@kodax-ai/kodax 0.7.96-beta.8 → 0.7.96-rc.1

package/CHANGELOG.md

@@ -8,6 +8,56 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.96-rc.1] - 2026-09-12
+
+First release candidate of the v0.7.96 line: trusted text authority is
+unified across Runtime Sessions and direct SDK entries, and provider requests
+carry live permission facts. Every beta.9 contract is retained. npm
+publication remains a manual maintainer action.
+
+### Fixed
+
+- Unify trusted text authority across Runtime Sessions and direct SDK entries.
+  Full Access now reaches native text transactions through `runKodaX`,
+  `runManagedTask`, and each `KodaXClient.send`. Auto-approved concrete text
+  calls can write their exact external target, including portable `tool_call`
+  dispatch, without granting a directory or reusing approval across operations
+  or Runs. Explicit denials and native integrity checks remain enforced.
+- Include live host permission facts in direct and managed provider requests,
+  including retries, independently of configuration defaults and prompt
+  overrides. Runtime permission capability 6 fences older daemon authority.
+
+---
+
+## [0.7.96-beta.9] - 2026-09-12
+
+Ninth beta pre-release of the v0.7.96 line, carrying FEATURE_299 (unified
+Stop, Full Access and extension execution contracts) plus a legacy-metadata
+paging fix. Every beta.8 contract is retained. npm publication remains a
+manual maintainer action.
+
+### Added
+
+- FEATURE_299: unified Stop, Full Access and extension execution contracts.
+  Owned Run controls and atomic Session Stop work independently of file locks
+  across direct CLI, SDK, daemon, and ACP hosts with a single acceptance-versus-
+  confirmation Stop contract. Full Access executes directly on the host without
+  sandbox or approval prompts and without built-in dangerous-command fallbacks,
+  while explicit forbidden rules stay enforced and prompt rules are rejected
+  under Never approval semantics; `kodax execpolicy check --mode full-access`
+  inspects that profile without running it. Managed extensions gain an
+  execution contract with reload isolation, runtime/session separation, and
+  lock-independent effects.
+
+### Fixed
+
+- Legacy large metadata no longer breaks Conversation continuation:
+  `readConversationPageAdmission` pages oversized `actorSnapshot` metadata
+  instead of misreading a >=64 KiB first line as `data_corrupt`, so
+  snapshot-backed pages continue across the previous failure boundary.
+
+---
+
 ## [0.7.96-beta.8] - 2026-09-11
 
 Eighth beta pre-release of the v0.7.96 line: an explicit, audited opt-in for

package/README.md

@@ -784,6 +784,28 @@ provider's model, REPL `/compact` clears the UI only after a durable save, and
 successful reports carry bounded `summaryRequests` plus `commitMs` per
 physical summary call.
 
+**v0.7.96-rc.1 release:** First release candidate of the v0.7.96 line.
+Unifies trusted text authority across Runtime Sessions and direct SDK
+entries: Full Access reaches native text transactions through `runKodaX`,
+`runManagedTask`, and each `KodaXClient.send`; auto-approved concrete text
+calls write their exact external target, including portable `tool_call`
+dispatch, without granting a directory or reusing approval across operations
+or Runs; explicit denials and native integrity checks remain enforced.
+Direct and managed provider requests carry live host permission facts,
+refreshed on retries, and runtime permission capability 6 fences older
+daemon authority.
+
+**v0.7.96-beta.9 release:** Ships FEATURE_299 — unified Stop, Full Access
+and extension execution contracts. Owned Run controls and atomic Session
+Stop work independently of file locks across direct CLI, SDK, daemon, and
+ACP hosts under a single acceptance-versus-confirmation Stop contract.
+Full Access executes directly on the host without sandbox, approval prompts,
+or built-in dangerous-command fallbacks while explicit forbidden rules stay
+enforced; `kodax execpolicy check --mode full-access` inspects that profile
+without running it. Managed extensions gain an execution contract with
+reload isolation, and legacy oversized `actorSnapshot` metadata pages
+correctly instead of failing Conversation continuation.
+
 **v0.7.96-beta.8 release:** Adds `runtime.sessions.confirmIdentityAlias`
 for explicitly confirmed legacy interrupt identities: registration verifies
 the original delivery receipt and session revision, preserves an immutable
@@ -849,7 +871,7 @@ requests, preserves structured Child Agent Provider failures, honors exact
 run-scoped credential verification, and omits empty `tools` arrays for strict
 vLLM gateways (Issues 329-332). npm publication remains a
 manual maintainer action. See the
-[release checklist](docs/release.md#v0796-beta8-release-preparation).
+[release checklist](docs/release.md#v0796-rc1-release-preparation).
 
 **v0.7.96-alpha.3 release:** Provider credentials are lazy, scoped,
 revocable capabilities (ADR-068). The v2 credential broker keeps Provider
@@ -1137,7 +1159,7 @@ Exec Policy and the Edits user decision or Auto[LLM] reviewer. Auto review has
 fixed 90/180-second attempt bounds and never falls back to Rules, Edits, or an
 automatic user prompt. Full Access samples the profile once per Bash call and
 runs directly on the host without sandbox or approval prompts. Explicit
-forbidden rules and the Codex dangerous-command policy still block. Runtime permission prompts
+forbidden rules still block; built-in dangerous-command fallbacks do not apply. Runtime permission prompts
 offer opaque, exact
 allow-once/session/persistent grant suggestions; persistent grants are
 daemon-owned and revisioned. Host plan exit is exposed only when the host
@@ -1648,7 +1670,7 @@ KodaX provides 4 permission profiles:
 | `plan` | Read-only planning mode | All modification tools blocked |
 | `accept-edits` | Sandbox-first edits; user decides an exact host boundary | Host-boundary operations |
 | `auto` | Sandbox-first execution; LLM reviews an exact host boundary | No automatic prompt; denied calls return a safer-route reason |
-| `full-access` | Direct host execution without sandbox or approval prompts | Never prompts; explicit forbidden/dangerous policy can block |
+| `full-access` | Direct host execution without sandbox or approval prompts | Explicit forbidden/prompt rules still block; no built-in dangerous-command fallback |
 
 ```bash
 # In REPL, use /mode command
@@ -1676,10 +1698,10 @@ KodaX provides 4 permission profiles:
 - Shift-Tab cycles `Plan -> Edits -> Auto[LLM] -> Full Access`; Shift+Enter
   inserts a newline. Legacy `auto-in-project` and Auto[RULES] state normalize
   to Auto[LLM] and are never persisted again.
-- Full Access skips sandbox and all approval paths. Explicit forbidden rules
-  and the Codex dangerous-command policy remain enforced; an Exec Policy
+- Full Access skips sandbox, all approval paths, and built-in dangerous-command
+  fallbacks. Explicit forbidden rules remain enforced; an Exec Policy
   `prompt` rule is rejected under Never approval semantics. Use
-  `kodax execpolicy check -- <command>` to inspect host policy without running it.
+  `kodax execpolicy check --mode full-access -- <command>` to inspect that profile without running it.
 - Runtime-backed prompts can offer exact `allow once`, `allow this session`,
   and `always allow` choices. Return the Runtime-issued opaque suggestion;
   never derive or widen a permission rule from the displayed command or path.

package/README_CN.md

@@ -296,6 +296,21 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
+**v0.7.96-rc.1 发布**：v0.7.96 线首个发布候选。统一 Runtime Session 与直接
+SDK 入口的可信文本授权：Full Access 通过 `runKodaX`、`runManagedTask` 与每个
+`KodaXClient.send` 覆盖原生文本事务；自动批准的具体文本调用可写入其确切外部
+目标（包括可移植的 `tool_call` 分发），但不授予目录权限，也不会跨操作或跨 Run
+复用批准；显式拒绝与原生完整性校验继续生效。直接与托管 provider 请求携带实时
+宿主权限事实并在重试时刷新，runtime 权限 capability 6 阻止旧 daemon 提供该授权。
+
+**v0.7.96-beta.9 发布**：交付 FEATURE_299——统一 Stop、Full Access 与扩展
+执行契约。owned Run 控制与原子 Session Stop 不依赖文件锁，跨直接 CLI、SDK、
+daemon 与 ACP 宿主在单一"受理 vs 确认"Stop 契约下工作。Full Access 直接在
+宿主执行，无沙箱、无审批提示、不套用内置危险命令回退，同时显式禁止规则
+仍然生效；`kodax execpolicy check --mode full-access` 可在不执行的情况下
+检查该 profile。托管扩展获得带重载隔离的执行契约；超大 legacy
+`actorSnapshot` 元数据正确分页，不再中断 Conversation 续读。
+
 **v0.7.96-beta.8 发布**：新增 `runtime.sessions.confirmIdentityAlias`，
 用于显式确认的遗留中断标识：注册时验证原始投递回执与 session revision，
 保留不可变审计记录并拒绝竞争声明。别名跨保存、压缩、重启与分页生效；
@@ -361,8 +376,7 @@ native 文本权威改在摘要固定的 `manylinux_2_28` 构建器中编译，
 scope 在 SDK、Agent 摘要、CLI 与 Runtime Worker 请求间共享，保留结构化的 Child Agent Provider
 失败信息，精确遵循 run-scoped 凭据校验，并为严格 vLLM 网关省略空 `tools` 数组（Issues 329-332）。
 npm 发布仍由
-npm 发布仍由
-维护者手动执行。详见 [v0.7.96-beta.8 发布清单](docs/release.md#v0796-beta8-release-preparation)。
+维护者手动执行。详见 [v0.7.96-rc.1 发布清单](docs/release.md#v0796-rc1-release-preparation)。
 
 **v0.7.96-alpha.3 发布**：Provider 凭据成为惰性、受限、可撤销的能力（ADR-068）。v2
 credential broker 将 Provider 密钥保留在 OS keychain，按每次 wire call、为单一封闭
@@ -559,8 +573,9 @@ CLI 也会在配置的 deadline 被终止。详见
 **v0.7.96 权限契约：**权限档位统一为 `Plan -> Edits -> Auto[LLM] -> Full Access`。
 Edits 与 Auto 先尝试 sandbox；成功即静默完成，只有启动前拒绝或 backend 不可用
 才在 Exec Policy 后进入用户/LLM 宿主边界。每次 Bash 调用只在入口读取一次权限档位；
-Full Access 直接在宿主执行，不经过 sandbox、reviewer 或授权弹窗。显式 forbidden 规则
-与 Codex dangerous-command policy 仍可阻断，Exec Policy `prompt` 在 Never 语义下直接拒绝。
+Full Access 直接在宿主执行，不经过 sandbox、reviewer 或授权弹窗，也不应用内置危险命令兜底。
+用户、管理员和受信项目的显式 forbidden 规则仍生效，Exec Policy `prompt` 在 Never 语义下直接拒绝。
+拒绝结果以 JSON 返回来源、规则和处理方式；模型不得将其误称为机器限制或改写脚本绕过。
 旧 `auto-in-project`
 和 Auto[RULES] 状态只做读取兼容并归一到 Auto[LLM]；`/auto-engine` 已移除。
 Reviewer 首次 90 秒，只有 timeout/provider/无效输出会再试一次 180 秒；普通失败

package/config-templates/config.example.jsonc

@@ -39,8 +39,9 @@
   // Agent harness: "ama" enables adaptive multi-agent use; "sa" forces one
   // agent. Permission profiles are "plan", "accept-edits", sandbox-first
   // "auto", or direct-host "full-access". Full Access has no sandbox or
-  // approval prompts; explicit forbidden and Codex dangerous-command policy
-  // still block. Exec Policy is separate:
+  // approval prompts; built-in dangerous-command fallbacks do not apply.
+  // Explicit forbidden rules still block; explicit prompt rules cannot prompt.
+  // Exec Policy is separate:
   // ~/.kodax/exec-policy.jsonc (and explicitly trusted project policy).
   // "agentMode": "ama",
   // "permissionMode": "accept-edits",

package/dist/chunks/{agent-XBT4ZUCG.js → agent-4SHG4ZF3.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Aa as e,Ba as f,Ra as g,Ta as h,a as c,hb as i,ib as j,qb as k,za as d}from"./chunk-ZMXVACRD.js";import"./chunk-JA2DY4EC.js";import"./chunk-KHPUDIG7.js";import"./chunk-5KG5LAUO.js";import"./chunk-Y6VGGIKD.js";import{Ob as a,Pb as b}from"./chunk-F7JMG426.js";import"./chunk-WXBRPZMI.js";import"./chunk-V7ZTP5SV.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{La as g,Na as h,a as c,ha as d,ia as e,ja as f,lb as i,mb as j,ub as k}from"./chunk-5RFHTNGM.js";import"./chunk-JA2DY4EC.js";import"./chunk-Z6QJ23NH.js";import"./chunk-5Z7OAIPW.js";import"./chunk-NYKZ6Z2Q.js";import{Ob as a,Pb as b}from"./chunk-P472TI5T.js";import"./chunk-WXBRPZMI.js";import"./chunk-V7ZTP5SV.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-2PP5RVZL.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ma as a,Na as b}from"./chunk-R5XC57MT.js";import"./chunk-YDHLWJ2G.js";import"./chunk-74UJ5IFX.js";import"./chunk-5TAC6EP7.js";import"./chunk-KVL2URPE.js";import"./chunk-N7UOIQZ3.js";import"./chunk-5RFHTNGM.js";import"./chunk-JA2DY4EC.js";import"./chunk-Z6QJ23NH.js";import"./chunk-5Z7OAIPW.js";import"./chunk-NYKZ6Z2Q.js";import"./chunk-P472TI5T.js";import"./chunk-WXBRPZMI.js";import"./chunk-V7ZTP5SV.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/{chunk-57PKLDQI.js → chunk-3C6UWDAN.js}

@@ -1,5 +1,5 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{a as hn,b as vn,c as De,d as xn,e as kn,f as En,g as cr,h as Rn,k as en,l as lr,m as ur,n as fr,o as nn,p as wr}from"./chunk-JBOJY7LE.js";import{Fc as dr,Ka as me,Ya as rr,_a as tr,ab as xe,bb as or,fb as Sn,hb as ke,kb as Oe,ob as ir,pb as sr,rb as ar,v as L}from"./chunk-F7JMG426.js";import{a}from"./chunk-ONUPGMER.js";import{spawn as qe,spawnSync as we}from"node:child_process";import{createHash as Xe,randomInt as jt,randomUUID as B}from"node:crypto";import{once as Ut}from"node:events";import{closeSync as Dn,constants as an,existsSync as qn,fsyncSync as Ft,lstatSync as ae,mkdirSync as qr,openSync as Xr,readFileSync as Ie,readSync as Vt,readdirSync as Jr,realpathSync as K,renameSync as Kt,rmSync as un,statSync as _e,writeFileSync as Hr,writeSync as qt}from"node:fs";import{copyFile as zr,lstat as Xt,mkdir as ne,readFile as Me,realpath as je,rm as H,stat as dn,writeFile as Ue}from"node:fs/promises";import{createRequire as Jt}from"node:module";import{createServer as Ht}from"node:net";import U from"node:os";import l from"node:path";import{lstatSync as vt,readFileSync as xt,readdirSync as pr,realpathSync as kt}from"node:fs";import C from"node:path";import{globSync as Et}from"glob";var Rt=[".ssh",".tsh",".brev",".gnupg",".aws",".azure",".kube",".docker",".config",".npm",".pki",".terraform.d"],At=new Set(["certificatefile","controlpath","globalknownhostsfile","identityagent","identityfile","revokedhostkeys","userknownhostsfile"]);function oe(e){try{return kt.native(e).toLowerCase()}catch(r){return["ENOENT","ENOTDIR"].includes(r.code??"")||L({source:"sandbox:ssh-config",level:"warn",message:`Cannot canonicalize SSH ACL path: ${e}`,detail:r}),C.resolve(e).toLowerCase()}}a(oe,"pathKey");function gr(e,r){return r===e||r.startsWith(e.endsWith(C.sep)?e:`${e}${C.sep}`)}a(gr,"inside");function Wt(e){let r=[],n="",t;for(let o=0;o<e.length;o+=1){let i=e[o];if(i==="#"&&t===void 0)break;if(i===t){t=void 0;continue}if((i==='"'||i==="'")&&t===void 0){t=i;continue}let s=e[o+1];i==="\\"&&s!==void 0&&(['"',"'","\\"].includes(s)||t===void 0&&s===" ")?(n+=s,o+=1):/\s/.test(i)&&t===void 0?(n&&r.push(n),n=""):n+=i}return n&&r.push(n),r}a(Wt,"sshWords");function Ct(e,r,n){if(e.toLowerCase()==="none")return;if(["~","%d","${HOME}"].includes(e))return r;let t=e.replace(/^(?:~|%d|\$\{HOME\})[/\\]/,`${r}${C.sep}`);return C.isAbsolute(t)?C.resolve(t):n===void 0?void 0:C.resolve(n,t)}a(Ct,"sshPath");function An(e,r,n,t,o=0){let i=oe(e);if(t.has(i))return;if(o>=32){L({source:"sandbox:ssh-config",level:"warn",message:`SSH Include depth limit reached; dependencies beyond this config were not inspected: ${e}`});return}t.add(i);let s;try{s=xt(e,"utf8")}catch(d){if(d.code==="ENOENT")return;L({source:"sandbox:ssh-config",level:"warn",message:`Cannot inspect SSH configuration dependencies: ${e}`,detail:d});return}for(let d of s.split(/\r?\n/)){let c=Wt(d.replace(/^(\s*[^\s=]+)\s*=\s*/,"$1 ")),u=c.shift()?.toLowerCase();if(u!==void 0)for(let f of c){let p=Ct(f,r,u==="include"?C.join(r,".ssh"):void 0);if(p!==void 0)if(u==="include")for(let g of Et(p.replace(/\\/g,"/"),{nodir:!0}))n.push(g),An(g,r,n,t,o+1);else At.has(u)&&n.push(p)}}}a(An,"visitSshConfig");function de(e){let r=[];An(C.join(e,".ssh","config"),e,r,new Set);let n=oe(e),t=Rt.map(o=>C.join(e,o));for(let o of r){let i=C.relative(n,oe(o));i&&!i.startsWith(`..${C.sep}`)&&i!==".."&&!C.isAbsolute(i)&&t.push(C.join(e,i.split(C.sep)[0]))}return[...new Set(t.map(o=>C.resolve(o)))]}a(de,"windowsSandboxAclExclusions");function mr(e){let r=[];An(C.join(e,".ssh","config"),e,r,new Set);let n=[C.join(e,".ssh")];for(;n.length>0;){let t=n.pop();r.push(t);let o;try{if(vt(t).isSymbolicLink())continue;o=pr(t,{withFileTypes:!0})}catch(i){if(i.code==="ENOENT")continue;throw i}for(let i of o){if(i.isSymbolicLink())continue;let s=C.join(t,i.name);r.push(s),i.isDirectory()&&n.push(s)}}return[...new Set(r.filter(t=>gr(oe(e),oe(t))))]}a(mr,"windowsSandboxSshCleanupRoots");function Ee(e,r,n){let t=oe(r),o=n.flatMap(s=>[C.resolve(s).toLowerCase(),oe(s)]),i=e.flatMap(s=>oe(s)===t?pr(r,{withFileTypes:!0}).filter(d=>!d.isSymbolicLink()).map(d=>C.join(r,d.name)):[s]);return[...new Set(i)].filter(s=>![C.resolve(s).toLowerCase(),oe(s)].some(c=>o.some(u=>gr(u,c))))}a(Ee,"windowsSandboxAclRoots");import{fileURLToPath as _r,pathToFileURL as Yr}from"node:url";import{realpathSync as Pt,statSync as Nt}from"node:fs";import _t from"node:path";function Wn(e){let r=e.code;return r==="ENOENT"||r==="ENOTDIR"}a(Wn,"isMissingGitTrustPath");function br(e,r,n){try{let t=r(e).replaceAll("\\","/").replace(/\/+$/,"");return t===""?void 0:/^[A-Za-z]:$/.test(t)?`${t}/`:t}catch(t){if(n(t))return;throw t}}a(br,"normalizeGitSafeDirectoryRootImplementation");function Tt(e){return br(e,Pt,Wn)}a(Tt,"normalizeGitSafeDirectoryRoot");function Sr(e,r,n,t){try{let i=r(n.join(e,".git"));if(i.isDirectory()||i.isFile())return!0}catch(i){if(!t(i))throw i}if(!(n.basename(e).toLowerCase()===".git"||/[/\\]\.git[/\\]modules[/\\]/i.test(e)))return!1;try{return r(n.join(e,"HEAD")).isFile()}catch(i){if(t(i))return!1;throw i}}a(Sr,"isRepoBearingGitReadRootImplementation");function It(e){return Sr(e,Nt,_t,Wn)}a(It,"isRepoBearingGitReadRoot");function hr(e,r,n,t,o){let i=[];typeof e=="string"&&e!==""&&i.push(e);for(let c of n??[])o(c)&&i.push(c);i.push(...r??[]);let s=[],d=new Set;for(let c of i){if(s.length>=8)break;let u=t(c);if(u===void 0)continue;let f=u.toLowerCase();d.has(f)||(d.add(f),s.push(u))}return s}a(hr,"windowsGitTrustRootsImplementation");function vr(e,r,n){return hr(e,r,n,Tt,It)}a(vr,"windowsGitTrustRoots");function xr(e){if(e==="git_config_count")return"count";if(/^git_config_key_\d+$/.test(e))return"key";if(/^git_config_value_\d+$/.test(e))return"value"}a(xr,"gitConfigEnvKind");function Ot(e,r,n,t,o){let i=new Map,s=[],d,c=!1;for(let u=0;u<r;u+=1){if(e[u]!=="--env"||u+1>=r)continue;let f=e[u+1],p=f.indexOf("="),g=(p<0?f:f.slice(0,p)).toLowerCase(),w=n(g);if(w===void 0)continue;c=!0,s.push(u);let m=p<0?"":f.slice(p+1);if(w==="count"){let W=Number.parseInt(m,10);(d!==void 0||!Number.isSafeInteger(W)||W<0||String(W)!==m)&&t(),d=W;continue}let S=Number.parseInt(g.slice(`git_config_${w}_`.length),10),h=i.get(S)??{};(!Number.isSafeInteger(S)||S<0||h[w]!==void 0)&&t(),h[w]=m,i.set(S,h)}return o(i,s,d,c,t)}a(Ot,"parseGitConfigEnvironmentImplementation");function rn(){throw new Error("ASRT GIT_CONFIG environment has an unexpected shape.")}a(rn,"throwUnexpectedGitConfigShape");function kr(e,r,n,t,o){!t||n!==void 0&&e.size===n&&[...e].every(([d,c])=>d<n&&c.key!==void 0&&c.value!==void 0)||o();let s=[...e].map(([d,c])=>({slot:d,key:c.key,value:c.value}));return{argumentIndices:r,pairs:s,sawAny:t}}a(kr,"finishParsedGitConfigEnvironment");function Er(e,r){let n=[];for(let o of e)n.push({key:"safe.directory",value:o},{key:"safe.directory",value:`${o}/*`});n.push(...r);let t=n.flatMap((o,i)=>[`GIT_CONFIG_KEY_${i}=${o.key}`,`GIT_CONFIG_VALUE_${i}=${o.value}`]);return t.push(`GIT_CONFIG_COUNT=${n.length}`),t}a(Er,"gitSafeDirectoryAssignments");function yr(e,r){let n=[],t=new Set;for(let[o,i]of Object.entries(e)){if(i===void 0)continue;if(o===""||o.includes("=")||o.includes("\0")||i.includes("\0"))throw new Error(`Invalid ${r} environment entry.`);let s=o.toUpperCase();if(t.has(s))throw new Error(`Ambiguous ${r} environment variable: ${o}.`);t.add(s),n.push([o,i])}return n}a(yr,"validatedEnvironmentEntries");function Dt(e,r){let n=new Map,t=[],o,i=!1;for(let[u,f]of Object.entries(e)){let p=u.toLowerCase(),g=xr(p);if(g===void 0){t.push([u,f]);continue}if(i=!0,g==="count"){let S=Number.parseInt(f,10);(o!==void 0||!Number.isSafeInteger(S)||S<0||String(S)!==f)&&rn(),o=S;continue}let w=Number.parseInt(p.slice(`git_config_${g}_`.length),10),m=n.get(w)??{};(!Number.isSafeInteger(w)||w<0||m[g]!==void 0)&&rn(),m[g]=f,n.set(w,m)}let d=kr(n,[],o,i,rn).pairs.filter(u=>u.key.toLowerCase()!=="safe.directory").sort((u,f)=>u.slot-f.slot),c=Object.fromEntries(t);for(let u of Er(r,d)){let f=u.indexOf("=");c[u.slice(0,f)]=u.slice(f+1)}return c}a(Dt,"rewriteWindowsGitSafeDirectoryEnvironment");function Rr(e,r,n){let t=yr(e,"ASRT-controlled"),o=yr(r,"Windows target"),i=new Map;for(let s of t)i.set(s[0].toUpperCase(),s);for(let s of o){let d=s[0].toUpperCase();i.has(d)&&d!=="PATH"&&d!=="PATHEXT"||i.set(d,s)}return Dt(Object.fromEntries(i.values()),n)}a(Rr,"mergeWindowsSandboxTargetEnvironment");function Lt(e,r,n,t){let o=new Set(n.argumentIndices),i=[],s=!1;for(let d=0;d<e.length;d+=1)if(o.has(d)){if(!s){for(let c of t)i.push("--env",c);s=!0}d+=1}else i.push(e[d]);return n.sawAny||i.splice(r,0,...t.flatMap(d=>["--env",d])),i}a(Lt,"replaceGitConfigEnvironment");function Bt(e,r,n,t,o){let i=e.lastIndexOf("--");if(i<0)throw new Error("ASRT Windows wrapper omitted its child separator.");let s=n(e,i),d=s.pairs.filter(u=>u.key.toLowerCase()!=="safe.directory").sort((u,f)=>u.slot-f.slot),c=t(r,d);return o(e,i,s,c)}a(Bt,"rewriteWindowsGitSafeDirectoryArgvImplementation");function Ar(){return String.raw`
+import{a as hn,b as vn,c as De,d as xn,e as kn,f as En,g as cr,h as Rn,k as en,l as lr,m as ur,n as fr,o as nn,p as wr}from"./chunk-6EFXA3RL.js";import{Fc as dr,Ka as me,Ya as rr,_a as tr,ab as xe,bb as or,fb as Sn,hb as ke,kb as Oe,ob as ir,pb as sr,rb as ar,v as L}from"./chunk-P472TI5T.js";import{a}from"./chunk-ONUPGMER.js";import{spawn as qe,spawnSync as we}from"node:child_process";import{createHash as Xe,randomInt as jt,randomUUID as B}from"node:crypto";import{once as Ut}from"node:events";import{closeSync as Dn,constants as an,existsSync as qn,fsyncSync as Ft,lstatSync as ae,mkdirSync as qr,openSync as Xr,readFileSync as Ie,readSync as Vt,readdirSync as Jr,realpathSync as K,renameSync as Kt,rmSync as un,statSync as _e,writeFileSync as Hr,writeSync as qt}from"node:fs";import{copyFile as zr,lstat as Xt,mkdir as ne,readFile as Me,realpath as je,rm as H,stat as dn,writeFile as Ue}from"node:fs/promises";import{createRequire as Jt}from"node:module";import{createServer as Ht}from"node:net";import U from"node:os";import l from"node:path";import{lstatSync as vt,readFileSync as xt,readdirSync as pr,realpathSync as kt}from"node:fs";import C from"node:path";import{globSync as Et}from"glob";var Rt=[".ssh",".tsh",".brev",".gnupg",".aws",".azure",".kube",".docker",".config",".npm",".pki",".terraform.d"],At=new Set(["certificatefile","controlpath","globalknownhostsfile","identityagent","identityfile","revokedhostkeys","userknownhostsfile"]);function oe(e){try{return kt.native(e).toLowerCase()}catch(r){return["ENOENT","ENOTDIR"].includes(r.code??"")||L({source:"sandbox:ssh-config",level:"warn",message:`Cannot canonicalize SSH ACL path: ${e}`,detail:r}),C.resolve(e).toLowerCase()}}a(oe,"pathKey");function gr(e,r){return r===e||r.startsWith(e.endsWith(C.sep)?e:`${e}${C.sep}`)}a(gr,"inside");function Wt(e){let r=[],n="",t;for(let o=0;o<e.length;o+=1){let i=e[o];if(i==="#"&&t===void 0)break;if(i===t){t=void 0;continue}if((i==='"'||i==="'")&&t===void 0){t=i;continue}let s=e[o+1];i==="\\"&&s!==void 0&&(['"',"'","\\"].includes(s)||t===void 0&&s===" ")?(n+=s,o+=1):/\s/.test(i)&&t===void 0?(n&&r.push(n),n=""):n+=i}return n&&r.push(n),r}a(Wt,"sshWords");function Ct(e,r,n){if(e.toLowerCase()==="none")return;if(["~","%d","${HOME}"].includes(e))return r;let t=e.replace(/^(?:~|%d|\$\{HOME\})[/\\]/,`${r}${C.sep}`);return C.isAbsolute(t)?C.resolve(t):n===void 0?void 0:C.resolve(n,t)}a(Ct,"sshPath");function An(e,r,n,t,o=0){let i=oe(e);if(t.has(i))return;if(o>=32){L({source:"sandbox:ssh-config",level:"warn",message:`SSH Include depth limit reached; dependencies beyond this config were not inspected: ${e}`});return}t.add(i);let s;try{s=xt(e,"utf8")}catch(d){if(d.code==="ENOENT")return;L({source:"sandbox:ssh-config",level:"warn",message:`Cannot inspect SSH configuration dependencies: ${e}`,detail:d});return}for(let d of s.split(/\r?\n/)){let c=Wt(d.replace(/^(\s*[^\s=]+)\s*=\s*/,"$1 ")),u=c.shift()?.toLowerCase();if(u!==void 0)for(let f of c){let p=Ct(f,r,u==="include"?C.join(r,".ssh"):void 0);if(p!==void 0)if(u==="include")for(let g of Et(p.replace(/\\/g,"/"),{nodir:!0}))n.push(g),An(g,r,n,t,o+1);else At.has(u)&&n.push(p)}}}a(An,"visitSshConfig");function de(e){let r=[];An(C.join(e,".ssh","config"),e,r,new Set);let n=oe(e),t=Rt.map(o=>C.join(e,o));for(let o of r){let i=C.relative(n,oe(o));i&&!i.startsWith(`..${C.sep}`)&&i!==".."&&!C.isAbsolute(i)&&t.push(C.join(e,i.split(C.sep)[0]))}return[...new Set(t.map(o=>C.resolve(o)))]}a(de,"windowsSandboxAclExclusions");function mr(e){let r=[];An(C.join(e,".ssh","config"),e,r,new Set);let n=[C.join(e,".ssh")];for(;n.length>0;){let t=n.pop();r.push(t);let o;try{if(vt(t).isSymbolicLink())continue;o=pr(t,{withFileTypes:!0})}catch(i){if(i.code==="ENOENT")continue;throw i}for(let i of o){if(i.isSymbolicLink())continue;let s=C.join(t,i.name);r.push(s),i.isDirectory()&&n.push(s)}}return[...new Set(r.filter(t=>gr(oe(e),oe(t))))]}a(mr,"windowsSandboxSshCleanupRoots");function Ee(e,r,n){let t=oe(r),o=n.flatMap(s=>[C.resolve(s).toLowerCase(),oe(s)]),i=e.flatMap(s=>oe(s)===t?pr(r,{withFileTypes:!0}).filter(d=>!d.isSymbolicLink()).map(d=>C.join(r,d.name)):[s]);return[...new Set(i)].filter(s=>![C.resolve(s).toLowerCase(),oe(s)].some(c=>o.some(u=>gr(u,c))))}a(Ee,"windowsSandboxAclRoots");import{fileURLToPath as _r,pathToFileURL as Yr}from"node:url";import{realpathSync as Pt,statSync as Nt}from"node:fs";import _t from"node:path";function Wn(e){let r=e.code;return r==="ENOENT"||r==="ENOTDIR"}a(Wn,"isMissingGitTrustPath");function br(e,r,n){try{let t=r(e).replaceAll("\\","/").replace(/\/+$/,"");return t===""?void 0:/^[A-Za-z]:$/.test(t)?`${t}/`:t}catch(t){if(n(t))return;throw t}}a(br,"normalizeGitSafeDirectoryRootImplementation");function Tt(e){return br(e,Pt,Wn)}a(Tt,"normalizeGitSafeDirectoryRoot");function Sr(e,r,n,t){try{let i=r(n.join(e,".git"));if(i.isDirectory()||i.isFile())return!0}catch(i){if(!t(i))throw i}if(!(n.basename(e).toLowerCase()===".git"||/[/\\]\.git[/\\]modules[/\\]/i.test(e)))return!1;try{return r(n.join(e,"HEAD")).isFile()}catch(i){if(t(i))return!1;throw i}}a(Sr,"isRepoBearingGitReadRootImplementation");function It(e){return Sr(e,Nt,_t,Wn)}a(It,"isRepoBearingGitReadRoot");function hr(e,r,n,t,o){let i=[];typeof e=="string"&&e!==""&&i.push(e);for(let c of n??[])o(c)&&i.push(c);i.push(...r??[]);let s=[],d=new Set;for(let c of i){if(s.length>=8)break;let u=t(c);if(u===void 0)continue;let f=u.toLowerCase();d.has(f)||(d.add(f),s.push(u))}return s}a(hr,"windowsGitTrustRootsImplementation");function vr(e,r,n){return hr(e,r,n,Tt,It)}a(vr,"windowsGitTrustRoots");function xr(e){if(e==="git_config_count")return"count";if(/^git_config_key_\d+$/.test(e))return"key";if(/^git_config_value_\d+$/.test(e))return"value"}a(xr,"gitConfigEnvKind");function Ot(e,r,n,t,o){let i=new Map,s=[],d,c=!1;for(let u=0;u<r;u+=1){if(e[u]!=="--env"||u+1>=r)continue;let f=e[u+1],p=f.indexOf("="),g=(p<0?f:f.slice(0,p)).toLowerCase(),w=n(g);if(w===void 0)continue;c=!0,s.push(u);let m=p<0?"":f.slice(p+1);if(w==="count"){let W=Number.parseInt(m,10);(d!==void 0||!Number.isSafeInteger(W)||W<0||String(W)!==m)&&t(),d=W;continue}let S=Number.parseInt(g.slice(`git_config_${w}_`.length),10),h=i.get(S)??{};(!Number.isSafeInteger(S)||S<0||h[w]!==void 0)&&t(),h[w]=m,i.set(S,h)}return o(i,s,d,c,t)}a(Ot,"parseGitConfigEnvironmentImplementation");function rn(){throw new Error("ASRT GIT_CONFIG environment has an unexpected shape.")}a(rn,"throwUnexpectedGitConfigShape");function kr(e,r,n,t,o){!t||n!==void 0&&e.size===n&&[...e].every(([d,c])=>d<n&&c.key!==void 0&&c.value!==void 0)||o();let s=[...e].map(([d,c])=>({slot:d,key:c.key,value:c.value}));return{argumentIndices:r,pairs:s,sawAny:t}}a(kr,"finishParsedGitConfigEnvironment");function Er(e,r){let n=[];for(let o of e)n.push({key:"safe.directory",value:o},{key:"safe.directory",value:`${o}/*`});n.push(...r);let t=n.flatMap((o,i)=>[`GIT_CONFIG_KEY_${i}=${o.key}`,`GIT_CONFIG_VALUE_${i}=${o.value}`]);return t.push(`GIT_CONFIG_COUNT=${n.length}`),t}a(Er,"gitSafeDirectoryAssignments");function yr(e,r){let n=[],t=new Set;for(let[o,i]of Object.entries(e)){if(i===void 0)continue;if(o===""||o.includes("=")||o.includes("\0")||i.includes("\0"))throw new Error(`Invalid ${r} environment entry.`);let s=o.toUpperCase();if(t.has(s))throw new Error(`Ambiguous ${r} environment variable: ${o}.`);t.add(s),n.push([o,i])}return n}a(yr,"validatedEnvironmentEntries");function Dt(e,r){let n=new Map,t=[],o,i=!1;for(let[u,f]of Object.entries(e)){let p=u.toLowerCase(),g=xr(p);if(g===void 0){t.push([u,f]);continue}if(i=!0,g==="count"){let S=Number.parseInt(f,10);(o!==void 0||!Number.isSafeInteger(S)||S<0||String(S)!==f)&&rn(),o=S;continue}let w=Number.parseInt(p.slice(`git_config_${g}_`.length),10),m=n.get(w)??{};(!Number.isSafeInteger(w)||w<0||m[g]!==void 0)&&rn(),m[g]=f,n.set(w,m)}let d=kr(n,[],o,i,rn).pairs.filter(u=>u.key.toLowerCase()!=="safe.directory").sort((u,f)=>u.slot-f.slot),c=Object.fromEntries(t);for(let u of Er(r,d)){let f=u.indexOf("=");c[u.slice(0,f)]=u.slice(f+1)}return c}a(Dt,"rewriteWindowsGitSafeDirectoryEnvironment");function Rr(e,r,n){let t=yr(e,"ASRT-controlled"),o=yr(r,"Windows target"),i=new Map;for(let s of t)i.set(s[0].toUpperCase(),s);for(let s of o){let d=s[0].toUpperCase();i.has(d)&&d!=="PATH"&&d!=="PATHEXT"||i.set(d,s)}return Dt(Object.fromEntries(i.values()),n)}a(Rr,"mergeWindowsSandboxTargetEnvironment");function Lt(e,r,n,t){let o=new Set(n.argumentIndices),i=[],s=!1;for(let d=0;d<e.length;d+=1)if(o.has(d)){if(!s){for(let c of t)i.push("--env",c);s=!0}d+=1}else i.push(e[d]);return n.sawAny||i.splice(r,0,...t.flatMap(d=>["--env",d])),i}a(Lt,"replaceGitConfigEnvironment");function Bt(e,r,n,t,o){let i=e.lastIndexOf("--");if(i<0)throw new Error("ASRT Windows wrapper omitted its child separator.");let s=n(e,i),d=s.pairs.filter(u=>u.key.toLowerCase()!=="safe.directory").sort((u,f)=>u.slot-f.slot),c=t(r,d);return o(e,i,s,c)}a(Bt,"rewriteWindowsGitSafeDirectoryArgvImplementation");function Ar(){return String.raw`
 const isMissingGitTrustPath = ${Wn.toString()};
 const normalizeGitSafeDirectoryRootImplementation = ${br.toString()};
 const normalizeGitSafeDirectoryRoot = (root) => (