@letrquan/book 0.2.0

package/dist/chunk-574C6MQR.js

@@ -0,0 +1,743 @@
+// src/settings.ts
+import { z } from "zod";
+var permissionRuleSchema = z.string().min(1);
+var sandboxSchema = z.object({
+  enabled: z.boolean().default(false),
+  failIfUnavailable: z.boolean().default(false),
+  autoAllowBashIfSandboxed: z.boolean().default(true),
+  excludedCommands: z.array(z.string()).default([]),
+  allowUnsandboxedCommands: z.boolean().default(true),
+  filesystem: z.object({
+    allowWrite: z.array(z.string()).default([]),
+    denyWrite: z.array(z.string()).default([]),
+    denyRead: z.array(z.string()).default([])
+  }).default({}),
+  network: z.object({
+    allowedDomains: z.array(z.string()).default([]),
+    deniedDomains: z.array(z.string()).default([])
+  }).default({})
+});
+var projectAllowRuleChoiceSchema = z.enum(["approved", "rejected"]);
+var permissionsSchema = z.object({
+  allow: z.array(permissionRuleSchema).default([]),
+  ask: z.array(permissionRuleSchema).default([]),
+  deny: z.array(permissionRuleSchema).default([]),
+  /**
+   * Decisions about `allow` rules the project layer declared. A project rule
+   * with no `approved` entry here never reaches the resolved allow list.
+   */
+  projectAllowRules: z.record(projectAllowRuleChoiceSchema).default({})
+});
+var hookEntrySchema = z.object({
+  /** Tool(specifier) pattern to filter which events trigger this hook. */
+  matcher: z.string().optional(),
+  /** Shell command to run (passed through system shell). */
+  command: z.string().min(1),
+  /** Extra environment variables for this hook. */
+  env: z.record(z.string()).default({})
+});
+var projectHookChoiceSchema = z.enum(["approved", "rejected"]);
+var HOOK_EVENTS = [
+  "SessionStart",
+  "SessionEnd",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "Stop",
+  "PreCompact",
+  "PostCompact",
+  "SubagentStart",
+  "SubagentStop",
+  /**
+   * Something a human should know about while nobody is watching: a run parked on
+   * a rejected credential, a budget crossing its ceiling, a refused spawn because
+   * the disk is nearly full. Wire ntfy/Slack/SMS here as an ordinary shell hook.
+   *
+   * Only `severity: 'alarm'` is meant to wake anyone; everything else is a line to
+   * tail. `hooksSchema` is generated from this array, so the schema cost is one
+   * entry.
+   */
+  "Notification"
+];
+var hooksSchema = z.object({
+  ...Object.fromEntries(HOOK_EVENTS.map((e) => [e, z.array(hookEntrySchema).default([])])),
+  /**
+   * Decisions about hook entries the checked-in project layer declared. An
+   * entry whose fingerprint has no `approved` record here never reaches the
+   * resolved hooks.
+   */
+  projectEntries: z.record(projectHookChoiceSchema).default({})
+});
+var retrySettingsSchema = z.object({
+  maxAttempts: z.number().int().min(0).max(15).default(10),
+  baseDelayMs: z.number().int().min(100).max(6e4).default(1e3),
+  maxDelayMs: z.number().int().min(100).max(3e5).default(3e4),
+  totalBudgetMs: z.number().int().min(0).max(6e5).default(0),
+  requestTimeoutMs: z.number().int().min(5e3).max(6e5).default(6e5),
+  streamStallTimeoutMs: z.number().int().min(5e3).max(12e4).default(2e4),
+  /**
+   * Stall ceiling while the model is thinking, which is a different regime.
+   *
+   * `streamStallTimeoutMs` is tuned for a chat: 20s of silence means something
+   * broke. But with adaptive thinking on — the default for every Opus and Sonnet
+   * model here, at `high` effort unless told otherwise — a long quiet stretch
+   * before the first token is the model working, not a fault. Applying the chat
+   * timeout to it cancels a healthy request and reports `stream_stall`.
+   */
+  thinkingStallTimeoutMs: z.number().int().min(1e4).max(18e5).default(9e5),
+  toolRetries: z.number().int().min(0).max(3).default(1),
+  watchdog: z.boolean().default(false),
+  /**
+   * How many times a turn may be re-sent after a transport fault that left the
+   * work intact — a stalled stream, a dropped socket.
+   *
+   * `maxAttempts` covers connection setup only; once a 200 response is streaming
+   * it is out of scope, so without this a single 20-second provider silence ended
+   * the run. Set to 0 to restore that behavior exactly.
+   */
+  streamReissueAttempts: z.number().int().min(0).max(10).default(3),
+  /**
+   * Separate allowance for continuing after the provider's output cap. A large
+   * generated file legitimately hits the cap on consecutive turns, and sharing
+   * the transport budget would leave nothing for a real socket drop afterwards.
+   */
+  outputCapContinuations: z.number().int().min(0).max(50).default(10)
+});
+var effortLevelSchema = z.enum(["low", "medium", "high", "xhigh", "max"]);
+var providerModelSchema = z.object({
+  label: z.string().optional(),
+  contextWindow: z.number().int().positive().optional(),
+  maxOutputTokens: z.number().int().positive().optional(),
+  /** Whether this model accepts image input. Unknown models remain optimistic. */
+  vision: z.boolean().optional(),
+  /**
+   * Entered by hand rather than returned by the endpoint's model-list API.
+   * Refreshing the catalog keeps these, since they exist precisely because
+   * discovery does not list them.
+   */
+  manual: z.boolean().optional(),
+  /** Mutation-tool preference for this model; defaults to a family-level prior. */
+  editFormat: z.enum(["patch", "replace", "whole"]).optional(),
+  effort: z.union([
+    z.literal(false),
+    z.object({
+      default: effortLevelSchema.optional(),
+      levels: z.array(effortLevelSchema).optional()
+    })
+  ]).optional()
+});
+var providerConfigSchema = z.object({
+  type: z.enum(["openai", "anthropic"]).default("openai"),
+  baseURL: z.string().min(1).optional(),
+  baseUrl: z.string().min(1).optional(),
+  apiKey: z.string().min(1).optional(),
+  models: z.record(providerModelSchema).default({})
+});
+var continuationSettingsSchema = z.object({
+  enabled: z.boolean().default(false),
+  /** Consecutive host-authored continuations before the run stops regardless. */
+  maxConsecutive: z.number().int().min(1).max(1e3).default(50),
+  /**
+   * Identical progress witnesses in a row before the run stops as no-progress.
+   * Minimum 1: a 0 here would fire on the first boundary, before any witness
+   * exists, and label a run that never got a chance to spin as spinning.
+   */
+  noProgressLimit: z.number().int().min(1).max(20).default(3),
+  /**
+   * Consecutive turns in which EVERY tool call was refused before the run stops.
+   *
+   * Enforced even when `enabled` is false, deliberately. The spin it catches
+   * predates continuation and needs no continuation to happen: a headless run in
+   * the default permission mode answers every prompt `deny`, so the model can
+   * re-issue a refused call forever while `toolCalls.length > 0` keeps the
+   * turn-end gate from ever firing. None of the existing anti-loop signals see it
+   * either — the repeated-failure breaker ignores anything that is not `error`,
+   * and `toolCallStats.failures` excludes `blocked` by construction.
+   *
+   * 0 disables the guard.
+   */
+  blockedToolTurnLimit: z.number().int().min(0).max(100).default(3),
+  /** Turns between host-authored work-state messages; 0 disables them. */
+  planRefreshTurns: z.number().int().min(0).max(500).default(25),
+  /** Wall-clock ceiling for one continued run; 0 means no ceiling. */
+  maxWallClockMs: z.number().int().min(0).default(0)
+});
+var memorySettingsSchema = z.object({
+  enabled: z.boolean().default(true),
+  autoSave: z.boolean().default(true),
+  requireApproval: z.boolean().default(true)
+});
+var agentSettingsSchema = z.object({
+  mode: z.enum(["adaptive", "manual", "off"]).default("adaptive"),
+  maxConcurrent: z.number().int().min(1).max(16).default(3),
+  maxSpawned: z.number().int().min(1).max(64).default(8),
+  maxDepth: z.literal(1).default(1),
+  persist: z.boolean().default(true),
+  includeUntrackedInSnapshot: z.boolean().default(true),
+  telemetry: z.boolean().default(true),
+  retentionDays: z.number().int().min(1).max(3650).default(30),
+  checks: z.record(z.union([z.string().min(1), z.array(z.string().min(1)).min(1)])).default({}),
+  /**
+   * Wall-clock ceiling for one `Check` run. The 120s default suits a focused
+   * suite; a full `npm test` on a large repository routinely exceeds it, and a
+   * check that always times out is worse than no check because the timeout was
+   * reported as a failing suite. Raise it per project rather than per invocation.
+   */
+  checkTimeoutMs: z.number().int().min(1e3).max(72e5).default(12e4),
+  /**
+   * Simultaneous agent worktrees per repository; 0 disables the check.
+   *
+   * Nothing reclaims a worktree automatically outside the TUI, and the store's
+   * retention sweep runs once at startup with a 30-day default — so on a long
+   * unattended run the count only grows. Sized above `maxConcurrent` so ordinary
+   * fan-out is unaffected and only accumulation trips it.
+   */
+  maxWorktrees: z.number().int().min(0).max(256).default(24),
+  /**
+   * Re-drive agents that were interrupted by process death on the next start.
+   *
+   * A restart otherwise converts the whole pending backlog into terminal records
+   * nothing picks up, silently losing hours of child work on a wide fan-out. The
+   * re-drive is contained: explorers are read-only and patchers/validators run in
+   * their own worktree, so nothing reaches the parent workspace without the usual
+   * evidence gate. Only `process_exit` interruptions qualify — a user stop stays
+   * stopped.
+   */
+  resumeInterrupted: z.boolean().default(true),
+  /**
+   * Refuse a new worktree when free disk would fall below this; 0 disables.
+   * Worktrees share the filesystem with the workspace, so exhausting it breaks
+   * the root agent's own Edit and Bash, not just the child's.
+   */
+  minFreeDiskBytes: z.number().int().min(0).default(2 * 1024 * 1024 * 1024),
+  profiles: z.record(
+    z.object({
+      model: z.string().min(1).optional(),
+      effort: effortLevelSchema.optional(),
+      maxTurns: z.number().int().min(1).optional(),
+      color: z.string().optional()
+    })
+  ).default({}),
+  ui: z.object({ enabled: z.boolean().default(true) }).default({}),
+  routing: z.object({
+    inlineSearchBudget: z.number().int().min(1).max(20).default(3),
+    exploreReminder: z.boolean().default(true)
+  }).default({}),
+  forwardTextEvents: z.boolean().default(false)
+});
+var toolDiscoverySettingsSchema = z.object({
+  mode: z.enum(["auto", "eager", "deferred"]).default("auto"),
+  eagerToolCount: z.number().int().min(1).max(100).default(10),
+  schemaTokenBudget: z.number().int().min(1e3).max(1e5).default(8e3),
+  maxLoadedTools: z.number().int().min(1).max(100).default(15),
+  searchLimit: z.number().int().min(1).max(5).default(5)
+});
+var toolExecutionSettingsSchema = z.object({
+  /** Shared across the root loop and managed children for parallel-safe tools. */
+  maxConcurrent: z.number().int().min(1).max(8).default(4)
+});
+var observabilitySettingsSchema = z.object({
+  /** Persist a per-tool-call JSONL record for `book tool-stats`. */
+  toolTelemetry: z.boolean().default(true),
+  /**
+   * Default reporting window (in days) for `book tool-stats` and the target for
+   * `book tool-stats --prune`. Disk use is bounded by size-based log rotation;
+   * records are only deleted when they rotate out or are explicitly pruned.
+   */
+  toolTelemetryRetentionDays: z.number().int().min(1).max(3650).default(30)
+});
+var mcpProjectServerChoiceSchema = z.object({
+  /** Hash of the server's command/args/env at decision time; a mismatch re-prompts. */
+  fingerprint: z.string().min(1),
+  choice: z.enum(["approved", "rejected"])
+});
+var mcpSettingsSchema = z.object({
+  /**
+   * Per-server trust decisions for workspace `.mcp.json` declarations.
+   * User-global servers (<BOOK_HOME>/.book/mcp.json) never require approval.
+   */
+  projectServers: z.record(mcpProjectServerChoiceSchema).default({})
+});
+var projectCommandChoiceSchema = z.object({
+  /** Digest of the shell the body substitutes at decision time; a mismatch re-prompts. */
+  fingerprint: z.string().min(1),
+  choice: z.enum(["approved", "rejected"])
+});
+var commandSettingsSchema = z.object({
+  /**
+   * Per-command trust decisions for `<workspace>/.book/commands/*.md` files
+   * that substitute shell into their prompt. That substitution runs outside the
+   * permission system and outside the sandbox, so a repository-controlled file
+   * needs a decision before it runs. User-global commands
+   * (<BOOK_HOME>/commands) were written by the user and never require one.
+   */
+  projectCommands: z.record(projectCommandChoiceSchema).default({})
+});
+var uiSettingsSchema = z.object({
+  /** Show provider-native and embedded model reasoning in the interactive transcript. */
+  showThinking: z.boolean().default(true),
+  /** Play the full-screen fire sequence on a newly created interactive startup session. */
+  startupAnimation: z.boolean().default(true)
+});
+var skillActivationSchema = z.enum(["auto", "name-only", "manual", "off"]);
+var skillExecutionSchema = z.enum(["inherit", "ask", "deny"]);
+var skillSettingsSchema = z.object({
+  /** Emergency switch that removes skill prompt and runtime effects without deleting packages. */
+  enabled: z.boolean().default(true),
+  /** Per-skill visibility overrides keyed by the skill's declared name. */
+  overrides: z.record(skillActivationSchema).default({}),
+  /** Per-skill activation consent policy. Tool calls still use the normal permission system. */
+  execution: z.record(skillExecutionSchema).default({})
+});
+var compactStrategySchema = z.literal("summary");
+var bookSettingsSchema = z.object({
+  model: z.string().optional(),
+  /** Default strategy used to reduce historical conversation context. */
+  compactStrategy: compactStrategySchema.optional(),
+  /** Optional model used only to generate historical conversation checkpoints. */
+  compactModel: z.string().min(1).optional(),
+  /** Max agent turns per user message. Omit for unlimited. */
+  maxTurns: z.number().int().min(1).optional(),
+  maxTokens: z.number().int().min(1e3).optional(),
+  effort: effortLevelSchema.optional(),
+  /** TUI color theme: apple (default), dark, light, auto, a bundled palette, or a custom theme filename. */
+  theme: z.string().min(1).optional(),
+  /**
+   * The shell the Bash tool spawns: `bash`, `pwsh`, `powershell`, `cmd`, `sh`,
+   * or an executable path. Honoured from the user-global layer, an explicit
+   * `--settings` document, or `BOOK_SHELL` only: a workspace file cannot pick
+   * the program every command is handed to.
+   */
+  shell: z.string().min(1).optional(),
+  ui: uiSettingsSchema.default({}),
+  skills: skillSettingsSchema.default({}),
+  autoCompactEnabled: z.boolean().optional(),
+  /** Permission mode used by each host when no invocation-specific mode is supplied. */
+  defaultMode: z.enum(["default", "acceptEdits", "plan", "auto", "dontAsk", "bypassPermissions"]).optional(),
+  disableBypassPermissionsMode: z.boolean().optional(),
+  additionalDirectories: z.array(z.string()).default([]),
+  env: z.record(z.string()).default({}),
+  provider: z.record(providerConfigSchema).default({}),
+  permissions: permissionsSchema.default({}),
+  sandbox: sandboxSchema.default({}),
+  hooks: hooksSchema.default({}),
+  retry: retrySettingsSchema.default({}),
+  memory: memorySettingsSchema.default({}),
+  continuation: continuationSettingsSchema.default({}),
+  agents: agentSettingsSchema.default({}),
+  toolDiscovery: toolDiscoverySettingsSchema.default({}),
+  toolExecution: toolExecutionSettingsSchema.default({}),
+  observability: observabilitySettingsSchema.default({}),
+  mcp: mcpSettingsSchema.default({}),
+  commands: commandSettingsSchema.default({})
+});
+var DEFAULT_SETTINGS = {
+  compactStrategy: "summary",
+  permissions: { allow: [], ask: [], deny: [], projectAllowRules: {} },
+  sandbox: {
+    enabled: false,
+    failIfUnavailable: false,
+    autoAllowBashIfSandboxed: true,
+    excludedCommands: [],
+    allowUnsandboxedCommands: true,
+    filesystem: { allowWrite: [], denyWrite: [], denyRead: [] },
+    network: { allowedDomains: [], deniedDomains: [] }
+  },
+  hooks: {
+    SessionStart: [],
+    SessionEnd: [],
+    UserPromptSubmit: [],
+    PreToolUse: [],
+    PostToolUse: [],
+    Stop: [],
+    PreCompact: [],
+    PostCompact: [],
+    SubagentStart: [],
+    SubagentStop: [],
+    Notification: [],
+    projectEntries: {}
+  },
+  additionalDirectories: [],
+  env: {},
+  provider: {},
+  ui: { showThinking: true, startupAnimation: true },
+  skills: { enabled: true, overrides: {}, execution: {} },
+  retry: {
+    maxAttempts: 10,
+    baseDelayMs: 1e3,
+    maxDelayMs: 3e4,
+    totalBudgetMs: 0,
+    requestTimeoutMs: 6e5,
+    streamStallTimeoutMs: 2e4,
+    thinkingStallTimeoutMs: 9e5,
+    toolRetries: 1,
+    watchdog: false,
+    streamReissueAttempts: 3,
+    outputCapContinuations: 10
+  },
+  continuation: {
+    enabled: false,
+    maxConsecutive: 50,
+    noProgressLimit: 3,
+    blockedToolTurnLimit: 3,
+    planRefreshTurns: 25,
+    maxWallClockMs: 0
+  },
+  memory: {
+    enabled: true,
+    autoSave: true,
+    requireApproval: true
+  },
+  agents: {
+    mode: "adaptive",
+    maxConcurrent: 3,
+    maxSpawned: 8,
+    maxDepth: 1,
+    persist: true,
+    includeUntrackedInSnapshot: true,
+    telemetry: true,
+    retentionDays: 30,
+    checks: {},
+    checkTimeoutMs: 12e4,
+    maxWorktrees: 24,
+    resumeInterrupted: true,
+    minFreeDiskBytes: 2 * 1024 * 1024 * 1024,
+    profiles: {},
+    ui: { enabled: true },
+    routing: { inlineSearchBudget: 3, exploreReminder: true },
+    forwardTextEvents: false
+  },
+  toolDiscovery: {
+    mode: "auto",
+    eagerToolCount: 10,
+    schemaTokenBudget: 8e3,
+    maxLoadedTools: 15,
+    searchLimit: 5
+  },
+  toolExecution: {
+    maxConcurrent: 4
+  },
+  observability: {
+    toolTelemetry: true,
+    toolTelemetryRetentionDays: 30
+  },
+  mcp: {
+    projectServers: {}
+  },
+  commands: {
+    projectCommands: {}
+  }
+};
+
+// src/settings-repository.ts
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeSync
+} from "fs";
+import { basename, dirname, join } from "path";
+
+// src/cli/utils.ts
+function getNestedValue(obj, path) {
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current === null || current === void 0 || typeof current !== "object") return void 0;
+    current = current[part];
+  }
+  return current;
+}
+function setNestedValue(obj, path, value) {
+  const parts = path.split(".");
+  let current = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    if (!(parts[i] in current) || typeof current[parts[i]] !== "object" || current[parts[i]] === null) {
+      current[parts[i]] = {};
+    }
+    current = current[parts[i]];
+  }
+  current[parts[parts.length - 1]] = value;
+}
+function deleteNestedValue(obj, path) {
+  const parts = typeof path === "string" ? path.split(".") : [...path];
+  const ancestors = [];
+  let current = obj;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const key = parts[i];
+    if (!Object.prototype.hasOwnProperty.call(current, key)) return false;
+    const next = current[key];
+    if (typeof next !== "object" || next === null || Array.isArray(next)) return false;
+    ancestors.push({ parent: current, key });
+    current = next;
+  }
+  const leaf = parts[parts.length - 1];
+  if (!Object.prototype.hasOwnProperty.call(current, leaf)) return false;
+  delete current[leaf];
+  for (let i = ancestors.length - 1; i >= 0; i--) {
+    const { parent, key } = ancestors[i];
+    const child = parent[key];
+    if (typeof child === "object" && child !== null && !Array.isArray(child) && Object.keys(child).length === 0) {
+      delete parent[key];
+    } else {
+      break;
+    }
+  }
+  return true;
+}
+function parseNumericFlag(raw, flag, opts = {}) {
+  if (raw === void 0 || raw === null || raw === "") return void 0;
+  const text = String(raw).trim();
+  const value = opts.integer ? Number.parseInt(text, 10) : Number.parseFloat(text);
+  if (!Number.isFinite(value) || !/^[+-]?(\d+\.?\d*|\.\d+)$/.test(text)) {
+    throw new Error(`${flag} expects a number, but received "${text}".`);
+  }
+  if (opts.integer && text.includes(".")) {
+    throw new Error(`${flag} expects a whole number, but received "${text}".`);
+  }
+  const min = opts.min ?? 0;
+  if (value < min) {
+    throw new Error(`${flag} must be at least ${min}, but received "${text}".`);
+  }
+  return value;
+}
+
+// src/settings-redaction.ts
+var REDACTED_SECRET = "*** (stored)";
+function redactProviderRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const clone = structuredClone(value);
+  if ("apiKey" in clone) clone.apiKey = REDACTED_SECRET;
+  return clone;
+}
+function redactProviderMap(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const clone = structuredClone(value);
+  for (const [id, provider] of Object.entries(clone)) clone[id] = redactProviderRecord(provider);
+  return clone;
+}
+var REMOVED_SECRET_BEARING_BLOCKS = ["auth"];
+function redactSettingValue(path, value) {
+  const parts = path.split(".");
+  if (parts[0] && REMOVED_SECRET_BEARING_BLOCKS.includes(parts[0])) return REDACTED_SECRET;
+  if (parts[0] !== "provider") return value;
+  if (parts.length === 1) return redactProviderMap(value);
+  if (parts.length === 2) return redactProviderRecord(value);
+  return parts[parts.length - 1] === "apiKey" ? REDACTED_SECRET : value;
+}
+function redactSettingsForDisplay(value) {
+  if (!value || typeof value !== "object") return value;
+  const clone = structuredClone(value);
+  clone.provider = redactProviderMap(clone.provider);
+  for (const key of REMOVED_SECRET_BEARING_BLOCKS) {
+    if (clone[key] !== void 0) clone[key] = REDACTED_SECRET;
+  }
+  return clone;
+}
+
+// src/settings-repository.ts
+var SETTINGS_TOP_LEVEL_KEYS = Object.freeze(Object.keys(bookSettingsSchema.shape).sort());
+function formatSettingsKeyHelp(heading = "Supported top-level settings:") {
+  return `${heading}
+${SETTINGS_TOP_LEVEL_KEYS.map((key) => `  ${key}`).join("\n")}`;
+}
+function issueDiagnostic(path, issue) {
+  return {
+    path,
+    issuePath: issue.path.join("."),
+    message: issue.message
+  };
+}
+function safeMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function readSettingsDocument(path) {
+  if (!existsSync(path)) return { status: "absent", path };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf-8"));
+  } catch (error) {
+    return { status: "malformed", path, error: safeMessage(error) };
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { status: "non-object", path, error: "Settings must contain a JSON object." };
+  }
+  return { status: "valid", path, document: parsed };
+}
+function writeFileAtomic(path, contents) {
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true });
+  const temporaryPath = join(
+    directory,
+    `.${basename(path)}.${process.pid}.${crypto.randomUUID()}.tmp`
+  );
+  let descriptor;
+  try {
+    descriptor = openSync(temporaryPath, "wx", 384);
+    writeSync(descriptor, contents, void 0, "utf-8");
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    descriptor = void 0;
+    renameSync(temporaryPath, path);
+  } catch (error) {
+    if (descriptor !== void 0) closeSync(descriptor);
+    try {
+      unlinkSync(temporaryPath);
+    } catch {
+    }
+    throw error;
+  }
+}
+function validateTopLevelKeys(path, document) {
+  const supported = new Set(SETTINGS_TOP_LEVEL_KEYS);
+  return Object.keys(document).filter((key) => !supported.has(key)).map((key) => ({
+    path,
+    issuePath: key,
+    message: `Unknown top-level setting. Supported keys: ${SETTINGS_TOP_LEVEL_KEYS.join(", ")}`
+  }));
+}
+var SettingsRepository = class {
+  constructor(path, options = {}) {
+    this.path = path;
+    this.writeAtomic = options.writeAtomic ?? writeFileAtomic;
+  }
+  path;
+  writeAtomic;
+  read() {
+    return readSettingsDocument(this.path);
+  }
+  set(values) {
+    return this.mutate((candidate) => {
+      for (const [key, value] of Object.entries(values)) setNestedValue(candidate, key, value);
+    }, values);
+  }
+  remove(paths) {
+    return this.mutate((candidate) => {
+      for (const path of paths) deleteNestedValue(candidate, path.split("."));
+    }, {});
+  }
+  update(mutation, displayValues = {}) {
+    return this.mutate(mutation, displayValues);
+  }
+  mutate(mutation, values) {
+    let lock;
+    try {
+      lock = this.acquireLock();
+      return this.mutateLocked(mutation, values);
+    } catch (error) {
+      return {
+        ok: false,
+        path: this.path,
+        diagnostics: [{ path: this.path, message: safeMessage(error) }]
+      };
+    } finally {
+      if (lock !== void 0) this.releaseLock(lock);
+    }
+  }
+  acquireLock() {
+    mkdirSync(dirname(this.path), { recursive: true });
+    const lockPath = `${this.path}.lock`;
+    for (let attempt = 0; attempt < 50; attempt++) {
+      try {
+        return openSync(lockPath, "wx", 384);
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+        try {
+          if (Date.now() - statSync(lockPath).mtimeMs > 1e4) unlinkSync(lockPath);
+        } catch {
+        }
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+      }
+    }
+    throw new Error(`Timed out waiting for settings lock: ${lockPath}`);
+  }
+  releaseLock(descriptor) {
+    closeSync(descriptor);
+    try {
+      unlinkSync(`${this.path}.lock`);
+    } catch {
+    }
+  }
+  mutateLocked(mutation, values) {
+    const source = this.read();
+    if (source.status === "malformed" || source.status === "non-object") {
+      return {
+        ok: false,
+        path: this.path,
+        diagnostics: [{ path: this.path, message: source.error }]
+      };
+    }
+    const candidate = structuredClone(source.status === "valid" ? source.document : {});
+    try {
+      mutation(candidate);
+    } catch (error) {
+      return {
+        ok: false,
+        path: this.path,
+        diagnostics: [{ path: this.path, message: safeMessage(error) }]
+      };
+    }
+    const keyDiagnostics = validateTopLevelKeys(this.path, candidate);
+    const validation = bookSettingsSchema.safeParse(candidate);
+    const diagnostics = [
+      ...keyDiagnostics,
+      ...validation.success ? [] : validation.error.issues.map((issue) => issueDiagnostic(this.path, issue))
+    ];
+    if (diagnostics.length > 0) return { ok: false, path: this.path, diagnostics };
+    try {
+      const changed = source.status !== "valid" || JSON.stringify(source.document) !== JSON.stringify(candidate);
+      if (changed) this.writeAtomic(this.path, JSON.stringify(candidate, null, 2) + "\n");
+      return {
+        ok: true,
+        path: this.path,
+        document: candidate,
+        changed,
+        values: Object.fromEntries(
+          Object.entries(values).map(([key, value]) => [key, redactSettingValue(key, value)])
+        )
+      };
+    } catch (error) {
+      return {
+        ok: false,
+        path: this.path,
+        diagnostics: [{ path: this.path, message: safeMessage(error) }]
+      };
+    }
+  }
+};
+function formatSettingsDiagnostics(diagnostics) {
+  return diagnostics.map((diagnostic) => {
+    const location = diagnostic.issuePath ? `${diagnostic.path} (${diagnostic.issuePath})` : diagnostic.path;
+    return `${location}: ${diagnostic.message}`;
+  }).join("\n");
+}
+
+export {
+  projectAllowRuleChoiceSchema,
+  projectHookChoiceSchema,
+  HOOK_EVENTS,
+  effortLevelSchema,
+  providerConfigSchema,
+  mcpProjectServerChoiceSchema,
+  projectCommandChoiceSchema,
+  bookSettingsSchema,
+  DEFAULT_SETTINGS,
+  getNestedValue,
+  setNestedValue,
+  parseNumericFlag,
+  redactSettingValue,
+  redactSettingsForDisplay,
+  SETTINGS_TOP_LEVEL_KEYS,
+  formatSettingsKeyHelp,
+  readSettingsDocument,
+  writeFileAtomic,
+  SettingsRepository,
+  formatSettingsDiagnostics
+};
+//# sourceMappingURL=chunk-574C6MQR.js.map