continue;
-    if (!endOfOptions && token === "--") {
-      endOfOptions = true;
-      continue;
-    }
-    if (!endOfOptions && token.startsWith("-") && token.length > 1) {
-      if (token === "-e" || token === "-f") {
-        sawScriptFlag = true;
-        index += 1;
-        continue;
-      }
-      if (token === "-l") {
-        index += 1;
-        continue;
-      }
-      if (token === "--expression" || token === "--file") {
-        sawScriptFlag = true;
-        index += 1;
-        continue;
-      }
-      if (token.startsWith("--expression=") || token.startsWith("--file=")) {
-        sawScriptFlag = true;
-        continue;
-      }
-      continue;
-    }
-    operands.push(token);
-  }
-  if (!sawScriptFlag && operands.length > 0) operands.shift();
-  return operands;
-}
-function isInterestingWriteTarget(target) {
-  if (target.length === 0) return false;
-  if (STANDARD_DEV_TARGETS.has(target)) return false;
-  if (target.startsWith("/dev/fd/")) return false;
-  return true;
-}
-function classifyRedirect(segment, artifacts) {
-  for (let index = 0; index < segment.length; index += 1) {
-    if (segment[index]?.value === ">>" || segment[index]?.value === "&>>") continue;
-    const target = redirectWriteTarget(segment[index], segment[index + 1]);
-    if (target === null) continue;
-    const matches = matchesForPaths([target], artifacts, "target", "redirect can overwrite protected artifacts");
-    if (matches.length > 0) {
-      return {
-        kind: "destructive",
-        operation: "redirect",
-        matches
-      };
-    }
-  }
-  return { kind: "benign", matches: [] };
-}
-function classifyGitOperation(args, artifacts) {
-  const subcommand = args[0];
-  if (subcommand === "reset" && args.includes("--hard")) {
-    return {
-      kind: "destructive",
-      operation: "git_reset_hard",
-      matches: artifacts.map(({ artifact }) => ({
-        artifactPath: artifact.path,
-        commandPath: ".",
-        reason: "git reset --hard can overwrite protected artifacts"
-      }))
-    };
-  }
-  if (subcommand === "checkout" && args.includes("--")) {
-    const paths = args.slice(args.indexOf("--") + 1);
-    const matches = matchesForPaths(paths, artifacts, "intersects", "git checkout -- can overwrite protected artifacts");
-    if (matches.length > 0) {
-      return {
-        kind: "destructive",
-        operation: "git_checkout",
-        matches
-      };
-    }
-    return { kind: "benign", matches: [] };
-  }
-  if (subcommand === "restore") {
-    const matches = matchesForPaths(
-      pathArgs(args.slice(1), -1),
-      artifacts,
-      "intersects",
-      "git restore can overwrite protected artifacts"
-    );
-    if (matches.length > 0) {
-      return {
-        kind: "destructive",
-        operation: "git_restore",
-        matches
-      };
-    }
-  }
-  return { kind: "benign", matches: [] };
-}
-function classifyFindDelete(args, artifacts) {
-  if (!args.includes("-delete")) return { kind: "benign", matches: [] };
-  const roots = findRoots(args);
-  const matches = matchesForPaths(
-    roots.length === 0 ? ["."] : roots,
-    artifacts,
-    "intersects",
-    "find -delete can remove protected artifacts"
-  );
-  if (matches.length > 0) {
-    return {
-      kind: "destructive",
-      operation: "find_delete",
-      matches
-    };
-  }
-  return { kind: "benign", matches: [] };
-}
-function findRoots(args) {
-  const roots = [];
-  for (const token of args) {
-    if (token === "-delete" || token.startsWith("-") || token === "(" || token === "!" || token === "not") break;
-    if (token === "--") continue;
-    roots.push(token);
-  }
-  return roots.length === 0 ? ["."] : roots;
-}
-function classifyPathOperation(operation, reason, paths, artifacts) {
-  const matches = matchesForPaths(paths, artifacts, "intersects", reason);
-  if (matches.length === 0) return { kind: "benign", matches: [] };
-  return {
-    kind: "destructive",
-    operation,
-    matches
-  };
-}
-function matchesForPaths(commandPaths, artifacts, mode, reason) {
-  const matches = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const commandPath of commandPaths) {
-    for (const artifact of artifacts) {
-      if (!pathMatchesArtifact(commandPath, artifact.key, mode)) continue;
-      const key = `${artifact.key}\0${commandPath}\0${reason}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      matches.push({
-        artifactPath: artifact.artifact.path,
-        commandPath,
-        reason
-      });
-    }
-  }
-  matches.sort(compareMatches);
-  return matches;
-}
-function pathMatchesArtifact(commandPath, artifactKey, mode) {
-  const wildcardRoot = wildcardRootKey(commandPath);
-  if (wildcardRoot !== null) {
-    return isSameOrDescendant(artifactKey, wildcardRoot);
-  }
-  const commandKey = normalizePathKey(commandPath);
-  if (commandKey === null) return false;
-  if (mode === "target") return isSameOrDescendant(commandKey, artifactKey);
-  return isSameOrDescendant(commandKey, artifactKey) || isSameOrDescendant(artifactKey, commandKey);
-}
-function validationMatch(executable, args) {
-  if (executable === "npm") {
-    if (args[0] === "test") return "npm test";
-    const script = args[0] === "run" && typeof args[1] === "string" ? args[1] : null;
-    if (script !== null && isVerificationScriptName(script)) return `npm run ${script}`;
-  }
-  if (executable === "pytest") return "pytest";
-  if (isPythonExecutable(executable) && moduleArg(args) === "pytest") return "python -m pytest";
-  if (executable === "cargo" && args[0] === "test") return "cargo test";
-  if (executable === "go" && args[0] === "test") return "go test";
-  if (executable === "ctest") return "ctest";
-  if (executable === "make" && args[0] === "test") return "make test";
-  if (executable === "ninja" && args[0] === "test") return "ninja test";
-  if (executable === "mvn" && args[0] === "test") return "mvn test";
-  if ((executable === "gradle" || executable === "gradlew") && args[0] === "test") return "gradle test";
-  return null;
-}
-function groundingMatch(executable, args) {
-  if (executable === "git") {
-    if (args[0] === "diff") return "git diff";
-    if (args[0] === "status") return "git status";
-    return null;
-  }
-  if (executable === "node") {
-    if (args.includes("--test")) return "node --test";
-    if (args.includes("-e") || args.includes("--eval")) return "node -e";
-    return null;
-  }
-  if (executable === "tsc") return typescriptCheckMatch(args);
-  if (executable === "npx") {
-    const inner = npxInvocation(args);
-    return inner === null ? null : npxRunnerMatch(inner.executable, inner.args);
-  }
-  return null;
-}
-var NPX_TEST_RUNNERS = /* @__PURE__ */ new Set(["vitest", "jest", "mocha"]);
-function npxRunnerMatch(executable, args) {
-  if (NPX_TEST_RUNNERS.has(executable)) return `npx ${executable}`;
-  if (executable === "tsx" && args.includes("--test")) return "npx tsx --test";
-  if (executable === "tsc") return typescriptCheckMatch(args);
-  return null;
-}
-function typescriptCheckMatch(args) {
-  return args.some((arg) => arg.toLowerCase() === "--noemit") ? "tsc --noEmit" : "tsc";
-}
-function npxInvocation(args) {
-  const VALUE_FLAGS = /* @__PURE__ */ new Set(["-p", "--package", "-c", "--call", "--shell"]);
-  let index = 0;
-  while (index < args.length) {
-    const token = args[index];
-    if (token === void 0) return null;
-    if (VALUE_FLAGS.has(token)) {
-      index += 2;
-      continue;
-    }
-    if (token.startsWith("-")) {
-      index += 1;
-      continue;
-    }
-    return { executable: basenameToken(token), args: args.slice(index + 1) };
-  }
-  return null;
-}
-function moduleArg(args) {
-  for (let index = 0; index < args.length - 1; index += 1) {
-    if (args[index] === "-m") return args[index + 1] ?? null;
-  }
-  return null;
-}
-function isPythonExecutable(executable) {
-  return executable === "python" || executable === "python3" || /^python3\.\d+$/.test(executable);
-}
-function pathArgs(segment, commandIndex) {
-  const args = [];
-  let endOfOptions = false;
-  for (let index = commandIndex + 1; index < segment.length; index += 1) {
-    const token = segment[index];
-    if (token === void 0) continue;
-    if (!endOfOptions && token === "--") {
-      endOfOptions = true;
-      continue;
-    }
-    if (!endOfOptions && token.startsWith("-")) continue;
-    args.push(token);
-  }
-  return args;
-}
-function commandArgumentSegments(command) {
-  return splitSegments(scanShellLike(command)).map(shellCommandArguments);
-}
-function scanShellLike(command) {
-  const tokens = [];
-  let current = "";
-  let wordStart = null;
-  let quoted = false;
-  let quote = null;
-  const pushCurrent = (end) => {
-    if (wordStart === null) return;
-    tokens.push({ value: current, operator: false, quoted, start: wordStart, end });
-    current = "";
-    wordStart = null;
-    quoted = false;
-  };
-  for (let index = 0; index < command.length; index += 1) {
-    const char = command[index];
-    if (char === void 0) continue;
-    if (quote !== null) {
-      if (char === quote) {
-        quote = null;
-        continue;
-      }
-      if (quote === '"' && char === "\\" && index + 1 < command.length) {
-        const next = command[index + 1] ?? "";
-        if (next === "\n" || '$`"\\'.includes(next)) {
-          index += 1;
-          if (next !== "\n") current += next;
-          continue;
-        }
-      }
-      current += char;
-      continue;
-    }
-    if (char === "'" || char === '"') {
-      wordStart ??= index;
-      quoted = true;
-      quote = char;
-      continue;
-    }
-    if (char === "\\" && index + 1 < command.length) {
-      if (command[index + 1] !== "\n") {
-        wordStart ??= index;
-        quoted = true;
-        current += command[index + 1] ?? "";
-      }
-      index += 1;
-      continue;
-    }
-    if (char === "#" && wordStart === null) {
-      while (index + 1 < command.length && command[index + 1] !== "\n") index += 1;
-      continue;
-    }
-    if (/\s/.test(char)) {
-      pushCurrent(index);
-      if (char === "\n") tokens.push({ value: ";", operator: true, quoted: false, start: index, end: index + 1 });
-      continue;
-    }
-    if (";&|><".includes(char)) {
-      pushCurrent(index);
-      const three = command.slice(index, index + 3);
-      const two = command.slice(index, index + 2);
-      const value = SHELL_REDIRECTIONS.has(three) || COMMAND_SEPARATORS.has(three) ? three : SHELL_REDIRECTIONS.has(two) || COMMAND_SEPARATORS.has(two) ? two : char;
-      tokens.push({ value, operator: true, quoted: false, start: index, end: index + value.length });
-      index += value.length - 1;
-      continue;
-    }
-    wordStart ??= index;
-    current += char;
-  }
-  pushCurrent(command.length);
-  return tokens;
-}
-function splitSegments(tokens) {
-  const segments = [];
-  let current = [];
-  for (const token of tokens) {
-    if (token.operator && COMMAND_SEPARATORS.has(token.value)) {
-      if (current.length > 0) segments.push(current);
-      current = [];
-      continue;
-    }
-    current.push(token);
-  }
-  if (current.length > 0) segments.push(current);
-  return segments;
-}
-function commandTokenIndex(segment) {
-  let index = 0;
-  while (index < segment.length) {
-    const token = segment[index];
-    if (token === void 0) return null;
-    if (isEnvAssignment(token)) {
-      index += 1;
-      continue;
-    }
-    if (token === "env") {
-      index += 1;
-      while (index < segment.length && (segment[index]?.startsWith("-") === true || isEnvAssignment(segment[index] ?? ""))) {
-        index += 1;
-      }
-      continue;
-    }
-    if (SHELL_WRAPPERS.has(token)) {
-      index += 1;
-      while (index < segment.length && segment[index]?.startsWith("-") === true) index += 1;
-      continue;
-    }
-    return index;
-  }
-  return null;
-}
-function isEnvAssignment(token) {
-  return /^[A-Za-z_][A-Za-z0-9_]*=/.test(token);
-}
-function basenameToken(token) {
-  if (token === void 0) return "";
-  const normalized = token.replace(/\\/g, "/");
-  const basename = normalized.slice(normalized.lastIndexOf("/") + 1);
-  return basename.toLowerCase();
-}
-function artifactMap(artifacts) {
-  const out = /* @__PURE__ */ new Map();
-  for (const artifact of artifacts) {
-    const key = normalizePathKey(artifact.path);
-    if (key !== null) out.set(key, cloneArtifact(artifact));
-  }
-  return out;
-}
-function stateFromMap(artifacts) {
-  return {
-    artifacts: Array.from(artifacts.entries()).sort(([left], [right]) => compareStrings(left, right)).map(([, artifact]) => cloneArtifact(artifact))
-  };
-}
-function normalizedArtifacts(artifacts) {
-  const out = Array.from(artifactMap(artifacts).entries()).map(([key, artifact]) => ({ key, artifact }));
-  out.sort((left, right) => compareStrings(left.key, right.key));
-  return out;
-}
-function cloneArtifact(artifact) {
-  const cloned = {
-    path: artifact.path,
-    protectedAt: artifact.protectedAt,
-    reason: artifact.reason,
-    source: artifact.source
-  };
-  if (artifact.validationCommand !== void 0) cloned.validationCommand = artifact.validationCommand;
-  if (artifact.validationExitCode !== void 0) cloned.validationExitCode = artifact.validationExitCode;
-  return cloned;
-}
-function normalizePathKey(input) {
-  const trimmed = input.trim();
-  if (trimmed.length === 0) return null;
-  if (isWindowsAbsolutePath(trimmed) && path.sep !== "\\") {
-    return toSlashKey(path.win32.normalize(trimmed));
-  }
-  const resolved = path.isAbsolute(trimmed) ? trimmed : path.resolve(trimmed);
-  return toSlashKey(canonicalizeExistingPath(resolved));
-}
-function wildcardRootKey(input) {
-  const normalizedInput = toSlashKey(input.trim());
-  const firstWildcard = firstWildcardIndex(normalizedInput);
-  if (firstWildcard === null) return null;
-  const prefix = normalizedInput.slice(0, firstWildcard);
-  const slash = prefix.lastIndexOf("/");
-  const root = slash >= 0 ? prefix.slice(0, slash + 1) : ".";
-  return normalizePathKey(root);
-}
-function firstWildcardIndex(input) {
-  const indexes = ["*", "?", "["].map((char) => input.indexOf(char)).filter((index) => index >= 0);
-  if (indexes.length === 0) return null;
-  return Math.min(...indexes);
-}
-function isWindowsAbsolutePath(input) {
-  return /^[A-Za-z]:[\\/]/.test(input);
-}
-function toSlashKey(input) {
-  return input.replace(/\\/g, "/");
-}
-function isSameOrDescendant(candidate, parent) {
-  if (candidate === parent) return true;
-  const relative = path.posix.relative(parent, candidate);
-  return relative !== "" && !relative.startsWith("..") && !path.posix.isAbsolute(relative);
-}
-function compareMatches(left, right) {
-  return compareStrings(left.artifactPath, right.artifactPath) || compareStrings(left.commandPath, right.commandPath) || compareStrings(left.reason, right.reason);
-}
-function compareStrings(left, right) {
-  if (left < right) return -1;
-  if (left > right) return 1;
-  return 0;
-}
-
-export {
-  toolMutationPaths,
-  protectedArtifactMutationBlockReason,
-  protectArtifact,
-  detectValidationCommand,
-  extractCommandWriteTargets,
-  inlineShellScript,
-  extractCommandCdTargets,
-  extractCommandDeleteTargets,
-  invokesClioSkillMutation,
-  commandArgumentSegments,
-  scanShellLike
-};
-//# sourceMappingURL=chunk-M6TAYK66.js.map