@kitman-sh/cli 0.10.74 → 0.10.76

package/dist/{chunk-kd02wvfa.js → chunk-0e3t90fs.js}

@@ -12,30 +12,30 @@ import {
   orElseSucceed,
   decodeJsonString,
   encodePrettyJsonString
-} from "./chunk-d3ksv8y1.js";
-import"./chunk-rrnee9mk.js";
+} from "./chunk-jbwk6k6m.js";
+import"./chunk-545b129z.js";
 import {
   isJsonObject
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-tzz4fv17.js";
 import {
   FileSystem,
   Path
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   tomlTableHeader2,
   tomlKeyPath2,
   kitmanSkillEntry,
   isPathWithin2
-} from "./chunk-8bhea26e.js";
+} from "./chunk-e3dmkypq.js";
 import {
   instructionsStart,
   instructionsEnd,
   renderMcpServer,
   materializeKitSetup,
   tomlInline
-} from "./chunk-g4fvd8r1.js";
-import"./chunk-2v7pbpfw.js";
-import"./chunk-1rry0tsn.js";
+} from "./chunk-bcbne0ek.js";
+import"./chunk-fqhxxxmp.js";
+import"./chunk-98sg1yyd.js";
 
 // packages/agent-runtime/src/kit-setup-sync.ts
 class KitSyncError extends TaggedError("KitSyncError") {

package/dist/{chunk-x0ep0a1y.js → chunk-1zt1yeme.js}

@@ -1,5 +1,5 @@
 // @bun
-import"./chunk-1rry0tsn.js";
+import"./chunk-98sg1yyd.js";
 import {
   HERDR_CORE_GENERATION2,
   HERDR_CORE_INSTALL_COMMAND2,
@@ -12,9 +12,9 @@ import {
   herdrCoreLayer2,
   herdrCoreTransportLayer2,
   updateHerdrCore2
-} from "./chunk-g4fvd8r1.js";
-import"./chunk-dk0ftqwg.js";
-import"./chunk-d3ksv8y1.js";
+} from "./chunk-bcbne0ek.js";
+import"./chunk-xb70ys3n.js";
+import"./chunk-jbwk6k6m.js";
 export {
   HERDR_CORE_GENERATION2 as HERDR_CORE_GENERATION,
   HERDR_CORE_INSTALL_COMMAND2 as HERDR_CORE_INSTALL_COMMAND,

package/dist/{chunk-5rs3yv84.js → chunk-225qhz3b.js}

@@ -85,7 +85,7 @@ import {
   decodeJsonString,
   encodeJsonStringSync,
   encodePrettyJsonString
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   tap,
   mapError,
@@ -97,7 +97,7 @@ import {
   withDefault,
   option,
   String2
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   currentTimeMillis,
   SecureRandom,
@@ -197,10 +197,10 @@ import {
   harnessNames,
   herdrRunnerCapabilities2,
   declaredChecks
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 import {
   Id
-} from "./chunk-rrnee9mk.js";
+} from "./chunk-545b129z.js";
 import {
   toJsonValue,
   isOneOf,
@@ -210,11 +210,11 @@ import {
   isObject,
   isJsonObject,
   isString
-} from "./chunk-v01c0k6j.js";
+} from "./chunk-tzz4fv17.js";
 import {
   ChildProcessSpawner,
   make3
-} from "./chunk-1rry0tsn.js";
+} from "./chunk-98sg1yyd.js";
 
 // apps/cli/src/cli-error.ts
 function cliErrorCode(error, status) {
@@ -504,10 +504,10 @@ var checkDockerImageSetting = pinnedImage;
 var checkRegistryImageSetting = pinnedImage;
 var herdrCoreSession = (runnerId, personal) => personal ? undefined : `kitman-${sha2562(runnerId).slice(0, 16)}`;
 var OpenHerdrCore = Reference("kitman/cli/OpenHerdrCore", {
-  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-x0ep0a1y.js")), ({ HerdrCore, herdrCoreLayer }) => provide3(service(HerdrCore), herdrCoreLayer(options)))
+  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-1zt1yeme.js")), ({ HerdrCore, herdrCoreLayer }) => provide3(service(HerdrCore), herdrCoreLayer(options)))
 });
 var UpdateHerdrCore = Reference("kitman/cli/UpdateHerdrCore", {
-  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-x0ep0a1y.js")), (module) => module.updateHerdrCore(options))
+  defaultValue: () => (options) => flatMap3(promise(() => import("./chunk-1zt1yeme.js")), (module) => module.updateHerdrCore(options))
 });
 var herdrCoreMissing = (error) => {
   if (isTagged(error, "HerdrCoreMissing"))
@@ -733,7 +733,7 @@ var syncTargets = (harness) => gen(function* () {
 });
 var syncKits = (input) => gen(function* () {
   const fs = yield* FileSystem;
-  const { syncKitSetup } = yield* promise(() => import("./chunk-kd02wvfa.js"));
+  const { syncKitSetup } = yield* promise(() => import("./chunk-0e3t90fs.js"));
   const harnesses = yield* syncTargets(input.harness);
   const chain = yield* input.client.getKitChain(input.workspaceId);
   for (const { name, problem } of chain.skipped)
@@ -1651,7 +1651,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.10.74";
+var cliVersion = "0.10.76";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1901,7 +1901,7 @@ var Usage = [
   "Every run, loop, agent, verify, constraint, secret, claim, deploy, dev and kit command takes --json."
 ].join(`
 `);
-var agentRuntime = promise(() => import("./chunk-rt94p780.js"));
+var agentRuntime = promise(() => import("./chunk-89547s8p.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -2777,7 +2777,7 @@ var SandboxHostProbe = Reference("kitman/cli/SandboxHostProbe", {
 });
 var OpenRunnerRpc = Reference("kitman/cli/OpenRunnerRpc", {
   defaultValue: () => (options) => gen(function* () {
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-mzphfkyk.js"));
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-h3y4z2c0.js"));
     return yield* makeRunnerRpcClient({
       runnerId: options.runnerId,
       bearer: options.bearer,
@@ -3161,7 +3161,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-3ne401fy.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-f0stxany.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -4372,9 +4372,9 @@ function claimCommand(args) {
     }
   });
 }
-var KitWriter = map8(promise(() => import("./chunk-mv288r6q.js")), (build) => build.writeKit);
+var KitWriter = map8(promise(() => import("./chunk-z7p5y767.js")), (build) => build.writeKit);
 var KitBuilder = Reference("kitman/cli/KitBuilder", {
-  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-mv288r6q.js")), (build) => build.buildKit(directory))
+  defaultValue: () => (directory) => flatMap3(promise(() => import("./chunk-z7p5y767.js")), (build) => build.buildKit(directory))
 });
 var uploadKit = (client, workspaceId, built) => gen(function* () {
   yield* client.uploadKitBundle(workspaceId, built.digest, { bundle: encode2(built.bundle) });

package/dist/{chunk-ggax0n15.js → chunk-3teaa3qx.js}

@@ -96,7 +96,7 @@ import {
   Defect,
   Exit,
   toCodecJson
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 import {
   interrupt,
   getCurrent,
@@ -108,7 +108,7 @@ import {
   shutdownUnsafe,
   fromQueue,
   unwrap
-} from "./chunk-dk0ftqwg.js";
+} from "./chunk-xb70ys3n.js";
 import {
   Clock,
   empty,
@@ -123,7 +123,7 @@ import {
   ParseOptions,
   RpcClientDefect,
   RpcClientError
-} from "./chunk-g4fvd8r1.js";
+} from "./chunk-bcbne0ek.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/workers/Transferable.js
 class Collector extends (/* @__PURE__ */ Service2()("effect/workers/Transferable/Collector")) {

package/dist/{chunk-rrnee9mk.js → chunk-545b129z.js}

@@ -18,7 +18,7 @@ import {
   isMinLength,
   isMaxLength,
   FiniteFromString
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/JsonSchema.js
 var PRE_2020_TO_2020_COLLISIONS = ["$anchor", "$defs", "$dynamicAnchor", "$dynamicRef", "$vocabulary", "contentSchema", "dependentRequired", "dependentSchemas", "maxContains", "minContains", "prefixItems", "unevaluatedItems", "unevaluatedProperties"];
@@ -115,9 +115,42 @@ var SecretScope = Union([Literal("workspace"), Literal("team")]);
 var SecretHost = String4.check(isPattern(new RegExp("^(\\*\\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$", "u")), isMaxLength(260));
 var SecretHosts = ArraySchema(SecretHost).check(isMaxLength(32));
 var secretReference = (owner, name) => `secret://${owner}/${name}`;
-var referencePattern = /secret:\/\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+/g;
-var replaceSecretReferences = (text, swap) => text.replace(referencePattern, swap);
-var secretReferencesIn = (text) => [...new Set(text.match(referencePattern) ?? [])];
+var referencePattern = /secret:\/\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+/;
+var placeholderMarker = "kitmanref";
+var tokenCharacter = "[A-Za-z0-9._~+/-]";
+var copilotEndpoint = /(?:^|;)(proxy-ep=[A-Za-z0-9.-]+)(?:;|$)/;
+var placeholderPattern = new RegExp(`(?<!${tokenCharacter})(?:proxy-ep=[A-Za-z0-9.-]+;)?${tokenCharacter}*${placeholderMarker}((?:[0-9a-f]{2})+)`);
+var anyReference = new RegExp(`${referencePattern.source}|${placeholderPattern.source}`, "g");
+var hex = (text) => [...new TextEncoder().encode(text)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+var unhex = (text) => new TextDecoder().decode(Uint8Array.from(text.match(/../g) ?? [], (pair) => Number.parseInt(pair, 16)));
+var isReference = (text) => new RegExp(`^${referencePattern.source}$`).test(text);
+var tokenPrefix = /^(?:sk-ant-[a-z]+[0-9]*-|sk-proj-|sk-or-v[0-9]+-|sk-|ya29\.|gh[opsu]_|github_pat_|xai-|gsk_|AIza)/;
+var secretPlaceholder = (token, reference) => {
+  const marker = `${placeholderMarker}${hex(reference)}`;
+  const jwt = /^([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.)[A-Za-z0-9_-]*$/.exec(token);
+  if (jwt !== null)
+    return `${jwt[1]}${marker}`;
+  const endpoint = copilotEndpoint.exec(token);
+  if (endpoint !== null)
+    return `${endpoint[1]};${marker}`;
+  return `${tokenPrefix.exec(token)?.[0] ?? ""}${marker}`;
+};
+var referenceOf = (match, encoded) => {
+  if (encoded === undefined)
+    return match;
+  const reference = unhex(encoded);
+  return isReference(reference) ? reference : undefined;
+};
+var replaceSecretReferences = (text, swap) => text.replace(anyReference, (match, encoded) => {
+  const reference = referenceOf(match, encoded);
+  return reference === undefined ? match : swap(reference);
+});
+var secretReferencesIn = (text) => [
+  ...new Set([...text.matchAll(anyReference)].flatMap((match) => {
+    const reference = referenceOf(match[0], match[1]);
+    return reference === undefined ? [] : [reference];
+  }))
+];
 var SecretSummary = Struct({
   name: SecretName,
   scope: SecretScope,
@@ -135,4 +168,4 @@ var SecretSet = Struct({
 });
 var SecretScopeQuery = Struct({ teamId: optionalKey(Id) });
 
-export { isDateTime, Numeric, isWholeNumber, guard, Id, Timestamp, ActorType, SecretName, SecretScope, SecretHosts, secretReference, replaceSecretReferences, secretReferencesIn };
+export { isDateTime, Numeric, isWholeNumber, guard, Id, Timestamp, ActorType, SecretName, SecretScope, SecretHosts, secretReference, secretPlaceholder, replaceSecretReferences, secretReferencesIn };

package/dist/{chunk-q3c7vmby.js → chunk-76ctrqm6.js}

@@ -3,7 +3,7 @@ import {
   Random,
   succeed6,
   withFiber2
-} from "./chunk-d3ksv8y1.js";
+} from "./chunk-jbwk6k6m.js";
 
 // node_modules/.bun/effect@4.1.2/node_modules/effect/dist/Random.js
 var Random2 = Random;